Hardware Fabric, Robot Drivers & Governed Execution

[wangxingjun778]

Features

• LHP hardware fabric and fleet lifecycle (583912f) — Node-side hardware/lhp/ layer (protocol, server, client, runtime) exposes local devices to the host over a shared-secret TCP fabric: leap hw serve, remote device namespacing (<node>__<device>), and a strictly one-way host→node dependency.
• Signed write permits and control sessions — Ed25519 execution permits (lhp/permit.py) with node write modes (permit_required / trusted_v1 / observe_only) and nonce-replay rejection; control.v1 sessions run ControlBus node-side under a host lease, with deadman expiry triggering comm_loss → halt.
• Governed write path (OODA execute loop) (0ffddf8) — Typed WriteExpectation/WriteVerdict four-state settlement (write_verification.py), feasibility gating (write_governor.py), execution authorization and interlocks; per-channel envelope and rate defenses in ControlBus and the LHP write precheck; trust is promoted only on verified settled outcomes.
• AgileX Piper arm driver (d4acf7e) — Node-local HCP transport over piper_sdk/socketcan: atomic six-joint vector writes with pre-send envelope enforcement, read-back verification, timestamp-based feedback freshness, EmergencyStop-only halt, and a governed arm.enable resume path; ships piper_arm.yaml and a 31-case fake-SDK suite.
• RealSense D435if pipeline (58ea745, c9ac5d4) — Serial-bound, lazily imported drivers/realsense.py with RGB / aligned-depth / IR previews and structured FrameReading interpretation metadata (depth scale, frame number, timestamps) over LHP; plus a ROS 2 image source (ros2_image.py).
• RoboHarm benchmark integration — External adapter, external/native manifests, and a native simulation benchmark under src/benchmarks/.
• Volatile prompt context (PCD) — VolatileContextProvider protocol and a bounded hardware-state provider, rendering per-turn context outside the byte-stable prompt prefix.
• Python 3.10 support (9a92934, e9ebe74) — requires-python >= 3.10 with compatibility fixes across the codebase.

Enhancements

• Completed the leap hw CLI surface — serve / verify / validate / probe / commission / permit-key / estop / pause / resume — all registered in argparse and digest-bound where applicable.
• Fleet registration via settings (hardware_fleet_nodes with token_env secret indirection); legacy environment fallback retained.
• Dashboard spawn hardening: captured server logs, startup-failure diagnostics with log tail, proxy-safe loopback probes, and leak-free child termination.
• Recovery checkpoint-halts on partial/unknown side effects; the unified classifier preserves the producer's side_effect_state instead of re-deriving it.
• Test coverage: 17 new test modules (drivers, LHP permits, write verification, reentry, realtime control); 33 suites extended.

Refactor

• Device-named drivers relocated from hardware/transports/ to hardware/drivers/; transports/ remains device-neutral (architecture contract restored).
• README restructured around hardware deployment modes with board-neutral, copy-pasteable quickstarts (78948bf).

Bug Fixes

• leap hw verify wrote verified.json to the wrong profile path; now consistent with ProfileLayout.hardware.
• Declaration digest mismatch fixed by computing from the raw pre-admission YAML context rather than post-admission (demoted) context.
• Missing argparse registrations left hw verify/validate/init/probe/commission/permit-key unreachable ("invalid choice").
• Hardware regression fixes and realsense YAML corrections (b6deefe, c9ac5d4).

Documentation

• AGENTS.md engineering contract updates: engine module architecture rules, TUI/session invariants, and hardware governance boundaries.
• New annotated device declaration examples: piper_arm.yaml, realsense_435if.yaml, realsense_ros2.yaml.

Maintenance

• Removed 28 scratch files under temp/ from git tracking; dropped an accidental AGENTS.md ignore rule (2aa93f2).
• Lockfile refresh (uv.lock) for the Python 3.10 floor.