Next iterations and team execution¶
Stage one: turn software candidates into physical evidence¶
The highest priority is connecting the three actual launch Boards, recording PCB/crystal/power/wiring, and establishing probe, serial and waveform/power-cut stations. G474/H743/U575 source-reference configurations require separate actual-board checks. H743 additionally needs power-mode observation; U575 requires option-byte/start-state confirmation before running an image. Check safe initial outputs and clock first, then UART true TC, cancellation, RX loss, watchdog reset, Flash power cuts and EXTI/PWM/ADC. Qualify each mode only on actually executed target tuples. Keep trial outputs disconnected from product loads; station contracts govern field actions.
Use the same candidate ELF to measure cycles, IRQ latency, maximum service interval, stack high-water, loss and sustained load. Source/assembly inference helps locate causes but is not a measured timing result. Budget or provider changes require regenerated source/config/artifact evidence.
Stage two: add capabilities according to measurements¶
F407/F470 already have bounded UART/SPI DMA, continuous UART RX/bidirectional DMA, bounded/continuous ADC trigger blocks, I2C IRQ/DMA, Classic CAN, USB FS PIO and Ethernet/capture/complementary-PWM exact software fixtures. First refine these existing modes with actual throughput, IRQ latency, inter-block gap, line-drain and overload measurements. Continuous modes cannot promise losslessness under arbitrary IRQ latency or consumer speed. I2C remains 100 kHz, 7-bit, 1–256 bytes per message, at most eight messages and exact routes; 10-bit or longer transactions are separate extensions.
H743 currently maintains fixed HSI clocks, timebase, GPIO, IRQ UART and explicitly selected finite UART TX DMA. Cache-on TX accepts only AXI SRAM payloads whose complete cache lines are exclusively owned; RX remains IRQ bytes. U575 maintains its default TZEN0 Platform separately from the independent TZEN1 synchronous dual-world GPIO reference; the dual-world reference provides no RTOS, factory or asynchronous DMA. Chip facts authorize no other modes, routes or physical qualification. The sequence and explicit exit conditions are in SOC-28–36:
Direction |
Contract to fix before implementation |
|---|---|
New G474 modes or more controllers/routes |
Exact registers, IRQ/DMA conflicts, Board provenance, instance isolation and budgets |
H743 DMA and Cache |
DMA1/2, BDMA and MDMA reachability domains; cache-line ownership, alignment and clean/invalidate timing; retained borrows on failure |
U575 DMA and security domains |
GPDMA/LPDMA descriptor lifecycle, memory/peripheral ownership, GTZC/MPCBB, actual TZEN entry and error handling |
New fixed clocks or runtime frequency changes |
Power/Flash/bus ordering, consumer reconfiguration, rollback and deadline domains; implement fixed profiles separately from dynamic transitions |
Bootloader handover or deep STOP |
Active VTOR/mask/FP/DMA state, RAM ownership, RTC/LPTIM continuous domain, wake recovery and precision |
Userspace I/O transport |
Actual principals, permissions, copy/pin, asynchronous borrows, exit reclamation and SVC/MPU/TZ gateways; the existing scalar broker does not replace transport |
Each extension first fixes owner, buffer, cancel/drain, ISR, deadline, alignment/cache and stop contracts. Then use GoogleTest/GoogleMock for an actual RED→GREEN production-provider vertical slice, followed by generated factory, ARM ELF, SDK and physical-boundary verification. Unselected modes retain no resources; growing generic-object costs are not imposed on every product.
Reuse existing narrow ports and static assembly first; allow explicitly versioned breaking changes when contracts cannot express hardware facts. Flash authentication, upgrades, manufacturing keys and industrial security policy belong to external products/independent mechanisms. Existing storage CRC or watchdog feed cannot establish their completion.
Ten-person roles and enterprise workflow¶
Role |
Seats |
Reviewable outputs owned |
|---|---|---|
Technical lead |
1 |
Contracts, boundaries, budgets, support scope and cross-layer design review |
Core/I/O/OS |
2 |
Ownership, concurrency, time, static resources and public ABI |
STM32/GD32 BSP |
2 |
Exact facts/routes, SDK/startup/provider and fault models |
Generic devices/communications and external applications |
2 |
Narrow-port components, device drivers and external composition |
QA/HIL |
2 |
Software faults, actual stations, timing/power-cut/sustained-load evidence |
Build/release |
1 |
Single configuration/CMake graph, locks/SDK, CI and candidate/reproduction evidence |
Codex assumes all maintenance responsibility; .github/maintainer-roles.json uses agent_managed. Ten-person roles remain domain/capacity divisions without requiring named accounts. The same maintenance responsibility covers security, manufacturing and field interfaces; product permissions/processes remain in external application repositories.
python tools/maintenance/ownership.py --require-assigned verifies responsible agents, path coverage, backup domains and required gates. GoogleTest/GoogleMock, configuration, ARM, budget, SDK and evidence-identity checks continue. This policy fabricates no CODEOWNERS and claims no independent human review. Actual GitHub branch-rule/required-check configuration still needs remote verification. Commands are in maintenance tools.
Issues describe concrete triggers and observable results. PRs state source/config/dependency/tool identities and affected contracts. Each commit automatically checks staged content and Conventional Commit; CI uses the same whole-file standard. New behavior and bug fixes require TDD: GoogleTest/GoogleMock for host contracts, unittest for Python tools. New cases run RED first, then a minimal GREEN fix. Mechanical gates do not prove historical editing order; PRs record commands, failure reasons and raw logs. IRQ, lifecycle, persistence and concurrency changes need actual failure-path regressions. Nightly/formal-candidate measurements, offline builds and station results are sealed separately; ordinary platform CI does not automatically promote production releases.