Repository navigation
MILESTONE LOCK: P10.6 BCUGE IED identity + 7-row static parity verified on simulator #518
Description
Milestone P10.6 — BCUGE trusted-IID identity and static-report parity VERIFIED on operator simulator (2026-10-11)
IMMUTABLE CODE AUTHORITY
- ARSAS staging
fix/512-goose-event-header-alignmenta883510218c62ac02096de37e831feede389f4a1at field-test baseline. - Engine lock and staged ARIEC61850
00ad2819b99ffe6b3f885e59aa24a6afb2b4d8e1. - NEW immutable safety branch
checkpoint/p10-6-field-verified-bcuge-parity-a8835102, created directly from the exact successful tested P10.6 staging SHA; prior checkpoints remain. - Operator executable app
1.6.40+789497270397a1caeae609951762661b401b7895is GitHub's merge-test commit with P10.6a8835102as second parent. This is NOT an older app. Existing PR-head 12/12 CI successful on P10.6 staging candidate.
INDEPENDENT OPERATOR EVIDENCE
- Two diagnostic text attachments supplied in chat, recorded local WIB 2026-10-11 11:44:56 (Open SCL) and 11:45:51 (IP Discovery) on authorized same-PC GE simulator,
KM_Test, target192.16.1.33:102. - Original independently opened IID
BCU_GE.iidsource SHA2562776bf5b26d1c8dbac8a00e88149931d0787b8493896106af217951e71df3002, IEDBCUGE, APS1, observed raw MMS domainBCUGEF650. - Subsequent IP-only Discovery
BCUGE; log:IP Discovery identity independently verified... source=prior verified SCL-assisted association,TrustedSclExactDomainMatch (High). MMS engine raw fall-back IED ID was preserved in wire-model provenance, not overwritten. - Both paths: 8/8 static DataSets, 124/124 member descriptors, selected 67 points, 6/6 separately routed real RCB streams, 25 InformationReport frames per test, 605 process updates, no cyclic MMS process-value polling.
- Semantic row[0..6] byte-for-byte equal in both independent diagnostic text reports; exact semantic fingerprint
439d4dc0507019533b154ed68f7f4007f39f6be92b5cd3f413ff3b84f619727e. - Both statuses
AWAITING PEER INGRESSbecause capture tracker was association-local: cross-session equality verified independently from user-provided files, NOT synthetic tool-issued runtimeMATCH.
EXPLICIT NO-GO GATES, DO NOT OVERSTATE
- BRCB continuity: Open SCL 13 findings / BufOvfl=3, IP Discovery 7 findings / BufOvfl=3. Different chosen CSWI/EVEGGIO RCB slots (GW vs SOGI). No proof of buffered SOE replay losslessness or event loss from SqNum alone. Observe EntryID opaque; GI reason is correlation, never guaranteed harmless reset.
- IP Discovery first-pass MMS named variables 6400/64 pages, incompleteChains=1, live 65 LN / 897 DO / 6274 DA versus SCL engineering 153 LN / 2228 DO / 14668 DA. Not proven full object tree equivalence. ARIEC Issue #162 tracks bounded deferred completeness.
- Original IID SCL GOOSE issues: missing APPID/MAC, empty configured GOOSE dataset, confRev 0 for
LLN0$GO$scb; no GOOSE end-to-end acceptance. Some DataSets are GOOSE-only with no configured RCB and intentionally not report-live. - Test endpoint was same-PC lab/simulator, not proven standalone physical GE BCU. No R10 physical acceptance; ARSAS/ARIEC
mainand public releases remain blocked.
PROTECTED SUCCESS CRITERIA
- Don't regress BCUGE trusted identity and original
BCUGEF650wire domain. - Don't regress exact 8 DataSets, 124 member descriptors, 67 unique static report points, 6 routed RCBs, no cyclic MMS.
- Preserve semantic fingerprint and independently verifiable two-ingress equality.
- Do not suppress, reinterpret as clean, or change behavior to hide BufOvfl, sequence reset, out-of-order, EntryID ambiguity.
- Future protocol fixes branch from exact P10.6 checkpoint and require isolated CI + new field evidence.
