Export the Smart-Card Public Wrapping Key

Export the public wrapping key from the current Volkano smart card so it can be used to wrap plain key material before wrapped-key registration. This is a narrow, read-oriented helper that keeps three values distinct: the public wrapping key, the plain device key, and the final wrapped key.

When to use

Trigger this skill when the user wants to:

• export the public wrapping key from the card ("export the wrap key", "get the smart-card public key for wrapping")
• prepare for an offline or later key-wrapping step
• inspect or reuse the wrapping key for KUID / wrapped-key onboarding
• explicitly separate export wrapkey from later wrap or register steps

Do not use it to wrap a plain key, register wrapped material, delete records, or decide plain ADKP registration. If the user already has a valid public wrapping key, do not force a re-export - route onward instead.

Available Capabilities

Type	Name	Invocation
Tool	status	confirm server reachable and default installation known
Tool	execute_action(action="find_installation")	resolve Volkano install path when needed
Tool	execute_action(action="export_wrapkey", params={...})	export the public wrapping key from the card

Quickstart

1. If readiness is unknown, call status (and execute_action(action="find_installation") if the path must be resolved).
2. Call execute_action(action="export_wrapkey", params={...}) with optional volkano_folder and password.
3. Present the exported value as the smart-card public wrapping key, suitable for wrapping plain key material - not itself the wrapped device key.

Workflow

1. Treat this as a read-side helper; verify readiness before export if the environment is not yet trusted.
2. Do not invent a public key - export it from the currently selected card unless the user already has one.
3. Export via execute_action(action="export_wrapkey", params={...}). Inputs: optional volkano_folder, optional password.
4. Describe the result clearly so the user does not confuse the public wrapping key with wrapped key material.
5. Route onward if the user wants to continue:
   • plain key to wrap and register -> s32sdaf-wrap-and-register
   • already wrapped key to register -> s32sdaf-register-key

Guardrails

Scope - Read-oriented. Exports public key material only; does not modify card contents.

Destructive actions - None. If the user's real goal is wrapping or registration, route to the appropriate downstream skill rather than performing a mutation here.

Secrets - Require but do not echo the smart-card password; treat exported key material as sensitive.

Refuse-and-escalate -

• Card unreachable: ask the user to verify card insertion and reader availability; recommend s32sdaf-discovery-and-status.
• Install path unresolved: use execute_action(action="find_installation"); do not guess a path.
• Authentication/password failure: ask for the correct password; do not guess.
• User needs more than export: explain export only yields the public wrapping key and route to s32sdaf-wrap-and-register or s32sdaf-register-key.

Validation loop

1. Confirm readiness when relevant.
2. Confirm the export succeeded and returned a public wrapping key.
3. Pass criterion: the exported value is described as a public wrapping key and, if the user wants to continue, the correct next workflow is identified.

Out of scope

• Wrapping a plain key (see s32sdaf-wrap-key / s32sdaf-wrap-and-register).
• Registering wrapped material (see s32sdaf-register-key).
• Deleting records or challenge-response authentication.

See Also

• s32sdaf-wrap-and-register - continue immediately from export to wrap+register.
• s32sdaf-register-key - register already-wrapped key material.
• s32sdaf-discovery-and-status - verify readiness and card availability first.