)]}' { "log": [ { "commit": "201736cb70364c99fbecc8e9a286704f0e15f4b2", "tree": "2ba7fb4a092cf0f772debd4b4beda5cf252384c2", "parents": [ "3329d0714ac401a83f06ec34a7f84d1d9a7144fa" ], "author": { "name": "Courtney Drant", "email": "courtney.drant@amd.com", "time": "Wed Sep 02 14:16:49 2026 -0700" }, "committer": { "name": "CourtneyDrant", "email": "Courtney.Drant@amd.com", "time": "Thu Sep 17 11:31:24 2026 -0700" }, "message": "Expanding firmware_update to pull data. Added inventory test.\n" }, { "commit": "3329d0714ac401a83f06ec34a7f84d1d9a7144fa", "tree": "0ee7adb7f80638840c83db4c59c13423d472cc9c", "parents": [ "7fde1ef5c4aad0b0226773907a97372c37ebba95" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Mon Sep 14 21:17:48 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Thu Sep 17 09:49:41 2026 -0700" }, "message": "orchestrator: Add the TrialBoot capability trait\n\nActivating an update proposes a boot candidate and never commits it, whether\nthe eRoT actuates that itself through Updatable::activate or a PLDM firmware\ndevice does it on the eRoT\u0027s behalf. Updatable\u0027s docs already name TrialBoot\nas the gate that resolves the proposal; this is that trait: is_pending,\nconfirm, revert, no slot ids.\n\nOne contract covers both implementors. A passive downstream device is judged\nfrom outside over its boot-complete line; the eRoT\u0027s own image is judged by\nthe boot the trial started, so is_pending has to be answerable from durable\nstate alone. The arming applies to the next boot only, so an unresolved trial\nfalls back on its own, but the record stays pending until confirm or revert,\nwhich is how an orchestrator that rebooted mid-update finds it again.\n\nconfirm moves slot metadata only. Raising the anti-rollback floor is\nSvnFloor::advance and happens later, so revert always has a bootable image to\nfall back to.\n\nAssisted-by: Claude\n" }, { "commit": "7fde1ef5c4aad0b0226773907a97372c37ebba95", "tree": "0ca1ebbb9f00965decd504afeb640cccf66b0b1e", "parents": [ "5060c36b9172acca8d9949be409dbbaba1402138" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Sep 16 14:59:06 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Wed Sep 16 16:56:44 2026 +0200" }, "message": "orchestrator: Cascade past a component that is already isolated\n\ncascade_hold only queued a dependent it had just gated, so the walk stopped at a\ncomponent isolated earlier and never reached what depends on it. Gate a middle\nnode on its own, then corrupt its Cascading parent, and the component behind it\ncomes out of reset with its whole dependency chain isolated.\n\nThe frontier is the visited set now, so traversal continues through a gated\ncomponent. gate_one is idempotent, so re-visiting one emits nothing.\n\nproperty_cascading_isolation_reaches_the_whole_subtree guards it.\n\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "5060c36b9172acca8d9949be409dbbaba1402138", "tree": "c1714b771a94e737f278a42693b39753a545021b", "parents": [ "b18b78cca3a932e6e47f2ea7435940b6441c98c6" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Sep 16 14:59:06 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Wed Sep 16 16:56:44 2026 +0200" }, "message": "orchestrator: Drop verdicts for a component already isolated\n\nA failure verdict or a corruption report can be in flight from before the\ncascade gated its component. VerificationFailed and CorruptionDetected now\nreturn early when the component is gated. Recovering it re-walks the chain for\na device that stays held, and on exhaustion a Required one locks the platform\ndown over a cascade that was already contained, which contradicts the rule that\na non-Required cascade never reaches lockdown.\n\nproperty_isolation_is_sticky_under_random_sequences guards both: after\nReportIsolated(id), nothing in the rest of the run emits ReleaseReset or\nRecoverComponent for that id. The cursor invariant the walk depends on is\nwritten down on the field, since that property is what guards it.\n\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "b18b78cca3a932e6e47f2ea7435940b6441c98c6", "tree": "7e8ed0cab9ba571db29341082bc5d90e4ee95f85", "parents": [ "fd52b1056e7ded223bd17f10a5a1a2a87a652b7a" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Sep 16 14:59:06 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Wed Sep 16 16:56:44 2026 +0200" }, "message": "orchestrator: Move the cursor off a component gated mid-walk\n\nA cascade can gate the component currently under verification. Only\nchain[cursor] can be released, so leaving the cursor on that component let its\nin-flight verdict take it back out of reset. handle_corruption_advancing gates\nby policy and then moves the cursor to the next ungated component. The two\nstates that release only chain[cursor], PreSupervision and AwaitingReady, route\nCorruptionDetected through it.\n\nIt is not called from handle_supervising. Recovering\u0027s cursor is stale, since\nVerificationFailed leaves it on the failed component, so advancing there would\nverify mid-recovery or reach Ready instead of re-walking.\n\nThe release property now randomizes the chain shape as well as the event\nsequence. The AwaitingReady race needs a gateable component after an active\none, which the old fixed chain never had.\n\nAlso adds the missing test for the Chain::try_from length bound. cursor is a u8\nusing chain.len() as its past-the-end sentinel, so a 256-entry chain would\ntruncate that sentinel to 0 and the walk would never read as done.\n\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "fd52b1056e7ded223bd17f10a5a1a2a87a652b7a", "tree": "19166320e9bf697e0db61fbdcf45ed014de351f9", "parents": [ "9daec62890f4ef9c82fdde1ce5b79b13e9e40e3c" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Mon Sep 14 15:08:41 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Sep 15 09:38:02 2026 -0700" }, "message": "fix: apply pw format to caliptra_runner.py\n\nCI\u0027s presubmit format check flagged two lines in the fpga branch that\ndidn\u0027t match the repo\u0027s formatting style.\n" }, { "commit": "9daec62890f4ef9c82fdde1ce5b79b13e9e40e3c", "tree": "0c358d3164cf6befbd11925133a6e3a3b570ca84", "parents": [ "83d57da3a06c2a9c4342ce990de6c3909dd4035b" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Mon Sep 14 14:31:51 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Sep 15 09:38:02 2026 -0700" }, "message": "ci: build the veer fpga target image on every CI run\n\nAdds a build-only (no lab hardware needed) CI job that builds\n//target/veer/unittest_runner:fpga_test under target_type\u003dfpga, so a\nregression like the console rust_library silently losing its fpga\ncfg feature (caught by the final review of the fpga-target plan) gets\nflagged automatically instead of only being visible under\nbazel aquery. Actually running the test still requires a VCK190 board\nand is left manual/opt-in.\n" }, { "commit": "83d57da3a06c2a9c4342ce990de6c3909dd4035b", "tree": "260c5132709cd48430ddd58638f9d5ea9d77b758", "parents": [ "c49440637faf71d0d6c0267cc78383e5c299eafd" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Mon Sep 14 13:39:45 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Sep 15 09:38:02 2026 -0700" }, "message": "fix: address whole-branch review findings for veer fpga target\n\n- target/veer/BUILD.bazel: add the crate_features select to the\n console rust_library that entry/config already had, so\n #[cfg(feature \u003d \"fpga\")] in console.rs actually compiles in when\n building for the fpga target_type. Previously the fpga console\n backend (writing to the FPGA wrapper\u0027s debug FIFO) was dead code\n and fpga images silently kept using the emulator-only UART address.\n- target/veer/tooling/caliptra_runner.py: in the fpga branch of\n load_and_run, drop the Detokenizer/detokenize_text call (this\n target\u0027s log backend is log_backend_basic, a plain-text logger, so\n detokenization was a no-op that only added a hard, unmet ELF-file\n runfiles dependency causing a FileNotFoundError at runtime) and scan\n proc.stdout directly instead. Also: print the captured device output\n so operators get diagnostics on both PASS and FAIL, add a timeout to\n the remote subprocess.run call with a TimeoutExpired handler (the\n VeeR core spins forever after signaling its exit sentinel, so an\n unreachable/stuck board no longer hangs indefinitely), and check\n proc.returncode so an outright ssh/remote failure is logged\n distinctly from \"board ran but printed nothing\".\n- .bazelrc: forward VCK190_FPGA_HOST into the k_veer test sandbox\n (Bazel scrubs the test environment by default), matching the\n existing k_ast1060_evb pattern.