Add live IO FAT sessions and durable evidence journal

[masarray]

Purpose

Turn the imported IO List Testing workspace into a real read-only FAT execution workflow per IED, while preserving the required OFF → ON → OFF evidence order and keeping protocol-engineering distractions outside the dedicated FAT window.

FAT session lifecycle

• start one selected imported IED session at a time
• require the IED to be connected, monitoring, and fully bound to unique live points
• capture a trustworthy live baseline for every enabled signal
• consume the immediate runtime point-update stream before UI batching can hide short transitions
• assign one monotonic ARSAS observation sequence across value, quality, and metadata updates
• capture ON evidence first, then accept only a later OFF transition
• automatically mark a signal PASS only after both ordered evidence transitions exist
• pause, resume, interrupt, stop, and auto-complete sessions
• rebind replacement live-point objects before resume after monitoring restarts
• lock IED selection and test-scope editing while a session is active

Scope preflight

Session start is rejected when:

• an enabled signal is not import-ready
• no import-ready signal is enabled
• an enabled signal lacks one unique live monitor point
• multiple enabled test points resolve to the same IEC 61850 reference

This prevents partial hidden test scope and prevents one physical edge from producing multiple PASS results.

False-PASS protection

• a signal already ON at session start must return OFF before a new ON can count
• baseline quality must be Good/Valid before testing is armed
• quality-only runtime updates can establish or invalidate a baseline
• steady-state quality loss before ON requires a new baseline
• quality loss after ON forces REVIEW because OFF continuity is no longer provable
• invalid ON transitions are rejected and require a new baseline
• invalid OFF transitions force REVIEW
• questionable transition quality is retained as REVIEW evidence
• duplicate and out-of-order observations do not create evidence
• pause/reconnect increments the connection generation and establishes a new baseline
• if ON was captured before continuity was lost, the point becomes REVIEW instead of accepting a possibly missed OFF transition
• an IED disconnect automatically moves the session to INTERRUPTED

Durable evidence

Every session writes an append-only JSON Lines journal under the user-local ARSAS evidence directory. Each record includes:

• project and source-workbook identity plus SHA-256
• session, IED, signal, object reference, and attempt identity
• baseline, baseline-state, ON, OFF, rejected transition, pause, resume, interruption, stop, and completion events
• previous and observed values plus normalized state
• IED timestamp and ARSAS capture timestamp
• quality, acquisition source, report reason, observation sequence, and connection generation
• application version, operator, and workstation

Each line is wrapped in a journal sequence and SHA-256 hash chain. Every append is flushed to disk. Sealed journals are verified on stop or completion. A journal write or verification failure moves the session to EVIDENCE FAULT instead of permitting unrecorded PASS results.

UI

The dedicated maximized workspace now provides:

• Start IED Session
• Pause, Resume, and Stop
• live session state and per-IED progress
• ON/OFF evidence columns
• evidence record count
• journal path and integrity status
• a customer-visible signal grid that remains readable during testing while editing controls are locked

Safety boundary

• read-only IEC 61850 observation only
• no command execution
• no RCB, DataSet, SCL, or IED configuration writes
• Excel evidence export remains a separate follow-up phase

Regression coverage

• normal OFF → ON → OFF live session completes and produces a verified journal
• initially-ON signal records OFF baseline before a new test cycle
• bad/questionable baseline quality cannot arm testing
• quality-only update recovers a rejected initial baseline
• steady-state quality loss before/after ON follows the safe baseline/REVIEW paths
• invalid ON and OFF transitions cannot produce PASS
• pause after ON forces REVIEW on resume
• replacement live point is rebound after monitoring restart
• device disconnect interrupts the session
• incomplete live scope and duplicate mappings are rejected
• binary, imported-label, and double-point state normalization
• journal hash-chain verification and tamper detection

Automated validation at head 69a0a3a9255cd65266c8ae17190bb33fc9b57739

• Validate IO List Testing run 22 — success
  • focused build
  • complete IO Testing regression suite
  • compiler diagnostics and TRX evidence upload
• Build ARSAS run 753 — success
  • source, UX, protocol, and release invariants
  • complete solution restore and build
  • complete application regression suite
  • portable Windows publication and artifact upload
• Validate SV evidence bundles run 54 — success
  • existing deterministic Sampled Values evidence regression remains intact

The Windows installer sources and workflow were not changed by this tranche, so installer validation was not claimed or forced through a no-op modification.

[chatgpt-codex-connector]

💡 Codex Review

arsas/Services/IoTesting/IoTestTransitionEvaluator.cs

Lines 279 to 280 in 69a0a3a

	if (normalized.Contains("good") || normalized == "valid")
	return (IoEvidenceVerdict.Accepted, "Quality accepted");

Reject stale quality flags before accepting evidence

When the production quality decoder emits values such as Good / OldData, this substring check classifies them as Accepted because they contain good. Consequently, a stale baseline can arm testing and stale ON/OFF observations can produce PASS even though OldData means transition continuity is not trustworthy; inspect the complete IEC 61850 quality flags and downgrade at least stale/inconsistent detail flags to Review or Rejected.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require a terminal seal before declaring a journal valid

If one or more complete lines are removed from the end of a journal, the remaining prefix still has valid sequences and hashes, so this return path reports it as verified. This can certify a journal that has lost OFF evidence or its session_completed/session_stopped record; verification needs an expected terminal seal, record count, or externally anchored final hash rather than accepting every nonempty valid prefix.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep the workspace open when sealing evidence fails

When the operator closes an active session and the final append or integrity verification fails, Stop returns a failure and moves the controller to Evidence Fault, but this result is ignored and the window still closes. The controller is then disposed by the caller, so the operator never sees the failure and cannot respond to an unsealed journal; cancel closing and display the failed action result in this scenario.

Useful? React with 👍 / 👎.