Phase 4D-C5: add guarded live IEC 61850 control interoperability harness - #30

Scope

Stacked on Phase 4D-C4. Add the laboratory interoperability harness and retained-evidence procedure needed to move guarded IEC 61850 control from software parity to controlled live-IED validation. Sampled Values / ESP32-P4 work remains out of scope.

Guarded live harness

• adds tools/control_interop_probe.cpp
• read-only discovery is the default and performs no control Write
• live Write requires exact --arm IEC61850-LAB-CONTROL
• requires an explicit control object, action and value before arming
• supports Direct/SBO normal and enhanced paths through the C4 production MmsAssociationControlTransport
• supports explicit operate, select-operate, and select-cancel laboratory actions
• discovers live ctlModel, exact GVAA/TypeSpecification, CF timeouts and ST/MX status before control
• accepts typed SPC/DPC/integer/unsigned/floating/step values conservatively
• exposes origin category/identifier, Test and the two Check bits
• supports a bounded enhanced CommandTermination timeout
• never performs automatic command retry

Discovery companions

• adds a read-only control inventory probe for unknown IED models
• adds a read-only raw ctlModel diagnostic probe
• both diagnostics have no control Write path
• raw ctlModel evidence distinguishes actual status-only values from decoder/representation gaps

Evidence

• wraps the production control transport and records every MMS control Write reference
• emits NO_RETRY_EVIDENCE on stdout
• optional JSON evidence records endpoint, object, ctlModel, CDC, status before/after, control Write count/list, report observation counts, completion, raw ControlError/AddCause and mapped AddCause
• prints a Wireshark filter hint so JSON evidence can be reconciled with retained PCAP/PCAPNG

Safety / usability

• unarmed control action is rejected before network execution
• offline --self-test proves read-only default + arm gate + no-auto-retry contract
• standalone CMake profile builds the harness without enabling the rest of the tool suite
• scripts/build_control_interop.ps1 provides a one-command Windows/MSVC build + CTest path
• dedicated CI publishes the tested Linux binaries and Windows .exe together with the self-test/help contract

Documentation truth synchronized

• PORT_STATUS.md advances the current milestone to C5
• MIGRATION_CHECKLIST.md reflects implemented BRCB R1-R3 and Control C1-C5
• MIGRATION_PLAN.md identifies C5 laboratory evidence as the current acceptance phase
• docs/FEATURE_MATRIX.md classifies Direct/SBO/enhanced control as software-ready for lab
• docs/CONTROL_INTEROP_RUNBOOK.md defines build, Wireshark, per-ctlModel test order, expected Write counts, negative paths and retained evidence bundle
• docs/CONTROL_INTEROP_ACCEPTANCE.md records the completed live simulator matrix and claim boundary

Live simulator acceptance — completed 2026-08-11

Tested profile:

• vendor IEC 61850 simulator profile: BCU7SL
• endpoint: 192.168.1.10:102
• object: BCU7SLCTRL/CSWI1.Pos
• discovered CDC: SPC
• live ctlVal: Boolean
• status: BCU7SLCTRL/CSWI1$ST$Pos$stVal

Acceptance matrix:

Additional evidence:

• live TypeSpecification rejected an incorrect DPC value before a valid control sequence could be issued to the SPC/Boolean object
• a rejected SBO-enhanced SBOw stopped after exactly one Write; no Oper and no automatic retry followed
• Direct and SBO enhanced successful commands completed on positive correlated CommandTermination
• normal-security commands completed at accepted MMS service boundary, without inventing a CommandTermination requirement

Specific tested profile state: SIMULATOR_INTEROP_PASSED.

Full evidence summary and local JSON filenames are recorded in docs/CONTROL_INTEROP_ACCEPTANCE.md.

Validation

Dedicated Control Interop Harness CI builds and runs the offline safety gate on GCC, Clang and Windows/MSVC. The normal repository C++/Security/Embedded/BRCB/URCB gates remain required on the final head.

Remaining acceptance boundary

This PR does not claim IEC 61850 conformance certification or physical-relay/primary-plant acceptance. Simulator interoperability has now been demonstrated for all four control models on the tested BCU7SL profile, but separate retained evidence is still required for any physical IED profile, broader vendor matrix, association-loss matrix, and exhaustive negative LastApplError/AddCause coverage.