Strategic Objectives Completed

• Serial Track Execution: Hard split of tickets by track (idf vs zephyr) using per-track acceptance criteria in tickets.json.
• Root Cause Isolation: Debugged and isolated deep hardware and bridge quirks (WSL2 USB reset triggers, shared sdkconfig hazards, BLE controller linkage).
• Proven Reference Standard: Built a complete, battle-tested golden reference for signed OTA, wire telemetry, and CLI tooling that sets the contract for Zephyr.

Ironclad Zephyr Gate (BL-063b)

Zephyr bring-up (BL-030, BL-005b, BL-014b) has been strictly blocked behind the completion of this presentation deck.

With BL-063b complete, the Zephyr development gate is officially released!

Flash Partition Layout

16 MB Flash partition table (partitions.csv):

• 0x009000: NVS (24 KB)
• 0x00F000: otadata (8 KB)
• 0x020000: ota_0 (4 MB) [v1 Factory]
• 0x420000: ota_1 (4 MB) [v2 Target]
• 0x820000: storage (8 MB)

Memory & Subsystems

• Octal PSRAM: 8 MB AP_3v3 octal memory confirmed via boot self-test (BL-005).
• LED GPIO: GPIO48 WS2812 RGB LED verified via physical hardware toggle counting.
• eFuse Integrity: No eFuses burned; cryptographic checks handled entirely in software.

RPi4 Operational Role

Documented in docs/rpi4_limitations.md:

• RPi4 power supply exhibits brownout drops (~1 UV / 85s); flashing stays on dev workstation.
• RPi4 was audited (BL-056a); no update has been run from it yet and BLE is unavailable there today.

1. Connectivity & Security

• NVS Secrets: WiFi SSID, PSK, and Bearer token provisioned securely to NVS namespace lab (BL-024). Stack wiped with memset.
• Embedded TLS: Root CA and server certs embedded directly into binary via CMake EMBED_TXTFILES.
• HTTPS Server: Starts on WiFi connection; provides GET /version and authenticated POST /ota (BL-025).

2. Dual OTA Engines

• WiFi OTA Pull: Background FreeRTOS task downloads image via esp_https_ota with pinned Root CA verification (BL-026).
• NimBLE BLE OTA: Pinned espressif/ble_ota component with custom app-level Bluetooth controller lifecycle and MTU negotiation (BL-027).
• Crypto Gate: esp_ota_end() rejects non-RSA-3072 signatures before partition activation.

3. Self-Test & Rollback

• Health Gate: Post-boot FreeRTOS task requires $\ge 5$ s uptime and $\ge 5$ toggles before confirming (BL-023).
• Cancellation: Calls esp_ota_mark_app_valid_cancel_rollback() on pass.
• Watchdog Hang: Unconfirmed or hanging firmware triggers task watchdog panic and rolls back to previous slot (BL-028).

Wire Framing Format

$LAB,<TYPE>,<KEY>=<VAL>*<CRC16>\n

Examples:
$LAB,ANNOUNCE,board=idf,uid=E072A1AA2390*5A2F
$LAB,VER,app=1.0.0,git=deded39,slot=0,confirmed=1*E81D
$LAB,STATE,uptime_ms=12400,toggles=12,free_heap=184520*9A14
$LAB,ERR,reason=bad_crc*77C2

• Zero Malloc: Static buffers, fixed-time parsing, no heap fragmentation.
• MISRA-Compliant: Verified with GCC -Wall -Wextra -Werror.
• CRC-16-CCITT: Polynomial 0x1021; shared vectors in test_vectors.json.

Verification & Port Performance

• Unit Tests: 26 C Unity tests + Python tests passing identical shared vector suite (BL-011, BL-013).
• Fuzz Robustness: LibFuzzer target ran 10 min clean under ASan/UBSan without a single crash or memory leak (BL-012).
• Fast Dispatch Latency: Medians 2.7–3.3 ms; 100% queries $\le 4.6$ ms (BL-022).
• Stress Under Log Flooding: 1,000 consecutive queries with 0 corruption (BL-053).
• Atomic Print: One-fputs frame output prevents interleaving with FreeRTOS log output.

WiFi OTA Sequence (HTTPS Pull)

1. Host runs ephemeral local HTTPS server serving signed binary on port 8443.
2. Host dispatches authenticated POST /ota with Bearer token.
3. Board validates token, responds 202 Accepted, and spawns OTA task.
4. Board downloads binary over TLS, pinned to Lab Root CA.
5. esp_ota_end() performs cryptographic signature verification.
6. Active boot partition switched from ota_0 $\to$ ota_1.
7. Reboot $\to$ self-test confirms after 5s $\to$ confirmed=True.
8. Cross-check: LABID VER == HTTPS /version (PLAN §7.3.4).

BLE OTA Sequence (NimBLE Push)

1. Host scans and discovers nimble-ble-ota peripheral at base MAC+2.
2. Client negotiates MTU size (up to 512 bytes).
3. Client transmits START command over Command UUID.
4. Image split into 4 KB sectors; packets streamed over Data UUID.
5. Board verifies sector checksums and writes to target OTA slot.
6. Client transmits STOP command; board calls esp_ota_end().
7. Board reboots into new slot and validates self-test.
8. Host queries LABID over serial confirming slot flip and new version.