Related ARSAS PR #512 and ARIEC PR #157.
Activity
masarray commentedon Oct 11, 2026
P10.6 immutable milestone LOCKED; P10.7 observational BRCB improvement PROMOTED (2026-10-11)
Protected field baseline: Milestone #518 and exact checkpoint branch
checkpoint/p10-6-field-verified-bcuge-parity-a8835102→a883510218c62ac02096de37e831feede389f4a1. Operator reports 11:44 Open SCL and 11:45 Discovery IP on KM_Test GE Edition1 simulator confirmed BCUGE from original SHA-verifiedBCU_GE.iid, AP S1, rawBCUGEF650, identical 7-row semantic fingerprint439d4dc0507019533b154ed68f7f4007f39f6be92b5cd3f413ff3b84f619727e, 8 DS/124 members, 67/67 runtime, 6/6 individually routed RCBs per path, zero cyclic MMS process polling.P10.7 implementation: PR #519 MERGED into the same staging by exact-SHA non-force fast-forward
a8835102...→**415d1db74c0f69637063601da037edf78142cb89**, checkpointcheckpoint/p10-7-brcb-observability-415d1db7. Exact PR-head CI 10/10 SUCCESS, no failed jobs. Canonical Build ARSAS #38114744222 SUCCESS; portable EXE artifact #11693356812. The 16 auto-triggered post-FF staging workflows are in progress; do not dispatch duplicate runs.Scoped engine-safe change: only
Services/Iec61850ReportContinuityInspector.cs,Services/DiagnosticReportBuilder.cs,tests/ARSAS.Tests/P107BrcbEvidenceTriageTests.cs. Observational-only. Distinguishes findings per frame vs anomalous frame count; countsSqNumdiscontinuities and changed/repeated/not-comparable EntryID cursor evidence, GI reason and BufOvfl on the same decoder frame. Crucially, cursor compare is authorized ONLY if BOTH consecutive frames have proven OptionFields bit and raw decoder mask; a missing intermediary EntryID resets comparative confidence. No event-loss or harmless-GI-reset inference. Existing all BufferOverflow and SqNum warning text/counts remain, no additional network requests, no dynamic MMS polling, no new RCB writes or control operations. Ten deterministic fail-closed tests passed Windows CI.Unresolved independent gates: prior two logs showed BRCB Open SCL 13 findings/3 BufOvfl, Discovery 7 findings/3 BufOvfl on different selected RCB slots. This patch does not fix IED/server buffering or certify SOE continuity. Need new P10.7 simulator field capture with new diagnostic
RCB triage, correlate by exact RCB/EntryID/GI session and if permitted capture anonymized PCAP. Smart NamedVariable 64-page partial gap is ARIEC Issue #162; engineering-SCL GOOSE issues remain. No R10 physical promotion, ARSAS main or ARIEC engine main/public release. Engine lock stays00ad2819b99ffe6b3f885e59aa24a6afb2b4d8e1.masarray commentedon Oct 11, 2026
Post-P10.7 operator confirmation (2026-10-11 12:58 Open SCL / 13:02 IP Discovery)
Full controlled audit in P10.8 Issue #520. Confirmed exe
4b12e5b0...is a merge-test of P10.7 head415d1db7.... Both snapshots independently show BCUGE trusted IID, 7/7 identical fingerprint439d4dc0..., 67/67 values, 6/6 report streams, 25 decoded frames and 605 updates each, no cyclic polling; P10.6 milestone not regressed. Continuity P10.7 triage works and identifies 12 frames/13 findings/10 SqNum discontinuities on Open SCL versus 6 frames/7 findings/4 SqNum discontinuities on IP Discovery, both 3 BufOvfl. Different CSWI/EVEGGIO BRCB slots confound comparison. Four URCBs clean but only one frame each. GI reason cannot explain all CSWI discontinuities. Only a same-slot, real wire-order + controlled simulator event replay can distinguish engine defect versus server buffering behavior. Do not alter frozen P10.6 milestone, hide warning, or claim lossless SOE. All sixteen post-promotion P10.7 workflows were also checked SUCCESS with no failures.masarray commentedon Oct 11, 2026
