[w5jwp]

Merge order for the PGXL / 4O3A PRs (the same map is in each of them; #6030 has merged):

Stage 1:
  #6008  authenticate TGXL, PGXL and Antenna Genius
Stage 2 (either order, after what each needs):
  #6027  Peripherals settings UI          needs #6008
  #6033  PGXL drain current (ID meter)    needs #6008
Stage 3:
  #6036  PGXL docked layout               needs #6008 and #6033

Summary

Fixes #2313. Authenticate TGXL, PGXL, and Antenna Genius direct TCP sessions when a device's greeting requests AUTH; keep ordinary commands gated until the device accepts the code. Use the existing manual host/port fields in Setup → Peripherals and restore distinct, endpoint-bound codes from QtKeychain on reconnect. Builds without QtKeychain retain a code for the current session only. Keep TGXL/PGXL radio-relay fallback available when the direct path cannot authenticate, and show the actual connection path in the accessory applets.

Target main at v26.9.5. This branch started at the preceding commit; the sole overlapping release file is CMakeLists.txt, and this branch's CMake change applies cleanly to the release version. docs/PR-WORKFLOW.md does not require a rebase for a stale PR branch.

The auth command and success-reply forms are device-specific. A live probe confirmed TGXL and PGXL forms on the firmware listed in docs/4o3a-remote-auth-hardware-evidence.md; the AG syntax follows 4O3A's public API documentation and uses CRLF, which the contributor capture confirms reaches the AG auth parser. New code is saved only after an AUTH success reply. A code typed for another target, rejected, or never challenged cannot silently replace a working saved code.

Implementation details

• Gate the TGXL, PGXL, and AG initialization/status paths on AUTH completion; reject malformed/oversized lines and invalid code characters before constructing a line-oriented command.
• Keep one Keychain record per device type with the accepted IP/port and code together. Never write a new plaintext password field into AppSettings; retain the existing manual IP/port settings. A Keychain read failure stays visible, and a failed Clear operation does not claim the code was deleted.
• Bound authentication attempts and suppress automatic retries after a blocking failure. Manual AG/ShackSwitch retries reset only the selected target's failure budget. An attempt token ignores late Keychain replies from an abandoned connection.
• Redact credentials from PGXL setup logging, sensitive automation text extraction, and UI grabs. Register the new auth logging category and add focused socket-free credential, handshake, automation, and applet coverage.
• Regenerate the aetherd touchpoint manifest for the new peripheral validation header; add the credential-store source to the desktop-support target. The new GUI→engine validator touchpoint keeps one input rule in the Keychain adapter and TCP clients before a line-oriented command is built. The manifest's AppSettings includer count grows by one for the session-only credential fallback in the Keychain adapter. ThemeManager grows by one because the extracted dialog connect-flow header uses the same token-based error style as the dialog; that header exposes a socket-free regression seam for target-switch ordering.
• Add tools/probe_4o3a_auth.py, a permanent one-shot, non-TX hardware handshake probe; it prompts for the code without echo and records no credentials.

Constitution principle honored

• Principle IV — Every Contribution Is Clean-Room: the TGXL and PGXL handshake code is grounded in a redacted live probe and published 4O3A documents; AG follows the published 4O3A API plus the contributor capture cited below. No proprietary binary was disassembled or translated.
• Principle V — Each Feature Owns Its Configuration As A Single Object: no new flat AppSettings credential writes were added. Existing manual connection settings remain as they were; each stored credential is a single Keychain record for its device type, bound to the hostname and port the operator typed, or to the connected peer IP and port for a literal address.
• Principle VII — Untrusted Input Is Validated At The Boundary: codes are checked before being interpolated into commands, incoming line buffers are bounded, and malformed/failed AUTH replies do not make a direct connection available.
• Principles VIII and XI — Evidence Over Assertion / Fixes Are Demonstrated: the probe output, focused tests, and the pre-change Tune routing record are in docs/4o3a-remote-auth-hardware-evidence.md. The report separates observed hardware behavior from test-only and still-unverified behavior; CI and operator confirmation remain gates after submission.

UI Changes

• Setup → Peripherals, TGXL/PGXL/AG rows: added separate masked Authorization code fields, Show/Hide buttons, Clear code buttons, endpoint-specific reuse/session-only placeholder text, and screen-reader names and descriptions. A blank field reuses the matching saved code when an AUTH greeting arrives; a new accepted code replaces that device type's saved record.
• Setup status cells: show connecting, rejected/required code, Keychain deletion failure, and session-only save warnings. They distinguish an unchallenged connection (code not saved) from a code discarded before verification, and clear stale errors after a recovered connection. The AG and ShackSwitch rows display their own connection errors.
• TGXL applet: added a bottom-right ● DIRECT / ● RADIO / ● OFFLINE indicator in docked and floating layouts. DIRECT uses the theme success color, RADIO the warning color, and OFFLINE the disabled-text color. A blocked direct-connection reason appears in the tooltip and accessible description, and clears on manual retry or successful direct connection.
• PGXL applet: moved its connection indicator below the controls to the same bottom-right placement and control-to-indicator spacing as TGXL. It uses the same three states, colors, tooltip, and accessibility behavior; RADIO requires a connected radio and PGXL relay handle.
• Antenna Genius applet: added a bottom-right ● DIRECT / ● OFFLINE indicator with success/disabled theme colors and accessible text. It remains OFFLINE before a direct AG connection; the shared ShackSwitch model does not make it display DIRECT.
• Setup layout: each device keeps address/port/connect on its first line, authorization controls on the next, and wrapped status across the available width. Clear code and errors fit at the default 960×680 size without horizontal scrolling. ShackSwitch Web UI occupies its own line; its authentication errors are named as ShackSwitch in the main status bar.
• Automation-visible UI: masked the code field's value and its grab output so remote automation does not expose a shown code.

Maintainer rulings: the central Peripherals tab (rather than per-applet fields), the compact Setup layout, the applet source indicators, and credential binding (configured host+port for names, peer IP+port for literal addresses) are accepted as built. So is a saved manual host taking precedence over the radio-reported endpoint, with the fallback described under Automatic connection behavior.

