From 1f24ccbd595609d56fca5b2df947ddb9bdf50046 Mon Sep 17 00:00:00 2001
From: mkadinti <101405874+mkadinti@users.noreply.github.com>
Date: Wed, 17 Jun 2026 15:27:23 +0530
Subject: [PATCH 01/13] RDKEMW-9150:[SECVULN] - HTTPS support for firmware
 download-OpenSpec Integration (#249)

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download

* Update project.md

* Update project.md

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- Spec generation for this user story with openspec

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- Adding RFC feature gate

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- XConf URL path branching and Codebig bypass

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- XConf URL path branching and Codebig bypass

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- XConf URL path branching and Codebig bypass

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- XConf URL path branching and Codebig bypass - unittests fix

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- XConf URL path branching and Codebig bypass - update on task.md

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- Per-Artifact Download Orchestration

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- Per-Artifact Download Orchestration

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- Per-artifact selective retry (max 3)

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download - upated with directCDN daigram

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download - L1 failure fix

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download - L1 failure fix

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download - L1

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download-CI build failure fix

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- addressing HIGH impact copilot review comments

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- addressing HIGH impact copilot review comments

* Update rdkv_main.c

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- addressing HIGH impact copilot review comments

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- after addressing comments, L1 fix

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download-OpenSpec Integration-peripheral issue

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download-OpenSpec Integration-peripheral issue

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- statered Fix

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- statered Fix

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download- PR cleanedup

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Update rdkv_upgrade.c

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Update rdkv_upgrade.c

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Update rdkv_main.c

* Update rdkv_upgrade.c

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* RDKEMW-9150:[SECVULN] - HTTPS support for firmware download-Legacy StateRed Fix

* Revert "RDKEMW-9150:[SECVULN] - HTTPS support for firmware download-Legacy StateRed Fix"

This reverts commit 4357d6d7d7c356909370580d26656b01aa53a7dd.

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/prompts/opsx-apply.prompt.md          |  149 +
 .github/prompts/opsx-archive.prompt.md        |  154 +
 .github/prompts/opsx-bulk-archive.prompt.md   |  239 +
 .github/prompts/opsx-continue.prompt.md       |  111 +
 .github/prompts/opsx-explore.prompt.md        |  170 +
 .github/prompts/opsx-ff.prompt.md             |   94 +
 .github/prompts/opsx-new.prompt.md            |   66 +
 .github/prompts/opsx-onboard.prompt.md        |  547 +++
 .github/prompts/opsx-propose.prompt.md        |  103 +
 .github/prompts/opsx-sync.prompt.md           |  131 +
 .github/prompts/opsx-verify.prompt.md         |  161 +
 .github/skills/openspec-apply-change/SKILL.md |  156 +
 .../skills/openspec-archive-change/SKILL.md   |  114 +
 .../openspec-bulk-archive-change/SKILL.md     |  246 +
 .../skills/openspec-continue-change/SKILL.md  |  118 +
 .github/skills/openspec-explore/SKILL.md      |  288 ++
 .github/skills/openspec-ff-change/SKILL.md    |  101 +
 .github/skills/openspec-new-change/SKILL.md   |   74 +
 .github/skills/openspec-onboard/SKILL.md      |  554 +++
 .github/skills/openspec-propose/SKILL.md      |  110 +
 .github/skills/openspec-sync-specs/SKILL.md   |  138 +
 .../skills/openspec-verify-change/SKILL.md    |  168 +
 Makefile.am                                   |    2 +
 .../.openspec.yaml                            |    2 +
 .../2026-06-04-direct-cdn-adoption/design.md  |  673 +++
 .../proposal.md                               |   37 +
 .../specs/direct-cdn-download/spec.md         |  147 +
 .../specs/download-engine/spec.md             |   19 +
 .../specs/firmware-validation/spec.md         |   34 +
 .../specs/retry-recovery/spec.md              |   53 +
 .../specs/updater-execution/spec.md           |   42 +
 .../2026-06-04-direct-cdn-adoption/tasks.md   |   62 +
 .../.openspec.yaml                            |    2 +
 .../design.md                                 |  151 +
 .../proposal.md                               |   29 +
 .../specs/download-engine/spec.md             |   16 +
 .../specs/firmware-validation/spec.md         |   20 +
 .../specs/retry-recovery/spec.md              |   17 +
 .../tasks.md                                  |   23 +
 .../.openspec.yaml                            |    2 +
 .../design.md                                 |   46 +
 .../proposal.md                               |   26 +
 .../specs/test-mock-isolation/spec.md         |   23 +
 .../tasks.md                                  |   23 +
 .../design.md                                 |   78 +
 .../proposal.md                               |   24 +
 .../specs/operational-safety/spec.md          |   16 +
 .../specs/retry-recovery/spec.md              |   23 +
 .../fix-state-red-dual-instance-race/tasks.md |   27 +
 openspec/config.yaml                          |   20 +
 openspec/dbus/dbus-architecture.md            |  271 ++
 openspec/diagrams/architecture-diagrams.md    |  354 ++
 openspec/diagrams/subsystem-architecture.md   | 1020 ++++
 openspec/gaps-and-unknowns.md                 |  115 +
 openspec/project.md                           |  269 ++
 openspec/runtime/client-daemon-interaction.md |  387 ++
 openspec/runtime/daemon-threading-model.md    |  314 ++
 openspec/runtime/firmware-update-flows.md     |  231 +
 openspec/runtime/rdkFwupdateMgr-lifecycle.md  |  206 +
 openspec/runtime/rdkFwupdateMgr-sequence.md   |  431 ++
 openspec/runtime/rdkvfwupgrader-lifecycle.md  |  160 +
 openspec/runtime/rdkvfwupgrader-sequence.md   |  347 ++
 openspec/specs/client-sdk/spec.md             |  466 ++
 openspec/specs/daemon-runtime/spec.md         |  344 ++
 openspec/specs/dbus-ipc/spec.md               |  487 ++
 openspec/specs/direct-cdn-download/spec.md    |   75 +
 openspec/specs/download-engine/spec.md        |  444 ++
 openspec/specs/firmware-validation/spec.md    |  476 ++
 openspec/specs/operational-safety/spec.md     |  444 ++
 openspec/specs/retry-recovery/spec.md         |  423 ++
 openspec/specs/test-mock-isolation/spec.md    |   38 +
 openspec/specs/updater-execution/spec.md      |  415 ++
 openspec/subsystems/client-library.md         |  215 +
 openspec/subsystems/spec-boundaries.md        |  137 +
 openspec/subsystems/subsystem-inventory.md    |  605 +++
 openspec/subsystems/subsystem-map.md          |  199 +
 src/dbus/rdkFwupdateMgr_handlers.c            |    3 +-
 src/dbus/rdkv_dbus_server.c                   |   27 +-
 src/device_status_helper.c                    |    4 +
 src/deviceutils/device_api.c                  |   32 +-
 src/deviceutils/deviceutils.c                 |   17 +
 src/deviceutils/deviceutils.h                 |    2 +
 src/directcdn.c                               |  221 +
 src/include/json_process.h                    |    3 +
 src/include/rdkv_cdl.h                        |    7 +-
 src/include/rdkv_upgrade.h                    |    2 +
 src/include/rfcinterface.h                    |    3 +
 src/json_process.c                            |   29 +-
 src/rdkFwupdateMgr.c                          |    4 +-
 src/rdkv_main.c                               |  162 +-
 src/rdkv_upgrade.c                            |   28 +-
 src/rfcInterface/rfcinterface.c               |   27 +
 unittest/Makefile.am                          |    1 +
 unittest/basic_rdkv_main_gtest.cpp            | 4240 +++++++++++------
 unittest/device_status_helper_gtest.cpp       |    9 +
 unittest/deviceutils/device_api_gtest.cpp     |  147 +
 unittest/fwdl_interface_gtest.cpp             |   29 +-
 unittest/mocks/dbus_handlers_gmock.cpp        |   10 +
 unittest/mocks/dbus_handlers_gmock.h          |    1 +
 unittest/mocks/device_status_helper_mock.cpp  |   17 +-
 unittest/mocks/device_status_helper_mock.h    |   12 +-
 unittest/mocks/deviceutils_mock.cpp           |   19 +
 unittest/mocks/deviceutils_mock.h             |    2 +
 unittest/mocks/rdkFwupdateMgr_mock.cpp        |    8 +
 unittest/mocks/rdkFwupdateMgr_mock.h          |    2 +
 unittest/rdkFwupdateMgr_handlers_gtest.cpp    |  104 +
 106 files changed, 18134 insertions(+), 1540 deletions(-)
 create mode 100755 .github/prompts/opsx-apply.prompt.md
 create mode 100755 .github/prompts/opsx-archive.prompt.md
 create mode 100755 .github/prompts/opsx-bulk-archive.prompt.md
 create mode 100755 .github/prompts/opsx-continue.prompt.md
 create mode 100755 .github/prompts/opsx-explore.prompt.md
 create mode 100755 .github/prompts/opsx-ff.prompt.md
 create mode 100755 .github/prompts/opsx-new.prompt.md
 create mode 100755 .github/prompts/opsx-onboard.prompt.md
 create mode 100755 .github/prompts/opsx-propose.prompt.md
 create mode 100755 .github/prompts/opsx-sync.prompt.md
 create mode 100755 .github/prompts/opsx-verify.prompt.md
 create mode 100755 .github/skills/openspec-apply-change/SKILL.md
 create mode 100755 .github/skills/openspec-archive-change/SKILL.md
 create mode 100755 .github/skills/openspec-bulk-archive-change/SKILL.md
 create mode 100755 .github/skills/openspec-continue-change/SKILL.md
 create mode 100755 .github/skills/openspec-explore/SKILL.md
 create mode 100755 .github/skills/openspec-ff-change/SKILL.md
 create mode 100755 .github/skills/openspec-new-change/SKILL.md
 create mode 100755 .github/skills/openspec-onboard/SKILL.md
 create mode 100755 .github/skills/openspec-propose/SKILL.md
 create mode 100755 .github/skills/openspec-sync-specs/SKILL.md
 create mode 100755 .github/skills/openspec-verify-change/SKILL.md
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-adoption/.openspec.yaml
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-adoption/design.md
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-adoption/proposal.md
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/direct-cdn-download/spec.md
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/download-engine/spec.md
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/firmware-validation/spec.md
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/retry-recovery/spec.md
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/updater-execution/spec.md
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-adoption/tasks.md
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/.openspec.yaml
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/design.md
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/proposal.md
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/specs/download-engine/spec.md
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/specs/firmware-validation/spec.md
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/specs/retry-recovery/spec.md
 create mode 100755 openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/tasks.md
 create mode 100755 openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/.openspec.yaml
 create mode 100755 openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/design.md
 create mode 100755 openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/proposal.md
 create mode 100755 openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/specs/test-mock-isolation/spec.md
 create mode 100755 openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/tasks.md
 create mode 100755 openspec/changes/fix-state-red-dual-instance-race/design.md
 create mode 100755 openspec/changes/fix-state-red-dual-instance-race/proposal.md
 create mode 100755 openspec/changes/fix-state-red-dual-instance-race/specs/operational-safety/spec.md
 create mode 100755 openspec/changes/fix-state-red-dual-instance-race/specs/retry-recovery/spec.md
 create mode 100755 openspec/changes/fix-state-red-dual-instance-race/tasks.md
 create mode 100755 openspec/config.yaml
 create mode 100755 openspec/dbus/dbus-architecture.md
 create mode 100755 openspec/diagrams/architecture-diagrams.md
 create mode 100755 openspec/diagrams/subsystem-architecture.md
 create mode 100755 openspec/gaps-and-unknowns.md
 create mode 100755 openspec/project.md
 create mode 100755 openspec/runtime/client-daemon-interaction.md
 create mode 100755 openspec/runtime/daemon-threading-model.md
 create mode 100755 openspec/runtime/firmware-update-flows.md
 create mode 100755 openspec/runtime/rdkFwupdateMgr-lifecycle.md
 create mode 100755 openspec/runtime/rdkFwupdateMgr-sequence.md
 create mode 100755 openspec/runtime/rdkvfwupgrader-lifecycle.md
 create mode 100755 openspec/runtime/rdkvfwupgrader-sequence.md
 create mode 100755 openspec/specs/client-sdk/spec.md
 create mode 100755 openspec/specs/daemon-runtime/spec.md
 create mode 100755 openspec/specs/dbus-ipc/spec.md
 create mode 100755 openspec/specs/direct-cdn-download/spec.md
 create mode 100755 openspec/specs/download-engine/spec.md
 create mode 100755 openspec/specs/firmware-validation/spec.md
 create mode 100755 openspec/specs/operational-safety/spec.md
 create mode 100755 openspec/specs/retry-recovery/spec.md
 create mode 100755 openspec/specs/test-mock-isolation/spec.md
 create mode 100755 openspec/specs/updater-execution/spec.md
 create mode 100755 openspec/subsystems/client-library.md
 create mode 100755 openspec/subsystems/spec-boundaries.md
 create mode 100755 openspec/subsystems/subsystem-inventory.md
 create mode 100755 openspec/subsystems/subsystem-map.md
 create mode 100644 src/directcdn.c
 mode change 100644 => 100755 unittest/basic_rdkv_main_gtest.cpp

