Initial snapshot: Aliro applet, harness, Nucleo NFC10A1 reader port

Three components, all bench-validated to varying depths:

- applet/: CSA Aliro v1.0 Java Card applet for J3R180. AUTH0 + AUTH1
  expedited-standard flow end-to-end green via PC/SC bench reader
  (aliro-bench-test). Userland AES-256-GCM and HMAC-SHA-256 layered
  on top of J3R180's primitives because the card lacks both natively.
  P-256 curve params seeded explicitly per J3R180's quirk.

- harness/: Python orchestrator (aliro-trustgen, aliro-personalize,
  aliro-bench-test) for trust-bundle generation, card personalization
  via PersonalizationApplet, and PC/SC AUTH0+AUTH1 transactions. 126
  pytest cases passing.

- reader/STM32CubeExpansion_ALIRO_V1_0_0/: ST X-CUBE-ALIRO V1.0.0
  with our NFC10A1 port (NUCLEO-U545RE-Q + X-NUCLEO-NFC10A1, ST25R200
  shared with NFC09A1). nfc10-only/ project, NFC10A1 BSP shim,
  ALIRO_TRUST_OVERRIDE include into vendor's provisioning.c, and an
  ALIRO_APDU_TRACE wrapper around demoTransceiveBlocking. Boots,
  detects the J3R180, completes SELECT + AUTH0; AUTH1 currently fails
  with RFAL ERR_PROTO (0xB) — under investigation, see
  docs/plans/2026-04-20-nucleo-nfc10a1-port.md and bench-notes/.

Excluded: x-cube-aliro.zip vendor archive, harness/.venv, build dirs,
generated aliro_trust.h (contains private reader scalar), all PEMs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

