Module 2: Card Dispenser, Personalization & Reader Subsystem

2.1 Purpose and Scope

This document specifies the card issuance, personalization, and card reader subsystems for Money Roll. It covers the motorized card dispenser, card stock selection, on-device personalization data layout for the default Stellar-native card tier, the optional Lithic-issued Visa tier, the hybrid reader used for return customers, and PC/SC driver integration on the Debian 12 host. It interfaces with Module 5 (firmware/Stellar) for cryptographic operations and Horizon calls.

2.2 Card Issuance Module Selection

2.2.1 Selection Rationale

The Creator CRT-591 is selected because it integrates card feed, contact IC encoding, contactless RF encoding, magnetic stripe encoding (retained for legacy compatibility though unused in the baseline data model), and monochrome thermal printing in a single compact module sized for the kiosk enclosure footprint (Module 3). The 200-card hopper supports approximately one week of median-volume operation between refills. The CRT-571 lacks integrated printing, which would require a second serial device and additional card-path length inside an already space-constrained enclosure. The Evolis/Zebra dye-sublimation OEM engines are reserved for a future full-color loyalty-card product tier; they are not justified for the plain QR/text card layout used here.

2.2.2 CRT-591 Reference Specifications

2.3 Card Stock

Both stocks use pre-printed graphic art (Money Roll branding, denomination-agnostic) with a reserved blank panel (30 mm x 40 mm) for the thermal printer to overlay the QR code, terminal ID, issue date, and balance line at personalization time.

2.4 Personalization Flow

At the point of dispensing, the terminal binds the physical card to the customer's active Stellar session address generated (or supplied) during the transaction.

2.4.1 Contact Chip Data Layout (JCOP4 Java Card Tier)

The same application and file structure is mirrored over the ISO 14443-4 contactless interface so the reader in Section 2.6 can authenticate the card via either contact or contactless presentation.

2.4.2 NFC NDEF Mirror

2.4.3 Thermal Print Layout

+--------------------------------------+
|   MONEY ROLL                          |
|                                        |
|   [ QR CODE 22x22 mm, ECC-M ]         |
|   (encodes public key G-address)      |
|                                        |
|   TERMINAL ID: MR-0000482             |
|   ISSUED: 2026-09-13                  |
|   INITIAL BALANCE: 84.00 USDC         |
|                                        |
|   ** NOT A BANK CARD **               |
+--------------------------------------+

The "NOT A BANK CARD" line is printed whenever the optional Lithic debit program is not enabled for the issuing terminal/tenant. When the Lithic program is enabled (Section 2.4.4) this disclosure line is omitted and replaced with card network branding supplied by Lithic's fulfillment partner.

2.4.4 Lithic Program Tier (Optional)

2.5 Dispenser Command Sequence

The CRT-591 uses a framed serial protocol: STX <command> <data> <BCC> ETX, where BCC is an XOR checksum over the command and data bytes.

2.5.1 Error Handling

2.6 Hybrid Card Reader (Return Customers)

Selection: Creator CRT-310 motorized dual-interface reader as the primary hybrid reader, because it services both the Stellar-native contact chip and the ISO 14443-4 contactless mirror without a second peripheral. Where cost-reduced kiosk variants use the ID Tech Augusta dip reader (contact-only), a separate ACR1252U USB NFC reader is added to cover contactless presentation.

2.6.1 PC/SC Driver Stack (Debian 12)

apt-get install -y pcscd libccid pcsc-tools libpcsclite1
systemctl enable --now pcscd
# Verify reader enumeration
pcsc_scan

2.6.2 UID + Secure Token Authentication Flow

CARD                    READER/TERMINAL                    BACKEND (Horizon)
  |                            |                                   |
  |<---- SELECT AID ---------- |                                   |
  |---- OK, AID selected ----->|                                   |
  |<---- READ EF.TOKEN ------- |                                   |
  |---- EF.TOKEN bytes ------->|                                   |
  |                            | decrypt EF.TOKEN with fleet key   |
  |                            | (AES-256-GCM, per-card salt)      |
  |                            | verify HMAC / session binding     |
  |                            |---- GET /accounts/{id} ---------->|
  |                            |<---- balances, sequence ----------|
  |                            | unlock deposit/transfer actions   |

2.6.3 Anti-Cloning

2.6.4 Rate Limiting and Lockout

2.7 Service Considerations