Fix/69 sequential packet reassembly

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/CI.yml

@@ -1,46 +1,79 @@
-# This is a basic workflow to help you get started with Actions
-
 name: CI
 
-# Controls when the workflow will run
+permissions:
+  contents: read
+
 on:
   push:
     branches:
       - master
       - develop
-    tags:
-      - v*
   pull_request:
     branches:
       - "**"
   schedule:
-    # Daily at 10:55
-    - cron: '55 10 * * *'
-
-  # Allows you to run this workflow manually from the Actions tab
+    - cron: '55 10 * * 0'
   workflow_dispatch:
 
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
-  # This workflow contains a single job called "test"
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-python@v7.0.0
+        with:
+          python-version: '3.10'
+          cache: 'pip' # Safely caches dependencies
+
+      - name: Install dependencies
+        run: pip install -e .[lint]
+
+      - name: Check style and syntax (Ruff)
+        run: ruff check .
+
+      - name: Check minimum Python version compatibility (Vermin)
+        run: vermin --target=3.10- --no-parse-comments --no-tips j1939/
+
+      - name: Run Pyright
+        run: pyright
+
   test:
-    # The type of runner that the job will run on
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
+        python-version: ['3.10', '3.11', '3.12', '3.13']
 
     steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-python@v7.0.0
         with:
-          python-version: '3.10'
-
-      - uses: actions/checkout@v2
+          python-version: ${{ matrix.python-version }}
+          cache: 'pip'
 
       - name: install dependencies
-        run: pip3 install .
+        run: pip3 install -e .[test]
 
       - name: Run tests
         run: pytest . --pyargs
 
+  build_check:
+    name: Verify Package Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-python@v7.0.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+
+      - name: Install build tools
+        run: pip install build twine
+
+      - name: Verify package build and metadata
+        run: |
+          python -m build
+          python -m twine check dist/*

.github/workflows/publish.yml

@@ -0,0 +1,60 @@
+name: Publish Release
+
+on:
+  push:
+    tags:
+      - v*
+
+permissions:
+  contents: read
+
+jobs:
+  build_and_publish:
+    name: Build, Release, and Publish
+    runs-on: ubuntu-latest
+    outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
+    permissions:
+      id-token: write # Required for PyPI OIDC and SLSA provenance
+      contents: write # Required to create a GitHub Release
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python
+        uses: actions/setup-python@v7.0.0
+        with:
+          python-version: '3.12'
+
+      - name: Install build tools
+        run: pip install build
+
+      - name: Build sdist and wheel
+        run: python -m build
+
+      - name: Generate hashes for SLSA
+        id: hash
+        run: |
+          cd dist && echo "hashes=$(sha256sum * | base64 -w0)" >> "$GITHUB_OUTPUT"
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v3
+        with:
+          files: |
+            dist/*.tar.gz
+            dist/*.whl
+          generate_release_notes: true
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  provenance:
+    needs: [build_and_publish]
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
+    with:
+      base64-subjects: "${{ needs.build_and_publish.outputs.hashes }}"
+      upload-assets: true

.github/workflows/scorecard.yml

@@ -0,0 +1,78 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '23 10 * * 4'
+  push:
+    branches: [ "master" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
+    if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+          # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
+          # file_mode: git
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: results.sarif

.gitignore

@@ -63,6 +63,9 @@ instance/
 
 # Sphinx documentation
 docs/_build/
+docs/examples.rst
+docs/source/j1939.rst
+docs/source/modules.rst
 
 # PyBuilder
 target/

.readthedocs.yaml

@@ -0,0 +1,20 @@
+# Read the Docs configuration file
+# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
+
+# Required
+version: 2
+
+# Set the OS, Python version, and other tools you might need
+build:
+  os: ubuntu-24.04
+  tools:
+    python: "3.12"
+
+# Build documentation in the "docs/" directory with Sphinx
+sphinx:
+  configuration: docs/conf.py
+
+# Declare the Python requirements required to build your documentation
+python:
+  install:
+    - requirements: docs/requirements.txt

