Design decision: Matter integration via hub bridge (SWARCH-WOHL-006)

[avrabe]

Summary

Records a tracked ASPICE design decision: Wohl reaches the Matter ecosystem through the hub acting as a Matter Bridge, with sensors keeping the lean, verified CCSDS firmware — they are not native Matter devices.

Decision reached after an independent architecture review (CCSDS vs Matter on the sensor: footprint, battery, BOM, certification, and the impact on Wohl's verification story).

New artifacts

ID	Type	Role
SWREQ-MATTER-001	sw-req	Matter ecosystem interoperability via hub bridge — derives-from SYSREQ-WOHL-006
SWARCH-WOHL-006	sw-arch-component (SWE.2)	The design decision record — allocated-from SWREQ-MATTER-001

The decision

Option A (chosen) — sensors emit CCSDS; hub translates to Matter, presents each sensor as a Matter bridged endpoint.
Option B (rejected) — sensors implement the full Matter stack over Thread (standalone Matter devices).

Rationale captured in SWARCH-WOHL-006:

• Verification (decisive) — a Matter + OpenThread stack is hundreds of KB of allocating C/C++, outside Kani/Verus. Option B dissolves the "Verified. Always on." differentiator; Option A keeps verification end-to-end.
• Footprint — Option B forces ~16× flash / ~32× RAM more sensor silicon.
• Certification — Option B needs Matter cert per sensor SKU; Option A needs at most one hub bridge cert.
• Transport — sub-GHz sensors can never be Matter-native (Matter is IP/Thread/Wi-Fi only), so the hub bridge is mandatory regardless — Option A is the only uniform architecture.
• Market check — cheap "Matter" sensors are mostly Zigbee bridged via a vendor hub; genuine Matter-over-Thread sensors ship oversized batteries. Low price = volume + amortized cert, not cheap engineering.

Verification

• rivet validate — PASS. The one new warning is the standard lifecycle-coverage warning every approved sw-req carries (no verification artifacts yet). CI's rivet-validate job re-checks on this PR.
• Traceability: SWARCH-WOHL-006 → SWREQ-MATTER-001 → SYSREQ-WOHL-006.

Linked work

• Phase 3 field firmware (Phase 3: Field sensor firmware — Thread (STM32WB55) base, sub-GHz + CAN-FD alternates, transport-agnostic CCSDS #10) — the transport trait + hub bridge implement this decision.

🤖 Generated with Claude Code