Three JNI exports: generateAttestedKeyPair (orchestrates keygen, attestation, certbuilder, returns length-prefixed binary), initLogging (multi-output tracing setup), dumpLogs (diagnostic ZIP). CertGenConfig extraction via typed JNI field accessors. catch_unwind on all FFI boundaries.