G2.6: consume ProductionEligible profile for automatic dynamic reporting

CHANGELOG.md

@@ -7,13 +7,15 @@ All notable public changes to ARIEC61850 are recorded here. The project is still
 ### Added
 
 - Added a typed hybrid report acquisition planner that can cover requested signals with safe static BRCB/URCB plans, use explicitly free dynamic report slots for residual signals, and leave only the remaining points on MMS polling fallback without equating fallback with absence.
+- Added the G2.6 production dynamic-report consumer: an optional typed production-planning context can authorize automatic dynamic planning only from an identity-compatible `ProductionEligible` profile, with exact proven InformationReport RCB/member scope and fail-closed fallback for unproven points.
 - Added typed IEC 61850 UTC-Time forensic evidence with exact preserved 8-byte wire provenance, the original 24-bit fractional-second field, TimeQuality/accuracy decoding, and explicit full/engineering UTC and local-offset views.
 - Added report timestamp evidence that keeps IED data timestamps, report `TimeOfEntry`, and client `ReceivedAt` as distinct evidence sources; raw `TimeOfEntry` provenance is linked only when an exact decoded-report match exists.
 
 ### Changed
 
 - Native MMS discovery can now carry bounded, ordered DataSet-directory results in its typed result, allowing live-model, engineering-profile, and readiness builders to consume the same member evidence without application-side reconstruction.
 - Hybrid dynamic reporting can host a temporary DataSet in a verified-free RCB Logical Device while its members reference live points in other Logical Devices, matching the MMS named-variable-list model used by Siemens auxiliary RCB pools.
+- Production automatic dynamic planning remains P6.2-B quarantined for callers without a valid production context; even when authorized, the first G2.6 consumer is limited to the exact report-proven RCB, report-proven members, one dynamic group, and fresh live availability.
 - Preserved full seven-digit UTC-Time precision through the shared MMS scalar/structured renderer and retained exact decoded UTC-Time bytes for byte-exact re-encoding; synthetic UTC-Time values remain explicitly without wire provenance.
 - Corrected website structured-data licensing to `GPL-3.0-or-later`.
 - Replaced stale active-license wording and milestone journals with current evidence and future-only roadmap documents.
@@ -61,4 +63,4 @@ All notable public changes to ARIEC61850 are recorded here. The project is still
 
 Earlier milestones include MMS association and discovery, reporting readiness and persistent monitoring, GOOSE and Sampled Values codecs and diagnostics, SCL engineering profiles, PCAP workflows, deterministic simulation, Windows raw-Ethernet transport, Sampled Values laboratory publishing, and engineering evidence export.
 
-See [Engine Maturity Matrix](docs/ENGINE_MATURITY_MATRIX.md) for current evidence and [Roadmap](ROADMAP.md) for future work.
+See [Engine Maturity Matrix](docs/ENGINE_MATURITY_MATRIX.md) for current evidence and [Roadmap](ROADMAP.md) for future work.

docs/G2_6_PRODUCTION_DYNAMIC_CONSUMER.md

@@ -0,0 +1,86 @@
+# G2.6 Production Dynamic Reporting Consumer
+
+## Status
+
+Implemented and unit-tested on the `g2.6-production-dynamic-consumer` branch. This document describes the production-planning contract only; it is not a claim of new live-IED interoperability.
+
+## Purpose
+
+P6.2-B deliberately quarantines automatic full dynamic DataSet activation because advertised MMS capability and a successful single-member NamedVariableList probe were not sufficient evidence for safe production mutation.
+
+G2.6 adds the missing production consumer for the existing persisted qualification profile. The capability-aware hybrid planner can now consider dynamic reporting only when an application supplies a `MmsDynamicReportProductionPlanningContext` containing the persisted profile and the current IED identity.
+
+## Authorization gate
+
+Dynamic production planning requires all of the following:
+
+1. dynamic BRCB or URCB intent is enabled in planner options;
+2. the current association passes the existing dynamic-report capability evaluator;
+3. `MmsDynamicReportQualificationProfilePolicy.CanUseForProductionPlanning(...)` accepts the profile;
+4. the profile is identity-compatible and exactly `ProductionEligible`;
+5. the activation proof and InformationReport proof agree on RCB, DataSet, and exact member sequence;
+6. the InformationReport member set is an ordered subset of the accepted qualified envelope;
+7. the production member evidence is non-empty and contains no duplicate normalized MMS references.
+
+A profile at `InformationReportProven` or any earlier state remains quarantined.
+
+## First production-consumer scope
+
+The initial consumer is intentionally narrower than the theoretical qualified envelope:
+
+- static BRCB/URCB coverage is always planned first;
+- automatic dynamic planning is restricted to the exact RCB that produced the proven InformationReport;
+- only exact members from that proven InformationReport are exposed to the production dynamic planner;
+- automatic production dynamic scale-out is limited to one dynamic group;
+- the per-report member ceiling is clamped to the proven InformationReport member count;
+- unproven or unrelated requested members remain on bounded MMS polling;
+- another free RCB cannot silently substitute for the proven RCB.
+
+This deliberately avoids generalizing a successful NVL envelope into report authority for members or RCBs that have not produced the proven report.
+
+## Fresh live evidence remains mandatory
+
+`ProductionEligible` is permission to consider the dynamic path, not permission to perform a blind write. Normal live planning still requires exact fresh RCB availability. If the proven RCB is unavailable, occupied, not explicitly free, or otherwise fails the existing dynamic-slot rules, the planner emits no dynamic segment and leaves the affected signals on polling.
+
+## Post-plan invariant
+
+Persisted profile material is treated as untrusted input. After the generic hybrid planner returns, the capability-aware wrapper verifies that any dynamic segment:
+
+- uses no more than one dynamic RCB;
+- uses the exact proven RCB;
+- contains resolved dynamic points;
+- contains only an ordered subset of the exact proven InformationReport member set.
+
+If this invariant fails, the dynamic plan is discarded and planning is rebuilt with the frozen static-to-polling behavior.
+
+## Compatibility
+
+The existing `MmsCapabilityAwareHybridReportAcquisitionPlanner.Build(...)` call remains source-compatible. The production context is an optional final argument. Existing callers that do not provide it retain P6.2-B quarantine behavior.
+
+## Deterministic validation
+
+`MmsG26ProductionDynamicConsumerTests` covers:
+
+- `InformationReportProven` remains quarantined;
+- an identity-compatible `ProductionEligible` profile can authorize the exact proven URCB/member set;
+- an unproven requested member remains on polling;
+- identity/fingerprint mismatch fails closed;
+- a different free RCB cannot substitute for the proven RCB;
+- tampered persisted member evidence is rejected.
+
+CI command set:
+
+```powershell
+dotnet restore .\ARIEC61850.sln
+dotnet build .\ARIEC61850.sln -c Release --no-restore
+dotnet test .\ARIEC61850.sln -c Release --no-build
+.\scripts\verify-source-clean.ps1
+```
+
+The first successful branch validation ran 703 tests with 703 passed, zero build warnings, and zero build errors.
+
+## What remains unproven
+
+This engine patch does not itself make any IED `ProductionEligible` and does not establish live field behavior for a new device. Applications must still complete the physical G2.6 acceptance gates before persisting `ProductionEligible`, then supply that profile and the matching current IED identity to this consumer.
+
+The next lowest-risk application step is to wire the typed production context into ARSAS while keeping current non-qualified IEDs on the existing static-report/polling behavior.