fix(gate): W1 wipe-misfire — tri-state sm_ dispatch (STAGED, donor-gated)#1
Open
LxveAce wants to merge 1 commit into
Open
fix(gate): W1 wipe-misfire — tri-state sm_ dispatch (STAGED, donor-gated)#1LxveAce wants to merge 1 commit into
LxveAce wants to merge 1 commit into
Conversation
…m_wipe reaches the wipe flow Audit DEADMANS-AUDIT-2026-07-12 GateInput_serial.cpp:313: the caller overloaded processCommand()'s bool return so BOTH a deliberate sm_wipe AND any unrecognized sm_ line returned false, then routed false unconditionally into the authenticated wipe prompt (p="wipe"). A typo (sm_reboot), an unknown/future command, or a mangled keyword (sm_wipe\t, sm_wipex) therefore dropped the operator into the wipe prompt; entering the correct password there fired an irreversible wipe (SPEC 6.1 violation: unrecognized SM_ must be a deferred error reply, never a password attempt, never wipe). Fix: extract the classification into a pure, Arduino-free header (SmCommand.h: classifySmCommand + smDispatch) and return a TRI-STATE (Handled | WipeRequest | Unknown). ONLY a clean sm_wipe maps to WipeRequest; an unrecognized sm_ line is Unknown -> the caller emits an error and re-prompts, never wipes, never counts an attempt. Behaviour-preserving for every recognized command. Verify: - SmCommand.h + native test compile clean + warning-free under the ESP32 xtensa g++ (-fsyntax-only -Wall -Wextra -std=c++17). - New host test firmware/test_harness/native/test_sm_command.cpp asserts the full table + the single safety invariant (no input other than a clean sm_wipe yields WipeRequest); wired into CI (.github/workflows/native-tests.yml, runs on every push under host g++ -Werror). - HELD for the owner's donor board: the on-board wipe-trigger validation (real sm_wipe+password still wipes; sm_reboot now re-prompts and never wipes). Not merged to master until donor-validated. - Full-firmware link stage stays the known WIP RED (build.yml, unrelated to this change).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
W1 wipe-misfire fix (audit DEADMANS-AUDIT-2026-07-12 §GateInput_serial.cpp:313)
Bug: the caller overloaded
processCommand()'sboolreturn so BOTH a deliberatesm_wipeAND any unrecognizedsm_line returnedfalse, then routedfalseunconditionally into the authenticated wipe prompt (p="wipe"). A typo (sm_reboot), an unknown/future command, or a mangled keyword (sm_wipe\t,sm_wipex) dropped the operator into the wipe prompt; entering the correct password there fired an irreversible wipe. SPEC §6.1 violation.Fix: extract classification into a pure, Arduino-free header (
SmCommand.h) returning a tri-state (Handled | WipeRequest | Unknown). ONLY a cleansm_wipemaps toWipeRequest; an unrecognizedsm_line isUnknown→ the caller emits an error and re-prompts, never wipes, never counts an attempt. Behaviour-preserving for every recognized command.Verification
SmCommand.h+ native test compile clean + warning-free under the ESP32 xtensa g++ (-fsyntax-only -Wall -Wextra -std=c++17), local.firmware/test_harness/native/test_sm_command.cppasserts the full table + the single safety invariant (no input other than a cleansm_wipeyieldsWipeRequest); wired into CI (native-tests.yml, host g++-Werror) — this PR runs it.build.yml, unrelated to this change).⚠ DO NOT MERGE until donor-validated
Per the standing irreversibility gate: the on-board wipe-trigger validation (confirm real
sm_wipe+password still wipes; confirmsm_rebootnow re-prompts and never wipes) is HELD for the owner's donor board (not yet arrived). This PR is staged for review + CI, not for merge to master.