site: make field evidence intake reviewable before publication

.github/ISSUE_TEMPLATE/device-compatibility.yml

@@ -6,7 +6,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Report service-level evidence, not a universal vendor conclusion. Remove credentials, private endpoints, customer names, confidential SCL, captures and disturbance records.
+        One issue = one bounded service result. A submission is not verified evidence and does not update the published matrix. Read the [evidence intake and maintainer review policy](https://github.com/masarray/arsas/blob/main/docs/evidence-intake-review.md) before posting. Remove credentials, private endpoints, customer/project names, confidential SCL, raw captures and disturbance records. Never upload a private file expecting maintainers to sanitize it in public.
   - type: input
     id: arsas-version
     attributes:
@@ -65,6 +65,22 @@ body:
       options: [Verified repeatedly, Conditional success, Observed once, Failed with known evidence, Not tested]
     validations:
       required: true
+  - type: textarea
+    id: expected-observed
+    attributes:
+      label: Expected versus observed behavior
+      description: Give the exact positive or negative result for this service. For a planned test, state "Not tested - no result yet"; do not infer a pass.
+      placeholder: "Expected: ... / Observed: ... / Failure or negative result: ..."
+    validations:
+      required: true
+  - type: input
+    id: public-evidence-link
+    attributes:
+      label: Public sanitized evidence link (optional)
+      description: Link only to material you are authorized to publish. An implementation PR alone is not a field-test capture.
+      placeholder: https://github.com/masarray/arsas/issues/...
+    validations:
+      required: false
   - type: textarea
     id: conditions
     attributes:
@@ -76,7 +92,7 @@ body:
     id: diagnostics
     attributes:
       label: Sanitized diagnostics
-      description: Paste exact ARSAS text or attach a sanitized screenshot. Do not include secrets or confidential project data.
+      description: Paste sanitized ARSAS text or attach a reviewed screenshot. For a planned test, write No capture yet. Never attach raw private captures, confidential SCL, credentials or disturbance records.
     validations:
       required: true
   - type: checkboxes
@@ -88,3 +104,5 @@ body:
           required: true
         - label: I understand this report is service-specific and is not IEC 61850 conformance certification.
           required: true
+        - label: I understand an issue is a submission, not verified evidence; publication requires maintainer review and a separate registry PR.
+          required: true

docs/evidence-intake-review.md

@@ -0,0 +1,35 @@
+# ARSAS service-evidence intake and review
+
+This is the public review procedure for [compatibility evidence](https://masarray.github.io/arsas/compatibility.html) and the [device compatibility issue form](https://github.com/masarray/arsas/issues/new?template=device-compatibility.yml). It is a documentation and maintainer-review workflow, not an automatic test, endorsement, vendor certification, or IEC 61850 conformance process.
+
+## 1. Submit one bounded service result
+
+Open one issue per device context and IEC 61850 service. Record the **actual test date**, exact ARSAS version/tag, Windows version, anonymized device/firmware or disclosure boundary, service, observed outcome, acquisition conditions, expected versus observed behavior, and sanitized diagnostics or a public evidence link. Include negative results and reproducible steps. State whether the submission is a field test, sanitized diagnostic, engineering history, or a planned test with no result. If retesting a published profile, supply its ID; do not overwrite historical dates or assume that the latest release was the version used.
+
+**Privacy first:** never publish credentials, private IPs/endpoints, customer/project names, confidential SCL, raw network captures, or disturbance records. Review screenshots, text and attachments for sensitive identifiers before posting. If safe publication is impossible, report only a bounded sanitized description and mark the evidence unavailable for public verification. Do not upload private files and ask the maintainer to sanitize them publicly.
+
+A newly opened issue is **submitted, not verified**. An issue link alone does not establish a physical-relay test or a new compatibility status. Planned tests and implementation-only history cannot serve as a current-stable field retest.
+
+## 2. Maintainer review gate
+
+Review the report before considering any registry change:
+
+- **Privacy and authority:** safe-to-publish identifiers; approved network/test context; control tests only in an authorized non-energized environment.
+- **Provenance:** actual date, exact tested ARSAS version, evidence type, device disclosure boundary and traceable public record; identify whether raw field capture is publicly linked.
+- **Scope and reproducibility:** one service, explicit positive/negative outcome, conditions, permissions, relevant MMS/RCB/GOOSE/control paths, expected versus observed behavior.
+- **Claim precision:** separate *observed*, *conditional*, *verified*, *known issue*, *not tested* and *not declared*; a missing service is not a tested failure. Reporting configuration is not proof of live report delivery.
+- **Retest:** confirm actual repeat execution on the declared release; engineering PRs or a registry edit are not a retest. Keep earlier evidence dates and unknowns intact.
+
+If details are missing, request sanitized clarification in the issue and leave the matrix unchanged. If a submission cannot be publicly inspected or responsibly bounded, keep it as a report only, not a published compatibility result. Do not represent maintainer review as independent certification.
+
+## 3. Promote only with a reviewed PR
+
+A maintainer may open a separate PR to update `landing/device-evidence.json` and the English/Indonesian compatibility pages. In that PR:
+
+1. Cite the reviewed public issue or sanitized record *for the exact service*, with test date, version, conditions and record type. A private attachment is not a public evidence link.
+2. Set or retain each service status based on its own observation. Do not turn `not-tested` or `not-declared` into a claim by copying another service's result.
+3. Change `testedArsasVersion`, `lastRetest`, `rawFieldCaptureLinked` or current-stable language only when the specific supporting public test and date exist. Distinguish engineering history from raw field captures.
+4. Reconcile registry, service-to-record links, coverage gaps, English/Indonesian pages and claim boundaries; run source, rendered-site, adoption/field-proof and exact-head PR CI.
+5. Merge only after review and required checks pass; verify the final production Pages deployment. The published matrix is authoritative only after this gate.
+
+An issue may remain open or be closed without a registry change. A green CI validates consistency of the published claims and links, **not the physical truth of a device test**.

