feat(lights): exterior-light conditions and standstill actions (CR-046)

Tracks EVHardware 1.15.0 (200112f).
- VehicleReader puts the low/high beam and fog states and switch positions.
  Absent stays absent; it never reads as OFF.
- DirectExecutor gets branches SET_HEADLIGHTS / SET_HIGH_BEAM / SET_FOG_LIGHTS.
  They are gated (0 km/h only). ExteriorLights refuses low beams OFF and high
  beam forced ON.
- Manifest + allowlist add CAR_EXTERIOR_LIGHTS and CONTROL_CAR_EXTERIOR_LIGHTS.
- DiagnosticsTest: an unproven write on a generation that does not carry it
  reports the firmware reason first. The lights are proven on none yet.

Every light entry stays hidden and inert until a capture proves a generation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: malys

.github/security/permission-allowlist.txt

@@ -13,6 +13,11 @@ android.car.permission.CAR_ENERGY
 android.car.permission.CAR_POWERTRAIN
 android.car.permission.CAR_VENDOR_EXTENSION
 android.car.permission.CONTROL_CAR_CLIMATE
+# CR-046 (owner request 2026-10-08): light conditions read HEADLIGHTS/HIGH_BEAM/FOG_LIGHTS_STATE;
+# light actions write the matching _SWITCH only at 0 km/h (VehicleWriteGate), never low beams
+# OFF, never high beam forced ON (ExteriorLights). Both unused until a generation is proven.
+android.car.permission.CAR_EXTERIOR_LIGHTS
+android.car.permission.CONTROL_CAR_EXTERIOR_LIGHTS
 android.permission.WRITE_SETTINGS
 
 # --- Own vehicle service ---

EVHardware

@@ -16,6 +16,10 @@
     <uses-permission android:name="android.car.permission.CAR_POWERTRAIN" />
     <uses-permission android:name="android.car.permission.CAR_VENDOR_EXTENSION" />
     <uses-permission android:name="android.car.permission.CONTROL_CAR_CLIMATE" />
+    <!-- Exterior lights (CR-046): read for light conditions, control for the standstill
+         actions. Signature-level, granted by the platform signature like the rest. -->
+    <uses-permission android:name="android.car.permission.CAR_EXTERIOR_LIGHTS" />
+    <uses-permission android:name="android.car.permission.CONTROL_CAR_EXTERIOR_LIGHTS" />
     <uses-permission android:name="android.permission.WRITE_SETTINGS" />
 
     <!-- Own vehicle service: foreground + wake + start at boot to catch the ignition. -->

app/src/main/AndroidManifest.xml

@@ -172,6 +172,10 @@ class DirectExecutor(
             // Blocking for about a second: EVHardware reads the state three times before it
             // dares toggle it. The executor already runs off the main thread.
             ActionType.SET_ESC              -> EVHardware.setEsc(b)
+            // Exterior lights (CR-046) — gated; ExteriorLights refuses low-beam OFF / high-beam ON.
+            ActionType.SET_HEADLIGHTS       -> EVHardware.setHeadlightsSwitch(i)
+            ActionType.SET_HIGH_BEAM        -> EVHardware.setHighBeamSwitch(i)
+            ActionType.SET_FOG_LIGHTS       -> EVHardware.setFogLights(b)
             ActionType.SET_DROWSINESS       -> EVHardware.setDrowsiness(b)
             ActionType.SET_DROWSINESS_SENSITIVITY -> EVHardware.setDrowsinessSensitivity(i)
             ActionType.SET_ACC_TJA_MODE     -> EVHardware.setAccTjaMode(i)

app/src/main/java/com/evsuite/tasker/vehicle/DirectExecutor.kt

@@ -107,6 +107,14 @@ object VehicleReader {
                 putIfReadable(SnapshotKeys.KEY_BRIGHTNESS, EVHardware.getScreenBrightnessPercent())
             }
 
+            // Exterior lights (CR-046): null until a generation is proven, so absent — never OFF.
+            EVHardware.headlightsStateOrNull()?.let { put(SnapshotKeys.KEY_HEADLIGHTS, it) }
+            EVHardware.highBeamOnOrNull()?.let { put(SnapshotKeys.KEY_HIGH_BEAM, it) }
+            EVHardware.fogLightsOnOrNull()?.let { put(SnapshotKeys.KEY_FOG_LIGHTS, it) }
+            EVHardware.headlightsSwitchOrNull()?.let { put(SnapshotKeys.KEY_HEADLIGHTS_SWITCH, it) }
+            EVHardware.highBeamSwitchOrNull()?.let { put(SnapshotKeys.KEY_HIGH_BEAM_SWITCH, it) }
+            EVHardware.fogLightsSwitchOnOrNull()?.let { put(SnapshotKeys.KEY_FOG_LIGHTS_SWITCH, it) }
+
             // The `…OrNull` readers, not the Boolean ones: those answer false for a signal
             // the firmware never returned, which the engine would read as "the feature is
             // off" and act on. Absent from the snapshot is the honest answer.

app/src/main/java/com/evsuite/tasker/vehicle/VehicleReader.kt

@@ -1,6 +1,7 @@
 package com.evsuite.tasker.debug
 
 import com.evsuite.hardware.FirmwareGen
+import com.evsuite.hardware.FirmwareSupport
 import com.evsuite.hardware.catalog.ActionType
 import com.evsuite.hardware.catalog.ConditionType
 import com.evsuite.hardware.catalog.SnapshotKeys
@@ -421,11 +422,16 @@ class DiagnosticsTest {
 
         val unproven = ActionType.entries.filter { !it.writeProven }.map { it.name }
         assertTrue("the glass is the case this exists for", "SET_WINDOWS" in unproven)
+        // Every unproven write is blocked and hidden, whatever the reason given.
         unproven.forEach {
-            assertEquals(Diagnostics.Reason.WRITE_UNPROVEN, entry(entries, it).reason)
             assertEquals(Diagnostics.Status.BLOCKED, entry(entries, it).status)
             assertTrue("$it must not be offered in the editor", entry(entries, it).hidden)
         }
+        // The reason is WRITE_UNPROVEN where the firmware carries it. Where it does not — the
+        // CR-046 lights, supported on no generation yet — the firmware verdict comes first.
+        ActionType.entries
+            .filter { !it.writeProven && FirmwareSupport.gensOf(it)?.contains(FirmwareGen.SWI68) != false }
+            .forEach { assertEquals(Diagnostics.Reason.WRITE_UNPROVEN, entry(entries, it.name).reason) }
         assertTrue(
             "no OK action may be unproven",
             entries.filter { it.status == Diagnostics.Status.OK }.none { it.name in unproven }