\n" }, { "commit": "c49440637faf71d0d6c0267cc78383e5c299eafd", "tree": "159ce7eaceade5e48b112cf733d45d793ae2f0df", "parents": [ "a4033c22e02d58f92113f4e729c9d65bf292b897" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Mon Sep 14 13:17:06 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Sep 15 09:38:02 2026 -0700" }, "message": "build: add a manual fpga_test target for the veer unittest runner\n" }, { "commit": "a4033c22e02d58f92113f4e729c9d65bf292b897", "tree": "14d5e951a1f8fba9b7e0fdf3ebb07c389ee05003", "parents": [ "66a2773b367309a4aa92ac938ee10a34c843f4dc" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Mon Sep 14 13:03:50 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Sep 15 09:38:02 2026 -0700" }, "message": "fix: handle scp failures and surface ssh stderr in fpga runner branch\n\nWraps the scp subprocess.run(check\u003dTrue) call in a try/except so a\nfailed copy (bad host, network down, wrong path) logs a clean\n_LOG.fatal diagnostic and exits 1 instead of propagating a raw\nCalledProcessError traceback. Also logs the ssh/launch_openocd.sh\nsubprocess\u0027s captured stderr (previously discarded), including it in\nthe \"no PASS/FAIL sentinel\" fatal message so a real remote failure\n(auth, missing script, wrong path) is diagnosable from the output\ninstead of being silently swallowed behind a generic error.\n" }, { "commit": "66a2773b367309a4aa92ac938ee10a34c843f4dc", "tree": "8fcc061d75f658ab87dda3d21358255f1dd7666e", "parents": [ "2cb37c6f9c1bb9d3c39ab2f1e7c3b6c0a88daadf" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Mon Sep 14 12:49:55 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Sep 15 09:38:02 2026 -0700" }, "message": "feat: implement the fpga interface in caliptra_runner.py\n\nAdds an `elif interface \u003d\u003d \"fpga\":` branch alongside the existing\n\"emulator\" branch in load_and_run(). It reads the VCK190_FPGA_HOST env\nvar (FPGA_HOST constant), fails loudly with a non-zero exit if unset,\nscps the image to the board, invokes launch_openocd.sh over ssh,\ndetokenizes the captured output with the existing pw_tokenizer\nDetokenizer mechanism, and calls scan_output_for_result() (from Task 4)\nto decide pass/fail.\n" }, { "commit": "2cb37c6f9c1bb9d3c39ab2f1e7c3b6c0a88daadf", "tree": "053c05dd5638f0c32ec5ddc5b8e762abb5bffd8b", "parents": [ "c2bf1bd2b9295dd4889009004f45361695eb32b0" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Mon Sep 14 12:26:38 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Sep 15 09:38:02 2026 -0700" }, "message": "refactor: extract pass/fail scanning in caliptra_runner.py and add a unit test\n\nAdd scan_output_for_result(lines) to caliptra_runner.py: a standalone\nfunction that scans detokenized output lines for a PASS/FAIL sentinel,\nwith no dependency on the emulator subprocess. This is what Task 5\u0027s\nfpga interface will reuse, and it\u0027s what makes this file unit-testable\nin a sandbox with no board/emulator binary available.\n\nAdd caliptra_runner_test.py covering the no-sentinel, PASS, FAIL, and\nfirst-sentinel-wins cases, and wire it into BUILD.bazel as a py_test.\n" }, { "commit": "c2bf1bd2b9295dd4889009004f45361695eb32b0", "tree": "8d2e77949879a7028bd23a6ad916b7f910560205", "parents": [ "3e169cf283ff792d7ca023c5e586a36be825f6b9" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Fri Sep 11 17:47:17 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Sep 15 09:38:02 2026 -0700" }, "message": "config: add k_veer bazel config for veer platform setup\n" }, { "commit": "3e169cf283ff792d7ca023c5e586a36be825f6b9", "tree": "bbaf18f278916c39db56a8a3be665cb3372698a6", "parents": [ "3a784a5ff38defb708826c1f111629d6b9ef28f3" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Fri Sep 11 17:37:43 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Sep 15 09:38:02 2026 -0700" }, "message": "feat: add fpga exit/pass-fail signaling via the wrapper debug FIFO\n" }, { "commit": "3a784a5ff38defb708826c1f111629d6b9ef28f3", "tree": "5202aefe62d30dab7d60c903dcd9a0b0e5b5a3b7", "parents": [ "ca284ffbbb3077632e4c93e54ee5ed61af853c36" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Fri Sep 11 17:37:41 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Sep 15 09:38:02 2026 -0700" }, "message": "feat: add fpga console backend using the wrapper debug FIFO\n" }, { "commit": "ca284ffbbb3077632e4c93e54ee5ed61af853c36", "tree": "64d2095bbf2a310033d6d1fd61eb9d2c26293bd1", "parents": [ "eda977853d14d280b0584619bc23ca7fe916332e" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Fri Sep 11 17:37:39 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Sep 15 09:38:02 2026 -0700" }, "message": "fix: correct veer fpga target clock to match VCK190 hardware (20 MHz)\n" }, { "commit": "eda977853d14d280b0584619bc23ca7fe916332e", "tree": "6ae68da28340e07f7c16511f4a7e5e4e6e20fb24", "parents": [ "2eb5cd2870751e936882fb27c3211aa46e0f8be4" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Thu Aug 27 21:29:44 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Thu Sep 10 11:18:03 2026 -0700" }, "message": "orchestrator: Compose report delivery from the board\u0027s ReportSink capability\n\nBoardCapabilities gains ReportSink and Board a report_sink field, and the\nfour Report effects leave the not-yet-composed group to hand their Report\nto the sink.\n\nOne sink per platform, not one per component: two of the four reports\nname no component.\n\nDriver tests build their Board through mock_board() and override only the\nfield under test; a seventh field would otherwise be repeated in fourteen\nliterals.\n\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "2eb5cd2870751e936882fb27c3211aa46e0f8be4", "tree": "fcf36349120d6d14691086d8b500351a8d6a0a23", "parents": [ "32c46348e762a7d80bdc9eeb953478f050e1e359" ], "author": { "name": "JesseMelon", "email": "jessechambers2000@icloud.com", "time": "Thu Sep 10 10:39:30 2026 -0400" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Thu Sep 10 10:50:33 2026 -0700" }, "message": "chore: roll pigweed\n" }, { "commit": "32c46348e762a7d80bdc9eeb953478f050e1e359", "tree": "ee8fa47e5398542d5f4a80831ab06fb956daa8ce", "parents": [ "fd1c4a8821d6c2aa6b557d9d1b1c8f6177de6303" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Fri Aug 21 16:36:43 2026 +0200" }, "committer": { "name": "leongross", "email": "leon.gross@rub.de", "time": "Thu Sep 03 19:30:26 2026 +0200" }, "message": "orchestrator: Wire CommitSvnFloor through the platform driver\n\nSvnFloor joins BoardCapabilities, one floor per component slot. The SVN\nto advance to travels in Verdict::Authenticated: verification is the\nonly authenticated read of the manifest, so nothing else may tell the\nfloor where to go. The driver caches it per component, clears it on\nrejection, and fails closed when asked to commit without it.\nSvnFloorBinding names the two wirings a board can choose: Erot, where\nthe eRoT holds the floor, and SelfManaged for a component that tracks\nits own SVN (iRoT, or a PLDM device committing internally), whose\ncommit is a no-op.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "fd1c4a8821d6c2aa6b557d9d1b1c8f6177de6303", "tree": "7e4adb02d6e8856b7b9fc659e0f1c01d9b3df610", "parents": [ "5384e71e463033c80b805f24e4a76746506253ba" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Aug 26 10:58:51 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Thu Sep 03 09:17:33 2026 -0700" }, "message": "orchestrator: Fold post-write readback into the Updatable contract\n\nReady now means the staged payload is verified to the archetype\u0027s\ndiscipline: a direct-flash adapter reads written pages back before\nreporting Ready, a PLDM device runs its own verify step after the\ntransfer. This drops the planned ReadBack capability; a separate\npost-Ready check would leak archetype knowledge to the caller and PLDM\ndevices cannot serve it at all. The commit bullet now points at the\nBootConfirmed gated flow instead of a TrialBoot capability.\n\nUpdateError gains ReadbackMismatch. Folding it into Device would hide\nthe one device fault a caller can act on differently: the write path\nreported success and the storage still disagrees, so a slot that keeps\nmismatching is worth retiring rather than retrying.\n\nMockFlashDevice demonstrates the discipline: writes hold written still,\nreadback advances it, and a mismatch fails the step. MockPldmDevice\ntakes a verify step of its own once the transfer completes, so a\nfinished transfer is not yet Ready.