ci.yml

name: CI

on:
  push:
    branches: [main, rewrite/v3-from-c-rcp]
  pull_request:
    branches: [main, rewrite/v3-from-c-rcp]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ── Build and test (cross-platform matrix) ───────────────────────────────────
  build-and-test:
    name: ${{ matrix.os }} / ${{ matrix.compiler }} / C++${{ matrix.std }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            compiler: clang-14
            std: 17
            cc: clang-14
            cxx: clang++-14
          - os: ubuntu-22.04
            compiler: gcc-12
            std: 17
            cc: gcc-12
            cxx: g++-12
          - os: ubuntu-22.04
            compiler: gcc-12
            std: 20
            cc: gcc-12
            cxx: g++-12
          - os: macos-14
            compiler: clang
            std: 17
            cc: clang
            cxx: clang++
          - os: windows-2022
            compiler: msvc
            std: 17
            cc: cl
            cxx: cl

    steps:
      - uses: actions/checkout@v4

      - name: Install tools (Ubuntu)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y cmake ninja-build

      - name: Set up MSVC environment (Windows)
        if: runner.os == 'Windows'
        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1

      - name: Configure
        shell: bash
        env:
          CC:  ${{ matrix.cc }}
          CXX: ${{ matrix.cxx }}
        run: |
          cmake -B build \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_CXX_STANDARD=${{ matrix.std }} \
            -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
            -DRELAY_BUILD_CLI=ON \
            -G Ninja

      - name: Build
        run: cmake --build build --parallel

      - name: Test
        run: ctest --test-dir build --output-on-failure -j1

      - name: Upload compile_commands.json (Linux clang-14 C++17 only)
        if: matrix.os == 'ubuntu-22.04' && matrix.compiler == 'clang-14' && matrix.std == 17
        uses: actions/upload-artifact@v4
        with:
          name: compile-commands
          path: build/compile_commands.json

  # ── Version sources agree ────────────────────────────────────────────────────
  # Ported from c-RCP's own version-sources-agree job, adapted for cpp-RCP's
  # real version.hpp syntax: c-RCP's version.h uses a preprocessor
  # `#define RCP_VERSION "X.Y.Z"`, while cpp-RCP's version.hpp (this being a
  # C++17 header-only port) instead declares a
  # `constexpr std::string_view kVersion = "X.Y.Z";`, so the grep pattern
  # below matches that syntax rather than c-RCP's #define form.
  version-sources-agree:
    name: CMakeLists.txt / version.hpp / .fusa.json versions agree
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - name: Compare the three version sources
        run: |
          cmake_version=$(grep -m1 -oE '^\s*VERSION [0-9]+\.[0-9]+\.[0-9]+' CMakeLists.txt | awk '{print $2}')
          header_version=$(grep -m1 -oE 'kVersion[[:space:]]*=[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+"' include/rcp/version.hpp | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
          fusa_version=$(grep -m1 -oE '"version": *"[0-9]+\.[0-9]+\.[0-9]+"' .fusa.json | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')

          echo "CMakeLists.txt project() VERSION : ${cmake_version:-<not found>}"
          echo "include/rcp/version.hpp kVersion  : ${header_version:-<not found>}"
          echo ".fusa.json \"version\"             : ${fusa_version:-<not found>}"

          fail=0
          [ -n "$cmake_version" ]  || { echo "::error file=CMakeLists.txt::Could not parse project() VERSION"; fail=1; }
          [ -n "$header_version" ] || { echo "::error file=include/rcp/version.hpp::Could not parse kVersion"; fail=1; }
          [ -n "$fusa_version" ]   || { echo "::error file=.fusa.json::Could not parse \"version\""; fail=1; }
          [ "$fail" -eq 0 ] || exit 1

          if [ "$cmake_version" != "$header_version" ] || [ "$cmake_version" != "$fusa_version" ]; then
            echo "::error::Version sources disagree -- CMakeLists.txt=$cmake_version, version.hpp=$header_version, .fusa.json=$fusa_version. Bump all three together (see version.hpp's header comment); a mismatch here silently mislabels every SBOM/provenance/compliance-report artifact release.yml generates from .fusa.json's stale value."
            exit 1
          fi

  # ── TLA+ formal verification (TLC model checking) ────────────────────────────
  # Independent of the C++ build (tla/*.tla model the safety-relevant state
  # machines rcp/lifecycle.hpp and rcp/e2e.hpp implement, not the C++ code
  # itself), so this job carries no `needs:` on build-and-test, matching
  # c-RCP's own identically-named formal-verification job. Each spec's
  # like-named .cfg file in tla/ supplies TLC's CONSTANTS/SPECIFICATION/
  # INVARIANTS/PROPERTIES — TLC loads it automatically when invoked without
  # -config (see FORMAL_VERIFICATION.md). TLC itself exits non-zero on any
  # invariant/property violation or deadlock, so a plain `java -jar ...` per
  # spec is already a real pass/fail gate — no output-scraping needed.
  formal-verification:
    name: formal verification (TLC model checking)
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'

      - name: Download TLC (tla2tools.jar)
        run: curl -sSL -o "$RUNNER_TEMP/tla2tools.jar" https://github.com/tlaplus/tlaplus/releases/latest/download/tla2tools.jar

      - name: Model-check WatchdogSafeState.tla
        working-directory: tla
        run: java -jar "$RUNNER_TEMP/tla2tools.jar" -workers 4 WatchdogSafeState.tla