Test plan

• Local build passes (cmake --build build --parallel 6) on macOS 27.0/arm64 using the branch's 26.9.4 source snapshot.
• Behavior verified on a real radio if applicable — a prior operator Tune action showed the FlexRadio accepting a relayed TGXL autotune command; a full in-app saved-code restore has not yet been observed.
• Existing tests pass (CI) — rerun required for the latest review-fix commit.
• Reproduction steps documented for the pre-change direct-TGXL Tune routing problem in docs/4o3a-remote-auth-hardware-evidence.md.

Earlier submission verification: 37 passed, 1 skipped across the peripheral auth dialog, handshake, and Keychain tests; automation redaction tests; TGXL/PGXL applet tests; and AppSettings safety scenarios. pgxl_panel_test skipped because this sandbox could not bind loopback; its result is not a pass claim. PR-REVIEW preflight identified that the earlier dialog regression clicked Connect against reserved IPs and opened outbound QTcpSockets. That check now uses an injected callback at the production connect-ordering seam and its focused test passes socket-free. A mutation that kept the old pending flag set during the callback made the revised test fail; restoring the fix made it pass. The modified pgxl_panel_test is an existing default-graph loopback QTcpServer test; it was not rerun during this review after operator notification. Its bind failure returns 77. git diff --check, test registration, the aetherd touchpoint manifest, engine-boundary, capability-record, and command-plane baselines completed with no new blocker; the accessibility scan reports existing warning-only findings. An isolated, TX-disabled offscreen app launched, but its automation bridge did not expose a socket, so no demo GUI claim is based on bridge output.

Live evidence and limits: the one-command TGXL and PGXL probes received accepted AUTH replies on firmware 1.2.17 and 3.9.1, respectively. A later app build established direct TCP sockets and showed bidirectional traffic, but that socket snapshot did not capture the in-app AUTH exchange. AG hardware AUTH and the full in-app Keychain restore/clear cycle remain unverified.

Checklist

• Commits are signed (docs/COMMIT-SIGNING.md) — feature commit 120ed439 has a locally verified SSH signature registered to w5jwp.
• No new flat-key AppSettings calls — existing manual IP/port keys are reused and credentials use endpoint-bound Keychain records (Principle V).
• Code is clean-room — vendor/public API documents and observed wire behavior, with no decompiled or disassembled proprietary code (Principle IV).
• All meter UI uses MeterSmoother — not applicable to this PR; it changes connection labels/layout, with no new meter data or smoothing path.
• Documentation updated for user-visible behavior in docs/4o3a-remote-auth-hardware-evidence.md; CHANGELOG.md remains untouched.
• Security-sensitive changes reference a GHSA if applicable — no GHSA applies to this feature request.

Review routing: source/tests/docs need Tier-3 code-owner review; CMakeLists.txt needs Tier-2 infrastructure review. The issue carries maintainer-review, and the UI/UX decisions above need the project maintainer's approval. The required issue-claim attempt was rejected by GitHub because w5jwp lacks upstream assignment permission; no placeholder assignee was created.

Current review dispositions

• TGXL/PGXL socket-free regression coverage now enables automatic reconnect at a nonempty target and asserts that the named reconnect timers stop after explicit AUTH rejection or three timeouts/handshake disconnects. Late disconnect/error delivery must not re-arm them.
• AG requires sequence 1, zero result, and an omitted/empty or exactly OK body. Unknown/rejection bodies and extra fields cannot accept a credential. The test writer is private test-access plumbing; the production constructor accepts only its QObject parent.
• The contributor capture on #2313 reports V<version> AG AUTH\n, LF from the vendor utility, and CRLF from AetherSDR reaching the auth parser. AUTH now uses CRLF. The report also says the utility silently truncates passwords to eight characters; operators must enter the actual device code. AetherSDR does not silently truncate passwords. This is attributed contributor evidence, not a new successful AG hardware test; the report names no firmware version.
• Failed Keychain deletion retains the cache; a completed older deletion cannot erase a newer save. AG retry history ignores empty targets and is bounded to 128 targets without evicting existing blocks.
• The earlier six CodeGuard advisories concern a protocol comment and unchanged MainWindow code; they do not identify a new path operation requiring a fix.

Automatic connection behavior: saved TGXL/PGXL manual host/port settings take precedence over radio-discovered endpoints. Loss of radio-reported accessory presence does not disconnect the direct session while a manual override is configured. This also affects LAN users with a saved override; clearing it restores discovered-address selection. When an automatic connect (discovery, presence, startup, or their reconnects) to the saved address never reaches the device over TCP, the app tries the radio-reported address once, on the default port, as an alternate attempt. Reconnects keep aiming at the saved host, a code saved for the saved host is never sent to the alternate address, and a missing code there fails that try without blocking reconnects. An explicit Setup → Connect, a deliberate disconnect, or an attempt whose socket connected never triggers it. checkUnreachableAndAlternate in peripheral_auth_handshake_test pins each rule.

Credential identity (907a88e8): a saved code is bound to the name the operator typed. A hostname (typically DDNS) binds the lowercased name and port, so a change of the residential IP behind it no longer asks for the code again, which is the main remote use case of #2313. A literal IP binds the connected peer IP and port, as before. Nothing binds until a socket has a real peer address, and a different name, port, or a literal IP is a different identity, so a code saved for one is never offered to another. The trade is deliberate: whatever the name resolves to receives the saved code, so a code should only be saved for a name the operator controls; the store header and docs/4o3a-remote-auth-hardware-evidence.md say so. A code saved earlier for a hostname was stored in the IP form and is not reused, so those operators enter it once more. Tests cover name equality across IPs, case and whitespace, the empty-peer and zero-port refusals, and that another name, port or literal IP does not match. This was raised as a question on the review; if the maintainer prefers peer-IP-only binding, it reverts by dropping this one commit. Central-tab placement, the compact layout, and applet indicator design still await maintainer direction.

Latest local verification (2026-09-29): the desktop app builds, and all eight focused auth, automation-redaction, TGXL and amp applet tests passed. Mutation checks removed TGXL/PGXL auth-block reconnect guards, reverted AG AUTH to bare CR, and restored the wide Setup table: each failed at its intended regression assertion. All fixes were restored and the eight tests passed again. Test registration, touchpoint manifest, engine-boundary, capability-record, command-plane, colour ratchet, and whitespace checks found no new blocker. No new synthetic device peer, live-hardware, OS-vault, or TX test was introduced or run. The existing loopback pgxl_panel_test was not rerun.