P10.8A complete — follow-up evidence added without changing BRCB acquisition (2026-10-11)
Field basis: Latest user-uploaded Discovery Diagnostic Report (13:28 WIB; app merge-test
4b12e5b05da2531d2f852844a8db4b8006554c65, locked ARIEC00ad2819b99ffe6b3f885e59aa24a6afb2b4d8e1) shows BCUGE high-confidence IID verification, same 7/7 semantic fingerprint439d4dc0507019533b154ed68f7f4007f39f6be92b5cd3f413ff3b84f619727e, 8 DataSets/124 members, 67/67 static values, 6/6 static RCB streams, no cyclic MMS polling. 43 InfoReports/623 process updates in that association. Ten SqNum anomalies and three BufOvfl across two GW BRCBs; last known anomaly 186ms after CSWI activation return, no later anomaly timestamp despite later traffic. Comparing different previous session 25/605 is not a same-association incremental delta. Same-slot earlier Open SCL GW capture had exactly 13 findings/10 Seq discontinuities/3 BufOvfl; ingress not independently implicated. Ongoing SOE losslessness remains unverified.Implemented in PR #521: from frozen P10.7
415d1db74c0f69637063601da037edf78142cb89, 3-file consumer-only diff (continuity inspector; diagnostic formatter; six new xUnit tests). Adds capped constant-memory, association-local actual report frame count after last per-RCB finding, plus first/last report receive timestamps and last finding timestamp in immutable snapshot. A later warning resets follow-up count; OptFlds warnings/BufOvfl remain; timestamps without evidence remain null. ReportsRCB follow-up : receivedAfterLastFinding=... firstFrameUtc=... lastFindingUtc=... lastFrameUtc=...only for RCBs with findings. RCBs with no later frames CANNOT appear recovered solely due idle elapsed time. No new network I/O, commands, report activation, dynamic polling, decoder/engine or per-frame unbounded allocations.Promotion: exact PR head
a7f4edbf5cb972eacb9baaf0c25e4475ee5f10c910/10 GitHub CI succeeded including canonical Windows Build #38118437424 and portable EXE artifact #11694588019. Guarded non-force FF to stagingfix/512-goose-event-header-alignmentverified, checkpointcheckpoint/p10-8a-post-anomaly-followup-a7f4edbf. 16 staging post-FF workflows automatically triggered on the identical SHA; do NOT manually retrigger duplicates. ARSAS main and ARIEC main/engine pin untouched.Acceptance: P10.6 field-verified semantic/identity Milestone #518 and prior
checkpoint/p10-6-field-verified-bcuge-parity-a8835102, pluscheckpoint/p10-7-brcb-observability-415d1db7, remain immutable. No physical R10 acceptance or public release. For operator next test: reuse GE simulator, run 60-150 seconds after initial GI, take diagnostics: compare same GW slotCSWIandEVEGGIO. Expect actual additional reports reflected as post-finding frames for active CSWI, while an EVEGGIO BRCB with no further reports honestly shows zero. Historical BufOvfl must remain. Root-cause distinction IED buffering vs client receive-order requires authorized wire trace; no decoder or auto replay mutations permitted without that evidence. Engine NameList partial 6400/64 remains ARIEC #162.masarray commentedon Oct 11, 2026
P10.8B milestone — bounded BRCB decoder-metadata chronology (2026-10-11)
Current staging:
fix/512-goose-event-header-alignmentadvanced via non-force fast-forward from tested P10.8Aa7f4edbf5cb972eacb9baaf0c25e4475ee5f10c9to exact3c58a476e25289a1a59f55992dbf70c81f73fffd, PR #522 GitHub confirms MERGED. Immutable new checkpointcheckpoint/p10-8b-bounded-brcb-chronology-3c58a476. Previously verified P10.6checkpoint/p10-6-field-verified-bcuge-parity-a8835102and P10.7checkpoint/p10-7-brcb-observability-415d1db7stay unchanged; P10.6 milestone #518 protected.Engineering scope: only three consumer files changed:
