feat(dice): recognize Midas Venice as a deferred fail-closed DICE device

.clang-format

@@ -0,0 +1,21 @@
+---
+Language: Cpp
+BasedOnStyle: LLVM
+
+IndentWidth: 4
+TabWidth: 4
+UseTab: Never
+
+ColumnLimit: 100
+
+BreakBeforeBraces: Attach
+AllowShortIfStatementsOnASingleLine: Never
+AllowShortLoopsOnASingleLine: false
+AllowShortBlocksOnASingleLine: Never
+
+DerivePointerAlignment: false
+PointerAlignment: Left
+
+SortIncludes: true
+IncludeBlocks: Preserve
+...

.clang-tidy

@@ -0,0 +1,26 @@
+---
+Checks: >
+  -*,
+  clang-analyzer-*,
+  -clang-analyzer-alpha.*,
+  bugprone-*,
+  -bugprone-easily-swappable-parameters,
+  -bugprone-reserved-identifier,
+  performance-*,
+  modernize-*,
+  -modernize-use-trailing-return-type,
+  -modernize-use-auto,
+  -modernize-avoid-c-arrays,
+  readability-*,
+  -readability-identifier-naming,
+  -readability-magic-numbers
+
+FormatStyle: file
+WarningsAsErrors: ''
+
+# The DriverKit codebase uses common low-level abbreviations (`kr`, `hw`, `it`, `ok`).
+# Keep `readability-identifier-length` enabled, but reduce noise by allowing 2-char names.
+CheckOptions:
+  readability-identifier-length.MinimumVariableNameLength: '2'
+  readability-identifier-length.MinimumParameterNameLength: '2'
+...

.github/workflows/build-and-test.yml

@@ -0,0 +1,147 @@
+name: Build and Test
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  build-and-test:
+    name: Build and Test
+    runs-on: macos-26
+    env:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      LLVM_PROFILE_FILE: ${{ github.workspace }}/build/tests/%p-%m.profraw
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
+          submodules: recursive
+
+      - name: Install Dependencies
+        run: |
+          gem install xcpretty
+
+      - name: Install the Apple certificate and provisioning profile
+        env:
+          BUILD_CERTIFICATE_BASE64: ${{ secrets.CERT_BASE_64 }}
+          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
+          # BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          if [[ -z "$BUILD_CERTIFICATE_BASE64" || -z "$P12_PASSWORD" || -z "$KEYCHAIN_PASSWORD" ]]; then
+            echo "Signing secrets are unavailable; skipping certificate import."
+            exit 0
+          fi
+
+          # create variables
+          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
+          PP_PATH=$RUNNER_TEMP/build_pp.provisionprofile
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+
+          # import certificate and provisioning profile from secrets
+          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
+          # echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH
+
+          # create temporary keychain
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+
+          # import certificate to keychain
+          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+
+          # apply provisioning profile
+          # mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
+          # cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles      
+
+      - name: Generate Compilation Database
+        env:
+          BUILD_CERTIFICATE_BASE64: ${{ secrets.CERT_BASE_64 }}
+          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          chmod +x bump.sh
+          ls -l bump.sh
+          set -o pipefail
+          CODE_SIGN_ARGS=()
+          if [[ -z "$BUILD_CERTIFICATE_BASE64" || -z "$P12_PASSWORD" || -z "$KEYCHAIN_PASSWORD" ]]; then
+            echo "Signing secrets are unavailable; building without code signing."
+            CODE_SIGN_ARGS=(CODE_SIGNING_ALLOWED=NO CODE_SIGN_IDENTITY= CODE_SIGNING_REQUIRED=NO)
+          fi
+
+          xcodebuild -project ASFW.xcodeproj \
+            -scheme ASFW \
+            -configuration Debug \
+            -arch arm64 \
+            -derivedDataPath build/DerivedData \
+            clean build \
+            "${CODE_SIGN_ARGS[@]}" \
+            | tee xcodebuild.log \
+            | xcpretty -r json-compilation-database --output compile_commands.json || {
+              echo "::error::Build failed! Showing last 100 lines of log:"
+              tail -n 100 xcodebuild.log
+              exit 1
+            }
+
+      - name: Configure Tests with Coverage
+        run: |
+          cmake -S tests -B build/tests \
+            -DCMAKE_BUILD_TYPE=Debug \
+            -DCMAKE_CXX_FLAGS="-fprofile-instr-generate -fcoverage-mapping" \
+            -DCMAKE_EXE_LINKER_FLAGS="-fprofile-instr-generate"
+
+      - name: Build Tests
+        run: |
+          cmake --build build/tests --config Debug -j$(sysctl -n hw.ncpu)
+
+      - name: Run Tests
+        run: |
+          cd build/tests
+          ctest --output-on-failure -j$(sysctl -n hw.ncpu)
+
+      - name: Process C++ Coverage
+        run: |
+          # Merge all profraw files into a single profdata file
+          xcrun llvm-profdata merge -sparse build/tests/*.profraw -o coverage.profdata
+
+          # Find all test executables in build/tests (excluding CMake artifacts)
+          TEST_EXECUTABLES=$(find build/tests -type f -perm +111 -not -name "*.dylib" -not -name "*.a" -not -path "*/CMakeFiles/*" -not -path "*/_deps/*" -not -name "cmake" -not -name "ctest")
+
+          # Construct the object args for llvm-cov
+          OBJECT_ARGS=""
+          for exe in $TEST_EXECUTABLES; do
+            OBJECT_ARGS="$OBJECT_ARGS -object $exe"
+          done
+
+          # Generate coverage report excluding test files, stubs, and mocks
+          xcrun llvm-cov show $OBJECT_ARGS \
+            -instr-profile=coverage.profdata \
+            --ignore-filename-regex='.*Tests\.cpp$' \
+            --ignore-filename-regex='.*/tests/.*Stub\.cpp$' \
+            --ignore-filename-regex='.*/tests/mocks/.*' \
+            --ignore-filename-regex='.*/tests/LoggingStubs\.cpp$' \
+            > coverage.txt
+
+      - name: Install Sonar Build Wrapper (optional for C/C++ analysis)
+        uses: SonarSource/sonarqube-scan-action/install-build-wrapper@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 # v7
+        if: runner.os == 'macOS' && env.SONAR_TOKEN != ''
+
+      - name: SonarQube Scan
+        uses: SonarSource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 # v7
+        if: env.SONAR_TOKEN != ''
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: >
+            --define "sonar.cfamily.compile-commands=compile_commands.json"
+            --define "sonar.cfamily.llvm-cov.reportPath=coverage.txt"
+
+      # REDUNDANT if generating compile_commands.json succeeded
+      # - name: Build Driver
+      #   run: |
+      #     ./build.sh

