wesandClaude Opus 4.8
cda537da29
Per updated policy: - Water heater (node 95): new switch entity + on/off state read-back. - Awning (node 75): new cover entity (open=op01 / close=op02 / stop=op00), with current_operation published from the page-3 motion byte (C2/C3/C0). First actuation must be attended; single-shot commands can't run the motor away. - Water pump (node 61): added to command_guard denylist (winterizing-only, panel/app only) alongside slides/jacks. Guard re-tested 8/8 (host g++). Switch/cover comments + HANDOFF safety notes and remaining-work updated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
40 lines
1.8 KiB
C++
40 lines
1.8 KiB
C++
#pragma once
|
|
// Command-path safety policy for the OneControl integration.
|
|
//
|
|
// POLICY: some loads are operated from the physical control panel / OEM app ONLY,
|
|
// never over CAN. command_blocked() returns true for any node this firmware must
|
|
// never send a command to. It is the single source of truth for that rule and is
|
|
// checked in two independent places (the command-entry script and the actual
|
|
// transmit point), so loosening one does not open the other.
|
|
//
|
|
// What it blocks:
|
|
// * slides / jacks — never automate. Explicit denylist of this rig's nodes
|
|
// (6A/7F/9C), always blocked, even before we've heard their identity;
|
|
// * the water pump (61) — winterizing-only; operate it from the panel/app so it
|
|
// can't be left running (e.g. dry) by accident;
|
|
// * any movement/motor-class node (device class 0x21) other than the awning
|
|
// (0x75) — generalizes the slide/jack rule to "any motor that isn't the awning".
|
|
//
|
|
// Permitted (NOT blocked here): lights, water heater, and the awning. Whether a
|
|
// permitted node is actually exposed as an entity is a separate allowlist in the
|
|
// command-entry script — this gate only enforces the never-allowed set.
|
|
//
|
|
// node_type is the page-2 identity byte (device class) for the node, or 0 if not
|
|
// yet observed. The static denylist covers the not-yet-observed window.
|
|
|
|
#include <cstdint>
|
|
|
|
namespace onecontrol {
|
|
|
|
inline bool command_blocked(uint8_t node, uint8_t node_type) {
|
|
// Slide / jack / movement-class nodes on this rig — always refused.
|
|
if (node == 0x6A || node == 0x7F || node == 0x9C) return true;
|
|
// Water pump — panel/app only (winterizing).
|
|
if (node == 0x61) return true;
|
|
// Any movement-class (0x21) node except the awning (0x75).
|
|
if (node_type == 0x21 && node != 0x75) return true;
|
|
return false;
|
|
}
|
|
|
|
} // namespace onecontrol
|