Services/Iec61850ReportContinuityInspector.cs,Services/DiagnosticReportBuilder.cs,tests/ARSAS.Tests/P108BBoundedReportChronologyTests.cs. For buffered RCB only, record first 32 and most recent 8 received decoder metadata frames per exact stream using lazy-allocated fixed-size ring of readonly record structs, no unbounded collection/per-frame heap trace allocation. Metadata includes receive-order ordinal, explicitly known/unknown receive time, SqNum, GI reason, BufOvfl, opaque EntryID relation only (changed/repeated/unverified/absent; requires independently verified OptionFields for both consecutive frames), and number of WARN findings on each frame. Never store raw EntryIDs, payload values, MMS PDU bytes. Snapshot copies up to 40 structs/RCB and diagnoses omitted middle count, first/tail order. Report makes clear receive-order metadata is not TCP packet order, no SOE losslessness conclusion. Four URCBs have no chronology buffer.Exact candidate CI: 10/10 green, full Windows solution/regression, pinned engine identity/canonical SCL, ArdIrec native CTest, portable single EXE smoke, CI guards; Build ARSAS run #38120012150, portable artifact #11695130540 (not expired when checked). Nine new deterministic tests verify ring 60 frames and omitted interval, boundary lengths, warning retention with repeat SqNum/EntryID, raw OptionFields rejection, no raw cursor leakage, URCB no history, frozen snapshot, unknown timestamps and stream isolation. At stage promotion exact SHA/baseline preflight passed. Auto-triggered 16 post-fast-forward workflows started, not manually dispatched.
Protected physical simulator truth: Operator previously verified BCUGE with original SHA-pinned
BCU_GE.iid, 7/7 identical static semantic rows/fingerprint439d4dc0507019533b154ed68f7f4007f39f6be92b5cd3f413ff3b84f619727e, 8 DS/124 ordered members, 67/67 runtime values, 6/6 routed configured static RCBs, no cyclic MMS polling. Most recent 13:28 user report from P10.7 showed 43 reports and 623 updates, 13 findings/10 Sq discontinuities/3 BufOvfl on the same GW BRCB slots as earlier Open SCL. All anomalies clustered at activation, but no wire capture means client-vs-simulator cause and SOE replay/loss remain UNKNOWN, warnings MUST remain. P10.8 Issue #520 owns the real-wire same-slot investigation; engine partial 6400/64 page NameList remains ARIEC #162.Safety: ARIEC stage and pinned lock remain
00ad2819b99ffe6b3f885e59aa24a6afb2b4d8e1, ARSAS main remains7d8d8026ae96d45f44d47f361d115a437af88fbe, ARIEC main unchanged. No decoder behavior, extra network I/O, RCB ownership or GI rewrites, no R10 physical qualification, main merge or public release. Next operator test: run P10.8B EXE in GE simulator, record complete Diagnostic Report after startup and after a permitted safe indication change; compare per-GW-RCB chronology to Wireshark trace. Do not interpret receive order as wire proof.masarray commentedon Oct 11, 2026
P10.8C — completed isolated milestone (2026-10-11)
Verified latest staging was P10.8B
3c58a476e25289a1a59f55992dbf70c81f73fffd, which had already passed 16/16 post-FF workflows, not the earlier P10.8A head. P10.6 trusted BCUGE IID and static-report parity field milestone #518 remains protected. Engine lock still exact00ad2819b99ffe6b3f885e59aa24a6afb2b4d8e1.Root-cause-quality observability gap: P10.8B retains first 32 + latest 8 BRCB decoder report metadata frames. In a long BRCB stream, genuine BufOvfl/SqNum anomaly at frame #46 of 70 is lost from the detailed head/tail evidence, despite existing aggregate counters. A long-running gateway needs to preserve intermittent anomaly evidence with bounded memory.
