Strip SPEC_DECISIONS.md pointers from shipped code + docs

docs/FWTPM.md

@@ -730,8 +730,9 @@ hierarchy seed + template → KDFa-derived seed → FIPS 203/204 key expansion.
   `wc_MlKemKey_MakeKeyWithRandom` → (ek, dk). Wire format stores only 64-byte
   seed per TCG Part 2 Table 206.
 
-All three labels are logged in `docs/v185_pqc/SPEC_DECISIONS.md` as DEC-0001
-(interpretation, pending TCG Part 4 v185 publication).
+These label strings are an interpretation — TCG Part 4 v185 (which would
+normatively specify them) is unpublished, so they are subject to change
+if rc5 / Part 4 v185 prescribe different labels.
 
 ### Sign / Verify Sequences
 
@@ -773,7 +774,7 @@ Three v1.85 features are deferred with documented reasons:
    Part 2 §11.4.2 Table 222 defines the `mlkem` arm of `TPMU_ENCRYPTED_SECRET`.
    Part 4 v185 (which would normatively specify this) is not yet published.
    Current behavior: `TPM2_StartAuthSession` returns `TPM_RC_KEY` for ML-KEM
-   tpmKey. See `SPEC_DECISIONS.md` DEC-0002.
+   tpmKey; revisit when Part 4 v185 lands.
 2. **External-μ ML-DSA signing** — wolfCrypt has no μ-direct sign API. Part 2
    §12.2.3.7 text says "512-byte external Mu" but FIPS 204 Algorithm 7 Line 6
    produces 64 bytes (SHAKE256 output). Pending wolfCrypt API addition and

src/fwtpm/fwtpm_crypto.c

@@ -674,9 +674,9 @@ static int FwGetWcMlkemType(TPMI_MLKEM_PARAMETER_SET ps)
 }
 
 /** \brief Derive 32-byte ML-DSA seed xi from hierarchy primary seed via KDFa.
- *  Per SPEC_DECISIONS DEC-0001 the label is "MLDSA" for TPM_ALG_MLDSA or
- *  "HASH_MLDSA" for TPM_ALG_HASH_MLDSA. The derived seed is fed into
- *  FIPS 204 deterministic keygen. */
+ *  Caller selects label: "MLDSA" for TPM_ALG_MLDSA or "HASH_MLDSA" for
+ *  TPM_ALG_HASH_MLDSA (interpretation, pending Part 4 v185 publication).
+ *  The derived seed is fed into FIPS 204 deterministic keygen. */
 TPM_RC FwDeriveMldsaPrimaryKeySeed(TPMI_ALG_HASH nameAlg,
     const byte* seed, const byte* hashUnique, int hashUniqueSz,
     const char* label, byte* seedXiOut)
@@ -693,8 +693,9 @@ TPM_RC FwDeriveMldsaPrimaryKeySeed(TPMI_ALG_HASH nameAlg,
 }
 
 /** \brief Derive 64-byte ML-KEM seed (d || z) from hierarchy primary seed
- *  via KDFa. Per SPEC_DECISIONS DEC-0001 the label is "MLKEM". The derived
- *  seed is fed into FIPS 203 deterministic keygen (ML-KEM.KeyGen_internal). */
+ *  via KDFa using the label "MLKEM" (interpretation, pending Part 4 v185
+ *  publication). The derived seed is fed into FIPS 203 deterministic
+ *  keygen (ML-KEM.KeyGen_internal). */
 TPM_RC FwDeriveMlkemPrimaryKeySeed(TPMI_ALG_HASH nameAlg,
     const byte* seed, const byte* hashUnique, int hashUniqueSz,
     byte* seedDZOut)

wolftpm/fwtpm/fwtpm_crypto.h

@@ -137,7 +137,8 @@ TPM_RC FwDeriveRsaPrimaryKey(TPMI_ALG_HASH nameAlg,
 
 #ifdef WOLFTPM_V185
 /* v1.85 PQC primary-key derivation.
- * Per SPEC_DECISIONS DEC-0001 the KDFa labels are:
+ * KDFa labels used here (interpretation — Part 4 v185 is unpublished
+ * so these may change if the final normative text differs):
  *   "MLDSA"       for TPM_ALG_MLDSA (Pure ML-DSA)
  *   "HASH_MLDSA"  for TPM_ALG_HASH_MLDSA (pre-hash variant)
  *   "MLKEM"       for TPM_ALG_MLKEM

wolftpm/tpm2.h

@@ -1138,7 +1138,8 @@ typedef struct TPMT_TK_VERIFIED {
     /* v185 rc4 Part 2 §10.6.5 Table 112 / §10.6.4 Table 110 — [tag]metadata.
      * Empty on the wire for TPM_ST_VERIFIED and TPM_ST_MESSAGE_VERIFIED.
      * For TPM_ST_DIGEST_VERIFIED carries the TPM_ALG_ID (hash/XOF used).
-     * Per SPEC_DECISIONS DEC-0003, ML-DSA external-mu uses TPM_ALG_NULL.
+     * For ML-DSA external-mu wolfTPM emits TPM_ALG_NULL here (hash-less
+     * mu-direct path; interpretation pending Part 4 v185 publication).
      * Spec note: field formerly named `digest` was renamed to `hmac` in
      * v185 to reduce ambiguity; we retain `digest` for wolfTPM API stability
      * since the rename is editorial and does not affect wire bytes. */