tirtc-device-builder 0.6.0 → 0.7.1

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "tirtc-device-builder",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Codex workflows for building and validating TiRTC device firmware across supported chip platforms.",
   "author": {
     "name": "TangeAI",

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 This project follows Semantic Versioning.
 
+## 0.7.1
+
+- Split clean-room bootstrap from Skill execution: install or replace the pinned Skill before Codex starts, restart the session, then run read-only version and Doctor checks before generation.
+
+## 0.7.0
+
+- Separate the platform/Web video contract (MJPEG, H.264, and H.265 on stream 11) from the single codec profile selected by a board; keep the LCKFB ESP32-S3 adapter on MJPEG without narrowing platform capability.
+- Add a mandatory runtime semantic gate for service-endpoint wiring, callback-safe lifecycle changes, exact downlink media filtering, authoritative AI session-format validation, and remote session termination.
+- Reject invented, concatenated, absolute, missing, or hash-mismatched Hardware IR source locators and verify recorded build artifacts against the actual project-relative files.
+- Treat the entire ESP-IDF `build/` tree as non-portable, retain verified deliverable copies under `artifacts/`, and strengthen Doctor handling and negative regression tests.
+- Package the hardened generated starter and platform/runtime contracts in ESP32 Device Kit 1.1.1.
+
 ## 0.6.0
 
 - Add project-local audio and video semantic contracts that verify codec clock tables, I2S/TDM topology, selected video framing, dependency locks, scheduler isolation, sensor policy, and memory/backpressure before an artifact can reach `BUILD_VERIFIED`.

package/README.md

@@ -12,7 +12,7 @@ TiRTC Device Builder 用于把 ESP32-S3 开发板接入 TiRTC。输入可以只
 
 - npm 包：[tirtc-device-builder](https://www.npmjs.com/package/tirtc-device-builder)
 - GitHub 仓库：[tangeai/tirtc-device-builder](https://github.com/tangeai/tirtc-device-builder)
-- ESP32 Device Kit：[kit-esp32s3-v1.0.0](https://github.com/tangeai/tirtc-device-builder/releases/tag/kit-esp32s3-v1.0.0)
+- ESP32 Device Kit：[kit-esp32s3-v1.1.1](https://github.com/tangeai/tirtc-device-builder/releases/tag/kit-esp32s3-v1.1.1)
 
 文档导航：
 
@@ -86,13 +86,14 @@ Skill 在 Codex 会话启动时被发现。安装完成后，关闭当前 Codex
 
 目标：
 - 功能：<例如 H5 实时音视频、H5 对讲、AI 双向语音>
-- 视频：<MJPEG/H264/H265/根据合同和硬件证据选择>
+- 平台/Web 视频：MJPEG、H264、H265
+- 板级视频选择：<MJPEG/H264/H265/根据硬件证据选择一种>
 - Wi-Fi：<指定方案/根据 BSP 选择>
 - 设备绑定：<指定方案/根据平台合同选择>
 
 工程：<输出目录或现有工程的工作区相对路径>
 
-请先运行 Doctor，分析全部资料并生成 Hardware IR v2。把未知项区分为可由资料、实现、构建或 HIL 解决，以及必须由用户补充的阻塞项。READY_TO_PORT 表示资料足以开始设计，不要求最终 ELF；随后生成、适配和编译，运行项目内音视频语义门禁，把 artifact SHA-256 写入 build_evidence 后执行 build 阶段评估，并输出 TIRTC_PORTING_REPORT.md。
+请先运行 Doctor，分析全部资料并生成 Hardware IR v2。把未知项区分为可由资料、实现、构建或 HIL 解决，以及必须由用户补充的阻塞项。READY_TO_PORT 表示资料足以开始设计，不要求最终 ELF；随后生成、适配和编译，运行项目内 runtime、音频和视频语义门禁，把项目内 artifacts/ 的真实大小与 SHA-256 写入 build_evidence 后执行 build 阶段评估，并输出 TIRTC_PORTING_REPORT.md。
 本轮不访问串口、不烧录、不擦除 NVS；缺少串口只让 L2-L7 记为 SKIP，不得阻止 L0/L1。不要把任何凭证写入源码或报告。
 ```
 
@@ -139,6 +140,7 @@ Skill 负责：
 - 生成并校验 `hardware-ir.json`，把冲突和未知项留在报告里；
 - 判断视频、上行音频、下行播放和 AI 会话是否具备移植条件；
 - 生成带 TiRTC SDK 的独立 ESP-IDF 工程；
+- 核验发现地址、SDK callback 生命周期、下行格式过滤和 AI 会话响应等运行协议不变量；
 - 把摄像头、所选 MJPEG/H.264/H.265 路径、麦克风、Codec、I2S、功放和按键接到板级 adapter；
 - 运行测试和 `idf.py build`，记录固件路径、版本和 SHA-256；
 - 在用户明确给出芯片、工程和串口后烧录；
@@ -245,7 +247,7 @@ board-materials/
 | ESP-IDF | 5.5.x |
 | 自动安装版本 | ESP-IDF v5.5.4 |
 | TiRTC SDK | `espressif-esp32s3/2.3.0` |
-| ESP32 Device Kit | 1.0.0 |
+| ESP32 Device Kit | 1.1.1 |
 | Node.js | 18 或更高版本 |
 | 支持自动安装的系统 | Linux、WSL、macOS |
 | 原生 Windows | 使用 Espressif 官方安装器准备 ESP-IDF，再重新运行检查 |
@@ -284,7 +286,7 @@ H5 和 AI 的端到端验收还需要可访问的 ThingConnect 服务、可用
 
 ### 媒体约束
 
-H5 视频要先从前端和服务端支持的合同中选择一种 profile。MJPEG 提交完整 JPEG 帧；H.264/H.265 按合同提交 Annex-B access unit、参数集，并实现刷新或关键帧控制。板上有摄像头 Sensor，只能证明图像有来源，不能证明浏览器一定能持续出图。
+ThingConnect 平台和 Web 播放端支持 MJPEG、H.264、H.265；具体开发板必须根据其有证据的媒体路径只选择一种输出 profile。MJPEG 提交完整 JPEG 帧；H.264/H.265 按合同提交 Annex-B access unit、参数集，并实现刷新或关键帧控制。某块板只能输出 MJPEG 不代表平台只支持 MJPEG。板上有摄像头 Sensor，只能证明图像有来源，不能证明浏览器一定能持续出图。
 
 当前音频基线使用 G.711 A-law、8 kHz、单声道。对讲还要有可靠的下行队列、A-law 解码、Codec/I2S/功放播放和会话停止清理。没有可用的全双工和 AEC 证据时，应按半双工设计 AI 对讲。
 
@@ -327,7 +329,7 @@ npx --yes tirtc-device-builder@latest install esp32
 |---|---|
 | Codex Skill | `${CODEX_HOME:-~/.codex}/skills/tirtc-esp32-builder` |
 | 托管根目录 | `~/.tirtc-device-builder` |
-| Device Kit | `~/.tirtc-device-builder/kits/esp32s3/1.0.0` |
+| Device Kit | `~/.tirtc-device-builder/kits/esp32s3/1.1.1` |
 | ESP-IDF | `~/.tirtc-device-builder/esp-idf-v5.5.4` |
 | Espressif 工具 | `~/.tirtc-device-builder/espressif` |
 | 安装记录 | `~/.tirtc-device-builder/config.json` |
@@ -372,7 +374,7 @@ npx --yes tirtc-device-builder@latest setup esp32 --install \
 