Verification of the credential-identity commit 907a88e8 (2026-09-30): the desktop app builds, and the ten focused tests (peripheral auth dialog, keychain and handshake; automation redaction; TGXL and amp applet) pass. The new handshake-test assertions cover name equality across IPs, case and whitespace, the empty-peer and zero-port refusals, and that another name, port or literal IP does not match. I did not run a mutation check against it, and it has not been tried against a live device or a real DDNS name.

Self-assignment was attempted again; GitHub denied it because w5jwp lacks upstream assignment permission. Review threads are left for the reviewers to resolve.

Review follow-up (2026-10-03)

• A keychain outage no longer blocks auto-reconnect: setAuthCodeForAttempt passes blockReconnect=false when the credential store is unavailable (TGXL, PGXL, Antenna Genius). A rejected or missing code still blocks.
• setup appends authcode= only when setup read contained the authcode key and it was empty. The firmware 3.9.8 R4|50000013| probe result is in docs/4o3a-remote-auth-hardware-evidence.md.
• The PGXL status debug log omits authcode.
• The authcode-omission assertion is a socket-free case in peripheral_auth_handshake_test, through a command-writer seam on PgxlConnection.
• Manual-address fallback: see Automatic connection behavior above.
• Merged origin/main (732b99a9).

[aethersdr-agent]

Issue fit

Partially. #2313 asks for an Auth Code field so TGXL/PGXL/AG can be reached directly over a WAN without a VPN. The TGXL and PGXL halves land that: the greeting's AUTH suffix is detected, the code is sent in the device-specific form the probe observed, and — importantly — the direct path is no longer marked isConnected() before authorization, which also fixes the pre-existing "Tune goes out over an unauthenticated direct socket" routing recorded in the evidence doc. The Antenna Genius half is implemented but, per §"Blockers" below, its reply check accepts the 4O3A family's documented rejection reply as success, so the AG requirement is not safely met yet.

The issue proposed per-applet settings with a Local/Remote toggle; the PR extends the central Peripherals tab instead. That divergence is disclosed and correctly routed to the maintainer.

Scope

File / group	What it changes	Explained by #2313 / PR body	Verdict
src/core/{Tgxl,Pgxl}Connection.{h,cpp}	AUTH state machine, attempt token, failure budget, 64 KiB line bound, authcode= log redaction	yes	in scope
src/models/AntennaGeniusModel.{h,cpp}	AG AUTH, per-target block/budget, hostname connect, prologue extracted to completePrologue()	yes	in scope
src/core/PeripheralAuthCode*.h	code validation + line-oriented command builders	yes	in scope
src/gui/PeripheralAuthStore.{h,cpp}, CMakeLists.txt	QtKeychain adapter, endpoint-bound record, session fallback	yes	in scope
src/gui/RadioSetupDialog.cpp	code field / Show / Clear columns; status-cell states; grid column re-index 4→7	yes	in scope — the column shift is mechanically forced by the three new columns, not a restyle
src/gui/{Tuner,Amp,AntennaGenius,ShackSwitch}Applet.*	new ● DIRECT / ● RADIO / ● OFFLINE indicator; PGXL indicator relocated to match TGXL	yes, and flagged by the author	needs maintainer decision — new user-visible UI + a relocation of a working PGXL indicator. The PR already asks for this ruling; I agree it is the maintainer's call, not a violation
src/AutomationSensitiveLineEdit.h, src/core/AutomationServer.cpp	redact sensitive line edits in dumpTree and in grab	yes	in scope
src/core/SettingsCredentialPolicy.h	six reserved credential names	yes	in scope, and the right table per AGENTS.md
src/core/LogManager.cpp	aether.peripheral.auth category	yes	in scope
docs/4o3a-remote-auth-hardware-evidence.md, touchpoint manifest + tags	evidence, manifest regen (230→231)	yes	in scope; counts are self-consistent
tools/probe_4o3a_auth.py	new one-shot hardware probe	referenced by the evidence doc, not called out as a new permanent tool in the body	in scope, but worth naming — it's new tooling that outlives the PR
.gitignore	third_party/qtkeychain/	yes; scripts/setup/setup-qtkeychain.sh it names already exists on main	in scope
CHANGELOG.md	untouched	—	correct per AGENTS.md

Nothing in the diff is unrelated to the issue. The one genuine judgment call is the applet indicator work, which the author has already routed for a ruling.

Socket tests (disclosure, not a finding)

• peripheral_auth_dialog_test, peripheral_auth_handshake_test, peripheral_auth_keychain_test — all three are socket-free. I read the sources, not tests.cmake: the dialog test only clicks Connect on the invalid-code path (which returns before connectFn) and otherwise drives beginAttemptAt / processLine / processTcpBytes through the Q_INVOKABLE seams; the keychain test uses an in-memory QKeychain double via tests/fakes/qt6keychain/. No bind(), listen() or connectToHost() in any of them. All three are registered and run by default.
• pgxl_panel_test — modified, and it is a pre-existing registered loopback QTcpServer test. The PR did not add the socket; it added a tests.cmake comment disclosing the bind, which is the right direction. It skips with 77 on bind failure.
• No fake radio/amp/tuner peer was added. The handshake test injects captured frames, which is the correct layer for this per AGENTS.md ("refusals, malformed or disconnected input… socket-free transport or state-machine injection").

Blockers

1. Antenna Genius treats the vendor family's documented rejection reply as success — inline on src/models/AntennaGeniusModel.cpp:564.

The accept condition is fields[0] == "R1" && result(hex) == 0. The body is never examined. Your own evidence document says, about the sibling device:

The vendor TGXL API document lists R1|0|Unauthorized for a rejected code. Because its numeric result is also zero, the client must check the reply body.

TGXL and PGXL both do exactly that — line == "R0|0|auth OK" || "R1|0|auth OK" and line == "R1|0|Authorized". AG is the one path that does not, despite being the only one of the three with no live handshake observation at all.

Failure scenario (reasoned from code — I have no AG hardware and cannot reproduce it): operator types a wrong or stale AG code → device answers R1|0|Unauthorized → result == 0 → authCodeAccepted fires, completePrologue() runs, m_connected = true, info get is sent on an unauthorized socket, the applet shows ● DIRECT, and the rejected code is written to the keychain, replacing whatever was there. The R1|FF|Denied case the test covers is the one shape this bug does not affect.

