From 510b10854ab8833f4ad09a742dddb80420a728d9 Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:41:15 +0700 Subject: [PATCH 01/17] fix(identity): bind trusted SCL match to selected access point in consumer --- Services/TrustedSclIdentityAuthority.cs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Services/TrustedSclIdentityAuthority.cs b/Services/TrustedSclIdentityAuthority.cs index 2e894f5c0..a5795c14a 100644 --- a/Services/TrustedSclIdentityAuthority.cs +++ b/Services/TrustedSclIdentityAuthority.cs @@ -29,7 +29,8 @@ public static class TrustedSclIdentityAuthority source, liveModel.LogicalDevices.Select(ld => ld.MmsDomain), device.IpAddress, - device.SclIedName); + device.SclIedName, + device.SclAccessPointName); } /// @@ -87,7 +88,8 @@ public static class TrustedSclIdentityAuthority continue; var identity = TrustedSclIedIdentityMatcher.TryMatch( - document, domains, device.IpAddress, candidate.IedName); + document, domains, device.IpAddress, candidate.IedName, + candidate.AccessPointName); if (identity is null || identity.Source != "TrustedSclExactDomainMatch" || identity.Confidence != LiveIedDiscoveryConfidenceLevel.High) From 86715fba47521b743aad7f102cfcc8e39a0b0d12 Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:41:27 +0700 Subject: [PATCH 02/17] build(identity): pin tested engine P0-A exact SHA for isolated consumer trial --- engines/ARIEC61850.lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/engines/ARIEC61850.lock.json b/engines/ARIEC61850.lock.json index 8cc894215..1b5c0c6a5 100644 --- a/engines/ARIEC61850.lock.json +++ b/engines/ARIEC61850.lock.json @@ -2,13 +2,13 @@ "schemaVersion": 1, "repository": "masarray/ARIEC61850", "ref": "main", - "commit": "51c2eefd61d6bcbe1116fda6b781b74bb9cf06da", - "sourcePullRequest": 173, - "purpose": "M2.17-K isolated C264 acceptance trial: ARIEC typed ST enumerated Mod/Beh/Health/PhyHealth Report FCD projection with exact ST/quality/timestamp checks, preserving P10.9V control and fail-closed unknowns. ARIEC #173 Windows engine CI passed; integrated consumer CI/physical C264 replay pending. Do not promote or merge into main without acceptance.", + "commit": "ccf31f60095ea65f9095514f0fa0102060962049", + "sourcePullRequest": 177, + "purpose": "P0-A trial of generic exact-prefix identity, provisional MMS-only confidence, case-sensitive LD domains and endpoint/AP-bound trusted SCL reconciliation. Engine exact-SHA CI passed; consumer exact-SHA Windows CI and physical qualification required; no mainline promotion.", "previousTrialPin": { - "commit": "4467124775d8d9d76f3db194f9fbfd97144767a8", - "sourcePullRequest": 134, - "purpose": "Previous P0-5b/P0-5c field-capture engine pin retained as the physical R5 baseline before canonical communication evidence, logical RCB SCL projection, and round-trip association validation were added." + "commit": "51c2eefd61d6bcbe1116fda6b781b74bb9cf06da", + "sourcePullRequest": 173, + "purpose": "M2.17-K typed ST report baseline preserved as direct ancestor of P0-A identity trial." }, "priorGoldenWirePin": { "commit": "0023ef9a4373855497464ed3979e359c4041c95d", From 2e8f6d287ca2b4cfd39ff23a5496ca9bb178c448 Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:41:47 +0700 Subject: [PATCH 03/17] test(identity): verify five-LD SIEBCU consumer promotion and reject wrong AP/endpoint --- .../TrustedSclIdentityConsumerTests.cs | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/tests/ARSAS.Tests/TrustedSclIdentityConsumerTests.cs b/tests/ARSAS.Tests/TrustedSclIdentityConsumerTests.cs index f2476d095..9a6b99c91 100644 --- a/tests/ARSAS.Tests/TrustedSclIdentityConsumerTests.cs +++ b/tests/ARSAS.Tests/TrustedSclIdentityConsumerTests.cs @@ -23,6 +23,40 @@ public async Task GE_F650_SHA_Pinned_Engineering_Source_Promotes_IED_And_LD_With Assert.Equal("F650",Assert.Single(projected.LogicalDevices).Instance); } + + [Fact] + public async Task Five_Ld_SIEBCU_Identity_Is_Verified_Only_By_Matching_Pinned_Scl_Endpoint_And_Ap() + { + using var temp=TempScl.Create("SIEBCU","CTRL","192.0.2.20"); + var path=temp.Device.SclSourcePath; + var xml=File.ReadAllText(path); + xml=xml.Replace("", """ + + """, StringComparison.Ordinal); + File.WriteAllText(path,xml); + temp.Device.SclSourceSha256=Convert.ToHexString(SHA256.HashData(File.ReadAllBytes(path))); + var domains=new[] {"SIEBCUCTRL","SIEBCUMEAS","SIEBCUPROT","SIEBCUUD1","SIEBCUUD2"}; + var model=new LiveIedModelDiscoveryDocument + { + Host="192.0.2.20", + LogicalDevices=domains.Select(x=>new LiveIedLogicalDeviceModel{MmsDomain=x,Inst=x}).ToArray() + }; + var verified=await TrustedSclIdentityAuthority.TryMatchAsync(temp.Device,model); + Assert.NotNull(verified); + Assert.Equal("SIEBCU",verified.IedName); + Assert.Equal(LiveIedDiscoveryConfidenceLevel.High,verified.Confidence); + Assert.Equal(5,verified.LogicalDeviceAliases.Count); + var projected=TrustedSclIdentityAuthority.ToConsumerIdentity(verified,domains); + Assert.Equal("SIEBCU",projected.IedName); + Assert.Equal("UD2",projected.LogicalDevices.Single(x=>x.Domain=="SIEBCUUD2").Instance); + + temp.Device.SclAccessPointName="WRONG_AP"; + Assert.Null(await TrustedSclIdentityAuthority.TryMatchAsync(temp.Device,model)); + temp.Device.SclAccessPointName="S1"; + temp.Device.IpAddress="192.0.2.21"; + Assert.Null(await TrustedSclIdentityAuthority.TryMatchAsync(temp.Device,model)); + } + [Fact] public async Task Changed_SCL_SHA_Must_Fail_Closed_And_Never_Rename() { From b2584c8a13b1b7cb0fbf865d41681589f7ee1905 Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:46:50 +0700 Subject: [PATCH 04/17] build(identity): preserve historical physical baseline pin and declare exact P0-A trial lineage --- engines/ARIEC61850.lock.json | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/engines/ARIEC61850.lock.json b/engines/ARIEC61850.lock.json index 1b5c0c6a5..0cae6ece8 100644 --- a/engines/ARIEC61850.lock.json +++ b/engines/ARIEC61850.lock.json @@ -6,9 +6,9 @@ "sourcePullRequest": 177, "purpose": "P0-A trial of generic exact-prefix identity, provisional MMS-only confidence, case-sensitive LD domains and endpoint/AP-bound trusted SCL reconciliation. Engine exact-SHA CI passed; consumer exact-SHA Windows CI and physical qualification required; no mainline promotion.", "previousTrialPin": { - "commit": "51c2eefd61d6bcbe1116fda6b781b74bb9cf06da", - "sourcePullRequest": 173, - "purpose": "M2.17-K typed ST report baseline preserved as direct ancestor of P0-A identity trial." + "commit": "4467124775d8d9d76f3db194f9fbfd97144767a8", + "sourcePullRequest": 134, + "purpose": "Historical P0-5b/P0-5c field-capture engine baseline required by immutable golden evidence and smart-discovery capture gates." }, "priorGoldenWirePin": { "commit": "0023ef9a4373855497464ed3979e359c4041c95d", @@ -270,5 +270,19 @@ "physicalQualificationRequired": true, "mainlinePromotionForbidden": true, "cyclicMmsProcessPollingForbidden": true + }, + "p0AIdentityTrial": { + "status": "code-verified-engine-consumer-trial-not-physical", + "enginePullRequest": 177, + "consumerPullRequest": 625, + "baseEngineCommit": "51c2eefd61d6bcbe1116fda6b781b74bb9cf06da", + "exactCommit": "ccf31f60095ea65f9095514f0fa0102060962049", + "engineCiRun": 39228439974, + "fullDomainSetRequired": true, + "sclSha256Required": true, + "endpointAndAccessPointRequired": true, + "provisionalHeuristicOnly": true, + "physicalQualificationRequired": true, + "mainlinePromotionForbidden": true } } From 0e3eba9bd9f35c568511b2cf84f0ed73413db3fe Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:47:34 +0700 Subject: [PATCH 05/17] test(identity): preserve historical trial ancestry while admitting exact P0-A child --- .../SmartInteroperabilityTrialGuardRegressionTests.cs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tests/ARSAS.Tests/SmartInteroperabilityTrialGuardRegressionTests.cs b/tests/ARSAS.Tests/SmartInteroperabilityTrialGuardRegressionTests.cs index 0225ca225..6153f2357 100644 --- a/tests/ARSAS.Tests/SmartInteroperabilityTrialGuardRegressionTests.cs +++ b/tests/ARSAS.Tests/SmartInteroperabilityTrialGuardRegressionTests.cs @@ -118,9 +118,14 @@ public void TrialLock_PreservesHistoricalPhysicalAuthorityAndExplicitlyRequiresP typedStatusTrial.GetProperty("previousConsumerPin").GetString()); Assert.Equal("51c2eefd61d6bcbe1116fda6b781b74bb9cf06da", typedStatusTrial.GetProperty("exactCommit").GetString()); + var identityTrial = root.GetProperty("p0AIdentityTrial"); Assert.Equal(typedStatusTrial.GetProperty("exactCommit").GetString(), + identityTrial.GetProperty("baseEngineCommit").GetString()); + Assert.Equal(identityTrial.GetProperty("exactCommit").GetString(), root.GetProperty("commit").GetString()); - Assert.Equal(173, root.GetProperty("sourcePullRequest").GetInt32()); + Assert.Equal(177, root.GetProperty("sourcePullRequest").GetInt32()); + Assert.True(identityTrial.GetProperty("physicalQualificationRequired").GetBoolean()); + Assert.True(identityTrial.GetProperty("mainlinePromotionForbidden").GetBoolean()); Assert.Equal(618, typedStatusTrial.GetProperty("consumerPullRequest").GetInt32()); Assert.True(typedStatusTrial.GetProperty("strictFcAndTupleEvidenceRequired").GetBoolean()); Assert.True(typedStatusTrial.GetProperty("physicalQualificationRequired").GetBoolean()); From 10485e79136b0cdc6d211e37a24c89c2594f6427 Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:47:38 +0700 Subject: [PATCH 06/17] test(identity): preserve historical trial ancestry while admitting exact P0-A child --- tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs b/tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs index e3351a288..711e43439 100644 --- a/tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs +++ b/tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs @@ -474,9 +474,12 @@ public void EngineLock_PreservesPhysicalSclRepairBaselineAcrossCodeVerifiedInter typedStatusTrial.GetProperty("previousConsumerPin").GetString()); Assert.Equal("51c2eefd61d6bcbe1116fda6b781b74bb9cf06da", typedStatusTrial.GetProperty("exactCommit").GetString()); + var identityTrial = root.GetProperty("p0AIdentityTrial"); Assert.Equal(typedStatusTrial.GetProperty("exactCommit").GetString(), + identityTrial.GetProperty("baseEngineCommit").GetString()); + Assert.Equal(identityTrial.GetProperty("exactCommit").GetString(), root.GetProperty("commit").GetString()); - Assert.Equal(173, root.GetProperty("sourcePullRequest").GetInt32()); + Assert.Equal(177, root.GetProperty("sourcePullRequest").GetInt32()); Assert.Equal(618, typedStatusTrial.GetProperty("consumerPullRequest").GetInt32()); Assert.True(typedStatusTrial.GetProperty("strictFcAndTupleEvidenceRequired").GetBoolean()); Assert.True(typedStatusTrial.GetProperty("physicalQualificationRequired").GetBoolean()); From c326c50f3a51e3d94b31a918404a0d206d79ec85 Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:47:41 +0700 Subject: [PATCH 07/17] test(identity): preserve historical trial ancestry while admitting exact P0-A child --- .../M217KC264TypedStatusReportIntegrationTests.cs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/ARSAS.Tests/M217KC264TypedStatusReportIntegrationTests.cs b/tests/ARSAS.Tests/M217KC264TypedStatusReportIntegrationTests.cs index 431c34b23..457489d0f 100644 --- a/tests/ARSAS.Tests/M217KC264TypedStatusReportIntegrationTests.cs +++ b/tests/ARSAS.Tests/M217KC264TypedStatusReportIntegrationTests.cs @@ -68,9 +68,11 @@ public void TestProductUsesExplicitlyApprovedEngineCommitNotPreviouslyPinnedDll( using var lockDocument = JsonDocument.Parse(File.ReadAllText( Path.Combine(root!.FullName, "engines", "ARIEC61850.lock.json"))); var lockRoot = lockDocument.RootElement; - Assert.Equal(ExpectedEngineSha, + var identityTrial = lockRoot.GetProperty("p0AIdentityTrial"); + Assert.Equal(ExpectedEngineSha, identityTrial.GetProperty("baseEngineCommit").GetString()); + Assert.Equal(identityTrial.GetProperty("exactCommit").GetString(), lockRoot.GetProperty("commit").GetString()); - Assert.Equal(173, lockRoot.GetProperty("sourcePullRequest").GetInt32()); + Assert.Equal(177, lockRoot.GetProperty("sourcePullRequest").GetInt32()); var trial = lockRoot.GetProperty("m217KTypedStatusReportTrial"); Assert.Equal("036e2c00d83a0815b6160147b14ea05975057965", trial.GetProperty("previousConsumerPin").GetString()); From 29e3211eeedd53aa0a5bf1b3a2a65e99c610f6a4 Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:47:55 +0700 Subject: [PATCH 08/17] test(identity): exercise historical R10 trial fixture independently from new P0-A pin --- tests/ARSAS.Tests/P10MainlinePolicyExecutionTests.cs | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/tests/ARSAS.Tests/P10MainlinePolicyExecutionTests.cs b/tests/ARSAS.Tests/P10MainlinePolicyExecutionTests.cs index e4f1db0b9..dc6ec3622 100644 --- a/tests/ARSAS.Tests/P10MainlinePolicyExecutionTests.cs +++ b/tests/ARSAS.Tests/P10MainlinePolicyExecutionTests.cs @@ -119,6 +119,17 @@ public void Exact_CI_Gate_Fails_Closed_Without_False_Physical_Promotion( var lockDoc = JsonNode.Parse(File.ReadAllText(Path.Combine(root, "engines", "ARIEC61850.lock.json")))!.AsObject(); + // Historical R10 gate tests its own already-qualified M2.17-K + // baseline. The P0-A child is a distinct non-physical trial, not + // retroactive evidence that R10's historical pin changed. + if (scenario == "p10-stacked-valid" || + scenario.StartsWith("m217k-", StringComparison.Ordinal)) + { + lockDoc["commit"] = "51c2eefd61d6bcbe1116fda6b781b74bb9cf06da"; + lockDoc["sourcePullRequest"] = 173; + lockDoc["purpose"] = "M2.17-K isolated C264 acceptance trial"; + } + string baseRef = "fix/512-goose-event-header-alignment"; string sourceRef = "512/merge"; switch (scenario) From 509cbb0ce3ce36238e6988f9b403e1b3444b077f Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:48:38 +0700 Subject: [PATCH 09/17] test(identity): add ancestry-bound code-only trial policy without weakening physical gates --- scripts/test-p0-a-identity-trial.ps1 | 34 ++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 scripts/test-p0-a-identity-trial.ps1 diff --git a/scripts/test-p0-a-identity-trial.ps1 b/scripts/test-p0-a-identity-trial.ps1 new file mode 100644 index 000000000..ad509be37 --- /dev/null +++ b/scripts/test-p0-a-identity-trial.ps1 @@ -0,0 +1,34 @@ +# P0-A identity is a code-only descendant of the immutable M2.17-K engine. +# This verifier deliberately never changes historical physical acceptance. +function Test-P0AIdentityTrial { + param([Parameter(Mandatory = $true)]$Lock) + + $trial = $Lock.p0AIdentityTrial + if ($null -eq $trial) { return $false } + + . (Join-Path $PSScriptRoot 'test-m217k-typed-status-trial.ps1') + $parent = $Lock | ConvertTo-Json -Depth 100 | ConvertFrom-Json + $parent.commit = '51c2eefd61d6bcbe1116fda6b781b74bb9cf06da' + $parent.sourcePullRequest = 173 + $parent.purpose = 'M2.17-K isolated C264 acceptance trial' + if (-not (Test-M217KTypedStatusTrial -Lock $parent)) { return $false } + + return ( + [string]$Lock.repository -ceq 'masarray/ARIEC61850' -and + [string]$Lock.ref -ceq 'main' -and + [string]$Lock.commit -ceq 'ccf31f60095ea65f9095514f0fa0102060962049' -and + [int]$Lock.sourcePullRequest -eq 177 -and + [string]$trial.status -ceq 'code-verified-engine-consumer-trial-not-physical' -and + [int]$trial.enginePullRequest -eq 177 -and + [int]$trial.consumerPullRequest -eq 625 -and + [string]$trial.baseEngineCommit -ceq '51c2eefd61d6bcbe1116fda6b781b74bb9cf06da' -and + [string]$trial.exactCommit -ceq $Lock.commit -and + [long]$trial.engineCiRun -eq 39228439974 -and + [bool]$trial.fullDomainSetRequired -and + [bool]$trial.sclSha256Required -and + [bool]$trial.endpointAndAccessPointRequired -and + [bool]$trial.provisionalHeuristicOnly -and + [bool]$trial.physicalQualificationRequired -and + [bool]$trial.mainlinePromotionForbidden + ) +} From 9caeb69d5d1e2df87e7921a94538a9cbe69ef5ad Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:48:59 +0700 Subject: [PATCH 10/17] ci(identity): admit only ancestry-proven P0-A trial while keeping physical promotion forbidden --- .github/workflows/interoperability-reference-guard.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/interoperability-reference-guard.yml b/.github/workflows/interoperability-reference-guard.yml index 09e296d31..7d509906e 100644 --- a/.github/workflows/interoperability-reference-guard.yml +++ b/.github/workflows/interoperability-reference-guard.yml @@ -88,6 +88,8 @@ jobs: . .\ARSAS\scripts\test-m217k-typed-status-trial.ps1 $coreRoutingTrialValid = Test-P109FCoreRoutingTrial -Lock $lock $m217KTrialValid = Test-M217KTypedStatusTrial -Lock $lock + . .