/yonsei-certificate-assistant

name: yonsei-certificate-assistant
description: Cross-platform Yonsei icert support that runs a local Windows/macOS/Linux free-print compatibility printer to decode the student's authenticated dzreportx ticket and render a PDF, or diagnoses native Windows ReportX for an explicitly requested physical print. Use for 인터넷즉시발급, localhost 65432 failures, ReportX ticket diagnosis, or an FP3/PDF result. Do not use for paid 전자증명서, forged or modified certificates, automatic printing, password collection, or claims that a compatibility PDF is an officially verified original.

Yonsei Certificate Assistant

Use this skill for the free-print path on Windows, macOS, or Linux:

`인터넷증명서 → 인터넷즉시발급 → 프린터 출력`

The implementation is a compatibility experiment for a user's own authenticated issuance session. It does not create, edit, or certify a document.

Confirmed protocol

The official page posts `PREVIEWENC` and gives the result to:

`http://127.0.0.1:65432/SSO?PARAM=dzreportx:…`

Static clean-room analysis of the current Yonsei installer and a normal, user-authorized live issuance established:

dzreportx: strip
→ "||" plaintext diagnostic form, or Base64 + ARIA-192-ECB
→ vendor ARIA-192-ECB key schedule
→ key = first 24 ASCII bytes of md5("10001").hexdigest()
→ little-endian uint32 payload length
→ "|" query separators restored to "&"
→ command URL and URLFile/URLPost fields parsed

For `SHOWREPORT` and `SHOWREPORT_PRINTAUTO`, ReportX constructs:

`http://{URLFile}?TPID={TPID}&MIN_NO={MINNO}&GIWAN_NO={GIWAN_NO}`

The current Yonsei ticket uses `icert.yonsei.ac.kr/ys1.0/jsp/report/sendfile.jsp`. The broker upgrades the ticket host/path to HTTPS, follows no redirects, and accepts only the tracked response. URLFile and URLCheck share one in-memory cookie jar, matching the single WinINet session used by ReportX; cookies are never persisted or exposed.

The accepted non-PDF response has a second recovered container layer:

ARIA-192-ECB key = first 24 ASCII bytes of md5(MINNO).hexdigest()
→ LE32 compressed length + zlib bytes + zero cipher padding
→ zlib inflate
→ LE32 primary length + primary bytes
→ LE32 additional count
→ repeated LE32 length + component bytes

The Windows path loads the primary as a FastReport VCL `4.7.109` prepared-report XML stream with FP3 semantics and uses additional streams as image sidecars. It has no compiled PDF exporter path. The bundled `render-reportx-fp3-pdf` skill implements the bounded prepared-page subset observed in the live Yonsei response.

Before rendering a printable page, ReportX performs two extra mutations:

1. `URLCheck` reserves one 16-character verification number. Its response is a 1,000-byte Windows buffer: exactly 16 safe ASCII characters followed only by NUL padding. The number is formatted `xxxx-xxxx-xxxx-xxxx` and replaces the ten-digit `__SERIAL__` placeholder. 2. `__LOGO1__` receives the `원본` bitmap embedded in the exact official `REPORTX.exe`. The skill distributes no vendor image; it extracts and validates the asset from the pinned Yonsei installer in the user's cache.

`URLCheck` can allocate state even though it is a GET. The agent writes a durable no-retry guard before the request. `URLPost`/`printcomplete.jsp` is a separate completion boundary. With `--notify-print-completion`, it is recorded and called exactly once only after the PDF has been durably saved, re-read, and matched to the expected digest. A timeout or uncertain response is never retried.

Run

For issuance, prewarm as soon as the skill is invoked. This emits the official Portal URL for Codex Computer Use and prepares the cold path while the student answers the single intake batch and completes visible login:

python3 "$SKILL_DIR/scripts/icert_print.py" start

The CLI never launches or manipulates a browser. Use Codex Computer Use in the student's current browser for the emitted official URL, login, visible selection, and one final click. Do not use Orca, AppleScript, JXA, coordinate automation, or a separate Chrome profile.

Capture missing choices and issuance authorization in the initial login pause. A fully specified prompt that explicitly commands issuance already provides that authorization. Validate the complete review internally and never ask for a second reply. Then run the single continuing command. It reuses the prewarmed agent, arms once, emits a machine-readable Computer Use handoff, correlates the job by the exact `arm_id`, waits for that job only, verifies the saved digest, and exports to a new destination without overwriting different bytes:

python3 "$SKILL_DIR/scripts/icert_print.py" issue \
  --request "<complete-request-json>" \
  --output "<new-pdf-destination>" \
  --confirm

`purpose` is optional. A transcript request must settle rank inclusion, conversion inclusion, and the observed 4.5 conversion scale when selected. Login state is determined from the visible page through Computer Use, not by asking the student to describe cookies or credentials. There is no second confirmation and no separate doctor/open/arm/wait/status/copy sequence.

The one-minute objective is the confirmed, visibly logged-in hot path with cached assets. First-use exact-hash download and extraction happen during the initial intake/login pause and must complete before any document number is reserved. `issue` performs no cold download and uses one overall command-start deadline capped at 55 seconds, preserving export margin. This is an implementation budget until a representative live issuance is measured.

If either bundled font is missing or its pinned hash differs, stop before a live request. `--title-font` and `--body-font` remain development overrides but must match the released authorized hashes. The lower-level `agent`, `arm`, `wait-job JOB_ID`, and `status` commands remain diagnosis tools, not the normal issuance flow.

The cross-platform compatibility path needs no DevTools bridge, cookie export, VM, or ex