feat(api): Implement Console Export Client and Models

- Added ConsoleExportClient for managing export requests and responses.
- Introduced ConsoleExportRequest and ConsoleExportResponse models.
- Implemented methods for creating and retrieving exports with appropriate headers.

feat(crypto): Add Software SM2/SM3 Cryptography Provider

- Implemented SmSoftCryptoProvider for software-only SM2/SM3 cryptography.
- Added support for signing and verification using SM2 algorithm.
- Included hashing functionality with SM3 algorithm.
- Configured options for loading keys from files and environment gate checks.

test(crypto): Add unit tests for SmSoftCryptoProvider

- Created comprehensive tests for signing, verifying, and hashing functionalities.
- Ensured correct behavior for key management and error handling.

feat(api): Enhance Console Export Models

- Expanded ConsoleExport models to include detailed status and event types.
- Added support for various export formats and notification options.

test(time): Implement TimeAnchorPolicyService tests

- Developed tests for TimeAnchorPolicyService to validate time anchors.
- Covered scenarios for anchor validation, drift calculation, and policy enforcement.

tests/AirGap/StellaOps.AirGap.Time.Tests/Rfc3161VerifierTests.cs

@@ -3,21 +3,91 @@ using StellaOps.AirGap.Time.Services;
 
 namespace StellaOps.AirGap.Time.Tests;
 
+/// <summary>
+/// Tests for Rfc3161Verifier with real SignedCms verification.
+/// Per AIRGAP-TIME-57-001: Trusted time-anchor service.
+/// </summary>
 public class Rfc3161VerifierTests
 {
+    private readonly Rfc3161Verifier _verifier = new();
+
     [Fact]
-    public void StubTokenProducesDeterministicAnchor()
+    public void Verify_ReturnsFailure_WhenTrustRootsEmpty()
     {
-        var tokenBytes = new byte[] { 0x01, 0x02, 0x03 };
-        var verifier = new Rfc3161Verifier();
-        var trust = new[] { new TimeTrustRoot("tsa-root", new byte[] { 0x01 }, "rsa-pkcs1-sha256") };
+        var token = new byte[] { 0x01, 0x02, 0x03 };
 
-        var result = verifier.Verify(tokenBytes, trust, out var anchor);
+        var result = _verifier.Verify(token, Array.Empty<TimeTrustRoot>(), out var anchor);
 
-        Assert.True(result.IsValid);
-        Assert.Equal("rfc3161-stub-verified", result.Reason);
-        Assert.Equal("RFC3161", anchor.Format);
-        Assert.Equal("tsa-root", anchor.SignatureFingerprint);
-        Assert.False(string.IsNullOrEmpty(anchor.TokenDigest));
+        Assert.False(result.IsValid);
+        Assert.Equal("rfc3161-trust-roots-required", result.Reason);
+        Assert.Equal(TimeAnchor.Unknown, anchor);
+    }
+
+    [Fact]
+    public void Verify_ReturnsFailure_WhenTokenEmpty()
+    {
+        var trust = new[] { new TimeTrustRoot("tsa-root", new byte[] { 0x01 }, "rsa") };
+
+        var result = _verifier.Verify(ReadOnlySpan<byte>.Empty, trust, out var anchor);
+
+        Assert.False(result.IsValid);
+        Assert.Equal("rfc3161-token-empty", result.Reason);
+        Assert.Equal(TimeAnchor.Unknown, anchor);
+    }
+
+    [Fact]
+    public void Verify_ReturnsFailure_WhenInvalidAsn1Structure()
+    {
+        var token = new byte[] { 0x01, 0x02, 0x03 }; // Invalid ASN.1
+        var trust = new[] { new TimeTrustRoot("tsa-root", new byte[] { 0x01 }, "rsa") };
+
+        var result = _verifier.Verify(token, trust, out var anchor);
+
+        Assert.False(result.IsValid);
+        Assert.Contains("rfc3161-", result.Reason);
+        Assert.Equal(TimeAnchor.Unknown, anchor);
+    }
+
+    [Fact]
+    public void Verify_ProducesTokenDigest()
+    {
+        var token = new byte[] { 0x30, 0x00 }; // Empty SEQUENCE (minimal valid ASN.1)
+        var trust = new[] { new TimeTrustRoot("tsa-root", new byte[] { 0x01 }, "rsa") };
+
+        var result = _verifier.Verify(token, trust, out _);
+
+        // Should fail on CMS decode but attempt was made
+        Assert.False(result.IsValid);
+        Assert.Contains("rfc3161-", result.Reason);
+    }
+
+    [Fact]
+    public void Verify_HandlesExceptionsGracefully()
+    {
+        // Create bytes that might cause internal exceptions
+        var token = new byte[256];
+        new Random(42).NextBytes(token);
+        var trust = new[] { new TimeTrustRoot("tsa-root", new byte[] { 0x01 }, "rsa") };
+
+        var result = _verifier.Verify(token, trust, out var anchor);
+
+        // Should not throw, should return failure result
+        Assert.False(result.IsValid);
+        Assert.Contains("rfc3161-", result.Reason);
+        Assert.Equal(TimeAnchor.Unknown, anchor);
+    }
+
+    [Fact]
+    public void Verify_ReportsDecodeErrorForMalformedCms()
+    {
+        // Create something that looks like CMS but isn't valid
+        var token = new byte[] { 0x30, 0x82, 0x00, 0x10, 0x06, 0x09 };
+        var trust = new[] { new TimeTrustRoot("tsa-root", new byte[] { 0x01 }, "rsa") };
+
+        var result = _verifier.Verify(token, trust, out _);
+
+        Assert.False(result.IsValid);
+        // Should report either decode or error
+        Assert.True(result.Reason?.Contains("rfc3161-") ?? false);
     }
 }