      - name: Model-check RxSequenceGuard.tla
        working-directory: tla
        run: java -jar "$RUNNER_TEMP/tla2tools.jar" -workers 4 RxSequenceGuard.tla

      - name: Model-check CrcSafeStateLatch.tla
        working-directory: tla
        run: java -jar "$RUNNER_TEMP/tla2tools.jar" -workers 4 CrcSafeStateLatch.tla

      - name: Model-check LifecycleStateMachine.tla
        working-directory: tla
        run: java -jar "$RUNNER_TEMP/tla2tools.jar" -workers 4 LifecycleStateMachine.tla

      - name: Model-check E2ESafePoint.tla
        working-directory: tla
        run: java -jar "$RUNNER_TEMP/tla2tools.jar" -workers 4 E2ESafePoint.tla

  # ── rcp/l2.hpp real-socket round trip (Linux, needs CAP_NET_RAW/root) ────────
  # Exercises rcp::l2::Server/Client over a real veth pair — real AF_PACKET
  # sockets, a real Linux network interface pair, real Ethernet frames. This
  # is deliberately separate from build-and-test above: it needs elevated
  # privileges (CAP_NET_RAW, satisfied here via `sudo`) that job intentionally
  # does not run with, and tests/test_l2.cpp's own header comment documents
  # why its pure codec tests must not require them either.
  l2-veth:
    name: l2 veth round trip (rcp::l2::Server/Client, real frames)
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - name: Install tools
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y cmake ninja-build

      - name: Configure
        run: |
          cmake -B build \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_CXX_STANDARD=17 \
            -G Ninja

      - name: Build l2_veth_roundtrip
        run: cmake --build build --target l2_veth_roundtrip --parallel

      - name: Create veth pair
        run: |
          sudo ip link add veth0 type veth peer name veth1
          sudo ip link set veth0 up
          sudo ip link set veth1 up

      - name: Run real Server/Client round trip over the veth pair
        run: |
          SERVER_MAC=$(cat /sys/class/net/veth1/address)
          echo "veth1 MAC: ${SERVER_MAC}"
          sudo ./build/tests/l2_veth_roundtrip veth1 veth0 "${SERVER_MAC}"

  # ── RELAY conformance gate (spec §12) ────────────────────────────────────────
  relay-conform:
    name: relay conform (RELAY §12 conformance)
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout cpp-RCP
        uses: actions/checkout@v4

      # Pinned to the latest tagged RELAY release rather than floating on the
      # default branch (issue #83 / cpp-RCP-15): an unpinned checkout means
      # this job's pass/fail can change with no cpp-RCP-side change at all
      # whenever RELAY's main branch moves, which is not reproducible CI.
      # Bump this SHA/tag deliberately (in its own commit) when cpp-RCP is
      # ready to validate against a newer RELAY conformance ruleset.
      - name: Checkout RELAY (authoritative conformance validator)
        uses: actions/checkout@v4
        with:
          repository: SoundMatt/RELAY
          ref: 810d1877362145a407b865426bb007657e42d00f # v2.0.4
          path: RELAY

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.25'

      - name: Build relay conformance tool
        working-directory: RELAY
        run: go build -o "$RUNNER_TEMP/relay" ./cmd/relay

      - name: Install build tools
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y cmake ninja-build

      - name: Build cpp-rcp CLI
        run: |
          cmake -B build -DCMAKE_BUILD_TYPE=Release -DRELAY_BUILD_CLI=ON -G Ninja
          cmake --build build --target cpp-rcp --parallel

      - name: Run relay conform (strict)
        run: '"$RUNNER_TEMP/relay" conform --strict build/cpp-rcp'

  # ── clang-tidy ───────────────────────────────────────────────────────────────
  clang-tidy:
    name: clang-tidy
    runs-on: ubuntu-22.04
    needs: build-and-test
    steps:
      - uses: actions/checkout@v4

      - name: Install tools
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y cmake ninja-build clang-tidy

      - name: Configure
        env:
          CC: clang-14
          CXX: clang++-14
        run: |
          cmake -B build \
            -DCMAKE_BUILD_TYPE=Debug \
            -DCMAKE_CXX_STANDARD=17 \
            -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
            -G Ninja

      - name: Build (generate compile_commands.json)
        run: cmake --build build --parallel

      - name: Run clang-tidy
        # Only pass tests/*.cpp as translation units: this project's
        # include/rcp/*.hpp headers are header-only (no standalone compile
        # command in compile_commands.json for a .hpp on its own), so
        # invoking clang-tidy directly on a header fails with a
        # clang-diagnostic-error "file not found" on its own #includes
        # (no -I flags to resolve them) rather than a real lint finding.
        # .clang-tidy's HeaderFilterRegex ('include/rcp/') still surfaces
        # findings from those headers as they're transitively included by
        # the .cpp translation units below.
        run: |
          find tests -name '*.cpp' | \
            xargs clang-tidy -p build --warnings-as-errors='*'

  # ── ASan/UBSan (regmap + faultinject) ─────────────────────────────────────────
  # Scoped to the two suites whose headers hand out raw references into
  # containers they also mutate:
  #
  #  - rcp/regmap.hpp's Ep0 does raw std::vector<T> indexing across
  #    per-endpoint access-control checks and the config vectors those checks
  #    gate (cpp-RCP-N2-01/N2-02, issues #64/#65).
  #  - rcp/faultinject.hpp's Interceptor picks a rule out of a std::vector it
  #    erases from in the same pass (cpp-RCP-D6). That defect was live and
  #    the *existing* test_faultinject cases already reproduced it under
  #    ASan — this job simply wasn't running them, which is why CI stayed
  #    green. Keeping it in scope makes that class of defect gated rather
  #    than fixed once.
  #
  # This is additive to build-and-test above, not a replacement for it.
  asan-ubsan-regmap:
    name: ASan/UBSan (regmap + faultinject)
    runs-on: ubuntu-22.04
    needs: build-and-test
    steps:
      - uses: actions/checkout@v4

