sunnypilot v2026.002.000

version: sunnypilot v2026.002.000 (staging)
date: 2026-07-21T07:44:02
master commit: 2c334ede443d7391d27575af8c854a095ba702a8

openpilot/sunnypilot/sunnylink/tests/test_capabilities.py

@@ -0,0 +1,92 @@
+"""
+Copyright (c) 2021-, Haibin Wen, sunnypilot, and a number of other contributors.
+
+This file is part of sunnypilot and is licensed under the MIT License.
+See the LICENSE.md file in the root directory for more details.
+
+Sentinel tests for the capabilities payload contract. PROTOCOL_VERSION is the
+wire-protocol version observable by the dashboard; bumping it is a breaking
+change and must be intentional. KNOWN_PROTOCOL_VERSIONS pins the set we
+explicitly support — when the constant is bumped, this list must be edited in
+the same commit so the bump shows up in code review.
+"""
+from __future__ import annotations
+
+import pytest
+
+from openpilot.sunnypilot.sunnylink.capabilities import (
+  CAPABILITY_DEFAULTS,
+  CAPABILITY_FIELDS,
+  CAPABILITY_LABELS,
+  PROTOCOL_VERSION,
+  generate_capabilities,
+)
+
+
+KNOWN_PROTOCOL_VERSIONS = (1,)
+LATEST_KNOWN = max(KNOWN_PROTOCOL_VERSIONS)
+
+
+@pytest.fixture(scope="module")
+def caps():
+  return generate_capabilities()
+
+
+class TestProtocolVersion:
+  def test_protocol_version_in_capability_fields(self):
+    assert "protocol_version" in CAPABILITY_FIELDS
+
+  def test_protocol_version_has_label(self):
+    assert "protocol_version" in CAPABILITY_LABELS
+
+  def test_protocol_version_default_is_set(self):
+    assert CAPABILITY_DEFAULTS.get("protocol_version") == PROTOCOL_VERSION
+
+  def test_protocol_version_emitted(self, caps):
+    assert "protocol_version" in caps
+    assert isinstance(caps["protocol_version"], int)
+    assert caps["protocol_version"] >= 1
+
+  def test_protocol_version_matches_constant(self, caps):
+    assert caps["protocol_version"] == PROTOCOL_VERSION
+
+  def test_protocol_version_is_known(self):
+    """Sentinel against accidental bumps. Edit KNOWN_PROTOCOL_VERSIONS if intentional."""
+    assert PROTOCOL_VERSION in KNOWN_PROTOCOL_VERSIONS, (
+      f"PROTOCOL_VERSION={PROTOCOL_VERSION} is not in KNOWN_PROTOCOL_VERSIONS={KNOWN_PROTOCOL_VERSIONS}. " +
+      "If this bump is intentional, add it to KNOWN_PROTOCOL_VERSIONS."
+    )
+
+  def test_protocol_version_matches_latest_known(self):
+    assert PROTOCOL_VERSION == LATEST_KNOWN, (
+      "Test invariant: PROTOCOL_VERSION must equal max(KNOWN_PROTOCOL_VERSIONS)."
+    )
+
+
+class TestOpaquePerBrandFlags:
+  def test_subaru_has_sng_field_present(self):
+    assert "subaru_has_sng" in CAPABILITY_FIELDS
+
+  def test_hyundai_alpha_long_available_field_present(self):
+    assert "hyundai_alpha_long_available" in CAPABILITY_FIELDS
+
+  def test_subaru_has_sng_default_false(self, caps):
+    assert caps["subaru_has_sng"] is False
+
+  def test_hyundai_alpha_long_available_default_false(self, caps):
+    assert caps["hyundai_alpha_long_available"] is False
+
+
+class TestCapabilitiesShape:
+  def test_all_fields_present(self, caps):
+    for field in CAPABILITY_FIELDS:
+      assert field in caps, f"capabilities missing {field}"
+
+  def test_all_fields_have_labels(self):
+    for field in CAPABILITY_FIELDS:
+      assert field in CAPABILITY_LABELS, f"CAPABILITY_LABELS missing {field}"
+
+  def test_string_defaults_are_strings(self, caps):
+    assert isinstance(caps["brand"], str)
+    assert isinstance(caps["steer_control_type"], str)
+    assert isinstance(caps["device_type"], str)

openpilot/sunnypilot/sunnylink/tests/test_compile_settings_ui.py

@@ -0,0 +1,194 @@
+"""
+Copyright (c) 2021-, Haibin Wen, sunnypilot, and a number of other contributors.
+
+This file is part of sunnypilot and is licensed under the MIT License.
+See the LICENSE.md file in the root directory for more details.
