P0: exact RCB-bound InformationReport authority and fail-closed DataSet mapping

[masarray]

User-facing milestone: authoritative Reporting/RCB on native Workbench

Basing on main 953f492541b3828c30bc46218a1b86649e0e2428. The previous source mapped every received InformationReport with the currently selected RCB's ordered DataSet, even when an unrelated report arrived on the same association; Browser also matched only by RptID, not the actual selected RCB identity. This is unsafe for multi-RCB IEDs.

Implementation

• One portable MmsReportFrameBindingValidator in existing native C++ reporting engine; no secondary decoder/subscription/receive loop. Requires verified live RCB RptID and DataSet; when optional Report DatSet/ConfRev are present, verifies against RCB readback. Verifies directory nonempty; inclusion indexes are bounded, strictly increasing, unique, and each decoded value retains its exact DataSet member identity.
• At the authoritative MmsReportSubscriptionRuntime::ingest_report boundary, prechecks decoded ReportID before assigning any process-value member names, then uses the validator before publishing to offline monitor. Foreign/stale frames are counted/reported as rejected; do not inflate received_reports or poison continuity.
• Snapshot includes active selected RCB reference, rejected count, and diagnostic events. Browser reports only frames tied to selected RCB (and optional RptID verification), rather than identifying a publisher solely by ReportID.
• Negative tests cover foreign RptID, wrong DataSet, ConfRev, malformed/reordered/duplicate member indexes, wrong DataSet member, absence of verified identity/directory, and valid missing optional fields. Native GUI integration QA now requires RCB provenance on observed frames.

Reference behavior and safety

Matches ARIEC61850 MmsReportDataSetOrderValidator and ARSAS StaticDataSetReportProjectionAccumulator second-boundary exact membership principles; ported directly into ARStack's existing native C++/Qt ownership, without copying WPF/.NET or introducing hidden MMS writes. Standard OptFlds may omit DataSet/ConfRev, so their presence is conditional; do not claim a physical relay acceptance or ability to distinguish two publishers with identical wire RptID within one association without further evidence.

Required gate: exact-head C++ CI (GCC/Clang/MSVC), Reporting/interop, native IED Simulator Qt + SCL-assist, review threads all resolved, then merge with exact expected HEAD. Physical IED, Windows installed-package UI and multi-vendor behavior remain unverified.

Follow-up hardening validated by exact-head gates

• Persist selected static DataSet identity through the activation probe; refuse a rebind after discovery before any MMS mutation. Newly added scripted association regression sends three legitimate reads, then verifies zero writes on mismatch.
• GI is no longer part of the mandatory RCB Read list; it is an explicit Write(GI) trigger. Canonical engineering attach advertises GI for request path, with GI-not-sent/failed diagnostics rather than silent success. Native Browser shows recent RCB lifecycle events and bounded rejected/decode-failed counters.
• Corrected earlier scripted fixtures to exclude GI from RCB Read responses (it may be write-only), require matching RptID on static fallback report, and directly inject a foreign RptID to prove rejection counters and absence of published data. The first exact-head GCC/Clang revealed those obsolete fixture assumptions; current CI runs on revised head.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T22:22:17.874667Z	44abf02	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 44abf02a36

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[masarray]

Physical IED acceptance gate (strictly not CI proof)

For vendor/firmware under test, record selected IED endpoint, device/SCD/CID identity, selected concrete RCB reference, fresh MMS association, and DataSet directory/ConfRev readback. Use the native Browser → Reports inspector; do not switch to a different RCB and treat previous frames as new evidence.

1. Passive verification before writes: connect/attach, select one exact available URCB/BRCB instance; capture readback RptID, DatSet, ConfRev, TrgOps, OptFlds, RptEna, Resv/ResvTms/Owner when exposed. If unavailable/reserved by another client, demonstrate no forced takeover.
2. Explicit guarded enable: on user-requested enable only, verify reservation (URCB where supported), changed writes and positive readback; surface state/cleanup status and no silent success on write/confirmation error. GI is an optional Write(true) trigger, not a required Read. Confirm GI request with actual InformationReport; a successful Write alone is not value-stream acceptance.
3. Value authority: compare each observed RptID, optional DatSet/ConfRev, inclusion index, optional DataRef and mapped member/value against the selected live RCB and known DataSet ordering. Check received/rejected/decode-failed counters and bounded events, including read-only use of a second RCB. No data from one RCB may be relabeled as another.
4. Continuity/ownership: capture repeat GI/change/integrity reports (where permitted), SqNum/replay/EntryID/BufOvfl/segmentation where provided, then guarded disable. Confirm cleanup of only the association's own mutations; if connection is lost, require explicit unconfirmed-cleanup evidence.
5. Artifacts: installed Windows Workbench screenshot per stage, MMS PCAP or vendor-safe trace, table of actual value changes vs relay point, exact vendor/model/firmware, Windows package build SHA, and bounded attach-to-first-report measurement. Redact site IPs and secrets before sharing.

Gate is OPEN until hardware traces are checked; current scripted CI does not certify multi-vendor physical interoperability.