diff --git a/.github/prompts/opsx-apply.prompt.md b/.github/prompts/opsx-apply.prompt.md
new file mode 100755
index 00000000..e23ec64d
--- /dev/null
+++ b/.github/prompts/opsx-apply.prompt.md
@@ -0,0 +1,149 @@
+---
+description: Implement tasks from an OpenSpec change (Experimental)
+---
+
+Implement tasks from an OpenSpec change.
+
+**Input**: Optionally specify a change name (e.g., `/opsx:apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx:continue`
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! You can archive this change with `/opsx:archive`.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.github/prompts/opsx-archive.prompt.md b/.github/prompts/opsx-archive.prompt.md
new file mode 100755
index 00000000..1163776d
--- /dev/null
+++ b/.github/prompts/opsx-archive.prompt.md
@@ -0,0 +1,154 @@
+---
+description: Archive a completed change in the experimental workflow
+---
+
+Archive a completed change in the experimental workflow.
+
+**Input**: Optionally specify a change name after `/opsx:archive` (e.g., `/opsx:archive add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Check for delta specs at `openspec/changes/<name>/specs/`. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create the archive directory if it doesn't exist:
+   ```bash
+   mkdir -p openspec/changes/archive
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move the change directory to archive
+
+   ```bash
+   mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Spec sync status (synced / sync skipped / no delta specs)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success (No Delta Specs)**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** No delta specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success With Warnings**
+
+```
+## Archive Complete (with warnings)
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** Sync skipped (user chose to skip)
+
+**Warnings:**
+- Archived with 2 incomplete artifacts
+- Archived with 3 incomplete tasks
+- Delta spec sync was skipped (user chose to skip)
+
+Review the archive if this was not intentional.
+```
+
+**Output On Error (Archive Exists)**
+
+```
+## Archive Failed
+
+**Change:** <change-name>
+**Target:** openspec/changes/archive/YYYY-MM-DD-<name>/
+
+Target archive directory already exists.
+
+**Options:**
+1. Rename the existing archive
+2. Delete the existing archive if it's a duplicate
+3. Wait until a different date to archive
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use the Skill tool to invoke `openspec-sync-specs` (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.github/prompts/opsx-bulk-archive.prompt.md b/.github/prompts/opsx-bulk-archive.prompt.md
new file mode 100755
index 00000000..0101c6b0
--- /dev/null
+++ b/.github/prompts/opsx-bulk-archive.prompt.md
@@ -0,0 +1,239 @@
+---
+description: Archive multiple completed changes at once
+---
+
+Archive multiple completed changes in a single operation.
+
+This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
+
+**Input**: None required (prompts for selection)
+
+**Steps**
+
+1. **Get active changes**
+
+   Run `openspec list --json` to get all active changes.
+
+   If no active changes exist, inform user and stop.
+
+2. **Prompt for change selection**
+
+   Use **AskUserQuestion tool** with multi-select to let user choose changes:
+   - Show each change with its schema
+   - Include an option for "All changes"
+   - Allow any number of selections (1+ works, 2+ is the typical use case)
+
+   **IMPORTANT**: Do NOT auto-select. Always let the user choose.
+
+3. **Batch validation - gather status for all selected changes**
+
+   For each selected change, collect:
+
+   a. **Artifact status** - Run `openspec status --change "<name>" --json`
+      - Parse `schemaName` and `artifacts` list
+      - Note which artifacts are `done` vs other states
+
+   b. **Task completion** - Read `openspec/changes/<name>/tasks.md`
+      - Count `- [ ]` (incomplete) vs `- [x]` (complete)
+      - If no tasks file exists, note as "No tasks"
+
+   c. **Delta specs** - Check `openspec/changes/<name>/specs/` directory
+      - List which capability specs exist
+      - For each, extract requirement names (lines matching `### Requirement: <name>`)
+
+4. **Detect spec conflicts**
+
+   Build a map of `capability -> [changes that touch it]`:
+
+   ```
+   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   api  -> [change-c]            <- OK (only 1 change)
+   ```
+
+   A conflict exists when 2+ selected changes have delta specs for the same capability.
+
+5. **Resolve conflicts agentically**
+
+   **For each conflict**, investigate the codebase:
+
+   a. **Read the delta specs** from each conflicting change to understand what each claims to add/modify
+
+   b. **Search the codebase** for implementation evidence:
+      - Look for code implementing requirements from each delta spec
+      - Check for related files, functions, or tests
+
+   c. **Determine resolution**:
+      - If only one change is actually implemented -> sync that one's specs
+      - If both implemented -> apply in chronological order (older first, newer overwrites)
+      - If neither implemented -> skip spec sync, warn user
+
+   d. **Record resolution** for each conflict:
+      - Which change's specs to apply
+      - In what order (if both)
+      - Rationale (what was found in codebase)
+
+6. **Show consolidated status table**
+
+   Display a table summarizing all changes:
+
+   ```
+   | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
+   |---------------------|-----------|-------|---------|-----------|--------|
+   | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
+   | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
+   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
+   | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
+   ```
+
+   For conflicts, show the resolution:
+   ```
+   * Conflict resolution:
+     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+   ```
+
+   For incomplete changes, show warnings:
+   ```
+   Warnings:
+   - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
+   ```
+
+7. **Confirm batch operation**
+
+   Use **AskUserQuestion tool** with a single confirmation:
+
+   - "Archive N changes?" with options based on status
+   - Options might include:
+     - "Archive all N changes"
+     - "Archive only N ready changes (skip incomplete)"
+     - "Cancel"
+
+   If there are incomplete changes, make clear they'll be archived with warnings.
+
+8. **Execute archive for each confirmed change**
+
+   Process changes in the determined order (respecting conflict resolution):
+
+   a. **Sync specs** if delta specs exist:
+      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
+      - For conflicts, apply in resolved order
+      - Track if sync was done
+
+   b. **Perform the archive**:
+      ```bash
+      mkdir -p openspec/changes/archive
+      mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
+      ```
+
+   c. **Track outcome** for each change:
+      - Success: archived successfully
+      - Failed: error during archive (record error)
+      - Skipped: user chose not to archive (if applicable)
+
+9. **Display summary**
+
+   Show final results:
+
+   ```
+   ## Bulk Archive Complete
+
+   Archived 3 changes:
+   - schema-management-cli -> archive/2026-01-19-schema-management-cli/
+   - project-config -> archive/2026-01-19-project-config/
+   - add-oauth -> archive/2026-01-19-add-oauth/
+
+   Skipped 1 change:
+   - add-verify-skill (user chose not to archive incomplete)
+
+   Spec sync summary:
+   - 4 delta specs synced to main specs
+   - 1 conflict resolved (auth: applied both in chronological order)
+   ```
+
+   If any failures:
+   ```
+   Failed 1 change:
+   - some-change: Archive directory already exists
+   ```
+
+**Conflict Resolution Examples**
+
+Example 1: Only one implemented
+```
+Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
+
+Checking add-oauth:
+- Delta adds "OAuth Provider Integration" requirement
+- Searching codebase... found src/auth/oauth.ts implementing OAuth flow
+
+Checking add-jwt:
+- Delta adds "JWT Token Handling" requirement
+- Searching codebase... no JWT implementation found
+
+Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
+```
+
+Example 2: Both implemented
+```
+Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
+
+Checking add-rest-api (created 2026-01-10):
+- Delta adds "REST Endpoints" requirement
+- Searching codebase... found src/api/rest.ts
+
+Checking add-graphql (created 2026-01-15):
+- Delta adds "GraphQL Schema" requirement
+- Searching codebase... found src/api/graphql.ts
+
+Resolution: Both implemented. Will apply add-rest-api specs first,
+then add-graphql specs (chronological order, newer takes precedence).
+```
+
+**Output On Success**
+
+```
+## Bulk Archive Complete
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+- <change-2> -> archive/YYYY-MM-DD-<change-2>/
+
+Spec sync summary:
+- N delta specs synced to main specs
+- No conflicts (or: M conflicts resolved)
+```
+
+**Output On Partial Success**
+
+```
+## Bulk Archive Complete (partial)
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+
+Skipped M changes:
+- <change-2> (user chose not to archive incomplete)
+
+Failed K changes:
+- <change-3>: Archive directory already exists
+```
+
+**Output When No Changes**
+
+```
+## No Changes to Archive
+
+No active changes found. Create a new change to get started.
+```
+
+**Guardrails**
+- Allow any number of changes (1+ is fine, 2+ is the typical use case)
+- Always prompt for selection, never auto-select
+- Detect spec conflicts early and resolve by checking codebase
+- When both changes are implemented, apply specs in chronological order
+- Skip spec sync only when implementation is missing (warn user)
+- Show clear per-change status before confirming
+- Use single confirmation for entire batch
+- Track and report all outcomes (success/skip/fail)
+- Preserve .openspec.yaml when moving to archive
+- Archive directory target uses current date: YYYY-MM-DD-<name>
+- If archive target exists, fail that change but continue with others
diff --git a/.github/prompts/opsx-continue.prompt.md b/.github/prompts/opsx-continue.prompt.md
new file mode 100755
index 00000000..24b480d7
--- /dev/null
+++ b/.github/prompts/opsx-continue.prompt.md
@@ -0,0 +1,111 @@
+---
+description: Continue working on a change - create the next artifact (Experimental)
+---
+
+Continue working on a change by creating the next artifact.
+
+**Input**: Optionally specify a change name after `/opsx:continue` (e.g., `/opsx:continue add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+
+   Present the top 3-4 most recently modified changes as options, showing:
+   - Change name
+   - Schema (from `schema` field if present, otherwise "spec-driven")
+   - Status (e.g., "0/5 tasks", "complete", "no tasks")
+   - How recently it was modified (from `lastModified` field)
+
+   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check current status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand current state. The response includes:
+   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
+   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
+   - `isComplete`: Boolean indicating if all artifacts are complete
+
+3. **Act based on status**:
+
+   ---
+
+   **If all artifacts are complete (`isComplete: true`)**:
+   - Congratulate the user
+   - Show final status including the schema used
+   - Suggest: "All artifacts created! You can now implement this change with `/opsx:apply` or archive it with `/opsx:archive`."
+   - STOP
+
+   ---
+
+   **If artifacts are ready to create** (status shows artifacts with `status: "ready"`):
+   - Pick the FIRST artifact with `status: "ready"` from the status output
+   - Get its instructions:
+     ```bash
+     openspec instructions <artifact-id> --change "<name>" --json
+     ```
+   - Parse the JSON. The key fields are:
+     - `context`: Project background (constraints for you - do NOT include in output)
+     - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+     - `template`: The structure to use for your output file
+     - `instruction`: Schema-specific guidance
+     - `outputPath`: Where to write the artifact
+     - `dependencies`: Completed artifacts to read for context
+   - **Create the artifact file**:
+     - Read any completed dependency files for context
+     - Use `template` as the structure - fill in its sections
+     - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
+     - Write to the output path specified in instructions
+   - Show what was created and what's now unlocked
+   - STOP after creating ONE artifact
+
+   ---
+
+   **If no artifacts are ready (all blocked)**:
+   - This shouldn't happen with a valid schema
+   - Show status and suggest checking for issues
+
+4. **After creating an artifact, show progress**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After each invocation, show:
+- Which artifact was created
+- Schema workflow being used
+- Current progress (N/M complete)
+- What artifacts are now unlocked
+- Prompt: "Run `/opsx:continue` to create the next artifact"
+
+**Artifact Creation Guidelines**
+
+The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+
+Common artifact patterns:
+
+**spec-driven schema** (proposal → specs → design → tasks):
+- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
+  - The Capabilities section is critical - each capability listed will need a spec file.
+- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
+- **design.md**: Document technical decisions, architecture, and implementation approach.
+- **tasks.md**: Break down implementation into checkboxed tasks.
+
+For other schemas, follow the `instruction` field from the CLI output.
+
+**Guardrails**
+- Create ONE artifact per invocation
+- Always read dependency artifacts before creating a new one
+- Never skip artifacts or create out of order
+- If context is unclear, ask the user before creating
+- Verify the artifact file exists after writing before marking progress
+- Use the schema's artifact sequence, don't assume specific artifact names
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
diff --git a/.github/prompts/opsx-explore.prompt.md b/.github/prompts/opsx-explore.prompt.md
new file mode 100755
index 00000000..3b674ebb
--- /dev/null
+++ b/.github/prompts/opsx-explore.prompt.md
@@ -0,0 +1,170 @@
+---
+description: Enter explore mode - think through ideas, investigate problems, clarify requirements
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Input**: The argument after `/opsx:explore` is whatever the user wants to think about. Could be:
+- A vague idea: "real-time collaboration"
+- A specific problem: "the auth system is getting unwieldy"
+- A change name: "add-dark-mode" (to explore in context of that change)
+- A comparison: "postgres vs sqlite for this"
+- Nothing (just enter explore mode)
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│      ┌────────┐         ┌────────┐      │
+│      │ State  │────────▶│ State  │      │
+│      │   A    │         │   B    │      │
+│      └────────┘         └────────┘      │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+If the user mentioned a specific change name, read its artifacts for context.
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Read existing artifacts for context**
+   - `openspec/changes/<name>/proposal.md`
+   - `openspec/changes/<name>/design.md`
+   - `openspec/changes/<name>/tasks.md`
+   - etc.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+    | Insight Type               | Where to Capture               |
+    |----------------------------|--------------------------------|
+    | New requirement discovered | `specs/<capability>/spec.md` |
+    | Requirement changed        | `specs/<capability>/spec.md` |
+    | Design decision made       | `design.md`                  |
+    | Scope changed              | `proposal.md`                |
+    | New work identified        | `tasks.md`                   |
+    | Assumption invalidated     | Relevant artifact              |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When things crystallize, you might offer a summary - but it's optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.github/prompts/opsx-ff.prompt.md b/.github/prompts/opsx-ff.prompt.md
new file mode 100755
index 00000000..06cea280
--- /dev/null
+++ b/.github/prompts/opsx-ff.prompt.md
@@ -0,0 +1,94 @@
+---
+description: Create a change and generate all artifacts needed for implementation in one go
+---
+
+Fast-forward through artifact creation - generate everything needed to start implementation.
+
+**Input**: The argument after `/opsx:ff` is the change name (kebab-case), OR a description of what the user wants to build.
+
+**Steps**
+
+1. **If no input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change at `openspec/changes/<name>/`.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `outputPath`: Where to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "✓ Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx:apply` to start implementing."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, ask if user wants to continue it or create a new one
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.github/prompts/opsx-new.prompt.md b/.github/prompts/opsx-new.prompt.md
new file mode 100755
index 00000000..ec2253d9
--- /dev/null
+++ b/.github/prompts/opsx-new.prompt.md
@@ -0,0 +1,66 @@
+---
+description: Start a new change using the experimental artifact workflow (OPSX)
+---
+
+Start a new change using the experimental artifact-driven approach.
+
+**Input**: The argument after `/opsx:new` is the change name (kebab-case), OR a description of what the user wants to build.
+
+**Steps**
+
+1. **If no input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Determine the workflow schema**
+
+   Use the default schema (omit `--schema`) unless the user explicitly requests a different workflow.
+
+   **Use a different schema only if the user mentions:**
+   - A specific schema name → use `--schema <name>`
+   - "show workflows" or "what workflows" → run `openspec schemas --json` and let them choose
+
+   **Otherwise**: Omit `--schema` to use the default.
+
+3. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   Add `--schema <name>` only if the user requested a specific workflow.
+   This creates a scaffolded change at `openspec/changes/<name>/` with the selected schema.
+
+4. **Show the artifact status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+   This shows which artifacts need to be created and which are ready (dependencies satisfied).
+
+5. **Get instructions for the first artifact**
+   The first artifact depends on the schema. Check the status output to find the first artifact with status "ready".
+   ```bash
+   openspec instructions <first-artifact-id> --change "<name>"
+   ```
+   This outputs the template and context for creating the first artifact.
+
+6. **STOP and wait for user direction**
+
+**Output**
+
+After completing the steps, summarize:
+- Change name and location
+- Schema/workflow being used and its artifact sequence
+- Current status (0/N artifacts complete)
+- The template for the first artifact
+- Prompt: "Ready to create the first artifact? Run `/opsx:continue` or just describe what this change is about and I'll draft it."
+
+**Guardrails**
+- Do NOT create any artifacts yet - just show the instructions
+- Do NOT advance beyond showing the first artifact template
+- If the name is invalid (not kebab-case), ask for a valid name
+- If a change with that name already exists, suggest using `/opsx:continue` instead
+- Pass --schema if using a non-default workflow
diff --git a/.github/prompts/opsx-onboard.prompt.md b/.github/prompts/opsx-onboard.prompt.md
new file mode 100755
index 00000000..d7b0614e
--- /dev/null
+++ b/.github/prompts/opsx-onboard.prompt.md
@@ -0,0 +1,547 @@
+---
+description: Guided onboarding - walk through a complete OpenSpec workflow cycle with narration
+---
+
+Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
+
+---
+
+## Preflight
+
+Before starting, check if the OpenSpec CLI is installed:
+
+```bash
+# Unix/macOS
+openspec --version 2>&1 || echo "CLI_NOT_INSTALLED"
+# Windows (PowerShell)
+# if (Get-Command openspec -ErrorAction SilentlyContinue) { openspec --version } else { echo "CLI_NOT_INSTALLED" }
+```
+
+**If CLI not installed:**
+> OpenSpec CLI is not installed. Install it first, then come back to `/opsx:onboard`.
+
+Stop here if not installed.
+
+---
+
+## Phase 1: Welcome
+
+Display:
+
+```
+## Welcome to OpenSpec!
+
+I'll walk you through a complete change cycle—from idea to implementation—using a real task in your codebase. Along the way, you'll learn the workflow by doing it.
+
+**What we'll do:**
+1. Pick a small, real task in your codebase
+2. Explore the problem briefly
+3. Create a change (the container for our work)
+4. Build the artifacts: proposal → specs → design → tasks
+5. Implement the tasks
+6. Archive the completed change
+
+**Time:** ~15-20 minutes
+
+Let's start by finding something to work on.
+```
+
+---
+
+## Phase 2: Task Selection
+
+### Codebase Analysis
+
+Scan the codebase for small improvement opportunities. Look for:
+
+1. **TODO/FIXME comments** - Search for `TODO`, `FIXME`, `HACK`, `XXX` in code files
+2. **Missing error handling** - `catch` blocks that swallow errors, risky operations without try-catch
+3. **Functions without tests** - Cross-reference `src/` with test directories
+4. **Type issues** - `any` types in TypeScript files (`: any`, `as any`)
+5. **Debug artifacts** - `console.log`, `console.debug`, `debugger` statements in non-debug code
+6. **Missing validation** - User input handlers without validation
+
+Also check recent git activity:
+```bash
+# Unix/macOS
+git log --oneline -10 2>/dev/null || echo "No git history"
+# Windows (PowerShell)
+# git log --oneline -10 2>$null; if ($LASTEXITCODE -ne 0) { echo "No git history" }
+```
+
+### Present Suggestions
+
+From your analysis, present 3-4 specific suggestions:
+
+```
+## Task Suggestions
+
+Based on scanning your codebase, here are some good starter tasks:
+
+**1. [Most promising task]**
+   Location: `src/path/to/file.ts:42`
+   Scope: ~1-2 files, ~20-30 lines
+   Why it's good: [brief reason]
+
+**2. [Second task]**
+   Location: `src/another/file.ts`
+   Scope: ~1 file, ~15 lines
+   Why it's good: [brief reason]
+
+**3. [Third task]**
+   Location: [location]
+   Scope: [estimate]
+   Why it's good: [brief reason]
+
+**4. Something else?**
+   Tell me what you'd like to work on.
+
+Which task interests you? (Pick a number or describe your own)
+```
+
+**If nothing found:** Fall back to asking what the user wants to build:
+> I didn't find obvious quick wins in your codebase. What's something small you've been meaning to add or fix?
+
+### Scope Guardrail
+
+If the user picks or describes something too large (major feature, multi-day work):
+
+```
+That's a valuable task, but it's probably larger than ideal for your first OpenSpec run-through.
+
+For learning the workflow, smaller is better—it lets you see the full cycle without getting stuck in implementation details.
+
+**Options:**
+1. **Slice it smaller** - What's the smallest useful piece of [their task]? Maybe just [specific slice]?
+2. **Pick something else** - One of the other suggestions, or a different small task?
+3. **Do it anyway** - If you really want to tackle this, we can. Just know it'll take longer.
+
+What would you prefer?
+```
+
+Let the user override if they insist—this is a soft guardrail.
+
+---
+
+## Phase 3: Explore Demo
+
+Once a task is selected, briefly demonstrate explore mode:
+
+```
+Before we create a change, let me quickly show you **explore mode**—it's how you think through problems before committing to a direction.
+```
+
+Spend 1-2 minutes investigating the relevant code:
+- Read the file(s) involved
+- Draw a quick ASCII diagram if it helps
+- Note any considerations
+
+```
+## Quick Exploration
+
+[Your brief analysis—what you found, any considerations]
+
+┌─────────────────────────────────────────┐
+│   [Optional: ASCII diagram if helpful]  │
+└─────────────────────────────────────────┘
+
+Explore mode (`/opsx:explore`) is for this kind of thinking—investigating before implementing. You can use it anytime you need to think through a problem.
+
+Now let's create a change to hold our work.
+```
+
+**PAUSE** - Wait for user acknowledgment before proceeding.
+
+---
+
+## Phase 4: Create the Change
+
+**EXPLAIN:**
+```
+## Creating a Change
+
+A "change" in OpenSpec is a container for all the thinking and planning around a piece of work. It lives in `openspec/changes/<name>/` and holds your artifacts—proposal, specs, design, tasks.
+
+Let me create one for our task.
+```
+
+**DO:** Create the change with a derived kebab-case name:
+```bash
+openspec new change "<derived-name>"
+```
+
+**SHOW:**
+```
+Created: `openspec/changes/<name>/`
+
+The folder structure:
+```
+openspec/changes/<name>/
+├── proposal.md    ← Why we're doing this (empty, we'll fill it)
+├── design.md      ← How we'll build it (empty)
+├── specs/         ← Detailed requirements (empty)
+└── tasks.md       ← Implementation checklist (empty)
+```
+
+Now let's fill in the first artifact—the proposal.
+```
+
+---
+
+## Phase 5: Proposal
+
+**EXPLAIN:**
+```
+## The Proposal
+
+The proposal captures **why** we're making this change and **what** it involves at a high level. It's the "elevator pitch" for the work.
+
+I'll draft one based on our task.
+```
+
+**DO:** Draft the proposal content (don't save yet):
+
+```
+Here's a draft proposal:
+
+---
+
+## Why
+
+[1-2 sentences explaining the problem/opportunity]
+
+## What Changes
+
+[Bullet points of what will be different]
+
+## Capabilities
+
+### New Capabilities
+- `<capability-name>`: [brief description]
+
+### Modified Capabilities
+<!-- If modifying existing behavior -->
+
+## Impact
+
+- `src/path/to/file.ts`: [what changes]
+- [other files if applicable]
+
+---
+
+Does this capture the intent? I can adjust before we save it.
+```
+
+**PAUSE** - Wait for user approval/feedback.
+
+After approval, save the proposal:
+```bash
+openspec instructions proposal --change "<name>" --json
+```
+Then write the content to `openspec/changes/<name>/proposal.md`.
+
+```
+Proposal saved. This is your "why" document—you can always come back and refine it as understanding evolves.
+
+Next up: specs.
+```
+
+---
+
+## Phase 6: Specs
+
+**EXPLAIN:**
+```
+## Specs
+
+Specs define **what** we're building in precise, testable terms. They use a requirement/scenario format that makes expected behavior crystal clear.
+
+For a small task like this, we might only need one spec file.
+```
+
+**DO:** Create the spec file:
+```bash
+# Unix/macOS
+mkdir -p openspec/changes/<name>/specs/<capability-name>
+# Windows (PowerShell)
+# New-Item -ItemType Directory -Force -Path "openspec/changes/<name>/specs/<capability-name>"
+```
+
+Draft the spec content:
+
+```
+Here's the spec:
+
+---
+
+## ADDED Requirements
+
+### Requirement: <Name>
+
+<Description of what the system should do>
+
+#### Scenario: <Scenario name>
+
+- **WHEN** <trigger condition>
+- **THEN** <expected outcome>
+- **AND** <additional outcome if needed>
+
+---
+
+This format—WHEN/THEN/AND—makes requirements testable. You can literally read them as test cases.
+```
+
+Save to `openspec/changes/<name>/specs/<capability>/spec.md`.
+
+---
+
+## Phase 7: Design
+
+**EXPLAIN:**
+```
+## Design
+
+The design captures **how** we'll build it—technical decisions, tradeoffs, approach.
+
+For small changes, this might be brief. That's fine—not every change needs deep design discussion.
+```
+
+**DO:** Draft design.md:
+
+```
+Here's the design:
+
+---
+
+## Context
+
+[Brief context about the current state]
+
+## Goals / Non-Goals
+
+**Goals:**
+- [What we're trying to achieve]
+
+**Non-Goals:**
+- [What's explicitly out of scope]
+
+## Decisions
+
+### Decision 1: [Key decision]
+
+[Explanation of approach and rationale]
+
+---
+
+For a small task, this captures the key decisions without over-engineering.
+```
+
+Save to `openspec/changes/<name>/design.md`.
+
+---
+
+## Phase 8: Tasks
+
+**EXPLAIN:**
+```
+## Tasks
+
+Finally, we break the work into implementation tasks—checkboxes that drive the apply phase.
+
+These should be small, clear, and in logical order.
+```
+
+**DO:** Generate tasks based on specs and design:
+
+```
+Here are the implementation tasks:
+
+---
+
+## 1. [Category or file]
+
+- [ ] 1.1 [Specific task]
+- [ ] 1.2 [Specific task]
+
+## 2. Verify
+
+- [ ] 2.1 [Verification step]
+
+---
+
+Each checkbox becomes a unit of work in the apply phase. Ready to implement?
+```
+
+**PAUSE** - Wait for user to confirm they're ready to implement.
+
+Save to `openspec/changes/<name>/tasks.md`.
+
+---
+
+## Phase 9: Apply (Implementation)
+
+**EXPLAIN:**
+```
+## Implementation
+
+Now we implement each task, checking them off as we go. I'll announce each one and occasionally note how the specs/design informed the approach.
+```
+
+**DO:** For each task:
+
+1. Announce: "Working on task N: [description]"
+2. Implement the change in the codebase
+3. Reference specs/design naturally: "The spec says X, so I'm doing Y"
+4. Mark complete in tasks.md: `- [ ]` → `- [x]`
+5. Brief status: "✓ Task N complete"
+
+Keep narration light—don't over-explain every line of code.
+
+After all tasks:
+
+```
+## Implementation Complete
+
+All tasks done:
+- [x] Task 1
+- [x] Task 2
+- [x] ...
+
+The change is implemented! One more step—let's archive it.
+```
+
+---
+
+## Phase 10: Archive
+
+**EXPLAIN:**
+```
+## Archiving
+
+When a change is complete, we archive it. This moves it from `openspec/changes/` to `openspec/changes/archive/YYYY-MM-DD-<name>/`.
+
+Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
+```
+
+**DO:**
+```bash
+openspec archive "<name>"
+```
+
+**SHOW:**
+```
+Archived to: `openspec/changes/archive/YYYY-MM-DD-<name>/`
+
+The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
+```
+
+---
+
+## Phase 11: Recap & Next Steps
+
+```
+## Congratulations!
+
+You just completed a full OpenSpec cycle:
+
+1. **Explore** - Thought through the problem
+2. **New** - Created a change container
+3. **Proposal** - Captured WHY
+4. **Specs** - Defined WHAT in detail
+5. **Design** - Decided HOW
+6. **Tasks** - Broke it into steps
+7. **Apply** - Implemented the work
+8. **Archive** - Preserved the record
+
+This same rhythm works for any size change—a small fix or a major feature.
+
+---
+
+## Command Reference
+
+**Core workflow:**
+
+ | Command           | What it does                               |
+ |-------------------|--------------------------------------------|
+ | `/opsx:propose` | Create a change and generate all artifacts |
+ | `/opsx:explore` | Think through problems before/during work  |
+ | `/opsx:apply`   | Implement tasks from a change              |
+ | `/opsx:archive` | Archive a completed change                 |
+
+**Additional commands:**
+
+ | Command            | What it does                                             |
+ |--------------------|----------------------------------------------------------|
+ | `/opsx:new`      | Start a new change, step through artifacts one at a time |
+ | `/opsx:continue` | Continue working on an existing change                   |
+ | `/opsx:ff`       | Fast-forward: create all artifacts at once               |
+ | `/opsx:verify`   | Verify implementation matches artifacts                  |
+
+---
+
+## What's Next?
+
+Try `/opsx:propose` on something you actually want to build. You've got the rhythm now!
+```
+
+---
+
+## Graceful Exit Handling
+
+### User wants to stop mid-way
+
+If the user says they need to stop, want to pause, or seem disengaged:
+
+```
+No problem! Your change is saved at `openspec/changes/<name>/`.
+
+To pick up where we left off later:
+- `/opsx:continue <name>` - Resume artifact creation
+- `/opsx:apply <name>` - Jump to implementation (if tasks exist)
+
+The work won't be lost. Come back whenever you're ready.
+```
+
+Exit gracefully without pressure.
+
+### User just wants command reference
+
+If the user says they just want to see the commands or skip the tutorial:
+
+```
+## OpenSpec Quick Reference
+
+**Core workflow:**
+
+ | Command                  | What it does                               |
+ |--------------------------|--------------------------------------------|
+ | `/opsx:propose <name>` | Create a change and generate all artifacts |
+ | `/opsx:explore`        | Think through problems (no code changes)   |
+ | `/opsx:apply <name>`   | Implement tasks                            |
+ | `/opsx:archive <name>` | Archive when done                          |
+
+**Additional commands:**
+
+ | Command                   | What it does                        |
+ |---------------------------|-------------------------------------|
+ | `/opsx:new <name>`      | Start a new change, step by step    |
+ | `/opsx:continue <name>` | Continue an existing change         |
+ | `/opsx:ff <name>`       | Fast-forward: all artifacts at once |
+ | `/opsx:verify <name>`   | Verify implementation               |
+
+Try `/opsx:propose` to start your first change.
+```
+
+Exit gracefully.
+
+---
+
+## Guardrails
+
+- **Follow the EXPLAIN → DO → SHOW → PAUSE pattern** at key transitions (after explore, after proposal draft, after tasks, after archive)
+- **Keep narration light** during implementation—teach without lecturing
+- **Don't skip phases** even if the change is small—the goal is teaching the workflow
+- **Pause for acknowledgment** at marked points, but don't over-pause
+- **Handle exits gracefully**—never pressure the user to continue
+- **Use real codebase tasks**—don't simulate or use fake examples
+- **Adjust scope gently**—guide toward smaller tasks but respect user choice
diff --git a/.github/prompts/opsx-propose.prompt.md b/.github/prompts/opsx-propose.prompt.md
new file mode 100755
index 00000000..cf30b2a5
--- /dev/null
+++ b/.github/prompts/opsx-propose.prompt.md
@@ -0,0 +1,103 @@
+---
+description: Propose a new change - create it and generate all artifacts in one step
+---
+
+Propose a new change - create the change and generate all artifacts in one step.
+
+I'll create a change with artifacts:
+- proposal.md (what & why)
+- design.md (how)
+- tasks.md (implementation steps)
+
+When ready to implement, run /opsx:apply
+
+---
+
+**Input**: The argument after `/opsx:propose` is the change name (kebab-case), OR a description of what the user wants to build.
+
+**Steps**
+
+1. **If no input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change at `openspec/changes/<name>/` with `.openspec.yaml`.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `outputPath`: Where to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx:apply` to start implementing."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, ask if user wants to continue it or create a new one
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.github/prompts/opsx-sync.prompt.md b/.github/prompts/opsx-sync.prompt.md
new file mode 100755
index 00000000..56b5b33c
--- /dev/null
+++ b/.github/prompts/opsx-sync.prompt.md
@@ -0,0 +1,131 @@
+---
+description: Sync delta specs from a change to main specs
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Input**: Optionally specify a change name after `/opsx:sync` (e.g., `/opsx:sync add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Find delta specs**
+
+   Look for delta spec files in `openspec/changes/<name>/specs/*/spec.md`.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+3. **For each delta spec, apply changes to main specs**
+
+   For each capability with a delta spec at `openspec/changes/<name>/specs/<capability>/spec.md`:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+4. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.github/prompts/opsx-verify.prompt.md b/.github/prompts/opsx-verify.prompt.md
new file mode 100755
index 00000000..28944894
--- /dev/null
+++ b/.github/prompts/opsx-verify.prompt.md
@@ -0,0 +1,161 @@
+---
+description: Verify implementation matches change artifacts before archiving
+---
+
+Verify that an implementation matches the change artifacts (specs, tasks, design).
+
+**Input**: Optionally specify a change name after `/opsx:verify` (e.g., `/opsx:verify add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have implementation tasks (tasks artifact exists).
+   Include the schema used for each change if available.
+   Mark changes with incomplete tasks as "(In Progress)".
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - Which artifacts exist for this change
+
+3. **Get the change directory and load artifacts**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns the change directory and `contextFiles` (artifact ID -> array of concrete file paths). Read all available artifacts from `contextFiles`.
+
+4. **Initialize verification report structure**
+
+   Create a report structure with three dimensions:
+   - **Completeness**: Track tasks and spec coverage
+   - **Correctness**: Track requirement implementation and scenario coverage
+   - **Coherence**: Track design adherence and pattern consistency
+
+   Each dimension can have CRITICAL, WARNING, or SUGGESTION issues.
+
+5. **Verify Completeness**
+
+   **Task Completion**:
+   - If `contextFiles.tasks` exists, read every file path in it
+   - Parse checkboxes: `- [ ]` (incomplete) vs `- [x]` (complete)
+   - Count complete vs total tasks
+   - If incomplete tasks exist:
+     - Add CRITICAL issue for each incomplete task
+     - Recommendation: "Complete task: <description>" or "Mark as done if already implemented"
+
+   **Spec Coverage**:
+   - If delta specs exist in `openspec/changes/<name>/specs/`:
+     - Extract all requirements (marked with "### Requirement:")
+     - For each requirement:
+       - Search codebase for keywords related to the requirement
+       - Assess if implementation likely exists
+     - If requirements appear unimplemented:
+       - Add CRITICAL issue: "Requirement not found: <requirement name>"
+       - Recommendation: "Implement requirement X: <description>"
+
+6. **Verify Correctness**
+
+   **Requirement Implementation Mapping**:
+   - For each requirement from delta specs:
+     - Search codebase for implementation evidence
+     - If found, note file paths and line ranges
+     - Assess if implementation matches requirement intent
+     - If divergence detected:
+       - Add WARNING: "Implementation may diverge from spec: <details>"
+       - Recommendation: "Review <file>:<lines> against requirement X"
+
+   **Scenario Coverage**:
+   - For each scenario in delta specs (marked with "#### Scenario:"):
+     - Check if conditions are handled in code
+     - Check if tests exist covering the scenario
+     - If scenario appears uncovered:
+       - Add WARNING: "Scenario not covered: <scenario name>"
+       - Recommendation: "Add test or implementation for scenario: <description>"
+
+7. **Verify Coherence**
+
+   **Design Adherence**:
+   - If `contextFiles.design` exists:
+     - Extract key decisions (look for sections like "Decision:", "Approach:", "Architecture:")
+     - Verify implementation follows those decisions
+     - If contradiction detected:
+       - Add WARNING: "Design decision not followed: <decision>"
+       - Recommendation: "Update implementation or revise design.md to match reality"
+   - If no design.md: Skip design adherence check, note "No design.md to verify against"
+
+   **Code Pattern Consistency**:
+   - Review new code for consistency with project patterns
+   - Check file naming, directory structure, coding style
+   - If significant deviations found:
+     - Add SUGGESTION: "Code pattern deviation: <details>"
+     - Recommendation: "Consider following project pattern: <example>"
+
+8. **Generate Verification Report**
+
+   **Summary Scorecard**:
+   ```
+   ## Verification Report: <change-name>
+
+   ### Summary
+   | Dimension    | Status           |
+   |--------------|------------------|
+   | Completeness | X/Y tasks, N reqs|
+   | Correctness  | M/N reqs covered |
+   | Coherence    | Followed/Issues  |
+   ```
+
+   **Issues by Priority**:
+
+   1. **CRITICAL** (Must fix before archive):
+      - Incomplete tasks
+      - Missing requirement implementations
+      - Each with specific, actionable recommendation
+
+   2. **WARNING** (Should fix):
+      - Spec/design divergences
+      - Missing scenario coverage
+      - Each with specific recommendation
+
+   3. **SUGGESTION** (Nice to fix):
+      - Pattern inconsistencies
+      - Minor improvements
+      - Each with specific recommendation
+
+   **Final Assessment**:
+   - If CRITICAL issues: "X critical issue(s) found. Fix before archiving."
+   - If only warnings: "No critical issues. Y warning(s) to consider. Ready for archive (with noted improvements)."
+   - If all clear: "All checks passed. Ready for archive."
+
+**Verification Heuristics**
+
+- **Completeness**: Focus on objective checklist items (checkboxes, requirements list)
+- **Correctness**: Use keyword search, file path analysis, reasonable inference - don't require perfect certainty
+- **Coherence**: Look for glaring inconsistencies, don't nitpick style
+- **False Positives**: When uncertain, prefer SUGGESTION over WARNING, WARNING over CRITICAL
+- **Actionability**: Every issue must have a specific recommendation with file/line references where applicable
+
+**Graceful Degradation**
+
+- If only tasks.md exists: verify task completion only, skip spec/design checks
+- If tasks + specs exist: verify completeness and correctness, skip design
+- If full artifacts: verify all three dimensions
+- Always note which checks were skipped and why
+
+**Output Format**
+
+Use clear markdown with:
+- Table for summary scorecard
+- Grouped lists for issues (CRITICAL/WARNING/SUGGESTION)
+- Code references in format: `file.ts:123`
+- Specific, actionable recommendations
+- No vague suggestions like "consider reviewing"
diff --git a/.github/skills/openspec-apply-change/SKILL.md b/.github/skills/openspec-apply-change/SKILL.md
new file mode 100755
index 00000000..70fbdb85
--- /dev/null
+++ b/.github/skills/openspec-apply-change/SKILL.md
@@ -0,0 +1,156 @@
+---
+name: openspec-apply-change
+description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.3.1"
+---
+
+Implement tasks from an OpenSpec change.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! Ready to archive this change.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.github/skills/openspec-archive-change/SKILL.md b/.github/skills/openspec-archive-change/SKILL.md
new file mode 100755
index 00000000..12e2f70e
--- /dev/null
+++ b/.github/skills/openspec-archive-change/SKILL.md
@@ -0,0 +1,114 @@
+---
+name: openspec-archive-change
+description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.3.1"
+---
+
+Archive a completed change in the experimental workflow.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Check for delta specs at `openspec/changes/<name>/specs/`. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create the archive directory if it doesn't exist:
+   ```bash
+   mkdir -p openspec/changes/archive
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move the change directory to archive
+
+   ```bash
+   mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Whether specs were synced (if applicable)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
+
+All artifacts complete. All tasks complete.
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use openspec-sync-specs approach (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.github/skills/openspec-bulk-archive-change/SKILL.md b/.github/skills/openspec-bulk-archive-change/SKILL.md
new file mode 100755
index 00000000..5be81af2
--- /dev/null
+++ b/.github/skills/openspec-bulk-archive-change/SKILL.md
@@ -0,0 +1,246 @@
+---
+name: openspec-bulk-archive-change
+description: Archive multiple completed changes at once. Use when archiving several parallel changes.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.3.1"
+---
+
+Archive multiple completed changes in a single operation.
+
+This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
+
+**Input**: None required (prompts for selection)
+
+**Steps**
+
+1. **Get active changes**
+
+   Run `openspec list --json` to get all active changes.
+
+   If no active changes exist, inform user and stop.
+
+2. **Prompt for change selection**
+
+   Use **AskUserQuestion tool** with multi-select to let user choose changes:
+   - Show each change with its schema
+   - Include an option for "All changes"
+   - Allow any number of selections (1+ works, 2+ is the typical use case)
+
+   **IMPORTANT**: Do NOT auto-select. Always let the user choose.
+
+3. **Batch validation - gather status for all selected changes**
+
+   For each selected change, collect:
+
+   a. **Artifact status** - Run `openspec status --change "<name>" --json`
+      - Parse `schemaName` and `artifacts` list
+      - Note which artifacts are `done` vs other states
+
+   b. **Task completion** - Read `openspec/changes/<name>/tasks.md`
+      - Count `- [ ]` (incomplete) vs `- [x]` (complete)
+      - If no tasks file exists, note as "No tasks"
+
+   c. **Delta specs** - Check `openspec/changes/<name>/specs/` directory
+      - List which capability specs exist
+      - For each, extract requirement names (lines matching `### Requirement: <name>`)
+
+4. **Detect spec conflicts**
+
+   Build a map of `capability -> [changes that touch it]`:
+
+   ```
+   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   api  -> [change-c]            <- OK (only 1 change)
+   ```
+
+   A conflict exists when 2+ selected changes have delta specs for the same capability.
+
+5. **Resolve conflicts agentically**
+
+   **For each conflict**, investigate the codebase:
+
+   a. **Read the delta specs** from each conflicting change to understand what each claims to add/modify
+
+   b. **Search the codebase** for implementation evidence:
+      - Look for code implementing requirements from each delta spec
+      - Check for related files, functions, or tests
+
+   c. **Determine resolution**:
+      - If only one change is actually implemented -> sync that one's specs
+      - If both implemented -> apply in chronological order (older first, newer overwrites)
+      - If neither implemented -> skip spec sync, warn user
+
+   d. **Record resolution** for each conflict:
+      - Which change's specs to apply
+      - In what order (if both)
+      - Rationale (what was found in codebase)
+
+6. **Show consolidated status table**
+
+   Display a table summarizing all changes:
+
+   ```
+   | Change              | Artifacts | Tasks | Specs   | Conflicts | Status |
+   |---------------------|-----------|-------|---------|-----------|--------|
+   | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
+   | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
+   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
+   | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
+   ```
+
+   For conflicts, show the resolution:
+   ```
+   * Conflict resolution:
+     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+   ```
+
+   For incomplete changes, show warnings:
+   ```
+   Warnings:
+   - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
+   ```
+
+7. **Confirm batch operation**
+
+   Use **AskUserQuestion tool** with a single confirmation:
+
+   - "Archive N changes?" with options based on status
+   - Options might include:
+     - "Archive all N changes"
+     - "Archive only N ready changes (skip incomplete)"
+     - "Cancel"
+
+   If there are incomplete changes, make clear they'll be archived with warnings.
+
+8. **Execute archive for each confirmed change**
+
+   Process changes in the determined order (respecting conflict resolution):
+
+   a. **Sync specs** if delta specs exist:
+      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
+      - For conflicts, apply in resolved order
+      - Track if sync was done
+
+   b. **Perform the archive**:
+      ```bash
+      mkdir -p openspec/changes/archive
+      mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
+      ```
+
+   c. **Track outcome** for each change:
+      - Success: archived successfully
+      - Failed: error during archive (record error)
+      - Skipped: user chose not to archive (if applicable)
+
+9. **Display summary**
+
+   Show final results:
+
+   ```
+   ## Bulk Archive Complete
+
+   Archived 3 changes:
+   - schema-management-cli -> archive/2026-01-19-schema-management-cli/
+   - project-config -> archive/2026-01-19-project-config/
+   - add-oauth -> archive/2026-01-19-add-oauth/
+
+   Skipped 1 change:
+   - add-verify-skill (user chose not to archive incomplete)
+
+   Spec sync summary:
+   - 4 delta specs synced to main specs
+   - 1 conflict resolved (auth: applied both in chronological order)
+   ```
+
+   If any failures:
+   ```
+   Failed 1 change:
+   - some-change: Archive directory already exists
+   ```
+
+**Conflict Resolution Examples**
+
+Example 1: Only one implemented
+```
+Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
+
+Checking add-oauth:
+- Delta adds "OAuth Provider Integration" requirement
+- Searching codebase... found src/auth/oauth.ts implementing OAuth flow
+
+Checking add-jwt:
+- Delta adds "JWT Token Handling" requirement
+- Searching codebase... no JWT implementation found
+
+Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
+```
+
+Example 2: Both implemented
+```
+Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
+
+Checking add-rest-api (created 2026-01-10):
+- Delta adds "REST Endpoints" requirement
+- Searching codebase... found src/api/rest.ts
+
+Checking add-graphql (created 2026-01-15):
+- Delta adds "GraphQL Schema" requirement
+- Searching codebase... found src/api/graphql.ts
+
+Resolution: Both implemented. Will apply add-rest-api specs first,
+then add-graphql specs (chronological order, newer takes precedence).
+```
+
+**Output On Success**
+
+```
+## Bulk Archive Complete
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+- <change-2> -> archive/YYYY-MM-DD-<change-2>/
+
+Spec sync summary:
+- N delta specs synced to main specs
+- No conflicts (or: M conflicts resolved)
+```
+
+**Output On Partial Success**
+
+```
+## Bulk Archive Complete (partial)
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+
+Skipped M changes:
+- <change-2> (user chose not to archive incomplete)
+
+Failed K changes:
+- <change-3>: Archive directory already exists
+```
+
+**Output When No Changes**
+
+```
+## No Changes to Archive
+
+No active changes found. Create a new change to get started.
+```
+
+**Guardrails**
+- Allow any number of changes (1+ is fine, 2+ is the typical use case)
+- Always prompt for selection, never auto-select
+- Detect spec conflicts early and resolve by checking codebase
+- When both changes are implemented, apply specs in chronological order
+- Skip spec sync only when implementation is missing (warn user)
+- Show clear per-change status before confirming
+- Use single confirmation for entire batch
+- Track and report all outcomes (success/skip/fail)
+- Preserve .openspec.yaml when moving to archive
+- Archive directory target uses current date: YYYY-MM-DD-<name>
+- If archive target exists, fail that change but continue with others
diff --git a/.github/skills/openspec-continue-change/SKILL.md b/.github/skills/openspec-continue-change/SKILL.md
new file mode 100755
index 00000000..4f2c3dcf
--- /dev/null
+++ b/.github/skills/openspec-continue-change/SKILL.md
@@ -0,0 +1,118 @@
+---
+name: openspec-continue-change
+description: Continue working on an OpenSpec change by creating the next artifact. Use when the user wants to progress their change, create the next artifact, or continue their workflow.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.3.1"
+---
+
+Continue working on a change by creating the next artifact.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+
+   Present the top 3-4 most recently modified changes as options, showing:
+   - Change name
+   - Schema (from `schema` field if present, otherwise "spec-driven")
+   - Status (e.g., "0/5 tasks", "complete", "no tasks")
+   - How recently it was modified (from `lastModified` field)
+
+   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check current status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand current state. The response includes:
+   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
+   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
+   - `isComplete`: Boolean indicating if all artifacts are complete
+
+3. **Act based on status**:
+
+   ---
+
+   **If all artifacts are complete (`isComplete: true`)**:
+   - Congratulate the user
+   - Show final status including the schema used
+   - Suggest: "All artifacts created! You can now implement this change or archive it."
+   - STOP
+
+   ---
+
+   **If artifacts are ready to create** (status shows artifacts with `status: "ready"`):
+   - Pick the FIRST artifact with `status: "ready"` from the status output
+   - Get its instructions:
+     ```bash
+     openspec instructions <artifact-id> --change "<name>" --json
+     ```
+   - Parse the JSON. The key fields are:
+     - `context`: Project background (constraints for you - do NOT include in output)
+     - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+     - `template`: The structure to use for your output file
+     - `instruction`: Schema-specific guidance
+     - `outputPath`: Where to write the artifact
+     - `dependencies`: Completed artifacts to read for context
+   - **Create the artifact file**:
+     - Read any completed dependency files for context
+     - Use `template` as the structure - fill in its sections
+     - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
+     - Write to the output path specified in instructions
+   - Show what was created and what's now unlocked
+   - STOP after creating ONE artifact
+
+   ---
+
+   **If no artifacts are ready (all blocked)**:
+   - This shouldn't happen with a valid schema
+   - Show status and suggest checking for issues
+
+4. **After creating an artifact, show progress**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After each invocation, show:
+- Which artifact was created
+- Schema workflow being used
+- Current progress (N/M complete)
+- What artifacts are now unlocked
+- Prompt: "Want to continue? Just ask me to continue or tell me what to do next."
+
+**Artifact Creation Guidelines**
+
+The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+
+Common artifact patterns:
+
+**spec-driven schema** (proposal → specs → design → tasks):
+- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
+  - The Capabilities section is critical - each capability listed will need a spec file.
+- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
+- **design.md**: Document technical decisions, architecture, and implementation approach.
+- **tasks.md**: Break down implementation into checkboxed tasks.
+
+For other schemas, follow the `instruction` field from the CLI output.
+
+**Guardrails**
+- Create ONE artifact per invocation
+- Always read dependency artifacts before creating a new one
+- Never skip artifacts or create out of order
+- If context is unclear, ask the user before creating
+- Verify the artifact file exists after writing before marking progress
+- Use the schema's artifact sequence, don't assume specific artifact names
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
diff --git a/.github/skills/openspec-explore/SKILL.md b/.github/skills/openspec-explore/SKILL.md
new file mode 100755
index 00000000..6858d3f6
--- /dev/null
+++ b/.github/skills/openspec-explore/SKILL.md
@@ -0,0 +1,288 @@
+---
+name: openspec-explore
+description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.3.1"
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│      ┌────────┐         ┌────────┐      │
+│      │ State  │────────▶│ State  │      │
+│      │   A    │         │   B    │      │
+│      └────────┘         └────────┘      │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Read existing artifacts for context**
+   - `openspec/changes/<name>/proposal.md`
+   - `openspec/changes/<name>/design.md`
+   - `openspec/changes/<name>/tasks.md`
+   - etc.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+    | Insight Type               | Where to Capture               |
+    |----------------------------|--------------------------------|
+    | New requirement discovered | `specs/<capability>/spec.md` |
+    | Requirement changed        | `specs/<capability>/spec.md` |
+    | Design decision made       | `design.md`                  |
+    | Scope changed              | `proposal.md`                |
+    | New work identified        | `tasks.md`                   |
+    | Assumption invalidated     | Relevant artifact              |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Handling Different Entry Points
+
+**User brings a vague idea:**
+```
+User: I'm thinking about adding real-time collaboration
+
+You: Real-time collab is a big space. Let me think about this...
+
+      COLLABORATION SPECTRUM
+      ════════════════════════════════════════════
+
+      Awareness          Coordination         Sync
+          │                   │                 │
+          ▼                   ▼                 ▼
+      ┌────────┐         ┌────────┐        ┌────────┐
+      │Presence│         │Cursors │        │  CRDT  │
+      │  "3    │         │ Multi  │        │Conflict│
+      │online" │         │ select │        │  free  │
+      └────────┘         └────────┘        └────────┘
+          │                   │                 │
+       trivial            moderate           complex
+
+      Where's your head at?
+```
+
+**User brings a specific problem:**
+```
+User: The auth system is a mess
+
+You: [reads codebase]
+
+     ┌─────────────────────────────────────────────┐
+     │              CURRENT AUTH FLOW              │
+     └─────────────────────────────────────────────┘
+                        │
+          ┌─────────────┼─────────────┐
+          ▼             ▼             ▼
+     ┌─────────┐  ┌─────────┐  ┌─────────┐
+     │ Google  │  │  GitHub │  │  Email  │
+     │  OAuth  │  │  OAuth  │  │  Magic  │
+     └────┬────┘  └────┬────┘  └────┬────┘
+          │             │             │
+          └─────────────┼─────────────┘
+                        ▼
+                  ┌───────────┐
+                  │  Session  │
+                  └─────┬─────┘
+                        │
+                        ▼
+                  ┌───────────┐
+                  │   Perms   │
+                  └───────────┘
+
+     I see three tangles. Which one's burning?
+```
+
+**User is stuck mid-implementation:**
+```
+User: /opsx:explore add-auth-system
+      The OAuth integration is more complex than expected
+
+You: [reads change artifacts]
+
+     You're on task 4: "Implement OAuth flow"
+
+     Let me trace what's involved...
+
+     [draws diagram, explores options, suggests paths]
+
+     Want to update the design to reflect this?
+     Or add a spike task to investigate?
+```
+
+**User wants to compare options:**
+```
+User: Should we use Postgres or SQLite?
+
+You: Generic answer is boring. What's the context?
+
+User: A CLI tool that tracks local dev environments
+
+You: That changes everything.
+
+     ┌─────────────────────────────────────────────────┐
+     │          CLI TOOL DATA STORAGE                  │
+     └─────────────────────────────────────────────────┘
+
+     Key constraints:
+     • No daemon running
+     • Must work offline
+     • Single user
+
+                  SQLite          Postgres
+     Deployment   embedded ✓      needs server ✗
+     Offline      yes ✓           no ✗
+     Single file  yes ✓           no ✗
+
+     SQLite. Not even close.
+
+     Unless... is there a sync component?
+```
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When it feels like things are crystallizing, you might summarize:
+
+```
+## What We Figured Out
+
+**The problem**: [crystallized understanding]
+
+**The approach**: [if one emerged]
+
+**Open questions**: [if any remain]
+
+**Next steps** (if ready):
+- Create a change proposal
+- Keep exploring: just keep talking
+```
+
+But this summary is optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.github/skills/openspec-ff-change/SKILL.md b/.github/skills/openspec-ff-change/SKILL.md
new file mode 100755
index 00000000..43f2632e
--- /dev/null
+++ b/.github/skills/openspec-ff-change/SKILL.md
@@ -0,0 +1,101 @@
+---
+name: openspec-ff-change
+description: Fast-forward through OpenSpec artifact creation. Use when the user wants to quickly create all artifacts needed for implementation without stepping through each one individually.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.3.1"
+---
+
+Fast-forward through artifact creation - generate everything needed to start implementation in one go.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change at `openspec/changes/<name>/`.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `outputPath`: Where to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "✓ Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx:apply` or ask me to implement to start working on the tasks."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, suggest continuing that change instead
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.github/skills/openspec-new-change/SKILL.md b/.github/skills/openspec-new-change/SKILL.md
new file mode 100755
index 00000000..1af41c7d
--- /dev/null
+++ b/.github/skills/openspec-new-change/SKILL.md
@@ -0,0 +1,74 @@
+---
+name: openspec-new-change
+description: Start a new OpenSpec change using the experimental artifact workflow. Use when the user wants to create a new feature, fix, or modification with a structured step-by-step approach.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.3.1"
+---
+
+Start a new change using the experimental artifact-driven approach.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Determine the workflow schema**
+
+   Use the default schema (omit `--schema`) unless the user explicitly requests a different workflow.
+
+   **Use a different schema only if the user mentions:**
+   - A specific schema name → use `--schema <name>`
+   - "show workflows" or "what workflows" → run `openspec schemas --json` and let them choose
+
+   **Otherwise**: Omit `--schema` to use the default.
+
+3. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   Add `--schema <name>` only if the user requested a specific workflow.
+   This creates a scaffolded change at `openspec/changes/<name>/` with the selected schema.
+
+4. **Show the artifact status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+   This shows which artifacts need to be created and which are ready (dependencies satisfied).
+
+5. **Get instructions for the first artifact**
+   The first artifact depends on the schema (e.g., `proposal` for spec-driven).
+   Check the status output to find the first artifact with status "ready".
+   ```bash
+   openspec instructions <first-artifact-id> --change "<name>"
+   ```
+   This outputs the template and context for creating the first artifact.
+
+6. **STOP and wait for user direction**
+
+**Output**
+
+After completing the steps, summarize:
+- Change name and location
+- Schema/workflow being used and its artifact sequence
+- Current status (0/N artifacts complete)
+- The template for the first artifact
+- Prompt: "Ready to create the first artifact? Just describe what this change is about and I'll draft it, or ask me to continue."
+
+**Guardrails**
+- Do NOT create any artifacts yet - just show the instructions
+- Do NOT advance beyond showing the first artifact template
+- If the name is invalid (not kebab-case), ask for a valid name
+- If a change with that name already exists, suggest continuing that change instead
+- Pass --schema if using a non-default workflow
diff --git a/.github/skills/openspec-onboard/SKILL.md b/.github/skills/openspec-onboard/SKILL.md
new file mode 100755
index 00000000..b6c734de
--- /dev/null
+++ b/.github/skills/openspec-onboard/SKILL.md
@@ -0,0 +1,554 @@
+---
+name: openspec-onboard
+description: Guided onboarding for OpenSpec - walk through a complete workflow cycle with narration and real codebase work.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.3.1"
+---
+
+Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
+
+---
+
+## Preflight
+
+Before starting, check if the OpenSpec CLI is installed:
+
+```bash
+# Unix/macOS
+openspec --version 2>&1 || echo "CLI_NOT_INSTALLED"
+# Windows (PowerShell)
+# if (Get-Command openspec -ErrorAction SilentlyContinue) { openspec --version } else { echo "CLI_NOT_INSTALLED" }
+```
+
+**If CLI not installed:**
+> OpenSpec CLI is not installed. Install it first, then come back to `/opsx:onboard`.
+
+Stop here if not installed.
+
+---
+
+## Phase 1: Welcome
+
+Display:
+
+```
+## Welcome to OpenSpec!
+
+I'll walk you through a complete change cycle—from idea to implementation—using a real task in your codebase. Along the way, you'll learn the workflow by doing it.
+
+**What we'll do:**
+1. Pick a small, real task in your codebase
+2. Explore the problem briefly
+3. Create a change (the container for our work)
+4. Build the artifacts: proposal → specs → design → tasks
+5. Implement the tasks
+6. Archive the completed change
+
+**Time:** ~15-20 minutes
+
+Let's start by finding something to work on.
+```
+
+---
+
+## Phase 2: Task Selection
+
+### Codebase Analysis
+
+Scan the codebase for small improvement opportunities. Look for:
+
+1. **TODO/FIXME comments** - Search for `TODO`, `FIXME`, `HACK`, `XXX` in code files
+2. **Missing error handling** - `catch` blocks that swallow errors, risky operations without try-catch
+3. **Functions without tests** - Cross-reference `src/` with test directories
+4. **Type issues** - `any` types in TypeScript files (`: any`, `as any`)
+5. **Debug artifacts** - `console.log`, `console.debug`, `debugger` statements in non-debug code
+6. **Missing validation** - User input handlers without validation
+
+Also check recent git activity:
+```bash
+# Unix/macOS
+git log --oneline -10 2>/dev/null || echo "No git history"
+# Windows (PowerShell)
+# git log --oneline -10 2>$null; if ($LASTEXITCODE -ne 0) { echo "No git history" }
+```
+
+### Present Suggestions
+
+From your analysis, present 3-4 specific suggestions:
+
+```
+## Task Suggestions
+
+Based on scanning your codebase, here are some good starter tasks:
+
+**1. [Most promising task]**
+   Location: `src/path/to/file.ts:42`
+   Scope: ~1-2 files, ~20-30 lines
+   Why it's good: [brief reason]
+
+**2. [Second task]**
+   Location: `src/another/file.ts`
+   Scope: ~1 file, ~15 lines
+   Why it's good: [brief reason]
+
+**3. [Third task]**
+   Location: [location]
+   Scope: [estimate]
+   Why it's good: [brief reason]
+
+**4. Something else?**
+   Tell me what you'd like to work on.
+
+Which task interests you? (Pick a number or describe your own)
+```
+
+**If nothing found:** Fall back to asking what the user wants to build:
+> I didn't find obvious quick wins in your codebase. What's something small you've been meaning to add or fix?
+
+### Scope Guardrail
+
+If the user picks or describes something too large (major feature, multi-day work):
+
+```
+That's a valuable task, but it's probably larger than ideal for your first OpenSpec run-through.
+
+For learning the workflow, smaller is better—it lets you see the full cycle without getting stuck in implementation details.
+
+**Options:**
+1. **Slice it smaller** - What's the smallest useful piece of [their task]? Maybe just [specific slice]?
+2. **Pick something else** - One of the other suggestions, or a different small task?
+3. **Do it anyway** - If you really want to tackle this, we can. Just know it'll take longer.
+
+What would you prefer?
+```
+
+Let the user override if they insist—this is a soft guardrail.
+
+---
+
+## Phase 3: Explore Demo
+
+Once a task is selected, briefly demonstrate explore mode:
+
+```
+Before we create a change, let me quickly show you **explore mode**—it's how you think through problems before committing to a direction.
+```
+
+Spend 1-2 minutes investigating the relevant code:
+- Read the file(s) involved
+- Draw a quick ASCII diagram if it helps
+- Note any considerations
+
+```
+## Quick Exploration
+
+[Your brief analysis—what you found, any considerations]
+
+┌─────────────────────────────────────────┐
+│   [Optional: ASCII diagram if helpful]  │
+└─────────────────────────────────────────┘
+
+Explore mode (`/opsx:explore`) is for this kind of thinking—investigating before implementing. You can use it anytime you need to think through a problem.
+
+Now let's create a change to hold our work.
+```
+
+**PAUSE** - Wait for user acknowledgment before proceeding.
+
+---
+
+## Phase 4: Create the Change
+
+**EXPLAIN:**
+```
+## Creating a Change
+
+A "change" in OpenSpec is a container for all the thinking and planning around a piece of work. It lives in `openspec/changes/<name>/` and holds your artifacts—proposal, specs, design, tasks.
+
+Let me create one for our task.
+```
+
+**DO:** Create the change with a derived kebab-case name:
+```bash
+openspec new change "<derived-name>"
+```
+
+**SHOW:**
+```
+Created: `openspec/changes/<name>/`
+
+The folder structure:
+```
+openspec/changes/<name>/
+├── proposal.md    ← Why we're doing this (empty, we'll fill it)
+├── design.md      ← How we'll build it (empty)
+├── specs/         ← Detailed requirements (empty)
+└── tasks.md       ← Implementation checklist (empty)
+```
+
+Now let's fill in the first artifact—the proposal.
+```
+
+---
+
+## Phase 5: Proposal
+
+**EXPLAIN:**
+```
+## The Proposal
+
+The proposal captures **why** we're making this change and **what** it involves at a high level. It's the "elevator pitch" for the work.
+
+I'll draft one based on our task.
+```
+
+**DO:** Draft the proposal content (don't save yet):
+
+```
+Here's a draft proposal:
+
+---
+
+## Why
+
+[1-2 sentences explaining the problem/opportunity]
+
+## What Changes
+
+[Bullet points of what will be different]
+
+## Capabilities
+
+### New Capabilities
+- `<capability-name>`: [brief description]
+
+### Modified Capabilities
+<!-- If modifying existing behavior -->
+
+## Impact
+
+- `src/path/to/file.ts`: [what changes]
+- [other files if applicable]
+
+---
+
+Does this capture the intent? I can adjust before we save it.
+```
+
+**PAUSE** - Wait for user approval/feedback.
+
+After approval, save the proposal:
+```bash
+openspec instructions proposal --change "<name>" --json
+```
+Then write the content to `openspec/changes/<name>/proposal.md`.
+
+```
+Proposal saved. This is your "why" document—you can always come back and refine it as understanding evolves.
+
+Next up: specs.
+```
+
+---
+
+## Phase 6: Specs
+
+**EXPLAIN:**
+```
+## Specs
+
+Specs define **what** we're building in precise, testable terms. They use a requirement/scenario format that makes expected behavior crystal clear.
+
+For a small task like this, we might only need one spec file.
+```
+
+**DO:** Create the spec file:
+```bash
+# Unix/macOS
+mkdir -p openspec/changes/<name>/specs/<capability-name>
+# Windows (PowerShell)
+# New-Item -ItemType Directory -Force -Path "openspec/changes/<name>/specs/<capability-name>"
+```
+
+Draft the spec content:
+
+```
+Here's the spec:
+
+---
+
+## ADDED Requirements
+
+### Requirement: <Name>
+
+<Description of what the system should do>
+
+#### Scenario: <Scenario name>
+
+- **WHEN** <trigger condition>
+- **THEN** <expected outcome>
+- **AND** <additional outcome if needed>
+
+---
+
+This format—WHEN/THEN/AND—makes requirements testable. You can literally read them as test cases.
+```
+
+Save to `openspec/changes/<name>/specs/<capability>/spec.md`.
+
+---
+
+## Phase 7: Design
+
+**EXPLAIN:**
+```
+## Design
+
+The design captures **how** we'll build it—technical decisions, tradeoffs, approach.
+
+For small changes, this might be brief. That's fine—not every change needs deep design discussion.
+```
+
+**DO:** Draft design.md:
+
+```
+Here's the design:
+
+---
+
+## Context
+
+[Brief context about the current state]
+
+## Goals / Non-Goals
+
+**Goals:**
+- [What we're trying to achieve]
+
+**Non-Goals:**
+- [What's explicitly out of scope]
+
+## Decisions
+
+### Decision 1: [Key decision]
+
+[Explanation of approach and rationale]
+
+---
+
+For a small task, this captures the key decisions without over-engineering.
+```
+
+Save to `openspec/changes/<name>/design.md`.
+
+---
+
+## Phase 8: Tasks
+
+**EXPLAIN:**
+```
+## Tasks
+
+Finally, we break the work into implementation tasks—checkboxes that drive the apply phase.
+
+These should be small, clear, and in logical order.
+```
+
+**DO:** Generate tasks based on specs and design:
+
+```
+Here are the implementation tasks:
+
+---
+
+## 1. [Category or file]
+
+- [ ] 1.1 [Specific task]
+- [ ] 1.2 [Specific task]
+
+## 2. Verify
+
+- [ ] 2.1 [Verification step]
+
+---
+
+Each checkbox becomes a unit of work in the apply phase. Ready to implement?
+```
+
+**PAUSE** - Wait for user to confirm they're ready to implement.
+
+Save to `openspec/changes/<name>/tasks.md`.
+
+---
+
+## Phase 9: Apply (Implementation)
+
+**EXPLAIN:**
+```
+## Implementation
+
+Now we implement each task, checking them off as we go. I'll announce each one and occasionally note how the specs/design informed the approach.
+```
+
+**DO:** For each task:
+
+1. Announce: "Working on task N: [description]"
+2. Implement the change in the codebase
+3. Reference specs/design naturally: "The spec says X, so I'm doing Y"
+4. Mark complete in tasks.md: `- [ ]` → `- [x]`
+5. Brief status: "✓ Task N complete"
+
+Keep narration light—don't over-explain every line of code.
+
+After all tasks:
+
+```
+## Implementation Complete
+
+All tasks done:
+- [x] Task 1
+- [x] Task 2
+- [x] ...
+
+The change is implemented! One more step—let's archive it.
+```
+
+---
+
+## Phase 10: Archive
+
+**EXPLAIN:**
+```
+## Archiving
+
+When a change is complete, we archive it. This moves it from `openspec/changes/` to `openspec/changes/archive/YYYY-MM-DD-<name>/`.
+
+Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
+```
+
+**DO:**
+```bash
+openspec archive "<name>"
+```
+
+**SHOW:**
+```
+Archived to: `openspec/changes/archive/YYYY-MM-DD-<name>/`
+
+The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
+```
+
+---
+
+## Phase 11: Recap & Next Steps
+
+```
+## Congratulations!
+
+You just completed a full OpenSpec cycle:
+
+1. **Explore** - Thought through the problem
+2. **New** - Created a change container
+3. **Proposal** - Captured WHY
+4. **Specs** - Defined WHAT in detail
+5. **Design** - Decided HOW
+6. **Tasks** - Broke it into steps
+7. **Apply** - Implemented the work
+8. **Archive** - Preserved the record
+
+This same rhythm works for any size change—a small fix or a major feature.
+
+---
+
+## Command Reference
+
+**Core workflow:**
+
+ | Command           | What it does                               |
+ |-------------------|--------------------------------------------|
+ | `/opsx:propose` | Create a change and generate all artifacts |
+ | `/opsx:explore` | Think through problems before/during work  |
+ | `/opsx:apply`   | Implement tasks from a change              |
+ | `/opsx:archive` | Archive a completed change                 |
+
+**Additional commands:**
+
+ | Command            | What it does                                             |
+ |--------------------|----------------------------------------------------------|
+ | `/opsx:new`      | Start a new change, step through artifacts one at a time |
+ | `/opsx:continue` | Continue working on an existing change                   |
+ | `/opsx:ff`       | Fast-forward: create all artifacts at once               |
+ | `/opsx:verify`   | Verify implementation matches artifacts                  |
+
+---
+
+## What's Next?
+
+Try `/opsx:propose` on something you actually want to build. You've got the rhythm now!
+```
+
+---
+
+## Graceful Exit Handling
+
+### User wants to stop mid-way
+
+If the user says they need to stop, want to pause, or seem disengaged:
+
+```
+No problem! Your change is saved at `openspec/changes/<name>/`.
+
+To pick up where we left off later:
+- `/opsx:continue <name>` - Resume artifact creation
+- `/opsx:apply <name>` - Jump to implementation (if tasks exist)
+
+The work won't be lost. Come back whenever you're ready.
+```
+
+Exit gracefully without pressure.
+
+### User just wants command reference
+
+If the user says they just want to see the commands or skip the tutorial:
+
+```
+## OpenSpec Quick Reference
+
+**Core workflow:**
+
+ | Command                  | What it does                               |
+ |--------------------------|--------------------------------------------|
+ | `/opsx:propose <name>` | Create a change and generate all artifacts |
+ | `/opsx:explore`        | Think through problems (no code changes)   |
+ | `/opsx:apply <name>`   | Implement tasks                            |
+ | `/opsx:archive <name>` | Archive when done                          |
+
+**Additional commands:**
+
+ | Command                   | What it does                        |
+ |---------------------------|-------------------------------------|
+ | `/opsx:new <name>`      | Start a new change, step by step    |
+ | `/opsx:continue <name>` | Continue an existing change         |
+ | `/opsx:ff <name>`       | Fast-forward: all artifacts at once |
+ | `/opsx:verify <name>`   | Verify implementation               |
+
+Try `/opsx:propose` to start your first change.
+```
+
+Exit gracefully.
+
+---
+
+## Guardrails
+
+- **Follow the EXPLAIN → DO → SHOW → PAUSE pattern** at key transitions (after explore, after proposal draft, after tasks, after archive)
+- **Keep narration light** during implementation—teach without lecturing
+- **Don't skip phases** even if the change is small—the goal is teaching the workflow
+- **Pause for acknowledgment** at marked points, but don't over-pause
+- **Handle exits gracefully**—never pressure the user to continue
+- **Use real codebase tasks**—don't simulate or use fake examples
+- **Adjust scope gently**—guide toward smaller tasks but respect user choice
diff --git a/.github/skills/openspec-propose/SKILL.md b/.github/skills/openspec-propose/SKILL.md
new file mode 100755
index 00000000..4b7e2041
--- /dev/null
+++ b/.github/skills/openspec-propose/SKILL.md
@@ -0,0 +1,110 @@
+---
+name: openspec-propose
+description: Propose a new change with all artifacts generated in one step. Use when the user wants to quickly describe what they want to build and get a complete proposal with design, specs, and tasks ready for implementation.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.3.1"
+---
+
+Propose a new change - create the change and generate all artifacts in one step.
+
+I'll create a change with artifacts:
+- proposal.md (what & why)
+- design.md (how)
+- tasks.md (implementation steps)
+
+When ready to implement, run /opsx:apply
+
+---
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change at `openspec/changes/<name>/` with `.openspec.yaml`.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `outputPath`: Where to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx:apply` or ask me to implement to start working on the tasks."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, ask if user wants to continue it or create a new one
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.github/skills/openspec-sync-specs/SKILL.md b/.github/skills/openspec-sync-specs/SKILL.md
new file mode 100755
index 00000000..f2ed9ec7
--- /dev/null
+++ b/.github/skills/openspec-sync-specs/SKILL.md
@@ -0,0 +1,138 @@
+---
+name: openspec-sync-specs
+description: Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.3.1"
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Find delta specs**
+
+   Look for delta spec files in `openspec/changes/<name>/specs/*/spec.md`.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+3. **For each delta spec, apply changes to main specs**
+
+   For each capability with a delta spec at `openspec/changes/<name>/specs/<capability>/spec.md`:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+4. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.github/skills/openspec-verify-change/SKILL.md b/.github/skills/openspec-verify-change/SKILL.md
new file mode 100755
index 00000000..00d0532c
--- /dev/null
+++ b/.github/skills/openspec-verify-change/SKILL.md
@@ -0,0 +1,168 @@
+---
+name: openspec-verify-change
+description: Verify implementation matches change artifacts. Use when the user wants to validate that implementation is complete, correct, and coherent before archiving.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.3.1"
+---
+
+Verify that an implementation matches the change artifacts (specs, tasks, design).
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have implementation tasks (tasks artifact exists).
+   Include the schema used for each change if available.
+   Mark changes with incomplete tasks as "(In Progress)".
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - Which artifacts exist for this change
+
+3. **Get the change directory and load artifacts**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns the change directory and `contextFiles` (artifact ID -> array of concrete file paths). Read all available artifacts from `contextFiles`.
+
+4. **Initialize verification report structure**
+
+   Create a report structure with three dimensions:
+   - **Completeness**: Track tasks and spec coverage
+   - **Correctness**: Track requirement implementation and scenario coverage
+   - **Coherence**: Track design adherence and pattern consistency
+
+   Each dimension can have CRITICAL, WARNING, or SUGGESTION issues.
+
+5. **Verify Completeness**
+
+   **Task Completion**:
+   - If `contextFiles.tasks` exists, read every file path in it
+   - Parse checkboxes: `- [ ]` (incomplete) vs `- [x]` (complete)
+   - Count complete vs total tasks
+   - If incomplete tasks exist:
+     - Add CRITICAL issue for each incomplete task
+     - Recommendation: "Complete task: <description>" or "Mark as done if already implemented"
+
+   **Spec Coverage**:
+   - If delta specs exist in `openspec/changes/<name>/specs/`:
+     - Extract all requirements (marked with "### Requirement:")
+     - For each requirement:
+       - Search codebase for keywords related to the requirement
+       - Assess if implementation likely exists
+     - If requirements appear unimplemented:
+       - Add CRITICAL issue: "Requirement not found: <requirement name>"
+       - Recommendation: "Implement requirement X: <description>"
+
+6. **Verify Correctness**
+
+   **Requirement Implementation Mapping**:
+   - For each requirement from delta specs:
+     - Search codebase for implementation evidence
+     - If found, note file paths and line ranges
+     - Assess if implementation matches requirement intent
+     - If divergence detected:
+       - Add WARNING: "Implementation may diverge from spec: <details>"
+       - Recommendation: "Review <file>:<lines> against requirement X"
+
+   **Scenario Coverage**:
+   - For each scenario in delta specs (marked with "#### Scenario:"):
+     - Check if conditions are handled in code
+     - Check if tests exist covering the scenario
+     - If scenario appears uncovered:
+       - Add WARNING: "Scenario not covered: <scenario name>"
+       - Recommendation: "Add test or implementation for scenario: <description>"
+
+7. **Verify Coherence**
+
+   **Design Adherence**:
+   - If `contextFiles.design` exists:
+     - Extract key decisions (look for sections like "Decision:", "Approach:", "Architecture:")
+     - Verify implementation follows those decisions
+     - If contradiction detected:
+       - Add WARNING: "Design decision not followed: <decision>"
+       - Recommendation: "Update implementation or revise design.md to match reality"
+   - If no design.md: Skip design adherence check, note "No design.md to verify against"
+
+   **Code Pattern Consistency**:
+   - Review new code for consistency with project patterns
+   - Check file naming, directory structure, coding style
+   - If significant deviations found:
+     - Add SUGGESTION: "Code pattern deviation: <details>"
+     - Recommendation: "Consider following project pattern: <example>"
+
+8. **Generate Verification Report**
+
+   **Summary Scorecard**:
+   ```
+   ## Verification Report: <change-name>
+
+   ### Summary
+   | Dimension    | Status           |
+   |--------------|------------------|
+   | Completeness | X/Y tasks, N reqs|
+   | Correctness  | M/N reqs covered |
+   | Coherence    | Followed/Issues  |
+   ```
+
+   **Issues by Priority**:
+
+   1. **CRITICAL** (Must fix before archive):
+      - Incomplete tasks
+      - Missing requirement implementations
+      - Each with specific, actionable recommendation
+
+   2. **WARNING** (Should fix):
+      - Spec/design divergences
+      - Missing scenario coverage
+      - Each with specific recommendation
+
+   3. **SUGGESTION** (Nice to fix):
+      - Pattern inconsistencies
+      - Minor improvements
+      - Each with specific recommendation
+
+   **Final Assessment**:
+   - If CRITICAL issues: "X critical issue(s) found. Fix before archiving."
+   - If only warnings: "No critical issues. Y warning(s) to consider. Ready for archive (with noted improvements)."
+   - If all clear: "All checks passed. Ready for archive."
+
+**Verification Heuristics**
+
+- **Completeness**: Focus on objective checklist items (checkboxes, requirements list)
+- **Correctness**: Use keyword search, file path analysis, reasonable inference - don't require perfect certainty
+- **Coherence**: Look for glaring inconsistencies, don't nitpick style
+- **False Positives**: When uncertain, prefer SUGGESTION over WARNING, WARNING over CRITICAL
+- **Actionability**: Every issue must have a specific recommendation with file/line references where applicable
+
+**Graceful Degradation**
+
+- If only tasks.md exists: verify task completion only, skip spec/design checks
+- If tasks + specs exist: verify completeness and correctness, skip design
+- If full artifacts: verify all three dimensions
+- Always note which checks were skipped and why
+
+**Output Format**
+
+Use clear markdown with:
+- Table for summary scorecard
+- Grouped lists for issues (CRITICAL/WARNING/SUGGESTION)
+- Code references in format: `file.ts:123`
+- Specific, actionable recommendations
+- No vague suggestions like "consider reviewing"
diff --git a/Makefile.am b/Makefile.am
index e8f41a8c..91307ab6 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -207,6 +207,7 @@ bin_PROGRAMS = rdkvfwupgrader rdkFwupdateMgr testClient
 
