reference design ADR

reference/decisions/ADR-001-repository-name.md

@@ -0,0 +1,87 @@
+# ADR-001: Use `ota-reference-design` as the Repository Name
+
+* **Status:** Accepted
+* **Date:** 2026-07-29
+
+## Context
+
+The project requires a repository name that communicates its purpose clearly without tying the design to a single hardware platform, implementation language, or update framework.
+
+The repository will contain:
+
+* architectural documentation;
+* OTA design decisions;
+* diagrams;
+* reference implementations;
+* update tooling;
+* failure-injection experiments;
+* security and reliability analysis.
+
+The initial practical implementation may use Raspberry Pi hardware, but the overall design should remain applicable to other embedded Linux platforms.
+
+The repository is not intended to provide a production-ready OTA framework or a reusable software library. Its primary purpose is to demonstrate and explain the architecture of a reliable and secure OTA update system.
+
+## Decision
+
+The repository will be named:
+
+```text
+ota-reference-design
+```
+
+The repository will initially remain a standalone top-level repository rather than being placed under a broader group such as `engineering`, `embedded-systems`, or `systems-engineering`.
+
+## Alternatives Considered
+
+### `embedded-ota-lab`
+
+This name emphasizes experimentation and practical work.
+
+It was not selected because the project will contain more than experiments. It will also document architecture, security, reliability, design decisions, and implementation trade-offs.
+
+### `ota-update-lab`
+
+This name is simple but somewhat redundant because OTA already means over-the-air updating.
+
+It also makes the project sound more like a temporary collection of experiments than a structured reference design.
+
+### `reliable-ota`
+
+This name emphasizes one of the primary goals of the project.
+
+It was not selected because it does not clearly communicate that the repository is educational and architectural rather than a production-ready OTA product.
+
+### A Repository Under an `engineering` Group
+
+A broader parent group could eventually contain several related repositories.
+
+It was not selected at this stage because a group containing only one repository adds unnecessary hierarchy and does not yet provide meaningful organization.
+
+## Consequences
+
+### Positive
+
+* The name clearly communicates that the project is an OTA reference design.
+* The repository is not tied to Raspberry Pi or any other specific platform.
+* The name allows the project to include documentation, code, diagrams, and experiments.
+* Readers are less likely to mistake the project for a production-ready framework.
+* The name remains appropriate if additional hardware platforms are added later.
+
+### Negative
+
+* The name is broader than the initial Raspberry Pi implementation.
+* Readers may still require the README to understand the exact project scope.
+* The term “reference design” may suggest a more complete implementation than exists during the early stages of development.
+
+## Notes
+
+A broader repository group may be introduced later if several related systems-engineering projects are created.
+
+Possible future group names include:
+
+```text
+embedded-systems
+systems-engineering
+```
+
+Moving the repository into such a group would not require changing the repository name.

reference/decisions/ADR-002-license.md

@@ -0,0 +1,87 @@
+# ADR-002: Use the MIT License
+
+* **Status:** Accepted
+* **Date:** 2026-07-29
+
+## Context
+
+The project is intended to be an open educational and engineering reference for designing OTA update systems on embedded Linux.
+
+The repository may contain:
+
+* documentation;
+* diagrams;
+* source code;
+* scripts;
+* configuration examples;
+* reference implementations;
+* test utilities;
+* failure-injection experiments.
+
+The license should allow engineers to study, modify, reuse, and adapt the material in both personal and commercial projects.
+
+The license should also be familiar, permissive, and easy to understand. The project does not require derivative works to remain open source.
+
+## Decision
+
+The repository will be licensed under the MIT License.
+
+The license will apply to the repository content unless a specific file or third-party component explicitly states otherwise.
+
+A standard `LICENSE` file containing the MIT License text will be included at the repository root.
+
+## Alternatives Considered
+
+### Apache License 2.0
+
+Apache 2.0 is a permissive license that includes an explicit patent grant and patent retaliation provisions.
+
+It was not selected because the project is currently an educational reference design rather than a large infrastructure framework or commercially governed software platform.
+
+The additional legal complexity does not currently provide enough practical benefit over MIT.
+
+### GNU General Public License
+
+The GPL would require derivative works distributed under certain conditions to remain under the same license.
+
+It was not selected because the project is intended to encourage broad reuse, including adoption of ideas and code in commercial embedded products.
+
+A copyleft requirement could discourage some companies or engineers from using the examples.
+
+### BSD 2-Clause or BSD 3-Clause License
+
+The BSD licenses are permissive and would also be suitable for the project.
+
+They were not selected because MIT is more familiar to many readers, concise, and already consistent with other projects maintained by the author.
+
+### No Explicit License
+
+Without a license, the repository would remain protected by copyright by default and other people would not have clear legal permission to reuse the material.
+
+This would conflict with the educational and open-source goals of the project.
+
+## Consequences
+
+### Positive
+
+* The project can be used in open-source and commercial environments.
+* Engineers can copy, modify, and redistribute examples.
+* The license is short and widely understood.
+* The project remains easy to adopt.
+* The license is consistent with the author’s other open-source repositories.
+* Attribution and preservation of the license notice are still required.
+
+### Negative
+
+* Modified versions are not required to remain open source.
+* Improvements may be used commercially without being contributed back.
+* The license does not include the explicit patent language provided by Apache 2.0.
+* The software is provided without warranty or liability protection beyond the license terms.
+
+## Notes
+
+The repository is a reference design and educational project.
+
+The MIT License permits reuse but does not imply that the implementation is production-ready, certified, secure for every deployment, or suitable for safety-critical systems.
+
+These limitations should also be explained in the repository README.

