[Elodie Mirza (elodiejmirza)]

BLUF

• Tracks central #179, specifically DSP alert [codex] Document sub-agent usage guidance #1; no issue-closing directive. The ordinary coefficient path is bounded; no remote exploit is claimed.
• Baseline actual gen_bandpass(NaN,...) returns31/31 nonfinite coefficients without reporting failure. Actual baseline AFSK initialization with malformed local tuning continues and decodes zero frames. This repair validates the whole numeric construction instead of merely changing the flagged literal.
• Build the filter with double intermediates and gain, check before every conversion to float, and return failure for nonfinite/unordered inputs, invalid tap count, nonrepresentable coefficients or zero/nonfinite normalization. Both AFSK/PSK callers terminate initialization with a fixed diagnostic before using a failed/partial kernel.
• Preserve filter windows, normal midpoint response, negative lower cutoff, supported profiles/platforms and finite experimental tuning. No arbitrary tuning range policy, provider removal, scanner suppression or privilege change.
• Current source commit c7889f9 is signed/DCO; merged after all exact-head native/CodeQL/review gates passed.

Verification

• Final full local Debug build and 43/43 CTest passed. Existing modem decoding regressions passed for AFSK/PSK and other supported modes. No claim of full stopband characterization from the focused test alone.
• Strict -Wall -Wextra -Werror compilation plus ASan/UBSan focused tests passed. The new unit covers all5 windows,5 odd/even tap counts,3 bands, finite/symmetric coefficients and preserved0.5 midpoint-response convention, plus NaN/Inf/extreme/zero-width/reversed-band/null/extreme-tap rejection.
• New cross-platform CMake test invokes actual AFSK and PSK initialization with NaN, infinity and overflow-producing local tuning, requiring exit1 and the exact failure diagnostic. Both paths pass locally. Large finite values that still construct a finite kernel remain allowed; unused prefilter tuning remains irrelevant to profiles that disable that filter.
• Baseline negative control produced31/31 nonfinite coefficients. Initial regression code did not compile against the old void API; final checked internal API and both direct callers are tested. No fake successful-startup receipt from intentionally rejected configuration.
• Final diff/secret checks passed. Hosted and integrated validation passed; scanner fixed-at is verified below.

Security Review Evidence

• Reviewed src/dsp.c/.h, both direct callers, test source/CMake wiring for numeric overflow/narrowing, malformed local environment, partial-state consumption, bounds, platform math, diagnostics and compatibility.
• Fresh pre-patch independent investigation reconciled coefficient bounds and active tuning. One fresh independent patch review found no actionable bypass/regression; its coverage limitations were addressed with actual caller failure tests and full modem regressions. Root independently reviewed both callers and all return outcomes.
• The API is internal application code; no installed library/header contract is changed. A failed builder may leave a partial scratch kernel; both callers stop before consumption.
• This repair does not validate every other tuning variable or claim all malformed configuration is safe. No secrets, device/network activation in the synthetic tests, new dependency, workflow permission or scanner-owner change.
• Current missing master protection remains under separate Support APRS Directed Station Queries wb2osz/direwolf#112. Do not call the branch protected or use admin bypass.

Lessons Learned

• Central register and active Feature Request: control beacon transmission using an external command wb2osz/direwolf#179 RCA context reviewed at start/end. LL-0002 avoids superficial repeated fixes; LL-0004/0011 require current source/native/scanner correlation; LL-0007 preserves original dismissals and baseline failures; LL-0010 requires GitHub-valid signatures/DCO and normal integration.
• Other producer/catalogue/Codespace/identity lessons are not applicable to this bounded native source change.
• Complexity removed or justified: one checked builder enforces numeric validity for both initialization paths; no duplicated caller arithmetic or new framework.
• Central Feature Request: control beacon transmission using an external command wb2osz/direwolf#179/Add GPIO LED support when PTT is asserted wb2osz/direwolf#61 Project9 and GPIO PTT wb2osz/direwolf#60 Project10 remain open; project state must reflect exact-head and integrated evidence separately.

DSP repair integrated — 4 November 2026

• Direwolf#16 merged normally at GitHub-verified signed master 1fe760fcf5903b915ab2a2c80424b29a65cd9aa0, containing reviewed signed/DCO c7889f914324ee7f0d446e13f5bcd96c932165b5. No open reviews/threads at final read; no bypass/settings change.
• Final-head PR native41845273959 and all3 CodeQL analyses passed. Actual Windows42/42 and Mac/Linux43/43 included both new tests. Integrated native 41846280798 passed all4 jobs, with actual Windows42/42 and both new tests inspected.
• Integrated CodeQL41846281427: C++2095094574 has1 result, Actions2095085261/Python2095087372 zero, empty errors/warnings. DSP#1 now has scanner fixed_at=2026-11-04T14:20:22Z. Two direwolf stations transmit at same time (collide) how to adjust hold-off timer? wb2osz/direwolf#19/Misc fixes for upstream wb2osz/direwolf#20 were previously scanner-confirmed fixed. The sole current C++ result is config#15 with its reviewed false-positive disposition.
• GitHub fixed-state query returns26 IDs (including historical dismissed findings now bearing fixed-at); do not double-count overlapping state filters. Dismissed query has14,13 with fixed-at; the only one without fixed-at is reviewed false-positive#15. Open query returns0. No claim of all privileged deployment safety.
• Feature Request: control beacon transmission using an external command wb2osz/direwolf#179 stays open for required governance/protection acceptance under Support APRS Directed Station Queries wb2osz/direwolf#112 and project readback. Live master rulesets/effective rules remain empty. Project9 PR16 addition/fields are pending authorized UI recovery (browser.user is unavailable); no read:project expansion requested. Existing issue179 remains In Progress. Add GPIO LED support when PTT is asserted wb2osz/direwolf#61/GPIO PTT wb2osz/direwolf#60 retain delivery/BAU follow-up.
• Lessons LL0002/0004/0007/0010/0011 applied at start/end; baseline failures/independent review preserved. Clean task master synced; isolated diagnostics/worktrees retained for issue179, no Docker used. Full A–J goal remains active.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T14:19:31.356554Z	c7889f9	Draft marked ready
🔒 Security Review	✅ Completed 2026-11-04T14:20:24.841739Z	c7889f9	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟡 Changes recommended

The enabled -ffast-math option can optimize away isfinite checks, undermining NaN/Inf rejection and regression assertions unless strict floating-point semantics protect both dsp.c and dsp_bandpass_test.c.

1 open issue

• Disable fast-math for finite-value checks and regression tests · New

What changed in this PR

This PR adds checked bandpass-filter construction to the shared DSP code so AFSK and PSK initialization stop rather than consume an invalid kernel.

Changes:

• Uses double intermediates and validates inputs, coefficients, and normalization.
• Returns construction failures to both demodulators, which stop with a fixed diagnostic.
• Adds kernel-response checks and malformed-tuning initialization tests.

File	Description
test/​dsp_bandpass_test.c	Tests valid kernels, midpoint response, and invalid construction.
test/​dsp_bandpass_initialization_test.cmake	Checks AFSK/PSK rejection of malformed tuning.
test/​CMakeLists.txt	Registers both bandpass regression tests.
src/​dsp.h	Documents the checked builder’s return and failure contract.
src/​dsp.c	Adds numeric validation and double-precision intermediates.
src/​demod_psk.c	Stops PSK initialization when filter construction fails.
src/​demod_afsk.c	Stops AFSK initialization when filter construction fails.

_{Review effort: Balanced}