      - name: Install tools
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y cmake ninja-build

      - name: Configure (ASan + UBSan)
        env:
          CC: clang-14
          CXX: clang++-14
        run: |
          cmake -B build-asan \
            -DCMAKE_BUILD_TYPE=Debug \
            -DCMAKE_CXX_STANDARD=17 \
            -DCMAKE_CXX_FLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer -g" \
            -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address,undefined" \
            -G Ninja

      - name: Build test_regmap and test_faultinject
        run: cmake --build build-asan --target test_regmap test_faultinject --parallel

      - name: Run test_regmap under ASan/UBSan
        env:
          ASAN_OPTIONS: halt_on_error=1
          UBSAN_OPTIONS: halt_on_error=1,print_stacktrace=1
        run: ./build-asan/tests/test_regmap

      - name: Run test_faultinject under ASan/UBSan
        env:
          ASAN_OPTIONS: halt_on_error=1
          UBSAN_OPTIONS: halt_on_error=1,print_stacktrace=1
        run: ./build-asan/tests/test_faultinject

  # ── LCOV coverage ─────────────────────────────────────────────────────────────
  coverage:
    name: Coverage (LCOV)
    runs-on: ubuntu-22.04
    needs: build-and-test
    outputs:
      coverage-info: coverage.info
    steps:
      - uses: actions/checkout@v4

      - name: Install tools
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y cmake ninja-build lcov

      - name: Configure (coverage build)
        env:
          CC: gcc-12
          CXX: g++-12
        run: |
          cmake -B build-cov \
            -DCMAKE_BUILD_TYPE=Debug \
            -DCMAKE_CXX_FLAGS="--coverage -O0" \
            -DCMAKE_EXE_LINKER_FLAGS="--coverage" \
            -G Ninja

      - name: Build
        run: cmake --build build-cov --parallel

      - name: Test
        run: ctest --test-dir build-cov --output-on-failure -j1

      - name: Collect LCOV data
        run: |
          # --rc lcov_branch_coverage=1 must be passed to BOTH the --capture
          # and --remove invocations below (lcov re-reads/rewrites the .info
          # file's branch records on every invocation, so omitting it on
          # either step silently drops branch data even if the other step
          # collected it). Without it, totalBranches/hitBranches downstream
          # in coverage-report.json are always 0/0 -- a vacuous "nothing
          # failed" rather than a genuine 100%-branch-coverage result against
          # this project's declared DAL-B target (see issues #67/#68).
          lcov --capture \
            --directory build-cov \
            --gcov-tool gcov-12 \
            --rc lcov_branch_coverage=1 \
            --output-file coverage.info
          # /usr/include/* excludes STL/toolchain system headers, which
          # otherwise dominate the file-entry count (confirmed: 101/153 file
          # entries and ~5979/9034 lines were system headers, dragging
          # blended line coverage down to ~68.8% vs. ~91.5% for actual
          # project files alone -- see issue #67/#68).
          lcov --remove coverage.info \
            '*/tests/*' '*/catch2/*' '*/FetchContent/*' '*/cmake-build*/*' \
            '/usr/include/*' \
            --rc lcov_branch_coverage=1 \
            --output-file coverage.info

      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-info
          path: coverage.info

  # ── LLVM MC/DC (real condition/decision coverage, ratchet-gated) ─────────────
  #
  # Phase 7 batch 2 (cpp-RCP #129): real MC/DC evidence per ISO 26262-6:2018
  # Table 12 (MC/DC is "++" recommended at ASIL-C/D), distinct from the
  # `cpfusa coverage --mcdc`/`--dal DAL-B` branch-coverage fallback used in
  # cpfusa-report below, which is NOT verified MC/DC evidence (see
  # AUDIT_PACK.md §3).
  #
  # `cpfusa coverage --mcdc-file` (the mechanism this job would otherwise
  # feed) cannot be used here: confirmed by direct local reproduction that
  # cpp-FuSa v0.18.0's parser (src/coverage/coverage.cpp's apply_mcdc)
  # scans for `mcdc_records[].conditions[].covered_true_count`/
  # `covered_false_count` object fields, while real `llvm-cov export
  # -format=text` emits `mcdc_records` as positional arrays (LineStart/
  # ColumnStart/LineEnd/ColumnEnd/.../a bool TestVectors array) with no such
  # keys anywhere in the schema, at any LLVM version — the same bug class
  # sibling repo c-RCP hit and filed as SoundMatt/c-FuSa#129. This job does
  # not wait on an upstream fix — it reads `llvm-cov export`'s own
  # `totals.mcdc` block directly instead of routing through cpfusa's
  # mismatched parser, so the number below is genuine, tool-independent
  # MC/DC evidence today.
  #
  # Landed ratchet-gated from the start (not informational-only): unlike
  # c-RCP's mcdc job, which shipped informational before a later issue
  # added its gate, this job ships its regression floor in the same PR that
  # introduces it, mirroring this file's own "Coverage regression gate
  # (line floor, not DAL-B)" step further down in cpfusa-report — a
  # ratchet against regression, not a claim of 100% (or even 80%) MC/DC.
  # See the "MC/DC regression gate" step at the end of this job for the
  # floor itself and its provenance comment.
  mcdc:
    name: MC/DC coverage (LLVM, ratchet-gated)
    runs-on: ubuntu-22.04
    needs: build-and-test
    steps:
      - uses: actions/checkout@v4

