masarray · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026
@@ -4,15 +4,70 @@ on:
   push:
     branches: [ main ]
   pull_request:
+    # A trial-manifest-only PR already runs FAST CI-P1; don't duplicate a
+    # full Windows application build, native bridge build or package upload.
+    paths-ignore:
+      - "engines/ARIEC61850.trial.json"
   workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
   cancel-in-progress: true
 
 jobs:
+  pr-scope:
+    name: Verify documentation-only PR scope (fail closed)
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      needs_windows: ${{ steps.files.outputs.needs_windows }}
+    steps:
+      - id: files
+        name: Read all changed PR paths without checkout or Windows
+        uses: actions/github-script@v7
+        with:
+          script: |
+            // Fail closed on missing/ambiguous/renamed inputs and any API/job error.
+            let needsWindows = true;
+            try {
+              const files = await github.paginate(github.rest.pulls.listFiles, {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: context.issue.number,
+                per_page: 100
+              });
+              const documentationOnly = files.length > 0 && files.length < 3000 &&
+                files.every(({ filename, status, previous_filename }) => {
+                  const allowedPath = filename === 'README.md' ||
+                    (filename.startsWith('docs/') && filename.endsWith('.md') &&
+                     filename !== 'docs/INTEROPERABILITY_REFERENCE_CONTRACT.md');
+                  // Renamed and deleted documents can conceal source removals.
+                  return allowedPath && (status === 'added' || status === 'modified') &&
+                    !previous_filename;
+                });
+              needsWindows = !documentationOnly;
+              core.info(`Changed paths=${files.length}, Windows required=${needsWindows}`);
+            } catch (error) {
+              core.warning(`Cannot certify docs-only PR: ${error.message}; full Windows required.`);
+            }
+            core.setOutput('needs_windows', needsWindows ? 'true' : 'false');
+
   build-windows:
     name: Build, test, validate and package Windows application
+    needs: [pr-scope]
+    # The classifier may fail before emitting outputs. Anything except an
+    # explicit verified 'false' still triggers the full canonical Windows job.
+    # Push/manual do not run pr-scope, but MUST run canonical Windows proof.
+    if: >-
+      ${{
+        always() &&
+        (github.event_name != 'pull_request' ||
+         needs.pr-scope.result != 'success' ||
+         needs.pr-scope.outputs.needs_windows != 'false')
+      }}
     runs-on: windows-latest
     steps:
       - name: Checkout exact triggering ARSAS revision
@@ -187,8 +242,12 @@ jobs:
               $main -notmatch '<Viewbox Width="50" Height="50" Stretch="Uniform"' -or
               $main -notmatch 'x:Name="MonitorStateBadge"' -or
               $main -match '<Control\.Effect><DropShadowEffect BlurRadius="5" ShadowDepth="1" Opacity="0\.22" Color="#26313B"/></Control\.Effect>' -or
-              $main -notmatch 'LucideSquare.*Stroke="\{StaticResource Warning\}"' -or
-              $main -notmatch 'LucideX.*Stroke="\{StaticResource Danger\}"' -or
+              # Material migration changes glyph identity, never action tone.
+              # Keep both the stop and remove semantic color invariants.
+              $main -notmatch 'Click="IedStopAction_Click"' -or
+              $main -notmatch 'MaterialStopIcon.*Fill="\{StaticResource Warning\}"' -or
+              $main -notmatch 'Click="IedRemove_Click"' -or
+              $main -notmatch 'MaterialCloseIcon.*Fill="\{StaticResource Danger\}"' -or
               $app -notmatch 'x:Key="CommandOpenGradient"' -or
               $app -notmatch 'x:Key="CommandCloseGradient"' -or
               $app -notmatch 'x:Key="CommandActionButtonBase"' -or
@@ -672,11 +731,13 @@ jobs:
           if-no-files-found: error
           retention-days: 30
 
