also looking at this
feat: own runtime firmware candidates
#49
24 files
+1245
-92
| @@ -262,12 +262,16 @@ verified crash-prefix recovery, provenance and offline replay through CLI and `/ | ||
| 262 | 262 | |
| 263 | 263 | The viewer opens files locally in the browser. The v1 format excludes imagery, location and |
| 264 | 264 | operator tokens. See [diagnostics, durability and remaining acceptance](docs/diagnostics.md). |
| 265 | The [signed runtime image stage](docs/runtime-updates.md) now verifies offline TUF | |
| 265 | The [signed runtime image workflow](docs/runtime-updates.md) verifies offline TUF | |
| 266 | 266 | candidates through `updates:stage` and `updates:inspect`, with explicit root pins, |
| 267 | 267 | compatibility and externally supplied release floors. `updates:enroll` and |
| 268 | `updates:trust` preserve and independently verify an initial root/policy record. | |
| 269 | Physical logging/commissioning, persistent refresh metadata/release floors, image | |
| 270 | installation and known-good rollback remain pending. | |
| 268 | `updates:trust` preserve the initial root/policy record. The independently pinned | |
| 269 | store retains verified metadata, clock/release floors and historical recovery; | |
| 270 | `updates:prepare` authenticates actual image bytes under that protected state. | |
| 271 | `updates:reserve`, `updates:candidates` and `updates:retire` add durable candidate | |
| 272 | identity, recorded-byte status and explicit retirement while retaining files/history. | |
| 273 | Physical logging/commissioning, key revocation/repair, installed/known-good slots | |
| 274 | and image-bound boot/session health remain pending. | |
| 271 | 275 | |
| 272 | 276 | ## Sensor acquisition and replay |
| 273 | 277 | |