Continue C# parity: TCP, live discovery, and vendor CPA interoperability

.github/workflows/cpp-ci.yml

@@ -2,7 +2,7 @@ name: C++ CI
 
 on:
   push:
-    branches: [main, "agent/**"]
+    branches: [main]
   pull_request:
   workflow_dispatch:
 
@@ -35,6 +35,16 @@ jobs:
         run: cmake --build build --parallel
       - name: Test
         run: ctest --test-dir build --output-on-failure
+      - name: Cross-language model parity tool self-test
+        run: python3 tools/compare_live_model_json.py --self-test
+      - name: Read-only evidence runner syntax and CLI smoke
+        run: |
+          python3 -m py_compile scripts/run-live-readonly-interop.py
+          python3 scripts/run-live-readonly-interop.py --help > /dev/null
+          python3 -m py_compile scripts/run-phase4c-physical-acceptance.py
+          python3 scripts/run-phase4c-physical-acceptance.py --help > /dev/null
+          python3 -m py_compile scripts/run-phase4c-timeout-recovery.py
+          python3 scripts/run-phase4c-timeout-recovery.py --help > /dev/null
 
   windows:
     name: Windows / MSVC
@@ -47,3 +57,12 @@ jobs:
         run: cmake --build build --config Release --parallel
       - name: Test
         run: ctest --test-dir build -C Release --output-on-failure
+      - name: Evidence tooling self-tests
+        run: |
+          python tools/compare_live_model_json.py --self-test
+          python -m py_compile scripts/run-live-readonly-interop.py
+          python scripts/run-live-readonly-interop.py --help | Out-Null
+          python -m py_compile scripts/run-phase4c-physical-acceptance.py
+          python scripts/run-phase4c-physical-acceptance.py --help | Out-Null
+          python -m py_compile scripts/run-phase4c-timeout-recovery.py
+          python scripts/run-phase4c-timeout-recovery.py --help | Out-Null

.github/workflows/embedded-ci.yml

@@ -0,0 +1,108 @@
+name: Embedded Profile CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  embedded-host-sim:
+    name: Embedded host-sim / ${{ matrix.compiler }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        compiler: [gcc, clang]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Select compiler
+        shell: bash
+        run: |
+          if [ "${{ matrix.compiler }}" = "clang" ]; then
+            echo "CC=clang" >> "$GITHUB_ENV"
+            echo "CXX=clang++" >> "$GITHUB_ENV"
+          else
+            echo "CC=gcc" >> "$GITHUB_ENV"
+            echo "CXX=g++" >> "$GITHUB_ENV"
+          fi
+
+      - name: Audit embedded source boundary
+        shell: bash
+        run: |
+          python3 - <<'PY'
+          from pathlib import Path
+          import re
+          import sys
+
+          cmake = Path('embedded/CMakeLists.txt').read_text(encoding='utf-8')
+          match = re.search(r'set\(ARIEC61850_EMBEDDED_SOURCES\s*(.*?)\)', cmake, re.S)
+          if not match:
+              raise SystemExit('embedded source list not found')
+
+          paths = []
+          for raw in match.group(1).splitlines():
+              raw = raw.strip()
+              if not raw or raw.startswith('#'):
+                  continue
+              raw = raw.replace('${ARIEC61850_ROOT}/', '')
+              paths.append(Path(raw))
+
+          forbidden = {
+              '#include <filesystem>': 'filesystem',
+              '#include <iostream>': 'iostream',
+              'winsock2.h': 'WinSock',
+              'windows.h': 'Windows API',
+              'sys/socket.h': 'POSIX socket API',
+              'netinet/': 'POSIX network API',
+              'ariec61850/capture/': 'PCAP/capture layer',
+              'ariec61850/comtrade/': 'COMTRADE layer',
+              'ariec61850/evidence/': 'host evidence layer',
+              'ariec61850/scl/parser': 'SCL parser',
+              'ariec61850/mms/tcp_transport': 'host TCP transport',
+              'ariec61850/mms/live_discovery': 'host live discovery',
+          }
+
+          failures = []
+          throw_count = 0
+          for path in paths:
+              if not path.is_file():
+                  failures.append(f'{path}: embedded source does not exist')
+                  continue
+              text = path.read_text(encoding='utf-8')
+              throw_count += len(re.findall(r'\bthrow\b', text))
+              for needle, label in forbidden.items():
+                  if needle in text:
+                      failures.append(f'{path}: forbidden {label} dependency ({needle})')
+
+          print(f'embedded sources={len(paths)}')
+          print(f'legacy throw tokens={throw_count} (migration debt; no-exceptions gate not enabled yet)')
+          if failures:
+              print('\n'.join(failures), file=sys.stderr)
+              raise SystemExit(1)
+          PY
+
+      - name: Configure embedded profile
+        run: >-
+          cmake -S embedded -B build-embedded
+          -DARIEC61850_EMBEDDED_NO_RTTI=ON
+          -DARIEC61850_EMBEDDED_NO_EXCEPTIONS=OFF
+          -DARIEC61850_EMBEDDED_WARNINGS_AS_ERRORS=ON
+
+      - name: Build embedded profile
+        run: cmake --build build-embedded --parallel
+
+      - name: Test embedded full-link smoke
+        run: ctest --test-dir build-embedded --output-on-failure
+
+      - name: Report host-sim footprint
+        shell: bash
+        run: |
+          if command -v size >/dev/null 2>&1; then
+            size build-embedded/ariec61850_embedded_link_smoke || true
+          fi

