Crate matter_commissioning 

Matter commissioning state machine.

This is Milestone 6 of the matter-rust roadmap. The crate is currently shipping in phases:

• M6.1: setup payload codec — see setup.
• M6.2.1: typed attestation cert wrappers (Dac, Pai, Paa) and PaaTrustStore — see attestation.
• M6.2.2 (current): verify_chain — rustls-webpki path validation with KeyUsage::client_auth(), plus a Matter VID/PID equality overlay. Six new AttestationError variants.
• M6.2.3: verify_attestation_response + matter.js byte-parity capture.
• M6.2.4–M6.2.6: see attestation.
• M6.3: Node Operational Certificate issuance — see noc.
• M6.4.2: attestation on-wire flow + off-wire AttestationVerification. State machine drives SendPaiCertRequest → SendDacCertRequest → SendAttestationRequest → AttestationVerification, chaining M6.2’s verify_chain + verify_attestation_response + the extract_attestation_elements_fields helper.
• M6.4.3: CD verification wired into AttestationVerification. The state machine now calls verify_certification_declaration against attestation::CdSigningRoots and advances past attestation on a valid CD; CommissionerConfig gains a cd_signing_roots reference.
• M6.4.4: CSR + NOC issuance flow. State machine drives SendOpCertSigningRequest → ValidateCsr → GenerateNocChain → SendTrustedRootCert → SendNoc, then advances to Stage::ReadNetworkCommissioningInfo (M6.5.2 expands the network subgraph). Integrates M6.3’s verify_csr_response + issue_noc + the OpCreds AddTrustedRoot / AddNOC encoders.
• M6.4.5: PASE→CASE handoff + CommissioningComplete. The state machine drives end-to-end from SecurePairing through Action::Done(CommissionedFabric) on canned responses plus a mock on_case_established() callback. New public API Commissioner::on_case_established for the M6.6 driver’s CASE handshake success signal; Expectation::CaseFailed for the failure path.
• M6.4 (complete): commissioning state machine. End-to-end cursor from SecurePairing through Action::Done(CommissionedFabric) on canned responses + a mock CASE-established callback. matter.js byte-parity gate infrastructure shipped — see state_machine for the API.
• M6.5 (current): Wi-Fi network commissioning. Expands the NetworkCommissioning no-op slot into the real Wi-Fi sub-cursor (ReadNetworkCommissioningInfo → NetworkSetup → FailsafeBeforeNetworkEnable → NetworkEnable; the generic stages also carry the M9-C2 Thread provisioning path). Ethernet-only devices skip the Wi-Fi sub-cursor entirely; Thread-only devices fail fast with a typed NetworkFeatureUnsupported error. New RemediationHint enum surfaces actionable categories for NetworkRejected. Failsafe-expiry now derives from BasicCommissioningInfo (was hardcoded 60s in M6.4). Optional tracing feature instruments every dispatch arm.
• M6.6.1 (current): Interaction Model framing — see im. build_invoke_request / parse_invoke_response, build_read_request / parse_report_data. Pure codec over matter-codec; the wire-I/O driver follows in M6.6.2+.
• M6.6 (next-next): Tokio driver + first real-device commission. Wires the M6.4 state machine into matter-transport’s session layer + drives matter-crypto’s SIGMA-I CASE handshake.

Quick-start (M6.1 only)

use matter_commissioning::setup::{parse_qr, parse_manual_code};
let from_qr = parse_qr("MT:Y.K90AFN00KA0648G00")?;
let from_manual = parse_manual_code("11693312331")?;
assert_eq!(from_qr.vendor_id, Some(0xFFF1));
assert_eq!(from_manual.passcode.as_u32(), 20_202_021);

Replace the QR string + manual code above with values captured for your own devices via cargo xtask capture-setup if you change the fixture set.

Optional tracing feature

Enable the tracing crate feature to get per-method spans on Commissioner::poll, Commissioner::on_response, and Commissioner::on_case_established. Span fields (stage, expectation) align best-effort with matter.js’s log-event format so operators can grep across both implementations. Compatibility is not guaranteed across matter.js minor versions.