landing/templates/bukti-kompatibilitas.html

@@ -80,7 +80,7 @@ <h2>Lihat service IEC 61850 mana yang memiliki evidence publik—dan mana yang b
       <article class="evidence-profile" id="field-profile-b-rcb-export" data-evidence-profile="field-profile-b-rcb-export"><span class="kicker">Evidence field historis · 2026-07</span><h2>Profile field anonim B — evidence RCB dan export SCL</h2><p>Vendor, model, instalasi dan firmware tidak dipublikasikan. Evidence tetap read-only sampai action export yang disetujui dilakukan.</p><p class="matrix-boundary evidence-trace" data-evidence-trace="field-profile-b-rcb-export" data-tested-version="not-recorded" data-current-stable-retest="not-documented"><strong>Evidence field: 2026-07.</strong> Versi ARSAS saat capture: Belum tercatat secara publik. Retest pada v{{STABLE_VERSION}}: Belum terdokumentasi. Update halaman atau registry bukan retest field.</p><table class="evidence-table"><thead><tr><th>Service</th><th>Status</th></tr></thead><tbody><tr><td>MMS association dan live model</td><td><span class="status-pill" data-status="observed">Observed</span></td></tr><tr><td>Evidence reporting</td><td><span class="status-pill" data-status="conditional">Conditional</span></td></tr><tr><td>Selected-RCB export</td><td><span class="status-pill" data-status="verified">Verified</span></td></tr><tr><td>File, GOOSE, control</td><td><span class="status-pill">Not tested</span></td></tr></tbody></table><p class="evidence-records" data-service-records="field-profile-b-rcb-export"><strong>Service → jejak engineering publik:</strong> MMS association / live model / opsi RCB read-only · <a href="https://github.com/masarray/ARIEC61850/pull/36" target="_blank" rel="noopener">PR #36</a>; export selected-RCB · <a href="https://github.com/masarray/arsas/pull/79" target="_blank" rel="noopener">PR #79</a>. Evidence opsi RCB bukan bukti delivery report live; tautan ini bukan raw field capture ataupun pengujian baru pada stable terbaru.</p><h3>Kondisi</h3><ul><li>Nama RCB live, TriggerOptions, OptionalFields, BufTm dan IntgPd dipertahankan.</li><li>Export selected-RCB mempertahankan exact identity MMS RCB live.</li><li>SCL hasil export tetap baseline engineering yang membutuhkan independent validation.</li><li>Profile ini tidak menyiratkan runtime RCB reservation atau write.</li></ul><div class="section-actions"><a class="btn" href="https://github.com/masarray/ARIEC61850/pull/36" target="_blank" rel="noopener">Evidence option RCB</a><a class="btn" href="https://github.com/masarray/arsas/pull/79" target="_blank" rel="noopener">Integrasi aplikasi</a><a class="btn" href="https://github.com/masarray/arsas/pull/101" target="_blank" rel="noopener">Release exact export</a><a class="text-link" href="workspace-scl-iec61850.html">Pahami workflow RCB &amp; SCL →</a></div></article>
     </div></section>
 