reference/decisions/ADR-003-reference-design.md

@@ -0,0 +1,120 @@
+# ADR-003: Build a Reference Design, Not a Production Framework
+
+* **Status:** Accepted
+* **Date:** 2026-07-29
+
+## Context
+
+OTA update systems differ significantly between products.
+
+Their architecture depends on factors such as:
+
+* hardware platform;
+* bootloader;
+* storage layout;
+* operating system;
+* security model;
+* network availability;
+* fleet size;
+* update frequency;
+* bandwidth limitations;
+* safety and regulatory requirements;
+* manufacturing and key-provisioning processes.
+
+A generic production-ready OTA framework would need to support many combinations of hardware, bootloaders, update artifacts, deployment systems, security policies, and fleet-management requirements.
+
+Building such a framework would significantly increase the project scope and could distract from its primary goal: explaining how reliable and secure OTA systems are designed.
+
+The project should demonstrate engineering principles and concrete implementation choices without claiming universal applicability.
+
+## Decision
+
+The project will be developed as a practical OTA reference design.
+
+It will provide:
+
+* documented requirements;
+* architecture descriptions;
+* Architecture Decision Records;
+* update-state models;
+* security analysis;
+* reliability analysis;
+* diagrams;
+* example implementations;
+* failure-injection tests;
+* at least one working embedded Linux implementation.
+
+The initial implementation may use Raspberry Pi as a practical demonstration platform, but the architecture will not be presented as Raspberry Pi-specific.
+
+The project will not claim to be:
+
+* a production-ready OTA framework;
+* a complete fleet-management service;
+* a universal update client;
+* a certified safety-critical solution;
+* a replacement for established commercial OTA platforms.
+
+## Alternatives Considered
+
+### Build a Reusable OTA Framework
+
+A reusable framework could provide common APIs, backend services, bootloader integrations, and platform adapters.
+
+It was not selected because it would require a much larger scope, long-term compatibility guarantees, extensive platform testing, and a stable public API.
+
+It would also shift the project away from architecture and engineering analysis toward product development and maintenance.
+
+### Build a Raspberry Pi-Specific OTA Tutorial
+
+A platform-specific tutorial would be easier to implement and explain.
+
+It was not selected because the main engineering principles—atomicity, rollback, artifact verification, health checks, boot control, and failure recovery—apply to many embedded Linux devices.
+
+Tying the project too closely to Raspberry Pi would unnecessarily limit its usefulness.
+
+### Publish Documentation Without a Working Implementation
+
+A documentation-only project would allow broader architectural discussion without platform-specific complexity.
+
+It was not selected because a working implementation is necessary to validate assumptions and demonstrate real failure modes.
+
+Without practical experiments, the project could remain too theoretical.
+
+### Build Only an OTA Update Client
+
+A standalone client would provide a concrete software artifact.
+
+It was not selected because OTA reliability depends on the complete system, including the bootloader, storage layout, update metadata, health checking, rollback, signing, and deployment process.
+
+The client alone would not demonstrate the full architecture.
+
+## Consequences
+
+### Positive
+
+* The project can focus on engineering reasoning and architecture.
+* Design decisions and trade-offs can be documented clearly.
+* The implementation can remain understandable and suitable for learning.
+* Platform-specific details can be isolated from general principles.
+* Additional reference implementations can be added later.
+* The project can evolve without promising a stable production API.
+* Failure scenarios can be explored openly without presenting the design as universally safe.
+
+### Negative
+
+* Users cannot assume the code is ready for direct production deployment.
+* Some components may be simplified for clarity.
+* Platform integration may require significant additional work.
+* The project may not cover manufacturing, provisioning, compliance, or very large fleet operations.
+* Readers must evaluate whether each design decision applies to their own product.
+* The boundary between a complete reference implementation and a framework must remain clearly documented.
+
+## Notes
+
+The repository README should contain a visible disclaimer similar to:
+
+> This repository contains an educational OTA reference design for embedded Linux. It demonstrates one possible approach to reliable and secure system updates. It is not a production-ready framework and must be adapted, reviewed, tested, and hardened for each target product.
+
+The project should prefer explicit architectural decisions over hidden assumptions.
+
+When a design choice is platform-specific, it should be documented separately from the general OTA architecture.

reference/decisions/template.md

@@ -0,0 +1,38 @@
+# ADR-NNNN: Decision Title
+
+* **Status:** Proposed
+* **Date:** YYYY-MM-DD
+
+## Context
+
+Describe the problem or architectural question that requires a decision.
+
+Explain the relevant requirements, constraints, risks, and assumptions. Keep this section focused on why the decision is needed.
+
+## Decision
+
+Describe the selected approach clearly and directly.
+
+## Alternatives Considered
+
+### Alternative 1
+
+Briefly describe the alternative and why it was not selected.
+
+### Alternative 2
+
+Briefly describe the alternative and why it was not selected.
+
+## Consequences
+
+### Positive
+
+* List the main benefits of the decision.
+
+### Negative
+
+* List the costs, limitations, and trade-offs introduced by the decision.
+
+## Notes
+
+Add implementation details, unresolved questions, or links to related documents when necessary.