+
+Tests for the settings_ui_src/ -> settings_ui.json compiler. Covers:
+  - Roundtrip: compiled output matches the checked-in settings_ui.json
+  - $ref macro resolution semantics (list-splice, scalar-substitute, depth, cycles)
+  - Per-page tree integrity (every page has id; vehicle page emits to vehicle_settings)
+
+Does not cover device-side generator (test_settings_schema.py) or per-bug
+regression (test_settings_changes.py); those continue to validate the
+compiled output once the compiler has produced it.
+"""
+from __future__ import annotations
+
+import difflib
+import json
+import os
+
+import pytest
+import yaml
+
+from openpilot.sunnypilot.sunnylink.tools.compile_settings_ui import (
+  CompileError,
+  DEFAULT_OUT,
+  DEFAULT_SRC,
+  _resolve_refs,
+  compile_schema,
+)
+
+
+@pytest.fixture(scope="module")
+def compiled() -> dict:
+  return compile_schema(DEFAULT_SRC)
+
+
+@pytest.fixture(scope="module")
+def committed() -> dict:
+  with open(DEFAULT_OUT) as f:
+    return json.load(f)
+
+
+class TestRoundtrip:
+  def test_compiled_matches_committed(self, compiled, committed):
+    """Compiled output must match the checked-in JSON."""
+    if compiled == committed:
+      return
+    diff = "\n".join(difflib.unified_diff(
+      json.dumps(committed, indent=2).splitlines(),
+      json.dumps(compiled, indent=2).splitlines(),
+      fromfile="settings_ui.json (committed)",
+      tofile="settings_ui.json (freshly compiled)",
+      lineterm="",
+    ))
+    pytest.fail(f"settings_ui.json schema mismatch — run compile_settings_ui.py\n\n{diff}")
+
+  def test_committed_file_is_canonical(self):
+    """Compiled output must byte-match the checked-in file (including trailing newline).
+    Drift means someone edited settings_ui.json by hand instead of editing settings_ui_src/."""
+    schema = compile_schema(DEFAULT_SRC)
+    rendered = json.dumps(schema, indent=2) + "\n"
+    with open(DEFAULT_OUT) as f:
+      current = f.read()
+    if current == rendered:
+      return
+    diff = "\n".join(difflib.unified_diff(
+      current.splitlines(),
+      rendered.splitlines(),
+      fromfile="settings_ui.json (on disk)",
+      tofile="settings_ui.json (freshly compiled)",
+      lineterm="",
+    ))
+    pytest.fail(f"settings_ui.json out of sync — run compile_settings_ui.py\n\n{diff}")
+
+
+class TestRefResolution:
+  def test_list_context_splices(self):
+    macros = {"a": [{"type": "offroad_only"}], "b": [{"type": "not_engaged"}]}
+    out = _resolve_refs([{"$ref": "#/macros/a"}, {"$ref": "#/macros/b"}], macros)
+    assert out == [{"type": "offroad_only"}, {"type": "not_engaged"}]
+
+  def test_scalar_context_substitutes(self):
+    macros = {"x": {"type": "capability", "field": "brand", "equals": "tesla"}}
+    out = _resolve_refs({"condition": {"$ref": "#/macros/x"}}, macros)
+    assert out == {"condition": {"type": "capability", "field": "brand", "equals": "tesla"}}
+
+  def test_chained_ref_resolves(self):
+    macros = {
+      "leaf": [{"type": "offroad_only"}],
+      "middle": [{"$ref": "#/macros/leaf"}],
+    }
+    out = _resolve_refs([{"$ref": "#/macros/middle"}], macros)
+    assert out == [{"type": "offroad_only"}]
+
+  def test_unknown_macro_raises(self):
+    with pytest.raises(CompileError, match="unknown macro"):
+      _resolve_refs([{"$ref": "#/macros/missing"}], {})
+
+  def test_cycle_raises(self):
+    macros = {"a": [{"$ref": "#/macros/b"}], "b": [{"$ref": "#/macros/a"}]}
+    with pytest.raises(CompileError, match="cycle"):
+      _resolve_refs([{"$ref": "#/macros/a"}], macros)
+
+  def test_depth_limit(self):
+    # Depth 4 chain should fail (limit is 3).
+    macros = {
+      "l1": [{"$ref": "#/macros/l2"}],
+      "l2": [{"$ref": "#/macros/l3"}],
+      "l3": [{"$ref": "#/macros/l4"}],
+      "l4": [{"type": "offroad_only"}],
+    }
+    with pytest.raises(CompileError, match="depth"):
+      _resolve_refs([{"$ref": "#/macros/l1"}], macros)
+
+  def test_invalid_ref_scheme(self):
+    with pytest.raises(CompileError, match="unsupported"):
+      _resolve_refs([{"$ref": "https://example.com/x"}], {})
+
+  def test_scalar_macro_in_list_context_raises(self):
+    macros = {"x": {"type": "offroad_only"}}  # macro is a single rule (dict), not a list
+    with pytest.raises(CompileError, match="must resolve to a list"):
+      _resolve_refs([{"$ref": "#/macros/x"}], macros)
+
+
+class TestCompiledShape:
+  def test_panels_present(self, compiled):
+    assert isinstance(compiled["panels"], list)
+    assert len(compiled["panels"]) == 9
+    panel_ids = {p["id"] for p in compiled["panels"]}
+    assert {"steering", "cruise", "display", "visuals", "toggles",
+            "device", "software", "developer", "models"} <= panel_ids
+
+  def test_vehicle_settings_consistent_shape(self, compiled):
+    """Each brand in vehicle_settings must have {title, description, items}."""