\n\nAssisted-by: Claude (Fable 5)\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "5384e71e463033c80b805f24e4a76746506253ba", "tree": "7d585282dccd88eb6654d4c3b8cc4599a2a3bd1f", "parents": [ "53599715544d43db657e94e6ba81052549a7b689" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Thu Aug 27 21:25:23 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Thu Sep 03 09:14:53 2026 -0700" }, "message": "orchestrator: Add the ReportSink seam for the Report effects\n\nThe four Effect::Report* variants had no consumer seam. Add a\nnon_exhaustive Report enum and one ReportSink::report, not a method or a\ntrait per variant, plus a unit impl for a board with no management side\nto tell.\n\nreport returns nothing: an error channel would put reports on the\ndriver\u0027s fail-closed path, letting the act of reporting a contained\nfailure escalate it.\n\nTrait only, composing a sink into the board follows.\n\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "53599715544d43db657e94e6ba81052549a7b689", "tree": "5b37056be03a43ef3f585afe98378c508939cc13", "parents": [ "d31a550e5742ec789b196c647fe40962019d035b" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Aug 26 22:32:50 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Mon Aug 31 22:17:28 2026 +0200" }, "message": "orchestrator: Replace single-arm match with matches! in FdEventSink impl\n\nClippy\u0027s single_match lint (denied under -D warnings in presubmit)\nrejects a one-arm match with a wildcard. FdEvent derives no PartialEq,\nso use matches! rather than an equality check.\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "d31a550e5742ec789b196c647fe40962019d035b", "tree": "95120d11acc3024a06cea2e040bf5af9e4ccace1", "parents": [ "8caba431cde867a8540a628e354231fdae1ae662" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Aug 26 21:31:29 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Mon Aug 31 22:17:28 2026 +0200" }, "message": "Generalize the FD event seam to an FdEvent enum\n\nMore PLDM lifecycle events are coming (cancel, transfer/verify/apply\ncomplete, activate). Replace UpdateEventSink\u0027s per-event method with a\nnon_exhaustive FdEvent enum and a single FdEventSink::notify, so new\nevents are one variant instead of a trait break.\n\nEvery variant payload stays Copy and lifetime-free: across the DSP0267\nFD surface the orchestrator-relevant edges carry only small integers;\nbuffer-shaped data (image chunks, package data, version strings) lands\nbehind FdOps and events name it instead of carrying it.\n\nUpdateRequested is the only variant for now. The adapter latch keeps\nits semantics and drops unmapped events.\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "8caba431cde867a8540a628e354231fdae1ae662", "tree": "14bb5a894be1d8122a9cd74cfe32d26afc51d523", "parents": [ "509e85cfe49190ba4dbb9a2fc2b73dd79561cf57" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Tue Aug 25 21:17:03 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Mon Aug 31 22:17:28 2026 +0200" }, "message": "Group orchestrator adapter crates under adapters/\n\nhal-adapters moves to adapters/hal and the new PLDM adapter to\nadapters/pldm, so the growing family of producer-to-orchestrator\nadapter crates (HAL, PLDM, later SPDM) sits under one directory.\nCrate and target names are unchanged; each adapter keeps its own\ncrate so composing one stack never pulls in another.\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "509e85cfe49190ba4dbb9a2fc2b73dd79561cf57", "tree": "c6e421c0ae5cf3af0e788db44a9b9ccd654fa9e4", "parents": [ "ce5587f65d6edd5a352324642ed3bb3c4bc065ca" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Tue Aug 25 20:50:59 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Mon Aug 31 22:17:28 2026 +0200" }, "message": "Wire accepted RequestUpdate to the orchestrator\u0027s UpdateRequest event\n\nThe PLDM firmware-device loop now notifies an UpdateEventSink once per\naccepted RequestUpdate, detected as the FD\u0027s only Idle -\u003e non-Idle\ntransition, after the success response is sent. Rejected requests\n(already in update mode, bad transfer size) leave the state unchanged\nand never notify.\n\nThe sink trait stays PLDM-flavored so this crate never depends on the\norchestrator stack. The mapping to Event::UpdateRequest lives in the\nnew orchestrator-pldm-adapter crate as UpdateRequestLatch, following\nthe same rule that keeps HAL adapters out of orchestrator-capabilities.\nThe latch is a bool, not a counter: the FD rejects a second\nRequestUpdate while one is in progress, and an undrained latch across\nupdate cycles coalesces into the single UpdateRequest the state\nmachine would act on anyway.\n\nThe firmware-update host test drives the latch end to end: the accepted\nRequestUpdate latches exactly one Event::UpdateRequest, the duplicate\nis rejected with AlreadyInUpdateMode and latches nothing, and no later\ncommand in the flow latches anything.\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "ce5587f65d6edd5a352324642ed3bb3c4bc065ca", "tree": "e22505eedfc11db77c5b0d8dd5a47c0c042cbf58", "parents": [ "914f316a351b268db6f7a8d974b0e8dc132369da" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Fri Aug 28 16:50:15 2026 -0700" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Mon Aug 31 14:53:00 2026 +0200" }, "message": "orchestrator/server: build for any pw_kernel target, not just ast10x0\n" }, { "commit": "914f316a351b268db6f7a8d974b0e8dc132369da", "tree": "5a143cbb606c7c35b08094aa6c5e97c0ab2136f2", "parents": [ "51f15af0bf1d778e307176f8b544658083614449" ], "author": { "name": "JesseMelon", "email": "jessechambers2000@icloud.com", "time": "Wed Aug 19 14:38:09 2026 -0400" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Fri Aug 28 09:50:40 2026 -0700" }, "message": "otp: add read-only OTP board test ported from upstream PR #38\n" }, { "commit": "51f15af0bf1d778e307176f8b544658083614449", "tree": "53e86783a975e8b878b96f6db123bac5b2bf04a7", "parents": [ "c9ef244f5955534222f7e4b320ebf5bc3dc5394c" ], "author": { "name": "JesseMelon", "email": "jessechambers2000@icloud.com", "time": "Tue Aug 18 18:38:54 2026 -0400" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Fri Aug 28 09:50:40 2026 -0700" }, "message": "panic hardening\n" }, { "commit": "c9ef244f5955534222f7e4b320ebf5bc3dc5394c", "tree": "92d351154062b7f259bc163955f987c8d6c48d6e", "parents": [ "66182ef2b8070e45646c5d62f7527608d43dc708" ], "author": { "name": "JesseMelon", "email": "jessechambers2000@icloud.com", "time": "Tue Aug 18 16:19:12 2026 -0400" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Fri Aug 28 09:50:40 2026 -0700" }, "message": "otp: add host-tested OtpController with driver fixes and strap pre-flight validation\n" }, { "commit": "66182ef2b8070e45646c5d62f7527608d43dc708", "tree": "f44814a99a752d39abeeb77782156d5998e62230", "parents": [ "2d43f31c0e674ed5fb6823329f1acc64ec5f5ad1" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Fri Jul 31 15:33:50 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Fri Aug 28 09:50:40 2026 -0700" }, "message": "Add AST10x0 OTP peripheral driver\n\nPort the OtpController inherent hardware logic from aspeed-rust into the\nast10x0_peripherals crate as the otp module. Uses a local Logger trait and\nDummyDelay; external trait impls are dropped. Data-region scratch is a local\nbuffer (no static mut) and otp_lock_mem verifies the lock latched, returning\nLockFailed otherwise.\n" }, { "commit": "2d43f31c0e674ed5fb6823329f1acc64ec5f5ad1", "tree": "3cfb0d7c891e465c635ec4fee9fba25f9f6c8177", "parents": [ "d5ada043b7d3a9a61333bfdf74e59bb15516abbc" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Thu Aug 27 13:03:19 2026 +0200" }, "committer": { "name": "Marvin Gudel", "email": "marvin@gudel.org", "time": "Thu Aug 27 23:53:52 2026 +0200" }, "message": "orchestrator: Move the mock board to services/orchestrator/test\n\nDirectories under target/ are pw_kernel targets; the mock board is two\nhost-test crates (the archetype device table and the OTP fuse bank),\nnot a target. House them next to the orchestrator they exercise.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "d5ada043b7d3a9a61333bfdf74e59bb15516abbc", "tree": "08c41be51c4ee5b8950d15aab33e176e5e6cff9b", "parents": [ "139de120814281f87535f389f46c669b111f4b1c" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Thu Aug 27 11:02:57 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Thu Aug 27 21:10:30 2026 +0200" }, "message": "orchestrator: Reject empty payloads in poll_stage\n\nWith len() \u003d\u003d 0 the written \u003d\u003d total termination check held on the\nfirst poll, so an image-less staging reached Ready and could be\nactivated. An empty payload is a caller bug: poll_stage now returns\nthe new UpdateError::EmptyPayload before touching the device.