masarray · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026
@@ -15,8 +15,59 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  pr-scope:
+    name: Verify documentation-only PR scope (fail closed)
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      needs_windows: ${{ steps.files.outputs.needs_windows }}
+    steps:
+      - id: files
+        name: Read all changed PR paths without checkout or Windows
+        uses: actions/github-script@v7
+        with:
+          script: |
+            // Fail closed on missing/ambiguous/renamed inputs and any API/job error.
+            let needsWindows = true;
+            try {
+              const files = await github.paginate(github.rest.pulls.listFiles, {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: context.issue.number,
+                per_page: 100
+              });
+              const documentationOnly = files.length > 0 && files.length < 3000 &&
+                files.every(({ filename, status, previous_filename }) => {
+                  const allowedPath = filename === 'README.md' ||
+                    (filename.startsWith('docs/') && filename.endsWith('.md') &&
+                     filename !== 'docs/INTEROPERABILITY_REFERENCE_CONTRACT.md');
+                  // Renamed and deleted documents can conceal source removals.
+                  return allowedPath && (status === 'added' || status === 'modified') &&
+                    !previous_filename;
+                });
+              needsWindows = !documentationOnly;
+              core.info(`Changed paths=${files.length}, Windows required=${needsWindows}`);
+            } catch (error) {
+              core.warning(`Cannot certify docs-only PR: ${error.message}; full Windows required.`);
+            }
+            core.setOutput('needs_windows', needsWindows ? 'true' : 'false');
+
   build-windows:
     name: Build, test, validate and package Windows application
+    needs: [pr-scope]
+    # The classifier may fail before emitting outputs. Anything except an
+    # explicit verified 'false' still triggers the full canonical Windows job.
+    # Push/manual do not run pr-scope, but MUST run canonical Windows proof.
+    if: >-
+      ${{
+        always() &&
+        (github.event_name != 'pull_request' ||
+         needs.pr-scope.result != 'success' ||
+         needs.pr-scope.outputs.needs_windows != 'false')
+      }}
     runs-on: windows-latest
     steps:
       - name: Checkout exact triggering ARSAS revision

@@ -7,6 +7,8 @@ on:
       - ".github/workflows/**"
       - "scripts/audit-ci-workflows.py"
       - "scripts/test-ci-workflows.py"
+      - "scripts/verify-p7-dual-ingress-diagnostic.py"
+      - "scripts/test-p7-dual-ingress-diagnostic.py"
       - "scripts/classify-ci-changes.py"
       - "scripts/test-classify-ci-changes.py"
       - "scripts/write-ci-canonical-proof.py"
@@ -32,6 +34,8 @@ on:
       - ".github/workflows/**"
       - "scripts/audit-ci-workflows.py"
       - "scripts/test-ci-workflows.py"
+      - "scripts/verify-p7-dual-ingress-diagnostic.py"
+      - "scripts/test-p7-dual-ingress-diagnostic.py"
       - "scripts/classify-ci-changes.py"
       - "scripts/test-classify-ci-changes.py"
       - "scripts/write-ci-canonical-proof.py"
@@ -78,6 +82,9 @@ jobs:
       - name: Run offline CI workflow guard tests
         run: python3 scripts/test-ci-workflows.py
 
+      - name: Validate sanitized P7.6 dual-ingress diagnostic parser (read-only)
+        run: python3 scripts/test-p7-dual-ingress-diagnostic.py
+
       - name: Run conservative CI P1 classifier fixtures
         run: python3 scripts/test-classify-ci-changes.py
 

@@ -1,4 +1,5 @@
 name: Release ARSAS Windows packages
+run-name: "ARSAS Windows · ${{ github.ref_name }} · ${{ github.event_name }}"
 
 on:
   push:
@@ -10,9 +11,9 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: "Release version, for example 1.6.19"
-        required: true
-        default: "1.6.20"
+        description: "Optional: blank = VERSION from selected branch (recommended)"
+        required: false
+        default: ""
         type: string
       publish_release:
         description: "Create or update a GitHub Release"
@@ -63,11 +64,11 @@ jobs:
           python-version: '3.12'
 
       - name: Run offline release-ready and installer-verifier fixtures
+        shell: bash
         run: |
-          python .\ArIED61850Tester\scripts\test-ci-release-ready.py
-          if ($LASTEXITCODE -ne 0) { throw 'Release-ready metadata gate fixtures failed.' }
-          python .\ArIED61850Tester\scripts\test-ci-installer-reuse.py
-          if ($LASTEXITCODE -ne 0) { throw 'Validated-installer verifier fixtures failed.' }
+          set -euo pipefail
+          python ./ArIED61850Tester/scripts/test-ci-release-ready.py
+          python ./ArIED61850Tester/scripts/test-ci-installer-reuse.py
 