+    for brand, data in compiled["vehicle_settings"].items():
+      assert isinstance(data, dict), f"{brand}: expected object, got {type(data).__name__}"
+      assert "title" in data, f"{brand}: missing title"
+      assert "description" in data, f"{brand}: missing description"
+      assert "items" in data, f"{brand}: missing items"
+
+  def test_no_dangling_refs_after_compile(self, compiled):
+    """All $ref objects must be resolved during compilation."""
+    def walk(node):
+      if isinstance(node, dict):
+        if "$ref" in node:
+          pytest.fail(f"unresolved $ref: {node}")
+        for v in node.values():
+          walk(v)
+      elif isinstance(node, list):
+        for x in node:
+          walk(x)
+    walk(compiled)
+
+
+class TestSourceTreeIntegrity:
+  def test_macros_yaml_well_formed(self):
+    with open(os.path.join(DEFAULT_SRC, "_macros.yaml")) as f:
+      doc = yaml.safe_load(f)
+    assert "macros" in doc
+    for name, body in doc["macros"].items():
+      assert name.replace("_", "").isalnum(), f"macro name '{name}' must be alphanumeric_"
+      assert body, f"macro '{name}' empty"
+
+  def test_pages_dir_well_formed(self):
+    pages_dir = os.path.join(DEFAULT_SRC, "pages")
+    assert os.path.isdir(pages_dir), "pages/ directory missing"
+    page_files = sorted(fn for fn in os.listdir(pages_dir) if fn.endswith(".yaml"))
+    # 9 panels + 1 vehicle = 10
+    assert len(page_files) == 10, f"expected 10 pages, found {len(page_files)}: {page_files}"
+
+  def test_every_page_has_id(self):
+    pages_dir = os.path.join(DEFAULT_SRC, "pages")
+    for fn in sorted(os.listdir(pages_dir)):
+      if not fn.endswith(".yaml"):
+        continue
+      path = os.path.join(pages_dir, fn)
+      with open(path) as f:
+        doc = yaml.safe_load(f)
+      assert isinstance(doc, dict), f"{path}: top-level must be a mapping"
+      assert "id" in doc, f"{path}: page missing 'id'"
+      # File basename should match page id (modulo .yaml extension).
+      expected_id = os.path.splitext(fn)[0]
+      assert doc["id"] == expected_id, (
+        f"{path}: page id '{doc['id']}' must match filename '{expected_id}'"
+      )
+
+  def test_vehicle_page_kind(self):
+    """vehicle.yaml must declare kind: vehicle so it routes to vehicle_settings."""
+    path = os.path.join(DEFAULT_SRC, "pages", "vehicle.yaml")
+    with open(path) as f:
+      doc = yaml.safe_load(f)
+    assert doc.get("kind") == "vehicle", "vehicle.yaml must declare kind: vehicle"

openpilot/sunnypilot/sunnylink/tests/test_settings_changes.py

@@ -0,0 +1,219 @@
+"""
+Copyright (c) 2021-, Haibin Wen, sunnypilot, and a number of other contributors.
+
+This file is part of sunnypilot and is licensed under the MIT License.
+See the LICENSE.md file in the root directory for more details.
+
+Per-bug regression tests for the Raylib-vs-schema parity audit. Each test
+isolates one of the gating bugs that the design-overhaul branch fixes so a
+future regression is loud and obvious. These tests are intentionally narrow
+and additive — they do not replace the broader test_settings_schema.py.
+"""
+from __future__ import annotations
+
+import json
+import os
+from typing import Any
+
+import pytest
+
+from openpilot.sunnypilot.sunnylink.tools.generate_settings_schema import (
+  DEFINITION_PATH,
+  TORQUE_VERSIONS_PATH,
+  _build_torque_options,
+  _load_torque_versions,
+  generate_schema,
+)
+
+
+SCHEMA_VALIDATOR_PATH = os.path.join(os.path.dirname(DEFINITION_PATH), "settings_ui.schema.json")
+
+
+def _walk_items(schema: dict[str, Any]):
+  """Yield every item dict from the schema."""