I cannot prove AG's firmware uses that exact string — but the safe direction is unambiguous and matches what the other two connections already do. Suggested shape: require a body that is empty or an explicit success token, and treat any other body as a rejection — the mirror of the TGXL check. Whatever form you pick, the AG test at tests/peripheral_auth_handshake_test.cpp:449 currently pins R1|0|OK as accepted, so it will need to move with the fix.

Nits (non-blocking)

• AG prologue gate may never fire on a WAN greeting. AntennaGeniusModel.cpp:516 still requires line.contains("AG"), and the new AUTH branch sits inside it. The only AUTH greeting this PR actually observed is TGXL's V1.2.17 AUTH — which dropped the device token. If AG's WAN greeting does the same (V4.0.22 AUTH), contains("AG") is false, the prologue is never recognised, and the entire AG auth path is dead rather than wrong. The tests all feed V4.0.22 AG AUTH, so they cannot distinguish. Worth confirming against a live AG before this is called done — the PR already lists AG hardware as unverified, so this is a specific thing to look for during that check. (Inline at line 524.)
• peripheralAuthFailureBlocks(int&) (src/core/PeripheralAuthCode.h:10) increments through a reference inside what reads as a predicate, and the member it increments is named m_authTimeouts while onDisconnected also feeds it mid-auth socket closes. It works; the name and the mutating-predicate shape make the three-strike budget harder to audit than it needs to be.
• A failed keychain delete leaves the session cache disagreeing with the vault. PeripheralAuthStore::save() clears g_entries[...] before queuing the DeletePasswordJob, so after a failed Clear the session reports Missing while the OS vault still holds the code and will restore it next launch. The UI does say "retry Clear code", so this is visible rather than silent — but the fail-safe direction would be to roll the cache back on failure.
• authTarget() returns an empty string for an empty host or port 0, and failAuthentication will then m_authBlockedTargets.insert(""), which makes isAuthBlockedFor() true for every other malformed target. Unreachable through the current call sites; cheap to guard.
• m_authTimeoutsByTarget / m_authBlockedTargets grow without bound across discovery churn. Trivial in practice.
• Stale paragraph in the evidence doc. The last paragraph of "Follow-up review checks (2026-09-28)" still says the dialog regression "makes outbound connection attempts to reserved documentation addresses". It no longer does — it uses the injected connect-ordering seam, exactly as the PR body says. Worth correcting so the doc and tests.cmake agree.

Other tools' findings

All six CodeGuard CG-PATH-001 hits are false positives and I am not repeating them as findings. src/core/TgxlConnection.h:19 is a protocol-format comment line (M|<text>\n — alert text), not a path. src/gui/MainWindow.cpp:9549, :9661, :9780-9782 are the pre-existing NR2-wisdom status label and the macOS .app bundle-root walk — none of which this diff touches (the MainWindow hunks are at ~6736–6790). No hardcoded-credential findings were reported, and the diff introduces none that I could find.

What I tried to break

• Accept-a-rejection. Walked each of the three reply parsers against the vendor-documented rejection forms. TGXL's exact-match on R0|0|auth OK / R1|0|auth OK and PGXL's on R1|0|Authorized both survive R1|0|Unauthorized; AG does not. That is the blocker above.
• abort() re-entrancy. failAuthentication clears m_authPending before m_socket.abort(), so the synchronous onDisconnected cannot double-count the attempt as a "closed during authentication" failure, and the !m_reconnectTimer.isActive() guard prevents the double re-arm. connectToTgxl/connectToPgxl correctly wrap the abort in m_deliberateDisconnect and emit disconnected() themselves. This one held on all three paths.
• Late keychain replies to a dead socket. Tried to make a reply from an abandoned attempt authenticate a newer one: ++m_authAttempt in beginAttempt() plus the attempt == m_authAttempt && m_waitingForAuthCode gate in setAuthCodeForAttempt closes it, and PeripheralAuthStore::load holds a QPointer context so a torn-down window drops the callback. Held.
• Carrying a typed code to the wrong host. beginAttemptAt compares the normalised target and discards + signals; sendAuthentication re-checks m_userAuthEndpoint == m_attemptEndpoint for AG; an unchallenged greeting discards an unverified code instead of keeping it. PeripheralAuthStore::endpoint() binds the stored record to the resolved peer IP, not the configured hostname, so a hostname that re-resolves elsewhere will not receive the old code. Held.
• Removed guards. Read the - lines: the only behavioural removals are m_tgxlConn.disconnect() / m_pgxlConn.disconnect() on tuner/amp absence, now skipped when a manual IP is configured. That is required for the WAN case #2313 describes, not a lost guard. No sendCommand() was added, and the unconditional emit connectionFailed removed from TgxlConnection::onError has no consumer on main outside this PR's new wiring — I grepped.
• Credential leakage. widgetValue now routes through automationLineEditValue, the grab mask flips revealed fields to Password for the duration of the capture and restores via QPointer, and sendCommand redacts any authcode= setup write. The mask's double-negative (!sensitive && echoMode == Normal → skip) is correct. No plaintext path into AppSettings — the six reserved names are in SettingsCredentialPolicy.h, which is the authoritative table.
• Could not check: anything at runtime. I have no build, no AG, and no keychain. Every finding above is reasoned from the source in the head checkout plus the PR's own evidence document; none was observed executing. The AG greeting shape and the AG rejection string are the two facts that would settle finding 1 and the first nit, and only live AG hardware can supply them.

CI is green on all five checks at 120ed439 (build, check-macos, check-windows, Static checks, Sanitizer configure). Note that per-PR ctest is -R-filtered, so green does not mean the three new targets ran.

Recommendation

Request changes, on finding 1 alone. The TGXL and PGXL state machines are careful work — the attempt token, the endpoint binding, the "an unchallenged greeting cannot verify a code" rule, and the redaction of the authcode= setup write are all things that are easy to get wrong and are right here. But the AG reply check accepts the one reply shape your own evidence document warns about, and the consequence is not a cosmetic wrong state: it writes a rejected credential to the operator's keychain and shows ● DIRECT on an unauthorized socket. Tighten that check and move the R1|0|OK assertion with it, then this is ready for the maintainer's separate ruling on the indicator UI and the central-tab-vs-per-applet placement, both of which you have correctly flagged rather than assumed.