\ARSAS\scripts\test-p0-a-identity-trial.ps1 + $p0AIdentityTrialValid = Test-P0AIdentityTrial -Lock $lock $trial = $lock.smartInteroperabilityCodeTrial $serverAt = $lock.sclServerAtTrial $originalTrial = $lock.commit -eq $trial.exactCommit -and @@ -135,7 +137,7 @@ jobs: if ($trial.status -ne 'code-verified-not-physical' -or [int]$trial.issue -ne 144 -or [int]$trial.integrationPullRequest -ne 148 -or - -not ($originalTrial -or $serverAtTrial -or $datasetTrial -or $p10Trial -or $coreRoutingTrialValid -or $m217KTrialValid) -or + -not ($originalTrial -or $serverAtTrial -or $datasetTrial -or $p10Trial -or $coreRoutingTrialValid -or $m217KTrialValid -or $p0AIdentityTrialValid) -or -not [bool]$trial.fullDiscoveryFallbackForbidden -or -not [bool]$trial.vendorBranchingForbidden -or -not [bool]$trial.physicalPromotionRequired) { From 14b9dd3f0ac877e54bcf63984bf8903b9d344c96 Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:49:02 +0700 Subject: [PATCH 11/17] ci(identity): admit only ancestry-proven P0-A trial while keeping physical promotion forbidden --- .github/workflows/scl-interoperability-r7.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scl-interoperability-r7.yml b/.github/workflows/scl-interoperability-r7.yml index 09ce6eb2a..27a4151dc 100644 --- a/.github/workflows/scl-interoperability-r7.yml +++ b/.github/workflows/scl-interoperability-r7.yml @@ -85,6 +85,8 @@ jobs: . .\ARSAS\scripts\test-m217k-typed-status-trial.ps1 $coreRoutingTrialValid = Test-P109FCoreRoutingTrial -Lock $lock $m217KTrialValid = Test-M217KTypedStatusTrial -Lock $lock + . .\ARSAS\scripts\test-p0-a-identity-trial.ps1 + $p0AIdentityTrialValid = Test-P0AIdentityTrial -Lock $lock $trial = $lock.smartInteroperabilityCodeTrial if ($null -ne $trial -and $lock.commit -eq $trial.exactCommit) { if ([int]$lock.sourcePullRequest -ne 148 -or @@ -150,7 +152,7 @@ jobs: } Write-Host 'P10 trusted-SCL identity trial accepted for code CI ONLY; R7/R10 physical gate unchanged.' } - elseif ($m217KTrialValid) { + elseif ($m217KTrialValid -or $p0AIdentityTrialValid) { if ($env:GITHUB_BASE_REF -eq 'main' -or $env:GITHUB_REF_NAME -eq 'main') { throw 'M2.17-K is not physically accepted and cannot run as a mainline promotion.' } From 201b3e54e282ff2515a0579306d1ce70f1e4e607 Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:49:05 +0700 Subject: [PATCH 12/17] ci(identity): admit only ancestry-proven P0-A trial while keeping physical promotion forbidden --- .github/workflows/smart-discovery-mainline-readiness.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/smart-discovery-mainline-readiness.yml b/.github/workflows/smart-discovery-mainline-readiness.yml index 44a927237..31cef11e8 100644 --- a/.github/workflows/smart-discovery-mainline-readiness.yml +++ b/.github/workflows/smart-discovery-mainline-readiness.yml @@ -113,6 +113,8 @@ jobs: . .\scripts\test-m217k-typed-status-trial.ps1 $coreRoutingTrialValid = Test-P109FCoreRoutingTrial -Lock $lock $m217KTrialValid = Test-M217KTypedStatusTrial -Lock $lock + . .\ARSAS\scripts\test-p0-a-identity-trial.ps1 + $p0AIdentityTrialValid = Test-P0AIdentityTrial -Lock $lock $trial = $lock.smartInteroperabilityCodeTrial $serverAt = $lock.sclServerAtTrial $closure = $lock.datasetFirstDiscoveryTrial @@ -164,7 +166,7 @@ jobs: $lock.commit -eq $p10.exactCommit -and [int]$lock.sourcePullRequest -eq 161 - if ($originalTrial -or $serverAtTrial -or $datasetTrial -or $p10Trial -or $coreRoutingTrialValid -or $m217KTrialValid) { + if ($originalTrial -or $serverAtTrial -or $datasetTrial -or $p10Trial -or $coreRoutingTrialValid -or $m217KTrialValid -or $p0AIdentityTrialValid) { if (-not $historicalTrialValid -or $lock.ref -ne 'main') { throw 'Stacked trial identity or ancestor authority is inconsistent.' From 631522803a94b1a9861d6e2071ab9b20cf1e73c9 Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:49:21 +0700 Subject: [PATCH 13/17] test(identity): execute