\n\nAssisted-by: Claude (Fable 5)\n" }, { "commit": "139de120814281f87535f389f46c669b111f4b1c", "tree": "1d90857c56a4621a577f0e5f301ab2c08a0d9628", "parents": [ "907e847f10657b3d0f547efbd298beb5896796a5" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Aug 26 12:17:10 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Thu Aug 27 21:10:30 2026 +0200" }, "message": "orchestrator: Make Updatable dyn-compatible for heterogeneous fleets\n\nBoards usually mix archetypes (flash and PLDM devices side by side),\nand the associated Error plus the generic payload parameter forced one\nconcrete Updatable type per board. Follows BootWatch: poll_stage takes\n\u0026dyn PayloadSource and errors are the erased UpdateError; adapters log\nconcrete causes while they are in scope. A board preferring static\ndispatch can still wrap its devices in an enum.\n\nAssisted-by: Claude (Fable 5)\n" }, { "commit": "907e847f10657b3d0f547efbd298beb5896796a5", "tree": "a191781fde72b6613ed8225d3dc8efa3c7e7ea69", "parents": [ "403ce47f71dbcd14007f1efc9b6f0e5252a2e36e" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Tue Aug 18 18:08:09 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Thu Aug 27 21:10:30 2026 +0200" }, "message": "orchestrator: Add the Updatable update capability trait\n\npoll_stage advances the transfer one bounded step per call, keeping a\nsingle-threaded runtime live and cancellation immediate. activate\nmarks the staged image as boot candidate, tentatively; committing is\nTrialBoot\u0027s job. PayloadSource is the chunked read seam, serving both\ndirect-flash adapters and PLDM devices that pull their own chunks.\n\nAssisted-by: Claude:claude-fable-5\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "403ce47f71dbcd14007f1efc9b6f0e5252a2e36e", "tree": "184f8c6b378db5b824db14ecc8d081af7a272d58", "parents": [ "af0ed5f4a2709fbd9eabfa83240c3fb3f57f7fe5" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Thu Aug 27 20:48:20 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Thu Aug 27 21:07:32 2026 +0200" }, "message": "orchestrator: Construct ComponentId via From\u003cu8\u003e\n\nReplace the ComponentId::new(idx as u8) call in poll_boot_walks with a\nFrom\u003cu8\u003e conversion, per review. The const fn new stays for const\ncontexts (test constants).\n\nAlso assert N \u003c\u003d 256 at compile time in PlatformDriver::new: component\nids are u8, so a larger board would wrap them silently.\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "af0ed5f4a2709fbd9eabfa83240c3fb3f57f7fe5", "tree": "835f784bc2512e0f83cfad6ca59b811ea8f83b97", "parents": [ "03d31305bbd8098c3ae7a3b0c7ae0282ab24c1b2" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Aug 26 10:43:17 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Thu Aug 27 21:07:32 2026 +0200" }, "message": "orchestrator: Compose boot-walk supervision from the board\u0027s BootWatch capability\n\nReleaseReset arms the component\u0027s walk, AssertReset stops it, and the\nnew PlatformDriver::poll_boot_walks maps terminal verdicts to events:\nComplete becomes ComponentReady (Active) or Booted (Passive), Failed\nbecomes Timeout regardless of cause — retry budgeting is the SM\u0027s. A\nfinished walk stops being watched, so each verdict is delivered once;\nwhile everything waits, the poll carries the earliest walk deadline as\nthe run loop\u0027s next wake-up.\n\nBootWatch gains arm(): a retry re-release starts a fresh walk, and\nsince reset actuation has no clock, the attempt starts at the next\npoll\u0027s now_millis. The Board supplies one walk and one ComponentKind\nper component, from the same table as the SM\u0027s chain.\n\nThe driver README still described take_event and NotImplemented, both\ngone; rewritten to the current execute/fail-closed shape.\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "03d31305bbd8098c3ae7a3b0c7ae0282ab24c1b2", "tree": "5cdecda128d5990ba6d03b6f1a6fa84371dab306", "parents": [ "7d2b1dfcfaea57150315006b9efaee9519a54f86" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Fri Aug 21 16:22:43 2026 +0200" }, "committer": { "name": "leongross", "email": "leon.gross@rub.de", "time": "Tue Aug 25 19:01:03 2026 +0200" }, "message": "Rename VerifierBroken to VerifierError in tests\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "7d2b1dfcfaea57150315006b9efaee9519a54f86", "tree": "a9861723b2e13d844e822d578bd8d35451373ac4", "parents": [ "d11fdb48837282ac9b258b5d231a2dacf2fcccae" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Mon Aug 17 14:54:29 2026 +0200" }, "committer": { "name": "leongross", "email": "leon.gross@rub.de", "time": "Tue Aug 25 19:01:03 2026 +0200" }, "message": "orchestrator: Test the at-rest guarantee end to end\n\nThe reset wiring itself landed with the platform driver (BootControl\ncomposed into BoardCapabilities, assert_reset/release_reset delegating\nto it), so what remains here are the end-to-end proofs: a component is\nstill held in reset while its image is verified and the line is\nreleased only on the passing verdict, and a dead reset line fails\nclosed with the component left quiesced. BootControl is re-exported\nfrom the driver crate so board crates need only one import.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "d11fdb48837282ac9b258b5d231a2dacf2fcccae", "tree": "3772651f9da87952bc4f898265931441c41e08cb", "parents": [ "d2ea5983e47b6af0839062d1126ddd5ef8761179" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Aug 19 17:41:04 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Tue Aug 25 11:50:43 2026 +0200" }, "message": "orchestrator: Add the LockdownLatch terminal capability trait\n\nThe Effect::LatchLockdown executor has no capability seam. Add\nLockdownLatch: a one-way latch into the platform safe state, a sticky\nbit rather than an acquire/release lock. Ok only when the safe state is\nin force; a failed latch is a hard fault the caller must treat as\nterminal. Trait only; the platform driver composition follows\nseparately.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "d2ea5983e47b6af0839062d1126ddd5ef8761179", "tree": "88c111eea20f0ddcc42f4cbe3ecca27bfb335967", "parents": [ "0287b2dc94e9e648df36f4ed5139cbf420de3cf2" ], "author": { "name": "Dave Roth", "email": "davidroth@google.com", "time": "Mon Aug 24 17:18:33 2026 +0000" }, "committer": { "name": "Dave Roth", "email": "49175007+davexroth@users.noreply.github.com", "time": "Mon Aug 24 15:45:10 2026 -0700" }, "message": "chore: Roll pigweed\n\nManually roll pigweed and required crate dep \u0027object\u0027 to 0.40.0\n" }, { "commit": "0287b2dc94e9e648df36f4ed5139cbf420de3cf2", "tree": "c01349632dd661087b1bf0ea855b6831e60dab72", "parents": [ "b3fa431ab2a6223a357bcda1f84e551a4a20c31a" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Fri Aug 21 14:37:20 2026 +0200" }, "committer": { "name": "leongross", "email": "leon.gross@rub.de", "time": "Fri Aug 21 15:25:47 2026 +0200" }, "message": "docs: Say platform driver, not shell\n\nPR #357 settled the vocabulary: the effect-carrying layer around the\npure state machine is the platform driver\n(services/orchestrator/driver). Sweep the remaining doc comments and\nthe sm README that still call it the shell. No code changes.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "b3fa431ab2a6223a357bcda1f84e551a4a20c31a", "tree": "a1696e29e8d63e5074878c6057c90dc3b48853fa", "parents": [ "0d7610e44341ff22aa227862e710b999115a18f9" ], "author": { "name": "Courtney Drant", "email": "courtney.drant@amd.com", "time": "Mon Aug 17 21:16:18 2026 -0700" }, "committer": { "name": "CourtneyDrant", "email": "Courtney.Drant@amd.com", "time": "Thu Aug 20 12:16:20 2026 -0700" }, "message": "Added an attacker test for type 5 commands.\n" }, { "commit": "0d7610e44341ff22aa227862e710b999115a18f9", "tree": "cda5866f4bdfc5e9ec0f7926478e7219c469ebcb", "parents": [ "91d16855e49eff072188c72287bb07d9f97a3705" ], "author": { "name": "Courtney Drant", "email": "courtney.drant@amd.com", "time": "Tue Aug 11 15:33:59 2026 -0700" }, "committer": { "name": "CourtneyDrant", "email": "Courtney.Drant@amd.com", "time": "Thu Aug 20 12:16:20 2026 -0700" }, "message": "Added new enum for error handling of run_terminus. run_terminus_inner contains the terminus loop and is wrapped in run_terminus. run_terminus while match on error and completed.