fix(release): lock qualified runtime lineage and public surfaces

.github/workflows/iedscout-convergence-guard.yml → .github/workflows/interoperability-convergence-guard.yml

@@ -1,4 +1,4 @@
-name: IEDScout Convergence Guard
+name: Interoperability Convergence Guard
 
 on:
   pull_request:
@@ -10,20 +10,20 @@ on:
       - "Directory.Build.targets"
       - "scripts/enable-smart-discovery-capture.ps1"
       - "engines/ARIEC61850.lock.json"
-      - "evidence/iedscout-convergence-target.json"
-      - "docs/IEDSCOUT_CONVERGENCE.md"
+      - "evidence/interoperability-convergence-target.json"
+      - "docs/INTEROPERABILITY_CONVERGENCE.md"
       - "tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs"
-      - ".github/workflows/iedscout-convergence-guard.yml"
+      - ".github/workflows/interoperability-convergence-guard.yml"
       - ".github/workflows/scl-interoperability-r7.yml"
   workflow_dispatch:
 
 concurrency:
-  group: iedscout-convergence-${{ github.event.pull_request.number || github.ref }}
+  group: interoperability-convergence-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
-  iedscout-convergence-contract:
-    name: iedscout-convergence-contract
+  interoperability-convergence-contract:
+    name: interoperability-convergence-contract
     runs-on: windows-latest
 
     steps:
@@ -47,7 +47,7 @@ jobs:
         shell: pwsh
         run: |
           $lock = Get-Content .\ARSAS\engines\ARIEC61850.lock.json -Raw | ConvertFrom-Json
-          $target = Get-Content .\ARSAS\evidence\iedscout-convergence-target.json -Raw | ConvertFrom-Json
+          $target = Get-Content .\ARSAS\evidence\interoperability-convergence-target.json -Raw | ConvertFrom-Json
 
           if ($target.status -ne 'physical-retest-passed-merge-ready') {
             throw "Convergence status changed unexpectedly: $($target.status)"
@@ -69,11 +69,13 @@ jobs:
               -not [bool]$target.promotion.physicalRetestPassed) {
             throw 'R10 physical-retest/merge gate drifted.'
           }
-          if ([int]$target.physicalReference.iedScoutCapture.associations -ne 1 -or
-              [int]$target.physicalReference.iedScoutCapture.getVariableAccessAttributes -ne 119 -or
+          if ([int]$target.physicalReference.acceptedDiscoveryBudget.associations -ne 1 -or
+              [int]$target.physicalReference.acceptedDiscoveryBudget.maximumConfirmedMmsRequests -ne 417 -or
+              [int]$target.physicalReference.acceptedDiscoveryBudget.maximumGetVariableAccessAttributes -ne 119 -or
+              [int]$target.physicalReference.acceptedDiscoveryBudget.maximumReads -ne 156 -or
               [int]$target.physicalReference.rejectedLegacyArsasCapture.associations -ne 2 -or
               [int]$target.physicalReference.rejectedLegacyArsasCapture.getVariableAccessAttributes -lt 20000) {
-            throw 'Physical IEDScout/legacy regression reference changed unexpectedly.'
+            throw 'Physical interoperability regression budget changed unexpectedly.'
           }
 
 
@@ -304,7 +306,7 @@ jobs:
               $singleFlight -notmatch 'DiscoverSmartSingleFlightAsync' -or
               $singleFlight -notmatch 'DiscoverSmartAsync\(options, CancellationToken\.None\)' -or
               $smartGva -notmatch 'GetVariableAccessAttributesSmartAsync') {
-            throw 'P0 structural discovery freeze regressed away from the accepted IEDScout convergence path.'
+            throw 'P0 structural discovery freeze regressed away from the accepted interoperability convergence path.'
           }
 
           if ($lnParts -notmatch 'instanceStart' -or
@@ -322,4 +324,4 @@ jobs:
             throw 'Canonical IEC model / SCL semantic authority regressed.'
           }
 
-          Write-Host 'IEDScout convergence contract PASS.'
+          Write-Host 'Interoperability convergence contract PASS.'

