P6: IEDScout interaction parity — Global Data, Control, dynamic services, MMS sniff, multi-IED

Follow-up to validated P5A-P5F canonical Browser architecture.

Authoritative base: baseline/ux-p5f-validated / 3fdc1ef53d2025902ca54250749aa9f15edb1b42.

P6A — Browser Global Data / Activity Monitor

Add a Browser-level common watch surface owned by the active canonical IedEngineeringContext.
Allow explicit watch entries from selected DataAttribute, DataSet, Report and configured GOOSE objects.
Data values must resolve from the canonical tree; no second semantic model.
Online refresh is explicit/operator-driven and bounded to at most 64 MMS targets per action; no cyclic MMS polling.
Received report activity may flow from the already active report controller; do not create another report association.
Configured GOOSE watch entries are model inspection only in P6A; passive wire subscription remains Sniffer ownership.
Disconnect preserves the watchlist/model context while runtime values become offline/stale; reconnect can refresh explicitly.
watchlist is bounded and deduplicated; fail closed on unsupported/structural selections.
no MMS/report/control/GOOSE wire-runtime rewrite.
QA must prove canonical authority, dedupe/bounds, explicit refresh, no Timer polling, and P5 regression gates.

Later P6 phases

P6B Browser IEC 61850 Control UX
P6C dynamic DataSet + advanced Report authoring
P6D real passive MMS sniffer
P6E multi-IED engineering workspace

P6A — Browser Global Data / Activity Monitor (STARTED)

base: baseline/ux-p5f-validated / 3fdc1ef53d2025902ca54250749aa9f15edb1b42
branch: ux/p6a-browser-global-data
Browser Global Data is a watchlist/projection over the canonical IedEngineeringContext; it does not own a second model.
supported explicit watch sources in this slice: DataAttribute, DataSet, Report, configured GOOSE.
monitored MMS refresh is explicit and bounded to 64 targets per action through the existing client association; no new cyclic polling.
watchlist max 256, deduplicated, retained across Disconnect, reset on structural context generation change.
Report activity reuses the active MmsReportController; configured GOOSE remains model-only.
no wire-runtime rewrite.

P6B acceptance contract — Browser IEC 61850 Control UX

P6B starts only after P6A is merged and locked as a validated baseline.

Authority / ownership

candidate controllable Data Objects come from the active canonical IedEngineeringContext; no full structural rediscovery.
Control runtime may own a separate MMS association for isolation, but endpoint/lifecycle come from the same Browser engineering context.
descriptor discovery is targeted to the operator-selected control object through existing ControlDescriptorDiscovery.
all control execution must reuse MmsAssociationControlTransport + ControlObjectSession; no GUI-local MMS control encoder/state machine.

UX / safety

Browser exposes a Controls section and contextual Control action for canonical controllable objects.
selected object shows ctlModel, CDC, live type readiness, status reference/value, SBO/Operate timeout and enhanced/normal mode.
supported models: Direct Normal, SBO Normal, Direct Enhanced, SBO Enhanced; StatusOnly/Unknown fail closed.
values support core proven ControlValue kinds (boolean/SPC, DPC, signed/unsigned integer, floating/APC, step/BSC where live type permits).
operator must explicitly arm each command in the dialog; no persistent/global arm token and no auto retry.
Select / SelectWithValue / Operate / Cancel remain distinct lifecycle states for SBO.
default origin category is station-control with bounded operator-editable origin identifier.
Test, interlock-check, synchro-check are explicit controls; defaults follow current core request defaults.
enhanced control waits for correlated CommandTermination and surfaces ControlError/AddCause; MMS Write acceptance alone is not shown as final success.
disconnect/cancel invalidates active selection; stale completion must not mutate a newer session.

Regression boundaries

no rewrite of core control/session/transport/command-termination implementation.
no implicit control Writes during discovery, selection browsing, connect, or descriptor inspection.
no automatic retry of Select/SBOw/Oper/Cancel.
P5/P6A canonical-context/service-reuse/global-data gates stay active.
CI must exercise read-only discovery plus simulator-backed Direct/SBO Normal/Enhanced control sequences and negative fail-closed cases.

P6A closeout — CLOSED / VALIDATED

PR P6A: add Browser Global Data activity monitor #119 exact validated head: e1abdfec93888b4affb74bec492e32d2fdf11c9a
exact-head pull-request workflows: 9/9 SUCCESS
merged main: b6c76f9fd641740182208108ada0050180a9a46c
exact head -> merge: 0 changed files
post-merge workflows: 11/11 SUCCESS
immutable baseline: baseline/ux-p6a-validated -> b6c76f9fd641740182208108ada0050180a9a46c

Validated behavior:

Browser now has a canonical Global Data watch surface.
DataAttribute, DataSet, Report and configured GOOSE can be added explicitly.
monitored data resolves through IedEngineeringContext.treeModel; no second engineering model.
explicit monitored refresh is bounded to 64 MMS targets/action and reuses the existing client association.
no new cyclic MMS polling.
watchlist is capped at 256 and deduplicated.
Disconnect preserves engineering watch context; structural context replacement resets it.
report activity reuses the existing report controller.
no MMS/report/GOOSE wire-runtime rewrite.