\n" }, { "commit": "91d16855e49eff072188c72287bb07d9f97a3705", "tree": "9090acbca2c87e41ab64c56577eed9d7ea99652f", "parents": [ "9ce634f9e6066d7bbae43572fb858358d046f41e" ], "author": { "name": "Courtney Drant", "email": "courtney.drant@amd.com", "time": "Tue Aug 11 12:57:51 2026 -0700" }, "committer": { "name": "CourtneyDrant", "email": "Courtney.Drant@amd.com", "time": "Thu Aug 20 12:16:20 2026 -0700" }, "message": "Added new PldmMemError enum to disambiguate memory buffer failures\n" }, { "commit": "9ce634f9e6066d7bbae43572fb858358d046f41e", "tree": "94279c4659fbc1cef9857924efa208390cb1ea44", "parents": [ "e206e88ff6f82859f1494e17728d72736eb5fb78" ], "author": { "name": "Courtney Drant", "email": "courtney.drant@amd.com", "time": "Mon Aug 10 16:40:06 2026 -0700" }, "committer": { "name": "CourtneyDrant", "email": "Courtney.Drant@amd.com", "time": "Thu Aug 20 12:16:20 2026 -0700" }, "message": "Modified run_terminus to use a new interface with Option\u003cusize\u003e returned\n" }, { "commit": "e206e88ff6f82859f1494e17728d72736eb5fb78", "tree": "fd7546ebc5e8c951c4e8578306a9847733843a5e", "parents": [ "4ed3307c1d64cf4652046fbf3c17394a9bc97330" ], "author": { "name": "Courtney Drant", "email": "courtney.drant@amd.com", "time": "Fri Aug 07 17:34:19 2026 -0700" }, "committer": { "name": "CourtneyDrant", "email": "Courtney.Drant@amd.com", "time": "Thu Aug 20 12:16:20 2026 -0700" }, "message": "Adding EID filtering into run_terminus with transport handler\u0027s now passing remote_eid. Unexpected EID tests use set/get TID to verify.\n" }, { "commit": "4ed3307c1d64cf4652046fbf3c17394a9bc97330", "tree": "9c9b7df510450d429855d582eae7a24a729a4281", "parents": [ "2da2c2610427ccb97fa13aa1947cd4a4f82881e0" ], "author": { "name": "Courtney Drant", "email": "courtney.drant@amd.com", "time": "Thu Aug 06 16:04:35 2026 -0700" }, "committer": { "name": "CourtneyDrant", "email": "Courtney.Drant@amd.com", "time": "Thu Aug 20 12:16:20 2026 -0700" }, "message": "Moved common test code into test/common.rs. Changed FakeFdOps to MockFdOps.\n" }, { "commit": "2da2c2610427ccb97fa13aa1947cd4a4f82881e0", "tree": "4cef4aec5511034af16324107f8093416b1c215b", "parents": [ "082924be43b8924687e9359c1ea41b1e1915de26" ], "author": { "name": "Courtney Drant", "email": "courtney.drant@amd.com", "time": "Mon Jul 27 17:11:06 2026 -0700" }, "committer": { "name": "CourtneyDrant", "email": "Courtney.Drant@amd.com", "time": "Thu Aug 20 12:16:20 2026 -0700" }, "message": "Removed requester and responder. run_terminus is the connection to mctp transport.\n" }, { "commit": "082924be43b8924687e9359c1ea41b1e1915de26", "tree": "2d2bece41b9ba3a8d25741af1f5af002f9fd6175", "parents": [ "f824257b1abd60d4a1362c37fafd4940f39f568d" ], "author": { "name": "Courtney Drant", "email": "courtney.drant@amd.com", "time": "Wed Jul 15 18:11:57 2026 -0700" }, "committer": { "name": "CourtneyDrant", "email": "Courtney.Drant@amd.com", "time": "Thu Aug 20 12:16:20 2026 -0700" }, "message": "Crate updates for pldm-lib to remove dyn FdOps.\n" }, { "commit": "f824257b1abd60d4a1362c37fafd4940f39f568d", "tree": "fcc86917fad003a96c4b64cc26301e9269c67cec", "parents": [ "ab4cf0015255367cc956615c547c4c3e36d522f2" ], "author": { "name": "Courtney Drant", "email": "courtney.drant@amd.com", "time": "Wed Jul 15 10:34:01 2026 -0700" }, "committer": { "name": "CourtneyDrant", "email": "Courtney.Drant@amd.com", "time": "Thu Aug 20 12:16:20 2026 -0700" }, "message": "Final updates after rebase with OpenProt/main.\n" }, { "commit": "ab4cf0015255367cc956615c547c4c3e36d522f2", "tree": "3a4fc0e990583ca5f254d95a39c85ea0ca4736c2", "parents": [ "3a884df9ff1f53ec2336f6d48c9a660a71ebf066" ], "author": { "name": "Courtney Drant", "email": "courtney.drant@amd.com", "time": "Wed May 20 18:57:52 2026 -0700" }, "committer": { "name": "CourtneyDrant", "email": "Courtney.Drant@amd.com", "time": "Thu Aug 20 12:16:20 2026 -0700" }, "message": "Add pldm test and service which leverages pldm-lib for firwmare device\naccess from update agent.\n" }, { "commit": "3a884df9ff1f53ec2336f6d48c9a660a71ebf066", "tree": "d8c166f909ec027c7707b4b0a9558866e1aafb78", "parents": [ "045ea46c213a1b1cda8a98f1667227f83493ac11" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Tue Aug 18 10:02:07 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Thu Aug 20 13:41:45 2026 +0200" }, "message": "target/mock: Add MockOtpFloor, the mock board\u0027s OTP fuse bank\n\nAn OTP-fused SvnFloor: the floor is a unary fuse counter, so lowering\nis impossible by construction, capacity is finite (Exhausted past\nFUSES), and fail_next injects a one-shot fault. Lives with the board,\nnot in a testonly crate, so host integration tests and a QEMU\nmock-board image link the same fuse bank.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "045ea46c213a1b1cda8a98f1667227f83493ac11", "tree": "63c36c4709895abbca76ce42e40ffe2cc710b0ac", "parents": [ "133a555e3505ff55af92eeb52c8e5b6f067fb2dc" ], "author": { "name": "JesseMelon", "email": "jessechambers2000@icloud.com", "time": "Fri Aug 14 18:00:22 2026 -0400" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 15:52:37 2026 -0700" }, "message": "i2c: Type-state ArmedDma refactor + on-hw abort test\n\nDrop the runtime `committed` flag from ArmedDma; commit(self) now consumes\nthe guard via mem::forget, so a committed transfer is no longer a droppable\nvalue and Drop tears down unconditionally.\n\nAdd the two-image i2c_dma_abort hardware test (master DMA + clock-stretching\nslave) exercising the commit no-op path and the timeout -\u003e guard-drop -\u003e\nsoft-reset teardown path.\n\nCo-Authored-By: Claude Opus 4 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "133a555e3505ff55af92eeb52c8e5b6f067fb2dc", "tree": "28cc4c4b4c75de0f1799fa538586701363b9ec6b", "parents": [ "34a6e894e99a7ae20e63896457ddcfe34be06002" ], "author": { "name": "JesseMelon", "email": "jessechambers2000@icloud.com", "time": "Thu Jul 30 09:59:35 2026 -0400" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 15:52:37 2026 -0700" }, "message": "progress\n" }, { "commit": "34a6e894e99a7ae20e63896457ddcfe34be06002", "tree": "4f4d75d5c339692137d6d5fdb2830ccd253a78da", "parents": [ "7080f99f26e3d2d0bb8276a9eb9d6e6d3e9df07d" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Aug 19 21:21:12 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 12:26:56 2026 -0700" }, "message": "orchestrator: Take ImageSource::size by shared reference\n\nThe image length is a property of the staged image, not a bus\ntransaction: every realistic source (RAM copy, interposed flash, PLDM\ntransfer) learns it during open and can report a cached value. Taking\n\u0026self matches embedded_storage::ReadStorage::capacity and leaves the\nsource shareable for size queries; read_at stays \u0026mut self because\nreads drive the bus, as in embedded_io::Read.\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "7080f99f26e3d2d0bb8276a9eb9d6e6d3e9df07d", "tree": "105bb7ce541e5c53b82ca9f51816b0ba240a582b", "parents": [ "f082e00b329e2226749a0d254762ea1a7026f8c5" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Aug 19 18:04:14 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 12:26:56 2026 -0700" }, "message": "orchestrator: Return verdicts through execute, drop the event queue\n\nPlatform::execute now returns the follow-up event, so verify_firmware\nhands its verdict back directly. The pending deque, take_event and\nQueueFull are gone.\n\nAssisted-by: Claude:claude-fable-5\n\nClaude-Session: https://claude.ai/code/session_018vLnXX7edp1R5YxQA3FM3h\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "f082e00b329e2226749a0d254762ea1a7026f8c5", "tree": "c1b6455ae6939ddaf7f021bfc1b20374f93f2316", "parents": [ "58ab214ed84fae9e4b8309a23bb796e54ab555ce" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Aug 19 17:42:24 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 12:26:56 2026 -0700" }, "message": "orchestrator: Fail closed inline instead of stubbing unimplemented executors\n\nEffects whose board capability is not composed yet no longer get a\nconcrete method returning NotImplemented; they fail closed in a single\ngrouped match arm in execute. The match stays exhaustive, so a new\nEffect variant still refuses to compile until it is routed. Each group\ngains a real executor when its capability joins BoardCapabilities, the\nway BootControl did. DriverError::NotImplemented is gone with the\nstubs.\n\nAssisted-by: Claude:claude-fable-5\n\nClaude-Session: https://claude.ai/code/session_018vLnXX7edp1R5YxQA3FM3h\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "58ab214ed84fae9e4b8309a23bb796e54ab555ce", "tree": "5848703e353301d67d7f21ac36998cdc80aebd11", "parents": [ "6690df9f7cc0360686103a386fb9cb08107a1412" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Aug 19 17:35:05 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 12:26:56 2026 -0700" }, "message": "orchestrator: Match the struct form of Effect::RecoverComponent\n\nMain changed RecoverComponent to a struct variant carrying the core\u0027s\nconsecutive-recovery count. Destructure it and pass the attempt through\nto recover_component, so a future implementation can pick a different\nrecovery source per attempt.