 rdkvfwupgrader_SOURCES = \
     ${top_srcdir}/src/rdkv_main.c \
+    ${top_srcdir}/src/directcdn.c \
     ${top_srcdir}/src/chunk.c \
     ${top_srcdir}/src/device_status_helper.c \
     ${top_srcdir}/src/rbusInterface/rbusInterface.c
@@ -222,6 +223,7 @@ rdkvfwupgrader_CPPFLAGS = -I${top_srcdir}/src/include -I${top_srcdir}/src/device
 rdkFwupdateMgr_SOURCES = \
     ${top_srcdir}/src/rdkFwupdateMgr.c\
     ${top_srcdir}/src/chunk.c \
+    ${top_srcdir}/src/directcdn.c \
     ${top_srcdir}/src/device_status_helper.c \
     ${top_srcdir}/src/rbusInterface/rbusInterface.c \
     ${top_srcdir}/src/dbus/rdkv_dbus_server.c \
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-adoption/.openspec.yaml b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/.openspec.yaml
new file mode 100755
index 00000000..9f708669
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-05-15
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-adoption/design.md b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/design.md
new file mode 100755
index 00000000..488f6cf3
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/design.md
@@ -0,0 +1,673 @@
+## Context
+
+The current refactored `rdkfwupdater` repo uses a context-struct-driven download API (`RdkUpgradeContext_t` → `rdkv_upgrade_request()`), modular shared libraries (`librdksw_upgrade`, `librdksw_rfcIntf`, `librdksw_jsonparse`, etc.), and supports both a one-shot CLI binary (`rdkvfwupgrader`) and a persistent D-Bus daemon (`rdkFwupdateMgr`).
+
+The legacy `stable2` branch implements Direct CDN (RDKE-874) as a monolithic function (`DirectCDNDownload()`) with positional-parameter APIs. PR #120 ports this into the open-source repo. We treat PR #120 as a **behavioral reference only** — the actual implementation must conform to the refactored architecture.
+
+### Current State
+- `Rfc_t` struct has 4 fields (throttle, topspeed, incr_cdl, mtls)
+- `XCONFRES` has one shared download URL (`cloudFWLocation`)
+- `GetServURL()` always returns `/xconf/swu/stb` path
+- `checkTriggerUpgrade()` takes `(XCONFRES*, const char* model)` — processes all artifact types in one call
+- `rdkv_upgrade_request()` takes `RdkUpgradeContext_t*` — no `directCdn` field
+- `checkCodebigAccess()` always probes Codebig availability
+- Download fallback chain: mTLS → direct → Codebig (always)
+
+### Constraints
+- RFC=false must produce zero behavioral change
+- All function signature changes must be backward-compatible
+- One-shot and daemon paths both need Direct CDN support
+- Max 11 working days for full delivery including tests
+
+---
+
+## Goals / Non-Goals
+
+**Goals:**
+- Adopt Direct CDN download capability (RFC-gated)
+- Per-artifact download URLs from XConf response
+- Independent PCI/PDRI/Peripheral download with selective retry
+- Codebig bypass when Direct CDN enabled
+- Full L1 + L2 test coverage
+- No regression to existing behavior when RFC disabled
+
+**Non-Goals:**
+- Refactoring existing download-engine internals
+- Changing the D-Bus API surface (no new methods)
+- Supporting TFTP in Direct CDN mode
+- Implementing server-side XConf changes
+- Parallel artifact downloads (serial is fine)
+
+---
+
+## Decisions
+
+### D1: Feature gate via `RdkUpgradeContext_t` field (not function signature change)
+
+**Decision:** Add `bool direct_cdn` field to `RdkUpgradeContext_t` instead of changing `rdkv_upgrade_request()` function signature.
+
+**Rationale:** The refactored repo already uses a context-struct pattern. Adding a field to the struct is non-breaking — existing callers that zero-initialize (`{0}`) automatically get `direct_cdn = false`. No signature changes needed anywhere in the download chain.
+
+**Alternative considered:** Add `bool directCdn` parameter to `rdkv_upgrade_request()` (as legacy PR #120 does with `upgradeRequest()`). Rejected — breaks all existing callers, incompatible with the refactored API pattern.
+
+### D2: `checkTriggerUpgrade()` gains `upgrade_type` parameter for per-artifact mode
+
+**Decision:** Change signature to `checkTriggerUpgrade(XCONFRES*, const char* model, int upgrade_type)` where `upgrade_type` = `LEGACY_ALL_UPGRADE` (-1) means "all artifacts" (legacy behavior) and `PCI_UPGRADE`/`PDRI_UPGRADE`/`PERIPHERAL_UPGRADE` targets a specific artifact.
+
+**Note:** `PCI_UPGRADE` is defined as 0 in `rdkv_cdl.h`, so the legacy sentinel cannot be 0 — it uses `LEGACY_ALL_UPGRADE = -1` to avoid collision.
+
+**Rationale:** The function is only called in two places (one-shot main, daemon handler). Adding a parameter with `LEGACY_ALL_UPGRADE` at legacy call sites is minimal churn.
+
+**Alternative considered:** Create a separate `checkTriggerUpgradeByType()` function. Rejected — would duplicate 90% of the logic.
+
+### D3: `DirectCDNDownload()` as a new orchestrator in `src/directcdn.c`
+
+**Decision:** Create a new source file `src/directcdn.c` containing the `DirectCDNDownload()` orchestrator. It calls into existing shared infrastructure (`rdkv_upgrade_request()`, `getXconfRespData()`, `processJsonResponse()`, `checkTriggerUpgrade()`).
+
+**Rationale:** Keeps the new orchestration logic isolated from `rdkv_main.c` (which is already 1200+ lines). Easy to unit-test independently. Clean file boundary.
+
+**Alternative considered:** Inline into `rdkv_main.c` (as legacy does). Rejected — `rdkv_main.c` is already too large.
+
+### D4: Per-artifact URL stored in `XCONFRES` (not in `RdkUpgradeContext_t`)
+
+**Decision:** Extend `XCONFRES` with `firmwareUrl`, `pdriUrl`, `remCtrlUrl` fields. The `DirectCDNDownload()` orchestrator populates `RdkUpgradeContext_t.artifactLocationUrl` from these fields before each per-artifact call.
+
+**Rationale:** `XCONFRES` is the canonical "parsed XConf response" structure. URLs belong there. The context struct is populated per-call from this data.
+
+### D5: Peripheral product key discovery via static cache
+
+**Decision:** Add `getPeripheralProduct(char *buf, size_t sz)` to `deviceutils.c`. It returns the cached product identifier set during `BuildRemoteInfo()`. If not yet populated, returns default `"remCtrl"`.
+
+**Rationale:** The peripheral product name is discovered during remote-control info parsing (which happens before XConf query). Caching in a static avoids re-parsing.
+
+### D6: No new D-Bus method for Direct CDN
+
+**Decision:** Direct CDN behavior is transparent to D-Bus clients. The existing `CheckForUpdate` → `DownloadFirmware` → `UpdateFirmware` flow works unchanged. The daemon internally uses Direct CDN when RFC is enabled.
+
+**Rationale:** Client-SDK and D-Bus interface stability. Operators control the feature via RFC, not client requests.
+
+---
+
+## Per-Subtask Design
+
+### ST-1: RFC Feature Gate
+
+**Affected files:** `src/include/rfcinterface.h`, `src/rfcInterface/rfcinterface.c`
+
+**Changes:**
+```
+// rfcinterface.h — add to Rfc_t struct:
+typedef struct rfcdetails {
+    char rfc_throttle[RFC_VALUE_BUF_SIZE];
+    char rfc_topspeed[RFC_VALUE_BUF_SIZE];
+    char rfc_incr_cdl[RFC_VALUE_BUF_SIZE];
+    char rfc_mtls[RFC_VALUE_BUF_SIZE];
+    char rfc_directcdn[RFC_VALUE_BUF_SIZE];   // ← NEW
+} Rfc_t;
+
+// Add macro:
+#define RFC_DIRECTCDN "Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Feature.SWDLDirect.Enable"
+
+// Add function declaration:
+bool isDirectCDNEnabled(void);
+```
+
+**Flow (rfcinterface.c):**
+```
+getRFCSettings():
+  ... existing reads ...
+  ret = read_RFCProperty("DIRECTCDN", RFC_DIRECTCDN, data, sizeof(data));
+  if (ret != -1) {
+      strncpy(rfc_list->rfc_directcdn, data, RFC_VALUE_BUF_SIZE - 1);
+      rfc_list->rfc_directcdn[RFC_VALUE_BUF_SIZE - 1] = '\0';
+  }
+
+isDirectCDNEnabled():
+  char rfc_data[RFC_VALUE_BUF_SIZE] = {0};
+  int ret = read_RFCProperty("DIRECTCDN", RFC_DIRECTCDN, rfc_data, sizeof(rfc_data));
+  if (ret == -1) return false;
+  return (strncmp(rfc_data, "true", 4) == 0);
+```
+
+**Validation:** L1 test — mock `getRFCParameter()` to return true/false, verify `isDirectCDNEnabled()` result.
+
+---
+
+### ST-2: XConf URL Path Branching & Codebig Bypass
+
+**Affected files:** `src/deviceutils/device_api.c`, `src/device_status_helper.c`
+
+**Changes to `GetServURL()` (device_api.c):**
+```
+// In each URL construction branch, replace hardcoded path:
+// BEFORE:
+len = snprintf(pServURL, szBufSize, "%s/xconf/swu/stb", buf);
+
+// AFTER:
+bool directCdn = isDirectCDNEnabled();
+if (directCdn) {
+    len = snprintf(pServURL, szBufSize, "%s/xconf/firmware/stb/", buf);
+} else {
+    len = snprintf(pServURL, szBufSize, "%s/xconf/swu/stb", buf);
+}
+```
+
+Three URL construction paths exist in `GetServURL()` (recovery, bootstrap, xconf-direct). All three must branch.
+
+**Changes to `checkCodebigAccess()` (device_status_helper.c):**
+```
+bool checkCodebigAccess(void) {
+    bool directCdn = isDirectCDNEnabled();
+    if (directCdn) {
+        SWLOG_INFO("CodebigAccess Not Present For direct cdn\n");
+        return false;
+    }
+    // ... existing Codebig probe logic unchanged ...
+}
+```
+
+**Validation:** L1 test — mock `isDirectCDNEnabled()` to true, verify `GetServURL()` returns `/xconf/firmware/stb/` path. Verify `checkCodebigAccess()` returns false without probing.
+
+---
+
+### ST-3: Enriched XConf Response Parsing
+
+**Affected files:** `src/include/json_process.h`, `src/json_process.c`, `src/deviceutils/deviceutils.c`, `src/deviceutils/deviceutils.h`
+
+**XCONFRES extension (json_process.h):**
+```
+typedef struct xconf_response {
+    // ... existing fields ...
+    char rdmCatalogueVersion[512];
+    char firmwareUrl[CLD_URL_MAX_LEN];      // ← NEW: PCI direct URL
+    char remCtrlUrl[CLD_URL_MAX_LEN];       // ← NEW: Peripheral direct URL
+    char pdriUrl[CLD_URL_MAX_LEN];          // ← NEW: PDRI direct URL
+} XCONFRES;
+```
+
+**Parsing logic (json_process.c — `getXconfRespData()`):**
+```
+// After existing field parsing:
+extern Rfc_t rfc_list;
+
+if (strncmp(rfc_list.rfc_directcdn, "true", 4) == 0) {
+    // Direct CDN mode: parse per-artifact URLs
+    GetJsonVal(pJson, "firmware_URL", pResponse->firmwareUrl, sizeof(pResponse->firmwareUrl));
+    GetJsonVal(pJson, "additionalFwVerInfo_URL", pResponse->pdriUrl, sizeof(pResponse->pdriUrl));
+
+    // Dynamic peripheral key
+    char peripheral_product[64] = {0};
+    char peripheral_product_url[100] = {0};
+    int peri_ret = getPeripheralProduct(peripheral_product, sizeof(peripheral_product));
+    if (peri_ret != -1) {
+        snprintf(peripheral_product_url, sizeof(peripheral_product_url), "%s_URL", peripheral_product);
+        GetJsonVal(pJson, peripheral_product, pResponse->peripheralFirmwares, sizeof(pResponse->peripheralFirmwares));
+        GetJsonVal(pJson, peripheral_product_url, pResponse->remCtrlUrl, sizeof(pResponse->remCtrlUrl));
+    }
+} else {
+    // Legacy: use containing-match for peripheral
+    GetJsonValContaining(pJson, "remCtrl", pResponse->peripheralFirmwares, sizeof(pResponse->peripheralFirmwares));
+}
+```
+
+**PDRI validation (json_process.c — `processJsonResponse()`):**
+```
+// After existing PDRI validation:
+if ((*(response->cloudPDRIVersion)) != 0) {
+    valid_pdri_img = validateImage(response->cloudPDRIVersion, model);
+    if ((strstr(response->cloudPDRIVersion, "_PDRI_")) == NULL) {
+        SWLOG_INFO("Invalid PDRI image\n");
+        valid_pdri_img = false;
+    }
+}
+```
+
+**Peripheral product (deviceutils.c):**
+```
+static char pProductNumber[128] = {0};
+
+int getPeripheralProduct(char *buf, size_t szIn) {
+    if (buf == NULL || szIn == 0) return -1;
+    if (pProductNumber[0] != 0) {
+        snprintf(buf, szIn, "%s", pProductNumber);
+    } else {
+        snprintf(buf, szIn, "%s", "remCtrl");
+    }
+    return 0;
+}
+
+// In BuildRemoteInfo(), after GetJsonVal(pItem, "Product", productBuf, ...):
+snprintf(pProductNumber, sizeof(pProductNumber), "remCtrl%s", productBuf);
+```
+
+**Validation:** L1 test — construct mock JSON with `firmware_URL`, `additionalFwVerInfo_URL`, `remCtrlXR15_URL` fields. Call `getXconfRespData()` with directCdn=true, verify struct populated. With directCdn=false, verify legacy path used.
+
+---
+
+### ST-4: Per-Artifact Download Orchestration
+
+**Affected files:** `src/directcdn.c` (NEW), `src/include/rdkv_cdl.h`, `src/include/rdkv_upgrade.h`, `src/rdkv_main.c`, `src/dbus/rdkFwupdateMgr_handlers.c`, `Makefile.am`
+
+**RdkUpgradeContext_t extension (rdkv_upgrade.h):**
+```
+typedef struct {
+    // ... existing fields ...
+    int download_only;
+    bool direct_cdn;           // ← NEW: Direct CDN mode flag
+} RdkUpgradeContext_t;
+```
+
+**New defines (rdkv_cdl.h):**
+```
+#define DIRECT_CDN_RETRY_ERR -2
+#define JSON_STR_LEN 1000
+```
+
+**checkTriggerUpgrade signature change (rdkv_cdl.h):**
+```
+// BEFORE:
+int checkTriggerUpgrade(XCONFRES *pResponse, const char *model);
+
+// AFTER:
+int checkTriggerUpgrade(XCONFRES *pResponse, const char *model, int upgrade_type);
+// upgrade_type: LEGACY_ALL_UPGRADE (-1) = all (legacy), PCI_UPGRADE (0), PDRI_UPGRADE (1), PERIPHERAL_UPGRADE (3)
+```
+
+**checkTriggerUpgrade behavior change (rdkv_main.c):**
+```
+// When upgrade_type != LEGACY_ALL_UPGRADE (per-artifact mode):
+//   - Only attempt the specified artifact type
+//   - Use per-artifact URL from XCONFRES (firmwareUrl/pdriUrl/remCtrlUrl)
+//   - Set context.direct_cdn = true
+//   - Return DIRECT_CDN_RETRY_ERR (-2) on transient failure (retryable)
+//   - Return 0 on success
+//   - Return -1 on permanent failure (e.g. HTTP 404)
+//   - Return 0 if URL or filename is empty (skip — artifact not needed)
+
+// When upgrade_type == LEGACY_ALL_UPGRADE (-1):
+//   - Existing behavior unchanged (PCI → PDRI → Peripheral sequential)
+```
+
+**DirectCDNDownload orchestrator (src/directcdn.c):**
+```
+int DirectCDNDownload(XCONFRES *response, char *cur_img_name,
+                      DeviceProperty_t *device_info, int server_type, int *pHttp_code)
+{
+    int pci_status = DIRECT_CDN_RETRY_ERR;
+    int pdri_status = DIRECT_CDN_RETRY_ERR;
+    int peri_status = -1;
+    int cnt = 0;
+    int total_retry = 3;
+    int ret = -1;
+
+    // XConf query setup
+    char *pJSONStr = malloc(JSON_STR_LEN);
+    char *pServURL = malloc(URL_MAX_LEN);
+    DownloadData DwnLoc = {0};
+    MemDLAlloc(&DwnLoc, DEFAULT_DL_ALLOC);
+
+    size_t len = GetServURL(pServURL, URL_MAX_LEN);
+    if (len == 0) goto cleanup;
+    createJsonString(pJSONStr, JSON_STR_LEN);
+
+    // Retry loop
+    while (cnt < total_retry && (pci_status == DIRECT_CDN_RETRY_ERR || pdri_status == DIRECT_CDN_RETRY_ERR)) {
+
+        // XConf query (reuses existing rdkv_upgrade_request with XCONF_UPGRADE type)
+        RdkUpgradeContext_t xconf_ctx = {0};
+        xconf_ctx.upgrade_type = XCONF_UPGRADE;
+        xconf_ctx.server_type = server_type;
+        xconf_ctx.artifactLocationUrl = pServURL;
+        xconf_ctx.dwlloc = &DwnLoc;
+        xconf_ctx.pPostFields = pJSONStr;
+        // ... populate remaining fields from device_info / globals ...
+
+        void *curl = NULL;
+        ret = rdkv_upgrade_request(&xconf_ctx, &curl, pHttp_code);
+
+        if (ret != 0 || *pHttp_code != 200) break;
+
+        // Parse response
+        getXconfRespData(response, (char*)DwnLoc.pvOut);
+        int json_res = processJsonResponse(response, cur_img_name, device_info->model, device_info->maint_status);
+        if (json_res != 0) break;
+
+        // Check protocol
+        if (strncmp(response->cloudProto, "tftp", 4) == 0) break;  // TFTP not supported
+
+        // Per-artifact downloads
+        if (pci_status == DIRECT_CDN_RETRY_ERR)
+            pci_status = checkTriggerUpgrade(response, device_info->model, PCI_UPGRADE);
+
+        if (pdri_status == DIRECT_CDN_RETRY_ERR)
+            pdri_status = checkTriggerUpgrade(response, device_info->model, PDRI_UPGRADE);
+
+        if (peri_status != 0)
+            peri_status = checkTriggerUpgrade(response, device_info->model, PERIPHERAL_UPGRADE);
+
+        if (pci_status == 0 && pdri_status == 0) break;
+        cnt++;
+    }
+
+cleanup:
+    free(pServURL);
+    free(pJSONStr);
+    if (DwnLoc.pvOut) free(DwnLoc.pvOut);
+    return (pci_status == 0 && pdri_status == 0) ? 0 : -1;
+}
+```
+
+**Integration point (rdkv_main.c — main flow):**
+```
+// After initialValidation succeeds, before MakeXconfComms:
+if (isDirectCDNEnabled()) {
+    ret_curl_code = DirectCDNDownload(&response, cur_img_detail.cur_img_name,
+                                       &device_info, server_type, &http_code);
+} else {
+    // Existing legacy path unchanged
+    ret_curl_code = MakeXconfComms(&response, server_type, &http_code);
+    if (ret_curl_code == 0 && http_code == 200) {
+        json_res = processJsonResponse(...);
+        if (proto == 1 && json_res == 0) {
+            ret_curl_code = checkTriggerUpgrade(&response, device_info.model, LEGACY_ALL_UPGRADE);
+        }
+    }
+}
+```
+
+**Daemon integration (rdkFwupdateMgr_handlers.c):**
+The daemon's `CheckForUpdate` handler already caches XConf responses. When Direct CDN is enabled:
+- The `DownloadFirmware` handler sets `context.direct_cdn = true` on the `RdkUpgradeContext_t`
+- `rdkv_upgrade_request()` uses `context.artifactLocationUrl` from the per-artifact URL (set from cached `XCONFRES`)
+- No new D-Bus methods needed
+
+**Makefile.am change:**
+```
+bin_PROGRAMS= rdkvfwupgrader
+rdkvfwupgrader_SOURCES = \
+    ${top_srcdir}/src/rdkv_main.c \
+    ${top_srcdir}/src/directcdn.c \    ← NEW
+    ${top_srcdir}/src/chunk.c \
+    ...
+```
+
+**Validation:** Compile check. Smoke test in Docker: invoke one-shot with RFC=true, verify XConf query goes to `/xconf/firmware/stb/` (can be observed via mock or log).
+
+---
+
+### ST-5: Selective Retry Logic
+
+**Affected files:** `src/directcdn.c`
+
+Already included in ST-4's `DirectCDNDownload()` design above. The retry is integral to the orchestrator. This subtask focuses on:
+
+- Ensuring `checkTriggerUpgrade()` returns `DIRECT_CDN_RETRY_ERR` for transient download failures (network errors, timeouts)
+- Ensuring it returns 0 for success
+- Ensuring it returns other negative for permanent failures (validation errors, file not found)
+- Peripheral status does NOT gate the retry loop
+- Max 3 iterations
+
+**Error classification in `checkTriggerUpgrade()` per-artifact mode (implemented):**
+```
+// Per-artifact download attempt:
+int curl_ret = rdkv_upgrade_request(&artifact_ctx, &curl, &http_code);
+
+// SUCCESS — download + HTTP status OK
+if (curl_ret == 0 && (http_code == HTTP_SUCCESS || http_code == HTTP_CHUNK_SUCCESS))
+    return 0;
+
+// RETRYABLE — transient curl-level errors
+if (curl_ret == CURL_COULDNT_RESOLVE_HOST || curl_ret == CURL_CONNECTIVITY_ISSUE ||
+    curl_ret == CURLTIMEOUT || curl_ret == CURL_LOW_BANDWIDTH ||
+    curl_ret == CURL_RECV_ERROR)
+    return DIRECT_CDN_RETRY_ERR;
+
+// RETRYABLE — transient HTTP-level errors (server-side temporary)
+if (curl_ret == 0 && (http_code == 502 || http_code == 503))
+    return DIRECT_CDN_RETRY_ERR;
+
+// PERMANENT FAIL — everything else (HTTP 404, validation errors, etc.)
+return -1;
+```
+
+**Curl code reference (from `rdkv_cdl.h`):**
+| Code | Define | Classification |
+|------|--------|----------------|
+| 6 | `CURL_COULDNT_RESOLVE_HOST` | Retryable |
+| 7 | `CURL_CONNECTIVITY_ISSUE` | Retryable |
+| 18 | `CURL_LOW_BANDWIDTH` | Retryable |
+| 28 | `CURLTIMEOUT` | Retryable |
+| 56 | `CURL_RECV_ERROR` | Retryable |
+| 0 + HTTP 502/503 | Server temporary error | Retryable |
+| 0 + HTTP 404 | Resource not found | Permanent |
+| Other | Unknown / unrecoverable | Permanent |
+
+**Validation:** L1 test — mock `rdkv_upgrade_request()` to fail twice then succeed. Verify retry count = 2 and final result = 0.
+
+---
+
+### ST-6: L1 Unit Tests
+
+**Affected files:** `unittest/basic_rdkv_main_gtest.cpp`, `unittest/fwdl_interface_gtest.cpp`, `unittest/mocks/` (as needed)
+
+**Test cases:**
+1. `getRFCSettings()` reads `RFC_DIRECTCDN` (success + failure)
+2. `isDirectCDNEnabled()` returns true/false correctly
+3. `getXconfRespData()` with directCdn=true parses `firmware_URL`, `additionalFwVerInfo_URL`, `<product>_URL`
+4. `getXconfRespData()` with directCdn=false uses legacy `GetJsonValContaining`
+5. `getPeripheralProduct()` returns cached product name
+6. PDRI `_PDRI_` validation (pass + reject)
+7. `GetServURL()` returns `/xconf/firmware/stb/` when directCdn=true
+8. `checkCodebigAccess()` returns false when directCdn=true
+9. `checkTriggerUpgrade(response, model, PCI_UPGRADE)` — per-artifact mode
+10. `checkTriggerUpgrade(response, model, LEGACY_ALL_UPGRADE)` — legacy mode unchanged
+11. DirectCDNDownload retry: fail→fail→succeed pattern
+12. DirectCDNDownload: PCI+PDRI success, PERI fail → overall SUCCESS
+
+**Mock updates:** `getRFCParameter` mock needs `Times(5)` instead of `Times(4)`.
+
+---
+
+### ST-7: L2 Functional Tests
+
+**Affected files:** `test/functional-tests/tests/test_directcdn_download.py` (NEW), `run_l2.sh`
+
+**Test scenarios:**
+1. RFC disabled → full legacy path (regression)
+2. RFC enabled → XConf URL contains `/xconf/firmware/stb/`
+3. RFC enabled → per-artifact download URLs used
+4. RFC enabled → per-artifact failure triggers retry
+5. RFC enabled → peripheral failure alone → overall success
+
+**`run_l2.sh` addition:**
+```
+rbuscli setv Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Feature.SWDLDirect.Enable boolean false
+```
+
+---
+
+### ST-8: Developer Validation & QA Handoff
+
+**Activities:**
+- Full L1 + L2 regression in Docker
+- RFC toggle (on/off) end-to-end verification
+- Coverity / static analysis clean
+- PR description with behavioral summary
+- QA test scenarios document
+
+---
+
+## Direct CDN Enabled Download Flow
+
+The diagram below shows the implemented end-to-end flow when Direct CDN is enabled via RFC. When the RFC is disabled (`isDirectCDNEnabled() == false`), the system follows the legacy path (`MakeXconfComms` → `checkTriggerUpgrade(..., LEGACY_ALL_UPGRADE)`) with zero behavioral change.
+
+### Entry Points
+
+Both the **one-shot binary** (`rdkvfwupgrader` via `src/rdkv_main.c`) and the **daemon** (`rdkFwupdateMgr` via `src/rdkFwupdateMgr.c`) evaluate `isDirectCDNEnabled()` after initial validation. If enabled, the one-shot binary calls `DirectCDNDownload()` directly; the daemon sets `context.direct_cdn = true` on the `RdkUpgradeContext_t` before calling `rdkv_upgrade_request()`.
+
+### Orchestration Flow
+
+```mermaid
+flowchart TD
+    START(["rdkvfwupgrader main() / daemon handler"])
+    START --> RFC{"isDirectCDNEnabled()?"}
+
+    RFC -- "false" --> LEGACY["Legacy path:<br/>MakeXconfComms() →<br/>checkTriggerUpgrade(response,<br/>model, LEGACY_ALL_UPGRADE)"]
+    LEGACY --> LEGACY_END(["Legacy download + flash<br/>(Codebig fallback enabled)"])
+
+    RFC -- "true" --> DCDN["DirectCDNDownload()<br/>(src/directcdn.c)"]
+
+    DCDN --> ALLOC["Allocate buffers<br/>(DwnLoc, pJSONStr, pServURL)"]
+    ALLOC --> URL["GetServURL() →<br/>/xconf/firmware/stb/"]
+    URL --> JSON["createJsonString() →<br/>device payload"]
+    JSON --> LOOP{"while cnt < 3 AND<br/>(pci==RETRY_ERR OR<br/>pdri==RETRY_ERR)"}
+
+    LOOP -- "condition false<br/>or cnt >= 3" --> RESULT{"pci==0 AND<br/>pdri==0?"}
+    RESULT -- "yes" --> SUCCESS(["Return 0 — success"])
+    RESULT -- "no" --> FAILURE(["Return -1 — failure"])
+
+    LOOP -- "condition true" --> XCONF["Build XCONF context:<br/>upgrade_type = XCONF_UPGRADE<br/>server_type = server_type<br/>direct_cdn = true"]
+    XCONF --> XREQ["rdkv_upgrade_request()<br/>(XConf query)"]
+    XREQ --> XCHECK{"ret==0 AND<br/>http==200?"}
+    XCHECK -- "no" --> BREAK1(["BREAK — XConf failure<br/>(unrecoverable)"])
+    BREAK1 --> RESULT
+
+    XCHECK -- "yes" --> PARSE["getXconfRespData()<br/>Parse per-artifact URLs:<br/>firmwareUrl, pdriUrl, remCtrlUrl"]
+    PARSE --> VALIDATE["processJsonResponse()<br/>Validate response"]
+    VALIDATE --> PROTO{"Protocol?"}
+    PROTO -- "tftp" --> BREAK2(["BREAK — TFTP unsupported"])
+    BREAK2 --> RESULT
+    PROTO -- "http" --> ARTIFACT_DISPATCH
+
+    subgraph ARTIFACT_DISPATCH["Per-Artifact Dispatch"]
+        direction TB
+        PCI_CHK{"PCI still<br/>RETRY_ERR?"}
+        PCI_CHK -- "yes" --> PCI_DL["checkTriggerUpgrade<br/>(response, model, PCI_UPGRADE)"]
+        PCI_CHK -- "no" --> PCI_SKIP["Skip — PCI already succeeded"]
+        PCI_DL --> PDRI_CHK
+        PCI_SKIP --> PDRI_CHK
+
+        PDRI_CHK{"PDRI still<br/>RETRY_ERR?"}
+        PDRI_CHK -- "yes" --> PDRI_DL["checkTriggerUpgrade<br/>(response, model, PDRI_UPGRADE)"]
+        PDRI_CHK -- "no" --> PDRI_SKIP["Skip — PDRI already succeeded"]
+        PDRI_DL --> PERI_CHK
+        PDRI_SKIP --> PERI_CHK
+
+        PERI_CHK{"Peripheral<br/>failed?"}
+        PERI_CHK -- "yes" --> PERI_DL["checkTriggerUpgrade<br/>(response, model, PERIPHERAL_UPGRADE)"]
+        PERI_CHK -- "no" --> DONE_CHK
+        PERI_DL --> DONE_CHK
+
+        DONE_CHK{"pci==0 AND<br/>pdri==0?"}
+    end
+
+    DONE_CHK -- "yes" --> BREAK3(["BREAK — all critical<br/>artifacts succeeded"])
+    BREAK3 --> RESULT
+    DONE_CHK -- "no" --> INC["cnt++"]
+    INC --> LOOP
+```
+
+### Per-Artifact Download Detail (`checkTriggerUpgrade` per-artifact mode)
+
+When `checkTriggerUpgrade()` is called with `upgrade_type ∈ {PCI_UPGRADE, PDRI_UPGRADE, PERIPHERAL_UPGRADE}`, it enters per-artifact mode:
+
+```mermaid
+flowchart TD
+    ENTRY(["checkTriggerUpgrade<br/>(response, model, upgrade_type)"])
+    ENTRY --> MAP["Map upgrade_type →<br/>artifact_url, artifact_file"]
+
+    MAP --> URL_EMPTY{"URL empty?"}
+    URL_EMPTY -- "yes" --> SKIP(["Return 0 — skip,<br/>artifact not needed"])
+    URL_EMPTY -- "no" --> FILE_EMPTY{"Filename empty?"}
+    FILE_EMPTY -- "yes" --> SKIP
+    FILE_EMPTY -- "no" --> CTX["Build RdkUpgradeContext_t:<br/>server_type = HTTP_SSR_DIRECT<br/>artifactLocationUrl = artifact_url<br/>dwlloc = difw_path / artifact_file<br/>direct_cdn = true"]
+
+    CTX --> DL["rdkv_upgrade_request(&ctx, &curl, &http_code)<br/><i>Codebig fallback bypassed<br/>because direct_cdn == true</i>"]
+
+    DL --> CLASSIFY{"Error<br/>classification"}
+
+    CLASSIFY --> S1{"curl==0 AND<br/>http ∈ {200, 206}?"}
+    S1 -- "yes" --> RET_OK(["Return 0<br/>SUCCESS"])
+
+    S1 -- "no" --> S2{"curl ∈ {6, 7, 18,<br/>28, 56}?"}
+    S2 -- "yes" --> RET_RETRY(["Return DIRECT_CDN_RETRY_ERR (-2)<br/>TRANSIENT — retryable"])
+
+    S2 -- "no" --> S3{"curl==0 AND<br/>http ∈ {502, 503}?"}
+    S3 -- "yes" --> RET_RETRY
+
+    S3 -- "no" --> RET_PERM(["Return -1<br/>PERMANENT failure"])
+```
+
+### URL-to-Artifact Mapping
+
+| `upgrade_type` | XCONFRES URL field | XCONFRES filename field | Download path |
+|---|---|---|---|
+| `PCI_UPGRADE` (0) | `firmwareUrl` | `cloudFWFile` | `difw_path/cloudFWFile` |
+| `PDRI_UPGRADE` (1) | `pdriUrl` | `cloudPDRIVersion` | `difw_path/cloudPDRIVersion` |
+| `PERIPHERAL_UPGRADE` (3) | `remCtrlUrl` | `peripheralFirmwares` | `difw_path/peripheralFirmwares` |
+
+### Key Behavioral Notes
+
+- **Codebig bypass**: When `RdkUpgradeContext_t.direct_cdn == true`, the fallback chain inside `rdkv_upgrade_request()` skips Codebig. Downloads go direct-to-CDN only.
+- **Selective retry**: Only artifacts with status `DIRECT_CDN_RETRY_ERR` are re-attempted on the next loop iteration. Already-succeeded artifacts are skipped.
+- **Peripheral is non-blocking**: The retry loop condition only checks PCI and PDRI status. Peripheral failure alone does not prevent overall success.
+- **XConf re-query per iteration**: Each retry iteration re-queries XConf. This is consistent with legacy behavior but means response could theoretically change between iterations.
+- **No backoff**: Retries are immediate (no sleep between iterations), consistent with legacy.
+- **Max 3 iterations**: Hard-coded `total_retry_cnt = 3`.
+
+---
+
+## Legacy → Refactored Mapping
+
+| Legacy (PR #120) | Refactored Repo Equivalent |
+|-------------------|---------------------------|
+| `upgradeRequest(..., bool directCdn, ...)` positional param | `RdkUpgradeContext_t.direct_cdn` field in context struct |
+| `checkTriggerUpgrade(response, model, directCdn, upgrade_type)` | `checkTriggerUpgrade(response, model, upgrade_type)` — directCdn inferred from `isDirectCDNEnabled()`; legacy callers pass `LEGACY_ALL_UPGRADE` (-1) |
+| `DirectCDNDownload()` in rdkv_main.c | `DirectCDNDownload()` in `src/directcdn.c` (separate file) |
+| Nested malloc pattern | Same pattern (C codebase, no alternative without refactor) |
+| `extern Rfc_t rfc_list` for global access | Same (existing pattern in the refactored repo) |
+| `#ifndef GTEST_ENABLE` guards around `isDirectCDNEnabled()` | Same pattern (already used for other RFC functions) |
+| `getPeripheralProduct()` in deviceutils.c | Same location, same approach (static cache) |
+| Function signature `int upgradeRequest(type, server, directCdn, url, dwlloc, json, http_code)` | No change to `rdkv_upgrade_request()` signature — context struct absorbs the new field |
+
+---
+
+## Assumptions
+
+1. RFC parameter `SWDLDirect.Enable` already exists in TR-181 data model (confirmed via PR #120 review comments)
+2. XConf server serves `firmware_URL`, `additionalFwVerInfo_URL`, and `<product>_URL` fields when queried at `/xconf/firmware/stb/`
+3. Peripheral product name is available before XConf query (populated during `initialize()` → `BuildRemoteInfo()`)
+4. TFTP is not supported in Direct CDN mode (consistent with PR #120)
+5. Docker build environment can compile and run L1/L2 tests for the refactored repo
+6. `DownloadData` / `MemDLAlloc` infrastructure is available (used by existing `MakeXconfComms()`)
+
+---
+
+## Risks / Trade-offs
+
+| Risk | Impact | Mitigation |
+|------|--------|------------|
+| `checkTriggerUpgrade()` signature change breaks existing callers | Build failure | Only 2 call sites. Add `upgrade_type=LEGACY_ALL_UPGRADE` at both. Compile immediately after change. |
+| XConf re-query per retry iteration (same as legacy) may get inconsistent responses | Firmware version mismatch between PCI/PDRI | Document as known limitation. Could cache first response in future enhancement. |
+| `getPeripheralProduct()` returns default "remCtrl" if BuildRemoteInfo hasn't run | Wrong JSON key parsed | Verify initialization order in both one-shot and daemon paths. |
+| No backoff between Direct CDN retry attempts | Server load during transient failure | Add 5-second sleep between retries (improvement over legacy which has none). |
+| `RdkUpgradeContext_t.direct_cdn` field changes struct size | ABI change if library consumers depend on struct layout | Field added at end. All internal callers zero-init. No external ABI promise. |
+| L2 test environment may not have XConf mock supporting new fields | L2 tests pass trivially | Extend existing XConf mock in L2 framework to return new fields. |
+
+---
+
+## Migration Plan
+
+1. Feature is RFC-gated — ships disabled by default
+2. Operator enables via: `rbuscli setv Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Feature.SWDLDirect.Enable boolean true`
+3. Rollback: disable RFC → immediate revert to legacy behavior (no code rollback needed)
+4. No data migration required
+5. No breaking API changes to client-SDK or D-Bus interface
+
+---
+
+## Open Questions
+
+1. **Should Direct CDN retry include a backoff delay?** Legacy has none. Recommend 5s delay between retries.
+2. **Should the daemon expose per-artifact progress via D-Bus signals?** Deferred to future enhancement. Current scope: transparent to clients.
+3. **Is `DownloadData`/`MemDLAlloc` freed between retry iterations in the orchestrator?** Must verify — potential stale buffer risk. Plan: reset `DwnLoc.datasize = 0` between iterations.
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-adoption/proposal.md b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/proposal.md
new file mode 100755
index 00000000..73d85af3
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/proposal.md
@@ -0,0 +1,37 @@
+## Why
+
+The legacy `rdkfwupdater` (stable2 branch) implements a Direct CDN firmware download mode (RDKE-874) that bypasses Codebig intermediaries and uses per-artifact download URLs from XConf. This capability needs to be adopted into the current refactored repo to maintain feature parity. The feature is RFC-gated and operator-controlled — when disabled, the system behaves identically to today.
+
+## What Changes
+
+- Add RFC parameter `Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Feature.SWDLDirect.Enable` support
+- Add `isDirectCDNEnabled()` runtime feature gate
+- Branch `GetServURL()` to return `/xconf/firmware/stb/` when Direct CDN is enabled
+- Skip Codebig access probe when Direct CDN is enabled
+- Extend `XCONFRES` struct with per-artifact URL fields (`firmwareUrl`, `pdriUrl`, `remCtrlUrl`)
+- Parse enriched XConf JSON response (per-artifact URLs, dynamic peripheral product key)
+- Add PDRI filename validation (must contain `_PDRI_` substring)
+- Add `getPeripheralProduct()` for dynamic peripheral JSON key resolution
+- Modify `checkTriggerUpgrade()` to support per-artifact mode (`upgrade_type` parameter)
+- Add `DirectCDNDownload()` orchestrator with per-artifact selective retry (max 3)
+- Modify `upgradeRequest()` signature with `directCdn` parameter
+- Wire into both one-shot (`rdkv_main.c`) and daemon (`rdkFwupdateMgr_handlers.c`) paths
+
+## Capabilities
+
+### New Capabilities
+- `direct-cdn-download`: RFC-gated firmware download mode that uses per-artifact CDN URLs from XConf, bypasses Codebig, and orchestrates independent PCI/PDRI/Peripheral downloads with selective retry
+
+### Modified Capabilities
+- `download-engine`: `upgradeRequest()` gains `directCdn` parameter; Codebig fallback chain conditionally shortened
+- `firmware-validation`: `XCONFRES` struct extended; `getXconfRespData()` gains conditional parsing branch; PDRI validation tightened
+- `retry-recovery`: New Direct CDN retry policy (per-artifact, max 3, built-in) added as distinct layer
+- `updater-execution`: `checkTriggerUpgrade()` modified for per-artifact mode; new `DirectCDNDownload()` orchestrator added to one-shot path
+
+## Impact
+
+- **Files modified**: `src/include/rfcinterface.h`, `src/rfcInterface/rfcinterface.c`, `src/include/json_process.h`, `src/json_process.c`, `src/deviceutils/deviceutils.c`, `src/deviceutils/deviceutils.h`, `src/deviceutils/device_api.c`, `src/device_status_helper.c`, `src/include/rdkv_cdl.h`, `src/rdkv_main.c`, `src/dbus/rdkFwupdateMgr_handlers.c`, `Makefile.am`
+- **New files**: `src/directcdn.c` (or inlined into rdkv_main.c)
+- **API changes**: `upgradeRequest()` and `checkTriggerUpgrade()` signatures change (backward-compatible via default `directCdn=false`)
+- **External dependency**: RFC param must exist in TR-181 data model (already in tr69hostif)
+- **Test impact**: L1 mock expectations need `Times()` updates; new L1 + L2 tests required
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/direct-cdn-download/spec.md b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/direct-cdn-download/spec.md
new file mode 100755
index 00000000..7704c0a9
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/direct-cdn-download/spec.md
@@ -0,0 +1,147 @@
+## ADDED Requirements
+
+### Requirement: RFC Feature Gate
+The system SHALL read the RFC parameter `Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Feature.SWDLDirect.Enable` at startup and expose a runtime query function `isDirectCDNEnabled()` that returns true only when the RFC value is `"true"`.
+
+#### Scenario: RFC enabled
+- **WHEN** the RFC parameter `SWDLDirect.Enable` is set to `"true"`
+- **THEN** `isDirectCDNEnabled()` SHALL return true
+
+#### Scenario: RFC disabled
+- **WHEN** the RFC parameter `SWDLDirect.Enable` is set to `"false"` or is absent
+- **THEN** `isDirectCDNEnabled()` SHALL return false
+
+#### Scenario: RFC value stored in Rfc_t
+- **WHEN** `getRFCSettings()` is called during initialization
+- **THEN** the Direct CDN RFC value SHALL be stored in `Rfc_t.rfc_directcdn`
+
+### Requirement: XConf URL Path Branching
+The system SHALL use a different XConf query URL path when Direct CDN is enabled. The path `/xconf/firmware/stb/` SHALL be used instead of `/xconf/swu/stb`.
+
+#### Scenario: Direct CDN enabled changes XConf URL
+- **WHEN** `GetServURL()` is called and `isDirectCDNEnabled()` returns true
+- **THEN** the returned URL SHALL contain the path `/xconf/firmware/stb/`
+
+#### Scenario: Direct CDN disabled uses legacy URL