P6A status: CLOSED / VALIDATED.
P6B must descend from baseline/ux-p6a-validated.

P6B — Browser IEC 61850 Control UX (STARTED)

base: baseline/ux-p6a-validated / b6c76f9fd641740182208108ada0050180a9a46c
branch: ux/p6b-browser-control

Acceptance contract:

Browser derives the target control-object root from the active canonical Data Model selection; no separate structural discovery/navigation authority.
A dedicated Browser control association may be used for runtime isolation, but endpoint/context ownership remains IedBrowserSessionController + IedEngineeringContext.
Runtime execution MUST reuse ControlDescriptorDiscovery + ControlObjectSession; no GUI-local MMS Control encoder/state machine.
support all discovered command-ready ctlModels: direct-normal, SBO-normal, direct-enhanced, SBO-enhanced.
expose explicit Select, Operate, Select+Operate and Cancel only when valid for the discovered model.
typed value parsing supports the existing proven ControlValue families (SPC/DPC/int/uint/float/step) and fails closed for unsupported/vendor-specific values.
origin, test, interlock-check and synchro-check are operator-visible; origin identifier is bounded.
no automatic retry.
enhanced security completion surfaces correlated positive/negative CommandTermination / LastApplError; MMS Write acceptance alone is not shown as final success.
explicit confirmation is required before a control action that can write to the IED.
Disconnect tears down any control selection/association and retains the canonical Browser model.
QA must prove lifecycle ownership, fail-closed selection detection, action gating, explicit confirmation and reuse of proven control runtime.
no server/runtime protocol rewrite.

P6B implementation candidate ready — certification pending

PR: P6B: add Browser IEC 61850 Control UX #120
frozen candidate head: 6f8a5c71cd24728071a76f578ac6b5245ed2cc7c
base: baseline/ux-p6a-validated / b6c76f9fd641740182208108ada0050180a9a46c
lineage: ahead 22 / behind 0
static P6B contract audit: PASS
unresolved review threads: 0
exact-head GitHub Actions: currently queued; no job has started yet

Candidate behavior:

canonical FC=CO DataAttribute selection projects a control-object root;
Browser-owned control association shares endpoint/context authority and disconnect lifecycle;
execution reuses ControlDescriptorDiscovery, MmsAssociationControlTransport, and ControlObjectSession;
four discovered ctlModels supported by the same proven core runtime;
typed ctlVal parsing for SPC/DPC/int/uint/float/step with fail-closed auto inference;
Select / Select+Operate / Operate / Cancel are gated by discovered capabilities;
origin/test/interlock/synchro options are operator-visible;
modal confirmation precedes every write-capable action;
no automatic retry;
enhanced-security completion surfaces correlated CommandTermination / LastApplError;
best-effort status read-back cannot overwrite an already authoritative control result;
human-readable ControlError/AddCause diagnostics.

Do not merge or create a P6B baseline until the exact candidate head is green.

P6B closeout — CLOSED / VALIDATED

PR P6B: add Browser IEC 61850 Control UX #120 exact validated head: e6a84965addd2a7816bad04ca834c0e69c6b22c2
exact-head PR workflows: 9/9 SUCCESS
merged main: 88e7af4d07c19efb4496e9b4ae71977c2554c571
exact head -> merge: 0 changed files
post-merge workflows: 11/11 SUCCESS
immutable baseline: baseline/ux-p6b-validated -> 88e7af4d07c19efb4496e9b4ae71977c2554c571

P6B status: CLOSED / VALIDATED.
P6C must descend from this exact baseline.

P6C — Dynamic DataSet + Advanced Report Authoring (STARTED)

base: baseline/ux-p6b-validated / 88e7af4d07c19efb4496e9b4ae71977c2554c571
branch: ux/p6c-dynamic-dataset-report-authoring