      - name: Install LLVM 18 (clang/llvm-cov/llvm-profdata with MC/DC support)
        run: |
          wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
          chmod +x /tmp/llvm.sh
          sudo /tmp/llvm.sh 18
          sudo apt-get install -y cmake ninja-build

      - name: Configure (MC/DC-instrumented build)
        env:
          CXX: clang++-18
        run: |
          cmake -B build-mcdc \
            -DCMAKE_BUILD_TYPE=Debug \
            -DCMAKE_CXX_STANDARD=17 \
            -DCMAKE_CXX_FLAGS="-fprofile-instr-generate -fcoverage-mapping -fcoverage-mcdc -O0" \
            -DCMAKE_EXE_LINKER_FLAGS="-fprofile-instr-generate -fcoverage-mapping" \
            -G Ninja

      - name: Build
        run: cmake --build build-mcdc --parallel

      - name: Test (profiled; one .profraw per test binary, %p/%m-namespaced)
        env:
          LLVM_PROFILE_FILE: mcdc-profiles/%p-%16m.profraw
        run: |
          mkdir -p build-mcdc/tests/mcdc-profiles
          ctest --test-dir build-mcdc --output-on-failure -j1

      - name: Merge profile data
        run: |
          llvm-profdata-18 merge -sparse \
            build-mcdc/tests/mcdc-profiles/*.profraw \
            -o mcdc.profdata

      - name: Export real MC/DC totals (llvm-cov, not cpfusa --mcdc-file -- see job header)
        run: |
          bins=()
          while IFS= read -r f; do bins+=("$f"); done < <(find build-mcdc/tests -maxdepth 1 -type f -perm -u+x -name 'test_*')
          primary="${bins[0]}"
          objargs=()
          for b in "${bins[@]:1}"; do objargs+=(-object "$b"); done
          # Header-only: the real implementation lives in include/rcp/*.hpp,
          # not in any src/ dir (cpp-RCP has none) -- scope -sources there,
          # not to tests/*.cpp, so this measures whether the implementation's
          # own conditions/decisions are independently exercised by the test
          # suite, matching c-RCP's own src/*.c-scoped intent.
          srcs=()
          while IFS= read -r f; do srcs+=("$f"); done < <(find include/rcp -name '*.hpp')
          llvm-cov-18 export "$primary" "${objargs[@]}" \
            -instr-profile=mcdc.profdata -format=text \
            -sources "${srcs[@]}" \
            > mcdc-export.json

      - name: Summarize MC/DC totals
        run: |
          python3 - <<'PYEOF'
          import json
          d = json.load(open("mcdc-export.json"))
          totals = d["data"][0]["totals"]
          mcdc = totals.get("mcdc", {})
          branch = totals.get("branches", {})
          summary = {
              "mcdc_condition_pairs_covered": mcdc.get("covered"),
              "mcdc_condition_pairs_total": mcdc.get("count"),
              "mcdc_percent": mcdc.get("percent"),
              "branch_percent_for_comparison": branch.get("percent"),
          }
          json.dump(summary, open("mcdc-summary.json", "w"), indent=2)
          print(json.dumps(summary, indent=2))
          note = (
              f"Real LLVM MC/DC (condition/decision) coverage: "
              f"{mcdc.get('percent', 0):.2f}% "
              f"({mcdc.get('covered')}/{mcdc.get('count')} condition "
              f"independence pairs) across include/rcp/*.hpp -- "
              f"ratchet-gated (regression-only, not a 100% gate; see the "
              f"gate step below). For comparison, branch coverage over the "
              f"same instrumented binaries: "
              f"{branch.get('percent', 0):.2f}%. See job header for why "
              f"this is measured directly via llvm-cov rather than "
              f"cpfusa coverage --mcdc-file."
          )
          print(f"::notice title=MC/DC Coverage::{note}")
          with open("mcdc-summary.md", "w") as f:
              f.write("### MC/DC coverage (ratchet-gated, not a 100% gate)\n\n")
              f.write(note + "\n")
          PYEOF
          cat mcdc-summary.md >> "$GITHUB_STEP_SUMMARY"

      # Uploaded *before* the gate step below so a failing gate still
      # leaves this diagnostic artifact inspectable -- matching how this
      # file's own cpfusa-report job uploads its compliance-report artifact
      # ahead of any of its own non-gating steps failing.
      - name: Upload MC/DC report
        uses: actions/upload-artifact@v4
        with:
          name: mcdc-report
          path: |
            mcdc-summary.json
            mcdc-export.json