reader/bench-notes/nfc10a1-j3r180-auth1-trust-mismatch.log

@@ -0,0 +1,405 @@
+
+-------------End of NFC demoAPDU --------- 
+NFCA Passive ISO-DEP device found. UID: 0489255AF21890
+ACWG_initSessionContext()
+retval=ACWG_OK
+
+
+ **************************************
+                -- SELECT --
+Returned 25 bytes
+Two last values are: 90 00
+
+Supported protocol version: 0x0100
+OK
+
+
+ **************************************
+                -- AUTH0 --
+-- USING Endpoint PubKey --
+-- STD TRANSACTION REQUESTED --
+ACWG_generateAUTH0CommandPayload()
+retval=ACWG_OK
+ACWG_generateAUTH0CommandPayload() - OK
+
+Generate AUTH0 DATA
+
+Sending AUTH0 APDU
+Returned 69 bytes
+Two last values are: 90 00
+ACWG_processAUTH0ResponsePayload()
+retval=ACWG_OK
+ACWG_processAUTH0ResponsePayload() - OK
+
+
+ **************************************
+                -- AUTH1 --
+ACWG_generateAUTH1CommandPayload()
+retval=ACWG_OK
+ACWG_generateAUTH1CommandPayload() - OK
+
+Generate AUTH1 DATA
+
+Sending AUTH1 APDU
+Returned 2 bytes
+Two last values are: 6a 80
+Error code: 6A 80
+
+DOOR OPERATION FAILED
+AliroPort_TRANSACTION_FAILURE
+ACWG_prepareEphemeralKeypairAndTransactionId()
+retval=ACWG_OK
+
+-------------End of NFC demoAPDU --------- 
+NFCA Passive ISO-DEP device found. UID: 0489255AF21890
+ACWG_initSessionContext()
+retval=ACWG_OK
+
+
+ **************************************
+                -- SELECT --
+Returned 25 bytes
+Two last values are: 90 00
+
+Supported protocol version: 0x0100
+OK
+
+
+ **************************************
+                -- AUTH0 --
+-- USING Endpoint PubKey --
+-- STD TRANSACTION REQUESTED --
+ACWG_generateAUTH0CommandPayload()
+retval=ACWG_OK
+ACWG_generateAUTH0CommandPayload() - OK
+
+Generate AUTH0 DATA
+
+Sending AUTH0 APDU
+Returned 69 bytes
+Two last values are: 90 00
+ACWG_processAUTH0ResponsePayload()
+retval=ACWG_OK
+ACWG_processAUTH0ResponsePayload() - OK
+
+
+ **************************************
+                -- AUTH1 --
+ACWG_generateAUTH1CommandPayload()
+retval=ACWG_OK
+ACWG_generateAUTH1CommandPayload() - OK
+
+Generate AUTH1 DATA
+
+Sending AUTH1 APDU
+Returned 2 bytes
+Two last values are: 6a 80
+Error code: 6A 80
+
+DOOR OPERATION FAILED
+AliroPort_TRANSACTION_FAILURE
+ACWG_prepareEphemeralKeypairAndTransactionId()
+retval=ACWG_OK
+
+-------------End of NFC demoAPDU --------- 
+NFCA Passive ISO-DEP device found. UID: 0489255AF21890
+ACWG_initSessionContext()
+retval=ACWG_OK
+
+
+ **************************************
+                -- SELECT --
+Returned 25 bytes
+Two last values are: 90 00
+
+Supported protocol version: 0x0100
+OK
+
+
+ **************************************
+                -- AUTH0 --
+-- USING Endpoint PubKey --
+-- STD TRANSACTION REQUESTED --
+ACWG_generateAUTH0CommandPayload()
+retval=ACWG_OK
+ACWG_generateAUTH0CommandPayload() - OK
+
+Generate AUTH0 DATA
+
+Sending AUTH0 APDU
+Returned 69 bytes
+Two last values are: 90 00
+ACWG_processAUTH0ResponsePayload()
+retval=ACWG_OK
+ACWG_processAUTH0ResponsePayload() - OK
+
+
+ **************************************
+                -- AUTH1 --
+ACWG_generateAUTH1CommandPayload()
+retval=ACWG_OK
+ACWG_generateAUTH1CommandPayload() - OK
+
+Generate AUTH1 DATA
+
+Sending AUTH1 APDU
+Returned 2 bytes
+Two last values are: 6a 80
+Error code: 6A 80
+
+DOOR OPERATION FAILED
+AliroPort_TRANSACTION_FAILURE
+ACWG_prepareEphemeralKeypairAndTransactionId()
+retval=ACWG_OK
+
+-------------End of NFC demoAPDU --------- 
+NFCA Passive ISO-DEP device found. UID: 0489255AF21890
+ACWG_initSessionContext()
+retval=ACWG_OK
+
+
+ **************************************
+                -- SELECT --
+Returned 25 bytes
+Two last values are: 90 00
+
+Supported protocol version: 0x0100
+OK
+
+
+ **************************************
+                -- AUTH0 --
+-- USING Endpoint PubKey --
+-- STD TRANSACTION REQUESTED --
+ACWG_generateAUTH0CommandPayload()
+retval=ACWG_OK
+ACWG_generateAUTH0CommandPayload() - OK
+
+Generate AUTH0 DATA
+
+Sending AUTH0 APDU
+Returned 69 bytes
+Two last values are: 90 00
+ACWG_processAUTH0ResponsePayload()
+retval=ACWG_OK
+ACWG_processAUTH0ResponsePayload() - OK
+
+
+ **************************************
+                -- AUTH1 --
+ACWG_generateAUTH1CommandPayload()
+retval=ACWG_OK
+ACWG_generateAUTH1CommandPayload() - OK
+
+Generate AUTH1 DATA
+
+Sending AUTH1 APDU
+Returned 2 bytes
+Two last values are: 6a 80
+Error code: 6A 
+
+-------------End of NFC demoAPDU --------- 
+NFCA Passive ISO-DEP device found. UID: 0489255AF21890
+ACWG_initSessionContext()
+retval=ACWG_OK
+
+
+ **************************************
+                -- SELECT --
+Returned 25 bytes
+Two last values are: 90 00
+
+Supported protocol version: 0x0100
+OK
+
+
+ **************************************
+                -- AUTH0 --
