Roles changed
The inner engineering loop — Specify, Implement, Test, Review, Observe, Update SDD — is executed by agents with real tools, real repositories, and real gates.
Execution can be delegated. Judgment cannot.
Three claims hold this page together. Each one is checked against an artifact, not an opinion.
Why now
Because an agent actually loads the contract before acting.
AGENTS.md, the living SDD, and the domain ontology
stopped being documents and became runtime context.
FDE still gates
Field discipline produced the contracts worth reusing — and it keeps the parts an agent may never sign off: PCB, bench, RF safety, live stations.
Testable form: a field incident becomes an SDD
ruling, the ruling becomes a machine-readable constraint, and the
constraint blocks the agent from re-introducing the incident. Any
claim on this page that cannot be traced onto that chain is not
made.
Agents run the loop. Humans hold three things.
The split is not by task size or by skill. It is by who is accountable when the result is wrong.
Delegated to agents
Specify→Implement→Test→Review→Observe→Update SDD
Agents read the constraint registry before editing, run the verification appropriate to each claim, and write the outcome back into the same contract they started from.
Retained by humans
Intent — why this work exists, what counts as
success, what is deliberately out of scope.
Boundaries — architecture rulings, safety
invariants, and the constraints an agent may not trade away
for a passing test.
Judgment — whether the available evidence is
enough to say a thing is done, shipped, or safe.
Agents carry execution, not accountability.
Responsibility for a transmit, a release, or a safety claim stays
with the named human who signs the evidence. No delegation changes
that.
Forward Deployed Engineering is where the contracts came from
Ontology is not a fourth FDE phase, and agentic engineering does not retire FDE. The loops are coupled and each keeps a veto.
FDE delivery loop
Echo
Field evidence→Delta
Risky proof→Product
Stable delivery
Field evidence→Delta
Risky proof→Product
Stable delivery
Echo observes the actual station and operator. Delta validates the highest-risk assumption with a working vertical slice. Product hardens the result into an operable boundary, contract, or reusable component — which is exactly the object an agent can later be handed.
Ontology engineering loop
Scope→Terms→Relations→Constraints→Validate
Product evidence stabilizes vocabulary and exposes invariants. The model then gives later work — human or agentic — better questions, cleaner boundaries, and fewer accidental protocol assumptions.
What an agent may not compress
Hardware
PCB fabrication and bench bring-up. EFHW V3.0 design and firmware are complete; its claims stay design-target until a board exists.
RF safety
PTT paths and transmit authority on real radios. A passing server test does not sign off a client.
Live stations
Field verification on the operator's own antenna, band conditions, and neighbors.
Publication
Release decisions and what gets labeled shipped, because the label is a promise to a person.
Bidirectional feedback: products generate evidence
for ontology revisions; the ontology supplies language, boundaries,
and competency questions for the next field cycle — now loaded by
the agent before it edits.
Harness × Loop × Living SDD
Engineering is the system that turns field intent into repeatable execution, reviewed increments, traceable evidence, and reusable assets.
Harness
Business, technical, and product constraints surround an execution environment of agents, tools, tests, deployment, and field telemetry.
Loop
Echo → Delta → Product contains an inner Specify → Implement → Test → Review → Observe → Update SDD loop.
Living SDD
Design intent flows toward implementation; code, tests, deployment, and field evidence flow back to correct the contract.
Across five product families: the same engineering
system adapts to different radios, protocols, clients, workflows,
hardware gates, and evidence boundaries.
Three tracks, not one artificial chain
Different hardware and operating goals require different architectures. The common foundation is control ownership, media flow, safety, observability, and evidence.
Radio Control
MRRC Universal provides broad Hamlib-backed
remote operation. MRRC FT-710 proves a direct
USB vertical slice; MRRC Modern generalizes it
through RadioBackend and
RadioCapabilities.
Direct-IQ SDR
SunMRRC owns ExpertSDR-facing station state and streams IQ/audio to clients. Its interfaces include the web client and SunsdrMobile, the native iOS client—not a separate product family.
Workflow / RF Edge
MRRC-FT8 coordinates time-sensitive digital-mode work. EFHW moves actuation to the antenna edge, where RF sensing, servo motion, and fail-safe limits matter.