Implemented PR #523: new lazy fixed ring of the last 8 anomalous BRCB frames, independent of unchanged existing first32/last8 chronology; copies in receive order into immutable snapshot; bounded
BRCB anomaly historydiagnostic section; no raw EntryID, MMS PDU, process values or unbounded history; zero new allocation for healthy BRCBs or URCBs until actual BRCB anomaly. O(1) append and constant per-BRCB memory. Exactly 3 files change: inspector, diagnostic formatter, five deterministic xUnit cases covering omitted-middle anomaly, ring wrap, immutable snapshot, no allocation for healthy/unbuffered and no secret cursors in diagnostics.Exact PR head
a10eae2c3a5be11ba63e0b94b78d4f24c7fc73f2CI 10/10 SUCCESS, canonical Build ARSAS #38122272726 and Windows Portable EXE #11695822574. Guarded non-force FF from P10.8B staging to that SHA; checkpointcheckpoint/p10-8c-anomaly-chronology-a10eae2c; PR marked merged. New staging 16 automatic workflows triggered on identical SHA: currently 1 green/15 running, zero failures; do not manually duplicate CI.Invariant: ARSAS and ARIEC main unchanged, ARIEC engine lock unchanged. Absolutely no changes to IEC 61850 decoder, RCB setup/selection, static DataSets, control, polling or GOOSE. SOE lossless physical qualification still NOT VERIFIED; BRCB BufOvfl=3 historical user logs remain genuine and must not be hidden. Device/protocol root cause still requires same-slot on-wire capture per Issue #520; Smart MMS 6400/64 partial NameList remains ARIEC #162.
masarray commentedon Oct 11, 2026
P10.8C checkpoint + P10.8D exact BRCB-slot comparator integrated (2026-10-11)
Baseline audit: Existing staged HEAD had already advanced beyond P10.8A to
a10eae2c3a5be11ba63e0b94b78d4f24c7fc73f2with 16/16 exact-head GitHub CI SUCCESS (P10.8B first32/last8 receive chronology and P10.8C last8 anomalies, no raw EntryID). Preserved as checkpointcheckpoint/p10-8c-bounded-anomaly-chronology-a10eae2cbefore changes, not rebuilt on older base.P10.8D: ARSAS PR #524 adds read-only offline comparator
scripts/compare-p10-brcb-sessions.py, nine standalone fixture regressions and one canonical Windows CI invocation. The comparator refuses misleading A/B analysis if IED name, pinned engine SHA, static semantic fingerprint, exact BRCB reference set, or DataSet differs. It compares per-slot observed counts and bounded chronology evidence only, NEVER asserts wire order, SOE lossless or physical R10 qualification; no live protocol writes, decoder, static DataSet, UI runtime, process polling or engine changes.Exact PR head
ce73df3a47e163416c232b083eba1e4915f33e17passed 12/12 GitHub Actions checks SUCCESS including canonical Windows build #38125585489 and portable EXE artifact #11697416229. After explicit exact-SHA, engine lock, main branch and FF ancestry checks, PR #524 merged into staging via non-force guarded fast-forwarda10eae2c...→ce73df3a..., checkpointcheckpoint/p10-8d-brcb-same-slot-comparator-ce73df3a. All original milestone checkpoints still exist. 16 automatic post-promotion CI workflows started; do not manually trigger duplicates.Protected field milestone: #518 P10.6 BCUGE High verified identity, seven-row fingerprint
439d4dc0507019533b154ed68f7f4007f39f6be92b5cd3f413ff3b84f619727e, 8 DataSets/124 members, 67/67 process values, 6/6 RCB report traffic, 0 cyclic polling. Engine lock remains exactly00ad2819b99ffe6b3f885e59aa24a6afb2b4d8e1; ARSAS/ARIEC main and public release untouched. Last GE simulator evidence still has BRCB BufOvfl and SqNum issues; this tool does NOT fix or hide them. IEC wire-order trace and physically controlled event evidence are still required before engine/protocol changes.masarray commentedon Oct 11, 2026
P10.6 protected baseline remains IMMUTABLE. Latest P10.8D stage/CI/engine/checkpoint/next-step handoff synced at ARSAS #525. This is a newer descendant of the P10.6 simulator-pass SHA, not a change of the original field-tested milestone. Name BCUGE, 8/124/67/6 and no cyclic polling remain protected; buffer SOE/physical R10 remain unqualified.