Thank you for the evidence document in particular — separating "observed on firmware 1.2.17" from "vendor documentation" from "not yet verified" is what made the AG gap findable at all.

---

_{🤖 aethersdr-agent · cost: $10.1235 · model: claude-opus-5}

[aethersdr-agent]

Cisco CodeGuard — static analysis of this PR (6 finding(s))

• [MEDIUM] CG-PATH-001 — Potential path traversal in src/core/TgxlConnection.h /tmp/aetherclaude/pr-6008/src/core/TgxlConnection.h:19
• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6008/src/gui/MainWindow.cpp:9549
• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6008/src/gui/MainWindow.cpp:9661
• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6008/src/gui/MainWindow.cpp:9780
• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6008/src/gui/MainWindow.cpp:9781
• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6008/src/gui/MainWindow.cpp:9782

_{Automated static scan by Cisco DefenseClaw CodeGuard on the changed files. Advisory — some may be false positives; the review above verifies them.}

---

_{🤖 aethersdr-agent · cost: $10.3171 · model: claude-opus-5}

[w5jwp]

@aetherbot Please re-review PR #6008 at commit 80f40fe. The review follow-up fixes AG authorization reply validation, failed Keychain deletion cache handling, and bounded per-target retry tracking, and clarifies the remaining AG hardware and maintainer design checks. Focused handshake, Keychain, and committed-dialog tests passed; four regression guards were mutation-tested. Full dispositions and validation are in the updated PR description. Self-assignment was attempted through both GitHub APIs but denied because w5jwp lacks upstream assignment permission.

[ten9876]

Issue fit

Yes for TGXL and PGXL, likely for AG, with one untested safety behavior. #2313 asks for an authorization code so TGXL, PGXL, and AG can be reached directly over WAN without a VPN. The existing manual IP/port rows already handled the "direct connect" part (per the triage on the issue). This PR adds the missing handshake. On an AUTH greeting, TGXL sends C1|auth <code> and accepts only R0|0|auth OK/R1|0|auth OK. PGXL sends C1|auth code=<code> and accepts only R1|0|Authorized. AG sends C1|auth code=<code> and accepts only R1|0 with an empty or OK body. The code goes to the Keychain only after the device accepts it. The previous review's AG blocker (a zero-result Unauthorized treated as success) is fixed at this head, and a mutation confirms the new negative cases catch it (see below). One requirement from the maintainer triage has no coverage: "Failure → surface error, do not retry" (blocker 1).

The PR puts the fields in the central Peripherals tab rather than per-applet with a Local/Remote toggle. That choice is disclosed and routed to the maintainer, so I am not treating it as a finding.

Scope

File / group	What it changes	Claimed in body?	Verdict
src/core/{Tgxl,Pgxl}Connection.*, src/models/AntennaGeniusModel.*	AUTH state machines, attempt token, failure budget, 64 KiB line cap, per-target AG budget	yes	in scope
src/core/PeripheralAuthCode*.h	code validation + command builders	yes	in scope
src/gui/PeripheralAuthStore.*, PeripheralAuthConnectFlow.h, CMakeLists.txt	Keychain adapter (endpoint-bound record), session-only fallback, connect-ordering seam	yes	in scope
src/gui/RadioSetupDialog.cpp	code / Show / Clear columns; status column 4→7 for every row	yes	in scope; see nit 3 on the resulting width
src/gui/{Tuner,Amp,AntennaGenius,ShackSwitch}Applet.*	new DIRECT/RADIO/OFFLINE indicators; PGXL indicator relocated and recoloured	yes, flagged by author	needs maintainer decision (new UI + change to a working PGXL indicator)
src/gui/MainWindow{,_Wiring}.cpp	auth wiring; auto-connect now prefers *_ManualIp over the radio-reported IP; presence loss no longer disconnects when a manual IP is saved	partly — the IP-precedence and no-disconnect changes are not described	in scope, but undisclosed (nit 4)
src/AutomationSensitiveLineEdit.h, src/core/AutomationServer.cpp	redact sensitive line edits in dumpTree and grab	yes	in scope
src/core/SettingsCredentialPolicy.h, LogManager.cpp	reserved credential names, aether.peripheral.auth category	yes	in scope
docs/architecture/aetherd-touchpoint*	+1 row (PeripheralAuthCodeValidation.h), AppSettings 103→104, ThemeManager 156→157	yes, each justified in the body	in scope (AGENTS.md conformance item 2 satisfied)
docs/4o3a-remote-auth-hardware-evidence.md, tools/probe_4o3a_auth.py	evidence + permanent TGXL/PGXL probe	yes	in scope
.gitignore	third_party/qtkeychain/	yes	in scope
tests (5 new, 5 modified)	see below	yes	in scope

Everything in the diff is explained by the issue. CHANGELOG.md is untouched, which is correct.

Socket tests: peripheral_auth_{dialog,handshake,keychain}_test and both automation_sensitive_* tests are socket-free. I read the sources: they inject frames through the Q_INVOKABLE seams and use an in-memory QKeychain double, with no bind/listen/connectToHost. pgxl_panel_test is a pre-existing loopback QTcpServer test. This PR only changed its layout assertions and added a tests.cmake comment naming the bind, and it skips with 77. I did not run it. No fake device peer was added.

Blockers

1. The "do not retry after rejection" rule for TGXL/PGXL has no test. Removing every guard still passes the suite (inline on src/core/TgxlConnection.cpp:26).

The maintainer triage on #2313 specifies R1|0|Unauthorized → surface error, do not retry, and the body claims "suppress automatic retries after a blocking failure". I mutated both connections and removed !m_authBlocked from all three places that arm or fire the reconnect timer:

• the timer lambda (TgxlConnection.cpp:26)
• onDisconnected (:186)
• failAuthentication (:417), with the same three edits in PgxlConnection.cpp.

After rebuilding, peripheral_auth_handshake_test still exits 0. With the mutation in place, a rejected or saved-but-stale code would be re-sent every 5 s for as long as the radio is connected. That is the loop the triage ruled out, and it can hammer a device that may rate-limit or lock out.

A deterministic seam already exists, because the AG side does this correctly. agReconnectTimer has an object name, and the handshake test asserts on it (tests/peripheral_auth_handshake_test.cpp:619). The suggested fix:

• give the TGXL/PGXL m_reconnectTimer an object name
• call setAutoReconnect(true)
• inject V1.2.17 AUTH + R1|0|Unauthorized, then assert isAuthBlocked() and !reconnectTimer->isActive()
• repeat for the third consecutive onAuthTimeout.