-    <section class="section section-tight"><div class="container split-panel"><article class="panel"><span class="kicker">Machine-readable source</span><h2>Profile evidence di-govern melalui JSON.</h2><p>Registry publik <code>device-evidence.json</code> memuat profile ID, status service, tanggal historis, versi/retest yang belum diketahui, engineering record per service, dan kondisi yang sama dengan halaman ini. CI menolak status tidak dikenal, link hilang atau named-device claim tanpa metadata evidence.</p><div class="section-actions"><a class="btn" href="device-evidence.json">Buka evidence JSON</a></div></article><article class="panel"><span class="kicker">Kontribusi profile baru</span><h2>Laporkan behavior service, bukan hanya merek.</h2><p>Sertakan versi ARSAS, operating system, service yang diuji, diagnostic sanitized, firmware bila boleh dibuka dan hasil yang reproducible. Credential serta identifier rahasia harus dihapus.</p><div class="section-actions"><a class="btn btn-primary" href="https://github.com/masarray/arsas/issues/new?template=device-compatibility.yml" target="_blank" rel="noopener">Buka form kompatibilitas</a><a class="btn" href="technical-review.html">Claim governance</a></div></article></div></section>
+    <section class="section section-tight"><div class="container split-panel"><article class="panel"><span class="kicker">Machine-readable source</span><h2>Profile evidence di-govern melalui JSON.</h2><p>Registry publik <code>device-evidence.json</code> memuat profile ID, status service, tanggal historis, versi/retest yang belum diketahui, engineering record per service, dan kondisi yang sama dengan halaman ini. CI menolak status tidak dikenal, link hilang atau named-device claim tanpa metadata evidence.</p><div class="section-actions"><a class="btn" href="device-evidence.json">Buka evidence JSON</a></div></article><article class="panel"><span class="kicker">Kontribusi profile baru</span><h2>Laporkan behavior service, bukan hanya merek.</h2><p>Sertakan versi ARSAS, operating system, service yang diuji, diagnostic sanitized, firmware bila boleh dibuka dan hasil yang reproducible. Credential serta identifier rahasia harus dihapus.</p><p class="matrix-boundary" data-evidence-intake="submitted-not-verified"><strong>Kirim → review maintainer → PR registry:</strong> GitHub Issue adalah laporan, bukan evidence field yang sudah diverifikasi. Reviewer memeriksa privasi, versi/tanggal tepat, hasil expected versus observed dan kondisi service; hanya PR registry terpisah yang direview dapat mengubah matrix ini. Planned test dan riwayat engineering saja bukan bukti retest fisik baru.</p><div class="section-actions"><a class="btn btn-primary" href="https://github.com/masarray/arsas/issues/new?template=device-compatibility.yml" target="_blank" rel="noopener">Buka form kompatibilitas</a><a class="btn" href="https://github.com/masarray/arsas/blob/main/docs/evidence-intake-review.md" target="_blank" rel="noopener">Cara evidence direview</a><a class="btn" href="technical-review.html">Claim governance</a></div></article></div></section>
 