\n\nAssisted-by: Claude:claude-fable-5\n\nClaude-Session: https://claude.ai/code/session_018vLnXX7edp1R5YxQA3FM3h\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "6690df9f7cc0360686103a386fb9cb08107a1412", "tree": "0f3ff49ac52500aa1349949daf252a9e38cc9b7a", "parents": [ "917a2e37d891454f3bf71d832638be737c048f34" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Tue Aug 18 14:01:11 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 12:26:56 2026 -0700" }, "message": "orchestrator: Compose reset actuation from the board\u0027s BootControl capability\n\nrelease_reset and assert_reset now delegate to a per-component\norchestrator_capabilities::BootControl supplied by the board, instead of\nreturning NotImplemented. BoardCapabilities gains a BootControl associated\ntype and Board a boot_controls array, following the composition pattern\nalready used for ImageSource and Verifier.\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "917a2e37d891454f3bf71d832638be737c048f34", "tree": "d993ff03356adb99215563156ca5b4584003c245", "parents": [ "eb25442ff2bcb79ca0224349a03be36c184f10fa" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Tue Aug 18 13:52:35 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 12:26:56 2026 -0700" }, "message": "orchestrator: Check component id validity before the staged check in verify_firmware\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "eb25442ff2bcb79ca0224349a03be36c184f10fa", "tree": "161a0f9087b80da4121fde7c9a6fe80a09afa29e", "parents": [ "aa6b771c8b39235f68eab4341a9b68ef9834411f" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Tue Aug 18 13:51:05 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 12:26:56 2026 -0700" }, "message": "orchestrator: Extract source lookup helper shared by stage and verify\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "aa6b771c8b39235f68eab4341a9b68ef9834411f", "tree": "06a259fcb2665427864539a9271fc853ac7d2851", "parents": [ "d807a84c93b138f8b0643def9f9e094e0c7fab5e" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Tue Aug 18 13:48:26 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 12:26:56 2026 -0700" }, "message": "orchestrator: Rename BoardTypes to BoardCapabilities\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "d807a84c93b138f8b0643def9f9e094e0c7fab5e", "tree": "b4e9bb52a602d506dbbe3fe4b11eae7452f06ac7", "parents": [ "c9b8919eb27cc1f1e035249025bb19758c4d8f43" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Tue Aug 18 13:45:56 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 12:26:56 2026 -0700" }, "message": "orchestrator: Rename DriverError::NoImage to NotStaged\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "c9b8919eb27cc1f1e035249025bb19758c4d8f43", "tree": "4d5a1ba1b2f23e153458ad1fb570ecbeb6e04a4e", "parents": [ "a013533f1f999974f6ac9537802345f48f544d0f" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Tue Aug 18 13:42:57 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 12:26:56 2026 -0700" }, "message": "orchestrator: Rename Verdict::Authentic to Authenticated\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "a013533f1f999974f6ac9537802345f48f544d0f", "tree": "66b22e26aab45f447387c9770438cb7028ee07e6", "parents": [ "d9aa9d4efe3deb82830cdb9d92c8544fe02ae2a6" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Mon Aug 17 19:10:43 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 12:26:56 2026 -0700" }, "message": "orchestrator: Rename read_firmware to stage_firmware\n\nThe executor stages the image (opens the source, marks it staged);\nit does not read it. Review on #418 flagged the mismatch. The SM\neffect stays ReadFirmware — only the driver method is renamed.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\nClaude-Session: https://claude.ai/code/session_018vLnXX7edp1R5YxQA3FM3h\n" }, { "commit": "d9aa9d4efe3deb82830cdb9d92c8544fe02ae2a6", "tree": "e9190484d51410661708b8e35c40d8eefb7acd52", "parents": [ "a0360e746defc30fa521657fc59e4f48fede7213" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Mon Aug 17 17:16:06 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 12:26:56 2026 -0700" }, "message": "orchestrator: Rename the shell to platform driver\n\nPR #357 already settled this word: \u0027shell\u0027 reads as bash, and the\ndocs say platform driver. The crate follows: PlatformDriver in\ndriver.rs, DriverError, openprot_orchestrator_driver. The outer pump\nis now the event loop, freeing \u0027driver\u0027 for the struct.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "a0360e746defc30fa521657fc59e4f48fede7213", "tree": "778651aa2e0af55a27a01408bd9422d37157f52e", "parents": [ "085ca066f0731a0b3779dd0020fb3bf588d1fd9f" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Fri Aug 14 20:17:32 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 12:26:56 2026 -0700" }, "message": "orchestrator: Add the shell skeleton with firmware verification\n\nOne executor method per SM effect, each documenting its obligation\nfrom the platform-boundary contract (orchestrator-model.md §6);\nunimplemented executors fail closed. read_firmware opens the image\nsource; verify_firmware has the verifier judge it and queues the\nverdict, which the driver loop feeds back via take_event.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "085ca066f0731a0b3779dd0020fb3bf588d1fd9f", "tree": "54e62b9bd3e8df0a95545e2160af3d653d70938c", "parents": [ "89d580cbdeae64e3d7da64a80d9c1ab3ce89e055" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Fri Aug 14 18:14:30 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Wed Aug 19 12:26:56 2026 -0700" }, "message": "orchestrator: Add the shell\u0027s board seams\n\nImageSource is board-supplied access to a component\u0027s active image\n(interposed flash, PLDM transfer, test double); Verifier judges it,\nand its error means the check could not run — a bad image is\nVerdict::Rejected, never an error. BoardTypes and Board bundle one\nboard\u0027s types and wired instances; a new seam adds an associated type\nand a field, not another parameter.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "89d580cbdeae64e3d7da64a80d9c1ab3ce89e055", "tree": "dcfee1f7e3f6c1c0d7af3557f7bfd50bf28a8da5", "parents": [ "d8f3c650d5e718bebb87c412e333e11ddda412e1" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Aug 19 16:48:41 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Wed Aug 19 17:20:33 2026 +0200" }, "message": "orchestrator: Fix docs — the SM queues and injects, execute may block\n\nReview feedback on #419: the orchestrator (not the driver) queues a\nreturned event and injects EffectFailed, and a blocking execute is\nfine — drop the never-block rule from the Platform docs.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "d8f3c650d5e718bebb87c412e333e11ddda412e1", "tree": "e3e68889b48c2879b96a3e1b44b06b79de4e92f7", "parents": [ "4ec2a882f93bcea7051adf9f8c4664bc3c143bf6" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Mon Aug 17 17:19:15 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Wed Aug 19 17:20:33 2026 +0200" }, "message": "orchestrator: Say platform driver, not shell, in the SM docs\n\nPR #357 renamed the effect-executing layer to platform driver; the SM\ndoc comments still said shell. Wording only.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "4ec2a882f93bcea7051adf9f8c4664bc3c143bf6", "tree": "78a47855c1657890a4c71dc83db06c470228f613", "parents": [ "0fda14657a5e3010c632b2cd32c781a793ef0af8" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Sat Aug 15 11:11:37 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Wed Aug 19 17:20:33 2026 +0200" }, "message": "orchestrator: Latch at the queue front, never lose the latch\n\nA failed effect with a full pending queue silently dropped the\nEffectFailed push: failed stayed set, nothing latched, and the run\nsettled as if the actuation had succeeded. Fold both failure paths into\none latch() helper: evict the newest queued event if the queue is full,\nand push the latch to the *front*, so it settles next and queued\nfeedback drains into Locked instead of actuating hardware after a\nfailure. Document that returned events must quiesce.