Re-exports

pub use setup::encode_manual_code;

pub use setup::encode_qr;

pub use setup::parse_manual_code;

pub use setup::parse_qr;

pub use setup::CommissioningFlow;

pub use setup::DiscoveryCapabilities;

pub use setup::Discriminator;

pub use setup::Error as SetupError;

pub use setup::Passcode;

pub use setup::SetupPayload;

pub use attestation::extract_attestation_elements_fields;

pub use attestation::verify_attestation_response;

pub use attestation::verify_certification_declaration;

pub use attestation::verify_certification_declaration_with_paa;

pub use attestation::verify_chain;

pub use attestation::verify_dac_signed_elements;

pub use attestation::AttestationElementsFields;

pub use attestation::AttestationError;

pub use attestation::AttestationResponse;

pub use attestation::CdSigningRoots;

pub use attestation::ChainVerification;

pub use attestation::Dac;

pub use attestation::Paa;

pub use attestation::PaaTrustStore;

pub use attestation::Pai;

pub use attestation::ProductId;

pub use attestation::VendorId;

pub use noc::decode_attestation_response;

pub use noc::decode_certificate_chain_response;

pub use noc::decode_csr_response;

pub use noc::decode_noc_response;

pub use noc::encode_add_noc;

pub use noc::encode_add_trusted_root;

pub use noc::encode_attestation_request;

pub use noc::encode_certificate_chain_request;

pub use noc::encode_csr_request;

pub use noc::encode_update_noc;

pub use noc::issue_icac;

pub use noc::issue_noc;

pub use noc::parse_and_verify_csr;

pub use noc::parse_nocsr;

pub use noc::verify_csr_response;

pub use noc::CertChainType;

pub use noc::CertificateChainResponse;

pub use noc::CsrResponse;

pub use noc::FabricRecord;

pub use noc::NocError;

pub use noc::NocResponse;

pub use noc::NocRng;

pub use noc::NocsrElements;

pub use noc::ParsedCsr;

pub use noc::SystemNocRng;

pub use noc::VerifiedCsr;

pub use clusters::network_commissioning::decode_connect_network_response;

pub use clusters::network_commissioning::decode_feature_map;

pub use clusters::network_commissioning::decode_network_config_response;

pub use clusters::network_commissioning::encode_add_or_update_wifi_network;

pub use clusters::network_commissioning::encode_connect_network;

pub use clusters::network_commissioning::remediation_for;

pub use clusters::network_commissioning::ConnectNetworkResponse;

pub use clusters::network_commissioning::NetworkCommissioningFeature;

pub use clusters::network_commissioning::NetworkConfigResponse;

pub use state_machine::Action;

pub use state_machine::CommissionedFabric;

pub use state_machine::Commissioner;

pub use state_machine::CommissionerConfig;

pub use state_machine::CommissioningError;

pub use state_machine::Expectation;

pub use state_machine::NetworkCredentials;

pub use state_machine::NetworkKind;

pub use state_machine::RemediationHint;

pub use state_machine::SessionContext;

pub use state_machine::Stage;

pub use state_machine::WiFiCredentials;

pub use thread_dataset::ThreadDataset;

pub use thread_dataset::ThreadDatasetError;

pub use matter_interaction as im;

Modules

attestation

Matter device attestation verification.

clusters

Per-cluster command + attribute codecs for clusters used during commissioning.

error

Error type for matter-commissioning. Implemented in Milestone 6.

noc

Node Operational Certificate (NOC) issuance.

setup

Setup payload parsing and encoding for Matter QR codes and manual pairing codes (Matter Core Spec §5.1).

state_machine

Commissioning state machine. Implemented in Milestone 6.4.

thread_dataset

Thread operational dataset validation and Extended PAN ID extraction.

Structs

AttributePath

A concrete attribute path: (endpoint, cluster, attribute).

CommandPath

A concrete command path: (endpoint, cluster, command).

ReportData

Parsed ReportDataMessage (Matter §10.6.4).

Enums

ImError

Errors produced while building or parsing Interaction Model messages.

ImStatus

An Interaction Model status, as carried by a StatusIB.

InvokeResponse

Outcome of parsing a single-command InvokeResponseMessage.

Constants

IM_REVISION

Interaction Model protocol revision emitted at context tag 0xFF in every top-level IM message. Confirmed against the matter.js byte-parity fixture (see tests/im_byte_parity.rs); bump only when a captured fixture proves matter.js changed it.

Functions

build_invoke_request

Build an InvokeRequestMessage carrying a single command.

build_read_request

Build a ReadRequestMessage for one or more concrete attribute paths.

parse_invoke_response

Parse a single-command InvokeResponseMessage.

parse_report_data

Parse a ReportDataMessage into concrete (path, value) pairs.