+- **WHEN** `GetServURL()` is called and `isDirectCDNEnabled()` returns false
+- **THEN** the returned URL SHALL contain the path `/xconf/swu/stb`
+
+### Requirement: Codebig Bypass
+The system SHALL skip Codebig access probing when Direct CDN is enabled.
+
+#### Scenario: Direct CDN bypasses Codebig
+- **WHEN** `checkCodebigAccess()` is called and `isDirectCDNEnabled()` returns true
+- **THEN** the function SHALL return false without performing any network probe
+
+#### Scenario: Codebig probe unaffected when disabled
+- **WHEN** `checkCodebigAccess()` is called and `isDirectCDNEnabled()` returns false
+- **THEN** the function SHALL perform the normal Codebig accessibility check
+
+### Requirement: Per-Artifact URL Parsing
+The system SHALL parse per-artifact download URLs from the enriched XConf JSON response when Direct CDN is enabled: `firmware_URL` (PCI), `additionalFwVerInfo_URL` (PDRI), and `<peripheralProduct>_URL` (Peripheral).
+
+#### Scenario: PCI firmware URL parsed
+- **WHEN** XConf response contains `firmware_URL` field and Direct CDN is enabled
+- **THEN** the value SHALL be stored in `XCONFRES.firmwareUrl`
+
+#### Scenario: PDRI URL parsed
+- **WHEN** XConf response contains `additionalFwVerInfo_URL` field and Direct CDN is enabled
+- **THEN** the value SHALL be stored in `XCONFRES.pdriUrl`
+
+#### Scenario: Peripheral URL parsed with dynamic key
+- **WHEN** XConf response contains `<peripheralProduct>_URL` field and Direct CDN is enabled
+- **THEN** the value SHALL be stored in `XCONFRES.remCtrlUrl` where `<peripheralProduct>` is resolved by `getPeripheralProduct()`
+
+#### Scenario: Legacy parsing when disabled
+- **WHEN** Direct CDN is disabled
+- **THEN** `getXconfRespData()` SHALL use the legacy `GetJsonValContaining("remCtrl", ...)` approach for peripherals and SHALL NOT attempt to parse per-artifact URL fields
+
+### Requirement: Peripheral Product Discovery
+The system SHALL provide `getPeripheralProduct()` which returns the peripheral product identifier cached during `BuildRemoteInfo()`.
+
+#### Scenario: Product available after initialization
+- **WHEN** `BuildRemoteInfo()` has populated the product identifier
+- **THEN** `getPeripheralProduct()` SHALL return the cached product identifier (e.g., `"remCtrlXR15"`)
+
+#### Scenario: Product not yet available
+- **WHEN** `BuildRemoteInfo()` has not yet populated the product identifier
+- **THEN** `getPeripheralProduct()` SHALL return the default `"remCtrl"`
+
+### Requirement: DirectCDNDownload Orchestrator
+The system SHALL provide a `DirectCDNDownload()` function that orchestrates per-artifact firmware downloads with selective retry. It SHALL query XConf, parse the response, then attempt PCI, PDRI, and Peripheral downloads independently.
+
+#### Scenario: All artifacts succeed on first attempt
+- **WHEN** `DirectCDNDownload()` is called and all per-artifact downloads succeed
+- **THEN** the function SHALL return 0 (success) after exactly one XConf query and one download attempt per artifact
+
+#### Scenario: PCI fails then succeeds on retry
+- **WHEN** PCI download fails with a transient error on the first attempt
+- **THEN** the orchestrator SHALL re-query XConf and re-attempt PCI download (up to 3 total iterations)
+
+#### Scenario: PDRI fails then succeeds on retry
+- **WHEN** PDRI download fails with a transient error on the first attempt but PCI already succeeded
+- **THEN** the orchestrator SHALL re-query XConf, skip PCI (already succeeded), and re-attempt PDRI
+
+#### Scenario: Peripheral failure does not gate retry
+- **WHEN** Peripheral download fails but PCI and PDRI both succeed
+- **THEN** the orchestrator SHALL return 0 (overall success) — peripheral failure is non-fatal
+
+#### Scenario: Max retry exceeded
+- **WHEN** PCI or PDRI fails on all 3 retry iterations
+- **THEN** the orchestrator SHALL return -1 (failure)
+
+#### Scenario: TFTP protocol rejected
+- **WHEN** XConf response specifies `cloudProto` as `"tftp"`
+- **THEN** `DirectCDNDownload()` SHALL abort and return -1 (TFTP not supported in Direct CDN mode)
+
+### Requirement: Per-Artifact Download Mode
+The system SHALL support calling `checkTriggerUpgrade()` with a specific `upgrade_type` to download only a single artifact type (PCI, PDRI, or Peripheral) using the per-artifact URL from `XCONFRES`.
+
+#### Scenario: PCI-only download via per-artifact URL
+- **WHEN** `checkTriggerUpgrade(response, model, PCI_UPGRADE)` is called and `response->firmwareUrl` is populated
+- **THEN** the download SHALL use `response->firmwareUrl` as the artifact location URL
+
+#### Scenario: PDRI-only download via per-artifact URL
+- **WHEN** `checkTriggerUpgrade(response, model, PDRI_UPGRADE)` is called and `response->pdriUrl` is populated
+- **THEN** the download SHALL use `response->pdriUrl` as the artifact location URL
+
+#### Scenario: Peripheral download via per-artifact URL
+- **WHEN** `checkTriggerUpgrade(response, model, PERIPHERAL_UPGRADE)` is called and `response->remCtrlUrl` is populated
+- **THEN** the download SHALL use `response->remCtrlUrl` as the artifact location URL
+
+#### Scenario: Transient failure returns retryable code
+- **WHEN** a per-artifact download fails with a network error (connection timeout, receive error)
+- **THEN** `checkTriggerUpgrade()` SHALL return `DIRECT_CDN_RETRY_ERR` (-2)
+
+#### Scenario: Permanent failure returns non-retryable code
+- **WHEN** a per-artifact download fails with a validation error or HTTP 404
+- **THEN** `checkTriggerUpgrade()` SHALL return -1 (non-retryable)
+
+### Requirement: Context Struct Direct CDN Flag
+The `RdkUpgradeContext_t` struct SHALL include a `bool direct_cdn` field that, when set to true, causes the download engine to skip the Codebig fallback chain and use the artifact URL directly.
+
+#### Scenario: direct_cdn flag set
+- **WHEN** `rdkv_upgrade_request()` is called with `context->direct_cdn == true`
+- **THEN** the download SHALL attempt only the direct URL (no mTLS → Codebig fallback chain)
+
+#### Scenario: direct_cdn flag not set (default)
+- **WHEN** `rdkv_upgrade_request()` is called with `context->direct_cdn == false`
+- **THEN** the download SHALL use the existing fallback chain (mTLS → direct → Codebig)
+
+### Requirement: One-Shot Integration
+The one-shot binary SHALL invoke `DirectCDNDownload()` when Direct CDN is enabled, replacing the legacy `MakeXconfComms()` → `checkTriggerUpgrade()` path.
+
+#### Scenario: Direct CDN path in one-shot
+- **WHEN** the one-shot binary detects `isDirectCDNEnabled() == true` after initial validation
+- **THEN** it SHALL call `DirectCDNDownload()` instead of the legacy XConf→download path
+
+#### Scenario: Legacy path when disabled
+- **WHEN** the one-shot binary detects `isDirectCDNEnabled() == false`
+- **THEN** it SHALL use the existing `MakeXconfComms()` → `processJsonResponse()` → `checkTriggerUpgrade(response, model, 0)` path unchanged
+
+### Requirement: Daemon Integration
+The daemon SHALL set `context.direct_cdn = true` on `RdkUpgradeContext_t` when Direct CDN is enabled, causing firmware downloads to bypass Codebig and use per-artifact URLs.
+
+#### Scenario: Daemon uses Direct CDN flag
+- **WHEN** the daemon's `DownloadFirmware` handler constructs an `RdkUpgradeContext_t` and `isDirectCDNEnabled()` returns true
+- **THEN** it SHALL set `context.direct_cdn = true` and populate `context.artifactLocationUrl` from the cached per-artifact URL in `XCONFRES`
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/download-engine/spec.md b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/download-engine/spec.md
new file mode 100755
index 00000000..162f7cc1
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/download-engine/spec.md
@@ -0,0 +1,19 @@
+## ADDED Requirements
+
+### Requirement: Direct CDN download mode skips Codebig fallback
+When the `direct_cdn` flag is set in `RdkUpgradeContext_t`, the download engine SHALL attempt only the direct URL download without the mTLS → direct → Codebig fallback chain.
+
+#### Scenario: direct_cdn true bypasses Codebig
+- **WHEN** `rdkv_upgrade_request()` is called with `context->direct_cdn == true`
+- **THEN** the engine SHALL perform a single direct HTTPS download attempt using `context->artifactLocationUrl` without Codebig signing or fallback
+
+#### Scenario: direct_cdn false preserves existing fallback
+- **WHEN** `rdkv_upgrade_request()` is called with `context->direct_cdn == false`
+- **THEN** the engine SHALL execute the existing fallback chain: mTLS → direct → Codebig (unchanged behavior)
+
+### Requirement: RdkUpgradeContext_t includes direct_cdn field
+The `RdkUpgradeContext_t` structure SHALL include a `bool direct_cdn` field. Callers that zero-initialize the struct SHALL get `false` (legacy behavior) by default.
+
+#### Scenario: Zero-initialized context defaults to legacy
+- **WHEN** a caller creates `RdkUpgradeContext_t ctx = {0}` without setting `direct_cdn`
+- **THEN** `ctx.direct_cdn` SHALL be false, preserving the full fallback chain behavior
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/firmware-validation/spec.md b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/firmware-validation/spec.md
new file mode 100755
index 00000000..08fc5cf0
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/firmware-validation/spec.md
@@ -0,0 +1,34 @@
+## ADDED Requirements
+
+### Requirement: XCONFRES struct extended with per-artifact URL fields
+The `XCONFRES` structure SHALL include `firmwareUrl`, `pdriUrl`, and `remCtrlUrl` fields for storing per-artifact download URLs received from the enriched XConf response.
+
+#### Scenario: Per-artifact URL fields present in struct
+- **WHEN** the `XCONFRES` struct is allocated
+- **THEN** it SHALL contain `char firmwareUrl[CLD_URL_MAX_LEN]`, `char pdriUrl[CLD_URL_MAX_LEN]`, and `char remCtrlUrl[CLD_URL_MAX_LEN]` fields
+
+### Requirement: Conditional XConf response parsing based on Direct CDN mode
+The `getXconfRespData()` function SHALL parse per-artifact URL fields from XConf JSON when Direct CDN is enabled, and use legacy parsing when disabled.
+
+#### Scenario: Direct CDN enabled parses per-artifact URLs
+- **WHEN** `getXconfRespData()` is called and `rfc_list.rfc_directcdn` is `"true"`
+- **THEN** it SHALL parse `firmware_URL`, `additionalFwVerInfo_URL`, and `<peripheralProduct>_URL` from the JSON response
+
+#### Scenario: Direct CDN disabled uses legacy peripheral parsing
+- **WHEN** `getXconfRespData()` is called and `rfc_list.rfc_directcdn` is not `"true"`
+- **THEN** it SHALL use `GetJsonValContaining("remCtrl", ...)` for peripheral firmware discovery (existing behavior)
+
+### Requirement: PDRI image filename validation
+The `processJsonResponse()` function SHALL validate that a PDRI image filename contains the `_PDRI_` substring. If the substring is absent, the PDRI image SHALL be considered invalid.
+
+#### Scenario: Valid PDRI filename accepted
+- **WHEN** `processJsonResponse()` processes a response where `cloudPDRIVersion` contains `_PDRI_`
+- **THEN** the PDRI image SHALL be considered valid for download
+
+#### Scenario: Invalid PDRI filename rejected
+- **WHEN** `processJsonResponse()` processes a response where `cloudPDRIVersion` does NOT contain `_PDRI_`
+- **THEN** the PDRI image SHALL be marked invalid and SHALL NOT be downloaded
+
+#### Scenario: Empty PDRI version skipped
+- **WHEN** `processJsonResponse()` processes a response where `cloudPDRIVersion` is empty
+- **THEN** PDRI SHALL be skipped entirely (no validation needed)
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/retry-recovery/spec.md b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/retry-recovery/spec.md
new file mode 100755
index 00000000..6146c900
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/retry-recovery/spec.md
@@ -0,0 +1,53 @@
+## ADDED Requirements
+
+### Requirement: Direct CDN per-artifact selective retry
+The Direct CDN orchestrator SHALL implement a per-artifact retry mechanism: only artifacts that failed with a transient error are re-attempted on subsequent iterations.
+
+#### Scenario: Successful artifact not re-attempted
+- **WHEN** PCI download succeeds on iteration 1 but PDRI fails with a transient error
+- **THEN** on iteration 2 the orchestrator SHALL skip PCI and only re-attempt PDRI
+
+#### Scenario: Maximum 3 retry iterations
+- **WHEN** an artifact fails with a transient error on all iterations
+- **THEN** the orchestrator SHALL attempt at most 3 total iterations before declaring failure
+
+#### Scenario: Both PCI and PDRI succeed stops retry loop
+- **WHEN** both PCI and PDRI downloads succeed within a retry iteration
+- **THEN** the orchestrator SHALL exit the retry loop immediately regardless of peripheral status
+
+### Requirement: Transient vs permanent failure classification
+The per-artifact download mode SHALL classify errors as transient (retryable) or permanent (non-retryable) based on the curl error code.
+
+#### Scenario: Connection timeout is transient
+- **WHEN** `rdkv_upgrade_request()` returns `CURLE_OPERATION_TIMEDOUT`
+- **THEN** the per-artifact caller SHALL return `DIRECT_CDN_RETRY_ERR` (retryable)
+
+#### Scenario: Connection refused is transient
+- **WHEN** `rdkv_upgrade_request()` returns `CURLE_COULDNT_CONNECT`
+- **THEN** the per-artifact caller SHALL return `DIRECT_CDN_RETRY_ERR` (retryable)
+
+#### Scenario: Receive error is transient
+- **WHEN** `rdkv_upgrade_request()` returns `CURLE_RECV_ERROR`
+- **THEN** the per-artifact caller SHALL return `DIRECT_CDN_RETRY_ERR` (retryable)
+
+#### Scenario: HTTP 404 is permanent
+- **WHEN** the HTTP response code is 404
+- **THEN** the per-artifact caller SHALL return -1 (non-retryable, permanent failure)
+
+### Requirement: XConf re-query per retry iteration
+The Direct CDN orchestrator SHALL perform a fresh XConf query on each retry iteration to obtain current per-artifact URLs.
+
+#### Scenario: Fresh XConf data per iteration
+- **WHEN** the retry loop begins a new iteration
+- **THEN** it SHALL call `rdkv_upgrade_request()` with `XCONF_UPGRADE` type and re-parse the response before attempting per-artifact downloads
+
+### Requirement: Peripheral failure does not block overall success
+Peripheral download failure SHALL NOT prevent the overall `DirectCDNDownload()` from reporting success, provided PCI and PDRI both succeeded.
+
+#### Scenario: PCI+PDRI success with peripheral failure
+- **WHEN** PCI and PDRI downloads succeed but peripheral download fails
+- **THEN** `DirectCDNDownload()` SHALL return 0 (success)
+
+#### Scenario: Peripheral retried within loop but non-blocking
+- **WHEN** peripheral download fails on one iteration
+- **THEN** it SHALL be re-attempted on subsequent iterations but SHALL NOT contribute to the retry-gate condition
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/updater-execution/spec.md b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/updater-execution/spec.md
new file mode 100755
index 00000000..9e5cce02
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/specs/updater-execution/spec.md
@@ -0,0 +1,42 @@
+## ADDED Requirements
+
+### Requirement: checkTriggerUpgrade supports per-artifact mode
+The `checkTriggerUpgrade()` function SHALL accept an `upgrade_type` parameter that specifies whether to process all artifact types (legacy) or a single specific artifact type (per-artifact mode).
+
+#### Scenario: Legacy mode (upgrade_type = 0)
+- **WHEN** `checkTriggerUpgrade(response, model, 0)` is called
+- **THEN** the function SHALL process all available artifact types sequentially (PCI → PDRI → Peripheral) using existing behavior
+
+#### Scenario: Per-artifact mode (upgrade_type = PCI_UPGRADE)
+- **WHEN** `checkTriggerUpgrade(response, model, PCI_UPGRADE)` is called
+- **THEN** the function SHALL process only the PCI firmware download using `response->firmwareUrl`
+
+#### Scenario: Per-artifact mode (upgrade_type = PDRI_UPGRADE)
+- **WHEN** `checkTriggerUpgrade(response, model, PDRI_UPGRADE)` is called
+- **THEN** the function SHALL process only the PDRI firmware download using `response->pdriUrl`
+
+#### Scenario: Per-artifact mode (upgrade_type = PERIPHERAL_UPGRADE)
+- **WHEN** `checkTriggerUpgrade(response, model, PERIPHERAL_UPGRADE)` is called
+- **THEN** the function SHALL process only the peripheral firmware download using `response->remCtrlUrl`
+
+### Requirement: One-shot branching on Direct CDN
+The one-shot binary `rdkvfwupgrader` SHALL branch its firmware update pipeline based on `isDirectCDNEnabled()` after initial validation.
+
+#### Scenario: Direct CDN path replaces legacy orchestration
+- **WHEN** initial validation passes and `isDirectCDNEnabled()` returns true
+- **THEN** the one-shot binary SHALL call `DirectCDNDownload()` instead of the legacy `MakeXconfComms()` → `processJsonResponse()` → `checkTriggerUpgrade(..., 0)` sequence
+
+#### Scenario: Legacy path preserved when disabled
+- **WHEN** initial validation passes and `isDirectCDNEnabled()` returns false
+- **THEN** the one-shot binary SHALL execute the existing legacy path unchanged: `MakeXconfComms()` → `processJsonResponse()` → `checkTriggerUpgrade(response, model, 0)`
+
+### Requirement: DirectCDNDownload is a new source file
+The `DirectCDNDownload()` orchestrator SHALL be implemented in a separate source file `src/directcdn.c` and linked into the `rdkvfwupgrader` binary via `Makefile.am`.
+
+#### Scenario: Build system includes directcdn.c
+- **WHEN** the project is compiled
+- **THEN** `src/directcdn.c` SHALL be included in `rdkvfwupgrader_SOURCES` in `Makefile.am`
+
+#### Scenario: Function callable from one-shot and daemon
+- **WHEN** `DirectCDNDownload()` is declared in a header
+- **THEN** both the one-shot binary and daemon binary SHALL be able to call it
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-adoption/tasks.md b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/tasks.md
new file mode 100755
index 00000000..3989ba22
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-adoption/tasks.md
@@ -0,0 +1,62 @@
+## 1. RFC Feature Gate
+
+- [x] 1.1 Add `rfc_directcdn[RFC_VALUE_BUF_SIZE]` field to `Rfc_t` struct in `src/include/rfcinterface.h`
+- [x] 1.2 Add `#define RFC_DIRECTCDN` macro in `src/include/rfcinterface.h`
+- [x] 1.3 Implement `isDirectCDNEnabled()` function in `src/rfcInterface/rfcinterface.c`
+- [x] 1.4 Add `rfc_directcdn` read to `getRFCSettings()` in `src/rfcInterface/rfcinterface.c`
+- [x] 1.5 Add L1 unit tests for `isDirectCDNEnabled()` (true/false/absent cases)
+
+## 2. XConf URL Path Branching & Codebig Bypass
+
+- [x] 2.1 Modify `GetServURL()` in `src/deviceutils/device_api.c` to branch URL path on `isDirectCDNEnabled()`
+- [x] 2.2 Modify `checkCodebigAccess()` in `src/device_status_helper.c` to return false when Direct CDN enabled
+- [x] 2.3 Add L1 unit tests for `GetServURL()` path branching
+- [x] 2.4 Add L1 unit tests for `checkCodebigAccess()` bypass
+
+## 3. Enriched XConf Response Parsing
+
+- [x] 3.1 Add `firmwareUrl`, `pdriUrl`, `remCtrlUrl` fields to `XCONFRES` in `src/include/json_process.h`
+- [x] 3.2 Add conditional per-artifact URL parsing to `getXconfRespData()` in `src/json_process.c`
+- [x] 3.3 Add `getPeripheralProduct()` function to `src/deviceutils/deviceutils.c` and declare in `deviceutils.h`
+- [x] 3.4 Cache peripheral product in `BuildRemoteInfo()` in `src/deviceutils/deviceutils.c`
+- [x] 3.5 Add PDRI `_PDRI_` substring validation in `processJsonResponse()` in `src/json_process.c`
+- [x] 3.6 Add L1 unit tests for enriched parsing (directCdn=true and directCdn=false)
+- [x] 3.7 Add L1 unit tests for `getPeripheralProduct()` and PDRI validation
+
+## 4. Per-Artifact Download Orchestration
+
+- [x] 4.1 Add `bool direct_cdn` field to `RdkUpgradeContext_t` in `src/include/rdkv_upgrade.h`
+- [x] 4.2 Add `DIRECT_CDN_RETRY_ERR` define to `src/include/rdkv_cdl.h`
+- [x] 4.3 Change `checkTriggerUpgrade()` signature to add `int upgrade_type` parameter in `src/include/rdkv_cdl.h`
+- [x] 4.4 Update `checkTriggerUpgrade()` implementation in `src/rdkv_main.c` for per-artifact mode
+- [x] 4.5 Update existing callers of `checkTriggerUpgrade()` to pass `upgrade_type=0` (legacy mode)
+- [x] 4.6 Create `src/directcdn.c` with `DirectCDNDownload()` orchestrator function
+- [x] 4.7 Create header declaration for `DirectCDNDownload()` (in `src/include/rdkv_cdl.h` or new header)
+- [x] 4.8 Add `src/directcdn.c` to `Makefile.am` (`rdkvfwupgrader_SOURCES`)
+
+## 5. One-Shot & Daemon Integration
+
+- [x] 5.1 Add Direct CDN branch in one-shot main flow (`src/rdkv_main.c`) after `initialValidation()`
+- [x] 5.2 Set `context.direct_cdn = true` in daemon download handler (`src/dbus/rdkFwupdateMgr_handlers.c`)
+- [x] 5.3 Modify `rdkv_upgrade_request()` to skip Codebig fallback when `context->direct_cdn == true`
+
+## 6. Selective Retry Logic
+
+- [x] 6.1 Implement transient vs permanent error classification in per-artifact `checkTriggerUpgrade()` path
+- [x] 6.2 Verify retry loop in `DirectCDNDownload()` correctly skips succeeded artifacts
+- [x] 6.3 Add L1 unit tests for retry scenarios (fail→fail→succeed, permanent failure, max retry exceeded)
+
+## 7. L1 Unit Tests (Integration)
+
+- [x] 7.1 Add `DirectCDNDownload()` unit tests to `unittest/` (mock XConf + per-artifact downloads)
+- [ ] 7.2 Update `getRFCParameter` mock `Times()` expectations in existing tests
+- [ ] 7.3 Add `checkTriggerUpgrade()` per-artifact mode unit tests
+- [ ] 7.4 Verify all existing unit tests still pass with signature changes
+
+## 8. L2 Functional Tests & Validation
+
+- [ ] 8.1 Create `test/functional-tests/tests/test_directcdn_download.py` with RFC on/off scenarios
+- [ ] 8.2 Update `run_l2.sh` to set Direct CDN RFC parameter
+- [ ] 8.3 Run full L1 regression suite in Docker
+- [ ] 8.4 Run full L2 regression suite in Docker
+- [ ] 8.5 Static analysis (Coverity) clean check
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/.openspec.yaml b/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/.openspec.yaml
new file mode 100755
index 00000000..1194417e
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-05-29
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/design.md b/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/design.md
new file mode 100755
index 00000000..91e670cc
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/design.md
@@ -0,0 +1,151 @@
+## Context
+
+PR #249 (`topic/RDKEMW-9150`) implements the Direct CDN adoption (per `openspec/changes/direct-cdn-adoption/`). The implementation refactored the monolithic positional-parameter API from PR #120 into the context-struct architecture (`RdkUpgradeContext_t` → `rdkv_upgrade_request()`).
+
+During review-readiness validation, three defense-in-depth behaviors present in PR #120 were found to be absent or weakened in PR #249's refactored implementation:
+
+1. **Codebig entry-point guard**: PR #120's `codebigdownloadFile()` returns immediately if `rfc_directcdn=="true"`. PR #249's `codebigdownloadFile()` in `src/rdkv_upgrade.c` has no such guard — it relies solely on the `context->direct_cdn` check at line 522 (fallback path). The `isDwnlBlock()` flip at line 382 can redirect a DIRECT request to CODEBIG, bypassing the fallback guard entirely.
+
+2. **PDRI `.bin` normalization**: PR #120 normalizes `cloudPDRIVersion` (appends `.bin` if missing) BEFORE the Direct CDN URL branch, so both legacy and Direct CDN paths get the normalized filename. PR #249's per-artifact switch in `checkTriggerUpgrade()` uses `pResponse->cloudPDRIVersion` raw — no `.bin` normalization.
+
+3. **HTTP 403 retryable classification**: PR #120 classifies HTTP 403 as `DIRECT_CDN_RETRY_ERR` (token expiry → retryable, triggers XConf re-query). PR #249's per-artifact error classification only lists curl errors + HTTP 502/503 as retryable; HTTP 403 falls through to permanent failure.
+
+### Constraints
+
+- All three fixes MUST be additive guards/classifications — no control-flow restructuring
+- MUST NOT change any function signatures, struct layouts, or Makefile dependencies
+- MUST NOT modify behavior when `direct_cdn == false` (legacy path unchanged)
+- MUST NOT alter existing `direct-cdn-adoption` task list or design decisions
+- The existing OpenSpec proposal D1/D2/D3/D4/D5/D6 decisions remain unchanged
+
+---
+
+## Goals / Non-Goals
+
+**Goals:**
+- Restore behavioral parity with PR #120 for the three identified defense-in-depth mechanisms
+- Enable PR #249 to pass review without "weaker than reference" objections on these points
+- Keep each fix independently reviewable and independently testable
+
+**Non-Goals:**
+- Refactoring `codebigdownloadFile()` or `rdkv_upgrade_request()` internals
+- Adding new retry layers beyond what PR #120 provided
+- Addressing Copilot review comments that are inherited patterns (C1/C2/C9/C10/C11)
+- Addressing comments that were already resolved (C3/C4) or incorrect (C6)
+- Changing the `isDwnlBlock()` mechanism itself (pre-existing platform infrastructure)
+
+---
+
+## Decisions
+
+### PG-1: Codebig guard placement — top of `codebigdownloadFile()` (straightforward parity)
+
+**Decision:** Add a 2-line early-return guard at the top of `codebigdownloadFile()` in `src/rdkv_upgrade.c`, after the null-check block and before any Codebig signing logic:
+
+```c
+if (context->direct_cdn) {
+    SWLOG_INFO("%s: Direct CDN mode - Codebig path not permitted, returning\n", __FUNCTION__);
+    return -1;
+}
+```
+
+**Rationale:** This is the exact behavioral equivalent of PR #120's:
+```c
+if (strncmp(rfc_list.rfc_directcdn, "true", 4) == 0) { return -1; }
+```
+The only difference is using `context->direct_cdn` (PR #249's D1 pattern) instead of re-reading the RFC global. The context field is always set from `isDirectCDNEnabled()` at call-site initialization, so the semantic is identical.
+
+**Why this location:** The guard must be inside `codebigdownloadFile()` (not at the call site in `rdkv_upgrade_request()`) because the `isDwnlBlock()` flip changes `server_type` BEFORE the branch that selects `codebigdownloadFile()` vs `downloadFile()`. The existing fallback-path guard at line 522 only covers the "direct failed → consider Codebig" path, not the "operator-blocked DIRECT → forced CODEBIG" path.
+
+**Design sensitivity:** None. This is a direct behavioral port of an existing proven guard.
+
+**Alternative considered:** Guard at the `isDwnlBlock()` flip point (suppress flip when `direct_cdn==true`). Rejected — `isDwnlBlock()` is a pre-existing platform mechanism used for operational overrides; suppressing it may have unintended side effects for operator tooling. The entry-point guard is safer because it only prevents the Codebig-specific download path, allowing `isDwnlBlock()` to continue functioning for other operational purposes.
+
+---
+
+### PG-2: PDRI `.bin` normalization in per-artifact path (design-sensitive)
+
+**Decision:** Add `.bin` suffix normalization for `artifact_file` in the `PDRI_UPGRADE` case of the per-artifact switch in `checkTriggerUpgrade()` (`src/rdkv_main.c`), using the same logic as the legacy path:
+
+```c
+case PDRI_UPGRADE:
+    artifact_url = pResponse->pdriUrl;
+    artifact_file = pResponse->cloudPDRIVersion;
+    /* Normalize: ensure .bin suffix for local filename (parity with legacy path) */
+    {
+        size_t len = strlen(artifact_file);
+        if (len > 0 && len < (sizeof(dwlpath_filename) - 5)) {
+            if (strstr(artifact_file, ".bin") == NULL) {
+                snprintf(dwlpath_filename, sizeof(dwlpath_filename), "%s/%s.bin",
+                         device_info.difw_path, artifact_file);
+            } else {
+                snprintf(dwlpath_filename, sizeof(dwlpath_filename), "%s/%s",
+                         device_info.difw_path, artifact_file);
+            }
+        }
+    }
+    break;
+```
+
+**Rationale:** PR #120 normalizes `cloudPDRIVersion` before any URL-path branching, using:
+```c
+if (strstr(cloudPDRIVersion, ".bin") == NULL) {
+    strncat(cloudPDRIVersion, ".bin", sizeof(cloudPDRIVersion) - strlen(cloudPDRIVersion) - 1);
+}
+```
+PR #249's per-artifact case currently does `snprintf(dwlpath_filename, ..., "%s/%s", path, artifact_file)` without `.bin` check.
+
+**Design sensitivity:** **Medium**. Two open questions:
+1. Should normalization modify `artifact_file` in place (as PR #120 does on `cloudPDRIVersion`) or construct the normalized path directly into `dwlpath_filename`? The latter is safer (doesn't mutate shared `XCONFRES` data) but diverges slightly from PR #120's approach.
+2. Does the XConf server in Direct CDN mode guarantee `.bin` suffix on `additionalFwVerInfo` responses? If so, this guard is defensive-only and never fires. If not, it's functionally necessary.
+
+**Recommended approach:** Construct normalized path into `dwlpath_filename` (option 2) — avoids mutating the `XCONFRES` struct which may be re-used across retry iterations in `DirectCDNDownload()`.
+
+**Assumption to confirm:** The normalization only affects the LOCAL save path (filesystem filename), NOT the download URL. The URL comes from `pResponse->pdriUrl` and is used as-is (the CDN URL already knows the correct remote filename).
+
+---
+
+### PG-3: HTTP 403 retry classification (straightforward parity)
+
+**Decision:** Add HTTP 403 to the retryable-error classification in the per-artifact download result handling within `checkTriggerUpgrade()` (`src/rdkv_main.c`), immediately after the existing HTTP 502/503 check:
+
+```c
+/* Transient HTTP-level failures → retryable (server-side temporary errors) */
+if (curl_ret == 0 && (http_code == 502 || http_code == 503)) {
+    SWLOG_WARN("%s: upgrade_type %d transient HTTP %d, retryable\n",
+               __FUNCTION__, upgrade_type, http_code);
+    return DIRECT_CDN_RETRY_ERR;
+}
+/* HTTP 403 → retryable (token expiry, requires fresh XConf query for new URL) */
+if (curl_ret == 0 && http_code == 403) {
+    SWLOG_WARN("%s: upgrade_type %d HTTP 403 (token expired), retryable\n",
+               __FUNCTION__, upgrade_type, http_code);
+    return DIRECT_CDN_RETRY_ERR;
+}
+```
+
+**Rationale:** In Direct CDN mode, per-artifact URLs are signed/tokenized by XConf. HTTP 403 means the token has expired. PR #120 explicitly returns `DIRECT_CDN_RETRY_ERR` for 403, which causes `DirectCDNDownload()` to re-query XConf (fresh tokens) and re-attempt the download. Without this, a temporary token expiry becomes a permanent failure requiring full process re-invocation.
+
+**Design sensitivity:** None. This is a direct behavioral port. The `DirectCDNDownload()` retry loop already handles `DIRECT_CDN_RETRY_ERR` correctly — it re-queries XConf on each iteration, which provides fresh URLs with fresh tokens.
+
+**Alternative considered:** Only classify 403 as retryable when `context->direct_cdn == true`. Rejected — the per-artifact path is ONLY entered when `upgrade_type != LEGACY_ALL_UPGRADE`, which only happens from `DirectCDNDownload()` where `direct_cdn` is always true. No disambiguation needed.
+
+---
+
+## Risks / Trade-offs
+
+| Risk | Mitigation |
+|------|-----------|
+| PG-1 returns -1 on Codebig path — caller may interpret as download error and retry inappropriately | The return from `codebigdownloadFile()` is -1 (same as existing failure path). In Direct CDN mode the `isDwnlBlock()` scenario is highly unlikely (requires operator to manually block DIRECT while Direct CDN is RFC-enabled). Even if it fires, the per-artifact retry path classifies this as a permanent curl failure and stops retrying. |
+| PG-2 normalization fires on a filename that already has `.bin` | The `strstr(artifact_file, ".bin")` check prevents double-append. Safe no-op. |
+| PG-2 normalizes filename that intentionally omits `.bin` (future XConf schema change) | Defensive only — if XConf guarantees `.bin`, the guard never fires. If it doesn't, this is necessary for local filesystem correctness. Either way, safe. |
+| PG-3 classifies non-token-related 403 as retryable (e.g., ACL denial) | In Direct CDN mode, 403 from CDN endpoints is always token-related (URLs are pre-signed with time-limited tokens). ACL-style 403 would come from XConf itself, not from per-artifact CDN downloads. |
+| Retry churn from 403 re-query loop if tokens always expire immediately | Max 3 iterations (existing `DirectCDNDownload()` cap). After 3 failed iterations, permanent failure. |
+
+## Open Questions
+
+1. **PG-2 XConf server guarantee**: Does the Direct CDN XConf response always include `.bin` suffix on `additionalFwVerInfo` (PDRI filename)? If confirmed, the normalization is purely defensive and can be documented as such in the reviewer response.
+
+2. **PG-1 return value**: Should the early-return from `codebigdownloadFile()` return -1 (generic failure) or a distinct error code like `DIRECT_CDN_BLOCKED`? Returning -1 is simplest and matches PR #120's approach, but a distinct code would aid debugging if this path ever fires in production.
+
+3. **PG-2 scope**: Should the normalization also apply to `PERIPHERAL_UPGRADE` case? PR #120 only normalizes PDRI; peripheral filenames have different naming conventions. Current recommendation: PDRI only (matching PR #120 exactly).
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/proposal.md b/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/proposal.md
new file mode 100755
index 00000000..040417bd
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/proposal.md
@@ -0,0 +1,29 @@
+## Why
+
+PR #249 refactored Direct CDN support into the context-struct architecture (`rdkv_upgrade_request()` / `RdkUpgradeContext_t`) but lost three defense-in-depth behaviors that PR #120 (the behavioral reference for RDKE-874) explicitly provided. These gaps create reviewer-visible behavioral regressions that prevent PR #249 from reaching review-ready status. This is a minimal parity-restoration patch — not a refactor or cleanup.
+
+## What Changes
+
+- Add `context->direct_cdn` early-return guard at the top of `codebigdownloadFile()` in `src/rdkv_upgrade.c` to prevent Direct CDN requests from ever entering the Codebig signing/download path (parity with PR #120's `codebigdownloadFile()` early-return guard for `rfc_directcdn`)
+- Add `.bin` filename normalization for PDRI in the per-artifact branch of `checkTriggerUpgrade()` in `src/rdkv_main.c` so that `cloudPDRIVersion` is always normalized before use as a local save filename (parity with PR #120's pre-branch normalization)
+- Add HTTP 403 to the retryable-error classification in the per-artifact download result handling within `checkTriggerUpgrade()` in `src/rdkv_main.c` (parity with PR #120's `DIRECT_CDN_RETRY_ERR` classification for token-expiry 403s)
+
+## Capabilities
+
+### New Capabilities
+
+(none — no new capabilities introduced)
+
+### Modified Capabilities
+
+- `download-engine`: Add Codebig entry-point guard that short-circuits when `direct_cdn=true`; this is a defense-in-depth requirement for the Direct CDN path
+- `retry-recovery`: Add HTTP 403 as a retryable transient error for Direct CDN per-artifact downloads (token-expiry retry)
+- `firmware-validation`: Ensure PDRI filename normalization (`.bin` suffix) applies in per-artifact mode, same as legacy mode
+
+## Impact
+
+- **Files modified**: `src/rdkv_upgrade.c` (codebig guard), `src/rdkv_main.c` (PDRI normalization + 403 retry)
+- **API changes**: None — no signature or struct changes
+- **Test impact**: Existing L1 tests for `codebigdownloadFile()` may need `direct_cdn=true` path assertion; per-artifact retry gtest needs 403 scenario
+- **Risk**: Low — all three changes are additive guards/classifications, not control-flow restructuring
+- **Scope boundary**: Does NOT touch `directcdn.c`, `json_process.c`, daemon handlers, RFC gate, XConf parsing, or any other existing working code paths
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/specs/download-engine/spec.md b/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/specs/download-engine/spec.md
new file mode 100755
index 00000000..834b6ed0
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/specs/download-engine/spec.md
@@ -0,0 +1,16 @@
+## ADDED Requirements
+
+### Requirement: Codebig entry-point guard for Direct CDN mode
+The `codebigdownloadFile()` function SHALL reject requests where `context->direct_cdn == true` by returning immediately before any Codebig signing or download logic executes. This provides defense-in-depth against `isDwnlBlock()` server_type flips that could redirect a Direct CDN download into the Codebig path.
