Repository navigation
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 29a3630825
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const bool resume_certified = | ||
| smp_synch_source_local_qualified() || | ||
| g_parked_source_clock_certified.load(std::memory_order_acquire); |
There was a problem hiding this comment.
If a certified clock is parked and PROFILE SMPSYNCH 1 followed by PROFILE SMPSYNCH AUTO arrives before the publisher's next 200-ms idle check, smp_synch_lab_set_mode() clears the existing SOURCE qualification but never clears this new latch. The timer and PTP lease remain unchanged, so START accepts the cached certificate and restores qualification without fresh MAC evidence, defeating the existing fail-closed mode-change behavior tested in test_smp_synch_policy.cpp. Checking only the current AUTO mode cannot detect this intervening invalidation. Tie parked certification to the shared qualification invalidation path or a policy generation so a revoked certificate cannot be resurrected.
AGENTS.md reference: AGENTS.md:L30-L30
Useful? React with 👍 / 👎.
…nous SV STOP/START
… sample-clock servo
…ured SV phase evidence
…ots simulated Global GM
…y is not runtime AUTO opt-in
…ERNAL_GM_ONLY default
…quire internal GM SOURCE
Field regression
ESP32-P4 laboratory PTP GM and SV stream initially report synchronized, but an SV-only STOP/START causes NOT SYNC although PTP/4-kHz sample timebase should remain active.
Root cause
The prior M3.A–D implementation parks the GPTimer but resets canonical MAC descriptor evidence at each SV START. Warm resume relies only on the instantaneous source sync flag and does not persist the previously measured sample-clock certification as a property of the parked timebase. At a STOP boundary it can be revoked and the next START is treated as cold acquisition. IEC 61850-9-2 synchronization status describes sampling relative to the synchronizing time source, not the mere SV publisher running state.
Fix
SvParkedClockAuthoritypreservation/resume policy requiring old measured SOURCE certification, same PTP lease/generation, uninterrupted GPTimer/profile, accepted 1Hz phase, fresh phase observation, and AUTO mode.smpSynch=2; the bench simulated Global GM authorization remains separately gated.Acceptance not yet established
Green CI != physical FAT. Need matched ESP32-P4 firmware + Windows preview and a PCAP of 100 STOP/START with stable
smpSynch=2, PTP announce/source identity, continuous sampling phase and SIPROTEC 5 acceptance. No merge to main/checkpoints.\n### Extra PTP root cause found during source audit\nThe old firmware incrementedg_ptp_source_generationon every PTP TX readiness recovery, even though the IEEE1588 EMAC hardware clock never restarted. The resulting fake lease/GM change caused the 4-kHz phase observer to invalidate a still-continuous clock. Generation is now incremented once when the SOURCE hardware timebase successfully starts, not when Announce/Sync transmission health returns. Actual PTP TX failure still revokes READY; this patch does NOT mask faults or force GLOBAL. CI source guard prevents recurrence.\nM3.E integration hardening (commit 4412e19)
RUNNING || PREFLIGHTand revoked a still-owned GPTimer/EMAC clock while the publisher was transitioning. Now steering is authorized only from the actual owned GPTimer + unchanged PTP lease + valid phase/fault/session + AUTO mode, independent of those toggles.RUNNING=trueis set before the PTP-second ISR turns on SV publisher notifications. Live MAC requalification is now keyed to that real ISR notification gate, so a dry sample grid cannot be misclassified as a missing SV stream.CONFIG_AR_PTP_BOOT_SIMULATED_GLOBAL_GM=yin compiledsdkconfig; manifest includesbootSimulatedGlobalGmEnabled,bootSourceAutostartEnabled, andglobalGmTraceabilityPhysicallyProven=false. Windows packaging explicitly refuses firmware without these true Global GM simulation and phase/MAC evidence gates.