RC1 F4 field kit: restore Windows package contract and fail-closed trace provenance

[masarray]

Root cause / baseline

The legacy F4 Real IED Acceptance Kit workflow still called packaging/windows/verify-release.ps1 with the pre-PR #216 signature (missing -PortablePath and -ExpectedSourceSha). It also invoked NSIS without required /DAPP_ICON and never shipped a BUILD_HEAD.txt inside the staged installer/portable application. F4 ran only on a stale feature branch or manual dispatch, so release-package CI was green without proving the separate F4 kit could still build.

The original evidence collector accepted buildHead=unknown, captured any endpoint sharing TCP/102, and had no installed-Workbench-vs-kit SHA check. That can misattribute traffic/build provenance during actual field acceptance.

Changes

• Enable exact PR head F4 Linux protocol and Windows field-kit CI on changes to F4 packaging contract, plus post-merge main F4 artifact publication; retain explicit workflow_dispatch for all other source changes.
• Reuse resilient NSIS path/version preflight; stamp exact git HEAD/GITHUB_SHA into staged BUILD_HEAD.txt; supply actual favicon define and call source-matching Windows verifier with portable ZIP and SHA. F4 acceptance kit copies the already checked staged BUILD_HEAD instead of independently inventing provenance.
• Fail-closed collector: require complete SHA kit marker and matching actual installed/extracted Workbench in ARStack->IED mode; target literal IPv4+MMS TCP port BPF, TShark verification/positive packet count, explicit NIC index, release/source metadata, capture SHA, no automatic physical PASS.
• Update Windows field instructions and acceptance form; add standalone contract regression with mutation controls and early PowerShell syntax parse gate.

Scope and risks

No MMS/GOOSE protocol engine changes, no automation of relay Writes, no user-facing GUI redesign. PCAP remains MMS-only; the canonical GUI/GOOSE/relay acceptance matrix remains separately required. All F4 green workflow results are CI and synthetic fixture evidence, not live vendor hardware certification.

Gate

Exact-head F4 Linux and Windows jobs, Qt/naming/routing checks as triggered, clean review, merge. Re-run post-merge main F4 and require source-matching installer, portable, and complete F4 artifact before claiming RC1 field kit ready.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T02:33:17.171923Z	f8029fc	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1fc5f4948b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[masarray]

Addressed both exact-head review findings at f8029fc18d17fa31f52a58b4b966d2e7667f7388: (P1) PowerShell capture NIC match now uses valid single-backslash ^\s*$InterfaceId\. regex; the regression checks it. (P2) F4 now derives F4_SOURCE_SHA from github.event.pull_request.head.sha || github.sha, explicitly checks out that revision in both Linux and Windows jobs, checks native git HEAD against it, and stamps/verifies that same source SHA across installer, portable ZIP, and field-kit manifest. The old synthetic PR merge SHA is not used as application provenance. Previous review threads resolved after source diff verification. @codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: f8029fc18d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".