+  def _yield(item: dict[str, Any]):
+    yield item
+    for sub in item.get("sub_items", []):
+      yield from _yield(sub)
+
+  for panel in schema.get("panels", []):
+    for section in panel.get("sections", []):
+      for item in section.get("items", []):
+        yield from _yield(item)
+      for sp in section.get("sub_panels", []):
+        for item in sp.get("items", []):
+          yield from _yield(item)
+    for item in panel.get("items", []):
+      yield from _yield(item)
+    for sp in panel.get("sub_panels", []):
+      for item in sp.get("items", []):
+        yield from _yield(item)
+  for brand in schema.get("vehicle_settings", {}).values():
+    items = brand.get("items", []) if isinstance(brand, dict) else brand
+    for item in items:
+      yield from _yield(item)
+
+
+def _find_item(schema: dict[str, Any], key: str) -> dict[str, Any] | None:
+  for item in _walk_items(schema):
+    if item.get("key") == key:
+      return item
+  return None
+
+
+def _find_section(schema: dict[str, Any], panel_id: str, section_id: str) -> dict[str, Any] | None:
+  for panel in schema.get("panels", []):
+    if panel.get("id") != panel_id:
+      continue
+    for section in panel.get("sections", []):
+      if section.get("id") == section_id:
+        return section
+  return None
+
+
+def _flatten_rule_types(rules: list[dict[str, Any]] | None) -> set[str]:
+  out: set[str] = set()
+
+  def _walk(rule: dict[str, Any]) -> None:
+    out.add(rule.get("type", ""))
+    if rule.get("type") == "not" and "condition" in rule:
+      _walk(rule["condition"])
+    elif rule.get("type") in ("any", "all"):
+      for c in rule.get("conditions", []):
+        _walk(c)
+
+  for rule in rules or []:
+    _walk(rule)
+  return out
+
+
+def _references_capability_field(rules: list[dict[str, Any]] | None, field: str) -> bool:
+  found = False
+
+  def _walk(rule: dict[str, Any]) -> None:
+    nonlocal found
+    if rule.get("type") == "capability" and rule.get("field") == field:
+      found = True
+    elif rule.get("type") == "not" and "condition" in rule:
+      _walk(rule["condition"])
+    elif rule.get("type") in ("any", "all"):
+      for c in rule.get("conditions", []):
+        _walk(c)
+
+  for rule in rules or []:
+    _walk(rule)
+  return found
+
+
+@pytest.fixture(scope="module")
+def schema():
+  return generate_schema()
+
+
+class TestMadsBrandGates:
+  def test_mads_main_cruise_has_brand_gate(self, schema):
+    """MadsMainCruiseAllowed must gate on brand and tesla_has_vehicle_bus."""
+    item = _find_item(schema, "MadsMainCruiseAllowed")
+    assert item is not None
+    assert _references_capability_field(item.get("enablement"), "brand")
+    assert _references_capability_field(item.get("enablement"), "tesla_has_vehicle_bus")
+
+  def test_mads_unified_engagement_has_brand_gate(self, schema):
+    """MadsUnifiedEngagementMode must mirror MadsMainCruiseAllowed brand-gate."""
+    item = _find_item(schema, "MadsUnifiedEngagementMode")
+    assert item is not None
+    assert _references_capability_field(item.get("enablement"), "brand")
+    assert _references_capability_field(item.get("enablement"), "tesla_has_vehicle_bus")
+
+
+class TestTestManeuversSection:
+  def test_lateral_maneuver_mode_in_test_maneuvers(self, schema):
+    section = _find_section(schema, "developer", "test_maneuvers")
+    assert section is not None, "developer.test_maneuvers section missing"
+    keys = {item["key"] for item in section.get("items", [])}
+    assert "LateralManeuverMode" in keys
+    assert "LongitudinalManeuverMode" in keys
+
+  def test_test_maneuvers_section_requires_attestation(self, schema):
+    section = _find_section(schema, "developer", "test_maneuvers")
+    assert section is not None
+    assert section.get("attestation_required") is True
+
+  def test_test_maneuvers_section_visibility_gate(self, schema):
+    section = _find_section(schema, "developer", "test_maneuvers")
+    assert section is not None
+    visibility = section.get("visibility")
+    assert visibility, "test_maneuvers must have visibility gate"
+    vis_refs = json.dumps(visibility)
+    assert "is_development" in vis_refs
+    assert "is_sp_release" in vis_refs
+    enablement = section.get("enablement") or []
+    enable_refs = json.dumps(enablement)
+    assert "ShowAdvancedControls" in enable_refs, \
+      "test_maneuvers must gate ShowAdvancedControls via enablement"
+
+
+class TestValidator:
+  def test_validator_accepts_real_json(self):
+    """settings_ui.json validates against settings_ui.schema.json."""