 ```bash
 npx --yes tirtc-device-builder@latest setup esp32 --install \
-  --kit-archive /absolute/path/tirtc-esp32s3-kit-1.0.0.tar.gz
+  --kit-archive /absolute/path/tirtc-esp32s3-kit-1.1.1.tar.gz
 ```
 
 安装器仍会核对固定的 SHA-256、目录结构、清单和每个资源文件，不接受未经验证的同名压缩包。
@@ -464,7 +466,7 @@ python3 ~/.codex/skills/tirtc-esp32-builder/scripts/hardware_ir.py assess \
 | `NEEDS_CONFIRMATION` | 当前阶段的关键事实未知、冲突或证据等级不足 | 按资料、实现、构建、HIL 或用户输入来源继续闭环 |
 | `BLOCKED` | 现有硬件或 SDK 已确认不满足 | 更换硬件，补编码/播放路径，或取得匹配 SDK |
 | `READY_TO_PORT` | 资料足以开始生成和板级实现 | 进入工程生成与编译 |
-| `BUILD_VERIFIED` | 精确 artifact 通过源码、音视频语义、编译和 post-link 门禁 | 记录 BIN/ELF SHA-256；按授权进入实机验收 |
+| `BUILD_VERIFIED` | 精确 artifact 通过 runtime、音频、视频、源码、编译和 post-link 门禁 | 记录项目内 BIN/ELF 的真实大小与 SHA-256；按授权进入实机验收 |
 | `HIL_VERIFIED` | 已完成端到端实机验证 | 固定版本并保存证据 |
 
 `assess --strict` 在条件不足时返回非零，这是门禁在阻止过早生成，不代表脚本损坏。
@@ -738,7 +740,7 @@ npx --yes tirtc-device-builder@latest setup esp32 --install --force-skill
 
 ```bash
 npx --yes tirtc-device-builder@latest setup esp32 --install \
-  --kit-archive /absolute/path/tirtc-esp32s3-kit-1.0.0.tar.gz
+  --kit-archive /absolute/path/tirtc-esp32s3-kit-1.1.1.tar.gz
 ```
 
 安装器会校验 SHA-256 和内部文件清单。如果校验不一致，请重新获取官方 Release 附件，不要跳过校验。
@@ -850,40 +852,28 @@ python3 ~/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py .
 ```bash
 npm run pack:esp32-kit -- \
   --source /absolute/path/tirtc-server-example/thing-connect \
-  --kit-version 1.0.0
+  --kit-version 1.1.1
 ```
 
 输出位于 `dist/`：
 
 ```text
-tirtc-esp32s3-kit-1.0.0.tar.gz
-tirtc-esp32s3-kit-1.0.0.tar.gz.sha256
+tirtc-esp32s3-kit-1.1.1.tar.gz
+tirtc-esp32s3-kit-1.1.1.tar.gz.sha256
 ```
 
-校验后使用独立的 `kit-esp32s3-v<version>` 标签发布 GitHub Release：
+校验后推送独立的 `kit-esp32s3-v<version>` 标签。`publish-kit.yml` 会从 metadata 固定的上游 commit 重建压缩包、核对 SHA-256，并使用 GitHub Actions token 创建 Release：
 
 ```bash
-gh --version
-gh release --help
-
 cd dist
-sha256sum -c tirtc-esp32s3-kit-1.0.0.tar.gz.sha256
+sha256sum -c tirtc-esp32s3-kit-1.1.1.tar.gz.sha256
 cd ..
 
-git tag -a kit-esp32s3-v1.0.0 -m "TiRTC ESP32-S3 Device Kit 1.0.0"
-git push origin kit-esp32s3-v1.0.0
-
-gh release create kit-esp32s3-v1.0.0 \
-  dist/tirtc-esp32s3-kit-1.0.0.tar.gz \
-  dist/tirtc-esp32s3-kit-1.0.0.tar.gz.sha256 \
-  --repo tangeai/tirtc-device-builder \
-  --verify-tag \
-  --latest=false \
-  --title "TiRTC ESP32-S3 Device Kit 1.0.0" \
-  --notes "ESP-IDF 5.5.x；TiRTC SDK 2.3.0；包含 H5/AI 工程生成资源。"
+git tag -a kit-esp32s3-v1.1.1 -m "TiRTC ESP32-S3 Device Kit 1.1.1"
+git push origin kit-esp32s3-v1.1.1
 ```
 
-`gh release --help` 如果提示 `No such command 'release'`，当前系统安装的不是 GitHub 官方 CLI。先按 [GitHub CLI 官方安装说明](https://github.com/cli/cli/blob/trunk/docs/install_linux.md) 安装或替换，再登录并发布 Release。
+metadata 中的版本、标签、上游 commit 和期望 SHA-256 必须与本地可复现打包结果一致；工作流不会从浮动的 `main` 取发布内容。
 
 ### 发布 npm
 
@@ -891,8 +881,8 @@ gh release create kit-esp32s3-v1.0.0 \
 
