fix: 2026-07-30 audit pass — diagnostic-frame routing, E2E gap re-sync, spec/doc drift, HARA ASIL correction - #39
Merged
Conversation
…c, spec/doc drift, HARA ASIL correction Applies the x-Net audit findings confirmed genuine for this repo: - rust-LIN-01 (Critical): Bus::publish hardcoded Enhanced checksum, but validate_frame rejects diagnostic frames (0x3C/0x3D) not using Classic per ISO 17987 / RELAY §15.3, making diagnostics unreachable through the documented trait API. publish_with_type now auto-selects Classic for 0x3C/0x3D regardless of caller-requested type. Added an end-to-end round-trip regression test through send_header. - rust-LIN-03: RELAY spec target was declared v1.11; the governing spec is v2.0. Updated SPEC_VERSION/RELAY_SPEC_VERSION and doc references. Consequently fixed a CI smoke-test assertion in ci.yml that hardcoded the old spec_version string and would have failed post-bump. - rust-LIN-06/07/08: safety-artifact version headers (BOUNDARY_DIAGRAM, SAFETY_MANUAL, SAFETY_PLAN, safety-case, DO178C_ALIGNMENT) and test/ requirement counts were stale (pinned to v0.2.0 / 94 reqs / 140 tests) against the actual v0.4.1 / 99 reqs / 155 tests. Corrected, with the new baseline recorded as its own version-history entry rather than overwriting history. - rust-LIN-09: Receiver::unwrap advanced last_seq on a detected sequence gap before returning the error, so only the first out-of-order frame in a burst was reported and subsequent frames silently re-synced. Removed the advance so every gap is reported until a frame that is genuinely last_seq+1 arrives. - rust-LIN-10: CLI send/subscribe each construct an independent in-process VirtualBus and cannot round-trip across two processes. Documented the limitation in the README quickstart instead of implying they pair up. - rust-LIN-11: `convert` wrote the non-spec sentinel `INVALID_ARGUMENT` to stderr on invalid input; RELAY §11.2 requires the actual sentinel name. Now emits `ErrInvalidFrame`. - rust-LIN-N2-01: .fusa-hara.json blanket-assigned ASIL-B to all twelve hazards regardless of S/E/C. Independently re-derived each hazard's ASIL from ISO 26262-3:2018 Table 4 (not from any project tool's own output) and confirmed the corrected values: several compute to QM, the rest to ASIL-A — none reach ASIL-B. This creates a real, unresolved contradiction with the project's ASIL-B SEOOC claim; flagged explicitly in safety-case.md rather than silently changed, since resolving it is a safety-engineer classification decision, not a mechanical edit. Not applied (advisory, no diff / requires broader design work, per the audit register): rust-LIN-02, -04, -05, -12, -N2-02. Version bumped 0.4.1 -> 0.4.2 (bugfix + doc-drift release; no public API break) with matching updates to the safety-artifact version headers this same change set just corrected, to avoid reintroducing the drift. Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Applies the externally-generated x-Net audit fixes for rust-LIN confirmed genuine after independent review (diff-by-diff cross-check against the findings, own build/test, and independent re-derivation of the ASIL question against ISO 26262-3:2018 Table 4).
Bus::publishhardcoded Enhanced checksum, butvalidate_framerequires Classic for diagnostic frames (0x3C/0x3D) per ISO 17987 / RELAY §15.3 — diagnostics were unreachable through the documented API.publish_with_typenow auto-selects Classic for 0x3C/0x3D. Added an end-to-end regression test.SPEC_VERSION/RELAY_SPEC_VERSIONbumped 1.11 → 2.0 to match the governing spec, plus doc references. Also fixed a CI smoke-test assertion (ci.yml) that hardcoded the old value and would have broken post-bump.Receiver::unwrapadvancedlast_seqon a detected sequence gap before returning the error, so only the first out-of-order frame in a burst was reported. Fixed to report every gap.send/subscribeeach use an independent in-process bus and cannot round-trip across processes.convertnow emits the real RELAY sentinelErrInvalidFrameinstead of the non-specINVALID_ARGUMENT..fusa-hara.jsonblanket-assigned ASIL-B to all 12 hazards. Independently re-derived every hazard against ISO 26262-3:2018 Table 4 (not the project's own tooling) — confirmed max per-hazard ASIL is A. This creates a real contradiction with the project's ASIL-B SEOOC claim; flagged explicitly insafety-case.mdas an open safety-case item rather than silently resolved, since choosing between downgrading the classification vs. re-justifying the HARA risk parameters is a safety-engineer decision.Not applied (advisory / no diff / broader design work, per the audit register): rust-LIN-02, -04, -05, -12, -N2-02. Left open.
Version bumped 0.4.1 → 0.4.2 (bugfix + doc-drift release, no public API break).
Test plan
cargo build --all-targetscargo test— 156 tests (108 unit + 46 integration + 2 doc), 0 failedcargo clippy --all-targets -- -D warnings— cleancargo fmt --check— cleancargo build --release --bin rust-lin --locked+ reproduced the CI smoke-test script locallyrelay conform --strictandrelay interop(LIN vectors) reproduced locally with the pinnedrelay@v1.11.0CLI — both pass