Parity with the Android client: drop the "Allow self-signed certificate"
escape hatch. The app now performs system TLS trust only — a self-signed
appliance must have its CA installed on the device (MDM/profile). A code-only
public-key pinning policy remains (no UI).
- ServerTrustEvaluator: remove ServerTrustPolicy.allowSelfSignedForHost and its
challenge handler; keep .system (default) and .pinPublicKeySHA256.
- SettingsView: remove the self-signed toggle/state/prefill; makeConfig uses
the default .system policy.
- MCMSConnection / APIConfiguration: update usage-sketch + doc comments.
- README / GUI-NOTES / MCMS_API.md: document system-trust-only; self-signed
boxes need their CA installed on the device.
- Add CHANGELOG.md for this session, flagged for the Android port.
Note: configs previously persisted with the self-signed policy fail to decode
and reset to defaults (one-time re-entry of the server URL).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The generation-guard refactor moved the fetched.map{…}.sorted{…} chain into an
untyped `let merged`, dropping the type anchor the property assignment used to
provide. A multi-statement .map closure then leaves .sorted's $0 uninferred
(error: cannot infer type of closure parameter). Annotate merged in
OLTListViewModel and ONUListViewModel as [OLTStateDoc]/[ONUStateDoc].
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Addresses a multi-agent code review (26 confirmed findings + a URLSession
leak) across correctness, concurrency, security, and cleanup:
- MongoDocument.id: deterministic fallback (was UUID() on every access) to stop
SwiftUI List/ForEach identity churn; getAll pagination drives its cursor off
the real _id via documentId, so a missing _id stops paging instead of looping
on a fabricated cursor.
- View models: per-load generation guard (+ captured-tab guard on ONU detail)
so a cancelled or overlapping load can't commit stale results or land data on
the wrong tab.
- JSONValue.intValue: guard Int(d) against NaN/inf/out-of-range (crash).
- ServerTrustEvaluator: hash the real SubjectPublicKeyInfo (prepend the
algorithm-specific ASN.1 SPKI header) so a standard openssl-captured
public-key pin actually matches; unknown key types fail closed.
- AppEnvironment.configure: clear stale cookies + Keychain creds on host change.
- FirmwareFile.isCompatible: empty metadata no longer passes as compatible-for-all.
- APIClient: invalidate URLSession on deinit (per-configure/probe leak).
- Dashboard best-effort sections keep last-good on transient failure; unified
optical thresholds; LoginView prefill-once; populatedBuckets unique ForEach id;
Format rounding rollover; dead-code/docstring/dedup cleanups.
Verification pending on the Mac (no Swift toolchain on the Linux dev box).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