 ```bash
 npm test
-git tag -a v0.6.0 -m "v0.6.0"
-git push origin v0.6.0
+git tag -a v0.7.1 -m "v0.7.1"
+git push origin v0.7.1
 ```
 
 不要重复发布已经存在的 npm 版本。版本变化同步更新 `package.json`、`.codex-plugin/plugin.json` 和发布说明。

package/bin/esp32-kit-metadata.js

@@ -1,8 +1,9 @@
 export const ESP32_KIT = Object.freeze({
-  archiveName: "tirtc-esp32s3-kit-1.0.0.tar.gz",
-  archiveRoot: "tirtc-esp32s3-kit-1.0.0",
-  releaseTag: "kit-esp32s3-v1.0.0",
-  sha256: "d2333878ae499a349b125cd81db0a64aef62bfae8fd7c0898c8eaa5ff2a49b65",
-  url: "https://github.com/tangeai/tirtc-device-builder/releases/download/kit-esp32s3-v1.0.0/tirtc-esp32s3-kit-1.0.0.tar.gz",
-  version: "1.0.0",
+  archiveName: "tirtc-esp32s3-kit-1.1.1.tar.gz",
+  archiveRoot: "tirtc-esp32s3-kit-1.1.1",
+  releaseTag: "kit-esp32s3-v1.1.1",
+  sha256: "d9818b1caf73b039d46b7f973ad675ac750d259940db4ef22b35a76896a0cdf3",
+  sourceCommit: "35acd405ffb0ed0917fc0671033b844739fe93dd",
+  url: "https://github.com/tangeai/tirtc-device-builder/releases/download/kit-esp32s3-v1.1.1/tirtc-esp32s3-kit-1.1.1.tar.gz",
+  version: "1.1.1",
 });

package/bin/install-esp32-kit.js

@@ -22,6 +22,8 @@ const REQUIRED_FILES = [
   "manifest.json",
   "device-sim/scripts/create_esp32_project.py",
   "device-sim/templates/esp32-h5-ai/CMakeLists.txt",
+  "device-sim/templates/esp32-h5-ai/platform-media-contract.json",
+  "device-sim/templates/esp32-h5-ai/tirtc-runtime-contract.json",
   "device-sim/sdk/espressif-esp32s3/2.3.0/include/tirtc/tiRTC.h",
   "device-sim/sdk/espressif-esp32s3/2.3.0/lib/libTiRTC.a",
   "device-sim/sdk/espressif-esp32s3/2.3.0/manifest/build-contract.env",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tirtc-device-builder",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Install and run TiRTC device-development skills for Codex.",
   "license": "MIT",
   "author": {

package/skills/tirtc-esp32-builder/SKILL.md

@@ -22,13 +22,13 @@ Before stopping on `NEEDS_CONFIRMATION`, classify every unresolved fact as `sour
 
 Run `<device-kit-root>/device-sim/scripts/create_esp32_project.py` for the current ESP32-S3 H5/AI starter. Keep ThingConnect onboarding, H5, AI, TiRTC lifecycle, callback, stream, and generation behavior in the existing deep modules. Put board-specific camera, microphone, encoder, codec, amplifier, GPIO, DMA, and task behavior behind the `starter_media` seam or a board media adapter owned by it.
 
-Before changing media code, read [capability-rules.md](references/capability-rules.md) and [porting-risks.md](references/porting-risks.md), then read the repository documents they route to. For requested audio, read [audio-contract.md](references/audio-contract.md); for requested video, read [video-contract.md](references/video-contract.md). Complete every applicable project-local semantic gate. A camera sensor alone does not establish H5 video support; validate the selected MJPEG, H.264, or H.265 profile end to end. Choose half duplex for AI when the supplied hardware and BSP do not establish a usable full-duplex/AEC path.
+Before changing media code, read [capability-rules.md](references/capability-rules.md) and [porting-risks.md](references/porting-risks.md), then read the repository documents they route to. For requested audio, read [audio-contract.md](references/audio-contract.md); for requested video, read [video-contract.md](references/video-contract.md); for any H5 or AI project, read [runtime-contract.md](references/runtime-contract.md). Complete every applicable project-local semantic gate. Treat platform/Web codec support and board codec selection as separate facts: the current platform contract accepts MJPEG, H.264, and H.265, while each board contract selects exactly one evidenced output profile. A camera sensor alone does not establish H5 video support. Choose half duplex for AI when the supplied hardware and BSP do not establish a usable full-duplex/AEC path.
 
 Keep the Skill board-agnostic. The prompt supplies product intent and artifact locations; Hardware IR stores evidence; the generated board adapter owns concrete sensors, codecs, pins, clocks, slots, DMA, and task allocation. Never add one board's values to Skill defaults to make an assessment pass.
 
-Run focused tests before ESP-IDF build. Resolve the TiRTC SDK target and `manifest/build-contract.env` against the generated `sdkconfig`; a mismatched precompiled SDK is a blocked build, not a code-generation problem. Resolve managed components with `idf.py reconfigure`, then validate and install every applicable audio/video contract gate. A value copied from a “typical” header comment or a different sample rate is not clock evidence. A self-declared camera realtime or memory boolean is not video evidence.
+Run focused tests before ESP-IDF build. Resolve the TiRTC SDK target and `manifest/build-contract.env` against the generated `sdkconfig`; a mismatched precompiled SDK is a blocked build, not a code-generation problem. Resolve managed components with `idf.py reconfigure`, then validate and install every applicable audio, video, and runtime contract gate. The runtime gate is mandatory for generated H5/AI projects and must prove service-endpoint wiring, deferred lifecycle operations, exact stream/media filtering, AI response validation, and remote `end_session` handling. A value copied from a “typical” header comment or a different sample rate is not clock evidence. A self-declared camera realtime or memory boolean is not video evidence.
 
-After a successful build, promote only facts actually established by source, compile, semantic, or post-link gates to `build_verified`. Hash the exact BIN/ELF, record that exact hash under `build_evidence.artifacts[]`, and run `hardware_ir.py assess --phase build --project <project> --artifact-sha256 <sha256> --strict`. The assessment must reject a well-formed but unrecorded hash. A design plan at `corroborated` can pass intake but cannot pass the build phase. Report a successful compiler invocation as `COMPILE_PASS` when any requested feature gate is blocked; project-wide `BUILD_VERIFIED` requires every requested feature to pass.
+After a successful build, promote only facts actually established by source, compile, semantic, or post-link gates to `build_verified`. Copy the final BIN/ELF needed for delivery into a project-relative `artifacts/` directory, record the actual file path, byte size, and SHA-256 under `build_evidence.artifacts[]`, and run `hardware_ir.py assess --phase build --project <project> --artifact-sha256 <sha256> --strict`. The assessment reopens the recorded file and rejects a missing, stale, size-mismatched, or hash-mismatched artifact. A design plan at `corroborated` can pass intake but cannot pass the build phase. Report a successful compiler invocation as `COMPILE_PASS` when any requested feature gate is blocked; project-wide `BUILD_VERIFIED` requires every requested feature to pass.
 
 ## Flash and verify
 
@@ -40,4 +40,4 @@ For HIL assessment, run `hardware_ir.py assess --phase hil --artifact-sha256 <sh
 
 ## Finish
 
-Run `project_portability.py <project> --export` against the source-only deliverable; do not ship a machine-bound `build/` tree. Return the generated project path, Hardware IR, capability assessment, build artifacts, flash record when applicable, and `TIRTC_PORTING_REPORT.md`. The task is complete only when every requested feature is either verified at the requested level or named as a blocker with the smallest next action that can resolve it.
+After the final assessment, remove the machine-bound `build/` tree without rebuilding, then run `project_portability.py <project> --export` against the source plus the project-relative `artifacts/` copies. Return the generated project path, Hardware IR, capability assessment, build artifacts, flash record when applicable, and `TIRTC_PORTING_REPORT.md`. The task is complete only when every requested feature is either verified at the requested level or named as a blocker with the smallest next action that can resolve it.

package/skills/tirtc-esp32-builder/USAGE.md

@@ -72,7 +72,7 @@ $tirtc-esp32-builder 使用 /path/hardware-ir.json 生成工程，编译后烧
 python3 <skill-dir>/scripts/doctor.py \
   --expected-idf 5.5 \
   --target esp32s3 \
-  --thing-connect-root ~/.tirtc-device-builder/kits/esp32s3/1.0.0 \
+  --thing-connect-root ~/.tirtc-device-builder/kits/esp32s3/1.1.1 \
   --require-workspace
 ```
 

