test: cover packet policy coercion on excluded builds

[RCGV1]

Summary

• expect the effective Compatible policy when PKI or XEdDSA is compiled out
• retain the Strict round-trip assertion for capable builds

Validation

• ./bin/test-native-docker.sh -f test_admin_session_repro — 25 test cases succeeded
• git diff --check

Follow-up to #11134 to address its CodeRabbit review finding. No hardware verification performed; this is a native configuration-path test.

Summary by CodeRabbit

• Tests
  • Updated security configuration validation to verify the device applies the expected packet signature policy under different build configurations.
  • Added checks for compatible and strict policy behavior based on available security features.

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

📝 Walkthrough

Walkthrough

The local security-config Unity test now validates packet_signature_policy against build-time security feature constraints and runs through its renamed test function.

Changes

Packet signature policy tests

Layer / File(s)	Summary
Update policy assertion and test wiring test/test_admin_session_repro/test_main.cpp	The test is renamed to describe policy application, expects COMPATIBLE when PKI or XEdDSA is excluded and STRICT otherwise, and is invoked by setup().

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• meshtastic/firmware#10967: Implements related packet authenticity policy behavior under excluded PKI or XEdDSA builds.
• meshtastic/firmware#11134: Updates related packet signature policy expectations in the same Unity test.

Suggested labels: enhancement

Suggested reviewers: caveman99

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: enforcing packet policy behavior on builds that exclude PKI/XEdDSA.
Description check	✅ Passed	The description includes a clear summary, validation steps, and notes that no hardware verification was performed.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚡ Try this PR in the Web Flasher

Warning

This is an automated, unreviewed CI test build. Back up your device configuration
before flashing, and only flash devices you are able to recover.

Supported boards built by this PR (30)

	Device	Board	Platform
	Crowpanel Adv 3.5 TFT	elecrow-adv-35-tft	esp32-s3
	Heltec HT62	heltec-ht62-esp32c3-sx1262	esp32-c3
	Heltec Mesh Node 096	heltec-mesh-node-t096	nrf52840
	Heltec Mesh Node T1	heltec-mesh-node-t1	nrf52840
	Heltec Mesh Node T114	heltec-mesh-node-t114	nrf52840
	Heltec V3	heltec-v3	esp32-s3
	Heltec V4	heltec-v4	esp32-s3
	Meshnology W10	meshnology_w10	esp32-s3
	Raspberry Pi Pico	pico	rp2040
	Raspberry Pi Pico W	picow	rp2040
	RAK WisMesh Pocket V3	rak_wismesh_pocket	nrf52840
	RAK WisMesh Pod	rak_wismesh_pod	nrf52840
	RAK WisMesh Repeater Mini V2	rak_wismesh_repeater_mini	nrf52840
	RAK WisMesh Tag	rak_wismeshtag	nrf52840
	RAK WisBlock 11200	rak11200	esp32
	RAK WisBlock 11310	rak11310	rp2040
	RAK3312	rak3312	esp32-s3
	RAK WisBlock 4631	rak4631	nrf52840
	Seeed SenseCAP Mesh-Tracker-X1	seeed_mesh_tracker_X1	nrf52840
	Seeed Wio Tracker L1	seeed_wio_tracker_L1	nrf52840
	Seeed Xiao NRF52840 Kit	seeed_xiao_nrf52840_kit	nrf52840
	Seeed Xiao ESP32-S3	seeed-xiao-s3	esp32-s3
	Station G2	station-g2	esp32-s3
	Station G3	station-g3	esp32-s3
	LILYGO T-Deck	t-deck-tft	esp32-s3
	LILYGO T-Echo	t-echo	nrf52840
	LILYGO T-Echo Plus	t-echo-plus	nrf52840
	LILYGO T-Impulse Plus	t-impulse-plus	nrf52840
	LilyGo T3-C6	tlora-c6	esp32-c6
	Seeed SenseCAP T1000-E	tracker-t1000-e	nrf52840

Build artifacts expire on 2026-08-21. Updated for 8acb7fe.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/test_admin_session_repro/test_main.cpp`:
- Line 680: Move the test_local_security_config_applies_packet_signature_policy
registration outside the `#if` !(MESHTASTIC_EXCLUDE_PKI) guard so it executes when
PKI is excluded, while preserving any fixture or setup requirements that must
remain PKI-specific.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4df2a139-ecbf-463f-88ef-50b0f3750beb

📥 Commits

Reviewing files that changed from the base of the PR and between 1804fd1 and 8acb7fe.

📒 Files selected for processing (1)

• test/test_admin_session_repro/test_main.cpp