.github/workflows/release-windows.yml

@@ -46,6 +46,12 @@ jobs:
         id: release
         shell: powershell
         run: |
+          if ($env:GITHUB_EVENT_NAME -eq "workflow_dispatch" -and
+              "${{ inputs.publish_release }}" -eq "true" -and
+              $env:GITHUB_REF -ne "refs/heads/main") {
+            throw "Manual publication is allowed only from the main branch."
+          }
+
           if ($env:GITHUB_EVENT_NAME -eq "workflow_dispatch") {
             $rawVersion = "${{ inputs.version }}"
           }
@@ -160,6 +166,10 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Verify qualified release source authority
+        shell: powershell
+        run: python .\ArIED61850Tester\scripts\verify-qualified-release-source.py
+
       - name: Verify source and licensing boundaries
         shell: powershell
         run: .\ArIED61850Tester\scripts\verify-source-clean.ps1
@@ -426,7 +436,11 @@ jobs:
             ArIED61850Tester/dist/ARSAS-Windows-x64-PROVENANCE.json
 
       - name: Create or update GitHub Release
-        if: github.ref_type == 'tag' || github.ref == 'refs/heads/main' || inputs.publish_release == true
+        if: >-
+          github.ref_type == 'tag' ||
+          (github.event_name == 'workflow_dispatch' &&
+           inputs.publish_release == true &&
+           github.ref == 'refs/heads/main')
         shell: powershell
         env:
           GH_TOKEN: ${{ github.token }}
@@ -467,7 +481,11 @@ jobs:
           if ($LASTEXITCODE -ne 0) { throw "Failed to create GitHub Release." }
 
       - name: Record verified release publication
-        if: github.ref_type == 'tag' || github.ref == 'refs/heads/main' || inputs.publish_release == true
+        if: >-
+          github.ref_type == 'tag' ||
+          (github.event_name == 'workflow_dispatch' &&
+           inputs.publish_release == true &&
+           github.ref == 'refs/heads/main')
         shell: powershell
         env:
           GH_TOKEN: ${{ github.token }}

.github/workflows/scl-interoperability-r7.yml

@@ -14,8 +14,8 @@ on:
       - "MainWindow.xaml.cs"
       - "Services/CanonicalSclReloadValidator.cs"
       - "engines/ARIEC61850.lock.json"
-      - "evidence/iedscout-convergence-target.json"
-      - "docs/IEDSCOUT_CONVERGENCE.md"
+      - "evidence/interoperability-convergence-target.json"
+      - "docs/INTEROPERABILITY_CONVERGENCE.md"
       - "tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs"
       - "tests/ARSAS.Tests/CanonicalSclReloadValidatorTests.cs"
       - ".github/workflows/scl-interoperability-r7.yml"
@@ -52,7 +52,7 @@ jobs:
         shell: pwsh
         run: |
           $lock = Get-Content .\ARSAS\engines\ARIEC61850.lock.json -Raw | ConvertFrom-Json
-          $convergence = Get-Content .\ARSAS\evidence\iedscout-convergence-target.json -Raw | ConvertFrom-Json
+          $convergence = Get-Content .\ARSAS\evidence\interoperability-convergence-target.json -Raw | ConvertFrom-Json
           if ($lock.repository -ne 'masarray/ARIEC61850' -or
               $lock.commit -notmatch '^[0-9a-f]{40}$') {
             throw 'Invalid ARIEC61850 R7 lock.'
@@ -71,7 +71,7 @@ jobs:
               [bool]$convergence.promotion.physicalRetestRequired -or
               -not [bool]$convergence.promotion.mergeAllowedAfterPhysicalRetest -or
               -not [bool]$convergence.promotion.physicalRetestPassed) {
-            throw 'IEDScout convergence single-source-of-truth does not match the physically proven merged-engine + ARSAS #324 authority.'
+            throw 'Interoperability convergence authority does not match the physically proven merged-engine + ARSAS #324 authority.'
           }
           if ([int]$lock.sourcePullRequest -notin @(134, 135)) {
             throw "Unexpected R7 engine source PR: $($lock.sourcePullRequest)"
@@ -111,7 +111,7 @@ jobs:
           $cdcInference = Get-Content .\ARIEC61850\src\AR.Iec61850\Discovery\CdcInferenceEngine.cs -Raw
           $consumer = Get-Content .\ARSAS\Services\NativeIec61850Client.CanonicalModel.cs -Raw
           $capture = Get-Content .\ARSAS\Services\NativeIec61850Client.SmartDiscoveryCapture.cs -Raw
-          $convergence = Get-Content .\ARSAS\evidence\iedscout-convergence-target.json -Raw | ConvertFrom-Json
+          $convergence = Get-Content .\ARSAS\evidence\interoperability-convergence-target.json -Raw | ConvertFrom-Json
           $buildTargets = Get-Content .\ARSAS\Directory.Build.targets -Raw
           $lifecycle = Get-Content .\ARSAS\Services\NativeIec61850Client.SmartDiscoveryLifecycle.cs -Raw
           $sclClient = Get-Content .\ARSAS\Services\NativeIec61850Client.SclAssisted.cs -Raw
@@ -175,16 +175,16 @@ jobs:
               $capture -match 'DiscoverDomainVariableTypeTreeNamesAsync' -or
               $capture -match 'AddAdaptiveLogicalNodeSiblingProbeSignalsAsync' -or
               $capture -match 'EnrichEngineeringUnitsAsync') {
-            throw 'IEDScout convergence source contract regressed: smart structure-first discovery or semantic SCL authority is missing, or a forbidden legacy browse path returned.'
+            throw 'Interoperability convergence source contract regressed: smart structure-first discovery or semantic SCL authority is missing, or a forbidden legacy browse path returned.'
           }
 