      # The real gate: hard-fails if MC/DC condition/decision coverage
      # drops below a floor set with real margin under the currently-
      # measured percentage, mirroring this file's own "Coverage
      # regression gate (line floor, not DAL-B)" step in cpfusa-report --
      # a ratchet against regression, not a claim of complete MC/DC (see
      # AUDIT_PACK.md §3). Reads mcdc-summary.json already written by the
      # step above rather than recomputing anything.
      #
      # Floor set at 60% (Phase 7 batch 2 / cpp-RCP #129): cpp-RCP had ZERO
      # MC/DC infrastructure before this PR, so there is no prior
      # measurement to ratchet against -- this is the first one. Local
      # instrumented build+test+export (same mechanism and flags as this
      # job) run twice: Homebrew LLVM 18.1.8 (matching this job's own
      # clang-18 major version) measured 313/466 = 67.17% over
      # include/rcp/*.hpp with all 58 tests passing under instrumentation;
      # a second run on Homebrew LLVM 22.1.8 measured 426/629 = 67.73%,
      # close agreement despite a 4-major-version toolchain gap, which is
      # itself evidence the percentage is a stable property of the test
      # suite rather than a toolchain artifact. 60% keeps ~7 points of
      # margin below the clang-18-matched 67.17% figure -- wider than
      # would be needed for gcc/clang version drift alone, because this
      # measurement also crosses macOS/arm64 (local) vs Ubuntu 22.04/x86_64
      # (this job) and Homebrew's clang-18 build vs apt.llvm.org's, either
      # of which could plausibly shift condition-pair counts on a
      # header-only codebase (many decisions live in platform-conditional
      # code, e.g. rcp/l2.hpp's raw-socket paths) more than a same-OS
      # version bump would. Raise this floor deliberately, with an updated
      # provenance comment, once a fresh re-measurement on this job's own
      # runner confirms real headroom -- do not raise it from a
      # locally-measured number alone.
      - name: MC/DC regression gate (ratchet floor, not 100% -- Phase 7 batch 2 / cpp-RCP #129)
        run: |
          python3 - <<'PYEOF'
          import json
          import sys

          floor = 60.0  # see step name's comment above for provenance

          summary = json.load(open("mcdc-summary.json"))
          actual = summary["mcdc_percent"]

          if actual is None or actual < floor:
              print(f"::error::MC/DC coverage regression: {actual}% < floor {floor}% "
                    f"({summary['mcdc_condition_pairs_covered']}/"
                    f"{summary['mcdc_condition_pairs_total']} condition "
                    f"independence pairs). This is a ratchet floor (Phase 7 "
                    f"batch 2 / cpp-RCP #129), not a 100% gate -- if this drop "
                    f"is an intentional tradeoff, lower the floor explicitly "
                    f"with a provenance comment matching this step's own "
                    f"convention; do not just delete or skip this step.")
              sys.exit(1)

          print(f"OK: {actual:.2f}% >= floor {floor}%")
          PYEOF

  # ── Build cpp-FuSa binary (shared by all cpfusa-* jobs) ──────────────────────
  cpfusa-build:
    name: Build cpp-FuSa
    runs-on: ubuntu-22.04
    steps:
      - name: Install tools
        run: sudo apt-get update -qq && sudo apt-get install -y cmake ninja-build

      - name: Build cpp-FuSa from source
        run: |
          git clone --depth=1 --branch v0.18.0 https://github.com/SoundMatt/cpp-FuSa /tmp/cpfusa
          cmake -B /tmp/cpfusa/build -S /tmp/cpfusa \
            -DCMAKE_BUILD_TYPE=Release -G Ninja
          cmake --build /tmp/cpfusa/build --parallel

      - name: Upload cpfusa binary
        uses: actions/upload-artifact@v4
        with:
          name: cpfusa-binary
          path: /tmp/cpfusa/build/cpfusa

  # ── Helper: download cpfusa binary ───────────────────────────────────────────
  # (Not a real job — these steps are inlined in each cpfusa-* job below.)

  # ── cpp-FuSa: built-in safety check (FUSA001–005) ────────────────────────────
  cpfusa-check:
    name: cpfusa check --strict
    runs-on: ubuntu-22.04
    needs: [build-and-test, cpfusa-build]
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          name: cpfusa-binary
          path: /tmp/cpfusa/build

      - run: chmod +x /tmp/cpfusa/build/cpfusa

      - name: Safety check (0 errors required)
        run: /tmp/cpfusa/build/cpfusa check

      - name: Verify required safety artifacts are present
        run: |
          missing=0
          for f in \
            .fusa.json \
            .fusa-reqs.json \
            .fusa-hara.json \
            .fusa-problems.json \
            .fusa-iec62443.json \
            SECURITY.md \
            INCIDENT-RESPONSE.md \
            SAFETY_PLAN.md \
            .github/CODEOWNERS; do
            if [ ! -f "$f" ]; then
              echo "::error::Required safety artifact missing: $f"
              missing=$((missing + 1))
            fi
          done
          [ "$missing" -eq 0 ] || exit 1

  # ── cpp-FuSa: MISRA/AUTOSAR/JSF++ lint (LINT001–010) ─────────────────────────
  cpfusa-lint:
    name: cpfusa lint (MISRA/AUTOSAR)
    runs-on: ubuntu-22.04
    needs: [build-and-test, cpfusa-build]
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          name: cpfusa-binary
          path: /tmp/cpfusa/build

      - run: chmod +x /tmp/cpfusa/build/cpfusa

      - name: MISRA/AUTOSAR/JSF++ lint
        run: /tmp/cpfusa/build/cpfusa lint

  # ── cpp-FuSa: static analysis (clang-tidy + cppcheck + own passes) ───────────
  cpfusa-analyze:
    name: cpfusa analyze
    runs-on: ubuntu-22.04
    needs: [build-and-test, cpfusa-build]
    steps:
      - uses: actions/checkout@v4

      - name: Install analysis tools
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y cmake ninja-build clang-tidy cppcheck

      - uses: actions/download-artifact@v4
        with:
          name: cpfusa-binary
          path: /tmp/cpfusa/build