+    jsonschema = pytest.importorskip("jsonschema")
+    with open(DEFINITION_PATH) as f:
+      data = json.load(f)
+    with open(SCHEMA_VALIDATOR_PATH) as f:
+      validator = json.load(f)
+    jsonschema.validate(instance=data, schema=validator)
+
+
+class TestTorqueOptionGeneration:
+  def test_torque_versions_match_generated_options(self, schema):
+    versions = _load_torque_versions()
+    assert versions, "latcontrol_torque_versions.json must have at least one version"
+    expected = _build_torque_options(versions)
+    item = _find_item(schema, "TorqueControlTune")
+    assert item is not None, "TorqueControlTune item must be present"
+    assert item.get("options") == expected
+
+  def test_torque_versions_path_resolves(self):
+    assert os.path.exists(TORQUE_VERSIONS_PATH), (
+      f"latcontrol_torque_versions.json not found at {TORQUE_VERSIONS_PATH}"
+    )
+
+
+class TestReleaseBranchGates:
+  @pytest.mark.parametrize("key", [
+    "EnableGithubRunner",
+    "QuickBootToggle",
+  ])
+  def test_sp_dev_items_gate_on_is_sp_release(self, schema, key):
+    """sunnypilot dev items must hide on sunnypilot release branches (is_sp_release gate)."""
+    item = _find_item(schema, key)
+    assert item is not None, f"{key} not found in schema"
+    rules = (item.get("visibility") or []) + (item.get("enablement") or [])
+    assert _references_capability_field(rules, "is_sp_release"), f"{key} missing is_sp_release gate"
+
+
+class TestSpuriousOffroadGatesDropped:
+  def test_disengage_on_accelerator_has_no_offroad_only(self, schema):
+    item = _find_item(schema, "DisengageOnAccelerator")
+    assert item is not None
+    assert "offroad_only" not in _flatten_rule_types(item.get("enablement"))
+
+  def test_dynamic_experimental_has_no_offroad_only(self, schema):
+    item = _find_item(schema, "DynamicExperimentalControl")
+    assert item is not None
+    assert "offroad_only" not in _flatten_rule_types(item.get("enablement"))
+
+
+class TestNotEngagedReplacement:
+  @pytest.mark.parametrize("key", [
+    "AlphaLongitudinalEnabled",
+    "ToyotaEnforceStockLongitudinal",
+    "ToyotaStopAndGoHack",
+  ])
+  def test_offroad_only_replaced_with_not_engaged(self, schema, key):
+    """These items should use not_engaged, not offroad_only."""
+    item = _find_item(schema, key)
+    assert item is not None, f"{key} not found"
+    rule_types = _flatten_rule_types(item.get("enablement"))
+    assert "offroad_only" not in rule_types, f"{key} still uses offroad_only"
+    assert "not_engaged" in rule_types, f"{key} missing not_engaged"

openpilot/sunnypilot/sunnylink/tests/test_settings_schema.py

@@ -0,0 +1,353 @@
+"""
+Copyright (c) 2021-, Haibin Wen, sunnypilot, and a number of other contributors.
+
+This file is part of sunnypilot and is licensed under the MIT License.
+See the LICENSE.md file in the root directory for more details.
+"""
+import json
+import pytest
+
+from openpilot.common.params import Params
+from openpilot.sunnypilot.sunnylink.tools.generate_settings_schema import (
+  SCHEMA_VERSION,
+  generate_schema,
+  generate_schema_json,
+  collect_all_keys,
+  collect_capability_refs,
+)
+from openpilot.sunnypilot.sunnylink.capabilities import CAPABILITY_FIELDS
+
+
+VALID_WIDGET_TYPES = {"toggle", "option", "multiple_button", "button", "info"}
+VALID_RULE_TYPES = {"offroad_only", "not_engaged", "capability", "param", "param_compare", "not", "any", "all"}
+VALID_COMPARE_OPS = {">", "<", ">=", "<="}
+MAX_ALLOWED_MISSING_TITLES = 0  # All items must have titles (metadata is inline in settings_ui.json)
+
+
+def _iter_panel_items(panel: dict):
+  """Yield top-level items from a panel (non-recursive)."""
+  for item in panel.get("items", []):
+    yield item
+  for sp in panel.get("sub_panels", []):
+    for item in sp.get("items", []):
+      yield item
+  for section in panel.get("sections", []):
+    for item in section.get("items", []):
+      yield item
+    for sp in section.get("sub_panels", []):
+      for item in sp.get("items", []):
+        yield item
+
+
+def _iter_all_sub_panels(panel: dict):
+  """Yield all sub_panels from a panel and its sections."""
+  yield from panel.get("sub_panels", [])
+  for section in panel.get("sections", []):
+    yield from section.get("sub_panels", [])
+
+
+def _brand_items(brand_data) -> list[dict]:
+  """Extract items from vehicle_settings[brand] (handles dict or list)."""