-          if ([int]$convergence.physicalReference.iedScoutCapture.associations -ne 1 -or
+          if ([int]$convergence.physicalReference.acceptedDiscoveryBudget.associations -ne 1 -or
               [int]$convergence.physicalReference.rejectedLegacyArsasCapture.associations -ne 2 -or
               -not [bool]$convergence.discoveryAcceptance.exactlyOneAssociation -or
               -not [bool]$convergence.discoveryAcceptance.supplementalLegacyAssociationForbidden -or
               -not [bool]$convergence.sclAcceptance.reopenInArsasRequired -or
               -not [bool]$convergence.sclAcceptance.physicalReconnectRequired) {
-            throw 'IEDScout physical acceptance target was weakened.'
+            throw 'Interoperability physical acceptance target was weakened.'
           }
 
           if ($consumer -notmatch 'LiveIedCanonicalModelBuilder\.Build\(model, communication, initialRead\)' -or
@@ -276,7 +276,7 @@ jobs:
             throw "Portable EXE smoke test failed: $($process.ExitCode)"
           }
 
-          $convergencePath = ".\ARSAS\evidence\iedscout-convergence-target.json"
+          $convergencePath = ".\ARSAS\evidence\interoperability-convergence-target.json"
           $convergenceHash = (Get-FileHash $convergencePath -Algorithm SHA256).Hash.ToLowerInvariant()
           $convergence = Get-Content $convergencePath -Raw | ConvertFrom-Json
 
@@ -304,8 +304,8 @@ jobs:
           path: |
             ARSAS\dist\ARSAS-*-win-x64-portable.exe
             ARSAS\dist\R7-SCL-INTEROP-BUILD.txt
-            ARSAS\evidence\iedscout-convergence-target.json
-            ARSAS\docs\IEDSCOUT_CONVERGENCE.md
+            ARSAS\evidence\interoperability-convergence-target.json
+            ARSAS\docs\INTEROPERABILITY_CONVERGENCE.md
             ARSAS\TestResults\*.trx
           if-no-files-found: error
           retention-days: 14