It is socket-free, and it is the only assertion that pins the requirement.

Nits (non-blocking)

1. AG auth uses a bare \r terminator, but the only live AG capture on #2313 shows \n (inline on src/core/PeripheralAuthCode.h:29). The 4O3A wiki does say <terminator> = 0x0D. But the pcap in this issue comment from the vendor's own AG Utility shows C<seq>|auth code=<code>\n. It also reports that AetherSDR's existing \r\n (sendCommand, AntennaGeniusModel.cpp:727) reached the AG auth parser live and got a real R<seq>|FF| back. Of the three terminators, bare CR is the only one never seen working against real hardware. If the firmware splits on LF, every AG auth will time out three times and block. \r\n satisfies both the wiki and the capture. Reasoned from the thread, not reproduced; I have no AG. Please weigh this strongly before calling AG done, and update the test pins at peripheral_auth_handshake_test.cpp:54,435,611 with it.
2. The same capture settles the previous review's contains("AG") concern. It records the WAN greeting as V<version> AG AUTH\n. The evidence doc lists that greeting as an open item, but it can cite this capture as observed. The capture also notes that the vendor Utility silently truncates the AG password to 8 characters. That is worth a line in the doc, because an operator typing the full code into AetherSDR will be rejected.
3. The Status column is off-screen at the default dialog size. From driving the demo build: Setup → Peripherals at the default 960×680 has a group box 890 px wide inside a 649 px scroll viewport, so a horizontal scrollbar appears. At the default scroll position, "Clear code" is cut off and the Status column is not visible at all. That column is where every new error is shown ("Authorization code rejected", "saved code remains in keychain"). The layout is part of the maintainer UI ruling, but it should be settled with that in mind.
4. Undisclosed auto-connect change (inline on src/gui/MainWindow_Wiring.cpp:6452). Tuner/amp presence now connects to TGXL_ManualIp/PGXL_ManualIp before the radio-reported IP, and presence loss no longer drops the direct socket when a manual IP is saved. That is defensible for WAN use, but it changes LAN behaviour for anyone with a saved manual IP. Please state it in the body.
5. Saved codes are bound to the resolved peer IP, not the configured host (inline on src/gui/PeripheralAuthStore.cpp:153). WAN users behind residential DHCP typically use a DDNS hostname. Every WAN IP change turns the saved code into "Authorization code required" and blocks the connection until the operator retypes it. Binding to the IP is a defensible security choice, but it is the main remote use case of #2313. Please ask the maintainer whether to bind to the configured host+port instead, or in addition.
6. AntennaGeniusModel's production constructor gains a std::function whose only purpose is to support tests. The TGXL/PGXL tests reach the same seam through Q_INVOKABLE without changing a public constructor. Minor.

What I verified vs. read

• Built the PR head merged with current main (20d022d50, clean auto-merge) on Linux. CI was created after main's tip, so the green is current.
• Ran peripheral_auth_{dialog,keychain,handshake}_test, automation_sensitive_{line_edit,grab_command}_test, tgxl_docked_parity_test, tgxl_applet_ports_test, and amp_applet_test: 8/8 pass.
• Mutations that were caught (good):
  • TGXL accepting any |0| reply → handshake test fails
  • AG body allowlist forced true → fails
  • Keychain delete clearing the cache before confirmation → keychain test fails
• Mutation that survived: blocker 1.
• Engine-boundary gates: I ran all four (check_engine_boundary --strict, gen_touchpoint_manifest --check, check_capability_records --strict, check_command_plane --strict) on main and on the merge. They show identical finding sets apart from line-number shifts in AutomationServer.cpp (102 findings each). The manifest diff is exactly the three rows the body justifies.
• Bridge session: isolated settings, offscreen, attached to DEMO-0001 and confirmed get radio → AetherSDR Demo. I opened Setup → Peripherals, typed a TGXL code, and clicked Show. dump_tree still returned "value": "<hidden>", and grab_widget rendered dots while the button read "Hide", so the redaction claim holds. That session is also where nit 3's geometry comes from. The instance was closed afterwards.
• Attacks that held up:
  • a code typed for host A carried to host B (discarded; covered)
  • a late Keychain reply for an abandoned attempt (token-gated)
  • a LAN greeting with a pending typed code (discarded, not saved)
  • |/whitespace/control characters in a code (rejected before interpolation)
  • an oversized line (capped)
  • credential text in logs: the auth write bypasses sendCommand's debug log, PGXL setup writes are redacted, and no path logs raw received lines.
• Not verifiable here: any live TGXL/PGXL/AG handshake (no hardware; the demo has no 4O3A devices), macOS/Windows Keychain behaviour, and the applet indicator placement (the applets are hidden without devices).

[w5jwp]

@aetherbot @ten9876 Please re-review PR #6008 at 601b4b4. The September 29 blocker and actionable nits are addressed:

• Retry coverage: TGXL/PGXL now expose named reconnect timers to the socket-free test. With auto-reconnect enabled and a nonempty target, explicit rejection and the third timeout/handshake disconnect must leave the timer inactive. Late disconnect/error delivery cannot re-arm it. Removing the auth-block reconnect guards now fails the test.
• AG framing/evidence: AUTH uses CRLF. The evidence doc cites the contributor capture for AG AUTH, vendor LF, AetherSDR CRLF reaching the parser, and the utility's eight-character truncation. This is attributed existing evidence, not a newly verified AG handshake. The production constructor no longer accepts the test-only writer.
• Clipping: address/connect, authorization controls, and wrapped status now occupy separate lines. The default 960×680 dialog regression includes all peripheral rows and verifies Clear/status fit without horizontal scrolling, including a failed-clear error. Reverting the layout fails that assertion.
• Behavior disclosure: the PR body now explicitly states manual host/port precedence and that presence loss retains a manually configured direct connection.

Maintainer ruling requested: should saved credentials bind to configured hostname+port, resolved peer IP+port, or a combination? Current peer-IP binding remains in place, with the DDNS re-entry limitation disclosed. Please also rule on the compact Setup layout, central-tab placement, and applet indicators already called out in the body.