+  if isinstance(brand_data, dict):
+    return brand_data.get("items", [])
+  if isinstance(brand_data, list):
+    return brand_data
+  return []
+
+
+@pytest.fixture(scope="module")
+def schema():
+  return generate_schema()
+
+
+@pytest.fixture(scope="module")
+def all_param_keys():
+  """All keys registered in the device param store."""
+  return {k.decode("utf-8") for k in Params().all_keys()}
+
+
+class TestSchemaStructure:
+  def test_schema_is_valid_json(self):
+    """Schema serializes to valid JSON."""
+    raw = generate_schema_json()
+    parsed = json.loads(raw)
+    assert isinstance(parsed, dict)
+
+  def test_has_required_top_level_fields(self, schema):
+    assert "schema_version" in schema
+    assert schema["schema_version"] == SCHEMA_VERSION
+    assert "generated_at" in schema
+    assert "panels" in schema
+    assert "vehicle_settings" in schema
+    assert "capability_fields" in schema
+
+  def test_panels_are_list(self, schema):
+    assert isinstance(schema["panels"], list)
+    assert len(schema["panels"]) > 0
+
+  def test_all_panels_have_required_fields(self, schema):
+    for panel in schema["panels"]:
+      assert "id" in panel, f"Panel missing 'id': {panel}"
+      assert "label" in panel, f"Panel {panel.get('id')} missing 'label'"
+      assert "order" in panel, f"Panel {panel.get('id')} missing 'order'"
+      has_sections = "sections" in panel
+      has_items = "items" in panel
+      assert has_sections or has_items, \
+        f"Panel {panel['id']} must have 'sections' or 'items'"
+      if has_sections:
+        assert isinstance(panel["sections"], list)
+        for sec in panel["sections"]:
+          assert "id" in sec, f"Section in panel {panel['id']} missing 'id'"
+          assert "items" in sec, f"Section {panel['id']}.{sec.get('id')} missing 'items'"
+          assert isinstance(sec["items"], list)
+      if has_items:
+        assert isinstance(panel["items"], list)
+
+  def test_all_items_have_key_and_widget(self, schema):
+    for panel in schema["panels"]:
+      for item in _iter_panel_items(panel):
+        assert "key" in item, f"Item in panel {panel['id']} missing 'key'"
+        assert "widget" in item, f"Item {item.get('key')} missing 'widget'"
+        assert item["widget"] in VALID_WIDGET_TYPES, \
+          f"Item {item['key']} has invalid widget type: {item['widget']}"
+
+  def test_sub_panel_items_have_key_and_widget(self, schema):
+    for panel in schema["panels"]:
+      for sp in _iter_all_sub_panels(panel):
+        assert "id" in sp
+        assert "items" in sp
+        for item in sp["items"]:
+          assert "key" in item
+          assert "widget" in item
+          assert item["widget"] in VALID_WIDGET_TYPES
+
+  def test_vehicle_settings_structure(self, schema):
+    vs = schema["vehicle_settings"]
+    assert isinstance(vs, dict)
+    for brand, data in vs.items():
+      assert isinstance(brand, str)
+      assert isinstance(data, dict), \
+        f"vehicle_settings[{brand}] must be a dict {{title, items, ...}}"
+      assert "items" in data, f"vehicle_settings[{brand}] missing 'items'"
+      assert isinstance(data["items"], list)
+      for item in data["items"]:
+        assert "key" in item, f"Vehicle item for {brand} missing 'key'"
+        assert "widget" in item, f"Vehicle item {item.get('key')} missing 'widget'"
+
+  def test_no_duplicate_keys_across_panels(self, schema):
+    """Param keys should appear in at most one panel."""
+    seen: dict[str, str] = {}  # key -> panel_id
+    for panel in schema["panels"]:
+      for item in _iter_panel_items(panel):
+        key = item["key"]
+        if key in seen:
+          pytest.fail(f"Key '{key}' appears in both panel '{seen[key]}' and '{panel['id']}'")
+        seen[key] = panel["id"]
+        for sub in item.get("sub_items", []):
+          sub_key = sub["key"]
+          if sub_key in seen:
+            pytest.fail(f"Sub-item key '{sub_key}' appears in both '{seen[sub_key]}' and '{panel['id']}'")
+          seen[sub_key] = panel["id"]
+
+
+class TestSchemaCoverage:
+  def test_all_schema_keys_exist_in_params(self, schema, all_param_keys):
+    """Schema keys must exist in Params().all_keys()."""
+    schema_keys = collect_all_keys(schema)
+    missing = schema_keys - all_param_keys
+    assert not missing, f"Schema references keys not in Params: {missing}"
+
+  def test_all_capability_fields_are_declared(self, schema):
+    """Capability fields used in rules must be declared."""