.github/workflows/smart-discovery-mainline-readiness.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Verify R10 physical convergence authority
         shell: powershell
         run: |
-          $target = Get-Content .\evidence\iedscout-convergence-target.json -Raw | ConvertFrom-Json
+          $target = Get-Content .\evidence\interoperability-convergence-target.json -Raw | ConvertFrom-Json
           $lock = Get-Content .\engines\ARIEC61850.lock.json -Raw | ConvertFrom-Json
 
           if ($target.status -ne 'physical-retest-passed-merge-ready' -or

.github/workflows/smart-discovery-post-merge-production.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Verify R10 physical convergence authority
         shell: powershell
         run: |
-          $target = Get-Content .\evidence\iedscout-convergence-target.json -Raw | ConvertFrom-Json
+          $target = Get-Content .\evidence\interoperability-convergence-target.json -Raw | ConvertFrom-Json
           $lock = Get-Content .\engines\ARIEC61850.lock.json -Raw | ConvertFrom-Json
 
           if ($target.status -ne 'physical-retest-passed-merge-ready' -or
@@ -86,7 +86,7 @@ jobs:
         shell: powershell
         run: |
           New-Item -ItemType Directory -Force .\TestResults | Out-Null
-          $target = Get-Content .\evidence\iedscout-convergence-target.json -Raw | ConvertFrom-Json
+          $target = Get-Content .\evidence\interoperability-convergence-target.json -Raw | ConvertFrom-Json
           [ordered]@{
             schemaVersion = 1
             sourceCommit = $env:GITHUB_SHA

.release/qualified-source.json

@@ -0,0 +1,22 @@
+{
+  "schemaVersion": 1,
+  "authority": "qualified-runtime-lineage",
+  "qualificationManifest": ".release/qualified-source.json",
+  "fieldQualifiedSource": {
+    "sourcePullRequest": 324,
+    "sourceHeadCommit": "b0f25569a398c7bbdc3a3a34409dbd74ebf49444",
+    "sourceMergeCommit": "2b8e8adfd019bd087dc338dcc32bffefec53370f",
+    "sourceTree": "cccb50607161f8637e597b43d71038ffd4becfdc",
+    "workflowRunId": 35412542175,
+    "artifactId": 10575075419,
+    "portableFileName": "ARSAS-1.6.37-win-x64-portable.exe",
+    "portableSha256": "6805b878f91f3d526cc50f3e81e3eb9a1f72500217dacc8921e50bdc349c5fcc",
+    "portableSizeBytes": 78383289
+  },
+  "currentReleaseCandidate": {
+    "derivation": "Field-qualified runtime with implementation-neutral identifiers and release-governance changes only.",
+    "fingerprintAlgorithm": "sha256-path-null-content-null-v1",
+    "releaseSensitiveFileCount": 506,
+    "releaseSensitiveFingerprint": "b86663f358499f656bcddd52e38dbe08df31b1192fae4136889677572dabada5"
+  }
+}

.release/windows.json

@@ -2,6 +2,7 @@
   "version": "1.6.38",
   "channel": "stable",
   "platform": "windows-x64",
+  "qualificationManifest": ".release/qualified-source.json",
   "primaryAsset": "ARSAS-Windows-x64-Setup.exe",
   "publicationRequest": 27
 }

CHANGELOG.md

@@ -4,6 +4,24 @@ Notable public changes to ARSAS are recorded here. Application releases must ide
 
 ## Unreleased
 
+## 1.6.38 — 2026-09-19
+
+### Added
+
+- Public stable Windows release for the physically verified R10 discovery/SCL convergence baseline.
+- Release evidence now includes verified installer and portable artifacts, SHA-256 checksums, SPDX 2.3 SBOM, provenance metadata, and artifact attestations.
+
+### Changed
+
+- Trusted-SCL reuse for generated Edition 2 IID and Edition 1 ICD now preserves exact-case value identity with `cacheLoss=0` on both editions.
+- Multi-DO CF hydration uses exact DO-scoped structured Reads instead of cross-DO positional assumptions.
+- Post-merge and mainline CI gates validate the accepted R10 physical authority and immutable engine source tree.
+
+### Fixed
+
+- Both generated editions reopen and reconnect with 32/32 MMS domains, all planned initial Reads successful, `projectionErrors=0`, 58/58 report-backed runtime points, zero final unresolved runtime points, actual InformationReport traffic, and zero cyclic MMS process polling on the accepted path.
+- Release automation now publishes the verified stable package from the exact mainline release commit.
+
 ## 1.6.37 — 2026-09-16
 
 ### Added