       - name: Wait for exact immutable release dependencies
         id: ready
@@ -76,9 +77,9 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           $proofPath = Join-Path $env:RUNNER_TEMP 'arsas-release-ready.json'
-          python .\ArIED61850Tester\scripts\wait-ci-release-ready.py `
+          python ./ArIED61850Tester/scripts/wait-ci-release-ready.py `
             --repository $env:GITHUB_REPOSITORY `
-            --source-dir .\ArIED61850Tester `
+            --source-dir ./ArIED61850Tester `
             --source-sha $env:GITHUB_SHA `
             --ref-type $env:GITHUB_REF_TYPE `
             --ref-name $env:GITHUB_REF_NAME `
@@ -166,9 +167,16 @@ jobs:
       - name: Resolve release identity and immutable engine locks
         id: release
         shell: powershell
+        env:
+          MANUAL_VERSION: ${{ inputs.version }}
         run: |
           if ($env:GITHUB_EVENT_NAME -eq "workflow_dispatch") {
-            $rawVersion = "${{ inputs.version }}"
+            # Package the checked-out revision by default. This avoids stale
+            # hardcoded workflow versions and operator/main metadata mismatches.
+            $rawVersion = [string]$env:MANUAL_VERSION
+            if ([string]::IsNullOrWhiteSpace($rawVersion)) {
+              $rawVersion = (Get-Content ".\ArIED61850Tester\VERSION" -Raw).Trim()
+            }
           }
           elseif ($env:GITHUB_REF_TYPE -eq "tag") {
             $rawVersion = $env:GITHUB_REF_NAME
@@ -478,8 +486,15 @@ jobs:
             -EngineProject "$env:GITHUB_WORKSPACE\ARIEC61850\src\AR.Iec61850\AR.Iec61850.csproj" `
             -NpcapProject "$env:GITHUB_WORKSPACE\ARIEC61850\src\AR.Iec61850.Transports.Npcap\AR.Iec61850.Transports.Npcap.csproj" `
             -ArdIrecSource "$env:GITHUB_WORKSPACE\ArdIrec"
-          "RELEASE_PORTABLE_PATH=$env:GITHUB_WORKSPACE\ArIED61850Tester\dist\ARSAS-$env:RELEASE_VERSION-win-x64-portable.exe" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
-          $manualPortableSha = (Get-FileHash $env:RELEASE_PORTABLE_PATH -Algorithm SHA256).Hash.ToLowerInvariant()
+          # GITHUB_ENV is applied only to SUBSEQUENT steps. The path must be
+          # computed, verified and hashed locally in this same step before
+          # exporting it for downstream release smoke/provenance checks.
+          $releasePortable = Join-Path $env:GITHUB_WORKSPACE "ArIED61850Tester\dist\ARSAS-$env:RELEASE_VERSION-win-x64-portable.exe"
+          if (-not (Test-Path $releasePortable -PathType Leaf)) {
+            throw "Manual release portable EXE is missing: $releasePortable"
+          }
+          $manualPortableSha = (Get-FileHash $releasePortable -Algorithm SHA256).Hash.ToLowerInvariant()
+          "RELEASE_PORTABLE_PATH=$releasePortable" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
           "RELEASE_CANONICAL_PORTABLE_SHA256=$manualPortableSha" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
 
