From e41b10d655d58fdb44e2619838efd85fdc6a53cf Mon Sep 17 00:00:00 2001 From: ScottW514 Date: Fri, 14 Aug 2026 17:12:03 -0400 Subject: [PATCH] BRINGUP: record audit Phase 5 (physical-evidence instrumentation) Emission witness, lid IR fire watch (watch-only until characterized), faults/HV telemetry, measure-laser cleanup, and the head I2C error fix (rides the pending image flash); bench items listed. --- docs/BRINGUP.md | 37 ++++++++++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/docs/BRINGUP.md b/docs/BRINGUP.md index 71a3bf7..60b492c 100644 --- a/docs/BRINGUP.md +++ b/docs/BRINGUP.md @@ -1,11 +1,46 @@ # ForgeFIRM bring-up status & cold-start runbook -Last updated: **2026-08-14** — **audit remediation Phases 0 through 4 +Last updated: **2026-08-14** — **audit remediation Phases 0 through 5 landed** (from an independent whole-tree audit dated 2026-08-13; the remediation is sequenced behind two gates — GATE A, uncommanded energy, before any further live-fire; GATE B, control surface + release, before any published release). +**Phase 5 (physical-evidence instrumentation) is code-complete and +host-verified.** The machine now watches what it *does*, not just what +it commanded. The cooling engine's 1 Hz tick runs the witnesses: +`cnc/laser_on_sampled` — the sampled, gated output of the hardware +AND-gate — is the emission ground truth, and emission sensed with no +armed window in the recent past stops motion and locks the latch +(repeating while the evidence persists); laser power-good degradation +during an armed window warns once per session; `cnc/faults` +transitions are warned during a run; `pic/hv_current` (the only live +HV telemetry) is ranged per job (A-1, A-4, A-5). The GRBL controller +carries its own in-process witness: emission sensed while the armed +window is closed relocks the latch and raises an alarm (A-1 ctrl +half). The four `pic/lid_ir_*` channels are polled every tick — each +job logs baseline and peaks (the characterization dataset), and the +fire-abort gate (`cool_fire_ir_delta`: sustained rise above run-start +baseline → motion stopped, latch locked, verdict `FIRE` + hold, smoke +airflow held) **ships watch-only (delta 0) until the sensors are +characterized on the bench** (A-2). `/status` exposes the sampled +evidence, faults, HV, and lid IR; the panel's latch row is relabeled +*commanded* with sensed emission and power rows beside it. Cloud: a +failed head capture can no longer leave the measure laser lit — the +capture runs under try/finally and `_action_cleanup` extinguishes the +head emitters (C-3). Kernel (rides the pending image flash): the head +I²C read helpers return signed values with errno propagated, so a bus +glitch reads as an error instead of `beam_detect_analog=65531` / +`accel_irq=1` — the witnesses can no longer be spoofed by a failed +read (K-11). Host verification: forgectrl and the controller build +clean, stream harness all-PASS byte-identical, cloud client +byte-compiles. **Bench items:** command a fire window and confirm +`laser_on_sampled` tracks it (and confirm the idle-state PGOOD +polarity for the panel row); force a head I²C error and confirm the +witnesses report error, not a positive; baseline the lid IR channels +across real jobs and set `cool_fire_ir_delta`; confirm a failed head +capture leaves the measure laser off. + **Phase 4 (stale-gate cluster) is code-complete and host-verified; all of it is hot-deployable (no kernel rows).** The operator-armed window is now **job-based**, not 60-second-idle-based: it closes at program