package/skills/tirtc-esp32-builder/assets/board-video-contract.example.json

@@ -1,5 +1,6 @@
 {
   "schema_version": 1,
+  "platform_contract": "platform-media-contract.json",
   "evidence": [
     "lckfb-schematic-v1.0.1",
     "lckfb-camera-example",
@@ -58,7 +59,7 @@
         "#defineVIDEO_MAX_COMPLETE_JPEG_BYTES(192U*1024U)",
         "starter_tirtc_send_buffer_used()>VIDEO_BACKPRESSURE_BYTES",
         "jpeg_length>VIDEO_MAX_COMPLETE_JPEG_BYTES",
-        "starter_tirtc_send_mjpeg((uint32_t)now_ms,jpeg,jpeg_length)>=0",
+        "starter_tirtc_send_jpeg((uint32_t)now_ms,jpeg,jpeg_length)>=0",
         ".pixel_format=PIXFORMAT_RGB565",
         ".fb_count=2",
         "frame2jpg(frame,CAMERA_JPEG_QUALITY,&jpeg,&jpeg_length)"

package/skills/tirtc-esp32-builder/assets/developer-intake-prompt.md

@@ -21,7 +21,8 @@ $tirtc-esp32-builder
 
 目标：
 - <例如：H5 实时视频和声音、H5 语音对讲、AI 双向语音对讲>
-- 视频选择：<MJPEG/H264/H265/根据合同和硬件证据选择>
+- 平台/Web 视频能力：<例如 MJPEG、H264、H265；按平台合同填写>
+- 板级视频选择：<MJPEG/H264/H265/根据硬件证据选择一种>
 - 双工或 AEC 的硬要求：<无，初版可半双工/必须全双工或 AEC/未知>
 