       - name: Stage unified release regression evidence
@@ -863,20 +878,51 @@ jobs:
             "release", "create", $env:RELEASE_TAG,
             "--repo", $env:GITHUB_REPOSITORY,
             "--target", $env:GITHUB_SHA,
-            "--title", "ARSAS $env:RELEASE_VERSION",
-            "--generate-notes",
-            "--latest"
+            "--title", "ARSAS $env:RELEASE_VERSION"
           )
-          if ($env:RELEASE_VERSION.Contains("-") -or ($env:GITHUB_REF_TYPE -ne "tag" -and $env:GITHUB_REF -ne "refs/heads/main" -and $env:MANUAL_PRERELEASE -eq "true")) {
+          # A manual publish from a staging branch is ALWAYS a public preview.
+          # A preview must never take over /releases/latest, even if a caller
+          # accidentally supplies prerelease=false in the workflow dialog.
+          $isStagingManual = $env:GITHUB_EVENT_NAME -eq "workflow_dispatch" -and
+                             $env:GITHUB_REF -ne "refs/heads/main"
+          $isPreview = $env:RELEASE_VERSION.Contains("-") -or $isStagingManual -or
+                       $env:MANUAL_PRERELEASE -eq "true"
+          if ($isPreview) {
             $arguments += "--prerelease"
+            # The current release candidate has independently accepted
+            # operator FAT scope and equally explicit unresolved limitations.
+            # Never replace those notes with automated commit-title noise.
+            $notes = Join-Path $env:GITHUB_WORKSPACE "ArIED61850Tester\docs\release\ARSAS_V1642_PUBLIC_PREVIEW_NOTES.md"
+            if ($env:RELEASE_VERSION -eq "1.6.42" -and (Test-Path $notes -PathType Leaf)) {
+              $arguments += @("--notes-file", $notes)
+            }
+            else {
+              # Future preview versions remain packagable without a
+              # version-specific document; don't create another workflow gate.
+              $arguments += "--generate-notes"
+            }
+          }
+          else {
+            $arguments += "--latest"
+            $arguments += "--generate-notes"
           }
           $arguments += $assets
 
           & gh @arguments
           if ($LASTEXITCODE -ne 0) { throw "Failed to create GitHub Release." }
 
       - name: Record verified release publication
-        if: ((github.event_name == 'push' && (github.ref_type == 'tag' || github.ref == 'refs/heads/main')) || (github.event_name == 'workflow_dispatch' && inputs.publish_release == true)) && env.RELEASE_ALREADY_PUBLISHED != 'true'
+        # Stable updater evidence is MAINLINE-ONLY. Never overwrite
+        # .release/published.json after a preview release on an RC branch.
+        if: >-
+          ${{
+            env.RELEASE_ALREADY_PUBLISHED != 'true' &&
+            !contains(steps.release.outputs.version, '-') &&
+            (
+              (github.event_name == 'push' && (github.ref_type == 'tag' || github.ref == 'refs/heads/main')) ||
+              (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' && inputs.publish_release == true && inputs.prerelease != true)
+            )
+          }}
         shell: powershell
         env:
           GH_TOKEN: ${{ github.token }}

@@ -2,7 +2,7 @@ name: Smart Discovery Field Capture Build
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
+    types: [opened, synchronize, reopened, ready_for_review, labeled]
     paths:
       # Fast PR routing: only Smart Discovery authority/dependencies trigger this gate.
       - "Services/NativeIec61850Client*.cs"
@@ -48,7 +48,9 @@ jobs:
     if: >-
       ${{
         always() &&
-        (github.event_name != 'pull_request' || !github.event.pull_request.draft) &&
+        (github.event_name != 'pull_request' ||
+         (!github.event.pull_request.draft &&
+          contains(github.event.pull_request.labels.*.name, 'ci-field-capture'))) &&
         (github.event_name != 'workflow_dispatch' ||
          needs.manual-regression.result == 'success')
       }}

@@ -26,18 +26,23 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Resolve canonical stable version
+      - name: Resolve latest published stable release from GitHub
         id: version
+        env:
+          GH_TOKEN: ${{ github.token }}
         shell: bash
         run: |
           set -euo pipefail
-          version="$(tr -d '[:space:]' < VERSION)"
-          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Invalid VERSION value: $version" >&2
+          # Documentation follows the already-published GitHub stable channel,
+          # not the main branch's potentially older application VERSION.
+          tag="$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" --jq .tag_name)"
+          if [[ ! "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "GitHub latest stable tag is invalid: $tag" >&2
             exit 1
           fi
+          version="${tag#v}"
           echo "version=$version" >> "$GITHUB_OUTPUT"
-          echo "tag=v$version" >> "$GITHUB_OUTPUT"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
 
       - name: Read exact GitHub Release metadata and checksums
         env:
@@ -202,7 +207,9 @@ jobs:
             git add landing/latest.json landing/release-notes.json
             git commit -m "docs: synchronize ARSAS ${{ steps.version.outputs.version }} release landing"
             git fetch origin main
-            git rebase origin/main
+            # Preserve unrelated, tracked generated-state edits when rebasing.
+            # Only the two checked-in release records above are committed.
+            git -c rebase.autoStash=true rebase origin/main
             git push origin HEAD:main
           fi
 

