kaptan/docs/src/safety-boundary.md

Safety boundary

Every checked-in F722 image inhibits PB0, PB1, PB4, and PB5 before normal board initialization. The interlock configures each pin as a low, push-pull GPIO output; it runs before clocks, board routing, UART setup, or RTIC tasks.

There is no checked-in platform actuator route:

• no DShot or PWM peripheral implementation is linked;
• no TIM3/TIM5 motor task or DMA output path exists;
• MAVLink input has no production authority path;
• a future verified arm command is still acknowledged as unsupported.

The protocol reference crate remains in the workspace only as a framing and arming-sequence reference. It does not grant hardware access or authority.

Run the structural guard after any platform or board change:

cargo test -p platform-stm32f7 --test platform_safety_boundary --offline

This boundary is deliberately stronger than an application-level disarm flag: it removes the physical actuator implementation from the platform image.