BFE EngineeringandClaude Opus 4.8
5a8b60ba3a
Second recursive pass: two adversarial re-reviewers verified the iteration-1 fixes.
Fuzz/empirical checks cleared the freshness min-budget rewrite (200k random trials),
the config-lint reg-token scanner, its UTF-8 boundary safety, and the build-kernel.sh
trap (5 exit scenarios) — no defects. Three items corrected here:
- config-lint is_known_safe_loader: match the WHOLE normalized loader name, not an
unanchored substring. The iteration-1 allowlist swap kept `contains()`, so a future
coprocessor whose name merely contained a boot word ("AudioLoader" ⊃ "loader",
"SplRtos" ⊃ "spl", "Bl32" ≠ "bl31") would have been waved through — reopening the
0x40000-brick false-negative the fail-closed change exists to prevent. Regression
test added with those exact adversarial names.
- docs/architecture.md §3: the `cru` bullet no longer claims flared's devmem `Bus`
seam is shipped — it lands when flare-edge consumes warden-sdk ([maintainer]-gated), which
is what §7 item 3 already said. Resolves an in-document contradiction.
- drivers/README.md: modbus "11 pty scenarios" -> "8 pty scenarios + 3 wire/daemon
checks (11 total)", matching flare-edge tools/modbus-sim's actual SCENARIOS list.
- docs/decisions/0002-mcdc-tiering.md: Consequences now describe the shared
drivers/enforce-mcdc.sh + drivers/<name>/test/ layout actually built (not the
per-driver dirs the ADR first anticipated); Rust MC/DC tooling reality noted.
config-lint: 9 tests pass; clippy clean under -D warnings; gitleaks clean. C drivers
untouched (still relays 40/40, freshness 66/66 MC/DC).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf
drivers/ — our own hardened, hardware-facing drivers
Per ADR-0002 (tiered MC/DC) and ADR-0005 (source-of-truth), our own hardware-facing code migrates here behind a HAL seam and is hardened. "100% MC/DC on 100% of drivers" is infeasible (≈97% of kernel-driver LOC is vendor blobs — AIC8800 alone is 88.5K lines); the realistic, honest target is tiered.
Tier 1 — real 100% MC/DC (here now, CI-enforced)
Self-contained logic with a clean seam, measured to 100% MC/DC (gcc-14
-fcondition-coverage) by the CI mcdc job (make -C drivers/*/test check):
| Driver | Seam | MC/DC |
|---|---|---|
relays/ |
relay_io vtable (sysfs backend + in-memory fake) |
40/40 conditions, 100% |
freshness/ |
produce/render callbacks (the "no stale numbers" guard) | 66/66 conditions, 100% |
Adding a Tier-1 driver: copy <name>.{c,h} here, put the hardware/OS calls behind
a small injectable seam, then mirror relays/test/ (a fake backend for the logic
branches + a real backend over a scratch tree for the plumbing). Reuse the shared
gate — the Makefile calls bash ../../enforce-mcdc.sh <gcov.log> build/<name>.c.gcov build/test.rc (it derives the driver name from the .gcov file, so there is no
per-driver copy to keep in sync). The CI mcdc job picks up any
drivers/*/test/Makefile automatically.
Tier 2 — serious testing + fault-injection + benchmarks
Drivers too large or too vendor/UI-coupled for literal MC/DC get fault-injection,
branch coverage, and benchmarks against the simulator instead. Their hardware side
is already modelled and tested here in ../sim/:
| Driver | Serious-testing status | SDK model |
|---|---|---|
modbus_engine.c (RS485 master) |
8 pty scenarios + 3 wire/daemon checks (11 total) + fault-injection (flare-edge tools/modbus-sim/, green) |
sim::modbus RTU slave (11 tests, silent-drop/forced-NAK faults) + modbus_read_holding benchmark |
warden_rga.c (RGA offload) |
offload-dispatch + CPU-fallback logic | sim::rga recording improcess fake (programmable IM_STATUS) + rga_improcess benchmark |
HPMCU supervisor (hpmcu.rs) |
arm/beat/fire + boot-grace safety property | sim::hpmcu (7 tests) + hpmcu_tick benchmark |
Why the Tier-2 source isn't vendored here yet: modbus_engine.c and
warden_rga.c pull in shared UI headers (platform.h, settings.h, lv_*) and
librga. Copying those in would duplicate exactly the shared surface the
flare-edge↔warden-sdk unification (ADR-0003/0005, a separate [maintainer]-gated step) is
meant to resolve cleanly. So the Tier-2 models (the hardware ends) live here now;
the Tier-2 driver sources migrate in with the unification, at which point their
existing flare-edge harnesses point at this repo.