Five boundaries shaped by field constraints
Each family is described through the same evidence path. Clients belong to the system that owns their authoritative state and safety contract.
MRRC Universal
General remote operation across radios supported by Hamlib/rigctld.
- Field Problem
- Operators need one remote station surface without rebuilding CAT logic for every radio.
- Echo Evidence
- Real station use exposed unreliable networks, state drift, audio routing, and PTT ownership as coupled concerns.
- Delta Breakthrough
- Place the radio-specific contract behind rigctld and make server state—not browser widgets—authoritative.
- Product Boundary
- Server-mediated CAT, audio, waterfall, Web/PWA experience, authentication, and operating safeguards.
- Reused Assets
- Hamlib vocabulary, web control patterns, session supervision, reconnect discipline.
- New Assets
- Universal rig adapter boundary and integrated station-facing control plane.
- Ontology Contribution
-
DeviceAdapter, capability discovery, command intent versus reported state. - Maturity / Evidence
- Field verified Released operation evidence is distinct from architecture claims.
- Agent Execution
-
AGENTS.mdat the repo root — run-and-verify, config and port conventions, and the/CONFIGrestart caveat are stated for agents before they touch the Tornado app. No machine-readable constraint registry yet. Census 2026-09-02. - Human Retained Judgment
- Live-station PTT and RF safety on operator hardware; release labelling. · Contract Left Behind: the run-and-verify entry contract reused by every later family.
MRRC Direct USB
A direct CAT/audio path that evolved from one-radio proof to a capability-driven multi-radio platform.
MRRC FT-710
Vertical validation
inspired-by →
Vertical validation
MRRC Modern
Platform abstraction
Platform abstraction
- Field Problem
- Replace proprietary LAN accessories while retaining radio control, audio, waterfall, and safe PTT.
- Echo Evidence
- FT-710 USB serial/audio behavior proved the end-to-end path and revealed model-specific assumptions.
- Delta Breakthrough
-
The FT-710 vertical slice became
RadioBackendplusRadioCapabilitiesin Modern. - Product Boundary
- Local radio server, Web/PWA UI, and companion mobile clients over explicit control/media contracts.
- Reused Assets
- CAT transactions, audio transport, reconnect handling, safety state machine, UI interaction grammar.
- New Assets
- Multi-radio backend registry and capability negotiation for FT-710, IC-7300, and IC-7300MK2.
- Ontology Contribution
- Protocol binding is separate from function; client availability is separate from product-family identity.
- Maturity / Evidence
- Automated test FT-710 and Modern evidence differ by version and hardware acceptance.
- Agent Execution
-
AGENTS.mdplus.agents/skills/sdd-guardian/: 17 constraints (ft710) and 21 (modern) with severity,sdd_ref, scope globs and patterns.SessionStart → primeloads them;PreToolUse(Edit|Write) → hookblocks violations before the edit lands. Census 2026-09-02. - Human Retained Judgment
-
PTT safety path on real radios; PCB and bench bring-up;
whether evidence supports a "shipped" label. ·
Contract Left Behind: the constraint
registry itself, plus
harness/index.jsonrouting to live SDD slices.
Web / PWAFT710Mobile · iOSFT710Android · Android
Client maturity is not uniform. FT710Mobile has an unresolved P0 PTT safety issue; no client is promoted to “safe complete” merely because another client or server test passes.
SunMRRC
Station-side control and direct-IQ media for the SunSDR2 DX ecosystem.
- Field Problem
- Remote clients need synchronized control, IQ/audio media, and deterministic TX safety around ExpertSDR.
- Echo Evidence
- Station integration exposed split control/media lifecycles, device-specific state, and mobile-network interruption.
- Delta Breakthrough
- Separate authoritative server state from client presentation while keeping protocol and media adapters explicit.
- Product Boundary
- SunMRRC is the station system; Web and SunsdrMobile are clients of that system.
- Reused Assets
- Remote control ownership, reconnect convergence, media framing, and safety supervision patterns.
- New Assets
- ExpertSDR-facing integration, direct-IQ stream contracts, native iOS interaction and audio path.
- Ontology Contribution
-
Distinguishes
RF Signal, sample streams, frames, observation, and UI projections. - Maturity / Evidence
- Field verified Evidence is assigned per server, client, and operating scenario.
- Agent Execution
-
AGENTS.mdandCLAUDE.mdat thesunsdrrepo root, in front of a reverse-engineered protocol document and a living SDD. No constraint registry — so no claim of a pre-edit gate here. Census 2026-09-02. - Human Retained Judgment
-
Every protocol inference drawn from observation rather than
a datasheet; PTT on hardware we did not design. ·
Contract Left Behind:
PROTOCOL.mdand the SDD chapters that later families cite as a boundary source.
SunMRRC WebSunsdrMobile · iOS
MRRC-FT8
A digital-mode workflow family where time, decode cycles, operator intent, and transmit scheduling form one safety boundary.
- Field Problem
- FT8 operation requires synchronized 15-second cycles, decode selection, QSO state, and guarded transmit timing.
- Echo Evidence
- Field evolution showed that “send a CAT command” does not model the operator workflow or time window.
- Delta Breakthrough
- Represent the QSO as an explicit workflow with timed activities, observations, and recovery transitions.
- Product Boundary
- Decode-to-QSO workflow, radio/audio integration, exchange state, and operator intervention.
- Reused Assets
- Station control vocabulary, audio framing, state ownership, event logs, release discipline.
- New Assets
- Slot-aware workflow state, decode evidence, exchange semantics, and timing constraints.
- Ontology Contribution
- Time interval, workflow state, decode observation, transmission activity, and evidence provenance.
- Maturity / Evidence
- Field evolution Public release state and SDD V1.8 field evolution are recorded separately.
- Agent Execution
-
AGENTS.mdplus.agents/skills/sdd-guardian/: 14 constraints includingvendor-readonly,no-direct-serialandptt-authority, enforced through the same prime / hook pair. Census 2026-09-02. - Human Retained Judgment
-
Decoder fidelity against real band conditions; UTC slot
discipline where a mistake costs an emission. ·
Contract Left Behind: the vendored-decoder
rule:
wsjtx-3.0.2/is read-only and changes go todsp/patched/[vendor-readonly, NFR-080 / AD-002].
EFHW Auto Tuner V3.0
An RF-edge controller that turns impedance observations into constrained servo actuation.
- Field Problem
- Portable EFHW stations need repeatable matching without placing unsafe mechanics or RF stress behind a remote button.
- Echo Evidence
- Physical tuner behavior exposes backlash, travel limits, RF measurement uncertainty, and power-dependent risk.
- Delta Breakthrough
- Model tune as a bounded search over measurement and actuation rather than an unconstrained motor command.
- Product Boundary
- ESP32-S3 firmware, RF sensing, servo control, saved positions, limits, and local/remote operation.
- Reused Assets
- Command intent, observation, fault convergence, evidence logging, and capability profile patterns.
- New Assets
- Mechanical position, impedance/SWR measurement, bounded tuning policy, and antenna-network entities.
- Ontology Contribution
- Connects software activity to physical actuation and measured RF outcomes.
- Maturity / Evidence
- Bench pending V3.0 design and firmware are complete; PCB and bench validation remain pending.
- Agent Execution
-
Site and knowledge-base work runs under the workspace
CLAUDE.md; the antenna research corpus inefhw-knowledge/is the shared ontology source. No firmware constraint registry. Census 2026-09-02. - Human Retained Judgment
- PCB fabrication and bench validation — this family's claims stay design-target until a physical board exists. · Contract Left Behind: the tuner state model and the 49:1 vs LC test report other families can cite.
Reuse the plane, not the accident
Reuse occurs at explicit architectural planes. It does not imply that unlike protocols, devices, or maturity levels are interchangeable.
Control
Command intent, authoritative state, leases, capability discovery, and idempotent reconciliation.
Media
Audio, IQ, waterfall, framing, pacing, buffering, and transport-loss behavior.
Device
Radio backends, protocol bindings, USB endpoints, DSP integrations, and RF actuators.
Safety
PTT interlocks, timeout-to-RX, power and travel limits, single-owner transitions, and fault containment.
Workflow
Operator intent, timed QSO state, tuning search, retries, cancellation, and recovery.
Experience
Web/PWA/native interaction patterns, feedback, controls, accessibility, and mobile ergonomics.
MRRC FT-710inspired-by →MRRC Modernimplements →RadioBackend
SunsdrMobileconsumes →SunMRRC servicesinherits →shared safety constraints
inherits
A specialization retains a declared constraint or contract.
consumes
A client uses a service without owning that service’s system boundary.
implements
A component realizes an interface, capability, or protocol binding.
inspired-by
Evidence influenced a later design; no code or contract inheritance is implied.
The ontology is loaded before the agent types
Not a documentation habit: the same terms, boundaries and axioms are consumed by agent context, by a pre-edit gate, and by human review. It is still a lightweight bilingual contract grounded in product evidence — not an RDF/OWL deployment, a graph database, or a new runtime framework.
| Ontology concept / axiom | Consumer | Verifiable anchor |
|---|---|---|
Policy/Constraint: single authoritative state
holder, serial exclusivity
|
Agent runtime hard block |
ft8 no-direct-serial — "rigctld is the sole
serial owner" [AD-008]; ft710 / modern
cat-direct-serial-io [AD-002]
|
Safety: TX authorization and PTT ownership
|
Agent runtime hard block |
ft8 ptt-authority — "PTT controlled only by rig
and safety components" [AD-007; NFR-050; Ch15]
|
CommandIntent ≠ Actuation |
info hint to the agent |
ft710 ptt-release-no-verify — "TX0 is
fire-and-forget" [AD-007; Ch15; V1.2]
|
Observation: a stale read must not pollute
state
|
info constraint + unit test |
ft710 / modern poll-stale-guard [AD-009; §9.6;
V1.7 filter race fix]
|
Protocol Binding ≠ Capability |
Code fact + specialized constraint |
modern audio-pyaudio-rate — "rate comes from
backend capabilities" [AD-011 amended V2.9/V2.14]
|
Evidence/Provenance: knowledge must not go
stale
|
Routing index stores no content |
harness/index.json — "holds no content — refs
are sliced live from SDD/*.md, so it never goes stale"
|
Information Object: a change implies a doc sync
|
Lifecycle enforcement |
SKILL.md Phase 0–6; docs-sync rule
[§14]
|
52 machine-readable constraints across three repositories
— mrrc_ft710: 17, mrrc_modern: 21, mrrc_ft8: 14 (census 2026-09-02).
Each rule carries a severity (
block /
warn / info), an
sdd_ref pointing back at an architecture decision or a
real incident, a scope glob and patterns.
harness/sdd_context.py exposes prime /
check / hook;
install_hooks.py registers
SessionStart → prime and
PreToolUse(Edit|Write) → hook. One semantic, three
consumers: agent context, runtime block, human review.
Agent
Operator, administrator, maintainer, or automated controller with authority and responsibility.
Physical Entity
Radio, antenna, tuner, transceiver interface, sensor, actuator, and station environment.
Software System
Station server, client, backend, adapter, decoder, DSP service, or persistence component.
Activity / Process
Actuation, observation, transmit, receive, tune, decode, synchronize, and recover.
Information Object
CommandIntent, StateReport, frame, sample, event, QSO record, profile, or evidence record.
Capability / Function
Tuning, PTT, mode selection, audio, IQ streaming, decoding, matching, and measurement.
Policy / Constraint
Authorization, lease, timeout, interlock, power limit, timing window, and safe-state rule.
Evidence / Provenance Record
Source, version, environment, method, result, date, and limitations behind a maturity claim.
Core semantic chain
CommandIntentrequests →Actuationchanges →DeviceState
Observationyields →StateReport
RF Signalsampled-as →Sample / Streamframed-as →Frame
Ontology modules
Identity / Authority
Agent, credential, role, permission, Control Lease, owner, delegation.
Station / Equipment
Station, radio, receiver, transmitter, antenna, tuner, sensor, actuator.
Function / Service
Capability, service, endpoint, dependency, availability, degradation.
Command / Actuation / Observation
Intent, requested change, physical/software activity, measured result, StateReport.
Protocol / Transport
Protocol Binding, DeviceAdapter, CAT, rigctld, WebSocket, serial, USB, packet.
Signal / Media / Measurement
RF signal, IQ sample, audio stream, frame, spectrum, SWR, frequency, level.
Time / Workflow
Instant, interval, slot, deadline, workflow state, QSO, cancellation, retry.
Safety / Reliability
Interlock, safe state, timeout, fault, uncertainty, limit, recovery, supervision.
Evidence / Provenance
Claim, source artifact, version, test method, environment, result, limitation.
Cross-family safety invariants
-
One authoritative state owner.
Clients may project or request state; they do not silently become the station authority. -
TX requires authority and safety context.
A transmit request needs an active authorization path, lease/ownership, and applicable interlocks. -
Disconnect and timeout converge to RX.
Loss of control must move the station toward a non-transmitting safe state. -
A command is not confirmed state.
Requested actuation and observed StateReport remain distinct. -
Undetectable faults stay undetected.
No design may claim detection without a sensor, signal, or testable observation path. -
Profiles bind concepts to products.
Each product profile states supported capabilities, protocols, clients, safety constraints, and evidence.
Comparable dimensions, different implementations
Capabilities describe what a product family can do. Evidence maturity describes how strongly each claim has been demonstrated; the two must not be collapsed.
| Dimension | MRRC Universal | MRRC Direct USB | SunMRRC | MRRC-FT8 | EFHW |
|---|---|---|---|---|---|
| Primary equipment | Hamlib-supported radios | FT-710; IC-7300 family via Modern | SunSDR2 DX / ExpertSDR | Radio + audio interface | EFHW matching network + ESP32-S3 |
| Control protocol | rigctld / Hamlib | Direct CAT over USB serial | ExpertSDR-facing control service | Workflow plus radio integration | Local firmware / remote command surface |
| Media | Remote audio and waterfall path | USB audio, remote audio, waterfall | IQ and audio streams | Receive/transmit audio | Measurement telemetry, not operator audio |
| Spectrum source | Configured receiver/backend | Radio USB/IQ path by model | Direct-IQ stream | Decode passband | RF detector measurements |
| DSP | System/backend dependent | Server/client pipeline by profile | IQ/audio processing chain | FT8 decode/encode processing | Bounded search and measurement filtering |
| Workflow | General operator control | General operator control | SDR operation | Slot-aware QSO state machine | Measure → move → settle → evaluate |
| RF actuation | Radio command/PTT | Radio command/PTT | Radio command/PTT | Timed transmission | Servo-controlled matching |
| Clients | Web / PWA | Web/PWA, FT710Mobile iOS, FT710Android | Web, SunsdrMobile iOS | Workflow UI | Local and remote control surfaces |
| Safety model | Server authority and session supervision | Backend authority, PTT state machine, client-specific acceptance | Control ownership and timeout-to-RX | Timed TX guards and operator state | Travel/power limits and bounded actuation |
Claims carry provenance and limits
A feature label is not a maturity claim. Every result is classified by method, environment, version, and remaining uncertainty.
Design targetSimulation resultAutomated testBench verifiedField verifiedReleased / operationalDeferred / known issue
B1 constraint registry entry
B2 spec / plan trail
B3 enforced in session
B4 block verified
The two ladders do not cross. The row below
measures whether an engineering process was constrained; the row
above measures whether a product behaviour is true. A B4 badge never
promotes an A-level claim, and no count of constraints makes a bench
result less necessary.
The chain, reproduced end to end (2026-09-02)
$ python3 .agents/skills/sdd-guardian/harness/sdd_context.py check probe_b4_tmp.py
SDD-GUARDIAN: blocking violations found:
[BLOCK] cat-no-dn (AD-014; SDD V1.2 freq-drift incident) probe_b4_tmp.py:2: return c.query("DN;")
→ On the FT-710, 'DN;' is NOT a DNR query — it steps the active VFO DOWN ~20 Hz per call. Polling it caused a live frequency-drift incident (V1.2). DNR level is intentionally not polled.
$ echo $?
2A field incident became an SDD ruling, the ruling became a machine-readable constraint, and the constraint blocked an agent from re-introducing the incident. This is the claim this page makes, and it is reproducible.
MRRC FT-710
Source: v1.8.1
Windows package:
v1.8.0
Automated tests: 439
Source, packaged release, test execution, and radio acceptance are separate evidence records. Process evidence: B4 block verified
MRRC Modern
Version: v1.12.0
Profiles:
FT-710, IC-7300, IC-7300MK2
Automated tests:
633
IC-series physical-radio acceptance is tracked separately from automated coverage. Process evidence: B4 block verified
MRRC-FT8
Public release: release record
Field evolution:
SDD V1.8
The public package and later field-evolved design are not presented as the same deployed artifact. Process evidence: B4 block verified
EFHW V3.0
Design: complete
Firmware:
complete
PCB / bench: pending
No bench-verified or field-verified claim is made before physical validation. Process evidence: B2 spec / plan trail
Known safety issue: FT710Mobile has an unresolved
P0 PTT safety issue. Automated server tests and other client results
do not close that issue or establish native-client safety
completion.
Evidence and knowledge appendices
Version and evidence ledger
| Artifact | Claim | Evidence class | Boundary / limitation |
|---|---|---|---|
| MRRC Universal | General remote-radio product family | Released / operational | Radio behavior still depends on Hamlib backend and station configuration. |
| MRRC FT-710 v1.8.1 | Direct FT-710 source baseline; 439 tests | Automated test | Windows installer remains v1.8.0; test count is not universal hardware acceptance. |
| MRRC Modern v1.12.0 | Three declared radio profiles; 633 tests | Automated test | IC physical-radio acceptance is separately recorded. |
| SunMRRC / SunsdrMobile | Station service plus native iOS client | Field evidence by scenario | Server and client evidence are not interchangeable. |
| MRRC-FT8 | Released baseline and SDD V1.8 evolution | Released + field evolution | The versions are intentionally separated. |
| EFHW V3.0 | Design and firmware complete | Design target | PCB and bench validation pending. |
Bilingual core glossary
Product Family
产品族
产品族
Domain Ontology
领域本体
领域本体
CommandIntent
控制意图
控制意图
Actuation
执行活动
执行活动
Observation
观测活动
观测活动
StateReport
状态报告
状态报告
DeviceAdapter
设备适配器
设备适配器
Protocol Binding
协议绑定
协议绑定
Control Lease
控制租约
控制租约
Field verified
现场验证
现场验证
Evidence provenance
证据溯源
证据溯源
Safe state
安全状态
安全状态
12 competency questions
- Which software system owns the authoritative state of a given radio?
- Which agent currently holds the Control Lease for transmit?
- Which CommandIntent requested an Actuation, and which Observation confirmed the result?
- Which DeviceAdapter implements a capability for a specific equipment profile?
- Which Protocol Binding carries control, media, or measurement data?
- What event forces the system to converge to RX or another safe state?
- Which clients consume a product service without becoming separate product families?
- Which RF Signal becomes which Sample, Stream, and Frame?
- Which workflow interval or deadline constrains a transmission?
- Which safety claim has a real sensor or observation path?
- Which evidence artifact supports a maturity label, for which version and environment?
- Which assets were inherited, consumed, implemented, or merely inspired by earlier work?
Evidence-supported evolution timeline
- Universal control: Hamlib-backed operation established broad radio control and station-state patterns.
- FT-710 vertical slice: direct USB CAT/audio validated the high-risk end-to-end path.
- Modern platform: FT-710 assumptions were extracted into backend and capability abstractions, then extended to IC profiles.
- Direct-IQ track: SunMRRC separated station authority and media contracts; SunsdrMobile consumed them as a native client.
- Workflow and edge: MRRC-FT8 added timed operating semantics; EFHW extended the model to physical RF measurement and actuation.
- Ontology: repeated concepts and constraints were consolidated only after evidence appeared across product boundaries.
Standards and modelling references
- Stanford — Ontology Development 101
- W3C OWL 2 Overview — conceptual reference, not a runtime requirement.
- W3C SKOS Reference — bilingual concept vocabulary.
- W3C SOSA/SSN — observation, sensor, actuation.
- W3C PROV-O — evidence provenance.
- W3C Time Ontology — intervals and timed workflows.
- W3C Web of Things Thing Description — capability and interaction affordances.
- ETSI SAREF and QUDT — devices, functions, quantities, and units.