+    declared = set(schema["capability_fields"])
+    referenced = collect_capability_refs(schema)
+    undeclared = referenced - declared
+    assert not undeclared, f"Rules reference undeclared capability fields: {undeclared}"
+
+  def test_capability_fields_match_constant(self, schema):
+    """Schema capability_fields must match CAPABILITY_FIELDS constant."""
+    assert set(schema["capability_fields"]) == set(CAPABILITY_FIELDS)
+
+
+class TestRuleWellFormedness:
+  def _validate_rule(self, rule: dict, context: str = ""):
+    """Recursively validate a single rule dict."""
+    assert "type" in rule, f"Rule missing 'type' in {context}"
+    rtype = rule["type"]
+    assert rtype in VALID_RULE_TYPES, f"Invalid rule type '{rtype}' in {context}"
+
+    if rtype == "capability":
+      assert "field" in rule, f"Capability rule missing 'field' in {context}"
+      assert "equals" in rule, f"Capability rule missing 'equals' in {context}"
+    elif rtype == "param":
+      assert "key" in rule, f"Param rule missing 'key' in {context}"
+      assert "equals" in rule, f"Param rule missing 'equals' in {context}"
+    elif rtype == "param_compare":
+      assert "key" in rule, f"Param compare rule missing 'key' in {context}"
+      assert "op" in rule, f"Param compare rule missing 'op' in {context}"
+      assert rule["op"] in VALID_COMPARE_OPS, f"Invalid op '{rule['op']}' in {context}"
+      assert "value" in rule, f"Param compare rule missing 'value' in {context}"
+    elif rtype == "not":
+      assert "condition" in rule, f"Not rule missing 'condition' in {context}"
+      self._validate_rule(rule["condition"], context=f"{context} > not")
+    elif rtype in ("any", "all"):
+      assert "conditions" in rule, f"{rtype} rule missing 'conditions' in {context}"
+      assert isinstance(rule["conditions"], list)
+      for c in rule["conditions"]:
+        self._validate_rule(c, context=f"{context} > {rtype}")
+
+  def _validate_items(self, items: list[dict], context: str):
+    for item in items:
+      key = item.get("key", "unknown")
+      for rules_field in ("visibility", "enablement"):
+        rules = item.get(rules_field)
+        if rules:
+          assert isinstance(rules, list), f"{key}.{rules_field} must be a list"
+          for rule in rules:
+            self._validate_rule(rule, context=f"{context}.{key}.{rules_field}")
+      for sub in item.get("sub_items", []):
+        self._validate_items([sub], context=f"{context}.{key}")
+
+  def _validate_section_rules(self, section: dict, context: str):
+    for rules_field in ("visibility", "enablement"):
+      rules = section.get(rules_field) or []
+      for rule in rules:
+        self._validate_rule(rule, context=f"{context}.{rules_field}")
+
+  def test_all_panel_rules_well_formed(self, schema):
+    for panel in schema["panels"]:
+      self._validate_items(list(_iter_panel_items(panel)), context=f"panel:{panel['id']}")
+      for sp in _iter_all_sub_panels(panel):
+        self._validate_items(sp["items"], context=f"subpanel:{sp['id']}")
+      for section in panel.get("sections", []):
+        self._validate_section_rules(section, context=f"section:{panel['id']}.{section['id']}")
+
+  def test_all_vehicle_rules_well_formed(self, schema):
+    for brand, data in schema["vehicle_settings"].items():
+      self._validate_items(_brand_items(data), context=f"vehicle:{brand}")
+
+  def test_no_self_referencing_visibility(self, schema):
+    """An item's visibility/enablement rules should not depend on its own key."""
+    def _check_self_ref(item: dict, rules_field: str):
+      key = item.get("key")
+      for rule in item.get(rules_field, []):
+        if rule.get("type") == "param" and rule.get("key") == key:
+          pytest.fail(f"Item {key} has self-referencing {rules_field} rule")
+
+    for panel in schema["panels"]:
+      for item in _iter_panel_items(panel):
+        _check_self_ref(item, "visibility")
+        _check_self_ref(item, "enablement")
+
+    for brand_data in schema.get("vehicle_settings", {}).values():
+      for item in _brand_items(brand_data):
+        _check_self_ref(item, "visibility")
+        _check_self_ref(item, "enablement")
+
+
+class TestKnownPanels:
+  def test_expected_panels_exist(self, schema):
+    panel_ids = {p["id"] for p in schema["panels"]}
+    expected = {"steering", "cruise", "display", "visuals", "device", "software", "developer"}
+    assert expected.issubset(panel_ids), f"Missing panels: {expected - panel_ids}"
+
+  def test_mads_sub_panel_exists(self, schema):
+    steering = next(p for p in schema["panels"] if p["id"] == "steering")
+    sub_ids = {sp["id"] for sp in _iter_all_sub_panels(steering)}
+    assert "mads_settings" in sub_ids
+
+  def test_mutual_exclusion_torque_nnlc(self, schema):
+    """EnforceTorqueControl and NNLC must reference each other in enablement."""