      - run: chmod +x /tmp/cpfusa/build/cpfusa

      - name: Configure (generate compile_commands.json)
        env:
          CC: clang-14
          CXX: clang++-14
        run: |
          cmake -B build \
            -DCMAKE_BUILD_TYPE=Debug \
            -DCMAKE_CXX_STANDARD=17 \
            -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
            -G Ninja

      - name: Build
        run: cmake --build build --parallel

      # Real root cause of the `|| true` this replaces: `cpfusa analyze`
      # (both its clang-tidy and cppcheck integrations) recursively scans
      # whatever directory tree it is pointed at with no awareness of
      # .fusa.json's excludePatterns. Left as `build/`, that tree contains
      # Catch2's own vendored source (FetchContent-populated
      # build/_deps/catch2-src/), including Catch2's own SelfTest suite —
      # cppcheck chokes on that third-party test code's BDD macros
      # (SECTION/GIVEN/CHECKED_IF/...) and reports them as first-party
      # ERROR findings (e.g. "unknownMacro", intentional ODR violations in
      # Catch2's own test fixtures), which is what was actually keeping this
      # job red, not a real defect in cpp-RCP's own code. Separately,
      # `cpfusa analyze` looks for compile_commands.json directly under the
      # directory it scans (the repo root here) — since it was left inside
      # build/ with no copy at the root, clang-tidy has never actually run
      # in this job at all (silently falling back to its
      # "compile_commands.json not found" info finding).
      #
      # Fixed by copying compile_commands.json to the root (so clang-tidy
      # finally runs for real) and then deleting build/ (and the vendored
      # sources inside it) before invoking analyze, so the scan only ever
      # sees this project's own first-party sources. With both fixed,
      # cpp-RCP's own code has 0 ERROR-severity findings, so this can be a
      # real, ungated `|| true`-free hard gate.
      - name: Isolate compile_commands.json from vendored build tree
        run: |
          cp build/compile_commands.json .
          rm -rf build

      - name: Static analysis
        run: /tmp/cpfusa/build/cpfusa analyze

  # ── cpp-FuSa: 20 CWE-mapped cybersecurity rules (ISO 21434) ─────────────────
  # Job renamed from its previous "cpfusa cyber --strict" name, which never
  # matched its `run:` line below (plain `cpfusa cyber`, no --strict). --strict
  # is a real flag (`cpfusa cyber --help`: "Exit 1 on warnings too"), but
  # cpp-RCP does not cleanly pass under it today: a real run surfaces 838
  # WARNING-severity findings (613 CYBER009 "integer narrowing conversion",
  # 189 CYBER017 "hardcoded IP address", plus smaller CYBER004/012/019
  # counts), overwhelmingly the expected, reviewed shape of a wire-protocol
  # library (masking/shifting a wider integer down to a byte for
  # serialization, and loopback/RFC5737 test addresses in the test suite) —
  # not defects, but also not sites that can be responsibly mass-remediated
  # or blanket-waived in this batch. Critically, `.fusa-dispositions.json`
  # cannot fix this either way: unlike gated_exit_code() (used by
  # check/lint/analyze), the `cyber` subcommand's --strict check
  # (`cyber_strict && warnings > 0`) never consults dispositions at all, so
  # no waiver entry changes its outcome. Turning --strict on today would
  # therefore require either fixing several hundred call sites sight-unseen
  # or sprinkling `// fusa:suppress CYBERxxx` at each one purely to satisfy
  # the flag — the "soften a gate to make CI pass" move this batch is
  # explicitly not supposed to make. So the job keeps running plain `cyber`
  # (a real gate on ERROR-severity findings, of which cpp-RCP has none) and
  # is named to match.
  cpfusa-cyber:
    name: cpfusa cyber
    runs-on: ubuntu-22.04
    needs: [build-and-test, cpfusa-build]
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          name: cpfusa-binary
          path: /tmp/cpfusa/build

      - run: chmod +x /tmp/cpfusa/build/cpfusa

      - name: Cybersecurity rules (ISO 21434)
        run: /tmp/cpfusa/build/cpfusa cyber

  # ── cpp-FuSa: requirements traceability (≥80% coverage gate) ─────────────────
  cpfusa-trace:
    name: cpfusa trace (100% coverage)
    runs-on: ubuntu-22.04
    needs: [build-and-test, cpfusa-build]
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          name: cpfusa-binary
          path: /tmp/cpfusa/build

      - run: chmod +x /tmp/cpfusa/build/cpfusa

      - name: Traceability check (all requirements traced)
        run: /tmp/cpfusa/build/cpfusa trace

      # Informational only, not a gate: this dumps the gap detail for human
      # review. The actual gate for this job is the "Enforce 100% requirement
      # coverage" step below, which runs without `|| true` and fails the job
      # for real.
      - name: Traceability gaps report (informational, non-gating)
        run: /tmp/cpfusa/build/cpfusa trace --gaps || true

      # RELAY §20.1: every requirement MUST be traced (100%). NOTE: despite
      # this job's own prior "traced AND tested" comment, --req-coverage
      # only gates cpfusa's annotation_coverage (traced) metric -- confirmed
      # by direct read of cpp-FuSa v0.18.0's trace.cpp, which wires
      # --req-coverage to annotation_coverage alone, never to `tested`. The
      # "AND tested" half was previously unenforced (this repo's own
      # `tested`/`total` has happened to be 100% regardless, so nothing was
      # ever observed to regress, but nothing was actually checking it).
      - name: Enforce 100% requirement coverage (traced)
        run: /tmp/cpfusa/build/cpfusa trace --req-coverage 100

