Repository navigation
fix(firmware): build CV1 custom MCUboot and block stock bootloader artifacts - #25104
Merged
Merged
Conversation
Build the Omi SD initialization main through sysbuild, gate boot regions, and stage app-only recovery HEX while custom MCUboot awaits bench qualification. Failure-Class: new
…odule Failure-Class: new
Strengthen compiled SD sequence evidence, record the actual compiler, and normalize disabled batch launchers. Failure-Class: new
…covery limits Record 3.0.19 static key/layout compatibility without preapproving it, strengthen compiled SD sequence regressions, and migrate the release-process smoke to the sibling boot gate. Failure-Class: new
…iagnostics Failure-Class: new
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
Git-on-my-level
marked this pull request as ready for review
November 11, 2026 10:28
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by David
CV1 release app-core HEX assets could replace the working Omi MCUboot with stock MCUboot. Without Omi's SD init/deinit sequence, an uninitialized SD drives the shared SPI3 MISO line and corrupts NOR reads; MCUboot can reject and erase a valid staged OTA. OTA ZIPs themselves never replace the bootloader.
This PR builds the existing Omi main through an MCUboot-only sysbuild overlay and requires the full padded [0, 0x10000) region to equal the qualified 3.0.19 hash
6cfd4a70a715c8885dd86db96eb97286590852dd4b0f28d9f7374faad235cad1. CI checks the public-key hash, production config, slot geometry, compiled SD sequence and identical hashes from two clean MCUboot compilations. Factoryc80cf2fd...da086remains an approved installed/restoration state. The initialized end at 0xCEBC is within the actual reservation; the lead retired the earlier 0xCE00 heuristic.Release app-core HEX is constructed from that pinned bootloader and the exact signed app bytes in the staged OTA ZIP. It excludes storage, UICR and network-core addresses. Staging, promotion and publish strictly reparse every staged HEX and enforce the boot pin plus exact OTA/app equivalence, even if checksums/receipts are edited. Merged app-core images support manufacturing and wired repair of stock-loader units; deliberate app-only recovery remains available when preserving an approved loader. OTA defaults to app-only and the separately named CPUNET asset is unchanged.
Lead-run jig receipt, 2026-11-11: factory boot backup matched
c80cf2fd; boot-onlyloadbinand readback installed6cfd4a70, byte-identical to CI run 42986142335 ateec9bff0be368557cde464f9e43b62b47c28a98e. After restoring only the .21 app, BLEimage-upload --mode confirmof released .24omi.signed.bin(SHA-256b92ef865d865ad47242a4f70d050225cc65f42705b9d9c2931d4402a0c852978) installed image-hash prefix7083cb10: slot1 pending/permanent before reset, slot0 active/confirmed after, DIS 3.0.24, boot record v2/flags 0x1d, nor_fail=0 and sd_fail=0. Factory boot and .21 app were restored and verified. The committed audit records this receipt without probe/device identifiers. Production remains overwrite-only; unconfirmed-trial reversion is not required or claimed.The audit classifies historical loaders and records the lead's removal of unsafe app HEX assets for .2/.3/.4/.5/.20/.21/.23/.24. Gettop shipment claims remain unverified. Stock .21 loaders SPU-lock the boot region before app entry; no safe durable OTA-only repair is established. Recommend controlled wired repair or RMA, with aggregate-only manufacturer sizing. A bootloader-only change does not require 3.0.25 and cannot reach fielded pendants over OTA. Firmware version, signing keys, partitions and protection settings are unchanged.
Validation:
6848f819322422234e98fb0f4ba91c8f4abd5cad: production sysbuild, both compiled bootloader proofs, clean-rebuild byte comparison and evidence export pass. Downloaded artifact is byte-identical to historical .19; full hash/key/compiled SD sequence/source identity rechecked locally. The complete run is green: all 50 simulator scenarios and 40 fuzz seeds pass, QA staging and artifact upload pass, and local download inspection confirms the shipping loader plus exact OTA signed-app bytes, ending at0x50A14, with no forbidden app-core addresses.ci-wait 25104 BasedHardware/omiis green on exact head6848f8193224: 57 checks, zero pending and zero failed, clean/mergeable.05808c764973e2ce8f9fce7d1f8099df74015816db64382ab19a169bef222b10; it is internally consistent with its HEX/OTA package. The lead's physical app receipt above covers the released.24imageb92ef865..., not this newly signed QA app. Any future publication still requires the normal exact-app bench receipt.4ff0b5d05fe126197554cba2d640a78b6fc35819and the final SDK evidence-export delta at6848f819322422234e98fb0f4ba91c8f4abd5cadfound no remaining P1/P2 findings. No merge, version bump, tag, release or publish dispatch is authorized by this PR.All
.github/changes:.github/workflows/firmware_release.yml: compile/prove before the unchanged simulator gate; pass public run identity; upload separate MCUboot evidence and failed-build diagnostics in the existing manual build-only job. QA packaging remains behind both gates..github/checks-manifest.yaml: register boot-region regressions in local and CI lanes..github/ci-budget.yaml: refreshed inventory and explicit rationale for one bootloader-only rebuild within the existing manual job allowance; no new trigger/job/runner..github/scripts/check-release-process-guards.pyand.github/scripts/test_check_release_process_guards.py: load the packaging helper with its sibling gate, use scoped synthetic boot/HEX fixtures, and preserve the offline staging/publish smoke..github/failure-classes/FC-unqualified-bootloader-in-wire-image.json: reusable pin/region guard and regression surfaces for this failure class.Failure-Class: new