 接入方式：
@@ -35,10 +36,11 @@ $tirtc-esp32-builder
 1. 先运行 Device Kit Doctor，读完全部资料，再生成 Hardware IR v2。没有证据的器件、GPIO 和媒体能力保持未知。
 2. 把每个未知项标为 source_resolvable、implementation_resolvable、build_resolvable、hil_resolvable 或 user_blocked。先通过资料和固定版本源码解决 source_resolvable；只有 user_blocked 会阻止开始 adapter 开发。
 3. READY_TO_PORT 表示硬件身份、连接、媒体合同和资源设计已经有证据，足以开始实现；它不要求最终 ELF 或实机数据。可通过实现或构建解决的项目必须继续生成 compile-safe adapter、锁定依赖、运行门禁并编译。
-4. 移植前核对媒体合同、板级资源、静态内存预算、配网和绑定状态。音频工程必须生成项目内 `board-audio-contract.json`，在依赖解析后核验每个 codec 的 `(MCLK, sample rate)` 表、I2S mode/controller、TDM slot/物理信号和共享 GPIO handoff；视频工程必须生成项目内 `board-video-contract.json`，核验锁定 camera 组件、传感器白名单、Wi-Fi/camera CPU 隔离、完整帧边界、frame buffers、TiRTC send buffer 和 backpressure。两个门禁都要接入普通 `idf.py build`。`resolved=true`、`pipeline_safe=true` 或编译成功不能替代门禁。
-5. 记录 BIN/ELF 路径、大小和 SHA-256，将所评估的 SHA 写入 Hardware IR 的 `build_evidence.artifacts[]`，再使用 `--project` 运行 build 阶段评估并输出 TIRTC_PORTING_REPORT.md。区分 `COMPILE_PASS`、请求能力 `BUILD_VERIFIED` 和 L2-L7 实机验收。
-6. 本轮不访问串口、不烧录、不擦除 NVS；因此缺少启动、浏览器、实体声音和运行时资源数据时，把相应 L2-L7 标为 SKIP，不得阻止 L0/L1。
-7. Wi-Fi 密码、设备密钥、token、私钥和用户音视频不能写入工程或报告。
+4. 移植前核对平台媒体合同、板级选择、板级资源、静态内存预算、配网和绑定状态。音频工程必须生成项目内 `board-audio-contract.json`，在依赖解析后核验每个 codec 的 `(MCLK, sample rate)` 表、I2S mode/controller、TDM slot/物理信号和共享 GPIO handoff；视频工程必须生成项目内 `board-video-contract.json` 并引用 `platform-media-contract.json`，分别证明平台可接受的 profiles 与该板选中的唯一 profile，再核验锁定 camera 组件、传感器白名单、Wi-Fi/camera CPU 隔离、完整帧边界、frame buffers、TiRTC send buffer 和 backpressure。
+5. 所有 H5/AI 工程必须生成 `tirtc-runtime-contract.json`，核验服务发现 endpoint 确实传给 SDK、callback 内不直接调用生命周期 API、下行 stream/media 精确过滤、AI 响应格式和远端 `end_session`。runtime、audio、video 三类适用门禁都要接入普通 `idf.py build`。`resolved=true`、`pipeline_safe=true` 或编译成功不能替代门禁。
+6. 将最终 BIN/ELF 复制到项目内 `artifacts/`，记录真实相对路径、大小和 SHA-256，将所评估的 SHA 写入 Hardware IR 的 `build_evidence.artifacts[]`，再使用 `--project` 运行 build 阶段评估并输出 TIRTC_PORTING_REPORT.md。评估后移除机器绑定的 `build/`，运行 `project_portability.py --export`，不得再次构建。区分 `COMPILE_PASS`、请求能力 `BUILD_VERIFIED` 和 L2-L7 实机验收。
+7. 本轮不访问串口、不烧录、不擦除 NVS；因此缺少启动、浏览器、实体声音和运行时资源数据时，把相应 L2-L7 标为 SKIP，不得阻止 L0/L1。
+8. Wi-Fi 密码、设备密钥、token、私钥和用户音视频不能写入工程或报告。
 ```
 
 ## 只有已知时才补充

package/skills/tirtc-esp32-builder/assets/hardware-ir-v2.example.json

@@ -77,6 +77,7 @@
     },
     "audio_semantic_contract": "board-audio-contract.json",
     "video_semantic_contract": "board-video-contract.json",
+    "runtime_semantic_contract": "tirtc-runtime-contract.json",
     "audio_channel_mapping": {
       "required": null,
       "resolved": null,

package/skills/tirtc-esp32-builder/assets/lckfb-szpi-esp32s3-portable-prompt.md

@@ -1,51 +1,91 @@
 $tirtc-esp32-builder
 
-请在一台全新电脑上完成立创·实战派 ESP32-S3 的 ThingConnect TiRTC clean-room L-1/L0/L1 接入。允许访问外网，并允许 `npx tirtc-device-builder@latest setup esp32 --install` 在当前用户目录安装固定版本的 Device Kit、ESP-IDF 和 Skill；禁止 sudo、系统级包变更和修改 shell profile。无需重复询问该用户目录安装权限。
+请在当前工作区完成一次立创·实战派 ESP32-S3 的 ThingConnect TiRTC clean-room L-1/L0/L1 接入验证。
 
-工作区：
-- 将本提示词所在资料包目录作为 `WORKSPACE_ROOT`。
-- 所有本地输入和输出均相对 `WORKSPACE_ROOT` 解析；报告中再记录规范化绝对路径。
+这是 Skill、提示词和开发板资料的独立有效性测试。允许访问外网。
 
-证据边界：
-- 只使用 `docs/`、其中的厂商示例、厂商官方资料和 managed Device Kit。
-- 不读取工作区外的历史工程、日志或 artifact。
-- 不使用任何真实 Wi-Fi、设备、MQTT、WHIP 或 AI 凭证。
+前置条件（必须由开发者在启动本次 Codex 会话前完成，不属于本提示词内的操作）：
+
+```bash
+npx --yes tirtc-device-builder@0.7.1 setup esp32 --install --force-skill
+```
+
+该命令只允许在当前用户目录安装固定版本的 Skill、managed ESP32 Device Kit、ESP-IDF 和工具链；禁止 sudo、系统级包变更和修改 shell profile。安装完成后，开发者必须关闭原 Codex 会话，再从本 clean-room 工作区启动一个新会话，然后粘贴本提示词。
+
+本轮第一步先只读运行：
+
+```bash
+npx --yes tirtc-device-builder@0.7.1 --version
+npx --yes tirtc-device-builder@0.7.1 setup esp32
+```
+
+必须确认 npm 包/Plugin/Skill 为 0.7.1、Device Kit 为 1.1.1，且 Doctor `OVERALL: PASS`。如果版本不一致、Skill 是在当前会话启动后才安装，或环境检查未通过，停止并报告前置条件不成立；不要在当前会话中替换 Skill 后继续生成工程。
+
+工作区与 clean-room 边界：
+- 将启动 Codex 时的当前目录定义为 `WORKSPACE_ROOT`。
+- 所有工程输入和输出必须位于 `WORKSPACE_ROOT`。
+- 不得读取 `WORKSPACE_ROOT` 之外的项目、兄弟目录、父目录项目、备份、旧构建、日志、报告或 artifact。
+- 如果目标输出目录已经存在，停止并报告 clean-room 条件不成立；不要读取、覆盖或删除该目录。
+
+允许的证据：
+- `WORKSPACE_ROOT/docs/` 中实际存在的全部资料。
+- 开发板厂商官方网站：https://wiki.lckfb.com/zh-hans/szpi-esp32s3/
+- 芯片、组件和 ESP-IDF 厂商官方资料。
+- managed Device Kit 内的 manifest、协议资料、生成器、锁定组件源码和 codec driver table。
+- 本提示词中的板型、实物观察和产品要求属于用户输入，但提示词本身不得作为 clock、GPIO、I2S、TDM、DMA、camera 调度或内存参数的技术证据。
+
+禁止：
+- 不读取任何 `.bak`、旧项目、旧报告、旧 `build/`、日志或历史 artifact。
+- 不使用社区博客、论坛代码或来源不明的示例替代官方证据。
+- 不记录或生成真实 Wi-Fi、设备、MQTT、WHIP 或 AI 凭证。
+- 不访问串口、不烧录、不 monitor、不擦除 NVS。
+- 不为了通过编译而猜测硬件参数、伪造来源或静默关闭请求的功能。
 
 开发板：
 - 立创·实战派 ESP32-S3，PCB V1.0.1。
 - ESP32-S3-WROOM-1-N16R8，16 MB Flash、8 MB Octal PSRAM。
 - `docs/立创实战派ESP32-S3开发板原理图.pdf` 对应手中实物。
-- 厂商标称 GC0308，实物 PID `0x2145`/GC2145；保留矛盾，只允许有精确证据的 PID，拒绝未知 PID。
-
-资料：
-- `docs/立创实战派ESP32-S3开发板原理图.pdf`
-- `docs/02-芯片手册/`
-- `docs/szpi-s3-esp/`
-- https://wiki.lckfb.com/zh-hans/szpi-esp32s3/
+- 厂商页面可能标称 GC0308，但手中实物观测到 PID `0x2145`，对应 GC2145；必须保留该矛盾。
+- 只能接受资料或锁定驱动明确支持的 PID；必须拒绝未知 PID。
 
-目标：
-- H5 MJPEG 实时视频和声音、H5 双向语音、AI 双向语音。
-- 每次视频发送一张完整 JPEG。
+媒体合同：
+- ThingConnect 平台和 Web 播放端支持 MJPEG、H.264、H.265；这属于平台能力。
+- 本开发板初版只选择 MJPEG；这是板级输出选择，不得错误写成平台只支持 MJPEG。
+- H5 MJPEG 实时视频和声音、H5 双向语音对讲、AI 双向语音对讲。
+- 每次视频调用必须发送一张完整 JPEG，禁止截断帧或裸分片。
 - 音频 G.711 A-law、8 kHz、mono。
-- stream：H5 上行 10、视频 11、下行 14、AI 1。