      # RELAY §20.1's other half: every requirement MUST also be tested
      # (100%). cpp-FuSa v0.18.0 has no CLI flag for this metric alone (its
      # --sec-tested flag is a differently-named, differently-scoped gate --
      # see the next step's own header -- and is NOT a substitute here: it
      # currently has a bug, filed as SoundMatt/cpp-FuSa#64, that makes it
      # silently check general test coverage instead of security-test
      # coverage, so relying on it for "tested" would work today by
      # coincidence and break the moment that bug is fixed). `cpfusa trace
      # --format json`'s `coverage` object exposes `testedRequirements`/
      # `totalRequirements` directly and correctly -- parsed here via jq,
      # matching the same JSON-over-text-scraping choice SoundMatt/c-RCP#577
      # made for the identical problem in that sibling repo's own CI.
      - name: Enforce 100% requirement coverage (tested)
        run: |
          cov="$(/tmp/cpfusa/build/cpfusa trace --format json | jq '.coverage')"
          echo "$cov"
          total=$(echo "$cov" | jq '.totalRequirements')
          tested=$(echo "$cov" | jq '.testedRequirements')
          if [ "$tested" != "$total" ]; then
            echo "::error::'tested' metric gate failed: tested=$tested total=$total (must be equal for a 100% gate)"
            exit 1
          fi
          echo "OK: $tested/$total tested"

      # Genuine security-test coverage: CYBERSECURITY.md's own six security
      # layers cite requirement ids as security-relevant (REQ-TLS-001..010,
      # REQ-AUTH-001..008, REQ-E2E-001..014, REQ-RL-001..008,
      # REQ-DISC-001..009, REQ-REGMAP-001..015, plus the 8 Table-30 Row-2
      # evt[2:0]-classification ids added after that doc's count was last
      # written -- 72 total as of Phase 5), each marked
      # `"severity": "cybersecurity"` in `.fusa-reqs.json` -- the field
      # cpp-FuSa's own trace.cpp already reads to compute
      # `secTestedRequirements` (a test annotation on a cybersecurity-marked
      # requirement), previously never populated so this metric was always
      # zero. Deliberately NOT using cpfusa's own `--sec-tested` CLI flag:
      # confirmed by direct read of v0.18.0's trace.cpp/cli.cpp that it
      # gates on the wrong variable (general test_coverage, not
      # sec_tested/total) -- the exact same bug class SoundMatt/c-FuSa#147
      # fixed in c-FuSa, filed upstream as SoundMatt/cpp-FuSa#64, not yet
      # fixed. Parses `--format json`'s already-correct
      # `secTestedRequirements` field directly instead.
      #
      # Gated on an ABSOLUTE COUNT (>= 72), not a percentage of the total
      # catalog: this step was originally a 17% floor (64/376 at the time),
      # but its own comment already stated the actual intent was "a
      # regression floor against the exact, CYBERSECURITY.md-enumerated
      # subset" losing test coverage -- not a claim about what fraction of
      # the codebase is security-relevant. A percentage-of-total
      # implementation is the wrong shape for that intent: Phase 6 (cpp-RCP
      # #129) is deliberately growing `.fusa-reqs.json` from 412 toward
      # something closer to c-RCP's 1282-entry catalog by re-deriving
      # entries for already-ported, non-cybersecurity-relevant content
      # (wire framing, per-endpoint register semantics, etc.) -- exactly
      # the kind of correct, intentional growth a percentage floor
      # penalizes as if it were a regression. Found when Phase 6 batch 1
      # (PR #155) legitimately added 36 REQ-ACF-*/REQ-AVTP-*/REQ-WIREERR-*
      # entries and the previously-passing ratio (72/412 = 17.5%) dropped
      # to 72/448 = 16.1%, failing a floor that was never meant to track
      # total-catalog size. An absolute-count floor at the current
      # enumerated total (72) still catches the real regression this step
      # exists for -- one of the enumerated ids losing its test tag, or an
      # id being removed from the `severity: cybersecurity` set -- without
      # being diluted by legitimate catalog growth elsewhere. Update this
      # number (never lower it silently) if CYBERSECURITY.md's own
      # enumerated set genuinely grows or shrinks.
      - name: Enforce security-test coverage (absolute floor, real CYBERSECURITY.md subset)
        run: |
          cov="$(/tmp/cpfusa/build/cpfusa trace --format json | jq '.coverage')"
          echo "$cov"
          total=$(echo "$cov" | jq '.totalRequirements')
          sec=$(echo "$cov" | jq '.secTestedRequirements')
          if [ "$sec" -lt 72 ]; then
            echo "::error::sec-tested gate failed: $sec/$total security-tested < required floor of 72 (CYBERSECURITY.md-enumerated subset)"
            exit 1
          fi
          echo "OK: $sec/$total security-tested (floor: 72)"

  # ── cpp-FuSa: ctest integration → .fusa-evidence.json ────────────────────────
  cpfusa-verify:
    name: cpfusa verify (ctest evidence)
    runs-on: ubuntu-22.04
    needs: [build-and-test, cpfusa-build]
    steps:
      - uses: actions/checkout@v4

      - name: Install tools
        run: sudo apt-get update -qq && sudo apt-get install -y cmake ninja-build

      - uses: actions/download-artifact@v4
        with:
          name: cpfusa-binary
          path: /tmp/cpfusa/build