exact P0-A policy helper inside isolated historical gate fixtures --- tests/ARSAS.Tests/P10MainlinePolicyExecutionTests.cs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/ARSAS.Tests/P10MainlinePolicyExecutionTests.cs b/tests/ARSAS.Tests/P10MainlinePolicyExecutionTests.cs index dc6ec3622..740361e0d 100644 --- a/tests/ARSAS.Tests/P10MainlinePolicyExecutionTests.cs +++ b/tests/ARSAS.Tests/P10MainlinePolicyExecutionTests.cs @@ -116,6 +116,8 @@ public void Exact_CI_Gate_Fails_Closed_Without_False_Physical_Promotion( // must execute the same immutable-trial gate, not a missing script. File.Copy(Path.Combine(root, "scripts", "test-m217k-typed-status-trial.ps1"), Path.Combine(folder, "scripts", "test-m217k-typed-status-trial.ps1")); + File.Copy(Path.Combine(root, "scripts", "test-p0-a-identity-trial.ps1"), + Path.Combine(folder, "scripts", "test-p0-a-identity-trial.ps1")); var lockDoc = JsonNode.Parse(File.ReadAllText(Path.Combine(root, "engines", "ARIEC61850.lock.json")))!.AsObject(); From f97db9a083e2c907b09a1d9b63571a2f3fe15e34 Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:50:39 +0700 Subject: [PATCH 14/17] ci(identity): respect mainline workflow root and executable sandbox test path --- .github/workflows/smart-discovery-mainline-readiness.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/smart-discovery-mainline-readiness.yml b/.github/workflows/smart-discovery-mainline-readiness.yml index 31cef11e8..e26c26f2e 100644 --- a/.github/workflows/smart-discovery-mainline-readiness.yml +++ b/.github/workflows/smart-discovery-mainline-readiness.yml @@ -113,7 +113,7 @@ jobs: . .\scripts\test-m217k-typed-status-trial.ps1 $coreRoutingTrialValid = Test-P109FCoreRoutingTrial -Lock $lock $m217KTrialValid = Test-M217KTypedStatusTrial -Lock $lock - . .\ARSAS\scripts\test-p0-a-identity-trial.ps1 + . .\scripts\test-p0-a-identity-trial.ps1 $p0AIdentityTrialValid = Test-P0AIdentityTrial -Lock $lock $trial = $lock.smartInteroperabilityCodeTrial $serverAt = $lock.sclServerAtTrial From e098d627dcfa09296680e5d2b77709687e4d980b Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:50:59 +0700 Subject: [PATCH 15/17] ci(identity): authorize exact ancestry-bound P0-A pin in shared immutable lock resolver --- scripts/resolve-ariec-lock.ps1 | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scripts/resolve-ariec-lock.ps1 b/scripts/resolve-ariec-lock.ps1 index 2856f8fbf..c70266497 100644 --- a/scripts/resolve-ariec-lock.ps1 +++ b/scripts/resolve-ariec-lock.ps1 @@ -121,13 +121,16 @@ if ($null -ne $lock.sclAssociationInteroperability) { . (Join-Path $PSScriptRoot 'test-m217k-typed-status-trial.ps1') $coreRoutingTrialValid = Test-P109FCoreRoutingTrial -Lock $lock $m217KTrialValid = Test-M217KTypedStatusTrial -Lock $lock + . (Join-Path $PSScriptRoot 'test-p0-a-identity-trial.ps1') + $p0AIdentityTrialValid = Test-P0AIdentityTrial -Lock $lock $acceptedTrial = ( ($trialValid -and [string]$lock.commit -ceq [string]$trial.exactCommit -and [int]$lock.sourcePullRequest -eq 148) -or ($serverAtValid -and [string]$lock.commit -ceq [string]$serverAt.exactCommit -and [int]$lock.sourcePullRequest -eq 153) -or ($closureValid -and [string]$lock.commit -ceq [string]$closure.exactCommit -and [int]$lock.sourcePullRequest -eq 157) -or ($p10Valid -and [string]$lock.commit -ceq [string]$p10.exactCommit -and [int]$lock.sourcePullRequest -eq 161) -or ($p10Valid -and $coreRoutingTrialValid) -or - $m217KTrialValid + $m217KTrialValid -or + $p0AIdentityTrialValid ) if (-not $historicalAnchorValid -or -not $acceptedTrial) { throw 'SCL association physical-tested engine head differs from integration lock.' From 5f9f7c37412cd64cbeb92137218af2e35fefecf9 Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:54:45 +0700 Subject: [PATCH 16/17] test(identity): assert immutable C264 PR ancestry separately from current P0-A PR --- tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs b/tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs index 711e43439..2fe8376f4 100644 --- a/tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs +++ b/tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs @@ -521,9 +521,9 @@ public void EngineLock_PreservesPhysicalSclRepairBaselineAcrossCodeVerifiedInter Assert.True(zivTrial.GetProperty("mainlinePromotionForbidden").GetBoolean()); Assert.True(zivTrial.GetProperty("fullDiscoveryFallbackForbidden").GetBoolean()); Assert.True(zivTrial.GetProperty("cyclicMmsProcessPollingForbidden").GetBoolean()); - // The current C264 report trial is PR #173, while the previous - // P10.9V control authority remains the unchanged PR #169. - Assert.Equal(173, root.GetProperty("sourcePullRequest").GetInt32()); + // Historical C264 remains PR #173; current P0-A identity trial is #177. + Assert.Equal(173, typedStatusTrial.GetProperty("sourcePullRequest").GetInt32()); + Assert.Equal(177, root.GetProperty("sourcePullRequest").GetInt32()); Assert.Equal(169, typedBscTrial.GetProperty("enginePullRequest").GetInt32()); Assert.True(genericTrial.GetProperty("typedSemanticGateRequired").GetBoolean()); Assert.True(genericTrial.GetProperty("associationScopedInventoryRequired").GetBoolean()); From 5c9f2732f9ce68290c2fb7d16f221e382a68eac9 Mon Sep 17 00:00:00 2001 From: Ari Sulistiono Date: Mon, 19 Oct 2026 16:54:48 +0700 Subject: [PATCH 17/17] test(identity): assert immutable C264 PR ancestry separately from current P0-A PR --- .../SmartInteroperabilityTrialGuardRegressionTests.cs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/ARSAS.Tests/SmartInteroperabilityTrialGuardRegressionTests.cs b/tests/ARSAS.Tests/SmartInteroperabilityTrialGuardRegressionTests.cs index 6153f2357..ea739723b 100644 --- a/tests/ARSAS.Tests/SmartInteroperabilityTrialGuardRegressionTests.cs +++ b/tests/ARSAS.Tests/SmartInteroperabilityTrialGuardRegressionTests.cs @@ -171,9 +171,9 @@ public void TrialLock_PreservesHistoricalPhysicalAuthorityAndExplicitlyRequiresP Assert.True(zivTrial.GetProperty("mainlinePromotionForbidden").GetBoolean()); Assert.True(zivTrial.GetProperty("fullDiscoveryFallbackForbidden").GetBoolean()); Assert.True(zivTrial.GetProperty("cyclicMmsProcessPollingForbidden").GetBoolean()); - // The current C264 report trial is PR #173, while the previous - // P10.9V control authority remains the unchanged PR #169. - Assert.Equal(173, root.GetProperty("sourcePullRequest").GetInt32()); + // Historical C264 remains PR #173; current P0-A identity trial is #177. + Assert.Equal(173, typedStatusTrial.GetProperty("sourcePullRequest").GetInt32()); + Assert.Equal(177, root.GetProperty("sourcePullRequest").GetInt32()); Assert.Equal(169, typedBscTrial.GetProperty("enginePullRequest").GetInt32()); Assert.Equal(540, genericTrial.GetProperty("issue").GetInt32()); Assert.Equal(38231327892L, genericTrial.GetProperty("engineCiRun").GetInt64());