Acceptance contract:

static/SCL/discovered non-deletable DataSets remain immutable in Browser authoring;
dynamic DataSet create/delete reuses MmsDynamicDataSetRuntime; no GUI-local Define/DeleteNamedVariableList encoder;
dynamic member list is ordered, deduplicated, bounded to 64, and sourced from canonical Data Model MMS references;
successful create MUST be verified by GetNamedVariableListAttributes before it enters authoring inventory;
delete defaults to runtime-owned DataSets only; no override path in ordinary Browser UX;
advanced report draft exposes DatSet binding plus IEC 61850 TrgOps/OptFlds controls;
report configuration writes reuse MmsReportSubscriptionRuntime and its read-back verification;
static report path remains MmsStaticReportSessionRuntime with write_data_set_reference=false and allow_polling_fallback=false;
dynamic authoring must never silently mutate an RCB: RCB writes happen only on explicit Enable / Enable+GI;
RCB must be disabled/available according to the proven runtime before configuration; no automatic retry;
dynamic DataSet cleanup is explicit and cannot delete static/non-owned DataSets;
Disconnect releases report runtime and dynamic ownership scope with the association; canonical engineering context remains;
permanent CI gates must prove static immutability, dynamic ownership, 64-member bound, canonical member sourcing, runtime reuse, and no wire encoder fork.

P6D acceptance contract — Real Passive MMS Sniffer (pre-implementation audit)

Start a code branch only from baseline/ux-p6c-validated after PR #121 exact-head and post-merge gates complete.

Ownership: Sniffer is passive, standalone, and never establishes an MMS association or emits client requests. Simulator GOOSE publication, Browser MMS client/control/report associations, and canonical IED engineering context are unchanged.

Capture and decode: explicit NIC selection with Start/Stop; PCAP offline fixture/import path; separate MMS/TCP port-102 capture transport (existing GOOSE transport is EtherType-filtered and cannot stand in for TCP capture). Bounded Ethernet/VLAN + IPv4/TCP parsing; per-direction sequence-aware reassembly and TPKT coalescing/splitting; COTP DT/EOT, Session/Presentation/ACSE decoding through existing core; MmsPduCodec classifies request/response/error/unconfirmed InformationReport. Show endpoint/direction, service, invoke ID, time, decode status, and report/control attribution only when established by decoded evidence.

Guardrails: capped flows, per-flow bytes, retained packets/events, and CPU work per capture cycle; malformed/truncated/IP fragments/unsupported link types fail explicitly, never guessed. Preserve PCAP export and non-MMS GOOSE behavior. No raw hex input treated as proof of decoded MMS.

QA: deterministic synthetic PCAP covers split/coalesced TPKT, duplicated/retransmitted/OOO/gap TCP, COTP EOT, MMS Read/Write/Report/Control classifications, malformed BER, no client association, and bounded memory. Linux+Windows build and release gates must remain green; no live-device parity claim without live evidence.

Implementation may be staged internally, but do not label P6D complete until real passive capture, decode, UI filtering, and deterministic regression evidence all exist.

P6C merge / P6D acceptance checkpoint

P6C PR #121 exact head b69b8135e1b76bc3cda7f72cadb8d36abc14ca0d passed 10/10 exact-head workflows, merged as 6e091411e0e9e9633364d15c62a41347bcc6b666; head->merge diff 0 files. Post-merge gates remain in progress; baseline creation waits for all green.

P6D Real Passive MMS Sniffer contract:

observe existing Ethernet/TCP traffic without opening an MMS client association or injecting traffic;
bounded per-direction TCP sequencing, retransmission dedupe, missing-segment/gap detection and fail-closed flow resync;
TPKT framing and COTP segmentation on the existing OSI codecs; decode Session/Presentation/ACSE/MMS using existing library authority;
bidirectional invocation correlation, correctly distinguish request/response/error/unconfirmed InformationReport; service filters Read/Write/Control/Reports/association;
offline reproducible PCAP import and optional live capture; no forced Npcap/libpcap dependency in portable build;
explicit unsupported/encrypted/truncated evidence, limits for packets/flows/bytes/events, user-facing error/health counters;
Sniffer stays passive and separate from Simulator publisher and Browser client association;
CI exercises split/coalesced/retransmitted/out-of-order TCP, fragmented COTP, malformed lengths, unrelated traffic, and no active association calls;
do not describe PCAP-only or GOOSE-only mode as complete live MMS sniff.

P6C CLOSED / VALIDATED

PR #121 exact head b69b8135e1b76bc3cda7f72cadb8d36abc14ca0d: 10/10 exact-head workflows SUCCESS. Merge 6e091411e0e9e9633364d15c62a41347bcc6b666; head→merge 0 changed files; post-merge 10/10 SUCCESS. Immutable baseline baseline/ux-p6c-validated points to exact merge SHA. P6D descends from this baseline.

P6D closeout — CLOSED / VALIDATED

PR P6D: passive TCP/102 MMS capture, PCAP replay and analysis UI #122 validated head 7c8ff874164ae42962339e57fe6fd892cf129b1e — exact-head workflows 11/11 SUCCESS.
Merge 13abb65d845d297fe8811d0f99c490ad275cd4c8 — head→merge 0 changed files.
Post-merge workflows 10/10 SUCCESS, including Security/Evidence ASan+UBSan, Qt, C++ CI, and Windows/Linux release hardening.
Immutable baseline baseline/ux-p6d-validated -> 13abb65d845d297fe8811d0f99c490ad275cd4c8.