Validation: the desktop app builds; all eight focused auth, automation-redaction, TGXL and amp applet tests pass. Reconnect-guard, bare-CR, and old-layout mutations each fail at the intended assertion; all eight tests pass again after restoring the fixes. Static baseline, manifest, registration, colour-ratchet, and whitespace checks found no new blocker. No new hardware, OS-vault, or TX verification was performed; the existing loopback PGXL panel test was not rerun.

The commit is signed. GitHub again denied self-assignment because w5jwp lacks upstream assignment permission. Review threads remain open for the reviewers to resolve.

[w5jwp]

Pushed 00d6f79: fan-mode changes and MEffA toggles failed on an authorization-enabled PGXL. This PR's own feature exposes the bug, because only an authenticated connection can reach it.

Cause. AmpModel::writeSetupGroup writes back the whole setup group, including the authcode it read from setup read. With authorization enabled on firmware 3.9.8, setup read returns the real code, and the PGXL refuses any setup that carries it. The app log showed six command … refused, code "50000013" in a row, one per fan change.

Probe (PGXL firmware 3.9.8, authorization enabled, authenticated session). Each write used the amplifier's current values, so an accepted write changed nothing:

Command	Reply
setup fanmode=CONTEST	`R2
setup nickname=… meffa=AUTO ledintens=74 fanmode=CONTEST	`R3
same + authcode=<code> (what the app sent)	`R4

Afterwards status was unchanged, and a fresh session authenticated with the same code, with setup read reporting it unchanged. Leaving authcode out does not clear or alter the stored code.

Fix. The write leaves out authcode once a code is set. With no code set, it still sends authcode= empty, byte for byte what the vendor utility sends to firmware without authorization.

Tests. pgxl_direct_protocol_test now feeds a setup read carrying a code, and checks that a fan-mode change and a MEffA toggle both go out without authcode. Restoring the old write makes it fail 4 checks. pgxl_direct_protocol_test, amp_model_test, pgxl_panel_test, amp_applet_test and peripheral_auth_handshake_test pass.

Verified in the app. After the fix, no refusals were logged, and the PGXL reported the fan mode selected in AetherSDR (fanmode=BROADCAST, from CONTEST).

Observed, not yet understood. On firmware 3.9.8 the fans respond to a profile change intermittently, in AetherSDR and in the vendor's PGXL Utility alike, even when the amplifier reports the new mode. The vendor utility also disables fan selection while the amplifier is in STANDBY. Neither is changed here. Both are being monitored.

[ten9876]

Issue fit

Yes for TGXL and PGXL. AG is still unverified on hardware, as the body says. The last review's blocker (no test for "do not retry after rejection") is fixed. checkReconnectSuppression asserts that tgxlReconnectTimer/pgxlReconnectTimer stay inactive after a rejection and after the third timeout (tests/peripheral_auth_handshake_test.cpp:112-114). The AG CRLF change and the hostname-bound credential (907a88e8) both hold up against the attacks listed below.

What blocks the merge is mechanical. The branch conflicts with current main, and one of the three conflicts is a trap that would silently revert this PR's own 00d6f79e fix (blocker 1).

This review covers 71d5bcd7, reviewed as stage 1 of the #6008 → (#6027 ∥ #6033) → #6036 stack. #6027 and #6033 both branch from this head; they are siblings, not a chain.

Scope

File / group	What it changes	Claimed?	Verdict
src/core/{Tgxl,Pgxl}Connection.*, src/models/AntennaGeniusModel.*, src/core/PeripheralAuthCode*.h	AUTH state machines, attempt token, failure budget, 64 KiB line cap, code validation	yes	in scope
src/gui/PeripheralAuthStore.*, PeripheralAuthConnectFlow.h, CMakeLists.txt	QtKeychain adapter bound to host+port (hostname) or peer IP+port (literal); session-only fallback	yes	in scope
src/models/AmpModel.cpp	setup writes omit authcode once a code is set (00d6f79e)	yes (PR comment + body)	in scope; feature exposed it
src/gui/RadioSetupDialog.cpp	code / Show / Clear rows, status cells, two-line layout	yes	in scope; UI awaits maintainer ruling
src/gui/{Tuner,Amp,AntennaGenius,ShackSwitch}Applet.*	DIRECT/RADIO/OFFLINE indicators; PGXL indicator moved	yes, flagged	needs maintainer decision (already routed)
src/gui/MainWindow{,_Wiring}.cpp	auth wiring; saved manual host wins over discovered IP; presence loss keeps a manual session	yes (disclosed after the last review)	in scope; see maintainer item M1
src/AutomationSensitiveLineEdit.h, src/core/AutomationServer.cpp, SettingsCredentialPolicy.h, LogManager.cpp	redaction, reserved credential names, log category	yes	in scope
docs/architecture/aetherd-touchpoint*	+1 row PeripheralAuthCodeValidation.h (peripheral(4o3a)), AppSettings 103→104, ThemeManager 156→157	yes	in scope; additions only, no reclassification
docs/4o3a-remote-auth-hardware-evidence.md, tools/probe_4o3a_auth.py	evidence + one-shot probe	yes	in scope
tests (5 new, 6 modified), tests/tests.cmake	see socket note	yes	in scope
.gitignore	not in the net diff. Merge be82a425 correctly took main's superset block (#6055)	body still claims it	nit N5

Nothing else in the diff is unexplained, and CHANGELOG.md is untouched.

Socket tests (disclosed to the operator before running): the five new targets are socket-free. I read the sources, and they inject through Q_INVOKABLE seams and an in-memory QKeychain double. Two existing tests are modified and both bind a loopback QTcpServer as a stub PGXL: pgxl_direct_protocol_test (gains the authcode-omission case) and pgxl_panel_test (layout assertions). Neither is on the #5254 legacy-exception list, and neither is in a ci.yml -R filter. The operator approved running both on loopback for this review, and both pass.