+    torque = nnlc = None
+    for panel in schema["panels"]:
+      for item in _iter_panel_items(panel):
+        if item["key"] == "EnforceTorqueControl":
+          torque = item
+        elif item["key"] == "NeuralNetworkLateralControl":
+          nnlc = item
+    assert torque is not None, "EnforceTorqueControl item missing"
+    assert nnlc is not None, "NeuralNetworkLateralControl item missing"
+    torque_enable_keys = {r.get("key") for r in torque.get("enablement", []) if r.get("type") == "param"}
+    assert "NeuralNetworkLateralControl" in torque_enable_keys
+    nnlc_enable_keys = {r.get("key") for r in nnlc.get("enablement", []) if r.get("type") == "param"}
+    assert "EnforceTorqueControl" in nnlc_enable_keys
+
+
+class TestKnownVehicleSettings:
+  def test_hyundai_has_longitudinal_tuning(self, schema):
+    keys = {i["key"] for i in _brand_items(schema["vehicle_settings"].get("hyundai"))}
+    assert "HyundaiLongitudinalTuning" in keys
+
+  def test_toyota_has_enforce_stock_and_stop_go(self, schema):
+    keys = {i["key"] for i in _brand_items(schema["vehicle_settings"].get("toyota"))}
+    assert "ToyotaEnforceStockLongitudinal" in keys
+    assert "ToyotaStopAndGoHack" in keys
+
+  def test_tesla_has_coop_steering(self, schema):
+    keys = {i["key"] for i in _brand_items(schema["vehicle_settings"].get("tesla"))}
+    assert "TeslaCoopSteering" in keys
+
+  def test_subaru_has_stop_and_go(self, schema):
+    keys = {i["key"] for i in _brand_items(schema["vehicle_settings"].get("subaru"))}
+    assert "SubaruStopAndGo" in keys
+    assert "SubaruStopAndGoManualParkingBrake" in keys
+
+
+class TestItemCompleteness:
+  def _collect_all_items(self, schema):
+    """Collect all items and sub_items from panels and vehicle_settings."""
+    items = []
+    for panel in schema["panels"]:
+      for item in _iter_panel_items(panel):
+        items.append(item)
+        for sub in item.get("sub_items", []):
+          items.append(sub)
+    for brand_data in schema.get("vehicle_settings", {}).values():
+      for item in _brand_items(brand_data):
+        items.append(item)
+        for sub in item.get("sub_items", []):
+          items.append(sub)
+    return items
+
+  def test_all_items_have_titles(self, schema):
+    """All items must have titles."""
+    missing = [i["key"] for i in self._collect_all_items(schema) if "title" not in i]
+    if len(missing) > MAX_ALLOWED_MISSING_TITLES:
+      pytest.fail(f"Items without titles ({len(missing)}): {missing[:10]}")
+
+  def test_no_default_titles(self, schema):
+    """Item titles must differ from keys."""
+    defaults = [i["key"] for i in self._collect_all_items(schema) if i.get("title") == i["key"]]
+    assert not defaults, f"Items with default titles (title == key): {defaults}"
+
+  def test_options_structure(self, schema):
+    """Options must be a list of {value, label} dicts."""
+    for item in self._collect_all_items(schema):
+      opts = item.get("options")
+      if opts is None:
+        continue
+      assert isinstance(opts, list), f"{item['key']}: options must be a list"
+      for opt in opts:
+        assert isinstance(opt, dict), f"{item['key']}: each option must be a dict"
+        assert "value" in opt, f"{item['key']}: option missing 'value': {opt}"
+        assert "label" in opt, f"{item['key']}: option missing 'label': {opt}"
+
+  def test_numeric_constraints(self, schema):
+    """If any of min/max/step is present, all three must be, and min < max."""
+    for item in self._collect_all_items(schema):
+      has_min = "min" in item
+      has_max = "max" in item
+      has_step = "step" in item
+      if has_min or has_max or has_step:
+        assert has_min and has_max and has_step, \
+          f"{item['key']}: must have all of min/max/step or none"
+        assert item["min"] < item["max"], \
+          f"{item['key']}: min ({item['min']}) must be < max ({item['max']})"
+
+  def test_known_param_has_options(self, schema):
+    """LongitudinalPersonality should have 3 options."""
+    cruise = next(p for p in schema["panels"] if p["id"] == "cruise")
+    lp = next((i for i in _iter_panel_items(cruise) if i["key"] == "LongitudinalPersonality"), None)
+    assert lp is not None
+    assert "options" in lp
+    assert len(lp["options"]) == 3