      - run: chmod +x /tmp/cpfusa/build/cpfusa

      - name: Configure
        env:
          CC: gcc-12
          CXX: g++-12
        run: |
          cmake -B build \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_CXX_STANDARD=17 \
            -G Ninja

      - name: Build
        run: cmake --build build --parallel

      - name: Run tests + generate evidence
        run: /tmp/cpfusa/build/cpfusa verify

      - name: Upload test evidence
        uses: actions/upload-artifact@v4
        with:
          name: fusa-evidence
          path: .fusa-evidence.json

  # ── cpp-FuSa: tool qualification suite ───────────────────────────────────────
  cpfusa-qualify:
    name: cpfusa qualify
    runs-on: ubuntu-22.04
    needs: cpfusa-build
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          name: cpfusa-binary
          path: /tmp/cpfusa/build

      - run: chmod +x /tmp/cpfusa/build/cpfusa

      - name: Tool qualification (8 positive/negative test cases)
        run: /tmp/cpfusa/build/cpfusa qualify

      - name: Upload qualification report
        uses: actions/upload-artifact@v4
        with:
          name: qualify-report
          path: qualify-report.json

  # ── cpp-FuSa: CMake dependency CVE scan ───────────────────────────────────────
  cpfusa-vuln:
    name: cpfusa vuln (CVE scan)
    runs-on: ubuntu-22.04
    needs: cpfusa-build
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          name: cpfusa-binary
          path: /tmp/cpfusa/build

      - run: chmod +x /tmp/cpfusa/build/cpfusa

      - name: Dependency vulnerability scan
        run: /tmp/cpfusa/build/cpfusa vuln

      - name: Upload vulnerability report
        uses: actions/upload-artifact@v4
        with:
          name: vuln-report
          path: vuln.json

  # ── cpp-FuSa: impact analysis on PRs ─────────────────────────────────────────
  cpfusa-impact:
    name: cpfusa impact (change analysis)
    runs-on: ubuntu-22.04
    if: github.event_name == 'pull_request'
    needs: [cpfusa-build, cpfusa-trace]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/download-artifact@v4
        with:
          name: cpfusa-binary
          path: /tmp/cpfusa/build

      - run: chmod +x /tmp/cpfusa/build/cpfusa

      - name: Change impact analysis
        run: /tmp/cpfusa/build/cpfusa impact

  # ── cpp-FuSa: full compliance report (aggregated) ────────────────────────────
  cpfusa-report:
    name: cpfusa report (compliance)
    runs-on: ubuntu-22.04
    needs:
      - build-and-test
      - coverage
      - cpfusa-check
      - cpfusa-lint
      - cpfusa-analyze
      - cpfusa-cyber
      - cpfusa-trace
      - cpfusa-verify
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          name: cpfusa-binary
          path: /tmp/cpfusa/build

      - run: chmod +x /tmp/cpfusa/build/cpfusa

      - name: Download coverage info
        uses: actions/download-artifact@v4
        with:
          name: coverage-info
          path: .

      # Artifact generation only, not a gate: this project's stub bridge
      # implementations cannot reach the 100%-branch DAL-B threshold this
      # command grades against, so `cpfusa coverage` exits non-zero by
      # design today (same reasoning as release.yml's gap-report steps).
      # `|| true` is intentional here so the job can still produce and
      # upload coverage-report.json for inspection; it does not mean "DAL-B
      # coverage is enforced". The step immediately below is what actually
      # gates on this job's data (issues #67/#68).
      - name: LCOV structural coverage report (DO-178C, artifact only — non-gating)
        run: /tmp/cpfusa/build/cpfusa coverage --profile coverage.info --dal DAL-B --output coverage-report.json || true

      # Real gate (issues #67/#68): a coverage report with totalBranches==0
      # is not "100% branch coverage met", it's "no branch data was
      # collected at all" -- a 0/0 ratio that would otherwise vacuously
      # satisfy any branch-coverage threshold check. Fail hard if that
      # happens, independent of whether the DAL-B step above is gating.
      - name: Assert branch coverage data is non-vacuous
        run: |
          total_branches=$(jq '.summary.totalBranches' coverage-report.json)
          echo "coverage-report.json summary.totalBranches=${total_branches}"
          if [ "$total_branches" -le 0 ]; then
            echo "::error::coverage-report.json reports totalBranches=${total_branches} — no branch coverage data was collected, so any branch-coverage threshold is being met vacuously (0/0), not genuinely. See issues #67/#68."
            exit 1
          fi

      # Artifact generation only, not a gate: these convert the aggregated
      # findings (already gated individually by the cpfusa-check / -lint /
      # -cyber / -trace / -verify jobs this job `needs:`) into downloadable
      # JSON/SARIF report formats. `|| true` reflects that intent, not a
      # bug — there is nothing pass/fail-shaped about a format conversion.
      - name: Full compliance report (JSON, artifact only — non-gating)
        run: /tmp/cpfusa/build/cpfusa report --format json --output report.json || true

      - name: Full compliance report (SARIF, artifact only — non-gating)
        run: /tmp/cpfusa/build/cpfusa report --format sarif --output results.sarif || true

      # Artifact generation only, not a gate: records a point-in-time safety
      # metrics snapshot for trend tracking. There is no pass/fail threshold
      # associated with recording a snapshot.
      - name: Safety metrics snapshot (artifact only — non-gating)
        run: /tmp/cpfusa/build/cpfusa metrics record || true

      - name: Upload compliance report
        uses: actions/upload-artifact@v4
        with:
          name: compliance-report
          path: |
            report.json
            results.sarif
            coverage-report.json