+
+#### Scenario: Direct CDN request blocked at Codebig entry point
+- **WHEN** `codebigdownloadFile()` is called with `context->direct_cdn == true`
+- **THEN** the function SHALL log an informational message and return -1 without performing any Codebig URL signing or download attempt
+
+#### Scenario: Non-Direct-CDN request proceeds normally
+- **WHEN** `codebigdownloadFile()` is called with `context->direct_cdn == false`
+- **THEN** the function SHALL proceed with its existing Codebig signing and download logic unchanged
+
+#### Scenario: isDwnlBlock flip does not bypass guard
+- **WHEN** `isDwnlBlock()` flips `server_type` from `HTTP_SSR_DIRECT` to `HTTP_SSR_CODEBIG` AND `context->direct_cdn == true`
+- **THEN** the resulting call to `codebigdownloadFile()` SHALL still be blocked by the entry-point guard
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/specs/firmware-validation/spec.md b/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/specs/firmware-validation/spec.md
new file mode 100755
index 00000000..cc54d675
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/specs/firmware-validation/spec.md
@@ -0,0 +1,20 @@
+## ADDED Requirements
+
+### Requirement: PDRI filename normalization in per-artifact mode
+The per-artifact download path for `PDRI_UPGRADE` in `checkTriggerUpgrade()` SHALL normalize the PDRI filename by appending `.bin` suffix if not already present, before constructing the local save path. This ensures the local filesystem filename is consistent regardless of whether the XConf response includes the `.bin` extension.
+
+#### Scenario: PDRI filename without .bin gets normalized
+- **WHEN** `checkTriggerUpgrade()` processes `PDRI_UPGRADE` and `pResponse->cloudPDRIVersion` does NOT contain `.bin`
+- **THEN** the local download path SHALL be constructed as `<difw_path>/<cloudPDRIVersion>.bin`
+
+#### Scenario: PDRI filename with .bin used as-is
+- **WHEN** `checkTriggerUpgrade()` processes `PDRI_UPGRADE` and `pResponse->cloudPDRIVersion` already contains `.bin`
+- **THEN** the local download path SHALL be constructed as `<difw_path>/<cloudPDRIVersion>` without additional suffix
+
+#### Scenario: Normalization applies only to local save path
+- **WHEN** PDRI `.bin` normalization is applied
+- **THEN** it SHALL only affect the local filesystem path (`dwlpath_filename`) and SHALL NOT modify the download URL (`artifact_url` / `pResponse->pdriUrl`)
+
+#### Scenario: Normalization does not apply to PCI or Peripheral artifacts
+- **WHEN** `checkTriggerUpgrade()` processes `PCI_UPGRADE` or `PERIPHERAL_UPGRADE`
+- **THEN** no `.bin` normalization SHALL be applied (only PDRI requires this)
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/specs/retry-recovery/spec.md b/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/specs/retry-recovery/spec.md
new file mode 100755
index 00000000..c42b59ff
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/specs/retry-recovery/spec.md
@@ -0,0 +1,17 @@
+## ADDED Requirements
+
+### Requirement: HTTP 403 classified as retryable for Direct CDN per-artifact downloads
+The per-artifact download error classification SHALL treat HTTP 403 as a transient retryable error (`DIRECT_CDN_RETRY_ERR`) when operating in Direct CDN per-artifact mode. This enables the `DirectCDNDownload()` retry loop to re-query XConf for fresh token-bearing URLs.
+
+#### Scenario: HTTP 403 triggers retry with XConf re-query
+- **WHEN** a per-artifact download receives HTTP 403 response
+- **THEN** `checkTriggerUpgrade()` SHALL return `DIRECT_CDN_RETRY_ERR`
+- **AND** the `DirectCDNDownload()` orchestrator SHALL re-query XConf on the next iteration to obtain fresh per-artifact URLs
+
+#### Scenario: HTTP 403 respects maximum retry count
+- **WHEN** per-artifact downloads receive HTTP 403 on all retry iterations
+- **THEN** the orchestrator SHALL fail permanently after 3 total iterations (existing retry cap)
+
+#### Scenario: HTTP 404 remains permanent failure (unchanged)
+- **WHEN** a per-artifact download receives HTTP 404 response
+- **THEN** `checkTriggerUpgrade()` SHALL return -1 (permanent failure, non-retryable)
diff --git a/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/tasks.md b/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/tasks.md
new file mode 100755
index 00000000..030186fc
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-direct-cdn-parity-guards/tasks.md
@@ -0,0 +1,23 @@
+## 1. Codebig Entry-Point Guard (PG-1)
+
+- [x] 1.1 Add `context->direct_cdn` early-return guard at top of `codebigdownloadFile()` in `src/rdkv_upgrade.c` (after null-check block, before `server_type` local variable assignment)
+- [x] 1.2 Add L1 unit test: call `codebigdownloadFile()` with `context->direct_cdn = true`, assert returns -1 without curl activity
+- [x] 1.3 Add L1 unit test: call `codebigdownloadFile()` with `context->direct_cdn = false`, assert existing behavior unchanged
+
+## 2. PDRI Filename Normalization (PG-2)
+
+- [x] 2.1 Add `.bin` suffix check and normalization in `PDRI_UPGRADE` case of per-artifact switch in `checkTriggerUpgrade()` in `src/rdkv_main.c` (construct normalized path into `dwlpath_filename` without mutating `pResponse->cloudPDRIVersion`)
+- [x] 2.2 Add L1 unit test: PDRI per-artifact with `cloudPDRIVersion` lacking `.bin` → verify download path has `.bin` appended
+- [x] 2.3 Add L1 unit test: PDRI per-artifact with `cloudPDRIVersion` containing `.bin` → verify download path used as-is
+- [x] 2.4 Confirm PCI_UPGRADE and PERIPHERAL_UPGRADE cases are NOT affected by normalization
+
+## 3. HTTP 403 Retry Classification (PG-3)
+
+- [x] 3.1 Add `http_code == 403` to retryable classification in per-artifact result handling in `checkTriggerUpgrade()` in `src/rdkv_main.c` (after existing 502/503 block)
+- [x] 3.2 Add L1 unit test: per-artifact download returns HTTP 403 → assert `DIRECT_CDN_RETRY_ERR` returned
+- [x] 3.3 Add L1 unit test: per-artifact download returns HTTP 404 → assert permanent failure (-1) returned (regression guard)
+
+## 4. Validation
+
+- [ ] 4.1 Run full L1 unit test suite — confirm no regressions from parity guards
+- [ ] 4.2 Verify legacy path (`direct_cdn = false`) behavior unchanged in all three modified functions
diff --git a/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/.openspec.yaml b/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/.openspec.yaml
new file mode 100755
index 00000000..1194417e
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-05-29
diff --git a/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/design.md b/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/design.md
new file mode 100755
index 00000000..dcb33e05
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/design.md
@@ -0,0 +1,46 @@
+## Context
+
+`rdkfw_main_gtest` contains ~80 standalone `TEST()` cases in `basic_rdkv_main_gtest.cpp`. Many tests create a stack-local `DeviceUtilsMock DeviceMock`, assign `g_DeviceUtilsMock = &DeviceMock;`, and then let `DeviceMock` go out of scope without resetting the global pointer to `nullptr`. This was harmless until the Direct CDN work added an `isDirectCDNEnabled()` call inside `getXconfRespData()` (json_process.c). The mock dispatcher for `isDirectCDNEnabled()` (deviceutils_mock.cpp:224) performs a NULL check on `g_DeviceUtilsMock` then calls a virtual method on it — if the pointer is dangling, the vtable lookup segfaults.
+
+The immediately preceding test `flashImageTestMaintFalse` (line 1325) is the direct trigger: it sets `g_DeviceUtilsMock = &DeviceMock;`, only resets `global_mockexternal_ptr = NULL;`, and leaves `g_DeviceUtilsMock` dangling. The next test `getXconfResTest` (line 1340) calls `getXconfRespData()` → `isDirectCDNEnabled()` → crash.
+
+A secondary build error exists: `bin_PROGRAMS` in `unittest/Makefile.am` lists `rdkFwupdateMgr_async_main_flow_gtest` and `rdkFwupdateMgr_async_handlers_gtest` without `_SOURCES` definitions (introduced by commit ed0760d6). This causes a make error but does not block the tests that were already built.
+
+## Goals / Non-Goals
+
+**Goals:**
+- Eliminate the segfault in `rdkfw_main_gtest` by resetting `g_DeviceUtilsMock = nullptr` in all `flashImage*` tests that use stack-local mocks without cleanup.
+- Remove phantom `bin_PROGRAMS` entries to clear the secondary build error.
+- Unblock the L1 CI gate for PR #249.
+
+**Non-Goals:**
+- Refactoring tests to use gtest fixtures (TEST_F with SetUp/TearDown). This is a broader cleanup best done separately.
+- Modifying production code (`json_process.c`, `directcdn.c`, `deviceutils.c`, etc.).
+- Auditing the full test suite for other mock-leakage patterns beyond `g_DeviceUtilsMock` in this file.
+- Adding new test coverage for Direct CDN — that already exists in the same file.
+
+## Decisions
+
+### D1: Reset `g_DeviceUtilsMock` in all same-pattern `flashImage*` tests, not just the directly crashing one
+
+**Rationale:** Only `flashImageTestMaintFalse` is the *direct* trigger today, but six other `flashImage*` tests (lines 1197–1310) share the identical pattern: `g_DeviceUtilsMock = &DeviceMock;` + no cleanup. Any reordering of tests (e.g. `--gtest_shuffle`) or addition of a new `isDirectCDNEnabled()` call downstream would cause the same crash. Fixing them all (adding one line each) is trivially reviewable and prevents regression.
+
+**Alternative considered:** Fix only `flashImageTestMaintFalse`. Rejected because it creates a known latent defect in the adjacent tests and is likely to be flagged in review.
+
+### D2: Do NOT convert tests to TEST_F fixtures
+
+**Rationale:** Introducing a fixture class (`FlashImageTest` with `TearDown()`) is cleaner long-term but broadens the patch scope, touches many more lines, and risks rebasing conflicts with other in-flight PRs. The single-line `g_DeviceUtilsMock = nullptr;` cleanup is strictly additive and minimal.
+
+### D3: Include Makefile phantom cleanup in this patch
+
+**Rationale:** The two phantom `bin_PROGRAMS` entries (`rdkFwupdateMgr_async_main_flow_gtest`, `rdkFwupdateMgr_async_handlers_gtest`) are a 1-line Makefile edit and cause a visible build error in the same CI log. Reviewers would expect them to be addressed together. However, if the PR owner prefers, this can be split out — it's mechanically independent.
+
+### D4: No production code changes
+
+The segfault is purely a test-isolation defect. The `isDirectCDNEnabled()` mock implementation already has a NULL guard; the problem is that the dangling pointer bypasses it. No changes to `json_process.c`, `directcdn.c`, `rfcinterface.c`, or any `src/` file are needed.
+
+## Risks / Trade-offs
+
+- **[Risk] Other tests may have the same dangling-mock pattern for other globals (e.g. `global_mockexternal_ptr`).** → Mitigation: Out of scope. `global_mockexternal_ptr` is already reset to NULL in the affected tests. A broader audit can follow separately.
+- **[Risk] Fixing multiple tests instead of one increases diff size slightly.** → Mitigation: Each change is a single identical line (`g_DeviceUtilsMock = nullptr;`), trivially reviewable.
+- **[Risk] Makefile cleanup may conflict with other PRs adding `_SOURCES` for the phantom targets.** → Mitigation: If those targets are intended, the correct fix is adding `_SOURCES` rather than removing them. Check with the ed0760d6 author if unclear.
diff --git a/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/proposal.md b/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/proposal.md
new file mode 100755
index 00000000..8942bd3a
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/proposal.md
@@ -0,0 +1,26 @@
+## Why
+
+The L1 CI gate for PR #249 (`topic/RDKEMW-9150`) fails because `rdkfw_main_gtest` segfaults in `MainHelperFunctionTest.getXconfResTest`. The crash is caused by a dangling `g_DeviceUtilsMock` pointer left behind by a preceding test (`flashImageTestMaintFalse`). The recently added `isDirectCDNEnabled()` call in `getXconfRespData()` now dereferences that pointer, triggering a use-after-free. This is a test-isolation defect, not a production bug — the fix is strictly test-only.
+
+## What Changes
+
+- Reset `g_DeviceUtilsMock` to `nullptr` at the end of `flashImageTestMaintFalse` and the small set of adjacent `flashImage*` tests that share the same dangling-pointer pattern.
+- Remove the phantom `rdkFwupdateMgr_async_main_flow_gtest` and `rdkFwupdateMgr_async_handlers_gtest` entries from `bin_PROGRAMS` in `unittest/Makefile.am` (no `_SOURCES` defined; causes a secondary build error).
+- No production source changes. No new tests. No refactoring.
+
+## Capabilities
+
+### New Capabilities
+
+- `test-mock-isolation`: Ensure stack-local mock objects in `basic_rdkv_main_gtest.cpp` do not leave dangling global pointers after test completion.
+
+### Modified Capabilities
+
+(none — no spec-level behaviour changes)
+
+## Impact
+
+- **Code**: `unittest/basic_rdkv_main_gtest.cpp` (5–7 tests gain a cleanup line), `unittest/Makefile.am` (remove 2 phantom program names).
+- **APIs**: None.
+- **Dependencies**: None.
+- **Systems**: Unblocks the L1 CI gate for PR #249.
diff --git a/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/specs/test-mock-isolation/spec.md b/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/specs/test-mock-isolation/spec.md
new file mode 100755
index 00000000..f2f75183
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/specs/test-mock-isolation/spec.md
@@ -0,0 +1,23 @@
+## ADDED Requirements
+
+### Requirement: Stack-local DeviceUtilsMock cleanup
+Every TEST() in `basic_rdkv_main_gtest.cpp` that assigns `g_DeviceUtilsMock` to a stack-local `DeviceUtilsMock` object SHALL reset `g_DeviceUtilsMock = nullptr` before the test function returns.
+
+#### Scenario: flashImageTestMaintFalse does not leave dangling pointer
+- **WHEN** `flashImageTestMaintFalse` completes
+- **THEN** `g_DeviceUtilsMock` SHALL be `nullptr`
+
+#### Scenario: getXconfResTest succeeds after flashImage tests
+- **WHEN** `getXconfResTest` runs after any `flashImage*` test
+- **THEN** `isDirectCDNEnabled()` SHALL encounter `g_DeviceUtilsMock == nullptr`, return `false`, and the test SHALL pass without segfault
+
+#### Scenario: All flashImage tests reset mock pointer
+- **WHEN** any of `flashImageTest`, `flashImageTestRedState`, `flashImageTestFail`, `flashImageTestFail1`, `flashImageTestFail2`, `flashImageTestRebootTrue`, `flashImageTestPdri`, `flashImageTestMaintTrue`, or `flashImageTestMaintFalse` completes
+- **THEN** `g_DeviceUtilsMock` SHALL be `nullptr`
+
+### Requirement: No phantom bin_PROGRAMS without sources
+Every entry in `bin_PROGRAMS` in `unittest/Makefile.am` SHALL have a corresponding `_SOURCES` definition.
+
+#### Scenario: Phantom programs removed
+- **WHEN** `make` is invoked in the unittest directory
+- **THEN** automake SHALL NOT emit "No rule to make target" errors for any program listed in `bin_PROGRAMS`
diff --git a/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/tasks.md b/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/tasks.md
new file mode 100755
index 00000000..8a0ae87e
--- /dev/null
+++ b/openspec/changes/archive/2026-06-04-fix-l1-dangling-mock-segfault/tasks.md
@@ -0,0 +1,23 @@
+## 1. Fix dangling g_DeviceUtilsMock in flashImage tests
+
+- [x] 1.1 Add `g_DeviceUtilsMock = nullptr;` before the closing brace of `flashImageTest` (line ~1200)
+- [x] 1.2 Add `g_DeviceUtilsMock = nullptr;` before the closing brace of `flashImageTestRedState` (line ~1215)
+- [x] 1.3 Add `g_DeviceUtilsMock = nullptr;` before the closing brace of `flashImageTestFail` (line ~1231)
+- [x] 1.4 Add `g_DeviceUtilsMock = nullptr;` before the closing brace of `flashImageTestFail1` (line ~1247)
+- [x] 1.5 Add `g_DeviceUtilsMock = nullptr;` before the closing brace of `flashImageTestFail2` (line ~1263)
+- [x] 1.6 Add `g_DeviceUtilsMock = nullptr;` before the closing brace of `flashImageTestRebootTrue` (line ~1279)
+- [x] 1.7 Add `g_DeviceUtilsMock = nullptr;` before the closing brace of `flashImageTestPdri` (line ~1294)
+- [x] 1.8 Add `g_DeviceUtilsMock = nullptr;` before the closing brace of `flashImageTestMaintTrue` (line ~1310)
+- [x] 1.9 Add `g_DeviceUtilsMock = nullptr;` before the closing brace of `flashImageTestMaintFalse` (line ~1325)
+
+## 2. Remove phantom bin_PROGRAMS entries
+
+- [ ] 2.1 Remove `rdkFwupdateMgr_async_main_flow_gtest` and `rdkFwupdateMgr_async_handlers_gtest` from `bin_PROGRAMS` in `unittest/Makefile.am` (line 21)
+
+## 3. Validate
+
+- [ ] 3.1 Build `rdkfw_main_gtest` and confirm no compile errors
+- [ ] 3.2 Run `./rdkfw_main_gtest --gtest_filter=MainHelperFunctionTest.getXconfResTest` — must pass
+- [ ] 3.3 Run full `rdkfw_main_gtest` suite — all 123 tests must pass
+- [ ] 3.4 Run `make` in unittest/ — confirm no "No rule to make target" errors
+- [ ] 3.5 Run `./run_ut.sh` end-to-end — confirm "L1 TEST PASSED"
diff --git a/openspec/changes/fix-state-red-dual-instance-race/design.md b/openspec/changes/fix-state-red-dual-instance-race/design.md
new file mode 100755
index 00000000..1cdb8d78
--- /dev/null
+++ b/openspec/changes/fix-state-red-dual-instance-race/design.md
@@ -0,0 +1,78 @@
+## Context
+
+When `rdkvfwupgrader` encounters a fatal TLS/certificate error during firmware download, it enters "State Red" — a recovery mode where the device reboots and retries with special parameters. The current implementation of `checkAndEnterStateRed()` in `src/device_status_helper.c` calls `uninitialize()` (which deletes `/tmp/DIFD.pid` and destroys mutexes) but then only returns -1 to the caller instead of exiting the process.
+
+The caller chain (`dwnlError()` → `downloadFile()` → `rdkv_upgrade_request()`) does not propagate the "state red entered" condition, so `rdkv_upgrade_request()` proceeds into `retryDownload()` — keeping the process alive for `RETRY_COUNT * 60` seconds without a PID file. Meanwhile, `stateRedRecovery.sh` sees `/tmp/stateRedEnabled` and starts a second instance which passes `CurrentRunningInst()` since the PID file is gone.
+
+There are 3 call sites of `checkAndEnterStateRed()`, all in `src/rdkv_upgrade.c`:
+- **Site 1** (line ~199): inside `dwnlError()`, HTTP 495 path
+- **Site 2** (line ~204): inside `dwnlError()`, curl error path
+- **Site 3** (line ~1052): inside `downloadFile()`, `MTLS_CERT_FETCH_FAILURE` path
+
+Site 3 already returns immediately after calling `checkAndEnterStateRed()`, but it returns `curl_ret_code` (-1) which is not a recognized short-circuit code — so the caller (`rdkv_upgrade_request()`) still enters `retryDownload()`. All 3 sites exhibit the same bug.
+
+## Goals / Non-Goals
+
+**Goals:**
+- Prevent dual-instance race condition after State Red entry
+- Ensure process exits cleanly through normal `main()` → `uninitialize()` → `exit()` path
+- Skip all retry/fallback logic once State Red has been entered
+- Minimal change surface — follow existing short-circuit patterns already in the codebase
+
+**Non-Goals:**
+- Refactoring the overall retry architecture
+- Changing State Red recovery shell script behavior
+- Modifying the PID file mechanism itself
+- Adding new error reporting or telemetry beyond what exists
+
+## Decisions
+
+### Decision 1: Keep `uninitialize()` in `checkAndEnterStateRed()` — no change
+
+**Choice:** Do NOT remove `uninitialize()` from `checkAndEnterStateRed()`. The function continues to call `uninitialize(INITIAL_VALIDATION_SUCCESS)` as it does today. Instead, we guard `main()` against calling `uninitialize()` a second time.
+
+**Rationale:** `checkAndEnterStateRed()` has always performed cleanup before creating the state-red flag. This is intentional — it tears down IARM connections, deletes the PID file, and frees resources to prepare the process for a clean exit. Removing it would change established behavior. The simpler fix is to ensure the caller (main) doesn't double-call uninitialize.
+
+**Alternative considered:** Remove `uninitialize()` from `checkAndEnterStateRed()` and let `main()` handle it. Rejected because it changes the semantics of state-red entry — the PID file must be removed BEFORE the process continues (to allow the recovery script to start a fresh instance), and `uninitialize()` is the function that does this.
+
+### Decision 2: Introduce `RDKV_UPGRADE_ERROR_STATE_RED` return code
+
+**Choice:** Define a new error constant (e.g., value -2 or a dedicated enum value) to signal that State Red was entered, following the existing pattern of `RDKV_UPGRADE_ERROR_FORCE_EXIT` and `RDKV_UPGRADE_ERROR_THROTTLE_ZERO`.
+
+**Rationale:** The codebase already has this pattern — `rdkv_upgrade_request()` checks for `RDKV_UPGRADE_ERROR_FORCE_EXIT` and returns immediately before calling `retryDownload()`. Adding a similar check for `RDKV_UPGRADE_ERROR_STATE_RED` is a minimal, consistent change.
+
+### Decision 3: Propagate state-red status from `downloadFile()` after `dwnlError()` (Sites 1 & 2)
+
+**Choice:** After `dwnlError()` is called in the download loop within `downloadFile()`, check if the state-red flag file (`/tmp/stateRedEnabled`) was created. If so, return `RDKV_UPGRADE_ERROR_STATE_RED` instead of continuing the loop.
+
+**Rationale:** `dwnlError()` is a void function and changing its signature would be a larger refactor. The state-red flag file is the authoritative indicator that `checkAndEnterStateRed()` was triggered, and `filePresentCheck(STATEREDFLAG)` is already used elsewhere. This keeps `dwnlError()` unchanged.
+
+### Decision 4: Change Site 3 return value to `RDKV_UPGRADE_ERROR_STATE_RED`
+
+**Choice:** In the `MTLS_CERT_FETCH_FAILURE` path (line ~1052), change `return curl_ret_code` to `return RDKV_UPGRADE_ERROR_STATE_RED`.
+
+**Rationale:** Site 3 currently returns `-1` (the initial value of `curl_ret_code`) which is not a recognized short-circuit code. The caller (`rdkv_upgrade_request()`) sees `-1 != CURL_SUCCESS` and enters `retryDownload()` — the same bug as Sites 1 & 2. Returning the new error code ensures the caller short-circuits consistently across all 3 sites.
+
+### Decision 5: Short-circuit retryDownload in `rdkv_upgrade_request()`
+
+**Choice:** Add a check for `RDKV_UPGRADE_ERROR_STATE_RED` alongside the existing `RDKV_UPGRADE_ERROR_FORCE_EXIT` and `RDKV_UPGRADE_ERROR_THROTTLE_ZERO` checks, before the `retryDownload()` call. This guard must be added in both the direct and codebig paths.
+
+**Rationale:** Follows the exact existing pattern. No new control flow structures needed.
+
+### Decision 6: Guard `main()` against double-uninitialize
+
+**Choice:** In `main()`, before the final `uninitialize()` call, check if the return code is `RDKV_UPGRADE_ERROR_STATE_RED`. If so, skip `uninitialize()` since `checkAndEnterStateRed()` already called it.
+
+**Rationale:** `checkAndEnterStateRed()` calls `uninitialize()` which destroys mutexes, tears down IARM, and deletes the PID file. Calling `uninitialize()` again in `main()` causes undefined behavior (pthread_mutex_destroy on destroyed mutex) and IARM_ASSERT failures seen in production logs. The guard prevents the double-call.
+
+## Risks / Trade-offs
+
+- **[Risk] Double-uninitialize in edge cases** → Mitigation: The guard in `main()` checks for `RDKV_UPGRADE_ERROR_STATE_RED` specifically. If a future code path reaches `main()` with this error code without having called uninitialize first, it would skip cleanup. This is acceptable because `RDKV_UPGRADE_ERROR_STATE_RED` is only ever set by paths that went through `checkAndEnterStateRed()`.
+
+- **[Risk] Process continues executing briefly after `uninitialize()` is called inside `checkAndEnterStateRed()`** → Mitigation: The new return code propagates up quickly (no sleeps or loops between state-red detection and `main()` exit). The window is milliseconds, not the previous minutes-long retry loop.
+
+- **[Risk] `codebigdownloadFile()` may have the same pattern** → Mitigation: The fix covers both the direct and codebig paths in `rdkv_upgrade_request()` since both share the same short-circuit check point before `retryDownload()`.
+
+- **[Trade-off] Using file-system check in `downloadFile()` after `dwnlError()` instead of propagating return value through `dwnlError()`** → Acceptable because it avoids changing a void function's signature which is called in multiple places, and the flag file is the canonical state indicator.
+
+- **[Trade-off] Site 3 (MTLS path) return value changes from `-1` to `RDKV_UPGRADE_ERROR_STATE_RED`** → This changes what value eventually reaches `main()` as `ret_curl_code`. Since `main()` uses this as the `exit()` code, the exit code will differ. This is acceptable because the process is about to reboot in state-red recovery regardless of exit code.
diff --git a/openspec/changes/fix-state-red-dual-instance-race/proposal.md b/openspec/changes/fix-state-red-dual-instance-race/proposal.md
new file mode 100755
index 00000000..93538ffc
--- /dev/null
+++ b/openspec/changes/fix-state-red-dual-instance-race/proposal.md
@@ -0,0 +1,24 @@
+## Why
+
+`checkAndEnterStateRed()` calls `uninitialize()` which deletes `/tmp/DIFD.pid` and destroys mutexes, but only returns -1 instead of exiting the process. The caller proceeds into `retryDownload()` keeping the process alive for minutes without a PID file, while `stateRedRecovery.sh` sees `/tmp/stateRedEnabled` and starts a second instance that passes `CurrentRunningInst()` (since the PID file is gone). This causes dual-instance corruption and unpredictable firmware update behavior. The bug exists in develop, stable2 (production), and topic/RDKEMW-9150 branches.
+
+## What Changes
+
+- After `checkAndEnterStateRed()` triggers state red entry, the process must NOT continue into retry/fallback logic — it must propagate the error immediately so the process exits cleanly
+- `checkAndEnterStateRed()` will no longer call `uninitialize()` directly; cleanup responsibility stays with the normal exit path in `main()`
+- A state-red-entered signal (return value) will be propagated from `dwnlError()` → `downloadFile()` → `rdkv_upgrade_request()` to short-circuit `retryDownload()`
+
+## Capabilities
+
+### New Capabilities
+
+### Modified Capabilities
+- `operational-safety`: State Red entry path must not delete PID file or destroy mutexes prematurely; process must exit cleanly through the normal uninitialize path
+- `retry-recovery`: Retry/fallback logic must be skipped when State Red has been entered; error propagation from `checkAndEnterStateRed()` must short-circuit all retry layers
+
+## Impact
+
+- **Code**: `src/device_status_helper.c` (`checkAndEnterStateRed()`), `src/rdkv_upgrade.c` (`dwnlError()`, `downloadFile()`, `rdkv_upgrade_request()`)
+- **Behavior**: After state red entry, process exits immediately instead of lingering for retry_count * 60 seconds
+- **Risk**: Low — state red is already a terminal failure; skipping retries after it is the correct semantic
+- **Testing**: Unit tests should verify that retryDownload is not called after state red entry
diff --git a/openspec/changes/fix-state-red-dual-instance-race/specs/operational-safety/spec.md b/openspec/changes/fix-state-red-dual-instance-race/specs/operational-safety/spec.md
new file mode 100755
index 00000000..4c45c269
--- /dev/null
+++ b/openspec/changes/fix-state-red-dual-instance-race/specs/operational-safety/spec.md
@@ -0,0 +1,16 @@
+## MODIFIED Requirements
+
+### Requirement: State Red entry must not perform premature cleanup
+The `checkAndEnterStateRed()` function SHALL NOT call `uninitialize()` or delete the PID file (`/tmp/DIFD.pid`). It SHALL only create the state red flag file (`/tmp/stateRedEnabled`), report telemetry/status, and return an error indicator. Process cleanup MUST remain the responsibility of the normal exit path in `main()`.
+
+#### Scenario: State Red entered during download
+- **WHEN** `checkAndEnterStateRed()` determines that a fatal TLS/certificate error requires State Red entry
+- **THEN** the function SHALL create `/tmp/stateRedEnabled`, update firmware download status, and return -1 without calling `uninitialize()` or deleting `/tmp/DIFD.pid`
+
+#### Scenario: PID file remains valid until process exit
+- **WHEN** State Red has been entered and the process is unwinding through normal return path
+- **THEN** `/tmp/DIFD.pid` SHALL exist and contain the current process PID until `main()` calls `uninitialize()` at exit
+
+#### Scenario: No second instance started while first is unwinding
+- **WHEN** `stateRedRecovery.sh` executes and starts a new `rdkvfwupgrader` instance after State Red flag is set
+- **THEN** the new instance SHALL find the existing PID file via `CurrentRunningInst()` and exit with `DWNL_INPROGRESS` status, because the first instance has not yet deleted its PID file
diff --git a/openspec/changes/fix-state-red-dual-instance-race/specs/retry-recovery/spec.md b/openspec/changes/fix-state-red-dual-instance-race/specs/retry-recovery/spec.md
new file mode 100755
index 00000000..0da1296e
--- /dev/null
+++ b/openspec/changes/fix-state-red-dual-instance-race/specs/retry-recovery/spec.md
@@ -0,0 +1,23 @@
+## MODIFIED Requirements
+
+### Requirement: Retry logic must be skipped after State Red entry
+The `rdkv_upgrade_request()` function SHALL NOT call `retryDownload()` or `fallBack()` when the preceding download attempt resulted in State Red entry. The error code indicating State Red (`RDKV_UPGRADE_ERROR_STATE_RED`) MUST be returned immediately, bypassing all retry and fallback logic.
+
+#### Scenario: downloadFile returns State Red error code
+- **WHEN** `downloadFile()` detects that `dwnlError()` triggered State Red entry (by checking presence of `/tmp/stateRedEnabled` flag file after `dwnlError()` returns)
+- **THEN** `downloadFile()` SHALL return `RDKV_UPGRADE_ERROR_STATE_RED` instead of the raw curl error code
+
+#### Scenario: rdkv_upgrade_request short-circuits on State Red
+- **WHEN** `rdkv_upgrade_request()` receives `RDKV_UPGRADE_ERROR_STATE_RED` from `downloadFile()` or `codebigdownloadFile()`
+- **THEN** `rdkv_upgrade_request()` SHALL return `RDKV_UPGRADE_ERROR_STATE_RED` immediately without calling `retryDownload()` or `fallBack()`
+
+#### Scenario: Process exits within seconds of State Red entry
+- **WHEN** State Red is entered during any download path (direct, codebig, mTLS cert failure)
+- **THEN** the process SHALL unwind through the return chain and reach `main()` exit within seconds, not minutes
+
+### Requirement: State Red error code defined consistently
+A new error constant `RDKV_UPGRADE_ERROR_STATE_RED` SHALL be defined to signal that State Red was entered. This constant MUST be handled at every point where `RDKV_UPGRADE_ERROR_FORCE_EXIT` is currently checked.
+
+#### Scenario: Consistent handling with FORCE_EXIT pattern
+- **WHEN** code checks for `RDKV_UPGRADE_ERROR_FORCE_EXIT` to short-circuit retry logic
+- **THEN** the same check SHALL also handle `RDKV_UPGRADE_ERROR_STATE_RED` with the same short-circuit behavior
diff --git a/openspec/changes/fix-state-red-dual-instance-race/tasks.md b/openspec/changes/fix-state-red-dual-instance-race/tasks.md
new file mode 100755
index 00000000..d91d309f
--- /dev/null
+++ b/openspec/changes/fix-state-red-dual-instance-race/tasks.md
@@ -0,0 +1,27 @@
+## 1. Define Error Constant
+
+- [x] 1.1 Add `RDKV_UPGRADE_ERROR_STATE_RED` constant to `src/include/rdkv_upgrade.h` (or wherever `RDKV_UPGRADE_ERROR_FORCE_EXIT` is defined)
+
+## 2. Propagate State Red from downloadFile (Sites 1 & 2)
+
+- [x] 2.1 In `downloadFile()` (`src/rdkv_upgrade.c`), after each `dwnlError()` call in the download loop, check `filePresentCheck(STATEREDFLAG)` — if state red flag exists, return `RDKV_UPGRADE_ERROR_STATE_RED`
+- [x] 2.2 Apply the same pattern in `codebigdownloadFile()` if it has an equivalent `dwnlError()` call path — N/A: codebigdownloadFile does not call dwnlError or checkAndEnterStateRed
+
+## 3. Fix Site 3 Return Value (MTLS_CERT_FETCH_FAILURE)
+
+- [x] 3.1 In `downloadFile()` (~line 1052), change `return curl_ret_code` to `return RDKV_UPGRADE_ERROR_STATE_RED` in the `MTLS_CERT_FETCH_FAILURE` block (after `checkAndEnterStateRed()` call)
+
+## 4. Short-Circuit Retry in rdkv_upgrade_request
+
+- [x] 4.1 In `rdkv_upgrade_request()` for the direct download path, add `RDKV_UPGRADE_ERROR_STATE_RED` check alongside existing `RDKV_UPGRADE_ERROR_FORCE_EXIT` and `RDKV_UPGRADE_ERROR_THROTTLE_ZERO` checks before `retryDownload()` call
+- [x] 4.2 In `rdkv_upgrade_request()` for the codebig download path, add the same `RDKV_UPGRADE_ERROR_STATE_RED` check before `retryDownload()` call
+
+## 5. Guard main() Against Double-Uninitialize
+
+- [x] 5.1 In `main()` (`src/rdkv_main.c`), wrap the final `uninitialize()` call with a check: skip it when `ret_curl_code == RDKV_UPGRADE_ERROR_STATE_RED`
+
+## 6. Unit Tests
+
+- [x] 6.1 Add test verifying `downloadFile()` returns `RDKV_UPGRADE_ERROR_STATE_RED` when state red flag is set after `dwnlError()`
+- [x] 6.2 Add test verifying `rdkv_upgrade_request()` does not call `retryDownload()` when `RDKV_UPGRADE_ERROR_STATE_RED` is returned
+- [x] 6.3 Add test verifying `main()` skips `uninitialize()` when return code is `RDKV_UPGRADE_ERROR_STATE_RED` — N/A for unit test (main() calls exit()), verified by code review + L2 integration tests
diff --git a/openspec/config.yaml b/openspec/config.yaml
new file mode 100755
index 00000000..392946c6
--- /dev/null
+++ b/openspec/config.yaml
@@ -0,0 +1,20 @@
+schema: spec-driven
+
+# Project context (optional)
+# This is shown to AI when creating artifacts.
+# Add your tech stack, conventions, style guides, domain knowledge, etc.
+# Example:
+#   context: |
+#     Tech stack: TypeScript, React, Node.js
+#     We use conventional commits
+#     Domain: e-commerce platform
+
+# Per-artifact rules (optional)
+# Add custom rules for specific artifacts.
+# Example:
+#   rules:
+#     proposal:
+#       - Keep proposals under 500 words
+#       - Always include a "Non-goals" section
+#     tasks:
+#       - Break tasks into chunks of max 2 hours
diff --git a/openspec/dbus/dbus-architecture.md b/openspec/dbus/dbus-architecture.md
new file mode 100755
index 00000000..f15bdee2
--- /dev/null
+++ b/openspec/dbus/dbus-architecture.md
@@ -0,0 +1,271 @@
+# D-Bus Architecture — `rdkFwupdateMgr` Daemon
+
+> **Evidence Level:** Facts verified from `src/dbus/` source code  
+> **Sources:** `rdkv_dbus_server.c`, `rdkv_dbus_server.h`, `rdkFwupdateMgr_handlers.c`, `rdkFwupdateMgr_handlers.h`, `xconf_comm_status.c`
+
+---
+
+## 1. Service Registration
+
+### 1.1 D-Bus Coordinates
+
+| Property | Value | Source |
+|----------|-------|--------|
+| Bus Type | System bus (`G_BUS_TYPE_SYSTEM`) | **[FACT]** `g_bus_get_sync(G_BUS_TYPE_SYSTEM)` |
+| Bus Name | `org.rdkfwupdater.Interface` | **[FACT]** `BUS_NAME` constant |
+| Object Path | `/org/rdkfwupdater/Service` | **[FACT]** `OBJECT_PATH` constant |
+| Interface | `org.rdkfwupdater.Interface` | **[FACT]** introspection XML |
+
+### 1.2 Setup Flow
+
+**[FACT]** `setup_dbus_server()` performs:
+1. Parse introspection XML into `GDBusNodeInfo`
+2. Connect to system bus via `g_bus_get_sync()`
+3. Register object at `OBJECT_PATH` with `process_app_request` as method handler
+4. Own bus name via `g_bus_own_name_on_connection()`
+5. Returns `1` on success, `0` on failure
+
+**[FACT]** Called from daemon's `STATE_INIT` before `initialize()`.
+
+---
+
+## 2. Interface Introspection
+
+```xml
+<interface name='org.rdkfwupdater.Interface'>
+
+  <!-- Process Management -->
+  <method name='RegisterProcess'>
+    <arg type='s' name='handler' direction='in'/>
+    <arg type='s' name='libVersion' direction='in'/>
+    <arg type='t' name='handler_id' direction='out'/>
+  </method>
+
+  <method name='UnregisterProcess'>
+    <arg type='t' name='handlerId' direction='in'/>
+    <arg type='b' name='success' direction='out'/>
+  </method>
+
+  <!-- Firmware Operations -->
+  <method name='CheckForUpdate'>
+    <arg type='s' name='handler_process_name' direction='in'/>
+    <arg type='i' name='result' direction='out'/>
+    <arg type='s' name='fwdata_version' direction='out'/>
+    <arg type='s' name='fwdata_availableVersion' direction='out'/>
+    <arg type='s' name='fwdata_updateDetails' direction='out'/>
+    <arg type='s' name='fwdata_status' direction='out'/>
+    <arg type='i' name='fwdata_status_code' direction='out'/>
+  </method>
+
+  <method name='DownloadFirmware'>
+    <arg type='s' name='handlerId' direction='in'/>
