orchestrator: Wire reset actuation into the platform driver - #421
Draft
chrysh wants to merge 4 commits into
Draft
Conversation
ImageSource is board-supplied access to a component's active image (interposed flash, PLDM transfer, test double); Verifier judges it, and its error means the check could not run — a bad image is Verdict::Rejected, never an error. BoardTypes and Board bundle one board's types and wired instances; a new seam adds an associated type and a field, not another parameter. Assisted-by: Claude:claude-fable-5 Signed-off-by: Christina Quast <christina.quast@9elements.com>
One executor method per SM effect, each documenting its obligation from the platform-boundary contract (orchestrator-model.md §6); unimplemented executors fail closed. read_firmware opens the image source; verify_firmware has the verifier judge it and queues the verdict, which the driver loop feeds back via take_event. Assisted-by: Claude:claude-fable-5 Signed-off-by: Christina Quast <christina.quast@9elements.com>
PR OpenPRoT#357 already settled this word: 'shell' reads as bash, and the docs say platform driver. The crate follows: PlatformDriver in driver.rs, DriverError, openprot_orchestrator_driver. The outer pump is now the event loop, freeing 'driver' for the struct. Assisted-by: Claude:claude-fable-5 Signed-off-by: Christina Quast <christina.quast@9elements.com>
The Reset seam fills in: BoardTypes names a BootControl per board, Board carries one line per component, and assert_reset/release_reset actuate them. Actuation only — boot-progress feedback stays with the Evidence seam follow-up. MockReset starts held, as hardware does, so the tests prove the at-rest guarantee: held through verification, released only on the verdict, and a dead line fails closed. Assisted-by: Claude:claude-fable-5 Signed-off-by: Christina Quast <christina.quast@9elements.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #418 — only the last commit ("Wire reset actuation into the platform driver") is new here; review the rest there.
Fills the Reset seam:
BoardTypesnames aBootControlper board,Boardcarries one line per component, andassert_reset/release_resetactuate them.Actuation only — boot-progress feedback (
ComponentReady/Booted/Timeout) belongs to the Evidence seam follow-up and arrives as outside events, never from these executors.MockResetstarts held, as hardware does at power-on, so the tests prove the at-rest guarantee end to end: held through verification, released only on the verdict, a dead line fails closed (SM latchesLocked, component never leaves reset).