Scope: passive IPv4 TCP/102, bounded TCP/TPKT/COTP/Session/MMS reassembly, request/response invoke correlation, InformationReport classification, classic Ethernet PCAP import, and GOOSE/MMS Sniffer tabs. Linux AF_PACKET and Windows dynamically loaded Npcap capture; no client association or packet injection.

Explicit limitations: IPv6, fragmented IPv4 defragmentation, arbitrary PCAPNG, and exhaustive semantic decoding are not claimed. Real physical IED traffic remains a separate live-site acceptance test.

P6E must descend from this exact baseline; do not regress P6A–P6D or static dataset-only reporting.

P6 closeout — A–E CLOSED / CI-VALIDATED

Phase	PR	Immutable merge/baseline
P6A — Browser Global Data	#119	`baseline/ux-p6a-validated`
P6B — Browser Control UX	#120	`baseline/ux-p6b-validated`
P6C — Dynamic DataSet + Report Authoring	#121	`baseline/ux-p6c-validated` -> `6e091411e0e9e9633364d15c62a41347bcc6b666`
P6D — Real Passive MMS Sniffer	#122	`baseline/ux-p6d-validated` -> `13abb65d845d297fe8811d0f99c490ad275cd4c8`
P6E — Multi-IED workspaces	#123	`baseline/ux-p6e-validated` -> `de8ba6e32f1e21effffc967f9f04b82d457f8451`

P6E exact-head ca51539199feefbf12bfe4c79b876af88e904c6d: 9/9 PR workflows SUCCESS and 2/2 push workflows SUCCESS. Merge de8ba6e32f1e21effffc967f9f04b82d457f8451; head->merge 0 changed files; 11/11 post-merge workflows SUCCESS. Behavioral QA proves isolated slot controllers/context, SCL fork and endpoint provenance, bounded 8 slots, invalid-index/capacity guard, tab switching and offline-only close. Existing static report-only and passive Sniffer boundaries remain.

This closes the implementation + CI/simulator milestone, not physical-device/field acceptance. That follow-up is tracked separately in #124. Do not claim full IEDScout field parity, exhaustive passive MMS decode, or authorized control/report success on physical IEDs without field evidence.

Navigation Menu

Repository navigation

P6: IEDScout interaction parity — Global Data, Control, dynamic services, MMS sniff, multi-IED #118

P6A — Browser Global Data / Activity Monitor

Later P6 phases

P6A — Browser Global Data / Activity Monitor (STARTED)

P6B acceptance contract — Browser IEC 61850 Control UX

Authority / ownership

UX / safety

Regression boundaries

P6A closeout — CLOSED / VALIDATED

P6B — Browser IEC 61850 Control UX (STARTED)

P6B implementation candidate ready — certification pending

P6B closeout — CLOSED / VALIDATED

P6C — Dynamic DataSet + Advanced Report Authoring (STARTED)

P6D acceptance contract — Real Passive MMS Sniffer (pre-implementation audit)

P6C merge / P6D acceptance checkpoint

P6C CLOSED / VALIDATED

P6D closeout — CLOSED / VALIDATED

P6 closeout — A–E CLOSED / CI-VALIDATED

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

P6: IEDScout interaction parity — Global Data, Control, dynamic services, MMS sniff, multi-IED #118

Description

P6A — Browser Global Data / Activity Monitor

Later P6 phases

Activity

masarray commented on Sep 21, 2026

P6A — Browser Global Data / Activity Monitor (STARTED)

masarray commented on Sep 21, 2026

P6B acceptance contract — Browser IEC 61850 Control UX

Authority / ownership

UX / safety

Regression boundaries

masarray commented on Sep 21, 2026

P6A closeout — CLOSED / VALIDATED

masarray commented on Sep 21, 2026

P6B — Browser IEC 61850 Control UX (STARTED)

masarray commented on Sep 21, 2026

P6B implementation candidate ready — certification pending

masarray commented on Sep 21, 2026

P6B closeout — CLOSED / VALIDATED

masarray commented on Sep 21, 2026

P6C — Dynamic DataSet + Advanced Report Authoring (STARTED)

masarray commented on Sep 23, 2026

P6D acceptance contract — Real Passive MMS Sniffer (pre-implementation audit)

masarray commented on Sep 23, 2026

P6C merge / P6D acceptance checkpoint

masarray commented on Sep 23, 2026

P6C CLOSED / VALIDATED

masarray commented on Sep 23, 2026

P6D closeout — CLOSED / VALIDATED

masarray commented on Sep 26, 2026

P6 closeout — A–E CLOSED / CI-VALIDATED

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions