Secrets have one owner.
Provision per-device identity, activation, regions, runtime, and map data through the approved vehicle/fleet control plane. Avoid shared embedded credentials.
A protected-artifact-neutral release skeleton for runtime/data/configuration/voice compatibility, qualification, atomic switch, and rollback.
The canonical file manifest is also the archive contract. Common evidence, environment, manifest, and acceptance files accompany platform-specific source.
README.mdSetup and first-success boundarySTARTER_MANIFEST.jsonMachine-readable project scope.env.exampleBlank non-secret configurationEVIDENCE.mdSource and selection boundaryACCEPTANCE.mdSuccess and hostile-path proofrelease-manifest.example.jsonCompatible release unitsrc/release_controller.hppAtomic update contractQUALIFICATION.mdVehicle and interruption matrixProvision per-device identity, activation, regions, runtime, and map data through the approved vehicle/fleet control plane. Avoid shared embedded credentials.
The public snapshot does not establish an automotive SDK or safety contract. Obtain the entitled runtime, data, activation, vehicle-interface, HMI, and regulatory requirements before binding an adapter.
This platform requires an entitled or company-selected distribution before live binding.
The session recovers to a safe explainable state with compatible runtime/data and never presents stale guidance as current after a reset.
A blocked, missing, or unentitled provider produces a useful explicit failure rather than a blank surface or fabricated result.
No server credential, bearer value, precise private fixture, or provider response body appears in client bundles, logs, screenshots, or test artifacts.
Resources, listeners, sessions, processes, or requests stop cleanly when the owning screen, request, or application ends.
Driver-distraction rules are testable
Power/connectivity recovery is proven
Runtime and data roll out together
Simulation precedes road evidence