Value-raw not honored for the single-sourced DIN energy-transfer field

[JakeMG-INL]

Problem

SimEVSEController.get_supported_energy_transfer_modes (app/secc/controller/simulator.py) single-sources the DIN energy-transfer mode from the message field tree (ADR-0006, #72). When the tree leaf fails EnergyTransferModeEnum(...) coercion it returns the raw value with this inline promise:

honor an illegal-but-encodable value as authored (red-team probing)

But the value then flows into ChargeService(energy_transfer_type=energy_mode) (app/secc/states/din_spec_states.py:~242) through the plain Pydantic constructor, which rejects the non-enum value with a ValidationError — aborting the SECC at ServiceDiscovery instead of advertising the crafted value. The ADR-0006 "lax build" seam (_lax_set in message_field_tree.py) that would honor value-raw emission is bypassed on this single-sourced path.

So the comment oversells: for this field the raw branch cannot deliver an illegal value on the wire, and a plausible authoring slip — using the enum name DC_EXTENDED instead of the value DC_extended — turns into a crash rather than a clean failure.

Impact

• No regression and no shipped personality is affected: normal in-enum values (DC_extended, DC_core) work, verified by the full suite (815 passed) and the live virtual demo.
• Only triggered by a hand-authored illegal/mis-spelled ServiceDiscoveryRes → ChargeService → EnergyTransferType leaf.

Options to consider

• Route the single-sourced read through the same value-raw/lax-build path the tree application uses, so advertised == accepted holds even for illegal-but-encodable values (true to ADR-0006's value-raw intent).
• Or, if value-raw on enum-typed wire fields is out of scope, correct the comment and fail loudly at load time with a clear message.

Surfaced during the /audit-issue review of #72.

[JakeMG-INL]

This was generated by AI during triage.

Agent Brief

Category: bug
Summary: The single-sourced DIN energy-transfer field bypasses ADR-0006's lax-build seam, so an illegal-but-encodable EnergyTransferType crashes the SECC at ServiceDiscovery instead of being emitted on the wire as authored.

Current behavior:
The SECC's supported-energy-transfer-modes accessor single-sources the DIN energy mode from the message field tree leaf ServiceDiscoveryRes → ChargeService → EnergyTransferType (ADR-0006, #72). When the leaf coerces to the energy-transfer enum it works. When it does not — an illegal-but-encodable value, or the realistic authoring slip of the enum name DC_EXTENDED instead of the wire value DC_extended — the accessor returns the raw leaf. That raw value is then fed into the ChargeService model through the ordinary Pydantic constructor, which rejects the non-enum value with a ValidationError, aborting the SECC at ServiceDiscovery. The inline promise to "honor an illegal-but-encodable value as authored (red-team probing)" is therefore a dead promise for this field.

Desired behavior:
Per ADR-0006's value-raw intent, an illegal-but-encodable EnergyTransferType leaf should be emitted on the wire as authored — the SECC advertises the crafted value in ServiceDiscoveryRes rather than crashing. The value-raw read must flow through the same lax-build seam the message-field-tree application uses (the seam that bypasses Pydantic validation to set a raw value), so the ChargeService built for ServiceDiscoveryRes carries the raw value through to encoding. The advertised==accepted invariant must continue to hold: because the ChargeParameterDiscovery WrongEnergyTransferType reject-gate compares against the same accessor, the raw advertised value is also the raw accepted value.

Key interfaces:

• The SECC controller's supported-energy-transfer-modes accessor (DIN branch) — currently returns the raw leaf on coercion failure; the raw value must be carried onward without being re-validated by a strict constructor.
• The DIN ServiceDiscovery state builder that constructs the ChargeService with its energy_transfer_type — must build via the lax-build seam (analogous to the message-field-tree application path) rather than the plain Pydantic constructor, so an illegal-but-encodable value survives to encoding.
• The lax-build seam in the message-field-tree module (the _lax_set-style path) — reuse this existing mechanism; do not introduce a parallel one.

Acceptance criteria:

• A personality whose ServiceDiscoveryRes → ChargeService → EnergyTransferType leaf is an illegal-but-encodable value causes the SECC to advertise that value in ServiceDiscoveryRes (encoded on the wire), not raise a ValidationError.
• The same value flows through the ChargeParameterDiscovery WrongEnergyTransferType reject-gate so advertised==accepted still holds: an EV requesting the advertised value is accepted; any other value is rejected.
• In-enum values (DC_extended, DC_core) behave exactly as before — no regression; the virtual two-session demo still completes a clean DIN session.
• The inline comment describing value-raw behavior is accurate to what the code now does.
• A test covers the illegal-but-encodable path (advertised on the wire, accepted by the gate) so the behavior is guarded.
• Full suite passes.