@@ -3,18 +3,24 @@ name: Validate IO List Testing
 on:
   pull_request:
     paths:
-      - "MainWindow.IoTesting.cs"
+      # Exact IO/FAT owners; Browser/RCB/SV changes use canonical Build ARSAS.
+      - "MainWindow.IoTesting*.cs"
+      - "MainWindow.NativeFat*.cs"
+      - "MainWindow.P0Fat*.cs"
       - "IoListTestingWindow.xaml"
-      - "IoListTestingWindow.xaml.cs"
+      - "IoListTestingWindow*.cs"
       - "Models/IoTesting/**"
+      - "Models/NativeFat*.cs"
       - "Services/IoTesting/**"
-      - "tests/ARSAS.Tests/IoTest*"
-      - "tests/ARSAS.Tests/IoList*"
-      - "tests/ARSAS.Tests/IoFat*"
-      - "tests/ARSAS.Tests/FatDataSet*"
-      - "tests/ARSAS.Tests/FatScl*"
+      - "tests/ARSAS.Tests/Io*.cs"
+      - "tests/ARSAS.Tests/Fat*.cs"
+      - "tests/ARSAS.Tests/NativeFat*.cs"
+      # Canonical test-evidence and immutable engine authority changes.
       - "engines/ARIEC61850.lock.json"
+      - ".github/actions/resolve-ariec-engine/**"
+      - ".github/workflows/build.yml"
       - ".github/workflows/validate-io-testing.yml"
+      - "scripts/write-ci-canonical-proof.py"
       - "scripts/verify-ci-canonical-reuse.py"
       - "scripts/test-ci-canonical-reuse.py"
   workflow_dispatch:
@@ -59,6 +65,7 @@ jobs:
           PR_HEAD_BRANCH: ${{ github.event.pull_request.head.ref }}
           PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           PR_MERGE_SHA: ${{ github.sha }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
           ENGINE_SHA: ${{ steps.engine.outputs.commit }}
         run: |
           set -euo pipefail
@@ -69,6 +76,7 @@ jobs:
             --head-sha "$PR_HEAD_SHA" \
             --merge-sha "$PR_MERGE_SHA" \
             --engine-sha "$ENGINE_SHA" \
+            --pr-title "$PR_TITLE" \
             --wait-seconds 960 \
             --allow-in-progress-artifact \
             --require-test-substring IoTest \

@@ -3,13 +3,22 @@ name: Validate SV evidence bundles
 on:
   pull_request:
     paths:
+      # Domain-owned sources; unrelated Browser/RCB/IO tests remain covered
+      # by the canonical Build ARSAS gate without a redundant SV waiter.
+      - "MainWindow.IedSmvQuickStart.cs"
       - "SmvViewerWindow.xaml"
-      - "Services/SmvViewerWindow.P1Evidence.cs"
-      - "Services/SmvSnapshotEvidenceExporter.cs"
-      - "Services/SmvSnapshotCaptureService.cs"
-      - "tests/ARSAS.Tests/**"
+      - "SmvViewerWindow*.cs"
+      - "Services/Smv*.cs"
+      - "tests/ARSAS.Tests/Smv*.cs"
+      - "tests/ARSAS.Tests/Sv*.cs"
+      - "tests/ARSAS.Tests/SampledValue*.cs"
+      - "tests/ARSAS.Tests/ProcessBus*.cs"
+      # Changes to shared evidence authority still force SV revalidation.
       - "engines/ARIEC61850.lock.json"
+      - ".github/actions/resolve-ariec-engine/**"
+      - ".github/workflows/build.yml"
       - ".github/workflows/validate-sv-evidence.yml"
+      - "scripts/write-ci-canonical-proof.py"
       - "scripts/verify-ci-canonical-reuse.py"
       - "scripts/test-ci-canonical-reuse.py"
   workflow_dispatch:
@@ -54,6 +63,7 @@ jobs:
           PR_HEAD_BRANCH: ${{ github.event.pull_request.head.ref }}
           PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           PR_MERGE_SHA: ${{ github.sha }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
           ENGINE_SHA: ${{ steps.engine.outputs.commit }}
         run: |
           set -euo pipefail
@@ -64,6 +74,7 @@ jobs:
             --head-sha "$PR_HEAD_SHA" \
             --merge-sha "$PR_MERGE_SHA" \
             --engine-sha "$ENGINE_SHA" \
+            --pr-title "$PR_TITLE" \
             --wait-seconds 960 \
             --allow-in-progress-artifact \
             --require-test-substring SmvSnapshotEvidenceExporterTests \