Foundational, cleanly-scoped work — purely additive, genuinely inert in production (confirmed: the server is never constructed when AETHER_AUTOMATION is unset), no model internals touched, cross-platform via QLocalServer, and the QRhiWidget::grabFramebuffer() capture path is exactly right. I want this in. Requesting changes on one thing: the TX-safety guard, which is the bridge's headline guarantee and currently has real holes.

Blocking: isTransmitControl() misses TX-keying controls

The guard blocks QAbstractButtons whose name/text contains mox/ptt/tune/transmit/vox. The PR's verification covered MOX/Tune/ATU/VOX — but auditing the actual keying buttons in the GUI against those keywords, two genuinely key the transmitter and are not blocked, because they're labeled "Send":

• src/gui/CwxPanel.cpp:172 — QPushButton("Send") sends CW → keys TX. "send" matches no deny term, so invoke … click would transmit against a live radio.
• src/gui/Ax25HfPacketDecodeDialog.cpp:2608 — the terminal "Send" button transmits an AX.25 packet → keys TX. Also unguarded. (The dialog's primary "Transmit" button at :940 is caught — good.)

This is exactly the failure mode the guard exists to prevent (an agent keying a live transmitter during hardware-in-the-loop tests). The blocklist also over-blocks harmlessly — src/gui/MemoryDialog.cpp:432 "Tune" is a frequency-recall button, not a carrier (fail-safe direction, fine) — and the three "TX" buttons (EqApplet.cpp:188, AetherialAudioStrip.cpp:221, ClientChainApplet.cpp:101) look like RX/TX editor toggles rather than keying; a one-line confirmation would be good.

Requested change

The substring blocklist is structurally fragile: any TX-capable control whose name lacks a magic word is silently unguarded, and new keying controls added later inherit no protection. Please move to a positive marker the guard checks authoritatively — e.g. a dynamic property setProperty("aetherTxKeying", true) set on the genuinely-keying controls (MOX, PTT, Tune, ATU, CWX Send, packet Send), with isTransmitControl() honoring that property (keep the name heuristic as a belt-and-suspenders fallback if you like). At minimum, the CW-send and packet-send paths must be covered before this lands, since the guard is the safety story for running automation against real hardware.

Non-blocking (worth doing in the same pass)

1. Socket permissions. m_server->listen() is called without setSocketOptions(QLocalServer::UserAccessOption). For a TX-reachable socket whose path is advertised in a shared-temp discovery file, restricting to the owning user (0600) is the safer default. Cheap, and it closes "another local user drives my GUI."
2. RFC #3646 carries the rfc label and is still open — worth formally resolving it alongside this merge since it's the sanctioned RFC for the feature area.

Everything else looks great. Once the keying-control coverage is authoritative (positive marker incl. CW/packet send), I'm a yes.

Re-reviewed cef03f2b — every concern resolved, and the fix is better than what I asked for. Clearing my changes-requested.

TX guard is now marker-driven (verified against the diff):

• isTransmitControl() checks the aetherTxKeying property first (authoritative), before any name heuristic — a control is blocked because it was declared keying, not because its label matched a word. ✓
• Every genuinely-keying control is marked at its creation site: CWX Send and packet Send (the two I flagged), plus Beacon Now and Send APRS Msg (which you found — same failure mode, I'd missed them), plus TUNE/MOX/ATU and the AtuPreTuneDialog per-point wizard buttons. Confirmed each markTxKeying(m_…) call site, and that every caller #includes TxKeyingMarker.h. ✓
• Name heuristic retained as a logged belt-and-suspenders fallback that warns the control needs an explicit markTxKeying(). Good defense-in-depth. ✓
• dumpTree reports "keying": true on marked controls, so an agent sees what invoke() will refuse before trying. Nice touch. ✓
• The three "TX" buttons confirmed as non-keying editor/view toggles, correctly left unmarked. ✓

Non-blocking, both done:

• Socket setSocketOptions(QLocalServer::UserAccessOption) before listen() — owner-only endpoint. ✓
• RFC #3646 to be closed as the sanctioned RFC on merge. 👍

Approving. One gate left: CI is mid-run on this commit (build/macOS/Windows/analyze pending) — merge once those go green. Excellent work, and thanks for hunting down the extra two keying buttons.

Thanks for this, @jensenpat — this is an exceptionally well-built and well-documented feature. The marker-based TX guard (markTxKeying() / aetherTxKeying) is the right design: declaring intent at the creation site is far more robust than a substring blocklist, and it correctly catches the "Send" / "Beacon Now" buttons no keyword would. CI is green across build/macOS/Windows/CodeQL/a11y, the change is cleanly scoped (purely additive, model internals untouched), error handling at the socket/JSON boundary is thorough, and lifetime/teardown ordering in main.cpp is correct (the automation unique_ptr destructs before window, so the QPointer<RadioModel> never dangles). Nice work.

One finding worth addressing before merge, plus a couple of minor notes.

dumpTree leaks password fields in cleartext (worth fixing)

widgetValue() returns le->text() for any QLineEdit (AutomationServer.cpp), with no check on echo mode. There are at least two QLineEdit::Password fields in the app:

• src/gui/ConnectionPanel.cpp:407 — radio connection password
• src/gui/MqttSettingsDialog.cpp:110 — MQTT broker password

So dumpTree (and the tree.json that automation_probe.py demo writes to a temp file) will serialize those secrets in plaintext whenever the relevant dialog has been opened. The socket is same-user 0600 and the whole bridge is opt-in behind AETHER_AUTOMATION, so this isn't a privilege-escalation hole — but writing live credentials into a world-readable temp artifact (tree.json) is an easy footgun for an agent or CI run. Cheap fix in widgetValue():

if (auto* le = qobject_cast<const QLineEdit*>(w))
    return le->echoMode() == QLineEdit::Normal ? le->text() : QStringLiteral("<hidden>");

(That preserves assertability — an agent can still confirm the field is non-empty — without exfiltrating the value.)

Minor notes (non-blocking)

• Concurrent-instance socket clobber. start() unconditionally calls QLocalServer::removeServer(serverName) before listen(). That's correct for the stale-socket self-heal you describe, but if a second AETHER_AUTOMATION=1 instance launches with the default socket name it silently steals the endpoint and rewrites the shared discovery file out from under the first. Edge case (two automation-enabled instances), and probably fine to leave — but a one-line log line noting the takeover, or appending the PID to the default socket name, would make it less surprising.
• grab writes to a client-supplied path. Any path the running user can write is fair game. Same-user/opt-in makes this acceptable, just flagging it as intentional surface.

Neither minor note blocks merge; the password-field point is the one I'd like to see handled. Overall this is a clean, high-quality addition.

_{🤖 aethersdr-agent · cost: $4.5361 · model: claude-opus-4-8}