Out of scope:

• Migrating other wire-bearing sections (identity, capabilities, power, meter) into per-message trees.
• Changing the fallback path for personalities without the tree leaf (the legacy capabilities-sourced mode).
• Any ISO-2 / ISO-20 energy-transfer handling — this is the DIN path only.
• Adding load-time validation that rejects illegal enum values — that is the opposite fix direction and was explicitly not chosen for this issue.

[JakeMG-INL]

Implementation summary (agent, 2026-07-01)

Branch / base: development @ 6dcbdc9
Files touched:

• app/shared/personality/model.py — new SECCPersonality load-time model_validator rejecting a mistyped DIN EnergyTransferType leaf.
• app/secc/controller/simulator.py — corrected the misleading value-raw comment in get_supported_energy_transfer_modes; the dead raw-return branch now raises a clear error (defense-in-depth).
• tests/personality/test_din_slice.py — regression tests.

Tests added:

• test_secc_rejects_mistyped_energy_transfer_type_leaf (red→green: mistyped leaf fails at load with a fix-naming message)
• test_secc_accepts_valid_energy_transfer_type_leaf (guards against over-rejecting legal modes)

Verify: PASS — full suite 817 passed / 5 skipped; DIN E2E two-session scenarios (din-happy, din-variant) complete cleanly; a bad --config fails at load (post-extends-merge) via load_personality with the clear message.

Decisions made:

• Chose "fail early" (issue's Option 2) over the issue's chosen Option 1 (value-raw), with user approval. Diagnosis proved Option 1 is vacuous for this field: the DIN codec accepts exactly the 6 EnergyTransferModeEnum members, and all 6 coerce cleanly — so every value reaching the value-raw branch (a non-member string like the authoring slip DC_EXTENDED) is also non-encodable. "Illegal" and "encodable" are mutually exclusive here; Option 1 would only relocate the crash from ValidationError (ChargeService constructor) to EXIEncodingError (codec), still aborting the SECC at ServiceDiscovery. Verified both directly.
• Enforce at personality load (SECCPersonality model_validator) for earliest operator feedback; the accessor's raise is defense-in-depth (unreachable for a validated personality).
• Scoped to the SECC / DIN energy-transfer field only — no other enum leaves touched.

Open caveats:

• Issue acceptance criteria Lack of detail information for PCB #1 and Make AcCCS usable with different hardware setups #2 are reinterpreted, not met as written. "Advertise / accept the illegal value on the wire" is infeasible for this enum-restricted field (illegal ⟺ non-encodable). Delivered behavior is instead a clean early failure with a clear message. Criteria Open-source contributions from Ford #3 (no regression, clean demo), DIN 70121 fixes (plus EV config prioritization and deprecated datetime replacement) #4 (accurate comment), Ford merge #5 (test), [Personality Config] Slice 1: Loader plumbing, field migration, and default.yaml #6 (suite passes) are met. Audit should confirm this reinterpretation.
• ADR-0006 nuance: this adds a targeted value check that qualifies the ADR's "value-raw validation" for enum-restricted wire fields. It is reconcilable with the ADR's "bounded only by codec serializability" clause (a non-coercible enum value is definitionally non-serializable), but the ADR text is not updated. Consider whether ADR-0006 should note this.
• Generalization deliberately not taken: other enum-typed tree leaves still fail late (at the codec) rather than at load — out of scope for Value-raw not honored for the single-sourced DIN energy-transfer field #76 (DIN energy-transfer only).

[JakeMG-INL]

Follow-up filed as #78: note in ADR-0006 that value-raw is vacuous for enum-restricted wire fields (surfaced during /audit-issue).

[JakeMG-INL]

Landed in 4938abe on development.

A mistyped DIN ServiceDiscoveryRes -> ChargeService -> EnergyTransferType leaf (e.g. the enum name 'DC_EXTENDED' vs the wire value 'DC_extended') now fails at personality load with a fix-naming message, rather than detonating mid-session at ServiceDiscovery. Delivered as the issue's Option 2 (fail early), with user approval, after confirming Option 1 (value-raw emission) is vacuous for this enum-restricted field: illegal implies non-encodable. Follow-up #78 tracks noting this in ADR-0006.

Manual verification: independently reproduced the full suite (817 passed / 5 skipped), the DIN two-session E2E scenarios, and direct load-time behavior (bad leaf rejected with a clear message, valid modes load); also confirmed all six energy-transfer modes encode and round-trip through the real EXI codec.