Repository navigation
feat(M4-P0E3C): verified three-MU group START/STOP with authoritative board readback - #358
Merged
Merged
Conversation
…ve readback Reuse single ESP32-P4 publisher/ISR/PTP/serial authority; introduce explicit M4START gated by boot/selected ARM3 hash, 3 current bank generations and hashes, all TX slots, PHY UP, fresh heartbeat and anti-replay. Prevent legacy V1 START bypass of selected M4 roster. Studio only admits matched SCD and unchanged three drafts, and requires exact M4START ACK + M4SHOW RUNNING or STOP ACK + M4SHOW STOPPED before claiming control-plane success. Disconnect revokes local proof without stopping autonomous output; failures remain uncertain and require explicit STOP. Extend existing native M4 and QML regressions; preserve official M3.H.3 release and shared 250us hot path. Hardware 3x4000fps Ethernet PCAP/long soak acceptance is still PENDING.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9e4b0dbf5f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…adback and explicit STOP recovery Resolve exact CI Qt operator workspace assertion without modifying the legacy pending-CFG START expression. Require firmware SvScenarioTransaction::verified_current_bank() for every M4 bank, not just caller-provided matching values; revokes on bank mutation or stage reset. Preserve manual priority STOP when START acknowledgement/readback is uncertain even if Studio never observed RUNNING; update compact existing STOP affordance. Present verified M4 RUNNING as RUNNING rather than an incorrect Studio session warning. Add positive/negative C++ and QML regressions using existing suites; no new workflows, publishers, timers or UI pages.
…stop incident latch Address P2 code-review findings on PR #358. Let firmware quiescence own its existing SV STOP ACK -> SHOW/SVLIFE and PTP STOP ACK/readback instead of starting forbidden M4SHOW during exclusive maintenance; preserve safe uncertainty. Clear operator STOP latch after proven group STOP and before a new verified group RUNNING, so future Ethernet/runtime faults generate the correct unexpected-stop incident. Do not mistake runtime forced STOP for operator ACK. Extend the existing deterministic session harness with maintenance proof, group lifecycle and incident-latch negative tests. No additional worker, timer, workflow, publisher or GUI.
…erving M4 group verification
…sabled A legitimate SVSTREAM slot STOP can change the M4 TX mask from 7 to any 3-bit value while the shared publisher remains active. Group STOP must still be verifiable with boot/roster/generation and running=0 instead of spuriously reporting UNCERTAIN due to mask !=7. Preserve strict mask=7 for group START, permit 0..7 only on STOP, and add native negative/positive state regression. No new controls, workflow or publisher changes.
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Real production milestone
Adds explicit 3-MU group START authorization and STOP confirmation through existing native Studio, single
DeviceIoWorker, ESP32-P4 UART task and the same 250us/4000Hz publisher. Does not introduce a new engine, GUI, FreeRTOS publisher, timer or CI workflow.Invariants
Regressions / gates
Updated existing native Qt uploader + deterministic session harness, QML safety contract and firmware ownership regression; exact paired ESP32-P4 firmware and Windows/Linux Studio preview are required. Do not merge unless all executed exact-head checks pass and any review findings are resolved. Physical PCAP measurement of 3×4000fps, sample epochs, live values and sustained timing is PENDING.
Related: #333; prior production M4 roster reconciliation #350 is already merged.