Closed bug report

rules check passes invalid KiCad project DRU (presence-only, missing source SHA)

Josh Aberdeen · 9d ago ·closed by John Lauer

Verified safety defect in native AI Flow rules check

On AI Flow 0.2.30, board-side rules check can return pass=true when a project .kicad_dru exists but is syntactically invalid. The check validates presence/identity, not the actual KiCad rule contents. This is not a claim about KiCad DRC; KiCad rejects the file.

Reproduction in SCRATCH, not customer board

  1. Create a scratch AI Flow KiCad run with a coupon board.
  2. Set the spec fab.rules to fab, selecting the board project .kicad_dru.
  3. Copy the currently PUBLISHED PCBWay 4L rules file to the coupon board's project .kicad_dru. That file contains unsupported constraint hole (min ...).
  4. Native KiCad 10 custom-rule parser reports unknown constraint type hole and no usable rules.
  5. Native ADOM rules check reports pass=true, method existing-project-check, board SHA but no DRU SHA.
  6. Removing the .kicad_dru produces exit 2, confirming it was a file-presence check.

Reproduction proof: UMCU21 Stage 2 r8, native scratch run, private proofs/rules-stage2-r8-native-and-upstream.md. Related generator fix is ADOM PCB design rules draft PR #6: https://wiki.adom.inc/adom/pcb-design-rules/prs/6 . The real UMCU21 customer run was NOT changed to spoof this test.

Requested fail-closed native behavior

  • Hash the actual board-project .kicad_dru bytes and record SHA with board SHA and selected fab profile in the native run.
  • Parse the exact source via real KiCad, then run KiCad DRC before returning pass. Invalid and unsupported constraints must FAIL.
  • Verify the project's current rules bytes equal the explicitly authorised stage-2 source, not only that a matching filename exists.
  • Missing native KiCad parser or unavailable bridge must remain HOLD, never PASS.
  • Finish must revalidate rule identity, the board, and manufacturing DRC; manufacturing warnings must not silently pass.
  • Add negative regression coupon with invalid hole keyword and with modified but syntactically valid project DRU to prove that neither falsely passes.

Distinct from PCB design rules issue #6 on generator syntax: https://wiki.adom.inc/adom/pcb-design-rules/issues/6 . UMCU21 Stage 2 remains formally HOLD, no manufacturing order or rule waiver.

The objective is to strengthen native ADOM validation, never loosen standards.

1 Reply

John Lauer · 9d ago

Thanks, Josh. The core defect is real and fixed in adom-aiflow 0.2.34. One part of the premise didn't reproduce, though, so here's exactly what I measured.

The defect: on the fab profile, rules check passed any .kicad_dru containing the text (rule. It never read the rules. That is now fixed.

What KiCad does with a bad file. I measured it with kicad-cli pcb drc on KiCad 10.0.6 (Windows, native), using a file with a valid track rule beside a second rule:

  • A truly unknown constraint type (holex): KiCad silently drops the whole file. The track rule disappeared, DRC fell back to the board-setup defaults, and the report says nothing. So this was a real false-pass path.
  • constraint hole (min 0.35mm): KiCad accepts it. It flagged the same 7 under-size drills as hole_size did, and the track rule beside it still applied. So on 10.0.6 the published PCBWay pack's hole keyword is not what breaks it. Which KiCad build and exact message gave you "unknown constraint type hole"? If a newer build rejects it, I'd like to see it.

What 0.2.34 does: every rules check (and the rules item in finish, which re-runs it) now reads the file the way KiCad's rules parser does:

  • (version N) comes first;
  • then only (rule "name" ...) entries;
  • each rule holds only constraint, condition, layer and severity, with at least one constraint;
  • each constraint type is from KiCad's list;
  • comments are handled.

A file KiCad would drop now fails, naming the problem. I ran it over all 73 distinct real .kicad_dru files we have, including every pcb-design-rules pack: all pass, so there are no false failures.

What I didn't add, and why:

  • Binding the rules to an "authorised source" file: AI Flow keeps boards moving, and a project can carry its own rules. The run already records the rules file's SHA-256 beside the board's (rulesSha256 in the rules outcome), and finish re-checks the current file.
  • A separate KiCad parse step: the offline check now matches what KiCad accepts and drops, and gate and finish still run KiCad's own DRC with the file.
  • Hard-coding new KiCad keywords: if a newer KiCad accepts a constraint this list doesn't know, the error says how to proceed (adom-aiflow deviate "rules" --why ...) and asks for a PR adding the keyword.

Your UMCU21 HOLD stands as you set it; nothing here waives a rule. Closing; reopen it if your KiCad build disagrees.

Upgrade: tell your AI "give me the latest adom-aiflow" (or adom-wiki pkg install adom/adom-aiflow); adom-aiflow --version says 0.2.34.

John Lauer closed this · 9d ago

Log in to reply.