     {{> download-cta-id}}
   </main>

landing/templates/compatibility.html

@@ -80,7 +80,7 @@ <h2>See exactly which IEC 61850 services have public evidence—and which do not
       <article class="evidence-profile" id="field-profile-b-rcb-export" data-evidence-profile="field-profile-b-rcb-export"><span class="kicker">Historical field evidence · 2026-07</span><h2>Anonymized field profile B — RCB and SCL export evidence</h2><p>Vendor, model, installation and firmware are not published. Evidence remains read-only until an approved export action is requested.</p><p class="matrix-boundary evidence-trace" data-evidence-trace="field-profile-b-rcb-export" data-tested-version="not-recorded" data-current-stable-retest="not-documented"><strong>Field evidence: 2026-07.</strong> ARSAS version at capture: Not publicly recorded. Retest on v{{STABLE_VERSION}}: Not documented. Updating this page or registry is not a field retest.</p><table class="evidence-table"><thead><tr><th>Service</th><th>Status</th></tr></thead><tbody><tr><td>MMS association and live model</td><td><span class="status-pill" data-status="observed">Observed</span></td></tr><tr><td>Reporting evidence</td><td><span class="status-pill" data-status="conditional">Conditional</span></td></tr><tr><td>Selected-RCB export</td><td><span class="status-pill" data-status="verified">Verified</span></td></tr><tr><td>Files, GOOSE, control</td><td><span class="status-pill">Not tested</span></td></tr></tbody></table><p class="evidence-records" data-service-records="field-profile-b-rcb-export"><strong>Service → public engineering trail:</strong> MMS association / live model / read-only RCB options · <a href="https://github.com/masarray/ARIEC61850/pull/36" target="_blank" rel="noopener">PR #36</a>; selected-RCB export · <a href="https://github.com/masarray/arsas/pull/79" target="_blank" rel="noopener">PR #79</a>. RCB option evidence does not establish live report delivery; these links are not raw field captures or new stable-release tests.</p><h3>Conditions</h3><ul><li>Live RCB names, TriggerOptions, OptionalFields, BufTm and IntgPd were preserved.</li><li>Selected-RCB export retained the exact live MMS RCB identity.</li><li>Exported SCL remains an engineering baseline requiring independent validation.</li><li>No runtime RCB reservation or write is implied by this profile.</li></ul><div class="section-actions"><a class="btn" href="https://github.com/masarray/ARIEC61850/pull/36" target="_blank" rel="noopener">RCB option evidence</a><a class="btn" href="https://github.com/masarray/arsas/pull/79" target="_blank" rel="noopener">Application integration</a><a class="btn" href="https://github.com/masarray/arsas/pull/101" target="_blank" rel="noopener">Exact export release</a><a class="text-link" href="scl-workspace.html">Understand the RCB &amp; SCL workflow →</a></div></article>
     </div></section>
 
-    <section class="section section-tight"><div class="container split-panel"><article class="panel"><span class="kicker">Machine-readable source</span><h2>Evidence profiles are governed in JSON.</h2><p>The public <code>device-evidence.json</code> registry contains the same profile IDs, service statuses, historical dates, explicit version/retest unknowns, service-level engineering records and conditions shown here. CI rejects unsupported status values, missing links or a named-device claim without explicit evidence metadata.</p><div class="section-actions"><a class="btn" href="device-evidence.json">Open evidence JSON</a></div></article><article class="panel"><span class="kicker">Contribute a new profile</span><h2>Report the service behavior—not only the brand.</h2><p>Provide the ARSAS version, operating system, service under test, sanitized diagnostics, firmware when disclosure is allowed and a reproducible result. Confidential identifiers and credentials must be removed.</p><div class="section-actions"><a class="btn btn-primary" href="https://github.com/masarray/arsas/issues/new?template=device-compatibility.yml" target="_blank" rel="noopener">Open compatibility form</a><a class="btn" href="technical-review.html">Claim governance</a></div></article></div></section>
+    <section class="section section-tight"><div class="container split-panel"><article class="panel"><span class="kicker">Machine-readable source</span><h2>Evidence profiles are governed in JSON.</h2><p>The public <code>device-evidence.json</code> registry contains the same profile IDs, service statuses, historical dates, explicit version/retest unknowns, service-level engineering records and conditions shown here. CI rejects unsupported status values, missing links or a named-device claim without explicit evidence metadata.</p><div class="section-actions"><a class="btn" href="device-evidence.json">Open evidence JSON</a></div></article><article class="panel"><span class="kicker">Contribute a new profile</span><h2>Report the service behavior—not only the brand.</h2><p>Provide the ARSAS version, operating system, service under test, sanitized diagnostics, firmware when disclosure is allowed and a reproducible result. Confidential identifiers and credentials must be removed.</p><p class="matrix-boundary" data-evidence-intake="submitted-not-verified"><strong>Submit → maintainer review → registry PR:</strong> a GitHub issue is a report, not verified field evidence. A reviewer checks privacy, exact version/date, expected versus observed results and service conditions; only a separate reviewed registry PR can change this matrix. Planned tests and engineering history alone do not establish a new physical retest.</p><div class="section-actions"><a class="btn btn-primary" href="https://github.com/masarray/arsas/issues/new?template=device-compatibility.yml" target="_blank" rel="noopener">Open compatibility form</a><a class="btn" href="https://github.com/masarray/arsas/blob/main/docs/evidence-intake-review.md" target="_blank" rel="noopener">How evidence is reviewed</a><a class="btn" href="technical-review.html">Claim governance</a></div></article></div></section>
 
     {{> download-cta}}
   </main>