template/lib/tesaiot_hsm/consumer_must_provide.txt is the machine-derived roster of symbols the archive references but does not define. Beyond libc and the OPTIGA host library (optiga_util_*, optiga_crypt_*, fetched by make getlibs), the ones a consumer writes are: optiga_util_callback (the callback_handler_t passed to optiga_manager_init()), the CM55 touch bridge ipc_hsm_touch_pause / ipc_hsm_touch_pause_reason / ipc_hsm_touch_resume, the MQTT plumbing cy_mqtt_publish, mqtt_connection, mqtt_device_id, publisher_task_q, the ingest globals g_protected_update_just_completed, certificate_sync_success, certificate_upload_success, check_certificate_response_received/_semaphore, platform_has_certificate, and the certificate helpers optiga_generate_csr_pem, optiga_generate_device_keypair, optiga_check_certificate_validity, optiga_read_factory_uid, optiga_slot_info. The template's ipc_hsm_handler.c, optiga_trust_helpers.c and tesaiot_pu_ingest.c provide all of them; a consumer replacing any of those files inherits the obligation.