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "0fda14657a5e3010c632b2cd32c781a793ef0af8", "tree": "3b3396cdf883449c8ca3bbc16e3292cc515e7ddf", "parents": [ "044c1ab5ca543c3085bb33e5a476a65b3e170a3b" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Fri Aug 14 18:49:26 2026 +0200" }, "committer": { "name": "Christina Quast", "email": "chrysh.ng+github@gmail.com", "time": "Wed Aug 19 17:20:33 2026 +0200" }, "message": "orchestrator: Let Platform::execute return a follow-up event\n\nAn executor that learns something synchronously — a verification\nverdict — had no way to feed it back; every shell needed its own queue,\ndrained between dispatches. execute now returns\nResult\u003cOption\u003cEvent\u003e, EffectError\u003e: the driver queues the returned\nevent and settles it in the same run, so one dispatch runs to\nquiescence. The pending queue pops as it settles, bounding it by\nin-flight events instead of a run\u0027s length; overflow injects\nEffectFailed and latches Locked — the same fail-closed rule as a\nfailed effect.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "044c1ab5ca543c3085bb33e5a476a65b3e170a3b", "tree": "84fdff19f49826ad8a64d93501b23d88700240af", "parents": [ "98db6791c675a7c537ecf47ef3df9713f0f27d89" ], "author": { "name": "Daniil Mordanov", "email": "mordanovdania@gmail.com", "time": "Thu Aug 06 19:40:30 2026 +0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 18 09:37:27 2026 -0700" }, "message": "docs: refresh architecture map\n" }, { "commit": "98db6791c675a7c537ecf47ef3df9713f0f27d89", "tree": "9692261d779bba6ffdc4d19bc7415b915cf78171", "parents": [ "97b6ff7e1d717d2b685a6fc6d2489388096c0b71" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Mon Aug 17 17:47:49 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 18 09:34:20 2026 -0700" }, "message": "target/veer: Fix formatting\n" }, { "commit": "97b6ff7e1d717d2b685a6fc6d2489388096c0b71", "tree": "0d792dcbd3755aaa6bc500177d6b75dc6ac00136", "parents": [ "8a71676b1d724d84099077720dfcbc2553317dd1" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Mon Aug 17 15:49:26 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 18 09:34:20 2026 -0700" }, "message": "ci: Run the caliptra emulator tests on pull requests\n" }, { "commit": "8a71676b1d724d84099077720dfcbc2553317dd1", "tree": "44bd1623408cd011e30616583ff8ff03132869fc", "parents": [ "b6d18b71ab2e1b6fb7b58564652349ae37ddc55f" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Mon Aug 17 15:13:14 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 18 09:34:20 2026 -0700" }, "message": "target/veer: Add an interrupts test that validates external interrupt delivery\n" }, { "commit": "b6d18b71ab2e1b6fb7b58564652349ae37ddc55f", "tree": "d6617072ce9426274837dfd629429b2d1502f44e", "parents": [ "b9a5a04cfe1f9c87d497e17fc897ab05ab9fc304" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Mon Aug 17 13:28:13 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 18 09:34:20 2026 -0700" }, "message": "target/veer: Program the VeeR MEIVT redirect table\n" }, { "commit": "b9a5a04cfe1f9c87d497e17fc897ab05ab9fc304", "tree": "6739a974737bd6d29fb1c6d673ba3e61ddcd96d7", "parents": [ "6a717e44d9f1fca918a7e5c121df836b2343dc0e" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Mon Aug 17 10:45:16 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 18 09:34:20 2026 -0700" }, "message": "target/veer: Use a local emulator binary that always starts the I3C controller\n" }, { "commit": "6a717e44d9f1fca918a7e5c121df836b2343dc0e", "tree": "363cd8789cf05c6c5ec2725d482e9b8b047ae453", "parents": [ "7faae8b0c6af16d20b1589bc32f2de52d38559c8" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Tue Aug 18 09:17:25 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 18 07:31:10 2026 -0700" }, "message": "docs(orchestrator): stop listing the state machine as a platform layer\n\nThe intro scopes this page to everything around the state machine, but\nthe Structure section still counted it as the first of three platform\nlayers. Present it as the core the two platform layers serve instead.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "7faae8b0c6af16d20b1589bc32f2de52d38559c8", "tree": "ca5996bea762f73d01a3331c57497eae948b185e", "parents": [ "37d3202f5c507d04ff1c4e4c0dc51f7dbd3366f6" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Tue Aug 18 11:44:36 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 18 07:29:29 2026 -0700" }, "message": "orchestrator: Say where the monotonic no-op is enforced\n\nThe trait cannot enforce it: one-way encodings get it for free, any\nother storage must check itself.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "37d3202f5c507d04ff1c4e4c0dc51f7dbd3366f6", "tree": "3851ab758289483c183d2372d64ca668b5d679da", "parents": [ "e60766d1803261b669906d6017c9e9664c3c6cb9" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Tue Aug 18 09:54:22 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 18 07:29:29 2026 -0700" }, "message": "orchestrator: Take \u0026self in SvnFloor::floor\n\nPer review: reading the floor does not require exclusive access.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "e60766d1803261b669906d6017c9e9664c3c6cb9", "tree": "116e1583dfe1d876570b24ff094d7ed52f953212", "parents": [ "01816241276549a75b79cdac7805af9434548ca9" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Mon Aug 17 18:36:04 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 18 07:29:29 2026 -0700" }, "message": "orchestrator: Add the SvnFloor anti-rollback capability trait\n\nOne device\u0027s durable SVN floor behind the capability seam: floor() and\nadvance(), monotonic and idempotent so a replayed commit is harmless,\ndurable when advance returns. Storage encoding (OTP fuse counters,\nprotected flash) stays behind the trait; PLDM devices that commit\ninternally simply have no eRoT-side floor. Trait only — the OTP-backed\nadapter and the driver\u0027s commit_svn_floor executor follow separately.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "01816241276549a75b79cdac7805af9434548ca9", "tree": "c4e56a6d842e92af262d0bad30277c0800262c27", "parents": [ "6c546931b4053785cf9ea4c073ce0f79eadc04fc" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Wed Aug 12 13:01:20 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Mon Aug 17 15:40:24 2026 -0700" }, "message": "Add orchestrator server runtime crate and integration QEMU test\n" }, { "commit": "6c546931b4053785cf9ea4c073ce0f79eadc04fc", "tree": "ce5b760211bcd8a54a76ed21c463cf717e986755", "parents": [ "48d13a12df3ee5ccf04ca9abca4bc462dc571070" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Wed Aug 12 10:36:42 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Mon Aug 17 15:40:24 2026 -0700" }, "message": "Add README for timer QEMU test\n" }, { "commit": "48d13a12df3ee5ccf04ca9abca4bc462dc571070", "tree": "59727814c6c9ec564cad122c04f12cdb811992be", "parents": [ "77bfa04c6293632abb0b0a9d73884634e73dd9ff" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Wed Aug 12 10:04:25 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Mon Aug 17 15:40:24 2026 -0700" }, "message": "Move timer QEMU test under tests/orchestrator\n" }, { "commit": "77bfa04c6293632abb0b0a9d73884634e73dd9ff", "tree": "e1c230657e9f4f6b94f161900afdffcd78eb9406", "parents": [ "74be5996cfb3a0643fe93eef3ec0e8cfbf149104" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Tue Aug 11 15:12:27 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Mon Aug 17 15:40:24 2026 -0700" }, "message": "ast10x0: timer test scenario 3 - event before deadline cancels watchdog\n" }, { "commit": "74be5996cfb3a0643fe93eef3ec0e8cfbf149104", "tree": "b032651e504ac7b224580722931d1194c7146525", "parents": [ "f50c9fcb77a07aa2ea320e44593af05a0d88d1ac" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Tue Aug 11 15:11:56 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Mon Aug 17 15:40:24 2026 -0700" }, "message": "ast10x0: timer test scenario 2 - re-arm replaces, never stacks\n" }, { "commit": "f50c9fcb77a07aa2ea320e44593af05a0d88d1ac", "tree": "186cc3542d688e25a5bdad0195c5d5cd5b7b88c2", "parents": [ "f9ac047bc8ddad6bde0bbdf8e56318991d4f5209" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Tue Aug 11 15:11:32 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Mon Aug 17 15:40:24 2026 -0700" }, "message": "ast10x0: timer test scenario 1 - ordered expiry, tie-break, one-shot\n" }, { "commit": "f9ac047bc8ddad6bde0bbdf8e56318991d4f5209", "tree": "fbaf02568ca182656eac2b06bd531f24a0162b32", "parents": [ "b2eaf1bcaccb2633509010e00b9b57a07b24521f" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Tue Aug 11 15:10:44 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Mon Aug 17 15:40:24 2026 -0700" }, "message": "ast10x0: scaffold timer qemu test suite\n\nKernel target + single-process test_timer app + interrupt object (IRQ 44).