-- 初版允许半双工；不声明未实测的全双工或 AEC。
+- stream：H5 上行 10、视频 11、H5 下行 14、AI 1。
+- 初版允许半双工；不得声明未经实机验证的全双工或 AEC。
 
-接入：
+接入要求：
 - SoftAP 配网，凭证保存 NVS。
-- 验证码绑定，复用已有绑定。
-- 分别提供 `wifi-clear` 和 `tirtc-clear`。
-- 平台发现先用 HTTP；HTTPS 后续独立验收。
-
-输出：
-- `lckfb-szpi-esp32s3-tirtc/`
-
-强制门禁：
-1. 运行 Device Kit Doctor并固定 ESP-IDF、Kit、TiRTC SDK、生成器和组件版本。
-2. 从不存在的输出目录开始生成 Hardware IR v2 和工程；不得读取或复制任何既有 adapter、历史工程、`build/`、日志或 artifact。所有具体 clock、I2S mode/controller、TDM slot、物理信号、shared-GPIO handoff、camera task/core、frame buffer 和 memory/backpressure 值都要引用来源。
-3. 音频必须生成项目内 `board-audio-contract.json`。`idf.py reconfigure` 后，使用 Skill 的 `audio_contract.py` 直接查询锁定 codec driver table；所选 `(MCLK, sample rate)` 必须被所有相关 codec 支持。
-4. 视频必须生成项目内 `board-video-contract.json` 并使用 `video_contract.py` 核对锁定组件、CPU 隔离、完整 JPEG、PID 白名单、frame buffers、TiRTC send buffer 和 backpressure。此板初版合同必须包含 camera event CPU1、Wi-Fi CPU0、两个 PSRAM frame buffers、256 KiB max send buffer、192 KiB backpressure、stream 11 和 `TIRTC_VIDEO_JPEG`；esp32-camera 固定官方 2.1.7 legacy-I2C 配置。
-5. 音频和视频合同都必须和 adapter 源码核对，并分别通过 `install_audio_gate.py`、`install_video_gate.py` 接入每次 `idf.py build`。任何缺失或失败都只能记为 `COMPILE_PASS / CAPABILITY_BLOCKED`，不得写 `BUILD_VERIFIED`。
-6. build assessment 必须提供 `--project` 和当前 artifact SHA-256，并重新运行两个语义合同；任一 requested feature 阻塞时，project gate 也必须阻塞。
-7. 输出 Hardware IR、两个合同、依赖锁、可独立构建工程、门禁证据、BIN/ELF 大小与 SHA-256，以及 `TIRTC_PORTING_REPORT.md`。
-8. 对源码交付物运行 `project_portability.py --export`；不得携带旧 `build/`，CMake 中的 shell 门禁必须显式通过 `bash` 调用。
-9. 本轮不访问串口、不烧录、不 monitor、不擦除 NVS；L2-L7 记为 SKIP，不得把 L1 编译表述为实机已有图像或声音。
+- 验证码绑定，并复用已有绑定。
+- 分别实现 `wifi-clear` 和 `tirtc-clear`。
+- 平台发现本轮先使用 HTTP；HTTPS 留待独立验收。
+
+输出目录：
+- `WORKSPACE_ROOT/lckfb-szpi-esp32s3-tirtc/`
+
+必须完成：
+1. 运行 Device Kit Doctor，记录实际使用的 npm 包、Skill、ESP32 Device Kit、源模板 commit、ESP-IDF、TiRTC SDK、生成器和所有关键组件版本。
+2. 审查 `docs/` 的实际内容，建立“需求—硬件事实—来源—验证等级”证据矩阵。每个来源只能使用一个可解析定位符；不得把提示词、多个文件或绝对机器路径拼成伪来源。
+3. 生成 Hardware IR v2。每个影响功能的 GPIO、clock、I2S controller/mode、codec slot、camera PID、DMA、task/core、frame buffer、内存和 backpressure 参数必须有精确来源。
+4. 对无法从允许证据确认的事实分类为 `source_resolvable`、`implementation_resolvable`、`build_resolvable`、`hil_resolvable` 或 `user_blocked`。只有真正的 `user_blocked` 才停止安全实现；不得用历史工程补证据。
+5. 生成板级 media adapter 和可独立构建的 ESP-IDF 工程。板级常量只进入项目 Hardware IR、合同或 adapter，不得写入通用 Skill。
+6. 音频生成 `board-audio-contract.json`。在 `idf.py reconfigure` 后，直接检查锁定 codec driver table，证明所选 sample rate、MCLK、I2S 模式和 slot 组合受相关 codec 支持；不得使用注释中的典型值代替驱动能力证明。
+7. 视频生成 `board-video-contract.json`，并引用项目内 `platform-media-contract.json`。门禁必须同时证明平台 stream 11 接受 MJPEG/H.264/H.265，以及本板只选择 MJPEG；还要核验锁定 camera 组件支持允许 PID、完整 JPEG 边界、TiRTC JPEG media type、camera/Wi-Fi 调度、frame buffer、最大 JPEG、send buffer、backpressure、PSRAM 和内部 DMA 内存关系。
+8. 生成并验证 `tirtc-runtime-contract.json`，证明发现得到的 `tirtc-srv` 实际传入 SDK、SDK callback 内不直接执行 disconnect/stop/uninit、H5 下行严格过滤 stream 14 与 A-law/8 kHz、AI `start_session` 严格验证 `session_id` 和输入输出格式、远端 `end_session` 能停止会话。
+9. 用 Skill 的 gate installer 把 runtime、audio、video 三个语义检查接入每次普通 `idf.py build`；合同必须和 adapter 源码及最终 `sdkconfig` 核对。任一适用门禁缺失或失败时，只能报告 `COMPILE_PASS / CAPABILITY_BLOCKED`，不得报告 `BUILD_VERIFIED`。
+10. 执行 `idf.py reconfigure`、全部语义门禁和完整 `idf.py build`。
+11. 将最终 BIN/ELF 复制到项目内 `artifacts/`，记录项目相对路径、实际大小和完整 SHA-256；用同一 SHA-256 执行 build-phase Hardware IR assessment。评估器必须重新读取 artifact 并核对大小和哈希。
+12. build assessment 通过后删除机器绑定的 `build/`，不要再次构建；对源码与 `artifacts/` 交付物运行 `project_portability.py --export`。交付物不得包含旧 `build/` 或本机绝对依赖。
+13. 生成 `TIRTC_PORTING_REPORT.md`，逐项记录 L-1、L0、L1 的 PASS/FAIL/SKIP、完整命令和证据。L2-L7 必须记为 SKIP，不得把编译通过描述成已有实机图像、声音、网络连接或稳定性证据。
+
+报告必须包含“根因归属”章节：
+- 必要硬件事实不在允许资料中：归类为“板卡资料不足”，列出缺失事实和所需官方证据。
+- 资料充分但 Skill 没有读取、校验或正确生成：归类为“Skill 缺陷”。
+- 要求存在歧义、冲突或错误约束：归类为“提示词缺陷”。
+- 只是缺少串口、设备、账号或实机运行证据：归类为“本轮 L2-L7 未执行”，不得错误归责给前三者。
+- 每项结论必须附具体文件、页码、URL、源码位置或命令结果，不能只给主观判断。
+
+即使构建失败，也不要引用历史工程修复。保留失败现场，报告最小阻塞点及下一步所需证据。

package/skills/tirtc-esp32-builder/assets/report-template.md

@@ -30,6 +30,10 @@
 
 ## Semantic build gates
 
+- Platform/Web video profiles: `{{PLATFORM_VIDEO_PROFILES}}`
+- Board-selected video profile: `{{BOARD_VIDEO_PROFILE}}`
+- Runtime contract path/SHA-256: `{{RUNTIME_CONTRACT}}`
+- Endpoint/callback/downlink/AI-session result: `{{RUNTIME_GATE}}`
 - Audio contract path/SHA-256: `{{AUDIO_CONTRACT}}`
 - Codec clock-table result: `{{AUDIO_CLOCK_GATE}}`
 - I2S mode/controller/slot/handoff result: `{{AUDIO_TOPOLOGY_GATE}}`
@@ -56,7 +60,7 @@
 ## Firmware and flash record
 
 - Serial port/chip: `{{SERIAL_TARGET}}`
-- Firmware artifacts: `{{FIRMWARE_ARTIFACTS}}`
+- Project-relative firmware artifacts: `{{FIRMWARE_ARTIFACTS}}`
 - Firmware SHA-256: `{{FIRMWARE_SHA256}}`
 - Flash command/result: `{{FLASH_RESULT}}`
 

package/skills/tirtc-esp32-builder/assets/tirtc-runtime-contract.example.json

@@ -0,0 +1,10 @@
+{
+  "schema_version": 1,
+  "platform_contract": "platform-media-contract.json",
+  "files": {
+    "platform_client": "components/platform_client/src/platform_client.c",
+    "app_main": "main/app_main.c",
+    "starter_tirtc": "components/starter_tirtc/src/starter_tirtc.c",
+    "starter_runtime": "components/starter_runtime/src/starter_runtime.c"
+  }
+}

package/skills/tirtc-esp32-builder/references/capability-rules.md