Diagnostics & ID

$ labflash doctor
[OK] Python 3.12, pyserial, bleak
[OK] Rig config valid

$ labflash identify
idf: COM14 [E072A1AA2390]

$ labflash info idf --json
{"app":"1.0.0","slot":0,"confirmed":true}

$ labflash measure idf
10 toggles in 5.00s = 1.00 Hz [PASS]

Flashing & Recovery

# Safe pre-write UID check
$ labflash flash idf
[OK] Verified UID E072A1AA2390
[OK] Flashed bootloader, partitions, app

# Automatic recovery
$ labflash recover idf
[OK] Erased flash
[OK] Restored factory v1 state

$ labflash provision idf \
    --ssid LAB --psk-file psk.env

Build & Update

# Per-dir sdkconfig isolated builds
$ labflash build idf --variant v1
[OK] Built build/bootlab_idf_blink.bin
[OK] Verified CONFIG_APP_VARIANT_V1=y
[OK] Verified RSA-3072 signature

# Automated dual-transport update
$ labflash update idf \
    --image v2.bin --transport wifi
UPDATE OK (slot 0 -> 1, confirmed)

Antigravity (Google DeepMind)

System Architecture & Verification Rigor

• Architected empirical verification gates (evidence before assertion, zero vacuous passes).
• Designed end-to-end multi-transport test matrices, ticket governance, and system specifications.
• Engineered interactive presentation engines and production documentation portals.

Claude (Claude Code)

Firmware Systems & Low-Level Engineering

• Developed production FreeRTOS & Zephyr RTOS C99 firmware stacks on ESP32-S3.
• Engineered MCUboot swap-with-revert hooks and hardware watchdog fail-safes.
• Diagnosed and bypassed critical traps: WinRT BLE GATT caching and serial COM locking.

Hermes Agent

Autonomous Edge Test Runner

• Operates locally on edge host (msa-linuxRPi4) executing unattended test plans.
• Autonomously coordinates network OTA validation and target health queries over LAN.
• Strict operational security boundary: zero-sudo privileges and ephemeral key isolation.

Raspberry Pi 4 (rpi4-hil)

Physical Hardware Edge Bridge

• Colocated hardware runner bridging cloud/workstation AI with physical target silicon.
• LAN network dispatcher isolating targets from USB flashing power brownouts (0x50000).
• Hosts self-hosted GitHub Actions runner (rpi4-hil) and automated test loop.

1. WSL2 / usbipd Reset Trigger (R14)

Trap: Opening USB serial inside WSL2 asserts DTR/RTS, forcing the ESP32-S3 into ROM bootloader.

Fix: Monitor serial natively on Windows COM14 with DTR/RTS suppressed.

2. Shared sdkconfig Contamination (R15)

Trap: CMake build dirs share a root sdkconfig; variant symbols silently bled across builds.

Fix: Use -DSDKCONFIG=<dir>/sdkconfig and verify output symbols post-build.

3. Serial DTR/RTS Reset Mid-OTA (Trap 34)

Trap: Telemetry queries or serial opens pulsed DTR/RTS, rebooting target mid-download.

Fix: Suppress control lines (dtr=False, rts=False); forbid fresh port opens during active OTA.

4. Salted RSA-PSS Signatures (Trap 30)

Trap: IDF Secure Boot v2 uses salted PSS; whole-file SHA-256 differs on every rebuild.

Fix: Compute content-only SHA-256 excluding signature trailer for reproducible verification.

5. Software vs Hardware Resets

Trap: Software resets (esp_restart) keep the USB port alive; waiting for disconnect hung scripts.

Fix: Listen for $LAB,ANNOUNCE or poll endpoint rather than port drop.

6. Vacuous Evidence Pitfalls

Trap: Server-side "bytes served" logged success during TCP RST truncation.

Fix: True proof requires on-target log verification of cryptographic rejection.

7. Windows COM Exclusivity

Trap: Windows COM port locks block telemetry while console logging is active.

Fix: Implemented SharedConsolePort teeing lines to background handles.

8. RPi4 Power Brownouts (0x50000)

Trap: RPi4 USB power dips trip resets during bulk flash erase/write.

Fix: Flashing stays on stable dev workstation; RPi4 limited to OTA dispatch.

Hardware Handover Checklist

Before launching Zephyr, target board lab-esp-idf was returned to a stable, known-good baseline state:

• Reflashed factory firmware v1.0.0 (slot 0, 1.00 Hz LED).
• Verified confirmed slot via $LAB,VER*11 and HTTPS /version.
• Power consumption verified baseline nominal ($\le 120$ mA).
• Both OTA partitions intact, ready for automated updates.

Zephyr Track Next Steps (P2)

With BL-063b closed, the Zephyr development gate is officially unlocked:

1. Step 1 (Mandatory Gate): Verify MCUboot swap-with-revert on ESP32-S3 (BL-030).
2. Step 2: Hardware detection on Zephyr board (LED GPIO & Octal PSRAM, BL-005b).
3. Step 3: Zephyr native_sim compilation of LABID common library (BL-014b).
4. Step 4: mcumgr SMP over BT + WiFi UDP in a single image (BL-031..BL-037).