End-to-end implementation per docs/sprint-2.5-plan.md.
New requirement added by user mid-sprint: 4-role RBAC (Super Admin /
Engineer / Owner / User) with dual-auth for Engineer flashing firmware,
plus a "mini Arduino IDE" inside the Studio.
Tests: pytest 231/231 green (129 Sprint 2 + 102 Sprint 2.5 new).
RBAC core (arautopilot/core/):
- rbac.py: 4 roles, 12 capabilities, immutable capability matrix,
has() / capabilities_of() / require() / requires_dual_auth() helpers.
Engineer flashing firmware needs SA approval; everything else is
single-factor.
- user.py: User model with PBKDF2-HMAC-SHA256 PIN hashing (200k iters,
16-byte salt, self-describing hash format for future migrations).
4-8 digit numeric PINs enforced.
- user_store.py: JSON-backed user database. seed_demo_users() for
first-run UX.
- audit.py: append-only JSONL audit log. AuditEvent with timestamp,
user_id, role, action, target, outcome, reason, secondary_user_id
for dual-auth, optional extra payload. Crypto signing of lines
deferred to Sprint 8.
Studio GUI (arautopilot/studio/):
- app.py: real entry point (replaces Sprint 0 stub). --seed-demo
populates demo users without launching GUI; --data-dir overrides the
~/.ar-autopilot/studio/ default.
- session.py: Session + SessionHolder. check() always audits the
decision; verify_super_admin_pin() + log_dual_auth_grant() for
dual-auth flows.
- login_window.py: modal login dialog with user picker + PIN field.
Audits login attempts (success and bad-PIN denials).
- main_window.py: top-level window with sidebar (user + role + caps)
and tab area (Overview, Flash Console, Project placeholder,
Telemetry placeholder).
- flash_console.py: the "mini Arduino IDE". Lists serial ports via
pyserial; picks firmware variant (esp32-dev / esp32-debug); compiles
via 'pio run'; flashes via 'pio run -t upload --upload-port <port>';
streams pio output to a dark-themed read-only console; supports
cancel. For Engineer flashes, asks the Super Admin for their PIN
inline before invoking pio. Records dual-auth grant + pio exit code
in the audit log.
Dependencies:
- New [project.optional-dependencies] group 'studio': PySide6>=6.6,
pyserial>=3.5, platformio>=6.1. Kept optional so the core can be
installed in lean / CI environments.
Tests (arautopilot/tests/):
- test_rbac.py: 32 tests for capability matrix, dual-auth policy,
no-privilege-escalation invariants, partial overlap between roles.
- test_user.py: 11 tests for PIN hashing, verification, salting,
serialisation, field validators.
- test_audit.py: 9 tests for JSONL append, immutability, round-trip,
corrupt-line detection, dual-auth event shape, blank-line tolerance.
- test_user_store.py: 10 tests for CRUD, persistence, role filtering,
demo seed idempotency.
- test_session.py: 9 tests for capability checks + audit side effects,
SA PIN verification, dual-auth recording, SessionHolder lifecycle.
- test_studio_smoke.py: 5 headless tests verifying Studio modules
import without a display server, --seed-demo works, helpers safe to
call without hardware.
NOT in Sprint 2.5 (intentional):
- Crypto signing of audit log lines (hash-chain) -- Sprint 8
- HWID binding of the user store -- Sprint 8
- Project configurator + .appack compiler -- Sprint 4
- Flutter bridge display -- Sprint 4
- Telemetry dashboard tab -- Sprint 4
- Serial monitor as a separate tab -- future enhancement
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Run the dev linters over Sprint 0's core/library/shared modules and
address every finding. Behaviour unchanged; tests still 80/80 green.
Changes:
- Replace `class Foo(str, Enum)` with `class Foo(StrEnum)` (PEP 663
/ Python 3.11+) in 7 enum classes: ActuatorType, AlarmSeverity,
AlarmType, KnobMode, KnobFunction, AutopilotMode, AccessLevel,
VesselType. Pydantic v2 serialises StrEnum the same way, so YAML/JSON
round-trips are byte-identical.
- Use `datetime.UTC` alias in place of `datetime.timezone.utc`
(UP017) across alarms.py, knob_state.py, project_config.py, and
test_knob_state.py.
- Remove now-unnecessary forward-reference quotes from method return
type annotations (UP037) — `from __future__ import annotations` is
already in scope everywhere.
- Tighten `_read_json_resource` / `_read_yaml_resource` in the library
loader: validate that the deserialised payload is actually a dict
before returning, instead of leaking `Any` from json.loads /
yaml.safe_load. Fixes the only two `mypy --strict` findings.
- Add `.claude/settings.local.json` to .gitignore (personal
Claude Code overrides are not committed).
Verification:
ruff check arautopilot/ -> All checks passed
mypy arautopilot/core library shared -> Success, 0 issues, 12 files
pytest -> 80 passed in 0.25s
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Initial commit. Delivers what the brief calls 'Sprint 0 - Foundations'
(see docs/AR_Autopilot_brief.md section 12):
- Complete repository structure (arautopilot package + firmware, display,
installer, tools placeholders + docs).
- Core data model (Pydantic v2): modes, alarms, actuator config, PID
config + gain scheduling, vessel config, knob state machine, project
config with YAML/JSON serialisation.
- Seed library: 2 actuator profiles (hydraulic & electric DC reversible)
and 2 default tunings (yacht motor planeo 30 m and 40 m). Conservative
literature values, NOT the integrator's production tuning IP.
- Firmware skeleton: only src/hal/pinout.h with the 21 I/O contract for
the AR-NMEA-IO v1.0 board. No drivers, no main loop.
- Studio stubs (real PySide6 app starts in Sprint 4).
- pytest suite (80 tests, all green): modes, alarms, actuator, PID
(incl. gain interpolation and the +/-50% adaptive bound from brief
section 6), vessel, knob state, project config, library loader,
end-to-end roundtrip.
- examples/sprint0_demo.py - the acceptance demo from the brief.
Acceptance criteria met:
- pytest green (80/80)
- demo creates, saves (YAML + JSON), reloads, and verifies a full
ProjectConfig using the seed library
- repository ready for tag `sprint-0-approved`
See CHANGELOG.md for the detailed scope.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
alro65