D1: Deliver the bounded maintenance CLI

[Tinnci]

Goal

Deliver a bounded local USB maintenance interface without bypassing platform ownership, application lifecycle or security policy.

Scope

Static commands, USB session, typed owner-context dispatcher, copied status results, bounded log/input streams, confirmed mutations and hardware qualification.

Non-goals

An OS shell, scripting, arbitrary memory/files/peripherals, command plug-ins, BLE terminal text, direct service calls from the CLI task or a public SDK event bus.

Dependencies

Independent of M5 and R1. Read-only work can proceed beside C1. Connectivity mutations require the applicable C1 authorization contract.

Acceptance criteria

• docs/MAINTENANCE_CLI_CONTRACT.md is implemented and remains consistent with code.
• CLI task performs terminal work only; platform work executes at the application-owner safe point.
• Fixed capacities, explicit failure, cooperative cancellation and authority policy are tested.
• Android maintenance uses typed protocol requests and does not carry CLI text.
• All software gates and the real Note4 USB/hardware gate pass.

Automated evidence

Host semantic tests, dispatcher concurrency tests, architecture/SDK checks, ESP-IDF clean build and command golden transcripts.

Hardware evidence

USB connect/reconnect, read-only commands, confirmation, Ctrl+C, log/input streams, sleep/wake and shutdown without panic, watchdog or unexpected reset.

Closure condition

Close after all D1 child Issues pass and their evidence is attached to pushed main.

[Tinnci]

D1 start checkpoint (cb6b770)

• Added docs/MAINTENANCE_CLI_CONTRACT.md and aligned docs/ROADMAP.md.
• Created the acyclic D1.1-D1.7 Issue sequence.
• Implemented and closed D1.1 (D1.1: Define and implement the bounded CLI core #41): bounded transport-independent command core, descriptor tree, parser, output and cancellation state.
• Host CLI tests, architecture checker, SDK v1 checker and ESP-IDF v5.5.2 build pass.
• Firmware size remains 0x12af10 with 61% free because the unreferenced core is currently removed by linking.

Next is #42: USB Serial/JTAG session and transport. No CLI task is allowed to call a Service or ApplicationRuntime directly.

[Tinnci]

G1.1 delivery review — 2026-09-10

The local backlog's D1.1–D1.3 is complete, but it is a smaller decomposition than GitHub D1.1–D1.7. Main now contains USB sessions/history, the owner dispatcher, system/display diagnostics, bounded log observation and an interactive Host simulator. 07b9c53, 5645091, 3eb86df and 249a5a1 record the later delivery. All 34 current Host targets pass.

This umbrella remains open. #44 still lacks power/time/connectivity/app status commands; #45 lacks the non-consuming input mirror and input watch; #46 lacks end-to-end physical confirmation and mutations. #42/#43 also retain their real USB transcript requirements, and #47 remains the aggregate qualification tracker. The contract and production command table explicitly distinguish implemented commands from planned commands. #58 explores future USB architecture and does not mark any of those missing commands complete.

[Tinnci]

G1.2 status reconciliation: D1.4 (70a8a0a) completes the previously missing status/input/confirmed-maintenance software, and D1.5 (108e96d) adds foreground health supervision and a recoverable Home failure path. All 40 Host targets pass locally. Implementation and verification are documented in the CLI contract and reliability record.

#42–#47 remain open for their original real USB reconnect, command transcript, streams, confirmation and sleep/wake requirements. This umbrella remains open until those child criteria and pushed-main evidence are complete.