+-- USING Endpoint PubKey --
+-- STD TRANSACTION REQUESTED --
+ACWG_generateAUTH0CommandPayload()
+retval=ACWG_OK
+ACWG_generateAUTH0CommandPayload() - OK
+
+Generate AUTH0 DATA
+
+Sending AUTH0 APDU
+Returned 69 bytes
+Two last values are: 90 00
+ACWG_processAUTH0ResponsePayload()
+retval=ACWG_OK
+ACWG_processAUTH0ResponsePayload() - OK
+
+
+ **************************************
+                -- AUTH1 --
+ACWG_generateAUTH1CommandPayload()
+retval=ACWG_OK
+ACWG_generateAUTH1CommandPayload() - OK
+
+Generate AUTH1 DATA
+
+Sending AUTH1 APDU
+Returned 2 bytes
+Two last values are: 6a 80
+Error code: 6A 80
+
+DOOR OPERATION FAILED
+AliroPort_TRANSACTION_FAILURE
+ACWG_prepareEphemeralKeypairAndTransactionId()
+retval=ACWG_OK
+
+-------------End of NFC demoAPDU --------- 
+Received char ?
+
+
+********************** STATUS ***********************
+	Key Slot: not active
+	Transaction: STANDARD
+	Exchange: auto - based on signaling bitmap
+	Stepup: auto - based on signaling bitmap
+	Load Cert: certificate not available
+	Not Verify Key: not active
+	Authentication Policy: User device setting
+	Vendor Specific Extension: not active
+	Protocol version: 0x0100
+	NFC FLOW: ENABLED
+	BLE FLOW: ENABLED
+	BLE-RKE FLOW: ENABLED
+	BLE-UWB FLOW: ENABLED
+	Access element is set to: matter1
+*****************************************************
+PROVISIONING_JSON_START_ADDRESS: 0x0807C000
+PROVISIONING_START_ADDRESS: 0x0807E000
+	verbosity level set to: 5
+********************* COMMANDS **********************
+	0-6 Set verbosity level
+	? - System status and commands list
+	a - Set Authentication Policy
+	b - Toggle Vendor Specific Extension
+	f - Toggle Fast transaction
+	k - Toggle Key Slot activation
+	e - Toggle EXCHANGE
+	l - Set LOAD_CERT
+	u - Toggle STEPUP
+	v - Toggle Not Verify Key
+	d - Ranging Suspend/Resume Action (not active work in progress)
+	p - Provisioning status
+	s - Save default provisioning info
+	c - Convert provisioning info from json
+	w - NFC wakeup mode (LPCD)
+	n - Switch NFC only / NFC+BLE / NFC+BLE+UWB
+	z - Save last access credential PuBK
+	'date:' - Set system date
+	'time:' - Set system time
+	'settime-' - Set system date and time
+	'setRDiden-' - Set reader group identifier and sub identifier
+	'setRDprvk-' - Set reader private key
+	'setRDpubk-' - Set reader public key
+	'setRDgrrk-' - Set reader group resolving key
+	'setCrIspk-' - Set Credential issuer public key
+	'setDEVpbk-' - Set reader access credential public key
+	'setAccElm-' - Set access element name for stepup (session)
+	r - system restart
+	! - system pause
+*****************************************************
+NFCA Passive ISO-DEP device found. UID: 0489255AF21890
+ACWG_initSessionContext()
+retval=ACWG_OK
+
+
+ **************************************
+                -- SELECT --
+Returned 25 bytes
+Two last values are: 90 00
+
+Supported protocol version: 0x0100
+OK
+
+
+ **************************************
+                -- AUTH0 --
+-- USING Endpoint PubKey --
+-- STD TRANSACTION REQUESTED --
+ACWG_generateAUTH0CommandPayload()
+retval=ACWG_OK
+ACWG_generateAUTH0CommandPayload() - OK
+
+Generate AUTH0 DATA
+
+Sending AUTH0 APDU
+Returned 69 bytes
+Two last values are: 90 00
+ACWG_processAUTH0ResponsePayload()
+retval=ACWG_OK
+ACWG_processAUTH0ResponsePayload() - OK
+
+
+ **************************************
+                -- AUTH1 --
+ACWG_generateAUTH1CommandPayload()
+retval=ACWG_OK
+ACWG_generateAUTH1CommandPayload() - OK
+
+Generate AUTH1 DATA
+
+Sending AUTH1 APDU
+Returned 2 bytes
+Two last values are: 6a 80
+Error code: 6A 80
+
+DOOR OPERATION FAILED
+AliroPort_TRANSACTION_FAILURE
+ACWG_prepareEphemeralKeypairAndTransactionId()
+retval=ACWG_OK
+
+-------------End of NFC demoAPDU --------- 
+NFCA Passive ISO-DEP device found. UID: 0489255AF21890
+ACWG_initSessionContext()
+retval=ACWG_OK
+
+
+ **************************************
+                -- SELECT --
+Returned 25 bytes
+Two last values are: 90 00
+
+Supported protocol version: 0x0100
+OK
+
+
+ **************************************
+                -- AUTH0 --
+-- USING Endpoint PubKey --
+-- STD TRANSACTION REQUESTED --
+ACWG_generateAUTH0CommandPayload()
+retval=ACWG_OK
+ACWG_generateAUTH0CommandPayload() - OK
+
+Generate AUTH0 DATA
+
+Sending AUTH0 APDU
+Returned 69 bytes
+Two last values are: 90 00
+ACWG_processAUTH0ResponsePayload()
+retval=ACWG_OK
+ACWG_processAUTH0ResponsePayload() - OK
+
+
+ **************************************
+                -- AUTH1 --
+ACWG_generateAUTH1CommandPayload()
+retval=ACWG_OK
+ACWG_generateAUTH1CommandPayload() - OK
+
+Generate AUTH1 DATA
+
+Sending AUTH1 APDU
+Returned 2 bytes
+Two last values are: 6a 80
+Error code: 6A 80
+
+DOOR OPERATION FAILED
+AliroPort_TRANSACTION_FAILURE
+ACWG_prepareEphemeralKeypairAndTransactionId()
+retval=ACWG_OK