CLAUDE.md

@@ -0,0 +1,78 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project
+
+`can-j1939` is a Python implementation of the SAE J1939 protocol stack on top of
+[python-can](https://python-can.readthedocs.org/). It supports both J1939-21 and J1939-22 (J1939-FD)
+data link layers, including transport protocols (BAM, CMDT / RTS-CTS), address claiming, and a
+number of diagnostic messages (DM1, DM11, DM14, DM22).
+
+## Common commands
+
+```bash
+# Install the package (editable for development)
+pip install -e .
+
+# Run the full test suite (matches CI)
+pytest . --pyargs
+
+# Run a single test file / test
+pytest test/test_ecu.py
+pytest test/test_memory_access.py::TestMemoryAccess::test_some_name -v
+```
+
+CI runs `pytest . --pyargs` on Python 3.10 across Ubuntu/macOS/Windows
+(`.github/workflows/CI.yml`).
+
+## Architecture
+
+The stack is layered: an **ECU** owns a **data-link layer** object and one or more
+**ControllerApplications**. Background work runs on a dedicated job thread.
+
+- `j1939/electronic_control_unit.py` — `ElectronicControlUnit` is the entry point. It owns the
+  `can.Bus`, a `MessageListener`, a job thread (`_async_job_thread`) that drives timers and
+  transport-protocol timeouts, and a list of subscribers. The `data_link_layer` constructor arg
+  (`'j1939-21'` or `'j1939-22'`) selects which DLL is instantiated. The ECU passes the DLL a
+  small surface of callbacks: `send_message`, `_job_thread_wakeup`, `_notify_subscribers`,
+  `_is_message_acceptable`. For tests, `send_message=` can be injected to bypass real CAN I/O.
+- `j1939/j1939_21.py` and `j1939/j1939_22.py` — the two DLL implementations. They share the
+  callback signature above and implement the transport protocols (TP-BAM, TP-CMDT / RTS-CTS,
+  and for J1939-22 the FD multi-session variants and Multi-PG / FEFF). Changes that touch
+  protocol behaviour usually need parallel updates in both files.
+- `j1939/controller_application.py` — `ControllerApplication` (CA) implements J1939/81 address
+  claiming, state machine (`NONE` → `WAITING_VETO` → `NORMAL` / `CANNOT_CLAIM`), per-CA
+  subscriptions, and `send_pgn` (which dispatches to the ECU's DLL).
+- `j1939/name.py`, `j1939/parameter_group_number.py`, `j1939/message_id.py` — value objects for
+  the J1939 NAME, PGN encoding, and 29-bit CAN identifier framing.
+- `j1939/diagnostic_messages.py`, `j1939/memory_access.py`, `j1939/Dm14Query.py`,
+  `j1939/Dm14Server.py`, `j1939/error_info.py` — diagnostic-message support (DM1/DM11/DM14/DM22),
+  including the DM14 memory-access client (`Dm14Query`) and server (`Dm14Server`).
+- `j1939/__init__.py` is the public API surface — anything users are expected to import lives
+  here.
+
+### Threading model
+
+All I/O and protocol timing flows through the ECU's job thread. The DLL never blocks on I/O
+itself — it enqueues work and calls `_job_thread_wakeup` to nudge the thread. Callbacks
+registered via `ca.subscribe(...)` or `ca.add_timer(...)` run on that job thread, so they
+must not block.
+
+### Tests
+
+- `test/` holds unit tests. `test/helpers/feeder.py` provides the `Feeder` fixture (registered
+  in `test/conftest.py`) which is the standard way to drive the stack from tests: it
+  replaces `ElectronicControlUnit.send_message` with a simulated bus, lets the test queue
+  expected RX/TX messages and PDUs in order, and asserts that the stack produces the expected
+  TX sequence. New protocol-level tests should follow that pattern instead of mocking
+  `python-can` directly.
+- `test/helpers/feeder.AcceptAllCA` is a CA subclass with `message_acceptable` overridden to
+  accept everything — use it when a test needs to receive peer-to-peer messages without setting
+  up a real claim.
+
+### Examples
+
+`examples/` contains runnable scripts mirroring the README quick-start (simple receive, own CA
+producer, transport protocols, multi-PG, diagnostic messages). When adding a new public
+feature, prefer extending an existing example over inventing a new pattern in the docs.