.github/workflows/security-evidence.yml

@@ -2,7 +2,7 @@ name: Security and Evidence
 
 on:
   push:
-    branches: [main, "agent/**"]
+    branches: [main]
   pull_request:
   workflow_dispatch:
 

.gitignore

@@ -1,18 +1,32 @@
 build/
 build-*/
 cmake-build-*/
-CMakeFiles/
-CMakeCache.txt
-Testing/
+.vs/
+.vscode/
+.idea/
 *.user
 *.suo
-*.vcxproj
-*.vcxproj.filters
-*.vcxproj.user
-*.profraw
-crash-*
-leak-*
-timeout-*
-oom-*
-slow-unit-*
-*.interop.json
+*.VC.db
+*.VC.opendb
+*.obj
+*.o
+*.a
+*.lib
+*.dll
+*.so
+*.dylib
+*.exe
+*.pdb
+*.ilk
+*.log
+*.tmp
+*.swp
+__pycache__/
+*.pyc
+interop-evidence/
+evidence/
+.artifacts/
+*-live-model.json
+*-live-runtime.json
+*-parity.json
+interop-summary.json

ASSOCIATION_RUNTIME_PROFILE.md

@@ -1,69 +1,37 @@
-# MMS Association and Report Subscription Runtime Profile
+# MMS Association, TCP, and Read-Only Discovery Runtime Profile
 
-## Scope
+## Association runtime
 
-Phase 4B adds the stateful runtime that joins the deterministic Phase 3 association codecs
-and Phase 4A reporting codecs. The runtime is transport-injected: an application supplies an
-`MmsByteTransport` implementation, while the core owns TPKT/COTP framing, Session,
-Presentation, ACSE/MMS association, confirmed-service routing, and RCB subscription state.
+`MmsAssociationRuntime` owns TPKT/COTP, Session, Presentation, ACSE/MMS Initiate, invoke
+routing, InformationReport queuing, deadline/cancellation events, disconnect, and explicit
+reconnect. It receives an `MmsByteTransport` and does not create hidden background work.
 
-## Association lifecycle
+## Built-in TCP transport
 
-`MmsAssociationRuntime` implements:
+Phase 4C adds `TcpMmsByteTransport` for Winsock and POSIX sockets. It is non-blocking, resolves
+IPv4/IPv6 endpoints, handles partial sends and receive chunks, and observes absolute deadlines
+and `std::stop_token` cancellation. It performs no protocol operation by itself.
 