@@ -17,7 +17,7 @@ A design fact that is still unknown is `NEEDS_CONFIRMATION`; a confirmed missing
 
 ## Selected video profiles
 
-Hardware IR v2 stores one or more `camera.video_profiles` and exactly one selected profile for H5 video:
+The current platform/Web contract supports all three profiles below on video stream 11. Hardware IR v2 separately stores the profiles the board can produce and exactly one selected profile for H5 video:
 
 | Codec | Required output contract |
 |---|---|
@@ -25,7 +25,7 @@ Hardware IR v2 stores one or more `camera.video_profiles` and exactly one select
 | `h264` | `h264_annex_b_access_units`: Annex-B access units with SPS/PPS and IDR request behavior |
 | `h265` | `h265_annex_b_access_units`: Annex-B access units with parameter-set and refresh behavior defined by the coordinated H5 contract |
 
-Available but unselected profiles do not satisfy or block the selected contract. Stream IDs and codec support must come from the applicable ThingConnect/H5 contract, not this table alone.
+Available but unselected board profiles do not satisfy or block the selected contract. A board may select MJPEG even though the platform also accepts H.264 and H.265. Stream IDs and codec support must be verified against the project-local platform contract rather than inferred from board hardware.
 
 ## Phased project gates
 
@@ -36,7 +36,7 @@ The intake phase requires:
 - one evidenced binding method—verification code, factory-bound identity, development credentials, or documented custom flow—plus stored-binding behavior and reset control;
 - feature-specific I2S/GPIO ownership plans, channel/TDM mapping, realtime camera policy, and a static startup/media memory budget.
 
-At intake, `corroborated` on these fields means the design is resolved from authoritative sources and is safe to implement. After compilation, promote a field to `build_verified` only when the generated source, component lock, semantic gate, compile result, or post-link gate establishes it. Build assessment reruns the applicable project-relative [audio contract](audio-contract.md) and [video contract](video-contract.md); self-declared `resolved=true`, `pipeline_safe=true`, or memory-budget booleans cannot replace them. The build phase requires an exact artifact SHA-256 and returns `BUILD_VERIFIED` only when every requested feature passes. Runtime measurements never need to be invented to pass intake or build.
+At intake, `corroborated` on these fields means the design is resolved from authoritative sources and is safe to implement. After compilation, promote a field to `build_verified` only when the generated source, component lock, semantic gate, compile result, or post-link gate establishes it. Build assessment reruns the applicable project-relative [audio contract](audio-contract.md), [video contract](video-contract.md), and mandatory [runtime contract](runtime-contract.md); self-declared `resolved=true`, `pipeline_safe=true`, or memory-budget booleans cannot replace them. The build phase requires an exact on-disk artifact SHA-256 and returns `BUILD_VERIFIED` only when every requested feature passes. Runtime measurements never need to be invented to pass intake or build.
 
 SoftAP is one Wi-Fi option, not a universal requirement. BLE, SmartConfig, factory NVS, development configuration, or a documented custom method can satisfy intake when the selected path is evidenced. Committed plaintext credentials are always `BLOCKED`.
 

package/skills/tirtc-esp32-builder/references/hardware-ir.md

@@ -13,6 +13,7 @@ The initializer creates schema v2. The validator still accepts schema v1 for exi
 ## Evidence rules
 
 - Give every source a stable `id`, `kind`, `location`, and revision when available.
+- Use one resolvable location per source. Accept an IR-relative local path or an explicit `https:`, `http:`, `device-kit:`, `managed:`, `official:`, `user-input:`, or `user-supplied:` locator. Reject absolute machine paths, concatenated multi-source strings, invented schemes, missing local paths, and declared SHA-256 values that do not match the referenced local file.
 - Reference source IDs from board facts, selected profiles, onboarding methods, resources, and runtime evidence.
 - Use `null` for unknown facts. Retain contradictory values as explicit issues instead of choosing silently.
 - Hardware revision `unspecified` is valid during intake but blocks reusable-board readiness.
@@ -39,6 +40,7 @@ The IR contains:
 - `hardware_resources` for I2C, I2S/GPIO ownership, audio channel mapping, camera realtime policy, and memory budget;
 - project-relative `hardware_resources.audio_semantic_contract` for every project requesting audio;
 - project-relative `hardware_resources.video_semantic_contract` for every project requesting video;
+- project-relative `hardware_resources.runtime_semantic_contract` for every generated H5/AI project;
 - `onboarding.wifi_credentials` with selectable SoftAP/BLE/SmartConfig/factory/development/custom methods;
 - selectable ThingConnect binding methods plus stored-binding states and reset control;
 - requested features;
@@ -61,7 +63,7 @@ python3 <skill-dir>/scripts/hardware_ir.py assess hardware-ir.json \
   --artifact-sha256 <64-character-sha256> --strict
 ```
 
