Appendix:
Security and Network Deployment Boundaries Network and Port Entry Boundaries
- Public Network Isolation: Control commands, data recording, REST APIs, WebSockets, video streams, and Teach Pendant management interfaces must NOT be directly exposed to public networks or untrusted environments.
- Port Access Control: System port listening statuses (such as
ssdiagnostic outputs) merely represent underlying process occupation. Ports not explicitly designated as "Customer Entry Points" (e.g.,81,8060,8888,9001,9675,9678) are managed strictly as internal/pending ports; exploratory probing calls are strictly prohibited. - HTTP Bridge Specification: The HTTP bridge service defaults to loopback binding. If remote network binding is required, explicit authorization within a private LAN is mandatory, along with enforced source IP Access Control Lists (ACLs), external TLS encryption, rate limiting, and audit logging.
Exclusive Control and Data Security
- Concurrency Control Policy: Each robot permits only one active business control owner and one data recording coordinator at any given time. Local process locks cannot substitute for control authority arbitration in distributed environments.
- Credential & Logging Standards: API Tokens, SSH credentials, and security certificates must be managed through the customer's private Key Management Service (KMS); recording these credentials in plain text within any system log is strictly prohibited.
- Data Input Validation: All write operations must undergo rigorous validation covering Schema structures, data types, value ranges, character lengths, and execution timeouts.
Fault Response and High-Risk Operation Controls
- Timeout Troubleshooting Strategy: Timeouts occurring during motion control or data recording are categorized as Unknown Outcome. Upon encountering a timeout, a stop command must be executed first followed by a real-time state query; automated direct retries are strictly prohibited.
- Data Deletion Constraints: Data cleanup operations are restricted exclusively to approved, validated, and exact subdirectories; utilizing wildcards or recursive deletion targeting root directories is strictly forbidden.
- High-Risk Change Management: Network adjustments, systemd service modifications, OTA firmware upgrades, software/hardware joint limit reconfigurations, power domain controls, and system performance tuning are classified as High-Risk Operations. They require verified data backups, documented recovery procedures, and comprehensive change logs.
- Cross-Platform Compatibility Model: Windows and macOS clients interact by default via SSH terminals, REST APIs, controlled bridge services, or offline MCAP files; direct cross-machine DDS communication is disabled by default.
Performance and System Tuning Constraints
Modifying Fast DDS XML configuration files, switching RMW implementations, tuning sysctl kernel parameters, binding CPU affinity, altering desktop service configurations, or enabling jetson_clocks do NOT constitute standard customer configuration practices. Underlying optimization operations must undergo rigorous single-variable controlled testing before reaching a "Verified" or "Unverified" deployment approval conclusion.