Blockers

1. The branch conflicts with main (1352368e), and the AmpModel.cpp conflict reverts 00d6f79e if resolved the easy way. git merge-tree --write-tree origin/main 71d5bcd7 reports content conflicts in three files, all from commits that landed on 2026-10-02:

• src/models/AmpModel.cpp (~L225-250). Main's side (#6072, comment condensing) still carries the old write setup nickname=%1 meffa=%2 ledintens=%3 fanmode=%4 authcode=%5 with m_setupAuthCode. Take this PR's side. Taking main's side re-sends the code and brings back the 50000013 refusal of every fan-mode/MEffA change on auth-enabled 3.9.8. I checked that the test catches this: with the old write restored, pgxl_direct_protocol_test fails 5 checks.
• src/gui/MainWindow_Wiring.cpp (~L6212). Keep both sides: main's #6044 TunerModel::relayedCommandRefused → showUnsupportedControlNotice() connect, and this PR's auth wiring block. Neither side of the hunk carries its own closing });; they share one after the marker. Check that every lambda still closes. 983d743c already committed markers once.
• src/gui/TunerApplet.h (~L209). Keep this PR's three members (m_sourceLabel, m_directConnected, m_directFailureReason) and main's condensed comment.

After resolving, rerun python3 tools/gen_touchpoint_manifest.py. It passes at this head, but main changed the manifest twice since the base (#6045, HL2 CL1), and a hand-resolved Totals line is what failed #6036's CI on 798d12ad.

Maintainer decisions

• M1. A saved manual host now always wins over the radio-reported IP (src/gui/MainWindow_Wiring.cpp:6455-6476 for TGXL, :6622-6634 for PGXL). At the merge base, presence connected to tunerModel().tgxlIp() and presence loss disconnected. Now a saved TGXL_ManualIp is used whenever present, and presence loss leaves that session up. The body discloses this. Two concrete consequences:

  1. A LAN user who once saved 192.168.1.50 loses direct control when DHCP moves the TGXL to .51, and nothing falls back to the address the radio reports.
  2. The keys are client-global, so connecting to a different station still aims at the home TGXL/PGXL.

  A fallback to the discovered IP when the manual connect fails would keep the WAN case without the LAN regression.

• M2. Unchanged from the last round: central-tab placement versus per-applet, the compact layout, the applet indicators, and hostname versus peer-IP binding.

Nits (non-blocking)

• N1. A keychain outage blocks auto-reconnect exactly like a device rejection.
  • setAuthCodeForAttempt calls failAuthentication("Stored authorization code unavailable") with the default blockReconnect = true (src/core/TgxlConnection.cpp:65, .h:112; same in PgxlConnection.cpp:65 and AntennaGeniusModel.cpp:111).
  • Failure: if the keyring is locked or denied when the AUTH greeting arrives, m_authBlocked is set. Every auto path checks isAuthBlocked(), so the station never recovers after the keyring unlocks; only Setup → Connect does.
  • That is the unattended WAN case #2313 is about. Suggest passing false on the unavailable path. Reasoned from code.
• N2. src/models/AmpModel.cpp:250 treats a missing authcode key like an empty one. kvs.value("authcode") is empty either way, so a firmware that leaves the key out of setup read while auth is enabled gets authcode= on every write. Appending it only when kvs.contains("authcode") would follow what the device actually said. Also, the 3.9.8 R4|50000013| probe exists only in a PR comment. docs/4o3a-remote-auth-hardware-evidence.md should carry it (Principle VIII).
• N3. src/gui/MainWindow_Wiring.cpp:6638 logs "PGXL status:" << kvs unredacted. On an authenticated session setup read contains authcode=<real code>. Today only the seq match in PgxlConnection keeps it out of this log; dropping authcode before logging would make that robust.
• N4. The new authcode-omission assertion was added to a synthetic-PGXL socket test (tests/pgxl_direct_protocol_test.cpp:384-408). docs/agents/tests-ci.md § Test-layer boundary puts wire encoding in a socket-free test. Emitting setupRead and capturing the setup line works without the loopback peer, the same way peripheral_auth_handshake_test does.
• N5. The body still says this PR adds third_party/qtkeychain/ to .gitignore. Main's #6055 block superseded it.
• N6. Comment policy (#6072, landed after this branch's base). AGENTS.md § Comments: "History does not go in code." AmpModel.cpp:240-246 retells the 3.9.8 bug ("so every fan-mode change and MEffA toggle failed"). The firmware fact with its version can stay; the narrative belongs in the commit.

What I verified vs. read

• Built f5eafa06 (#6036's head, which contains this one) and 0ef90af5 (#6027) on Linux.
• Ran the 13 focused targets on both heads, 13/13 passing: the three peripheral_auth_* tests, both automation_sensitive_* tests, tgxl_docked_parity, tgxl_applet_ports, amp_applet, amp_model, meter_model, health_applet, and the two loopback tests above.
• Mutation: restoring the authcode=<code> write made pgxl_direct_protocol_test fail 5 checks, so the guard is real.
• Gates: check_engine_boundary --strict, gen_touchpoint_manifest --check, check_capability_records --strict and check_command_plane --strict on the merge base and on this head. Both are flat at 102 findings (line shifts in AutomationServer.cpp only). The tag sidecar is one addition, with no retags.
• Bridge (on #6027's head, which carries this PR's redaction): offscreen, isolated settings, attached to DEMO-0001 only (get radio → "model":"AetherSDR Demo"). I typed a TGXL code and clicked Show. invoke setText echoed "newValue":"<hidden>", dumpTree never contained the digits, and grab of the field rendered dots while the button read "Hide". The redaction claim holds. The instance was closed.
• Attacks that held (reasoned from code, with a read-only second pass):
  • Hostname binding. Case and whitespace normalise. An empty host falls back to the peer IP. Port 0 or an unparseable peer gives no endpoint, and save() refuses. Exotic numeric forms (127.1) key as distinct hostnames and never cross-match. Records are per device type.
  • Credential leakage. Checked across auth writes, the AG pending table, failure strings, accessible text, automation get/grab, and the session fallback (AppSettings::m_sessionCredentials, in-memory only, never saved). The only gap found is N3.
  • Merge resolutions be82a425 / 983d743c+71d5bcd7. Re-run with merge-tree, they differ from the auto-merge only in .gitignore (correct) and the automation test list (both entries kept). No markers remain.
  • Antares' unbounded readAll() flag. Peak memory is one readyRead plus the 64 KiB cap, and overflow aborts the socket.
• CI is stale. The earliest run on this head was created at 2026-10-01 22:26Z; main's tip is 2026-10-02 19:07Z. Five commits landed between, touching the conflicting files. The green describes a merge that no longer exists, and the per-PR ctest is -R-filtered, so none of the new targets ran in CI.
• Not verifiable here: any live TGXL/PGXL/AG handshake, real OS-vault behaviour, and N1/N2 at runtime.