The 3DS Requestor App passes the ARes data to the SDK and invokes the doChallenge method; the SDK checks the received data elements against Table A.1, completes the ACS-to-SDK secure channel (verifying the JWS-signed ephemeral key and ACS URL, ending with an error report to the app if it cannot), establishes the TLS link to the ACS at the verified URL, formats the CReq per Table B.3 protected as JWE and sends it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.