+    <arg type='s' name='firmwareName' direction='in'/>
+    <arg type='s' name='downloadUrl' direction='in'/>
+    <arg type='s' name='typeOfFirmware' direction='in'/>
+    <arg type='s' name='result' direction='out'/>
+    <arg type='s' name='status' direction='out'/>
+    <arg type='s' name='message' direction='out'/>
+  </method>
+
+  <method name='UpdateFirmware'>
+    <arg type='s' name='handlerId' direction='in'/>
+    <arg type='s' name='firmwareName' direction='in'/>
+    <arg type='s' name='LocationOfFirmware' direction='in'/>
+    <arg type='s' name='TypeOfFirmware' direction='in'/>
+    <arg type='s' name='rebootImmediately' direction='in'/>
+    <arg type='s' name='UpdateResult' direction='out'/>
+    <arg type='s' name='UpdateStatus' direction='out'/>
+    <arg type='s' name='message' direction='out'/>
+  </method>
+
+  <!-- Async Signals -->
+  <signal name='CheckForUpdateComplete'>
+    <arg type='t' name='handlerId'/>
+    <arg type='i' name='result'/>
+    <arg type='i' name='statusCode'/>
+    <arg type='s' name='currentVersion'/>
+    <arg type='s' name='availableVersion'/>
+    <arg type='s' name='updateDetails'/>
+    <arg type='s' name='statusMessage'/>
+  </signal>
+
+  <signal name='DownloadProgress'>
+    <arg type='t' name='handlerId'/>
+    <arg type='s' name='firmwareName'/>
+    <arg type='u' name='progress'/>
+    <arg type='s' name='status'/>
+    <arg type='s' name='message'/>
+  </signal>
+
+  <signal name='DownloadError'>
+    <arg type='t' name='handlerId'/>
+    <arg type='s' name='firmwareName'/>
+    <arg type='s' name='status'/>
+    <arg type='s' name='errorMessage'/>
+  </signal>
+
+  <signal name='UpdateProgress'>
+    <arg type='t' name='handlerId'/>
+    <arg type='s' name='firmwareName'/>
+    <arg type='i' name='progress'/>
+    <arg type='i' name='status'/>
+    <arg type='s' name='message'/>
+  </signal>
+</interface>
+```
+
+---
+
+## 3. Method Handler Dispatch
+
+**[FACT]** `process_app_request()` is the single GDBus method call handler. It routes by method name:
+
+```
+process_app_request()
+    ├── "RegisterProcess"    → add_process_to_tracking()
+    ├── "UnregisterProcess"  → remove_process_from_tracking()
+    ├── "CheckForUpdate"     → rdkFwupdateMgr_checkForUpdate() + async GTask
+    ├── "DownloadFirmware"   → async GTask (rdkfw_download_worker)
+    ├── "UpdateFirmware"     → async GThread (rdkfw_flash_worker_thread)
+    └── unknown              → G_DBUS_ERROR_UNKNOWN_METHOD
+```
+
+---
+
+## 4. Concurrency Model
+
+### 4.1 Single-Operation-at-a-Time Enforcement
+
+**[FACT]** The daemon enforces that only one operation of each type can run simultaneously:
+
+| Operation | Guard | Thread Safety |
+|-----------|-------|---------------|
+| CheckForUpdate | `xconf_comm_status` module (mutex-protected) | Thread-safe via `trySetXConfCommStatus()` |
+| Download | `IsDownloadInProgress` (main thread only) | Safe due to GLib main loop serialization |
+| Flash | `IsFlashInProgress` (multi-thread access) | **[FACT]** TODO comment in code notes it should be mutex-protected |
+
+### 4.2 Piggybacking / Queueing
+
+**[FACT]** When an operation is already in progress:
+- `CheckForUpdate` clients are added to `waiting_checkUpdate_ids` GSList
+- `DownloadFirmware` clients for same firmware are added to `CurrentDownloadState.waiting_handler_ids`
+- All waiting clients receive the same result via D-Bus signals when the operation completes
+
+### 4.3 Worker Thread Architecture
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│  GLib Main Loop Thread (main thread)                         │
+│                                                              │
+│  D-Bus method calls serialized by GLib                      │
+│  ├── process_app_request() dispatches                       │
+│  ├── g_idle_add() callbacks for signal emission             │
+│  └── g_task_run_in_thread() spawns workers                  │
+│                                                              │
+│  Accesses without mutex (main loop guarantees):             │
+│  - IsDownloadInProgress                                     │
+│  - current_download (CurrentDownloadState)                  │
+│  - registered_processes (GHashTable)                        │
+│  - waiting_*_ids (GSList queues)                            │
+└─────────────────────────────────────────────────────────────┘
+          ▲                    ▲                    ▲
+          │ g_idle_add()       │ g_idle_add()       │ g_idle_add()
+          │                    │                    │
+┌─────────┴──────┐  ┌─────────┴──────┐  ┌─────────┴──────┐
+│ GTask Worker   │  │ GTask Worker   │  │ GThread Worker │
+│ (XConf fetch)  │  │ (Download)     │  │ (Flash)        │
+│                │  │                │  │                │
+│ rdkfw_xconf_   │  │ rdkfw_download_│  │ rdkfw_flash_   │
+│ fetch_worker() │  │ worker()       │  │ worker_thread()│
+│                │  │                │  │                │
+│ ► XConf HTTP   │  │ ► HTTP dwnl   │  │ ► flashImage() │
+│ ► Parse JSON   │  │ ► Progress     │  │ ► Progress     │
+│ ► Cache result │  │   monitor      │  │   via idle_add │
+└────────────────┘  └────────────────┘  └────────────────┘
+```
+
+---
+
+## 5. Process Tracking System
+
+### 5.1 Data Structure
+
+**[FACT]** `registered_processes` is a `GHashTable` mapping `handler_id` → `ProcessInfo`:
+
+```c
+typedef struct {
+    guint64 handler_id;
+    gchar *process_name;
+    gchar *lib_version;
+    gchar *sender_id;      // D-Bus unique name (e.g., ":1.42")
+    gint64 registration_time;
+} ProcessInfo;
+```
+
+### 5.2 Registration Rules
+
+**[FACT]** Four cases for `RegisterProcess`:
+
+| Scenario | Result |
+|----------|--------|
+| Same client, same process_name | Return existing handler_id (idempotent) |
+| Same client, different process_name | **REJECT** — one registration per client |
+| Different client, same process_name | **REJECT** — process names must be unique |
+| New client, new process_name | **ALLOW** — create new registration |
+
+---
+
+## 6. XConf Cache System
+
+### 6.1 File Cache
+
+**[FACT]** The daemon caches XConf responses to reduce server load:
+
+| File | Content |
+|------|---------|
+| `/tmp/xconf_response_thunder.txt` | Raw JSON response from XConf server |
+| `/tmp/xconf_httpcode_thunder.txt` | HTTP response code |
+
+**[FACT]** Protected by `G_LOCK_DEFINE_STATIC(xconf_cache)` mutex.
+
+### 6.2 In-Memory Cache
+
+**[FACT]** `g_cached_xconf_data` (static `XCONFRES`) holds parsed XConf response in memory. Protected by `G_LOCK_DEFINE_STATIC(xconf_data_cache)` mutex.
+
+### 6.3 Cache-First Strategy
+
+For `CheckForUpdate`:
+1. If cache exists → validate firmware, return result immediately
+2. If cache miss → return `FIRMWARE_CHECK_ERROR` immediately, spawn async XConf fetch
+3. When fetch completes → cache result, emit `CheckForUpdateComplete` signal to all waiting clients
+
+---
+
+## 7. Signal Emission
+
+**[FACT]** Background worker threads marshal signals to the main loop via `g_idle_add()`:
+
+```
+Worker Thread                    Main Loop Thread
+    │                                │
+    ├── g_idle_add(emit_signal)  ──► │
+    │                                ├── g_dbus_connection_emit_signal()
+    │                                │   (emits to all D-Bus subscribers)
+    │                                │
+    └────────────────────────────────┘
+```
+
+This ensures all signal emissions occur on the main loop thread where the `GDBusConnection` was created.
+
+---
+
+## 8. Cleanup / Shutdown
+
+**[FACT]** `cleanup_dbus()` performs:
+1. `cleanupXConfCommStatus()` — destroy XConf status mutex
+2. Free all `TaskContext` entries from `active_tasks`
+3. `cleanup_process_tracking()` — destroy process and download tracking hash tables
+4. Unregister D-Bus object
+5. Release D-Bus connection
+6. Release bus name
+7. Free `GMainLoop`
diff --git a/openspec/diagrams/architecture-diagrams.md b/openspec/diagrams/architecture-diagrams.md
new file mode 100755
index 00000000..40a4963d
--- /dev/null
+++ b/openspec/diagrams/architecture-diagrams.md
@@ -0,0 +1,354 @@
+# Architecture Diagrams
+
+> Mermaid-format diagrams for engineering design reviews.  
+> Render with any Mermaid-compatible tool (GitHub, VS Code preview, mermaid.live).
+
+---
+
+## 1. System Component Diagram
+
+```mermaid
+graph TB
+    subgraph "Client Layer"
+        APP1["Client App 1<br/>(example_plugin)"]
+        APP2["Client App N"]
+    end
+
+    subgraph "Client Library"
+        LIB["librdkFwupdateMgr.so<br/>├── Process Registration<br/>├── Async API (fire-and-forget)<br/>├── Callback Registry<br/>└── Background D-Bus Thread"]
+    end
+
+    subgraph "IPC Layer"
+        DBUS["System D-Bus<br/>org.rdkfwupdater.Interface"]
+    end
+
+    subgraph "Daemon Process (rdkFwupdateMgr)"
+        DBSRV["D-Bus Server<br/>(GDBus)"]
+        HANDLERS["Method Handlers<br/>├── RegisterProcess<br/>├── CheckForUpdate<br/>├── DownloadFirmware<br/>└── UpdateFirmware"]
+        XCONF_CACHE["XConf Cache<br/>(file + memory)"]
+        WORKERS["Worker Threads<br/>├── GTask (XConf fetch)<br/>├── GTask (Download)<br/>└── GThread (Flash)"]
+        CONCURRENCY["Concurrency Control<br/>├── xconf_comm_status (mutex)<br/>├── IsDownloadInProgress<br/>├── IsFlashInProgress<br/>└── Piggybacking queues"]
+    end
+
+    subgraph "One-Shot Binary (rdkvfwupgrader)"
+        ONESHOT["rdkvfwupgrader<br/>├── XConf query<br/>├── Download<br/>├── Flash<br/>└── Exit"]
+    end
+
+    subgraph "Shared Libraries"
+        UPGRADE["librdksw_upgrade<br/>(HTTP download engine)"]
+        JSONPARSE["librdksw_jsonparse<br/>(XConf JSON parser)"]
+        FLASH_LIB["librdksw_flash<br/>(Image flash + status)"]
+        RFC["librdksw_rfcIntf<br/>(RFC settings)"]
+        IARM_LIB["librdksw_iarmIntf<br/>(IARM events)"]
+        FWUTILS["librdksw_fwutils<br/>(Device utilities)"]
+    end
+
+    subgraph "External Services"
+        XCONF_SRV["XConf Cloud Server"]
+        CDN["CDN / HTTP Server"]
+        MM["Maintenance Manager"]
+        IARM_BUS["IARM Bus"]
+        RBUS["rBus"]
+    end
+
+    subgraph "Device Hardware"
+        FLASH_HW["Flash Storage"]
+    end
+
+    APP1 --> LIB
+    APP2 --> LIB
+    LIB <--> DBUS
+    DBUS <--> DBSRV
+    DBSRV --> HANDLERS
+    HANDLERS --> XCONF_CACHE
+    HANDLERS --> WORKERS
+    HANDLERS --> CONCURRENCY
+    
+    WORKERS --> UPGRADE
+    WORKERS --> JSONPARSE
+    WORKERS --> FLASH_LIB
+    
+    ONESHOT --> UPGRADE
+    ONESHOT --> JSONPARSE
+    ONESHOT --> FLASH_LIB
+    ONESHOT --> RFC
+    ONESHOT --> IARM_LIB
+    ONESHOT --> FWUTILS
+    
+    UPGRADE --> XCONF_SRV
+    UPGRADE --> CDN
+    FLASH_LIB --> FLASH_HW
+    IARM_LIB --> IARM_BUS
+    ONESHOT -.-> MM
+    
+    style DBSRV fill:#2d5986,color:#fff
+    style HANDLERS fill:#2d5986,color:#fff
+    style WORKERS fill:#2d5986,color:#fff
+    style CONCURRENCY fill:#2d5986,color:#fff
+    style XCONF_CACHE fill:#2d5986,color:#fff
+    style LIB fill:#4a7c59,color:#fff
+    style ONESHOT fill:#8b6914,color:#fff
+    style UPGRADE fill:#555,color:#fff
+    style JSONPARSE fill:#555,color:#fff
+    style FLASH_LIB fill:#555,color:#fff
+    style RFC fill:#555,color:#fff
+    style IARM_LIB fill:#555,color:#fff
+    style FWUTILS fill:#555,color:#fff
+```
+
+---
+
+## 2. Daemon Internal Architecture
+
+```mermaid
+graph TD
+    subgraph "Main Thread (GLib Main Loop)"
+        ML["g_main_loop_run()"]
+        DISPATCH["process_app_request()<br/>(method dispatcher)"]
+        SIGNAL_EMIT["Signal Emission<br/>(via g_idle_add)"]
+        TASK_TRACK["Task Tracking<br/>(GHashTable)"]
+        PROC_TRACK["Process Tracking<br/>(GHashTable)"]
+        DL_STATE["CurrentDownloadState<br/>(single active download)"]
+    end
+
+    subgraph "Worker Threads"
+        W_XCONF["XConf Fetch Worker<br/>(GTask thread pool)"]
+        W_DWNL["Download Worker<br/>(GTask thread pool)"]
+        W_FLASH["Flash Worker<br/>(dedicated GThread)"]
+        W_PROGRESS["Progress Monitor<br/>(polling thread)"]
+    end
+
+    subgraph "Thread-Safe Modules"
+        XCONF_STATUS["xconf_comm_status<br/>(GMutex protected)"]
+        XCONF_FILE_CACHE["File Cache Mutex<br/>(G_LOCK xconf_cache)"]
+        XCONF_MEM_CACHE["Memory Cache Mutex<br/>(G_LOCK xconf_data_cache)"]
+    end
+
+    ML --> DISPATCH
+    ML --> SIGNAL_EMIT
+    DISPATCH --> TASK_TRACK
+    DISPATCH --> PROC_TRACK
+    DISPATCH --> DL_STATE
+    
+    DISPATCH -->|"GTask"| W_XCONF
+    DISPATCH -->|"GTask"| W_DWNL
+    DISPATCH -->|"GThread"| W_FLASH
+    W_DWNL -->|"spawn"| W_PROGRESS
+    
+    W_XCONF -->|"g_idle_add"| SIGNAL_EMIT
+    W_DWNL -->|"g_idle_add"| SIGNAL_EMIT
+    W_FLASH -->|"g_idle_add"| SIGNAL_EMIT
+    W_PROGRESS -->|"g_idle_add"| SIGNAL_EMIT
+    
+    W_XCONF --> XCONF_STATUS
+    W_XCONF --> XCONF_FILE_CACHE
+    W_XCONF --> XCONF_MEM_CACHE
+    DISPATCH --> XCONF_STATUS
+
+    style ML fill:#1a4d2e,color:#fff
+    style DISPATCH fill:#1a4d2e,color:#fff
+    style SIGNAL_EMIT fill:#1a4d2e,color:#fff
+    style W_XCONF fill:#4a2d7c,color:#fff
+    style W_DWNL fill:#4a2d7c,color:#fff
+    style W_FLASH fill:#4a2d7c,color:#fff
+    style W_PROGRESS fill:#4a2d7c,color:#fff
+    style XCONF_STATUS fill:#7c4a2d,color:#fff
+    style XCONF_FILE_CACHE fill:#7c4a2d,color:#fff
+    style XCONF_MEM_CACHE fill:#7c4a2d,color:#fff
+```
+
+---
+
+## 3. Client Library Threading Model
+
+```mermaid
+graph LR
+    subgraph "Application Thread"
+        REG["registerProcess()"]
+        CFU["checkForUpdate()"]
+        DFW["downloadFirmware()"]
+        UFW["updateFirmware()"]
+        URG["unregisterProcess()"]
+        WAIT["pthread_cond_wait()"]
+    end
+
+    subgraph "Ephemeral D-Bus Connections"
+        EC1["conn :1.142<br/>(created per call)"]
+        EC2["conn :1.143<br/>(created per call)"]
+    end
+
+    subgraph "Background Thread"
+        PERSISTENT["Persistent conn :1.141"]
+        GLOOP["g_main_loop_run()"]
+        SUB1["Subscribe: CheckForUpdateComplete"]
+        SUB2["Subscribe: DownloadProgress"]
+        SUB3["Subscribe: UpdateProgress"]
+        DISP["dispatch_all_*()"]
+    end
+
+    subgraph "Registries (mutex-protected)"
+        R1["g_registry<br/>(30 slots, checkForUpdate)"]
+        R2["g_dwnl_registry<br/>(30 slots, download)"]
+        R3["g_update_registry<br/>(30 slots, update)"]
+    end
+
+    REG -->|sync| EC1
+    CFU -->|fire&forget| EC2
+    DFW -->|fire&forget| EC2
+    UFW -->|fire&forget| EC2
+    URG -->|sync| EC1
+    
+    CFU -->|"register cb"| R1
+    DFW -->|"register cb"| R2
+    UFW -->|"register cb"| R3
+    
+    GLOOP --> SUB1
+    GLOOP --> SUB2
+    GLOOP --> SUB3
+    SUB1 --> DISP
+    SUB2 --> DISP
+    SUB3 --> DISP
+    DISP -->|"read slots"| R1
+    DISP -->|"read slots"| R2
+    DISP -->|"read slots"| R3
+    DISP -->|"invoke callback"| WAIT
+
+    style REG fill:#2d6986,color:#fff
+    style CFU fill:#2d6986,color:#fff
+    style DFW fill:#2d6986,color:#fff
+    style UFW fill:#2d6986,color:#fff
+    style GLOOP fill:#692d86,color:#fff
+    style DISP fill:#692d86,color:#fff
+    style R1 fill:#86692d,color:#fff
+    style R2 fill:#86692d,color:#fff
+    style R3 fill:#86692d,color:#fff
+```
+
+---
+
+## 4. Build Artifact Dependency Graph
+
+```mermaid
+graph TD
+    subgraph "Binaries"
+        BIN1["rdkvfwupgrader"]
+        BIN2["rdkFwupdateMgr"]
+        BIN3["testClient"]
+        BIN4["example_plugin"]
+    end
+
+    subgraph "Internal Libraries"
+        L1["librdksw_upgrade.so"]
+        L2["librdksw_jsonparse.so"]
+        L3["librdksw_flash.so"]
+        L4["librdksw_rfcIntf.so"]
+        L5["librdksw_iarmIntf.so"]
+        L6["librdksw_fwutils.so"]
+        L7["librdkFwupdateMgr.so"]
+    end
+
+    subgraph "External Dependencies"
+        E1["libcurl"]
+        E2["libcjson"]
+        E3["GLib/GIO"]
+        E4["libdwnlutil"]
+        E5["libfwutils"]
+        E6["librdkloggers"]
+        E7["libsecure_wrapper"]
+        E8["libparsejson"]
+        E9["librbus"]
+        E10["libpthread"]
+    end
+
+    BIN1 --> L1 & L2 & L3 & L4 & L5 & L6
+    BIN2 --> L1 & L2 & L3 & L4 & L5 & L6
+    BIN2 -->|"+ D-Bus server"| E3
+    BIN3 --> E3
+    BIN4 --> L7
+    L7 --> E3 & E10
+
+    L1 --> E1 & E2
+    L2 --> E2
+    L3 --> E1
+
+    style BIN1 fill:#8b6914,color:#fff
+    style BIN2 fill:#2d5986,color:#fff
+    style BIN3 fill:#666,color:#fff
+    style BIN4 fill:#4a7c59,color:#fff
+    style L7 fill:#4a7c59,color:#fff
+```
+
+---
+
+## 5. Daemon State Machine
+
+```mermaid
+stateDiagram-v2
+    direction LR
+    
+    [*] --> STATE_INIT: Process start
+    
+    STATE_INIT --> STATE_INIT_VALIDATION: D-Bus + init OK
+    STATE_INIT --> CLEANUP: Init failed
+    
+    STATE_INIT_VALIDATION --> STATE_IDLE: Validation OK
+    STATE_INIT_VALIDATION --> STATE_IDLE: Download complete
+    STATE_INIT_VALIDATION --> STATE_IDLE: Download in-progress
+    STATE_INIT_VALIDATION --> CLEANUP: Validation failed
+    
+    state STATE_IDLE {
+        direction TB
+        [*] --> WAITING: Enter main loop
+        WAITING --> HANDLE_REQUEST: D-Bus method call
+        HANDLE_REQUEST --> SPAWN_WORKER: Async operation
+        SPAWN_WORKER --> WAITING: Worker running
+        HANDLE_REQUEST --> WAITING: Sync response
+    }
+    
+    STATE_IDLE --> CLEANUP: g_main_loop_quit()
+    
+    CLEANUP --> [*]: exit()
+    
+    note right of STATE_IDLE
+        Runs indefinitely.
+        All firmware operations
+        handled via D-Bus + GTask.
+    end note
+```
+
+---
+
+## 6. XConf Cache Decision Flow
+
+```mermaid
+flowchart TD
+    A[CheckForUpdate Request] --> B{Cache exists?}
+    
+    B -->|Yes| C[load_xconf_from_cache]
+    B -->|No| D{XConf fetch in progress?}
+    
+    C --> E{Parse successful?}
+    E -->|Yes| F[Validate firmware vs model]
+    E -->|No| D
+    
+    F --> G{Compatible?}
+    G -->|Yes, newer| H[Return FIRMWARE_AVAILABLE]
+    G -->|Same version| I[Return FIRMWARE_NOT_AVAILABLE]
+    G -->|Incompatible| J[Return UPDATE_NOT_ALLOWED]
+    
+    D -->|Yes| K[Add to waiting queue]
+    D -->|No| L[Spawn XConf fetch worker]
+    
+    L --> M[Return FIRMWARE_CHECK_ERROR immediately]
+    K --> M
+    
+    M --> N[Worker: HTTP POST to XConf]
+    N --> O[Worker: save_xconf_to_cache]
+    O --> P[Emit CheckForUpdateComplete signal]
+    P --> Q[Process waiting queue]
+
+    style H fill:#2d7c2d,color:#fff
+    style I fill:#7c7c2d,color:#fff
+    style J fill:#7c2d2d,color:#fff
+    style M fill:#4a4a7c,color:#fff
+```
diff --git a/openspec/diagrams/subsystem-architecture.md b/openspec/diagrams/subsystem-architecture.md
new file mode 100755
index 00000000..97e69428
--- /dev/null
+++ b/openspec/diagrams/subsystem-architecture.md
@@ -0,0 +1,1020 @@
+# Subsystem Architecture Diagrams
+
+> **Scope:** Layered architecture, subsystem relationships, ownership maps  
+> **Format:** Mermaid diagrams for rendering in Markdown viewers
+
+---
+
+## 1. Layered Architecture — Both Execution Models
+
+```mermaid
+block-beta
+    columns 5
+    
+    block:clients:5
+        A["Client Applications<br/>(example_plugin, etc.)"]
+    end
+    
+    block:sdk:5
+        B["Client Library SDK<br/>librdkFwupdateMgr.so<br/>(D-Bus proxy + async callbacks)"]
+    end
+    
+    space:5
+    
+    block:orchestrators:5
+        C["One-Shot Orchestrator<br/>rdkv_main.c<br/>(linear pipeline)"]
+        D["Daemon Orchestrator<br/>rdkFwupdateMgr.c<br/>(state machine + GLib loop)"]
+    end
+    
+    block:dbus_layer:5
+        E["D-Bus Service Runtime<br/>rdkv_dbus_server.c<br/>(dispatch, tasks, signals, concurrency)"]
+    end
+    
+    block:core:5
+        F["Firmware Upgrade Engine<br/>librdksw_upgrade.so"]
+        G["XConf Communication<br/>json_process.c + handlers.c"]
+        H["Flash Subsystem<br/>librdksw_flash.so"]
+    end
+    
+    block:infra:5
+        I["Device Identity<br/>librdksw_fwutils.so"]
+        J["RFC Config<br/>librdksw_rfcIntf.so"]
+        K["XConf Parsing<br/>librdksw_jsonparse.so"]
+        L["CEDM / Certs<br/>codebigUtils + mtlsUtils"]
+        M["Download Status<br/>download_status_helper.c"]
+    end
+    
+    block:ipc:5
+        N["IARM Events<br/>librdksw_iarmIntf.so"]
+        O["rBus Integration<br/>rbusInterface.c"]
+        P["Telemetry (T2)<br/>t2CountNotify"]
+    end
+    
+    block:external:5
+        Q["External:<br/>libcurl · libcjson · GLib/GIO · IARMBus · rbus · libdwnlutil"]
+    end
+
+    A --> B
+    B --> E
+    C --> F
+    C --> G
+    C --> H
+    D --> E
+    E --> F
+    E --> G
+    E --> H
+    F --> I
+    F --> J
+    F --> L
+    F --> M
+    G --> K
+    G --> I
+    H --> I
+    H --> M
+    F --> N
+    H --> N
+    F --> Q
+```
+
+---
+
+## 2. Subsystem Relationship / Interaction Map
+
+```mermaid
+flowchart TD
+    subgraph "Execution Models"
+        ONESHOT["One-Shot Orchestrator<br/>(rdkv_main.c)"]
+        DAEMON["Daemon Orchestrator<br/>(rdkFwupdateMgr.c)"]
+    end
+
+    subgraph "Daemon-Specific Layer"
+        DBUS["D-Bus Service Runtime<br/>(rdkv_dbus_server.c)"]
+        HANDLERS["D-Bus Handlers<br/>(rdkFwupdateMgr_handlers.c)"]
+        XCONF_STATUS["Concurrency Control<br/>(xconf_comm_status.c)"]
+        CLIENT_LIB["Client Library SDK<br/>(librdkFwupdateMgr.so)"]
+    end
+
+    subgraph "Core Shared Subsystems"
+        UPGRADE["Firmware Upgrade Engine<br/>(librdksw_upgrade.so)"]
+        FLASH["Flash Subsystem<br/>(librdksw_flash.so)"]
+        XCONF_PARSE["XConf Response Parsing<br/>(librdksw_jsonparse.so)"]
+    end
+
+    subgraph "Infrastructure Layer"
+        DEV_IDENTITY["Device & FW Identity<br/>(librdksw_fwutils.so)"]
+        RFC["RFC Configuration<br/>(librdksw_rfcIntf.so)"]
+        CEDM["CEDM / Cert Auth<br/>(codebigUtils + mtlsUtils)"]
+        DL_STATUS["Download Status<br/>(download_status_helper.c)"]
+    end
+
+    subgraph "IPC / Integration Layer"
+        IARM["IARM Event Interface<br/>(librdksw_iarmIntf.so)"]
+        RBUS["rBus Integration<br/>(rbusInterface.c)"]
+    end
+
+    subgraph "Cross-Cutting"
+        T2["Telemetry (T2)"]
+        SAFETY["Process Safety Guards<br/>(device_status_helper.c)"]
+    end
+
+    %% One-shot relationships
+    ONESHOT -->|"synchronous call"| UPGRADE
+    ONESHOT -->|"synchronous call"| FLASH
+    ONESHOT -->|"synchronous call"| XCONF_PARSE
+    ONESHOT -->|"init/term"| IARM
+    ONESHOT -->|"initialValidation"| SAFETY
+    ONESHOT -->|"getRFCSettings"| RFC
+    ONESHOT -->|"getDeviceProperties"| DEV_IDENTITY
+
+    %% Daemon relationships
+    DAEMON -->|"setup + main loop"| DBUS
+    DBUS -->|"dispatch"| HANDLERS
+    DBUS -->|"check status"| XCONF_STATUS
+    DBUS -->|"GTask worker"| UPGRADE
+    DBUS -->|"GTask worker"| FLASH
+    HANDLERS -->|"XConf query"| XCONF_PARSE
+    HANDLERS -->|"device info"| DEV_IDENTITY
+    DAEMON -->|"init/term"| IARM
+    DAEMON -->|"initialValidation"| SAFETY
+    DAEMON -->|"getRFCSettings"| RFC
+
+    %% Client library
+    CLIENT_LIB -->|"D-Bus IPC"| DBUS
+
+    %% Cross-cutting
+    UPGRADE -->|"status writes"| DL_STATUS
+    UPGRADE -->|"mTLS/Codebig"| CEDM
+    UPGRADE -->|"events"| IARM
+    FLASH -->|"events"| IARM
+    FLASH -->|"status writes"| DL_STATUS
+
+    %% Telemetry
+    ONESHOT -.->|"t2 events"| T2
+    DAEMON -.->|"t2 events"| T2
+    UPGRADE -.->|"t2 events"| T2
+    FLASH -.->|"t2 events"| T2
+```
+
+---
+
+## 3. Ownership Map — Who Owns What
+
+```mermaid
+flowchart LR
+    subgraph "One-Shot Owns"
+        direction TB
+        O1["Process lifecycle<br/>(start → exit)"]
+        O2["Global state<br/>(device_info, rfc_list, curl)"]
+        O3["Signal handler<br/>(SIGUSR1 → force_exit)"]
+        O4["Multi-firmware sequencing<br/>(PCI → PDRI → Peripheral)"]
+        O5["PID file lifecycle"]
+    end
+
+    subgraph "Daemon Owns"
+        direction TB
+        D1["GLib main loop"]
+        D2["D-Bus connection + bus name"]
+        D3["Client process registry"]
+        D4["Task lifecycle<br/>(active_tasks, waiting queues)"]
+        D5["Concurrency guards<br/>(IsDownload/Flash/CheckUpdate)"]
+        D6["XConf response cache"]
+        D7["Worker thread spawn/join"]
+    end
+
+    subgraph "Upgrade Engine Owns"
+        direction TB
+        U1["Curl handle lifecycle<br/>(during download)"]
+        U2["HTTP session state"]
+        U3["Chunk resume state"]
+        U4["Throttle interaction"]
+    end
+
+    subgraph "Flash Subsystem Owns"
+        direction TB
+        F1["Flash I/O lifecycle"]
+        F2["Post-flash reboot decision"]
+        F3["Flash status reporting"]
+    end
+
+    subgraph "IARM Interface Owns"
+        direction TB
+        I1["IARM Bus connection"]
+        I2["Event broadcast dispatch"]
+        I3["Throttle callback registration"]
+    end
+
+    subgraph "Client Library Owns"
+        direction TB
+        C1["Background thread lifecycle"]
+        C2["3 callback registries"]
+        C3["Signal subscriptions"]
+        C4["Ephemeral proxy creation"]
+    end
+```
+
+---
+
+## 4. Data Flow — Firmware Update (Daemon Path)
+
+```mermaid
+flowchart TD
+    subgraph "Client Process"
+        APP["Application"]
+        LIB["librdkFwupdateMgr.so"]
+    end
+
+    subgraph "D-Bus System Bus"
+        BUS["org.rdkfwupdater.Interface"]
+    end
+
+    subgraph "Daemon Process"
+        DISPATCH["process_app_request()<br/>[Main Thread]"]
+        VALIDATE["Input Validation<br/>[Main Thread]"]
+        
+        subgraph "Workers [GTask Pool]"
+            W_XCONF["XConf Worker"]
+            W_DWNL["Download Worker"]
+            W_FLASH["Flash Worker"]
+        end
+        
+        subgraph "Shared Libraries"
+            LIB_UPGRADE["librdksw_upgrade.so"]
+            LIB_FLASH["librdksw_flash.so"]
+            LIB_JSON["librdksw_jsonparse.so"]
+        end
+        
+        SIGNAL["Signal Emission<br/>[Main Thread via g_idle_add]"]
+    end
+
+    subgraph "External Services"
+        XCONF["XConf Server"]
+        CDN["CDN / HTTP"]
+        FLASH_HW["Flash Storage"]
+    end
+
+    APP -->|"API call"| LIB
+    LIB -->|"D-Bus method"| BUS
+    BUS -->|"dispatch"| DISPATCH
+    DISPATCH -->|"validate"| VALIDATE
+    VALIDATE -->|"spawn"| W_XCONF
+    VALIDATE -->|"spawn"| W_DWNL
+    VALIDATE -->|"spawn"| W_FLASH
+    
+    W_XCONF -->|"blocking"| LIB_JSON
+    LIB_JSON -->|"HTTP POST"| XCONF
+    
+    W_DWNL -->|"blocking"| LIB_UPGRADE
+    LIB_UPGRADE -->|"HTTP GET"| CDN
+    
+    W_FLASH -->|"blocking"| LIB_FLASH
+    LIB_FLASH -->|"flash I/O"| FLASH_HW
+    
+    W_XCONF -->|"g_task_return"| SIGNAL
+    W_DWNL -->|"g_idle_add"| SIGNAL
+    W_FLASH -->|"g_idle_add"| SIGNAL
+    
+    SIGNAL -->|"D-Bus signal"| BUS
+    BUS -->|"signal delivery"| LIB
+    LIB -->|"callback"| APP
+```
+
+---
+
+## 5. Library Dependency Graph
+
+```mermaid
+flowchart BT
+    subgraph "External Dependencies"
+        CURL["libcurl"]
+        CJSON["libcjson"]
+        GLIB["GLib/GIO"]
+        IARMBUS["libIARMBus"]
+        RBUS_LIB["librbus"]
+        DWNLUTIL["libdwnlutil"]
+        FWUTILS_EXT["libfwutils"]
+        SECWRAP["libsecure_wrapper"]
+        PARSEJSON["libparsejson"]
+        PTHREAD["libpthread"]
+        RFCAPI["librfcapi"]
+        T2_LIB["libtelemetry_msgsender"]
+    end
+
+    subgraph "Internal Libraries"
+        UPGRADE["librdksw_upgrade.so<br/>rdkv_upgrade.c, chunk.c<br/>codebigUtils.c, mtlsUtils.c"]
+        JSONPARSE["librdksw_jsonparse.so<br/>json_process.c"]
+        FLASH_LIB["librdksw_flash.so<br/>flash.c<br/>download_status_helper.c"]
+        RFCINTF["librdksw_rfcIntf.so<br/>rfcinterface.c"]
+        IARMINTF["librdksw_iarmIntf.so<br/>iarmInterface.c"]
+        FWUTILS["librdksw_fwutils.so<br/>deviceutils.c, device_api.c"]
+        CLIENTLIB["librdkFwupdateMgr.so<br/>process.c, api.c, async.c"]
+    end
+
+    subgraph "Binaries"
+        ONESHOT_BIN["rdkvfwupgrader"]
+        DAEMON_BIN["rdkFwupdateMgr"]
+        EXAMPLE["example_plugin"]
+    end
+
+    %% Binary → Library
+    ONESHOT_BIN --> UPGRADE
+    ONESHOT_BIN --> JSONPARSE
+    ONESHOT_BIN --> FLASH_LIB
+    ONESHOT_BIN --> RFCINTF
+    ONESHOT_BIN --> IARMINTF
+    ONESHOT_BIN --> FWUTILS
+
+    DAEMON_BIN --> UPGRADE
+    DAEMON_BIN --> JSONPARSE
+    DAEMON_BIN --> FLASH_LIB
+    DAEMON_BIN --> RFCINTF
+    DAEMON_BIN --> IARMINTF
+    DAEMON_BIN --> FWUTILS
+    DAEMON_BIN --> GLIB
+
+    EXAMPLE --> CLIENTLIB
+    CLIENTLIB --> GLIB
+    CLIENTLIB --> PTHREAD
+
+    %% Library → External
+    UPGRADE --> CURL
+    UPGRADE --> DWNLUTIL
+    UPGRADE --> SECWRAP
+    JSONPARSE --> CJSON
+    JSONPARSE --> PARSEJSON
+    FLASH_LIB --> CURL
+    RFCINTF --> RFCAPI
+    IARMINTF --> IARMBUS
+    FWUTILS --> PARSEJSON
+    FWUTILS --> SECWRAP
+```
+
+---
+
+## 6. Concurrency Architecture (Daemon Only)
+
+```mermaid
+flowchart TD
+    subgraph "Main Thread (GLib Main Loop)"
+        ML_DISPATCH["D-Bus Method Dispatch<br/>process_app_request()"]
+        ML_IDLE["g_idle_add() Callbacks<br/>(signal emission)"]
+        ML_DONE["GTask Completion Callbacks<br/>(xconf_done, download_done, flash_done)"]
+        
+        ML_STATE["Main-Loop-Serialized State<br/>• registered_processes<br/>• active_tasks<br/>• waiting queues<br/>• IsDownloadInProgress<br/>• IsFlashInProgress<br/>• current_download/flash"]
+    end
+
+    subgraph "Worker Threads (GTask Pool)"
+        WT_XCONF["XConf Worker<br/>rdkfw_xconf_fetch_worker()"]
+        WT_DWNL["Download Worker<br/>rdkfw_download_worker()"]
+        WT_FLASH["Flash Worker<br/>rdkfw_flash_worker()"]
+    end
+
+    subgraph "Monitor Threads (GThread)"
+        MT_PROG["Progress Monitor<br/>rdkfw_progress_monitor_thread()"]
+    end
+
+    subgraph "Mutex-Protected State"
+        MX1["XConfCommStatus<br/>(GMutex)"]
+        MX2["DwnlState<br/>(pthread_mutex)"]
+        MX3["app_mode<br/>(pthread_mutex)"]
+        MX4["g_xconf_data_cache<br/>(G_LOCK)"]
+        MX5["stop_flag<br/>(GMutex per download)"]
+    end
+
+    ML_DISPATCH -->|"g_task_run_in_thread"| WT_XCONF
+    ML_DISPATCH -->|"g_task_run_in_thread"| WT_DWNL
+    ML_DISPATCH -->|"g_task_run_in_thread"| WT_FLASH
+
+    WT_XCONF -->|"g_task_return_pointer"| ML_DONE
+    WT_DWNL -->|"g_task_return_boolean"| ML_DONE
+    WT_FLASH -->|"g_task_return_boolean"| ML_DONE
+
+    WT_DWNL -->|"g_thread_try_new"| MT_PROG
+    MT_PROG -->|"g_idle_add"| ML_IDLE
+    WT_DWNL -->|"g_idle_add"| ML_IDLE
+
+    WT_XCONF -.->|"read/write"| MX1
+    ML_DISPATCH -.->|"read/write"| MX1
+    WT_DWNL -.->|"read/write"| MX2
+    WT_DWNL -.->|"read/write"| MX5
+    MT_PROG -.->|"read"| MX5
+    WT_XCONF -.->|"write"| MX4
+
+    ML_DISPATCH -.->|"read/write"| ML_STATE
+    ML_DONE -.->|"read/write"| ML_STATE
+```
+
+---
+
+## 7. One-Shot Execution Lifecycle (`rdkvfwupgrader`)
+
+> **Cross-reference:** [specs/updater-execution/spec.md](../specs/updater-execution/spec.md), [runtime/rdkvfwupgrader-sequence.md](../runtime/rdkvfwupgrader-sequence.md)
+
+```mermaid
+stateDiagram-v2
+    [*] --> INVOCATION : Maintenance Manager / cron / TR-69
+
+    state INVOCATION {
+        [*] --> PARSE_ARGS : main(argc, argv)
+        PARSE_ARGS --> LOG_INIT : log_init()
+        LOG_INIT --> SIGNAL_SETUP : sigaction(SIGUSR1)
+    }
+
+    INVOCATION --> INITIALIZATION
+
+    state INITIALIZATION {
+        [*] --> DEVICE_PROPS : getDeviceProperties()
+        DEVICE_PROPS --> IMAGE_DETAILS : getImageDetails()
+        IMAGE_DETAILS --> RFC_SETTINGS : getRFCSettings()
+        RFC_SETTINGS --> DIR_CREATE : createDir(difw_path)
+        DIR_CREATE --> IARM_INIT : init_event_handler()
+        IARM_INIT --> MAINT_QUERY : getJsonRpc(MaintenanceMode)
+    }
+
+    INITIALIZATION --> VALIDATION
+
+    state VALIDATION {
+        [*] --> BUILD_CHECK : GetBuildType() + RFC exclusion
+        BUILD_CHECK --> PID_CHECK : CurrentRunningInst("/tmp/DIFD.pid")
+        PID_CHECK --> REBOOT_CHECK : Check fw_preparing_to_reboot
+        REBOOT_CHECK --> UPGRADE_FLAG : isUpgradeInProgress()
+    }
+
+    VALIDATION --> XCONF_PHASE : Validation passed
+    VALIDATION --> EXIT_SKIP : Conflict detected
+
+    state XCONF_PHASE {
+        [*] --> BUILD_PAYLOAD : createJsonString()
+        BUILD_PAYLOAD --> GET_URL : GetServURL()
+        GET_URL --> HTTP_POST : rdkv_upgrade_request(XCONF_UPGRADE)
+        HTTP_POST --> PARSE_RESP : getXconfRespData()
+        PARSE_RESP --> VALIDATE_RESP : processJsonResponse()
+    }
+
+    XCONF_PHASE --> FIRMWARE_PIPELINE : Update available
+    XCONF_PHASE --> EXIT_NO_UPDATE : No update
+
+    state FIRMWARE_PIPELINE {
+        [*] --> PCI_DOWNLOAD : rdkv_upgrade_request(PCI)
+        PCI_DOWNLOAD --> PCI_FLASH : flashImage(PCI)
+        PCI_FLASH --> DELAY_30S : sleep(30)
+        DELAY_30S --> PDRI_DOWNLOAD : rdkv_upgrade_request(PDRI)
+        PDRI_DOWNLOAD --> PDRI_FLASH : flashImage(PDRI)
+        PDRI_FLASH --> PERIPHERAL_LOOP : For each peripheral
+        PERIPHERAL_LOOP --> [*]
+    }
+
+    FIRMWARE_PIPELINE --> CLEANUP
+    EXIT_SKIP --> CLEANUP
+    EXIT_NO_UPDATE --> CLEANUP
+
+    state CLEANUP {
+        [*] --> IARM_REPORT : eventManager(MaintenanceMGR, status)
+        IARM_REPORT --> UNINIT : uninitialize()
+        UNINIT --> REMOVE_PID : unlink("/tmp/DIFD.pid")
+    }
+
+    CLEANUP --> [*] : exit(ret_code)
+```
+
+---
+
+## 8. Data Flow — Firmware Update (One-Shot Path)
+
+> Counterpart to §4 (Daemon Path). Shows the same firmware update lifecycle through the synchronous/procedural one-shot execution model.
+
+```mermaid
+flowchart TD
+    subgraph "External Trigger"
+        MM["Maintenance Manager<br/>(or cron / TR-69)"]
+    end
+
+    subgraph "rdkvfwupgrader Process (Single Thread)"
+        MAIN["main()<br/>Linear orchestration"]
+        INIT["initialize()<br/>Populate globals"]
+        VALID["initialValidation()<br/>Safety gates"]
+        
+        subgraph "XConf Query (blocking)"
+            XCONF_BUILD["createJsonString()"]
+            XCONF_REQ["rdkv_upgrade_request(XCONF)"]
+            XCONF_PARSE_OP["getXconfRespData()"]
+        end
+        
+        subgraph "Download (blocking)"
+            DL_PCI["rdkv_upgrade_request(PCI)"]
+            DL_PDRI["rdkv_upgrade_request(PDRI)"]
+            DL_PERIPH["rdkv_upgrade_request(PERIPHERAL)"]
+        end
+        
+        subgraph "Flash (blocking)"
+            FLASH_PCI["flashImage(PCI)"]
+            FLASH_PDRI["flashImage(PDRI)"]
+        end
+        
+        CLEANUP_OP["uninitialize() + exit()"]
+    end
+
+    subgraph "Shared Libraries (synchronous calls)"
+        LIB_UPGRADE["librdksw_upgrade.so"]
+        LIB_FLASH["librdksw_flash.so"]
+        LIB_JSON["librdksw_jsonparse.so"]
+        LIB_FWUTILS["librdksw_fwutils.so"]
+        LIB_RFC["librdksw_rfcIntf.so"]
+        LIB_IARM["librdksw_iarmIntf.so"]
+    end
+
+    subgraph "External Services"
+        XCONF_SRV["XConf Server"]
+        CDN_SRV["CDN / HTTP"]
+        FLASH_HW["Flash Storage"]
+        IARM_BUS["IARM Bus"]
+    end
+
+    MM -->|"fork+exec"| MAIN
+    MAIN --> INIT
+    INIT -->|"getDeviceProperties"| LIB_FWUTILS
+    INIT -->|"getRFCSettings"| LIB_RFC
+    INIT -->|"init_event_handler"| LIB_IARM
+    INIT --> VALID
+    VALID --> XCONF_BUILD
+    
+    XCONF_BUILD -->|"device payload"| LIB_JSON
+    XCONF_REQ -->|"HTTP POST (blocking)"| LIB_UPGRADE
+    LIB_UPGRADE -->|"HTTPS"| XCONF_SRV
+    XCONF_PARSE_OP -->|"parse JSON"| LIB_JSON
+    
+    XCONF_BUILD --> XCONF_REQ --> XCONF_PARSE_OP --> DL_PCI
+    
+    DL_PCI -->|"HTTP GET (blocking, minutes)"| LIB_UPGRADE
+    LIB_UPGRADE -->|"HTTPS"| CDN_SRV
+    DL_PCI --> FLASH_PCI
+    FLASH_PCI -->|"flash I/O"| LIB_FLASH
+    LIB_FLASH -->|"write"| FLASH_HW
+    
+    FLASH_PCI --> DL_PDRI
+    DL_PDRI -->|"HTTP GET"| LIB_UPGRADE
+    DL_PDRI --> FLASH_PDRI
+    FLASH_PDRI -->|"flash I/O"| LIB_FLASH
+    
+    FLASH_PDRI --> DL_PERIPH
+    DL_PERIPH -->|"HTTP GET(s)"| LIB_UPGRADE
+    
+    DL_PERIPH --> CLEANUP_OP
+    
+    LIB_IARM -->|"events"| IARM_BUS
+```
+
+---
+
+## 9. Execution Model Comparison — Side-by-Side
+
+> Structural comparison showing how each execution model uses the same shared infrastructure differently.
+
+```mermaid
+flowchart LR
+    subgraph "rdkvfwupgrader<br/>(One-Shot)"
+        direction TB
+        OS_TRIGGER["Maintenance Manager<br/>fork+exec"]
+        OS_MAIN["main() — single thread"]
+        OS_INIT["initialize()"]
+        OS_VALID["initialValidation()"]
+        OS_XCONF["MakeXconfComms()<br/>(direct, no cache)"]