-      - name: Upload portable single EXE
+      # GitHub Actions upload-artifact v7: a SINGLE file plus archive:false
+      # makes the artifact itself download as a real .exe in the browser.
+      # Keep the canonical sealed Windows package (previous upload) unchanged:
+      # it carries portable-build-identity.json, manifests and release evidence.
+      - name: Upload directly downloadable portable EXE (no ZIP)
         uses: actions/upload-artifact@v7
         with:
-          name: ARSAS-win-x64-portable-single-exe
-          path: |
-            ArIED61850Tester\dist\ARSAS-*-win-x64-portable.exe
-            ArIED61850Tester\dist\ARSAS-*-win-x64-portable-build-identity.json
+          path: ArIED61850Tester\dist\ARSAS-*-win-x64-portable.exe
+          archive: false
           if-no-files-found: error
@@ -7,6 +7,8 @@ on:
       - ".github/workflows/**"
       - "scripts/audit-ci-workflows.py"
       - "scripts/test-ci-workflows.py"
+      - "scripts/verify-p7-dual-ingress-diagnostic.py"
+      - "scripts/test-p7-dual-ingress-diagnostic.py"
       - "scripts/classify-ci-changes.py"
       - "scripts/test-classify-ci-changes.py"
       - "scripts/write-ci-canonical-proof.py"
@@ -32,6 +34,8 @@ on:
       - ".github/workflows/**"
       - "scripts/audit-ci-workflows.py"
       - "scripts/test-ci-workflows.py"
+      - "scripts/verify-p7-dual-ingress-diagnostic.py"
+      - "scripts/test-p7-dual-ingress-diagnostic.py"
       - "scripts/classify-ci-changes.py"
       - "scripts/test-classify-ci-changes.py"
       - "scripts/write-ci-canonical-proof.py"
@@ -78,6 +82,9 @@ jobs:
       - name: Run offline CI workflow guard tests
         run: python3 scripts/test-ci-workflows.py
 
+      - name: Validate sanitized P7.6 dual-ingress diagnostic parser (read-only)
+        run: python3 scripts/test-p7-dual-ingress-diagnostic.py
+
       - name: Run conservative CI P1 classifier fixtures
         run: python3 scripts/test-classify-ci-changes.py
 

@@ -22,6 +22,20 @@ on:
       - "*.xaml"
       - "MainWindow*.cs"
   workflow_dispatch:
+    inputs:
+      fast_dev:
+        description: 'FAST DEV compile + scoped regression; never release qualified'
+        type: boolean
+        default: false
+      focus:
+        description: 'Focused regression group'
+        type: choice
+        options: [quality-browser, smv, command-read, all]
+        default: quality-browser
+      engine_trial_sha:
+        description: 'Optional exact 40-char experimental ARIEC SHA; FAST DEV only, never FAT'
+        type: string
+        default: ''
 
 permissions:
   contents: read
@@ -43,6 +57,7 @@ jobs:
       packaging: ${{ steps.changed.outputs.packaging }}
       ci: ${{ steps.changed.outputs.ci }}
       risk: ${{ steps.changed.outputs.risk }}
+      engine_trial_sha: ${{ steps.trial.outputs.sha }}
     steps:
       - name: Checkout PR merge source
         uses: actions/checkout@v7
@@ -69,6 +84,30 @@ jobs:
               --summary "$GITHUB_STEP_SUMMARY"
           fi
 
+      - id: trial
+        name: Resolve explicit nonrelease engine trial (label-gated)
+        if: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-p1-shadow') }}
+        shell: bash
+        run: |
+          if [[ -f engines/ARIEC61850.trial.json ]]; then
+            python3 - <<'PY' >> "$GITHUB_OUTPUT"
+          import json
+          import re
+
+          with open("engines/ARIEC61850.lock.json", encoding="utf-8") as handle:
+              production = json.load(handle)
+          with open("engines/ARIEC61850.trial.json", encoding="utf-8") as handle:
+              trial = json.load(handle)
+          sha = str(trial.get("commit", ""))
+          if (not re.fullmatch(r"[0-9a-f]{40}", sha)
+              or trial.get("runMode") != "fast-dev-nonpromotion"
+              or trial.get("scope") != "command-read"
+              or sha == production.get("commit")):
+              raise SystemExit("Invalid or non-isolated engine trial manifest")
+          print("sha=" + sha)
+          PY
+          fi
+
   windows-shadow:
     name: Compare reusable build/test with legacy authority
     needs: classify
@@ -82,6 +121,13 @@ jobs:
       }}
     uses: ./.github/workflows/_ci-p1-windows-build-test.yml
     with:
-      source_sha: ${{ github.sha }}
+      # PR validation must package the immutable branch HEAD, not GitHub's
+      # synthetic refs/pull/<n>/merge SHA. The synthetic merge remains covered
+      # independently by canonical PR CI; FAST DEV evidence must match the
+      # exact operator-downloaded source revision.
+      source_sha: ${{ github.event.pull_request.head.sha || github.sha }}
       shadow_mode: true
+      fast_dev: ${{ (github.event_name == 'workflow_dispatch' && inputs.fast_dev == true) || (github.event_name == 'pull_request' && needs.classify.outputs.engine_trial_sha != '') }}
+      focus: ${{ github.event_name == 'workflow_dispatch' && inputs.fast_dev == true && inputs.focus || needs.classify.outputs.engine_trial_sha != '' && 'command-read' || 'all' }}
+      engine_trial_sha: ${{ github.event_name == 'workflow_dispatch' && inputs.fast_dev == true && inputs.engine_trial_sha || needs.classify.outputs.engine_trial_sha || '' }}
     secrets: {}
@@ -37,6 +37,7 @@ on:
       - "engines/ARIEC61850.lock.json"
       - "engines/ARDIREC.lock.json"
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - "installer/**"
       - "scripts/build-windows-installer.ps1"
@@ -83,7 +84,7 @@ concurrency:
 jobs:
   package-ready:
     name: Wait for exact canonical package metadata
-    if: github.event_name != 'workflow_dispatch'
+    if: github.event_name != 'workflow_dispatch' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
     runs-on: ubuntu-latest
     timeout-minutes: 25
     outputs:
@@ -185,6 +186,7 @@ jobs:
     if: >-
       ${{
         always() &&
+        (github.event_name != 'pull_request' || !github.event.pull_request.draft) &&
         (github.event_name == 'workflow_dispatch' ||
          needs.package-ready.result == 'success')
       }}
@@ -484,6 +486,53 @@ jobs:
           ) -Wait -PassThru
           if ($uninstall.ExitCode -ne 0) { throw "Uninstaller exited with code $($uninstall.ExitCode)." }
 
+      # Preserve the retired SMV preview workflow's protected-folder upgrade
+      # qualification inside the canonical installer workflow (no extra CI runner).
+      - name: Verify protected Program Files in-place DLL repair and uninstall
+        shell: powershell
+        run: |
+          $exe = ".\\ArIED61850Tester\\dist\\ARSAS-$env:APP_VERSION-win-x64-setup.exe"
+          if (-not (Test-Path $exe -PathType Leaf)) { throw 'Canonical installer missing.' }
+          $target = Join-Path $env:ProgramFiles 'ARSAS-FAT-ProtectedFolder-CI'
+          $dirArgument = '/DIR="' + $target + '"'
+          $params = @('/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART','/SP-','/CLOSEAPPLICATIONS',$dirArgument)
+          $installed = $false
+          try {
+            $install = Start-Process -FilePath $exe -ArgumentList $params -Wait -PassThru
+            if ($install.ExitCode -ne 0) { throw "Protected-folder install failed: $($install.ExitCode)." }
+            $installed = $true
+            if (-not (Test-Path (Join-Path $target 'ARSAS.exe') -PathType Leaf)) {
+              throw "Silent install did not use requested Program Files directory: $target"
+            }
+            $legacyAccessibility = Join-Path $target 'Accessibility.dll'
+            $publishedAccessibility = Join-Path $env:INSTALLER_INPUT_DIR 'Accessibility.dll'
+            if (-not (Test-Path $legacyAccessibility) -and -not (Test-Path $publishedAccessibility)) {
+              [System.IO.File]::WriteAllBytes($legacyAccessibility, [byte[]](65,82,83,65,83,83,45,79,76,68))
+              Write-Host 'Seeded a legacy Accessibility.dll as a prior-install fixture.'
+            }
+            $repairName = if (Test-Path $publishedAccessibility -PathType Leaf) { 'Accessibility.dll' } else { 'AR.Iec61850.Transports.Npcap.dll' }
+            $repairPath = Join-Path $target $repairName
+            if (-not (Test-Path $repairPath -PathType Leaf)) { throw "Shipped upgrade-test DLL is missing: $repairName" }
+            $expectedHash = (Get-FileHash $repairPath -Algorithm SHA256).Hash
+            [System.IO.File]::WriteAllBytes($repairPath, [byte[]](65,82,83,65,83,45,79,76,68,45,68,76,76))
+            $upgrade = Start-Process -FilePath $exe -ArgumentList $params -Wait -PassThru
+            if ($upgrade.ExitCode -ne 0) { throw "In-place Program Files upgrade failed: $($upgrade.ExitCode)." }
+            $actualHash = (Get-FileHash $repairPath -Algorithm SHA256).Hash
+            if ($actualHash -ne $expectedHash) { throw "Upgrade did not restore shipped DLL: $repairName" }
+            Write-Host "SMART_INNO_UPGRADE_PASS: Protected Program Files upgrade restored exact $repairName bytes."
+            foreach ($file in @('ARSAS.exe','AR.Iec61850.Transports.Npcap.dll','SharpPcap.dll','PacketDotNet.dll','Tools\\ArdIrec\\ardirec_bridge.dll')) {
+              if (-not (Test-Path (Join-Path $target $file) -PathType Leaf)) { throw "Installed runtime missing: $file" }
+            }
+          }
+          finally {
+            $uninstaller = Join-Path $target 'unins000.exe'
+            if ($installed -or (Test-Path $uninstaller -PathType Leaf)) {
+              if (-not (Test-Path $uninstaller -PathType Leaf)) { throw 'Uninstaller missing.' }
+              $uninstall = Start-Process -FilePath $uninstaller -ArgumentList @('/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART') -Wait -PassThru
+              if ($uninstall.ExitCode -ne 0) { throw "Uninstall failed: $($uninstall.ExitCode)." }
+            }
+          }
+
       - name: Create release checksums
         shell: powershell
         run: |