.gitignore

@@ -1,21 +1,62 @@
 # Build artifacts
 build/
+build-ninja/
+build-tests/
+build-tests-codex/
 **/build/
 **/build_*/
+tests_build/
+*.log
+tests.log
+build-tests*/
+
+# Local tooling caches
+.cache/
 
 # .DS_Store
 .DS_Store
 
+# .env
+.env
+
+# Coverage report
+coverage_html/
+coverage.profdata
+coverage.profraw
+default.profraw
+
 # build logs
 *.logs
+diff.txt
 
 # Other
 compile_commands.json
 
+# Sonar run with token
+sonar.sh
+
 # PVS studio
 .PVS-Studio*
 
 # Scripts for private repo management
+push-to-public.shtests/simple_mock_test
 push-to-public.sh
-# Exclude docs from public repository
+# Version metadata (auto-generated)
+ASFWDriver/Version/DriverVersion.hpp
+
+# Exclude docs/ from public repository
 docs/
+
+# Exclude Plugins/VersionGeneratorPlugin from public repository
+Plugins/VersionGeneratorPlugin
+
+# LLM Tools
+
+.claude/
+opencode.json
+
+# Xcode per-user state
+**/xcuserdata/
+
+# Local Codex scratch builds
+build-codex/

.vscode/c_cpp_properties.json

@@ -0,0 +1,21 @@
+{
+    "configurations": [
+        {
+            "name": "Mac",
+            "includePath": [
+                "${workspaceFolder}/**"
+            ],
+            "defines": [],
+            "compilerPath": "/usr/bin/clang",
+            "cStandard": "c17",
+            "cppStandard": "c++23",
+            "intelliSenseMode": "macos-clang-arm64",
+            "macFrameworkPath": [
+                "/Applications/Xcode-beta.app/Contents/Developer/Platforms/DriverKit.platform/Developer/SDKs/DriverKit.sdk/System/DriverKit/System/Library/Frameworks/AudioDriverKit.framework/Headers",
+                "/Applications/Xcode-beta.app/Contents/Developer/Platforms/DriverKit.platform/Developer/SDKs/DriverKit.sdk/System/DriverKit/System/Library/Frameworks/DriverKit.framework/Headers",
+                "/Applications/Xcode-beta.app/Contents/Developer/Platforms/DriverKit.platform/Developer/SDKs/DriverKit.sdk/System/DriverKit/System/Library/Frameworks/PCIDriverKit.framework/Headers"
+            ]
+        }
+    ],
+    "version": 4
+}

.vscode/settings.json

@@ -0,0 +1,7 @@
+{
+  "sonarlint.connectedMode.project": {
+    "connectionId": "mrmidi",
+    "projectKey": "mrmidi_ASFireWire"
+  },
+  "sonarlint.pathToCompileCommands": "${workspaceFolder}/compile_commands.json"
+}