+        OS_DL["rdkv_upgrade_request()<br/>(blocks main thread)"]
+        OS_FLASH["flashImage()<br/>(inline after download)"]
+        OS_EXIT["exit(ret_code)"]
+        
+        OS_TRIGGER --> OS_MAIN --> OS_INIT --> OS_VALID
+        OS_VALID --> OS_XCONF --> OS_DL --> OS_FLASH --> OS_EXIT
+    end
+
+    subgraph "Shared Platform"
+        direction TB
+        S_UPGRADE["librdksw_upgrade.so"]
+        S_FLASH["librdksw_flash.so"]
+        S_JSON["librdksw_jsonparse.so"]
+        S_FWUTILS["librdksw_fwutils.so"]
+        S_RFC["librdksw_rfcIntf.so"]
+        S_IARM["librdksw_iarmIntf.so"]
+    end
+
+    subgraph "rdkFwupdateMgr<br/>(Daemon)"
+        direction TB
+        D_SYSTEMD["systemd<br/>ExecStart"]
+        D_MAIN["main() — state machine"]
+        D_INIT["initialize()"]
+        D_VALID["initialValidation()"]
+        D_DBUS["setup_dbus_server()"]
+        D_LOOP["g_main_loop_run()<br/>(indefinite)"]
+        D_WORKERS["GTask Workers<br/>(XConf, Download, Flash)"]
+        D_SIGNALS["D-Bus Signal Emission"]
+        
+        D_SYSTEMD --> D_MAIN --> D_DBUS --> D_INIT --> D_VALID
+        D_VALID --> D_LOOP --> D_WORKERS --> D_SIGNALS
+        D_SIGNALS --> D_LOOP
+    end
+
+    OS_XCONF -->|"sync call"| S_JSON
+    OS_DL -->|"sync call"| S_UPGRADE
+    OS_FLASH -->|"sync call"| S_FLASH
+    OS_INIT -->|"sync call"| S_FWUTILS
+    OS_INIT -->|"sync call"| S_RFC
+    OS_INIT -->|"sync call"| S_IARM
+
+    D_WORKERS -->|"in GTask thread"| S_UPGRADE
+    D_WORKERS -->|"in GTask thread"| S_FLASH
+    D_WORKERS -->|"in GTask thread"| S_JSON
+    D_INIT -->|"sync call"| S_FWUTILS
+    D_INIT -->|"sync call"| S_RFC
+    D_INIT -->|"sync call"| S_IARM
+```
+
+---
+
+## 10. One-Shot Invocation & Recovery Model
+
+> Shows how `rdkvfwupgrader` is triggered, how it interacts with the Maintenance Manager, and how recovery works across invocations.
+
+```mermaid
+sequenceDiagram
+    participant MM as Maintenance Manager
+    participant OS as rdkvfwupgrader
+    participant FS as Filesystem (/tmp, /opt)
+    participant IARM as IARM Bus
+    participant XCONF as XConf Server
+    participant CDN as CDN
+
+    Note over MM,CDN: === Normal Invocation ===
+    MM->>OS: fork+exec(rdkvfwupgrader, 3, 2)
+    activate OS
+    OS->>FS: Check /tmp/DIFD.pid (no conflict)
+    OS->>FS: Write PID to /tmp/DIFD.pid
+    OS->>IARM: eventManager(FW_STATE_REQUESTING)
+    OS->>XCONF: HTTP POST (XConf query)
+    XCONF-->>OS: JSON response (update available)
+    OS->>IARM: eventManager(FW_STATE_DOWNLOADING)
+    OS->>FS: Set upgrade flag
+    OS->>CDN: HTTP GET (firmware binary, blocks minutes)
+    CDN-->>OS: Firmware data → /opt/fw/image.bin
+    OS->>IARM: eventManager(FW_STATE_FLASHING)
+    OS->>FS: Create /tmp/fw_preparing_to_reboot
+    OS->>FS: flashImage() → Flash storage
+    OS->>FS: Remove upgrade flag
+    OS->>IARM: eventManager(MaintenanceMGR, COMPLETE)
+    OS->>FS: Remove /tmp/DIFD.pid
+    OS-->>MM: exit(0)
+    deactivate OS
+
+    Note over MM,CDN: === Crash Recovery (next invocation) ===
+    MM->>OS: fork+exec(rdkvfwupgrader, 3, 2)
+    activate OS
+    OS->>FS: Check /tmp/fw_preparing_to_reboot → EXISTS
+    OS->>IARM: eventManager(MaintenanceMGR, COMPLETE)
+    OS->>FS: Remove /tmp/fw_preparing_to_reboot
+    OS->>FS: Remove /tmp/DIFD.pid
+    OS-->>MM: exit(0) [DWNL_COMPLETED]
+    deactivate OS
+
+    Note over MM,CDN: === Download Interrupted (SIGUSR1) ===
+    MM->>OS: fork+exec(rdkvfwupgrader, 3, 2)
+    activate OS
+    OS->>CDN: HTTP GET (downloading...)
+    MM->>OS: SIGUSR1 (abort request)
+    OS->>OS: force_exit=1 → curl abort
+    OS->>FS: Partial file remains (/opt/fw/image.bin, 50MB)
+    OS->>FS: Remove /tmp/DIFD.pid
+    OS-->>MM: exit(curl_error)
+    deactivate OS
+
+    Note over MM,CDN: === Resume on Re-invocation ===
+    MM->>OS: fork+exec(rdkvfwupgrader, 3, 2)
+    activate OS
+    OS->>XCONF: HTTP POST (XConf query, confirms same FW)
+    OS->>FS: Check /opt/fw/image.bin → 50MB exists
+    OS->>CDN: HTTP GET (Range: bytes=52428800-)
+    CDN-->>OS: 206 Partial Content (remaining data)
+    OS->>FS: Append to existing file → complete
+    OS->>FS: flashImage()
+    OS-->>MM: exit(0)
+    deactivate OS
+```
+
+---
+
+## 11. One-Shot Shared-Library Interaction Model
+
+> Shows the synchronous call chain between `rdkvfwupgrader` and each shared library, with timing characteristics.
+
+```mermaid
+flowchart TD
+    subgraph "rdkvfwupgrader Process"
+        MAIN["main() — single thread<br/>All calls are BLOCKING"]
+    end
+
+    subgraph "Initialization Phase (~50ms)"
+        LIB_FW["librdksw_fwutils.so<br/>getDeviceProperties()<br/>getImageDetails()"]
+        LIB_RFC_I["librdksw_rfcIntf.so<br/>getRFCSettings()"]
+        LIB_IARM_I["librdksw_iarmIntf.so<br/>init_event_handler()"]
+    end
+
+    subgraph "XConf Phase (5-60s)"
+        LIB_JSON_X["librdksw_jsonparse.so<br/>createJsonString()"]
+        LIB_UPG_X["librdksw_upgrade.so<br/>rdkv_upgrade_request(XCONF)"]
+        LIB_JSON_P["librdksw_jsonparse.so<br/>getXconfRespData()<br/>processJsonResponse()"]
+    end
+
+    subgraph "Download Phase (seconds to minutes)"
+        LIB_UPG_D["librdksw_upgrade.so<br/>rdkv_upgrade_request(PCI/PDRI/PERIPH)"]
+    end
+
+    subgraph "Flash Phase (seconds)"
+        LIB_FLASH_F["librdksw_flash.so<br/>flashImage()"]
+    end
+
+    subgraph "Cleanup Phase (~10ms)"
+        LIB_IARM_T["librdksw_iarmIntf.so<br/>term_event_handler()"]
+    end
+
+    MAIN -->|"1. sync"| LIB_FW
+    MAIN -->|"2. sync"| LIB_RFC_I
+    MAIN -->|"3. sync"| LIB_IARM_I
+    MAIN -->|"4. sync"| LIB_JSON_X
+    MAIN -->|"5. sync (network)"| LIB_UPG_X
+    MAIN -->|"6. sync"| LIB_JSON_P
+    MAIN -->|"7. sync (network, long)"| LIB_UPG_D
+    MAIN -->|"8. sync (I/O)"| LIB_FLASH_F
+    MAIN -->|"9. sync"| LIB_IARM_T
+```
+
+### Call Duration Characteristics
+
+| Phase | Library | Duration | Blocking? | Interruptible? |
+|-------|---------|----------|-----------|----------------|
+| Init | librdksw_fwutils | ~1-5ms | File I/O | No |
+| Init | librdksw_rfcIntf | ~5ms | File/IPC | No |
+| Init | librdksw_iarmIntf | ~10ms | IPC handshake | No |
+| XConf | librdksw_upgrade | **5-60 seconds** | Network | Via `force_exit` |
+| Download | librdksw_upgrade | **Seconds to minutes** | Network | Via `force_exit` / throttle |
+| Flash | librdksw_flash | **Seconds** | Storage I/O | No |
+| Cleanup | librdksw_iarmIntf | ~1ms | IPC | No |
+
+---
+
+## 12. One-Shot vs Daemon — Subsystem Usage Overlay
+
+> Shows which subsystems are active in each execution model and how they differ in invocation pattern.
+
+```mermaid
+flowchart TD
+    subgraph "Shared Subsystems (Both Models)"
+        style S fill:#e8f5e9
+        S1["Firmware Upgrade Engine<br/>librdksw_upgrade.so"]
+        S2["Flash Subsystem<br/>librdksw_flash.so"]
+        S3["XConf Parsing<br/>librdksw_jsonparse.so"]
+        S4["Device Identity<br/>librdksw_fwutils.so"]
+        S5["RFC Configuration<br/>librdksw_rfcIntf.so"]
+        S6["IARM Events<br/>librdksw_iarmIntf.so"]
+        S7["Download Status<br/>download_status_helper.c"]
+        S8["Process Safety<br/>device_status_helper.c"]
+        S9["CEDM / Certs<br/>codebigUtils + mtlsUtils"]
+        S10["Telemetry (T2)"]
+    end
+
+    subgraph "One-Shot Only"
+        style OS fill:#fff3e0
+        OS1["Linear Pipeline<br/>(PCI→PDRI→Peripheral)"]
+        OS2["Multi-firmware Sequencing<br/>(30s inter-flash delay)"]
+        OS3["Direct XConf Query<br/>(no cache, no dedup)"]
+        OS4["Signal Abort (SIGUSR1)"]
+        OS5["Maintenance Manager<br/>Status Reporting"]
+        OS6["Exit Code Propagation"]
+    end
+
+    subgraph "Daemon Only"
+        style D fill:#e3f2fd
+        D1["D-Bus Service Runtime"]
+        D2["Client Process Registry"]
+        D3["GTask Worker Pool"]
+        D4["Concurrency Guards"]
+        D5["Piggyback Queues"]
+        D6["XConf Response Cache"]
+        D7["D-Bus Signal Broadcasting"]
+        D8["Progress Monitor Thread"]
+        D9["Client Library SDK"]
+    end
+
+    %% One-shot → Shared (synchronous)
+    OS1 -->|"sync, blocks main"| S1
+    OS1 -->|"sync, blocks main"| S2
+    OS3 -->|"sync, blocks main"| S3
+    OS5 -->|"fire-and-forget"| S6
+    OS1 -->|"writes status"| S7
+    OS4 -->|"checks force_exit"| S1
+
+    %% Daemon → Shared (via workers)
+    D3 -->|"async, blocks worker"| S1
+    D3 -->|"async, blocks worker"| S2
+    D3 -->|"async, blocks worker"| S3
+    D1 -->|"init/term"| S6
+    D3 -->|"writes status"| S7
+    D4 -->|"guards access"| S1
+    D4 -->|"guards access"| S2
+
+    %% Cross-cutting
+    S8 -.->|"PID check"| OS1
+    S8 -.->|"PID check"| D1
+```
+
+---
+
+## 13. One-Shot Threading & Abort Model
+
+> Counterpart to §6 (Daemon Concurrency Architecture). Documents the simpler concurrency model of the one-shot binary.
+
+```mermaid
+flowchart TD
+    subgraph "rdkvfwupgrader — Single Thread + Signals"
+        MAIN_THREAD["Main Thread<br/>(only thread owned by process)"]
+        
+        subgraph "Main Thread Execution"
+            M1["initialize()"]
+            M2["initialValidation()"]
+            M3["MakeXconfComms()"]
+            M4["rdkv_upgrade_request()"]
+            M5["flashImage()"]
+            M6["uninitialize()"]
+            M1 --> M2 --> M3 --> M4 --> M5 --> M6
+        end
+    end
+
+    subgraph "External Threads (not owned by process)"
+        IARM_THREAD["IARM Internal Thread<br/>(delivers DwnlStopEventHandler)"]
+        SIGNAL_CTX["Signal Context<br/>(SIGUSR1 delivery)"]
+    end
+
+    subgraph "Shared Mutable State"
+        STATE_FORCE["force_exit<br/>(written by signal/IARM, read by curl)"]
+        STATE_DWNL["DwnlState<br/>(pthread_mutex protected)"]
+        STATE_MODE["app_mode<br/>(pthread_mutex protected)"]
+        STATE_CURL["curl handle<br/>(main thread owns, signal may cleanup)"]
+    end
+
+    SIGNAL_CTX -->|"sets force_exit=1<br/>curl_easy_cleanup()"| STATE_FORCE
+    IARM_THREAD -->|"doInteruptDwnl(speed)<br/>sets DwnlState"| STATE_DWNL
+    IARM_THREAD -->|"if speed==0: force_exit=1"| STATE_FORCE
+    
+    M4 -->|"curl progress callback<br/>checks force_exit"| STATE_FORCE
+    M4 -->|"read/write"| STATE_DWNL
+    MAIN_THREAD -->|"owns lifecycle"| STATE_CURL
+```
+
+### Contrast: Concurrency Primitives
+
+| Aspect | One-Shot | Daemon |
+|--------|----------|--------|
+| Threads owned | 1 (main only) | 1 main + N workers + progress monitors |
+| Event loop | None | GLib main loop |
+| Async dispatch | None | GTask + g_idle_add |
+| Concurrency guards | PID file only | PID file + IsDownload + IsFlash + XConfComm |
+| Mutex usage | 2 (DwnlState, app_mode) — mostly uncontested | 5+ (GMutex, G_LOCK, pthread_mutex) |
+| Abort mechanism | SIGUSR1 → force_exit → curl abort | stop_flag per download + g_idle_add |
+| Signal emission | N/A | D-Bus broadcast via main loop |
+| State protection | Single-thread guarantee + signal-safe flag writes | Main-loop serialization + mutexes |
+
+---
+
+## 14. Maintenance Manager Integration (One-Shot)
+
+> Shows how `rdkvfwupgrader` integrates with the RDK Maintenance Manager ecosystem.
+
+```mermaid
+flowchart TD
+    subgraph "RDK Maintenance Framework"
+        MM["Maintenance Manager"]
+        CRON["Scheduled Trigger<br/>(cron / timer)"]
+        TR69["TR-69 / SNMP<br/>Remote Trigger"]
+    end
+
+    subgraph "rdkvfwupgrader Lifecycle"
+        INVOKE["Process Start<br/>(fork+exec)"]
+        MODE_Q["Query Maintenance Mode<br/>(Thunder JSON-RPC)"]
+        EXEC["Firmware Pipeline<br/>(XConf → Download → Flash)"]
+        REPORT["Report Completion<br/>(IARM eventManager)"]
+        EXIT_P["Process Exit<br/>(exit code)"]
+    end
+
+    subgraph "IARM Event Reporting"
+        FW_REQUESTING["FW_STATE_REQUESTING"]
+        FW_DOWNLOADING["FW_STATE_DOWNLOADING"]
+        FW_FLASHING["FW_STATE_FLASHING"]
+        MAINT_COMPLETE["MAINT_FWDOWNLOAD_COMPLETE"]
+        MAINT_ERROR["MAINT_FWDOWNLOAD_ERROR"]
+    end
+
+    subgraph "Interaction Points"
+        THROTTLE["DwnlStopEventHandler<br/>(IARM callback)"]
+        SIGUSR["SIGUSR1<br/>(abort signal)"]
+    end
+
+    MM -->|"trigger_type=2"| INVOKE
+    CRON -->|"trigger_type=2"| INVOKE
+    TR69 -->|"trigger_type=3"| INVOKE
+
+    INVOKE --> MODE_Q
+    MODE_Q -->|"Thunder localhost:9998"| MM
+    MODE_Q --> EXEC
+
+    EXEC -->|"state events"| FW_REQUESTING
+    EXEC -->|"state events"| FW_DOWNLOADING
+    EXEC -->|"state events"| FW_FLASHING
+
+    EXEC --> REPORT
+    REPORT -->|"success"| MAINT_COMPLETE
+    REPORT -->|"failure"| MAINT_ERROR
+
+    REPORT --> EXIT_P
+    EXIT_P -->|"exit(0) or exit(error)"| MM
+
+    MM -->|"throttle/stop"| THROTTLE
+    MM -->|"abort"| SIGUSR
+    THROTTLE -->|"modifies download speed"| EXEC
+    SIGUSR -->|"force_exit=1"| EXEC
+```
+
+---
+
+## 15. Firmware Orchestration — Download/Flash Sequencing (One-Shot)
+
+> Detailed sequencing of multi-firmware operations showing blocking durations and inter-operation coordination.
+
+```mermaid
+gantt
+    title rdkvfwupgrader — Firmware Operation Timeline
+    dateFormat X
+    axisFormat %s
+
+    section Initialization
+    initialize()           :init, 0, 50
+    initialValidation()    :valid, 50, 100
+
+    section XConf Query
+    createJsonString()     :json, 100, 105
+    HTTP POST to XConf     :xconf, 105, 165
+    Parse response         :parse, 165, 170
+
+    section PCI Firmware
+    Download PCI (HTTP GET):dl_pci, 170, 770
+    Flash PCI              :flash_pci, 770, 780
+
+    section Inter-flash Delay
+    sleep(30)              :delay, 780, 810
+
+    section PDRI Firmware
+    Download PDRI          :dl_pdri, 810, 910
+    Flash PDRI             :flash_pdri, 910, 915
+
+    section Peripheral
+    Download Peripheral(s) :dl_periph, 915, 945
+
+    section Cleanup
+    uninitialize() + exit  :cleanup, 945, 950
+```
+
+```mermaid
+sequenceDiagram
+    participant MAIN as main() [single thread]
+    participant UPGRADE as librdksw_upgrade
+    participant FLASH as librdksw_flash
+    participant IARM as IARM Bus
+    participant FS as Filesystem
+
+    Note over MAIN,FS: === PCI Firmware ===
+    MAIN->>IARM: eventManager(FW_STATE_DOWNLOADING)
+    MAIN->>FS: eraseFolderExceParamFile() [clean old images]
+    MAIN->>UPGRADE: rdkv_upgrade_request(PCI) [BLOCKS]
+    Note right of UPGRADE: May take minutes.<br/>Throttle via IARM callback.<br/>Interruptible via force_exit.
+    UPGRADE-->>MAIN: 0 (success)
+    
+    MAIN->>IARM: eventManager(FW_STATE_FLASHING)
+    MAIN->>FS: create /tmp/fw_preparing_to_reboot
+    MAIN->>FLASH: flashImage(PCI) [BLOCKS]
+    FLASH-->>MAIN: 0 (success)
+    
+    Note over MAIN,FS: === PDRI Firmware (30s delay) ===
+    MAIN->>MAIN: sleep(30)
+    MAIN->>UPGRADE: rdkv_upgrade_request(PDRI) [BLOCKS]
+    UPGRADE-->>MAIN: 0 (success)
+    MAIN->>FLASH: flashImage(PDRI) [BLOCKS]
+    FLASH-->>MAIN: 0 (success)
+    
+    Note over MAIN,FS: === Peripheral Firmware ===
+    loop For each peripheral in XConf response
+        MAIN->>UPGRADE: rdkv_upgrade_request(PERIPHERAL) [BLOCKS]
+        UPGRADE-->>MAIN: 0 (success)
+    end
+    MAIN->>IARM: eventManager(PeripheralUpgradeEvent, paths)
+    
+    Note over MAIN,FS: === Cleanup ===
+    MAIN->>IARM: eventManager(MaintenanceMGR, COMPLETE)
+    MAIN->>FS: Remove /tmp/fw_preparing_to_reboot
+    MAIN->>FS: Remove /tmp/DIFD.pid
+    MAIN->>MAIN: exit(0)
+```
diff --git a/openspec/gaps-and-unknowns.md b/openspec/gaps-and-unknowns.md
new file mode 100755
index 00000000..edac2b52
--- /dev/null
+++ b/openspec/gaps-and-unknowns.md
@@ -0,0 +1,115 @@
+# Gaps, Unknowns & Areas Requiring Validation
+
+> This document tracks areas where code analysis alone is insufficient.  
+> Items are classified by confidence level and priority.
+
+---
+
+## 1. Unknowns — Require Manual Validation
+
+### 1.1 External Library Behavior
+
+| Item | Question | Why It Matters |
+|------|----------|---------------|
+| `rdkv_upgrade_request()` internals | Implemented in external `libfwutils`/`libdwnlutil`. Full download/flash logic is opaque. | Core download engine behavior not visible in this repository |
+| `flashImage()` implementation | Called from `flash.c` but actual flash mechanism depends on external HAL/library | Device-specific flash behavior unknown |
+| `getDeviceProperties()` | Reads from `/etc/device.properties` — exact format and available fields unknown | Device configuration dependency |
+| `GetServURL()` | XConf server URL source not visible in repo | Network endpoint configuration |
+| `createJsonString()` | Device JSON payload construction for XConf — format partially visible in unit tests | XConf API contract |
+| `processJsonResponse()` | JSON response validation logic — partially visible | XConf response handling completeness |
+
+### 1.2 Runtime Environment
+
+| Item | Question | Why It Matters |
+|------|----------|---------------|
+| D-Bus policy file | No `dbus-1/system.d/` policy file in repo. Where is `org.rdkfwupdater.Interface` authorized? | **[UNKNOWN]** System bus access control — daemon may fail at runtime without proper policy |
+| `/etc/device.properties` schema | Full set of expected keys unknown | Device initialization dependency |
+| IARM event handlers | Which processes subscribe to `FW_STATE_EVENT`, `MaintenanceMGR` events? | Integration point visibility |
+| `rdk_logger` configuration | Log output destination and rotation policy not in repo | Operational observability |
+| `libcurl` TLS configuration | Certificate paths, CA bundle, mTLS key paths are configured at build time | Security-critical configuration |
+
+### 1.3 Deployment Model
+
+| Item | Question | Why It Matters |
+|------|----------|---------------|
+| Coexistence | Can `rdkvfwupgrader` and `rdkFwupdateMgr` run simultaneously? | **[UNKNOWN]** Both share global state patterns and PID file `/tmp/DIFD.pid` |
+| Migration path | How is the transition from one-shot to daemon mode managed? | Operational deployment question |
+| systemd dependencies | Is `ntp-time-sync.target` always available on target devices? | Service startup reliability |
+
+---
+
+## 2. Inferences — Strongly Implied but Not Explicitly Verified
+
+### 2.1 Code Structure
+
+| Inference | Evidence | Confidence |
+|-----------|----------|------------|
+| `rdkFwupdateMgr.c` was derived from `rdkv_main.c` | Extensive code duplication: `initialize()`, `uninitialize()`, `interuptDwnl()`, `checkTriggerUpgrade()`, `MakeXconfComms()`, all global variables duplicated verbatim. Daemon version adds D-Bus and removes `exit()` on errors. | **HIGH** |
+| The daemon's `MakeXconfComms()` is vestigial | Function exists but is commented out in `rdkFwupdateMgr.c`. The daemon uses `fetch_xconf_firmware_info()` in handlers instead. | **HIGH** |
+| `testClient` is a raw D-Bus test tool | Built from `src/test/testClient.c`, links only GLib/GIO, no `librdkFwupdateMgr` | **HIGH** |
+| State Red recovery is a device resilience feature | Code paths for `RED_STATE_EVENT`, `RED_RECOVERY_STARTED/COMPLETED`, `isInStateRed()` suggest automated recovery from boot failures | **MEDIUM** |
+
+### 2.2 Threading Model
+
+| Inference | Evidence | Confidence |
+|-----------|----------|------------|
+| GLib serializes all D-Bus method handler calls | Code comments: "All D-Bus method handlers run on the main thread. GLib serializes all D-Bus method invocations." No mutex on `IsDownloadInProgress`. | **HIGH** |
+| `IsFlashInProgress` has a potential race condition | Code TODO: "Should be protected with mutex or atomic operations". Accessed by main thread and worker thread cleanup. | **HIGH** |
+| The 30-slot callback registry limit is arbitrary | Comment: "Reduced from 64 to keep stack usage < 10KB — Need to discuss the max number" | **HIGH** |
+
+---
+
+## 3. Assumptions — Reasonable but Unverified
+
+### 3.1 Architectural Assumptions
+
+| Assumption | Basis | Risk |
+|------------|-------|------|
+| Only one firmware update daemon is expected per device | Single bus name ownership, single PID file | LOW — standard daemon pattern |
+| XConf server response format is stable | Code relies on fixed JSON field names (`cloudFWVersion`, `cloudFWFile`, etc.) | MEDIUM — API contract may evolve |
+| Peripheral firmware is packaged as `.tgz` archives | Code appends `.tgz` extension to peripheral firmware names | LOW — consistent in code |
+| Device reboots are handled external to this codebase | No reboot syscall in repository; `rebootImmediately` flag is set but actual reboot is external | MEDIUM — reboot trigger mechanism unknown |
+| `librdkFwupdateMgr.so` is the only intended client interface | Library provides complete async API; raw D-Bus usage (via `testClient`) appears to be for testing only | LOW |
+
+### 3.2 Security Assumptions
+
+| Assumption | Basis | Risk |
+|------------|-------|------|
+| System D-Bus access is restricted by policy files not in this repo | Standard D-Bus security model requires explicit policy | **HIGH** — security-critical |
+| mTLS certificates are provisioned by device manufacturing | `mtlsUtils.c` references certificate paths but doesn't generate them | LOW |
+| XConf server validates device identity | Device JSON payload includes serial number and partner ID | LOW |
+| Downloaded firmware images are cryptographically verified before flash | Not visible in this repo — likely in external `flashImage()` | **HIGH** — security-critical |
+
+---
+
+## 4. Technical Debt Identified
+
+### 4.1 Code-Level
+
+| Issue | Location | Evidence |
+|-------|----------|----------|
+| Massive code duplication between binaries | `rdkv_main.c` / `rdkFwupdateMgr.c` | ~500 lines of nearly identical code |
+| Global variable overuse | Both `rdkv_main.c` and `rdkFwupdateMgr.c` | TODO comments in source: "Global variables should be avoided" |
+| `MakeXconfComms()` duplicated and partially dead | `rdkFwupdateMgr.c` has both active and commented-out versions | Maintenance risk |
+| Missing mutex on `IsFlashInProgress` | `rdkv_dbus_server.c` | TODO in source code |
+| Fixed-size buffers throughout | `URL_MAX_LEN`, `JSON_STR_LEN`, `DWNL_PATH_FILE_LEN` | Stack overflow risk if inputs exceed limits |
+| TODO comments indicating incomplete migration | Multiple `exit(1);//TODO` in `rdkFwupdateMgr.c` | Original one-shot `exit()` calls not fully converted to daemon-safe error handling |
+
+### 4.2 Build System
+
+| Issue | Evidence |
+|-------|----------|
+| Commented-out client library configuration blocks in `Makefile.am` | Lines 123-140: old `librdkFwupdateMgr` config commented out alongside active config |
+| D-Bus daemon flag (`ENABLE_DBUS_DAEMON`) exists but daemon is always built | `bin_PROGRAMS = rdkvfwupgrader rdkFwupdateMgr testClient` is unconditional |
+
+---
+
+## 5. Recommended Validation Activities
+
+1. **D-Bus policy verification** — Confirm system bus policy file exists in the BSP/device layer that authorizes `org.rdkfwupdater.Interface`
+2. **Coexistence testing** — Verify behavior when both `rdkvfwupgrader` and `rdkFwupdateMgr` are present
+3. **Flash verification** — Confirm firmware image integrity verification exists in the `flashImage()` HAL path
+4. **Thread safety audit** — Verify `IsFlashInProgress` race condition impact; consider `g_atomic_int_*` operations
+5. **Buffer overflow review** — Audit all fixed-size buffer usages against maximum possible input lengths from XConf responses
+6. **Reboot mechanism** — Trace how `rebootImmediately` flag translates to actual device reboot
+7. **Client disconnect handling** — Verify daemon behavior when a registered client crashes mid-operation (D-Bus `NameOwnerChanged` monitoring)
diff --git a/openspec/project.md b/openspec/project.md
new file mode 100755
index 00000000..2971d1e3
--- /dev/null
+++ b/openspec/project.md
@@ -0,0 +1,269 @@
+# rdkfwupdater — Baseline Architecture Overview
+
+> **Document Type:** Canonical repository overview and architectural baseline  
+> **Status:** Baseline analysis (code-verified)  
+> **Repository:** `rdkcentral/rdkfwupdater`  
+> **License:** Apache-2.0 (Comcast Cable Communications Management, LLC)
+
+---
+
+## 1. System Purpose
+
+`rdkfwupdater` is production-grade firmware update infrastructure for RDK-V (Reference Design Kit for Video) embedded Linux devices. It manages the complete firmware lifecycle: checking for updates via XConf cloud server, downloading firmware images over HTTP/HTTPS, flashing them to the device, and coordinating reboot.
+
+The system supports three categories of firmware artifacts:
+- **PCI** — Primary Customer Image (main device firmware)
+- **PDRI** — Primary Disaster Recovery Image (Backup working image)
+- **Peripheral** — Peripheral device firmware (e.g., remote control firmware)
+
+---
+
+## 2. Architectural Overview
+
+The repository produces **two distinct binaries** and **one client shared library**:
+
+| Artifact | Entry Point | Runtime Model | Purpose |
+|----------|------------|---------------|---------|
+| `rdkvfwupgrader` | `src/rdkv_main.c` | One-shot CLI process | Legacy/existing firmware updater, invoked by Maintenance Manager |
+| `rdkFwupdateMgr` | `src/rdkFwupdateMgr.c` | Persistent systemd daemon | D-Bus service exposing firmware update APIs to client applications |
+| `librdkFwupdateMgr.so` | `librdkFwupdateMgr/` | Shared library | Client-side SDK that abstracts D-Bus communication with the daemon |
+
+Additionally, `example_plugin` (`librdkFwupdateMgr/examples/example_app.c`) is a reference consumer that demonstrates the full update workflow through the client library.
+
+### 2.1 High-Level System Architecture
+
+```
+┌──────────────────────────────────────────────────────────────────────┐
+│                        RDK Device (Embedded Linux)                   │
+│                                                                      │
+│  ┌─────────────┐     ┌──────────────────────────────────────────┐   │
+│  │ example_app  │     │            rdkFwupdateMgr               │   │
+│  │ (or any app) │     │           (systemd daemon)               │   │
+│  │              │     │                                          │   │
+│  │  links to:   │     │  ┌──────────┐  ┌──────────────────┐    │   │
+│  │ librdkFwup-  │◄───►│  │ D-Bus    │  │ Firmware Logic   │    │   │
+│  │ dateMgr.so   │ IPC │  │ Server   │  │ (XConf, Download,│    │   │
+│  │              │     │  │ (GDBus)  │  │  Flash, Events)  │    │   │
+│  └─────────────┘     │  └──────────┘  └──────────────────┘    │   │
+│                       └──────────────────────────────────────────┘   │
+│                                                                      │
+│  ┌─────────────────────────────────────────────────────────────┐    │
+│  │                    rdkvfwupgrader (one-shot)                  │    │
+│  │     Direct XConf query → Download → Flash → Exit             │    │
+│  └─────────────────────────────────────────────────────────────┘    │
+│                                                                      │
+│  ┌──────────────────── Shared Libraries ────────────────────────┐   │
+│  │ librdksw_upgrade  librdksw_jsonparse  librdksw_flash         │   │
+│  │ librdksw_rfcIntf  librdksw_iarmIntf   librdksw_fwutils       │   │
+│  └──────────────────────────────────────────────────────────────┘   │
+│                                                                      │
+│  ┌──── External Dependencies ────────────────────────────────────┐  │
+│  │ libcurl  libcjson  GLib/GIO  IARMBus  rbus  libdwnlutil      │  │
+│  │ libfwutils  librdkloggers  libsecure_wrapper  libparsejson    │  │
+│  └───────────────────────────────────────────────────────────────┘  │
+└──────────────────────────────────────────────────────────────────────┘
+          │                         │
+          ▼                         ▼
+   ┌─────────────┐          ┌──────────────┐
+   │ XConf Cloud  │          │ CDN/Firmware  │
+   │ Server       │          │ Server (HTTP) │
+   └─────────────┘          └──────────────┘
+```
+
+---
+
+## 3. Subsystem Responsibilities
+
+### 3.1 Internal Shared Libraries (Build Artifacts)
+
+| Library | Sources | Responsibility |
+|---------|---------|---------------|
+| `librdksw_upgrade` | `rdkv_upgrade.c`, `chunk.c`, `cedmInterface/*` | Core HTTP upgrade request engine; Codebig/mTLS certificate management |
+| `librdksw_jsonparse` | `json_process.c` | XConf JSON response parsing into `XCONFRES` structure |
+| `librdksw_flash` | `flash.c`, `download_status_helper.c` | Firmware image flashing and download status tracking |
+| `librdksw_rfcIntf` | `rfcInterface/rfcinterface.c` | Remote Feature Control (RFC) settings reader |
+| `librdksw_iarmIntf` | `iarmInterface/iarmInterface.c` | IARM Bus event manager for system-wide event dispatch |
+| `librdksw_fwutils` | `deviceutils/deviceutils.c`, `device_api.c` | Device property queries, file utilities, system information |
+| `librdkFwupdateMgr` | `librdkFwupdateMgr/src/*` | Client-side SDK library (see §4) |
+
+### 3.2 Source Subsystem Map
+
+| Subsystem | Location | Description |
+|-----------|----------|-------------|
+| Upgrade Engine | `src/rdkv_upgrade.c`, `src/chunk.c` | HTTP/HTTPS firmware download with chunked transfer, throttling, retry logic |
+| CEDM Interface | `src/cedmInterface/` | Codebig endpoint discovery and mTLS authentication |
+| Device Utilities | `src/deviceutils/` | Device property file parsing, firmware version queries |
+| RFC Interface | `src/rfcInterface/` | RFC (Remote Feature Control) parameter access |
+| IARM Interface | `src/iarmInterface/` | IARMBus event publishing (MaintenanceMGR, firmware state) |
+| rBus Interface | `src/rbusInterface/` | rBus data model provider registration |
+| D-Bus Server | `src/dbus/` | GDBus service for daemon mode (see [D-Bus documentation](dbus/dbus-architecture.md)) |
+| JSON Processing | `src/json_process.c` | XConf response parsing |
+| Flash | `src/flash.c` | Firmware flashing to persistent storage |
+| Status Helpers | `src/device_status_helper.c`, `src/download_status_helper.c` | Device and download status tracking |
+
+---
+
+## 4. Runtime Models
+
+### 4.1 One-Shot Model (`rdkvfwupgrader`)
+
+**Entry point:** `src/rdkv_main.c` → `main()`  
+**Invocation:** Typically launched by Maintenance Manager via IARM or cron  
+**Arguments:** `rdkvfwupgrader <retry_count> <trigger_type>`
+
+Trigger types: `1`=Bootup, `2`=Scheduled, `3`=TR-69/SNMP, `4`=App, `5`=Delayed, `6`=State Red Recovery
+
+**Execution flow:** Initialize → Validate → XConf query → Download → Flash → Exit
+
+The one-shot binary performs the entire firmware update lifecycle in a single process invocation. It communicates directly with the XConf server, downloads firmware via HTTP/HTTPS, flashes the image, and exits. On fatal errors, it calls `exit()`.
+
+> **Detailed flow:** [runtime/rdkvfwupgrader-lifecycle.md](runtime/rdkvfwupgrader-lifecycle.md)  
+> **Deep sequence analysis:** [runtime/rdkvfwupgrader-sequence.md](runtime/rdkvfwupgrader-sequence.md)
+
+### 4.2 Daemon Model (`rdkFwupdateMgr`)
+
+**Entry point:** `src/rdkFwupdateMgr.c` → `main()`  
+**Startup:** `systemd` via `rdkFwupdateMgr.service` (`After=tr69hostif.service dbus.service`)  
+**Invocation:** `/usr/bin/rdkFwupdateMgr 0 1`
+
+**State machine:** `STATE_INIT` → `STATE_INIT_VALIDATION` → `STATE_IDLE` (GLib main loop)
+
+The daemon initializes D-Bus service, performs device validation, then enters the GLib main event loop indefinitely. All firmware operations (check, download, flash) are triggered by D-Bus method calls from client applications and executed asynchronously using GTask worker threads.
+
+> **Detailed flow:** [runtime/rdkFwupdateMgr-lifecycle.md](runtime/rdkFwupdateMgr-lifecycle.md)  
+> **Deep sequence analysis:** [runtime/rdkFwupdateMgr-sequence.md](runtime/rdkFwupdateMgr-sequence.md)  
+> **Threading model:** [runtime/daemon-threading-model.md](runtime/daemon-threading-model.md)
+
+### 4.3 Client Library (`librdkFwupdateMgr.so`)
+
+The shared library provides a C API for applications to interact with the daemon. It abstracts all D-Bus communication:
+
+| API | Behavior | Callback |
+|-----|----------|----------|
+| `registerProcess()` | Synchronous D-Bus call; returns handle | None |
+| `checkForUpdate()` | Fire-and-forget D-Bus call; returns immediately | `UpdateEventCallback` (once) |
+| `downloadFirmware()` | Fire-and-forget D-Bus call; returns immediately | `DownloadCallback` (repeated) |
+| `updateFirmware()` | Fire-and-forget D-Bus call; returns immediately | `UpdateCallback` (repeated) |
+| `unregisterProcess()` | Synchronous D-Bus call; frees handle | None |
+
+**Threading model:** The library spawns a background GLib event loop thread at first `registerProcess()` call. This thread subscribes to D-Bus signals and dispatches callbacks. Callers typically use mutex+condvar to synchronize with callbacks.
+
+> **Detailed architecture:** [subsystems/client-library.md](subsystems/client-library.md)  
+> **End-to-end interaction flow:** [runtime/client-daemon-interaction.md](runtime/client-daemon-interaction.md)
+
+---
+
+## 5. Process Relationships
+
+```
+  Maintenance Manager          Client Applications
+        │                      (example_plugin, etc.)
+        │ (triggers via IARM      │
+        │  or systemd)            │ links librdkFwupdateMgr.so
+        ▼                        │
+  ┌──────────────┐               │ D-Bus IPC
+  │rdkvfwupgrader│               │ (system bus)
+  │ (one-shot)   │               ▼
+  └──────┬───────┘         ┌──────────────────┐
+         │                 │ rdkFwupdateMgr   │
+         │                 │ (daemon)          │
+         │                 └────────┬─────────┘
+         │                          │
+         ▼                          ▼
+   ┌─────────────────────────────────────┐
+   │  Shared firmware update libraries   │
+   │  (librdksw_upgrade, librdksw_flash, │
+   │   etc.)                             │
+   └──────────────┬──────────────────────┘
+                  │
+    ┌─────────────┼────────────┐
+    ▼             ▼            ▼
+ XConf        CDN/HTTP      Device
+ Server       Servers       Flash Storage
+```
+
+Both binaries link the same set of shared upgrade libraries but differ in lifecycle:
+- `rdkvfwupgrader`: Exits after single upgrade cycle; can call `exit()` on fatal errors
+- `rdkFwupdateMgr`: Never exits on upgrade errors; logs and continues serving
+
+---
+
+## 6. IPC Architecture Summary
+
+### 6.1 D-Bus (Daemon ↔ Client Library)
+
+| Property | Value |
+|----------|-------|
+| Bus | System bus (`G_BUS_TYPE_SYSTEM`) |
+| Service Name | `org.rdkfwupdater.Service` |
+| Object Path | `/org/rdkfwupdater/Service` |
+| Interface | `org.rdkfwupdater.Interface` |
+
+**Methods:** `RegisterProcess`, `UnregisterProcess`, `CheckForUpdate`, `DownloadFirmware`, `UpdateFirmware`  
+**Signals:** `CheckForUpdateComplete`, `DownloadProgress`, `DownloadError`, `UpdateProgress`
+
+> **Full D-Bus documentation:** [dbus/dbus-architecture.md](dbus/dbus-architecture.md)
+
+### 6.2 IARM Bus (System-Wide Events)
+
+Both binaries publish firmware state events via IARM Bus:
+- `FW_STATE_EVENT` — firmware update state transitions
+- `MaintenanceMGR` — maintenance window status reporting
+- `PeripheralUpgradeEvent` — peripheral firmware results
+- `RED_STATE_EVENT` — State Red recovery notifications
+
+### 6.3 rBus
+
+Used for data model provider registration (rBus integration via `rbusInterface/rbusInterface.c`). Both binaries compile this source.
+
+### 6.4 JSON-RPC (via Thunder)
+
+Used to query MaintenanceManager mode via JSON-RPC over HTTP to WPEFramework's local endpoint (`http://127.0.0.1:9998`).
+
+---
+
+## 7. Build Configuration
+
+**Build system:** GNU Autotools (`configure.ac` / `Makefile.am`)
+
+### Conditional Compilation Flags
+
+| Flag | Purpose |
+|------|---------|
+| `--enable-dbus-daemon` | Enables D-Bus daemon compilation (defines `ENABLE_DBUS_DAEMON`) |
+| `--enable-iarmevent` | Enables IARM Bus event support |
+| `--enable-rfcapi` | Enables RFC API for remote feature control |
+| `--enable-t2api` | Enables Telemetry 2.0 event support |
+| `--enable-cpc-code` | Alternate CEDM/mTLS implementation |
+| `--enable-extended-logger` | Extended RDK logger initialization |
+| `--enable-rdkcertselector` | Alternate certificate selection library |
+| `--enable-mountutils` | Mount utilities integration |
+
+---
+
+## 8. Supporting Documentation