\nStub app passes trivially; harness verified to detect both PASS and FAIL.\n" }, { "commit": "b2eaf1bcaccb2633509010e00b9b57a07b24521f", "tree": "12cebd422884f793d7576e91e0aca0ad29466b41", "parents": [ "56233e76f0c75afc7ac33358272519b39526d1cd" ], "author": { "name": "Anthony Rocha", "email": "anthony.rocha@amd.com", "time": "Fri Aug 07 14:04:00 2026 -0700" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Mon Aug 17 10:36:19 2026 -0700" }, "message": "orchestrator-sm: carry recovery attempt on RecoverComponent\n\nEmit the per-component retry count as RecoverComponent { id, attempt } so\nthe driver picks a recovery source per attempt without its own counter.\n" }, { "commit": "56233e76f0c75afc7ac33358272519b39526d1cd", "tree": "7f228efc94b1e36b63327b1f004987ef8653c106", "parents": [ "635ecac2e31f5f9c3fabce9dc0eb4cdbade92ad6" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Mon Aug 17 11:09:14 2026 +0200" }, "committer": { "name": "leongross", "email": "leon.gross@rub.de", "time": "Mon Aug 17 14:18:36 2026 +0200" }, "message": "docs(orchestrator): apply review suggestions from leongross\n\nRename the scope heading, access-not-touch wording, and link the\nservices/i2c and services/mctp crates the layering paragraph cites.\n\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "635ecac2e31f5f9c3fabce9dc0eb4cdbade92ad6", "tree": "fa532c5b7d7f92892b5062d2b7786a66b1153e26", "parents": [ "2bf9533c7e78ad78f0a1ed2142294545788b5f0b" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Fri Aug 07 11:30:28 2026 +0200" }, "committer": { "name": "leongross", "email": "leon.gross@rub.de", "time": "Mon Aug 17 14:18:36 2026 +0200" }, "message": "docs(orchestrator): SPI monitor reports facts, not corruption verdicts\n\nPer review: services provide facts, the state machine judges them.\nRelabel the SPI edge and add the facts-not-verdicts rule.\n\nAssisted-by: Claude:claude-fable-5\n" }, { "commit": "2bf9533c7e78ad78f0a1ed2142294545788b5f0b", "tree": "c756141e42d4e8b48876f08cfeed1dee80c037bf", "parents": [ "bdd208e67a3fdf93cc87dccee90ea4f7533da7e8" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Fri Aug 07 11:27:46 2026 +0200" }, "committer": { "name": "leongross", "email": "leon.gross@rub.de", "time": "Mon Aug 17 14:18:36 2026 +0200" }, "message": "docs(orchestrator): scope platform page to the platform half\n\nPer review: decisions and the chain walk live in the state machine and\nare documented there. Drop the Responsibilities section that restated\nthe mission; open with the sensors/actuators framing. Keep the SPI\nwrite-filter TOCTOU fact in the boundary section.\n\nAssisted-by: Claude:claude-fable-5\n" }, { "commit": "bdd208e67a3fdf93cc87dccee90ea4f7533da7e8", "tree": "eb45dd8d6998d7a580fb1a5084d2238d8a7f11d4", "parents": [ "23dfbd86bf9c25adb2f9f5b8236645ecb89a2aed" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Fri Aug 07 10:34:56 2026 +0200" }, "committer": { "name": "leongross", "email": "leon.gross@rub.de", "time": "Mon Aug 17 14:18:36 2026 +0200" }, "message": "docs(orchestrator): show the IPC seam to platform services\n\nPer review: services are reached syscall-like — the orchestrator issues\nan IPC call, the service does the hardware I/O on its behalf, and the\ndata returns via IPC. Name the existing service crates in the diagram\nand add a legend showing the client / client-ipc / server round trip.\n\nAssisted-by: Claude (claude-fable-5)\n" }, { "commit": "23dfbd86bf9c25adb2f9f5b8236645ecb89a2aed", "tree": "73aeca62c9e33c11f31f7bd4d5dedce8cf2169ba", "parents": [ "88f2ab0c3aa05b3554d039755ae5a62ec52a604c" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Wed Aug 05 11:06:54 2026 +0200" }, "committer": { "name": "leongross", "email": "leon.gross@rub.de", "time": "Mon Aug 17 14:18:36 2026 +0200" }, "message": "docs: add orchestrator Platform Architecture design page\n\nThe platform half around the state-machine core: surrounding services,\ncapability contracts, the board device table, and the fail-safe rules\nat the responsibility boundary.\n" }, { "commit": "88f2ab0c3aa05b3554d039755ae5a62ec52a604c", "tree": "edef180d3e613eb935d82a2ec9ac2e513ae57428", "parents": [ "aa9a2dfff005cd4e82f3cf4b804e9793934cfce9" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Fri Aug 07 11:23:11 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 11 16:04:33 2026 -0700" }, "message": "orchestrator: Fold BootStatus into the evidence module\n\nWithin the crate only EvidenceReader consumes BootStatus — it is the\ntrait\u0027s return vocabulary — so the enum does not earn a module of its\nown. The crate-root re-export is unchanged; no import anywhere moves.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "aa9a2dfff005cd4e82f3cf4b804e9793934cfce9", "tree": "7bf3ac23584295b16bfeb5d13f106f0e3e29a55e", "parents": [ "d111508b3f25071908dee61c4cceb034d6c7ebd2" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Fri Aug 07 11:14:07 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 11 16:04:33 2026 -0700" }, "message": "orchestrator: Make invalid table entries unconstructible\n\nEvery schema check is per-device, so the constructors can run them\nall. BootCheckpoint::new and DeviceConfig::new are const fn -- board\ntables still build in const context, so a bad table is still a build\nerror -- but the fields are private now, and a checkpoint or device\nentry that violates the schema cannot be constructed at all.\n\nThe free validate() is gone with the loophole it carried: it had to\nbe remembered, and a board table that dropped the const fence\ncompiled fine while broken. Construction is the one gate every entry\npasses. Board-local checks keep the const-fence pattern\n(validate_signals in the mock table), reading through the new\naccessors.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "d111508b3f25071908dee61c4cceb034d6c7ebd2", "tree": "3184b4df506331fad6c3a8932a983f2c3fdce003", "parents": [ "40dbf9ef69456231e0051bb1651a668f3d3f97f8" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Thu Aug 06 11:31:31 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 11 16:04:33 2026 -0700" }, "message": "orchestrator: Pin the orchestrator seams in the docs\n\nPin three facts the docs left implicit: checkpoint timeouts\nare table data the walk consumes — the clockless state machine never\nsees a duration, a component\u0027s boot timeout is just its walk over the\nwindows; the device table is the authority the chain is built from;\nand Complete maps to ComponentReady or Booted by component kind, in\nthe shell.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "40dbf9ef69456231e0051bb1651a668f3d3f97f8", "tree": "0e0fae2db8c39092ea03fff09d75eabc5558c8f5", "parents": [ "2ca67888f1d916fbda9437e623138850e9e79737" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Thu Aug 06 10:55:08 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 11 16:04:33 2026 -0700" }, "message": "orchestrator: Leave retry and terminal decisions to the orchestrator\n\nWalkVerdict now reports observation only: Failed{checkpoint, cause}\nreplaces Retry/Dead/retries_left — the state machine\u0027s\nComponentStatus.retry and Recovering→RecoveryFailed path already own\nthose decisions, and a second counter could only agree or disagree\nwith the first. max_retries leaves the table for the same reason: a\nretry re-resets the device and re-runs the whole walk, so budgets are\nper boot attempt, owned where boot attempts are owned. The device\u0027s\nown judgment still flows up as FailureCause::{TimedOut,\nDeviceRetriable, DeviceFatal} — the one input the retry decision\nneeds.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" }, { "commit": "2ca67888f1d916fbda9437e623138850e9e79737", "tree": "d1dc6e04335c24f19ae046e41bfc1beba4bfdc47", "parents": [ "00658c13f76eb92721ab97c11526abf1f426e622" ], "author": { "name": "Christina Quast", "email": "christina.quast@9elements.com", "time": "Thu Aug 06 10:50:09 2026 +0200" }, "committer": { "name": "Anthony Rocha", "email": "116300062+rusty1968@users.noreply.github.com", "time": "Tue Aug 11 16:04:33 2026 -0700" }, "message": "orchestrator: Drop CommitPolicy from the device table\n\nWhether a device must attest before its update commits follows from\nwhat kind of device it is (iRoT-backed or symbiont — the\norchestrator\u0027s ComponentKind); the CSA defines only that distinction.\nA second table knob could only agree with the kind or contradict it.\n\nAssisted-by: Claude:claude-fable-5\nSigned-off-by: Christina Quast \u003cchristina.quast@9elements.com\u003e\n" } ], "next": "00658c13f76eb92721ab97c11526abf1f426e622" }