[satchlj]

Keep the existing T8122 transport and v4 biometric interface. On J613 OS firmware 26.6.2, require the boot-forwarded identity and xART guard for writable attachment and fail closed on host-store/index errors. Add default-on trusted_keys/filevault_api options so existing-bag deployments can omit those APIs. Add read-only cached policy diagnostics without UUIDs, keys or enclave operations.
Depends on #234. The carried prerequisite is already under review there; review only the J613 policy and diagnostic commits here, and drop the prerequisite after #234 merges. The original policy delta was owner-verified on a composed C13 kernel for positive/negative fingerprint verification, password fallback, lock/unlock, cold reboot and daily-root return. Production-boundary tests pass normally and with Python -O; the exact firmware predicate passes a native Rust test. The added diagnostic path passes a modules-only LLVM/Rust build with BTF generation and split-BTF decoding against completed C13 kernel interfaces. Full branch CI passes. On 2026-11-03 a C13k kernel carrying these commits booted on a J613 MacBook Air with 26.6.2 firmware. The diagnostic readback reported status=verified with identity_source=dt and no mismatches. Lock-screen unlock with the enrolled finger worked, an unenrolled finger was rejected, and sudo with the fingerprint worked. That machine now runs this kernel as its daily system. No new provisioning, storage format or firmware protocol is introduced.

[satchlj]

Fixed ABI 3 expectations in c50ca33; all three sensor diagnostic tests pass on Linux. The commit checker requires a carrier sign-off on carried commits. Rebased the existing series to sign 069366d in place (now 8ed1f3f), with no duplicate prerequisite, and pushed with an explicit force-with-lease against the old head. All four commits pass the trailer checker; the inherited prerequisite content is unchanged.

Written by Claude on @satchlj's behalf.