@@ -85,7 +85,15 @@ jobs:
             throw 'Accepted post-baseline SCL association authority drifted or lost physical evidence.'
           }
           . .\ARSAS\scripts\test-p10-9f-core-routing-trial.ps1
+          . .\ARSAS\scripts\test-m217k-typed-status-trial.ps1
           $coreRoutingTrialValid = Test-P109FCoreRoutingTrial -Lock $lock
+          $m217KTrialValid = Test-M217KTypedStatusTrial -Lock $lock
+          . .\ARSAS\scripts\test-p0-a-identity-trial.ps1
+          $p0AIdentityTrialValid = Test-P0AIdentityTrial -Lock $lock
+          . .\ARSAS\scripts\test-p0-b-rcb-trial.ps1
+          $p0BRcbTrialValid = Test-P0BRcbPlannerTrial -Lock $lock
+          . .\ARSAS\scripts\test-p0-c-typed-read-trial.ps1
+          $p0CTypedReadTrialValid = Test-P0CTypedReadTrial -Lock $lock
           $trial = $lock.smartInteroperabilityCodeTrial
           $serverAt = $lock.sclServerAtTrial
           $originalTrial = $lock.commit -eq $trial.exactCommit -and
@@ -129,11 +137,34 @@ jobs:
                            [bool]$serverAt.physicalQualificationRequired -and
                            [bool]$serverAt.noAutomaticMmsFailover -and
                            $lock.ref -eq 'main'
+          # An exact typed-control trial on the existing staging ancestry:
+          # do not promote it, and never reinterpret it as physical R7/R10.
+          $typedControl = $lock.globalTypedControlStageTrial
+          $typedControlTrialValid = (
+            $null -ne $typedControl -and
+            $lock.commit -ceq 'f75e323e9f8443aa20e0a3818a1d5d77255b2c0f' -and
+            $lock.ref -ceq 'main' -and
+            [int]$lock.sourcePullRequest -eq 192 -and
+            $typedControl.baseEngineCommit -ceq '9c7cb40364023a7b217e5ec31ab3105ba90142eb' -and
+            $typedControl.exactCommit -ceq $lock.commit -and
+            [int]$typedControl.enginePullRequest -eq 192 -and
+            [long]$typedControl.engineCiRun -eq 39909260816L -and
+            $typedControl.status -ceq 'engine-ci-success-consumer-trial-not-physical' -and
+            [bool]$typedControl.typedStatusReadRequired -and
+            [bool]$typedControl.sameDataObjectFeedbackRequired -and
+            [bool]$typedControl.ctlModelAndOperShapeRequired -and
+            [bool]$typedControl.sbowEnhancedSafetyRequired -and
+            [bool]$typedControl.noAutomaticOperate -and
+            [bool]$typedControl.physicalQualificationRequired -and
+            [bool]$typedControl.mainlinePromotionForbidden -and
+            $lock.p0CStageObservationTrial.exactCommit -ceq $typedControl.baseEngineCommit -and
+            $env:GITHUB_BASE_REF -ne 'main' -and $env:GITHUB_REF_NAME -ne 'main'
+          )
           if ($null -ne $trial) {
             if ($trial.status -ne 'code-verified-not-physical' -or
                 [int]$trial.issue -ne 144 -or
                 [int]$trial.integrationPullRequest -ne 148 -or
-                -not ($originalTrial -or $serverAtTrial -or $datasetTrial -or $p10Trial -or $coreRoutingTrialValid) -or
+                -not ($originalTrial -or $serverAtTrial -or $datasetTrial -or $p10Trial -or $coreRoutingTrialValid -or $m217KTrialValid -or $p0AIdentityTrialValid -or $p0BRcbTrialValid -or $p0CTypedReadTrialValid -or $typedControlTrialValid) -or
                 -not [bool]$trial.fullDiscoveryFallbackForbidden -or
                 -not [bool]$trial.vendorBranchingForbidden -or
                 -not [bool]$trial.physicalPromotionRequired) {