-The intake phase returns `READY_TO_PORT`; the build phase returns `BUILD_VERIFIED`. Build assessment only accepts a hash already present in `build_evidence.artifacts[]` and reruns the project-local media contracts through `--project`. Missing serial or browser access does not block either phase.
+The intake phase returns `READY_TO_PORT`; the build phase returns `BUILD_VERIFIED`. Build assessment only accepts a hash already present in `build_evidence.artifacts[]`, reopens that project-relative artifact to verify its byte size and SHA-256, and reruns the project-local audio, video, and runtime contracts through `--project`. Missing serial or browser access does not block either phase.
 
 Run:
 

package/skills/tirtc-esp32-builder/references/reporting.md

@@ -16,9 +16,9 @@ Use [the report template](../assets/report-template.md) and preserve separate `P
 | L6 AI | Token, WHIP, `start_session`, bidirectional audio, stop, and H5 recovery work |
 | L7 Stability | Requested weak-network, repeated-session, resource, and soak criteria pass |
 
-Run and record the intake assessment before L0, the build assessment with `--project` and the exact artifact SHA-256 at L1, and the HIL assessment only when matching runtime evidence exists. The L1 hash must already appear in `build_evidence.artifacts[]`; a syntactically valid unrecorded hash is a failure. Missing serial or browser access is a `SKIP` for the affected L2-L7 levels, not an L0/L1 failure.
+Run and record the intake assessment before L0, the build assessment with `--project` and the exact artifact SHA-256 at L1, and the HIL assessment only when matching runtime evidence exists. Before assessment, copy final deliverable BIN/ELF files to project-relative `artifacts/` paths and record their actual byte size and SHA-256 in `build_evidence.artifacts[]`; the assessor reopens the file and rejects stale metadata. Missing serial or browser access is a `SKIP` for the affected L2-L7 levels, not an L0/L1 failure.
 
-Keep `COMPILE_PASS` separate from `BUILD_VERIFIED`. When the compiler succeeds but a requested audio or video semantic gate fails or is missing, record the compiler result and report the feature and project as blocked. H5 image display is L5 evidence, never an inference from L1.
+Keep `COMPILE_PASS` separate from `BUILD_VERIFIED`. When the compiler succeeds but a required runtime, audio, or video semantic gate fails or is missing, record the compiler result and report the feature and project as blocked. After build assessment, remove `build/` without rebuilding and run `project_portability.py --export`; the source deliverable may retain verified `artifacts/` copies but not a machine-bound build tree. H5 image display is L5 evidence, never an inference from L1.
 
 ## Evidence
 

package/skills/tirtc-esp32-builder/references/runtime-contract.md

@@ -0,0 +1,34 @@
+# TiRTC runtime protocol contract
+
+Use this gate for every generated H5/AI project. It verifies protocol behavior that is
+neither a board clock fact nor a camera fact: service discovery wiring, SDK callback
+lifecycle, stream/media metadata, and AI session negotiation.
+
+Copy `assets/tirtc-runtime-contract.example.json` to
+`<project>/tirtc-runtime-contract.json`. Keep the file paths project-relative. The
+Device Kit generator supplies `platform-media-contract.json`; do not recreate it from
+the prompt or replace it with board capability claims.
+
+Run and install the gate before the final build:
+
+```bash
+python3 <skill-dir>/scripts/runtime_contract.py \
+  <project>/tirtc-runtime-contract.json \
+  --project <project> \
+  --evidence-out <project>/build/runtime-contract-evidence.json
+python3 <skill-dir>/scripts/install_runtime_gate.py <project>
+```
+
+The gate requires all of the following:
+
+- discovered `tirtc-srv` is passed to `TIRTC_OPT_SERVICE_ENDPOINT`;
+- SDK callbacks copy/queue work and never call Disconnect, Stop, or Uninit;
+- H5 streams 10/11/14 and AI stream 1 use the platform media contract;
+- downlink accepts only G.711 A-law, 8 kHz, mono metadata before decoding;
+- platform video capability includes MJPEG, H.264, and H.265 while the board contract
+  selects exactly one;
+- AI media starts only after a matching response provides a non-empty session ID and
+  authoritative input/output audio formats matching the implemented codec;
+- remote `end_session` converges through the runtime control task.
+
+Compilation without this gate is not an H5/AI `BUILD_VERIFIED` result.