safety: use the global watchdog configuration - #2453
Draft
adeebshihadeh wants to merge 1 commit into
Draft
adeebshihadeh wants to merge 1 commit into
adeebshihadeh wants to merge 1 commit into
Conversation
SpysyWeeb
added a commit
to SpysyWeeb/Spysypilot
that referenced
this pull request
Sep 14, 2026
opendbc_repo 88505d3e7 -> e7eca010a (SpysyWeeb/opendbc BLaTv3, 2026-09-12).
panda stays at commaai 5314c84d9.
The pinned pair no longer built. commaai/opendbc 95195b31 ("safety: enable 100%
branch coverage, part 2", 2026-09-12) changed the hook to `void safety_tick(void)`.
The fork's BLaTv3 branch merged commaai master past that point, so 88505d3e7
declares `safety_tick(void)`, but panda 5314c84d9 calls
`safety_tick(¤t_safety_config)` (board/main.c:242). The matching panda change
is still open as commaai/panda#2453. Upstream openpilot pins opendbc a3d3b7c6c and
panda 5314c84d9, and both use the argument form.
The rule: a consumer branch's panda/opendbc gitlink may only point at the newest
first-parent commit of its tracked fork branch whose merge-base with commaai
master is an ancestor of the commit upstream openpilot pins. If a submodule points
at commaai directly, the target is upstream openpilot's pin. On this branch panda
points at commaai directly and already equals upstream's pin. Upstream only bumps
panda and opendbc together once both build, so taking our pin from theirs means we
get the same guarantee.
Evidence:
merge-base(e7eca010a, commaai/master) = a3d3b7c6c, which is upstream openpilot's
pin; e7eca010a declares `void safety_tick(const safety_config *cfg)`, matching
panda 5314c84d9.
e7eca010a is the newest first-parent commit on the fork's BLaTv3 branch that
qualifies. The 19 non-merge commits between it and the old pin all came from
commaai master, and no fork-owned path differs.
This is where the rule puts the pin now, not a stopgap. The target moves forward
once commaai/panda#2453 merges and upstream openpilot bumps its pair. BLaTv3 is
not in sync-submodules.yaml's matrix, so nothing moves this pin automatically
yet.
Verified on GitHub Actions, engagement-smoke dispatched on a probe of this tree:
scons built every target, including the signed panda firmware against opendbc
e7eca010a; pytest then passed 257 tests across test_torqued, test_car_interfaces and the modeld tests, and the cereal import and upstream-field check were clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
SpysyWeeb
added a commit
to SpysyWeeb/Spysypilot
that referenced
this pull request
Sep 14, 2026
opendbc_repo c76a2eead -> 33f0bb7df (SpysyWeeb/opendbc Spysypilot, 2026-09-12).
panda stays at 8a7c80aa0.
The pinned pair no longer built. commaai/opendbc 95195b31 ("safety: enable 100%
branch coverage, part 2", 2026-09-12) changed the hook to `void safety_tick(void)`.
The fork's Spysypilot branch merged commaai master past that point, so c76a2eead
declares `safety_tick(void)`, but panda 8a7c80aa0 still calls
`safety_tick(¤t_safety_config)` (board/main.c:244). The matching panda change
is still open as commaai/panda#2453. Upstream openpilot pins opendbc a3d3b7c6c and
panda 5314c84d9, and both use the argument form.
The rule: a consumer branch's panda/opendbc gitlink may only point at the newest
first-parent commit of its tracked fork branch whose merge-base with commaai
master is an ancestor of the commit upstream openpilot pins. If a submodule points
at commaai directly, the target is upstream openpilot's pin. Upstream only bumps
panda and opendbc together once both build, so taking our pin from theirs means we
get the same guarantee.
Evidence:
merge-base(33f0bb7df, commaai/master) = a3d3b7c6c, which is upstream openpilot's
pin; 33f0bb7df declares `void safety_tick(const safety_config *cfg)`, matching
panda 8a7c80aa0 (whose own commaai base is 5314c84d9, upstream's panda pin).
33f0bb7df is the newest first-parent commit on Spysypilot that qualifies. The
19 non-merge commits between it and the old pin all came from commaai master.
opendbc/safety/spysypilot/aol.h and aol_types.h are byte-identical at c76a2eead
and 33f0bb7df.
This is where the rule puts the pin now, not a stopgap. The target moves forward
once commaai/panda#2453 merges and upstream openpilot bumps its pair.
sync-submodules.yaml runs daily from combo, the default branch, with SOL in its
matrix. It still advances each submodule to its tracked fork-branch tip, so it
will try c76a2eead again; its build step fails on the safety_tick mismatch
before the push, so it cannot land it.
Verified on GitHub Actions, engagement-smoke dispatched on a probe of this tree:
scons built every target, including the signed panda firmware against opendbc
33f0bb7df; pytest then passed 251 tests across test_torqued and test_car_interfaces, and the cereal import and upstream-field check were clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the firmware caller for commaai/opendbc#3759. Depends on that opendbc change.