Repository navigation
Post-M4: fail-closed PCAP/SCL evidence, bounded identity keys and cancellable Validation - #31
Conversation
…biguous sources or incomplete replay
…olicy not automatic conformance
…le file-size authority
…e PCAP inspections
…atting at 4800 samples/s
…p and throttled progress
…e and cancellable UI
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0be1f48db3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (exact.Stream.AsduCount < 2) | ||
| return new(expectation.ControlBlockReference, "LIMITED_EVIDENCE", | ||
| "One ASDU cannot establish sequence progression; record more than one sample", exact.Stream.Key); |
There was a problem hiding this comment.
When two or more decoded ASDUs omit or contain an unparseable smpCnt, AsduCount still passes this check while Observe records neither duplicates nor non-unit steps, so the comparison eventually returns WIRE_FIELDS_MATCH and claims sequential evidence. SampledValueParser.ReadAsdu explicitly permits SmpCnt to remain null, so track valid counters and downgrade any stream without at least two comparable values rather than treating ASDU count as progression evidence.
AGENTS.md reference: src/AGENTS.md:L19-L21
Useful? React with 👍 / 👎.
| var matching = candidatesWithMismatches.Where(x => x.Errors.Count == 0).ToArray(); | ||
| if (matching.Length > 1) | ||
| return new(expectation.ControlBlockReference, "AMBIGUOUS_WIRE", | ||
| $"{matching.Length} independent observed publisher identities match the same SCL stream; select and investigate the true source"); |
There was a problem hiding this comment.
When SCL omits a field such as confRev, VLAN ID, or PCP, CompareFields ignores that field, so two strong keys from the same source MAC that differ only in the omitted field both enter matching. This branch then reports “independent observed publisher identities” and AMBIGUOUS_WIRE, even though there may be only one sender whose configuration changed; incomplete intent should remain the diagnosis unless multiple distinct publishers actually match.
AGENTS.md reference: AGENTS.md:L29-L34
Useful? React with 👍 / 👎.
1 participant
Follow-up to merged #29. Tighten offline M4 verdicts to prevent false confidence from a single ASDU, duplicate publishers, bad sequence/layout, unverified smpCnt wraps, truncated replay or identity saturation. Add GUI cancellation and throttled progress for long local PCAP inspections, and remove per-ASDU joined-string allocation in inspector. All software changes remain passive/receive-only. Physical canonical TAP/IED/60-minute soak acceptance continues under #30.