[cpp-RCP-parity-B] CI reliability: cpfusa gating gaps (#59/#60/#61/#62 + cyber --strict) #123

Background

Part of the same 2026-08-21 parity audit against c-RCP. This tracker is specifically the cpfusa-integration CI-reliability surface: several jobs don't actually gate/verify what their names or intent claim. It folds in three already-open issues (re-verified against current main, not left as stale assumptions) plus one newly-found gap of the same class.

Findings (verified against current main)

• cpp-FuSa dependency pulled via unpinned git clone — non-reproducible CI/release, stale toolVersion in v2.18.0 artifacts #59 (unpinned cpp-FuSa dependency) — confirmed fixed. ci.yml:340 and release.yml:30 both now read git clone --depth=1 --branch v0.18.0 https://github.com/SoundMatt/cpp-FuSa, landed in b618f0b (ci: pin cpp-FuSa to v0.18.0 instead of floating on default branch #97). Recommend closing cpp-FuSa dependency pulled via unpinned git clone — non-reproducible CI/release, stale toolVersion in v2.18.0 artifacts #59 directly (see comment posted there).
• cpfusa analyze CI job uses "|| true", silently swallowing 22 ERROR-severity findings (violates §20.1.2) #60 (cpfusa analyze || true swallowing ERROR findings) — confirmed still open, ci.yml:445 unchanged. Re-ran cpfusa analyze locally (pinned v0.18.0, clean checkout): 26 ERROR-severity findings today, but all 26 are noise from vendored third-party source — cpfusa's cppcheck integration scans the whole project directory including build/_deps/catch2-src (pulled in by CMake FetchContent), and cppcheck flags Catch2's own macros (SECTION, GIVEN, CATCH_REGISTER_LISTENER) as unknownMacro errors. Scoping cppcheck to just include/ cli/ tests/ (excluding build/) gives zero ERROR findings against cpp-RCP's own code. Fix is a scope/exclude change, not a defect-fixing sprint — much smaller than it looks from the raw count.
• cpfusa-verify job: .fusa-evidence.json upload silently fails to find the file it just wrote #61 (cpfusa-verify evidence-upload silently fails) — confirmed still open, ci.yml:592-596's upload-artifact step for .fusa-evidence.json still has no if-no-files-found: error.
• README's TC18 wire-codec table entries omit the wire-conformance-not-claimed caveat (and byte_bus_id width vs TC18 needs verifying) #62 (README TC18 wire-codec caveat + byte_bus_id width) — half-fixed. The width half is done: ByteBusId widened uint8_t→uint16_t at v2.19.0 (include/rcp/avtp.hpp:191, explained at lines 184-189). The README-caveat half is still open — README.md:24-25's rows for <rcp/avtp.hpp>/<rcp/acf.hpp> still carry no "wire conformance not claimed" caveat. Recommend narrowing README's TC18 wire-codec table entries omit the wire-conformance-not-claimed caveat (and byte_bus_id width vs TC18 needs verifying) #62's scope to just the remaining half (see comment posted there).
• New finding: the cpfusa-cyber job is named "cpfusa cyber --strict" (ci.yml:394) but its run: step (ci.yml:408) invokes plain cpfusa cyber — no --strict flag, so WARNING-severity cybersecurity findings never fail the job despite the name. Scoped to cpp-RCP's own tree (no build/ artifacts, matching real CI): 273 WARNING findings exist today (mostly CYBER009/CWE-190 integer-narrowing in test files; one CYBER017/CWE-798 hardcoded-IP-in-test-fixtures class worth a real risk review), 0 ERROR findings — so the job's actual pass/fail behavior is currently correct by accident, but the name overstates what it enforces.
• Also found in passing: cpfusa's cppcheck-sourced ANAL002 findings never get a file/line attached (analyze.cpp:275-296's regex only captures the <error> tag's own attributes, never the nested <location> element) — worth filing upstream against cpp-FuSa itself once cpfusa analyze CI job uses "|| true", silently swallowing 22 ERROR-severity findings (violates §20.1.2) #60 is otherwise fixed, since it'll make future triage harder.

Checklist

• Close cpp-FuSa dependency pulled via unpinned git clone — non-reproducible CI/release, stale toolVersion in v2.18.0 artifacts #59 (already fixed, evidence posted)
• Fix cpfusa analyze CI job uses "|| true", silently swallowing 22 ERROR-severity findings (violates §20.1.2) #60 — scope cpfusa analyze's cppcheck invocation away from build/_deps vendor tree, then drop || true
• Fix cpfusa-verify job: .fusa-evidence.json upload silently fails to find the file it just wrote #61 — add if-no-files-found: error to the .fusa-evidence.json upload step
• Narrow README's TC18 wire-codec table entries omit the wire-conformance-not-claimed caveat (and byte_bus_id width vs TC18 needs verifying) #62 to the remaining README-caveat half (width fix already landed)
• Add the missing --strict flag to the cpfusa-cyber job, then triage the 273 newly-gated WARNING findings
• Consider filing the ANAL002 missing-location regex bug upstream against cpp-FuSa

Not in scope here

#58 (cs-bit polarity bug) is a real, already-open, already-well-evidenced functional defect unrelated to CI-tooling reliability — left as-is, not folded into this tracker. #23 (tooling-package parity with go-RCP) is a distinct, already-correctly-scoped architectural decision — no overlap found.