BLACKWAVE
// DEVICE DEPLOYMENT TERMINAL
// 01 Targets
Eleven contract devices and one infrastructure host. Every card shows the reconciled evidence state from docs/research/current-state.md — no state is ever promoted without matching machine-readable validation data.
Pi 500 is infrastructure inventory. Image-writing would be a separate, deliberate workflow with a different threat model (full-disk image, not flash partition).
// 02 Recovery & Safety
Every device gets a recovery card. The flasher will never silently:
...when only the download succeeded. Verifies the artifact before reporting success.
...when only a USB VID/PID matched. Carries a confidence score; AMBIGUOUS halts the flow.
...when the exact hardware revision has not been established. Revision detection is a separate evidence class.
eFuses, permanent security bits, calibration, private keys, identity region, RF transmission — default denied; explicit operator approval required.
// 03 Operating principles
Local-first. The browser app will not silently send serial logs, device identifiers, flash dumps, Wi-Fi credentials, keys, or configuration to FR3K servers.
- Discovery is read-only metadata about a peer; it never enrolls or authorizes a peer.
- Transport and control are separate failure domains; optional AI does not weaken the underlying system.
- Every artifact has a SHA-256. HASH VERIFIED is not the same as SIGNATURE VERIFIED.
- Hardware claims require hardware; LAN acceptance is never relabelled as RF, robotics, or field acceptance.
- Useful failure reports beat polished fiction. A blocked gate is a valid engineering result.