-1. byte-transport connect with deadline and `std::stop_token` cancellation;
-2. COTP Connection Request/Confirm negotiation and TPDU-size capture;
-3. ISO Session Connect, Presentation CP, ACSE AARQ, and MMS Initiate exchange;
-4. accepted/rejected association validation and negotiated MMS limits;
-5. segmented COTP send and bounded reassembly on receive;
-6. monotonically allocated bounded invoke IDs;
-7. confirmed-response/error routing while interleaved InformationReports are queued;
-8. explicit timeout, cancellation, fault, and disconnect events; and
-9. best-effort COTP Disconnect Request before closing the injected transport.
+## Read-only discovery runtime
 
-A failed or timed-out confirmed exchange faults the association because the transport stream
-may no longer have a trustworthy request/response boundary. Reconnect is explicit: close or
-fault the old runtime state, refill/recreate the transport as required, and call `connect` again.
+`MmsTcpLiveDiscoverySession` combines the TCP transport, association runtime, and
+`MmsLiveDiscoveryClient`. The discovery client is restricted to GetNameList,
+GetVariableAccessAttributes, GetNamedVariableListAttributes, and Read.
 
-## Report subscription lifecycle
+Phase 4C.1 maps the resulting evidence to `live-ied-model-v1`, computes a canonical fingerprint,
+and provides repeated reconnect/discovery evidence runners. This read-only workflow never
+constructs Write, control, GI, RCB reservation/enable, dynamic DataSet mutation, or file-service
+requests.
 
-`MmsReportSubscriptionRuntime` implements a persistent static-DataSet RCB workflow:
+## Report subscription runtime
 
-1. re-probe the selected RCB immediately before any write;
-2. refuse takeover when `RptEna`, reservation, or availability evidence indicates another
-   session owns the RCB;
-3. optionally reserve an URCB using `Resv=true`;
-4. optionally write `DatSet`, `TrgOps`, and `OptFlds`;
-5. enable with `RptEna=true`;
-6. optionally request GI after enable;
-7. receive, decode, map, and monitor InformationReports until stop/cancellation/fault;
-8. disable only when this runtime enabled the RCB;
-9. release only reservations touched by this runtime; and
-10. record `cleanup_required` when the association is lost before cleanup completes.
+`MmsReportSubscriptionRuntime` remains a separate explicit stateful surface. It can probe,
+reserve/enable supported URCBs, receive reports, stop, and perform ownership-aware cleanup. It
+is not invoked by live discovery or the Phase 4C.1 evidence runner.
 
-`retry_cleanup` can be called after a successful reconnect. BRCB `EntryID` resume, purge
-policy, buffer-overflow recovery, and dynamic DataSet create/delete remain separate work.
+## Acceptance
 
-## Safety and ownership rules
-
-- The core does not silently take over an already enabled or reserved RCB.
-- Cleanup writes are limited to state touched by the current runtime instance.
-- The runtime does not include a default TCP socket implementation; live network access is
-  possible only when an application explicitly supplies an `MmsByteTransport`.
-- No control service, SBO state machine, file service, dynamic DataSet create/delete, or
-  automatic BRCB replay is enabled by this phase.
-
-## Validation
-
-The scripted transport regression covers:
-
-- successful COTP/ACSE/MMS association and negotiated limits;
-- cancellation followed by a clean reconnect;
-- confirmed request/response routing with an interleaved InformationReport;
-- confirmed-exchange timeout and fault transition;
-- URCB probe, reserve, enable, GI, report receive, disable, and reservation release;
-- cleanup-required state after association loss; and
-- refusal to take over an enabled RCB.
-
-The repository has 16 CTest entries through Phase 4B. Local GCC, Clang, and Clang
-ASan/UBSan runs pass all 16 tests with warnings treated as errors.
+Automated tests cover scripted association, routing, report interleaving, cancellation/timeout,
+TCP loopback, read-only service allowlisting, and live-model parity behavior. Physical IED
+acceptance requires the Phase 4C.1 lab runner, same-target C# parity, reconnect/soak evidence,
+and reviewed packet-capture references.