+
+| Document | Path | Content |
+|----------|------|---------|
+| D-Bus Architecture | [dbus/dbus-architecture.md](dbus/dbus-architecture.md) | D-Bus server setup, interface introspection, method handlers, signal model, concurrency control |
+| rdkvfwupgrader Lifecycle | [runtime/rdkvfwupgrader-lifecycle.md](runtime/rdkvfwupgrader-lifecycle.md) | One-shot binary execution flow, state transitions, error handling |
+| rdkFwupdateMgr Lifecycle | [runtime/rdkFwupdateMgr-lifecycle.md](runtime/rdkFwupdateMgr-lifecycle.md) | Daemon lifecycle, GLib main loop, state machine, shutdown |
+| Client Library Architecture | [subsystems/client-library.md](subsystems/client-library.md) | Library internals, callback registry, background thread, signal dispatch |
+| Firmware Update Flows | [runtime/firmware-update-flows.md](runtime/firmware-update-flows.md) | End-to-end sequence diagrams for check/download/flash operations |
+| **rdkvfwupgrader Sequence** | [runtime/rdkvfwupgrader-sequence.md](runtime/rdkvfwupgrader-sequence.md) | **Deep execution-flow analysis: blocking operations, SIGUSR1 handling, throttle interaction, Gantt timeline** |
+| **rdkFwupdateMgr Sequence** | [runtime/rdkFwupdateMgr-sequence.md](runtime/rdkFwupdateMgr-sequence.md) | **Deep daemon lifecycle: state machine, CheckForUpdate/Download/Flash GTask flows, concurrency controls, shutdown** |
+| **Client-Daemon Interaction** | [runtime/client-daemon-interaction.md](runtime/client-daemon-interaction.md) | **End-to-end flow from app→library→D-Bus→daemon→worker→signal→callback, D-Bus message formats, timing profile** |
+| **Daemon Threading Model** | [runtime/daemon-threading-model.md](runtime/daemon-threading-model.md) | **Thread inventory, synchronization primitives, cross-thread data flow, GLib async patterns (GTask, g_idle_add, GThread)** |
+| Architecture Diagrams | [diagrams/](diagrams/) | Mermaid-format sequence and interaction diagrams |
+| Gaps & Unknowns | [gaps-and-unknowns.md](gaps-and-unknowns.md) | Areas requiring manual validation, unverified assumptions |
+
+---
+
+## 9. Evidence Classification
+
+Throughout supporting documents, findings are classified as:
+
+- **[FACT]** — Directly verified from source code, build files, or configuration
+- **[INFERENCE]** — Strongly implied by code structure, naming, or call patterns
+- **[ASSUMPTION]** — Reasonable but not verified from code alone
+- **[UNKNOWN]** — Requires manual validation on target hardware or platform documentation
diff --git a/openspec/runtime/client-daemon-interaction.md b/openspec/runtime/client-daemon-interaction.md
new file mode 100755
index 00000000..8428d5e8
--- /dev/null
+++ b/openspec/runtime/client-daemon-interaction.md
@@ -0,0 +1,387 @@
+# Client-Daemon Interaction — End-to-End Flow
+
+> **Evidence Level:** Verified from `librdkFwupdateMgr/src/rdkFwupdateMgr_api.c`, `rdkFwupdateMgr_async.c`, `rdkFwupdateMgr_process.c`, and `src/dbus/rdkv_dbus_server.c`  
+> **Scope:** Complete journey of a firmware update from client application through library, D-Bus, daemon, and back via signals/callbacks
+
+---
+
+## 1. Architecture Overview
+
+```mermaid
+flowchart LR
+    subgraph "Client Process"
+        APP[Application Code]
+        LIB[librdkFwupdateMgr.so]
+        BG[Background Thread<br/>GLib Main Loop]
+        CB[Callback Registries<br/>g_registry / g_dwnl_registry / g_update_registry]
+    end
+    
+    subgraph "D-Bus System Bus"
+        DBUS[(org.rdkfwupdater.Interface<br/>/org/rdkfwupdater/Service)]
+    end
+    
+    subgraph "Daemon Process (rdkFwupdateMgr)"
+        MAIN_LOOP[GLib Main Loop<br/>process_app_request()]
+        TASKS[Task Tracking<br/>active_tasks + waiting queues]
+        WORKERS[GTask Worker Pool]
+    end
+    
+    APP -->|"API call (blocking D-Bus)"| LIB
+    LIB -->|"Method call"| DBUS
+    DBUS -->|"Dispatch"| MAIN_LOOP
+    MAIN_LOOP -->|"Spawn"| WORKERS
+    WORKERS -->|"g_task_return / g_idle_add"| MAIN_LOOP
+    MAIN_LOOP -->|"Signal broadcast"| DBUS
+    DBUS -->|"Signal delivery"| BG
+    BG -->|"Invoke registered callback"| CB
+    CB -->|"App callback (user thread)"| APP
+```
+
+---
+
+## 2. Complete Firmware Update Lifecycle
+
+```mermaid
+sequenceDiagram
+    participant APP as Client Application
+    participant LIB as librdkFwupdateMgr<br/>(caller's thread)
+    participant BG as Library Background Thread<br/>(GLib main loop)
+    participant DBUS as D-Bus System Bus
+    participant DAEMON_ML as Daemon Main Loop<br/>(process_app_request)
+    participant DAEMON_W as Daemon Worker Thread<br/>(GTask)
+    participant XCONF as XConf Cloud
+    participant CDN as CDN Server
+
+    Note over APP,CDN: ═══ PHASE 1: INITIALIZATION ═══
+
+    APP->>LIB: rdkFwupdateMgr_init()
+    activate LIB
+    LIB->>LIB: internal_system_init()
+    LIB->>BG: g_thread_new("fwupdate_bg_thread")
+    activate BG
+    BG->>BG: g_main_loop_new() + g_main_loop_run()
+    Note right of BG: Background thread running.<br/>Subscribes to D-Bus signals:<br/>- CheckForUpdateComplete<br/>- DownloadProgress<br/>- UpdateProgress
+    BG->>DBUS: g_dbus_connection_signal_subscribe() × 3
+    LIB-->>APP: return (success)
+    deactivate LIB
+
+    Note over APP,CDN: ═══ PHASE 2: REGISTRATION ═══
+
+    APP->>LIB: registerProcess("MyApp", "1.0")
+    activate LIB
+    Note over LIB: Creates fresh D-Bus proxy (ephemeral)
+    LIB->>DBUS: g_dbus_proxy_call_sync("RegisterProcess", ("MyApp", "1.0"))
+    DBUS->>DAEMON_ML: Dispatch RegisterProcess
+    activate DAEMON_ML
+    DAEMON_ML->>DAEMON_ML: Validate name/version
+    DAEMON_ML->>DAEMON_ML: add_process_to_tracking() → handler_id=12345
+    DAEMON_ML->>DBUS: Return (handler_id=12345)
+    deactivate DAEMON_ML
+    DBUS-->>LIB: GVariant (t: 12345)
+    LIB->>LIB: Convert handler_id to string: "12345"
+    LIB->>LIB: Return "12345" as FirmwareInterfaceHandle
+    LIB-->>APP: handle = "12345"
+    deactivate LIB
+
+    Note over APP,CDN: ═══ PHASE 3: CHECK FOR UPDATE ═══
+
+    APP->>LIB: registerCheckForUpdateCallback(handle, my_callback)
+    activate LIB
+    LIB->>BG: Add callback to g_registry[handle]
+    Note right of BG: CRITICAL: Register BEFORE send!<br/>Prevents race with fast signal.
+    LIB-->>APP: return (success)
+    deactivate LIB
+
+    APP->>LIB: checkForUpdate(handle)
+    activate LIB
+    Note over LIB: Creates fresh D-Bus proxy
+    LIB->>DBUS: g_dbus_proxy_call_sync("CheckForUpdate", ("12345"))
+    
+    DBUS->>DAEMON_ML: Dispatch CheckForUpdate
+    activate DAEMON_ML
+    DAEMON_ML->>DAEMON_ML: Validate handler, registration ✓
+    DAEMON_ML->>DBUS: Return (0, "", "", "", "check in progress", 3)
+    Note right of DAEMON_ML: IMMEDIATE response.<br/>Client unblocked now.
+    DAEMON_ML->>DAEMON_ML: Create TaskContext, add to tracking
+    
+    alt No fetch running
+        DAEMON_ML->>DAEMON_ML: setXConfCommStatus(TRUE)
+        DAEMON_ML->>DAEMON_W: g_task_run_in_thread(xconf_fetch_worker)
+        activate DAEMON_W
+    else Fetch already running (piggyback)
+        DAEMON_ML->>DAEMON_ML: Task joins waiting queue
+    end
+    deactivate DAEMON_ML
+    
+    DBUS-->>LIB: GVariant (issssi: 0,"","","","check in progress",3)
+    LIB->>LIB: Parse → FwUpdateData{status_code=3}
+    LIB-->>APP: return FwUpdateData (FIRMWARE_CHECK_ERROR=3)
+    deactivate LIB
+    Note right of APP: App knows: check in progress.<br/>Real result comes via callback.
+
+    Note over DAEMON_W,XCONF: Worker Thread (blocking)
+    DAEMON_W->>XCONF: rdkFwupdateMgr_checkForUpdate() [HTTP POST]
+    XCONF-->>DAEMON_W: JSON response (firmware info)
+    DAEMON_W->>DAEMON_W: Package result as GVariant
+    DAEMON_W->>DAEMON_W: g_task_return_pointer(result)
+    deactivate DAEMON_W
+
+    Note over DAEMON_ML,DBUS: Completion Callback (main loop)
+    activate DAEMON_ML
+    DAEMON_ML->>DAEMON_ML: rdkfw_xconf_fetch_done()
+    DAEMON_ML->>DBUS: emit_signal("CheckForUpdateComplete", result)
+    Note right of DBUS: Broadcast to ALL subscribers
+    DAEMON_ML->>DAEMON_ML: Cleanup waiting tasks, reset status
+    deactivate DAEMON_ML
+
+    DBUS->>BG: Signal: CheckForUpdateComplete
+    activate BG
+    BG->>BG: on_check_update_signal_received()
+    BG->>BG: Parse GVariant → FwUpdateData
+    BG->>BG: Lookup callback in g_registry["12345"]
+    BG->>APP: my_callback(handle, &fw_data)
+    Note right of APP: App receives real result:<br/>FIRMWARE_AVAILABLE + version info
+    deactivate BG
+
+    Note over APP,CDN: ═══ PHASE 4: DOWNLOAD FIRMWARE ═══
+
+    APP->>LIB: registerDownloadCallback(handle, my_dwnl_callback)
+    activate LIB
+    LIB->>BG: Add callback to g_dwnl_registry[handle]
+    LIB-->>APP: return (success)
+    deactivate LIB
+
+    APP->>LIB: downloadFirmware(handle, "fw_v2.0.bin", "", "PCI")
+    activate LIB
+    LIB->>DBUS: g_dbus_proxy_call_sync("DownloadFirmware", ("12345","fw_v2.0.bin","","PCI"))
+    
+    DBUS->>DAEMON_ML: Dispatch DownloadFirmware
+    activate DAEMON_ML
+    DAEMON_ML->>DAEMON_ML: Validate all inputs ✓
+    DAEMON_ML->>DAEMON_ML: Check cache: /opt/CDL/fw_v2.0.bin → not found
+    DAEMON_ML->>DAEMON_ML: IsDownloadInProgress = TRUE
+    DAEMON_ML->>DAEMON_W: g_task_run_in_thread(download_worker)
+    activate DAEMON_W
+    DAEMON_ML->>DBUS: Return ("RDKFW_DWNL_SUCCESS", "INPROGRESS", "started")
+    deactivate DAEMON_ML
+    
+    DBUS-->>LIB: GVariant (sss)
+    LIB-->>APP: return DownloadResult{INPROGRESS}
+    deactivate LIB
+    Note right of APP: App knows: download started.<br/>Progress comes via callback.
+
+    Note over DAEMON_W,CDN: Worker Thread (blocking download)
+    DAEMON_W->>CDN: rdkv_upgrade_request() [HTTP GET, download_only=1]
+    
+    loop Progress Updates (every 100ms)
+        DAEMON_W->>DAEMON_ML: g_idle_add(emit_download_progress: N%)
+        DAEMON_ML->>DBUS: emit_signal("DownloadProgress", N%)
+        DBUS->>BG: Signal: DownloadProgress
+        BG->>BG: on_download_progress_signal()
+        BG->>APP: my_dwnl_callback(handle, progress=N%, INPROGRESS)
+    end
+    
+    CDN-->>DAEMON_W: Download complete
+    DAEMON_W->>DAEMON_ML: g_idle_add(emit_download_progress: 100%, COMPLETED)
+    DAEMON_W->>DAEMON_W: g_task_return_boolean(TRUE)
+    deactivate DAEMON_W
+    
+    DAEMON_ML->>DBUS: emit_signal("DownloadProgress", 100%, COMPLETED)
+    DBUS->>BG: Signal: DownloadProgress (COMPLETED)
+    BG->>APP: my_dwnl_callback(handle, progress=100%, COMPLETED)
+
+    Note over APP,CDN: ═══ PHASE 5: UPDATE (FLASH) FIRMWARE ═══
+
+    APP->>LIB: registerUpdateCallback(handle, my_update_callback)
+    APP->>LIB: updateFirmware(handle, "fw_v2.0.bin", "/opt/CDL/fw_v2.0.bin", "PCI", "false")
+    activate LIB
+    LIB->>DBUS: g_dbus_proxy_call_sync("UpdateFirmware", (...))
+    DBUS->>DAEMON_ML: Dispatch UpdateFirmware
+    activate DAEMON_ML
+    DAEMON_ML->>DAEMON_ML: Validate, check no download/flash in progress
+    DAEMON_ML->>DAEMON_W: g_task_run_in_thread(flash_worker)
+    DAEMON_ML->>DBUS: Return ("RDKFW_UPDATE_SUCCESS", "INPROGRESS", "started")
+    deactivate DAEMON_ML
+    DBUS-->>LIB: Response
+    LIB-->>APP: return UpdateResult{INPROGRESS}
+    deactivate LIB
+
+    activate DAEMON_W
+    DAEMON_W->>DAEMON_W: flashImage() [BLOCKING]
+    DAEMON_W->>DAEMON_ML: g_idle_add(emit: COMPLETED)
+    deactivate DAEMON_W
+    DAEMON_ML->>DBUS: emit_signal("UpdateProgress", COMPLETED)
+    DBUS->>BG: Signal: UpdateProgress
+    BG->>APP: my_update_callback(handle, COMPLETED)
+
+    Note over APP,CDN: ═══ PHASE 6: CLEANUP ═══
+
+    APP->>LIB: unregisterProcess(handle)
+    activate LIB
+    LIB->>DBUS: g_dbus_proxy_call_sync("UnregisterProcess", ("12345","MyApp"))
+    DBUS->>DAEMON_ML: Dispatch UnregisterProcess
+    DAEMON_ML->>DAEMON_ML: remove_process_from_tracking()
+    DAEMON_ML->>DBUS: Return (TRUE)
+    DBUS-->>LIB: Response
+    LIB->>LIB: Free handle string
+    LIB-->>APP: return (success)
+    deactivate LIB
+
+    APP->>LIB: rdkFwupdateMgr_term()
+    LIB->>BG: g_main_loop_quit()
+    BG->>BG: Unsubscribe signals, exit loop
+    deactivate BG
+    LIB->>LIB: g_thread_join(bg_thread)
+    LIB-->>APP: return (success)
+```
+
+---
+
+## 3. Thread Context Annotations
+
+| Operation | Thread | Evidence |
+|-----------|--------|----------|
+| `registerProcess()` | Caller's thread (blocking D-Bus call) | `g_dbus_proxy_call_sync` in `rdkFwupdateMgr_process.c` |
+| `checkForUpdate()` | Caller's thread (blocking D-Bus call) | `g_dbus_proxy_call_sync` in `rdkFwupdateMgr_api.c` |
+| `downloadFirmware()` | Caller's thread (blocking D-Bus call) | `g_dbus_proxy_call_sync` in `rdkFwupdateMgr_api.c` |
+| `updateFirmware()` | Caller's thread (blocking D-Bus call) | `g_dbus_proxy_call_sync` in `rdkFwupdateMgr_api.c` |
+| Callback invocation | Library background thread | `background_thread_func` in `rdkFwupdateMgr_async.c` |
+| Signal subscription | Library background thread | `g_dbus_connection_signal_subscribe` in background loop |
+| D-Bus dispatch | Daemon main loop thread | `process_app_request` is GDBus interface vtable callback |
+| XConf fetch | Daemon GTask worker thread | `rdkfw_xconf_fetch_worker` via `g_task_run_in_thread` |
+| Download | Daemon GTask worker thread | `rdkfw_download_worker` via `g_task_run_in_thread` |
+| Progress monitor | Daemon dedicated GThread | `rdkfw_progress_monitor_thread` via `g_thread_try_new` |
+| Flash | Daemon GTask worker thread | `rdkfw_flash_worker` via `g_task_run_in_thread` |
+| Signal emission | Daemon main loop thread | via `g_idle_add()` from worker → main loop serialized |
+
+---
+
+## 4. Race Condition Prevention
+
+### 4.1 Library-Side: Register Callback Before Method Call
+
+```mermaid
+sequenceDiagram
+    participant APP as App Thread
+    participant LIB as Library
+    participant BG as BG Thread
+    participant DBUS as D-Bus
+
+    Note over APP,DBUS: CORRECT order (prevents missed signal)
+    APP->>LIB: registerCheckForUpdateCallback(handle, cb)
+    LIB->>BG: Store cb in g_registry[handle]
+    APP->>LIB: checkForUpdate(handle)
+    LIB->>DBUS: D-Bus method call
+    Note right of DBUS: Even if signal arrives instantly,<br/>callback is already registered.
+```
+
+**[FACT]** The example_app.c demonstrates this pattern explicitly:
+```c
+registerCheckForUpdateCallback(handle, checkForUpdateCallback);  // FIRST
+FwUpdateData result = checkForUpdate(handle);                    // THEN
+```
+
+### 4.2 Daemon-Side: Immediate Response + Signal Pattern
+
+**[FACT]** The daemon sends the D-Bus method response BEFORE spawning the worker. This means:
+1. Client's `g_dbus_proxy_call_sync()` returns immediately
+2. Client's background thread is already subscribed to signals  
+3. Worker completes → signal broadcast → callback fires in client BG thread
+
+### 4.3 Piggyback Queue Safety
+
+**[FACT]** The `waiting_checkUpdate_ids` and `waiting_download_ids` lists are only accessed from the main loop thread (either in `process_app_request` or in the `_done` completion callback). No mutex needed because GLib main loop serializes access.
+
+---
+
+## 5. Error Propagation Paths
+
+```mermaid
+flowchart TD
+    subgraph "Client Receives Errors Via"
+        E1["D-Bus method return<br/>(immediate validation errors)"]
+        E2["Signal callback<br/>(async operation errors)"]
+    end
+    
+    subgraph "Immediate Errors (method return)"
+        IE1["Invalid handler ID"]
+        IE2["Not registered"]
+        IE3["Download already in progress<br/>(different firmware)"]
+        IE4["Flash already in progress"]
+        IE5["Invalid firmware type"]
+    end
+    
+    subgraph "Async Errors (signal callback)"
+        AE1["XConf server unreachable"]
+        AE2["Invalid XConf response"]
+        AE3["Download failed (network)"]
+        AE4["No XConf cache for URL"]
+        AE5["Flash failed"]
+    end
+    
+    IE1 & IE2 & IE3 & IE4 & IE5 --> E1
+    AE1 & AE2 & AE3 & AE4 & AE5 --> E2
+```
+
+---
+
+## 6. D-Bus Message Format Reference
+
+### Methods (Client → Daemon)
+
+| Method | Input Signature | Output Signature |
+|--------|----------------|------------------|
+| `RegisterProcess` | `(ss)` name, version | `(t)` handler_id |
+| `UnregisterProcess` | `(ts)` handler_id, name | `(b)` success |
+| `CheckForUpdate` | `(s)` handler_id | `(issssi)` result, ver, avail, details, status, code |
+| `DownloadFirmware` | `(ssss)` handler, name, url, type | `(sss)` result, status, message |
+| `UpdateFirmware` | `(sssss)` handler, name, path, type, reboot | `(sss)` result, status, message |
+
+### Signals (Daemon → Client, broadcast)
+
+| Signal | Signature | Fields |
+|--------|-----------|--------|
+| `CheckForUpdateComplete` | `(tiissss)` | handler_id, result, status_code, current_ver, avail_ver, details, message |
+| `DownloadProgress` | `(tsuss)` | handler_id, firmware_name, progress, status, message |
+| `UpdateProgress` | `(tsuss)` | handler_id, firmware_name, progress, status, message |
+
+---
+
+## 7. Connection Lifecycle
+
+```mermaid
+flowchart TD
+    subgraph "Library Connection Model"
+        INIT["rdkFwupdateMgr_init()"] -->|"Creates"| BG_CONN["Background thread connection<br/>(persistent, for signal subscription)"]
+        
+        API1["registerProcess()"] -->|"Creates + destroys"| EP1["Ephemeral proxy #1"]
+        API2["checkForUpdate()"] -->|"Creates + destroys"| EP2["Ephemeral proxy #2"]
+        API3["downloadFirmware()"] -->|"Creates + destroys"| EP3["Ephemeral proxy #3"]
+        API4["updateFirmware()"] -->|"Creates + destroys"| EP4["Ephemeral proxy #4"]
+        API5["unregisterProcess()"] -->|"Creates + destroys"| EP5["Ephemeral proxy #5"]
+        
+        TERM["rdkFwupdateMgr_term()"] -->|"Closes"| BG_CONN
+    end
+```
+
+**[FACT]** Each API call creates a fresh `GDBusProxy` and disposes it after the synchronous call completes. Only the background thread maintains a persistent connection for signal reception.
+
+**[INFERENCE]** This design trades per-call overhead (~5ms proxy creation) for simplicity — no connection state to manage, no reconnect logic needed in the API layer.
+
+---
+
+## 8. Typical Timing Profile
+
+| Phase | Client Thread Blocked | Wall Clock |
+|-------|----------------------|------------|
+| `registerProcess()` | ~10-50ms (D-Bus round-trip) | Same |
+| `checkForUpdate()` | ~10-50ms (immediate response) | Same |
+| XConf fetch (async) | 0 (callback notification) | 5-60s |
+| `downloadFirmware()` | ~10-50ms (immediate response) | Same |
+| Download (async) | 0 (progress callbacks) | 30s-10min |
+| `updateFirmware()` | ~10-50ms (immediate response) | Same |
+| Flash (async) | 0 (callback notification) | 10-120s |
+| `unregisterProcess()` | ~10-50ms (D-Bus round-trip) | Same |
+
+**Total client thread blocking time: ~50-250ms**  
+**Total wall-clock time for full update: 1-15 minutes**
diff --git a/openspec/runtime/daemon-threading-model.md b/openspec/runtime/daemon-threading-model.md
new file mode 100755
index 00000000..1230e131
--- /dev/null
+++ b/openspec/runtime/daemon-threading-model.md
@@ -0,0 +1,314 @@
+# Daemon Threading Model
+
+> **Evidence Level:** Verified from `src/dbus/rdkv_dbus_server.c`, `src/rdkFwupdateMgr.c`, `librdkFwupdateMgr/src/rdkFwupdateMgr_async.c`  
+> **Scope:** Every thread context in both daemon and client library, with synchronization primitives
+
+---
+
+## 1. Daemon Thread Architecture
+
+```mermaid
+flowchart TD
+    subgraph "rdkFwupdateMgr Process"
+        direction TB
+        
+        subgraph MAIN_THREAD["Main Thread (GLib Main Loop)"]
+            direction LR
+            ML_DBUS["D-Bus Dispatch<br/>process_app_request()"]
+            ML_IDLE["g_idle_add() callbacks<br/>emit signals"]
+            ML_DONE["GTask completion callbacks<br/>xconf_fetch_done()<br/>download_done()<br/>flash_done()"]
+        end
+        
+        subgraph WORKER_POOL["GLib Thread Pool (GTask Workers)"]
+            direction LR
+            W1["Worker: rdkfw_xconf_fetch_worker<br/>Blocking XConf HTTP POST"]
+            W2["Worker: rdkfw_download_worker<br/>Blocking firmware download"]
+            W3["Worker: rdkfw_flash_worker<br/>Blocking flash operation"]
+        end
+        
+        subgraph MONITOR_THREADS["Dedicated Threads (GThread)"]
+            M1["rdkfw_progress_monitor_thread<br/>Polls /opt/curl_progress<br/>every 100ms"]
+        end
+    end
+    
+    MAIN_THREAD -->|"g_task_run_in_thread()"| WORKER_POOL
+    WORKER_POOL -->|"g_task_return_*()"| MAIN_THREAD
+    WORKER_POOL -->|"g_thread_try_new()"| MONITOR_THREADS
+    MONITOR_THREADS -->|"g_idle_add()"| MAIN_THREAD
+    WORKER_POOL -->|"g_idle_add()"| MAIN_THREAD
+```
+
+---
+
+## 2. Thread Inventory
+
+### 2.1 Daemon Threads
+
+| Thread | Creation | Lifetime | Purpose | Blocking Calls |
+|--------|----------|----------|---------|----------------|
+| **Main Thread** | Process start | Entire daemon lifecycle | GLib main loop, D-Bus dispatch, signal emission, state management | `g_main_loop_run()` (event wait) |
+| **XConf Worker** | On first CheckForUpdate | Until XConf response received | Blocking HTTP POST to XConf server | `rdkFwupdateMgr_checkForUpdate()` |
+| **Download Worker** | On DownloadFirmware | Until download completes | Blocking HTTP GET for firmware | `rdkv_upgrade_request()` |
+| **Flash Worker** | On UpdateFirmware | Until flash completes | Blocking flash I/O | `flashImage()` |
+| **Progress Monitor** | Spawned by Download Worker | Until download worker signals stop | Poll progress file, emit signals | `g_usleep(100000)` (100ms sleep) |
+
+### 2.2 Client Library Threads
+
+| Thread | Creation | Lifetime | Purpose | Blocking Calls |
+|--------|----------|----------|---------|----------------|
+| **Caller Thread** | Application owns | Application-managed | Synchronous D-Bus proxy calls | `g_dbus_proxy_call_sync()` (10-50ms) |
+| **Background Thread** | `rdkFwupdateMgr_init()` | Until `rdkFwupdateMgr_term()` | GLib main loop for signal subscription and callback dispatch | `g_main_loop_run()` (event wait) |
+
+---
+
+## 3. Detailed Thread Interaction Diagram
+
+```mermaid
+sequenceDiagram
+    participant T1 as Main Thread<br/>(GLib Main Loop)
+    participant T2 as XConf Worker<br/>(GTask pool)
+    participant T3 as Download Worker<br/>(GTask pool)
+    participant T4 as Progress Monitor<br/>(dedicated GThread)
+
+    Note over T1: g_main_loop_run() — event dispatch
+    
+    Note over T1,T2: === CheckForUpdate ===
+    T1->>T1: process_app_request("CheckForUpdate")
+    T1->>T1: Validation + immediate response
+    T1->>T1: setXConfCommStatus(TRUE) [G_LOCK]
+    T1->>T2: g_task_run_in_thread(xconf_fetch_worker)
+    activate T2
+    Note right of T1: Main loop FREE<br/>for other requests
+    T2->>T2: rdkFwupdateMgr_checkForUpdate() [BLOCKS 5-60s]
+    T2->>T2: g_task_return_pointer(result)
+    deactivate T2
+    T1->>T1: rdkfw_xconf_fetch_done() [scheduled by GTask]
+    T1->>T1: emit_signal("CheckForUpdateComplete")
+    T1->>T1: setXConfCommStatus(FALSE) [G_LOCK]
+    
+    Note over T1,T4: === DownloadFirmware ===
+    T1->>T1: process_app_request("DownloadFirmware")
+    T1->>T1: Validation + immediate response
+    T1->>T1: IsDownloadInProgress = TRUE
+    T1->>T3: g_task_run_in_thread(download_worker)
+    activate T3
+    T3->>T4: g_thread_try_new("progress_monitor")
+    activate T4
+    T3->>T3: rdkv_upgrade_request() [BLOCKS minutes]
+    
+    loop Every 100ms
+        T4->>T4: Read /opt/curl_progress
+        T4->>T1: g_idle_add(emit_download_progress)
+        T1->>T1: rdkfw_emit_download_progress() [signal emit]
+    end
+    
+    T3->>T3: Download complete
+    T3->>T4: atomic_store(stop_flag, 1)
+    T4->>T4: Detect stop_flag, exit loop
+    deactivate T4
+    T3->>T3: g_thread_join(monitor_thread)
+    T3->>T1: g_idle_add(emit_progress: COMPLETED)
+    T3->>T3: g_task_return_boolean(TRUE)
+    deactivate T3
+    T1->>T1: rdkfw_download_done() [scheduled by GTask]
+    T1->>T1: IsDownloadInProgress = FALSE
+```
+
+---
+
+## 4. Synchronization Primitives
+
+### 4.1 Daemon Process
+
+```mermaid
+flowchart TD
+    subgraph "Mutex-Protected State"
+        M1["pthread_mutex_t mutuex_dwnl_state<br/>Guards: DwnlState (int)"]
+        M2["pthread_mutex_t app_mode_status<br/>Guards: app_mode (int)"]
+        M3["G_LOCK(xconf_status_mutex)<br/>Guards: XConfCommStatus (gboolean)"]
+        M4["GMutex* monitor_mutex<br/>Guards: stop_flag (per-download)"]
+    end
+    
+    subgraph "Main-Loop-Serialized State (no mutex needed)"
+        S1["registered_processes (GHashTable)"]
+        S2["active_tasks (GHashTable)"]
+        S3["waiting_checkUpdate_ids (GSList)"]
+        S4["waiting_download_ids (GSList)"]
+        S5["IsDownloadInProgress (gboolean)"]
+        S6["IsFlashInProgress (gboolean)"]
+        S7["current_download (CurrentDownloadState*)"]
+        S8["current_flash (CurrentFlashState*)"]
+    end
+    
+    subgraph "Thread-Safe Communication"
+        C1["g_task_return_pointer() / g_task_return_boolean()<br/>Worker → Main (via GTask framework)"]
+        C2["g_idle_add(callback, data)<br/>Worker/Monitor → Main (via GLib idle source)"]
+        C3["atomic gint stop_flag<br/>Worker → Monitor (via atomic/mutex)"]
+    end
+```
+
+### 4.2 Synchronization Rules
+
+| Rule | Mechanism | Rationale |
+|------|-----------|-----------|
+| Only one XConf fetch at a time | `XConfCommStatus` via `G_LOCK` | Prevents duplicate network calls |
+| Worker → Main loop data transfer | `g_task_return_*()` | GTask framework ensures main-loop dispatch |
+| Worker → Signal emission | `g_idle_add()` | Schedules function on main loop (thread-safe) |
+| Stop progress monitor | Atomic int + `GMutex` | Worker sets flag, monitor polls it |
+| Download/Flash state flags | Main loop serialization | Only modified in main-loop context callbacks |
+| `DwnlState` | `pthread_mutex_t` | Read from IARM callback context (possibly different thread) |
+| `app_mode` | `pthread_mutex_t` | Written from IARM callback (`interuptDwnl`) |
+
+---
+
+## 5. Client Library Threading Model
+
+```mermaid
+flowchart TD
+    subgraph "Client Library (librdkFwupdateMgr.so)"
+        direction TB
+        
+        subgraph CALLER["Caller's Thread"]
+            API["Public API functions<br/>registerProcess()<br/>checkForUpdate()<br/>downloadFirmware()<br/>updateFirmware()<br/>unregisterProcess()"]
+            PROXY["Ephemeral GDBusProxy<br/>(created per call, destroyed after)"]
+        end
+        
+        subgraph BG_THREAD["Background Thread (fwupdate_bg_thread)"]
+            BG_LOOP["GLib Main Loop"]
+            SUBS["Signal Subscriptions<br/>CheckForUpdateComplete<br/>DownloadProgress<br/>UpdateProgress"]
+            DISPATCH["Callback Dispatch<br/>Looks up registered callback<br/>Invokes in BG thread context"]
+        end
+        
+        subgraph REGISTRIES["Callback Registries (thread-safe)"]
+            R1["g_registry<br/>(CheckForUpdate callbacks)"]
+            R2["g_dwnl_registry<br/>(Download callbacks)"]
+            R3["g_update_registry<br/>(Update callbacks)"]
+        end
+    end
+    
+    API -->|"sync D-Bus call"| PROXY
+    BG_LOOP -->|"signal received"| SUBS
+    SUBS -->|"lookup"| REGISTRIES
+    REGISTRIES -->|"invoke"| DISPATCH
+    API -->|"register callback"| REGISTRIES
+```
+
+### 5.1 Library Thread Safety Guarantees
+
+| Operation | Thread Safety | Evidence |
+|-----------|--------------|----------|
+| `registerCheckForUpdateCallback()` | Safe from any thread | Modifies `g_registry` (GLib hash table with internal locking) |
+| `registerDownloadCallback()` | Safe from any thread | Modifies `g_dwnl_registry` |
+| Callback invocation | Always on BG thread | `background_thread_func` processes signals |
+| `rdkFwupdateMgr_init()` | Call once from single thread | Creates BG thread, not reentrant |
+| `rdkFwupdateMgr_term()` | Call once from single thread | Joins BG thread |
+| API calls (`checkForUpdate` etc.) | Safe from any thread | Each creates independent proxy |
+
+---
+
+## 6. Thread Lifecycle Diagram
+
+```mermaid
+gantt
+    title Thread Lifetimes During Firmware Update Operation
+    dateFormat ss
+    axisFormat %S
+
+    section Daemon
+    Main Thread (GLib Loop)     :active, main, 00, 200s
+    XConf Worker               :crit, xconf, 05, 20s
+    Download Worker            :crit, dwnl, 30, 120s
+    Progress Monitor           :monitor, 31, 119s
+    Flash Worker               :crit, flash, 155, 30s
+
+    section Client Library
+    App Thread (API calls)     :app, 00, 200s
+    BG Thread (signal RX)      :active, bg, 00, 200s
+```
+
+---
+
+## 7. Cross-Thread Data Flow Matrix
+
+| From → To | Data | Mechanism | Ownership Transfer |
+|-----------|------|-----------|-------------------|
+| Main → XConf Worker | `AsyncXconfFetchContext` | `g_task_set_task_data()` | Main allocates, completion CB frees |
+| XConf Worker → Main | `GVariant* result` | `g_task_return_pointer()` | Worker creates, completion CB unrefs |
+| Main → Download Worker | `AsyncDownloadContext` | `g_task_set_task_data()` | Main allocates, completion CB frees |
+| Download Worker → Main | `gboolean success` | `g_task_return_boolean()` | Value type (no ownership) |
+| Download Worker → Monitor | `ProgressMonitorContext*` | Thread argument | Worker allocates + frees after join |
+| Monitor → Main | `ProgressUpdate*` | `g_idle_add()` | Monitor allocates, idle CB frees |
+| Download Worker → Main | `ProgressUpdate*` (final) | `g_idle_add()` | Worker allocates, idle CB frees |
+| IARM → Main | `int app_mode` | `interuptDwnl()` callback | Value type via mutex |
+
+---
+
+## 8. Potential Concurrency Hazards
+
+| Hazard | Risk | Mitigation |
+|--------|------|------------|
+| Signal arrives before callback registered (client) | Missed update notification | Library pattern: register callback BEFORE calling API |
+| `interuptDwnl()` modifies `force_exit` during download | Race with download worker reading it | `force_exit` is `int` — atomic on most platforms; curl checks it periodically |
+| Multiple CheckForUpdate during XConf fetch | Duplicate worker spawn | `XConfCommStatus` flag with G_LOCK prevents this |
+| Download worker + Progress monitor access `current_download` | Data race | Monitor only reads progress file, not shared struct; Worker sets stop flag via mutex |
+| Main loop callbacks accessing freed context | Use-after-free | GTask framework guarantees completion CB runs after worker; `g_idle_add` serializes |
+| Client unregister while signal in flight | Callback invoked on stale handle | **[INFERENCE]** Possible issue — signal could arrive after unregister but before term |
+
+---
+
+## 9. GLib Async Patterns Used
+
+### 9.1 GTask (Offload blocking work)
+```
+Main Thread                    Worker Thread
+    │                              │
+    ├─ g_task_new()                │
+    ├─ g_task_set_task_data()      │
+    ├─ g_task_run_in_thread()──────┤
+    │  (main loop continues)       ├─ worker_func(task, data)
+    │                              ├─ <blocking I/O>
+    │                              ├─ g_task_return_pointer()
+    │  ┌───────────────────────────┘
+    ├──┤ completion_callback()
+    │  │ (runs on main loop)
+    │  └───────────────────────
+```
+
+### 9.2 g_idle_add (Thread-safe main loop dispatch)
+```
+Worker Thread                  Main Thread
+    │                              │
+    ├─ Allocate ProgressUpdate     │
+    ├─ g_idle_add(emit_fn, data)───┤
+    │  (worker continues)          ├─ emit_fn(data) [on next loop iteration]
+    │                              ├─ g_dbus_connection_emit_signal()
+    │                              ├─ g_free(data)
+    │                              ├─ return G_SOURCE_REMOVE
+```
+
+### 9.3 Dedicated GThread (Long-running monitoring)
+```
+Download Worker                Monitor Thread
+    │                              │
+    ├─ g_thread_try_new()──────────┤
+    │  (download proceeds)         ├─ while (!stop_flag)
+    │                              │    ├─ read progress file
+    │                              │    ├─ g_idle_add(emit_progress)
+    │                              │    └─ g_usleep(100000)
+    ├─ atomic_store(stop_flag, 1)──┤
+    │                              ├─ exit loop
+    ├─ g_thread_join()─────────────┤
+    │  (waits for monitor)         └─ thread exits
+```
+
+---
+
+## 10. Summary: What Runs Where
+
+| Context | What Happens Here | Never Do Here |
+|---------|-------------------|---------------|
+| **Daemon Main Loop** | D-Bus dispatch, validation, state changes, signal emission, completion callbacks | Blocking I/O, network calls, sleep |
+| **Daemon Worker Thread** | XConf queries, firmware downloads, flash operations | Direct D-Bus calls, direct state mutation |
+| **Daemon Monitor Thread** | File polling, progress tracking | Direct D-Bus calls (uses `g_idle_add`) |
+| **Client Caller Thread** | Synchronous D-Bus proxy calls (brief blocking) | Long waits, callback registration after API call |
+| **Client BG Thread** | Signal reception, callback dispatch | Blocking calls, API invocations |
diff --git a/openspec/runtime/firmware-update-flows.md b/openspec/runtime/firmware-update-flows.md
new file mode 100755
index 00000000..96c4c03e
--- /dev/null
+++ b/openspec/runtime/firmware-update-flows.md
@@ -0,0 +1,231 @@
+# Firmware Update Flows — End-to-End Sequences
+
+> **Evidence Level:** Facts verified from source code across all subsystems
+
+---
+
+## 1. Complete Firmware Update Workflow (Daemon Mode)
+
+```mermaid
+sequenceDiagram
+    participant App as Client Application
+    participant Lib as librdkFwupdateMgr.so
+    participant BG as Library BG Thread
+    participant Bus as System D-Bus
+    participant Daemon as rdkFwupdateMgr
+    participant Worker as Worker Thread
+    participant XConf as XConf Server
+    participant CDN as CDN/HTTP Server
+    participant Flash as Device Flash
+
+    Note over App,Flash: Phase 1: Registration
+    App->>Lib: registerProcess("MyApp", "1.0")
+    Lib->>Lib: internal_system_init()
+    Note over Lib: Starts BG thread, subscribes to signals
+    Lib->>Bus: RegisterProcess("MyApp", "1.0") [sync]
+    Bus->>Daemon: add_process_to_tracking()
+    Daemon-->>Bus: handler_id = 1
+    Bus-->>Lib: handler_id = 1
+    Lib-->>App: handle = "1"
+
+    Note over App,Flash: Phase 2: Check for Updates
+    App->>Lib: checkForUpdate("1", callback)
+    Lib->>Lib: Register callback in g_registry
+    Lib->>Bus: CheckForUpdate("1") [fire-and-forget]
+    Lib-->>App: CHECK_FOR_UPDATE_SUCCESS
+    
+    Bus->>Daemon: process_app_request("CheckForUpdate")
+    Daemon->>Daemon: trySetXConfCommStatus() → claimed
+    Daemon-->>Bus: Immediate reply (status=3, CHECK_ERROR)
+    Daemon->>Worker: GTask → rdkfw_xconf_fetch_worker()
+    
+    Worker->>XConf: HTTP POST (device JSON)
+    XConf-->>Worker: JSON response (fw version, URL, etc.)
+    Worker->>Worker: save_xconf_to_cache()
+    Worker->>Worker: Validate firmware vs device model
+    Worker->>Daemon: g_idle_add(emit CheckForUpdateComplete)
+    
+    Daemon->>Bus: CheckForUpdateComplete signal
+    Bus->>BG: Signal received
+    BG->>BG: on_check_complete_signal()
+    BG->>BG: dispatch_all_pending()
+    BG->>App: callback(FwInfoData{status=FIRMWARE_AVAILABLE})
+    
+    Note over App,Flash: Phase 3: Download Firmware
+    App->>Lib: downloadFirmware("1", {name, url, type}, dl_cb)
+    Lib->>Lib: Register dl_cb in g_dwnl_registry
+    Lib->>Bus: DownloadFirmware("1","fw.bin","url","PCI") [fire-and-forget]
+    Lib-->>App: RDKFW_DWNL_SUCCESS
+    
+    Bus->>Daemon: process_app_request("DownloadFirmware")
+    Daemon->>Worker: GTask → rdkfw_download_worker()
+    
+    loop Progress Updates (0% → 100%)
+        Worker->>CDN: HTTP GET (firmware binary)
+        Worker->>Daemon: g_idle_add(emit DownloadProgress)
+        Daemon->>Bus: DownloadProgress signal (progress%)
+        Bus->>BG: Signal received
+        BG->>App: dl_cb(progress, DWNL_IN_PROGRESS)
+    end
+    
+    Worker->>Daemon: g_idle_add(emit DownloadProgress 100%)
+    Daemon->>Bus: DownloadProgress signal (100%, COMPLETED)
+    Bus->>BG: Signal received
+    BG->>App: dl_cb(100, DWNL_COMPLETED)
+
+    Note over App,Flash: Phase 4: Flash Firmware
+    App->>Lib: updateFirmware("1", {name, type, reboot}, upd_cb)
+    Lib->>Lib: Register upd_cb in g_update_registry
+    Lib->>Bus: UpdateFirmware("1","fw.bin","/opt/CDL","PCI","true") [fire-and-forget]
+    Lib-->>App: RDKFW_UPDATE_SUCCESS
+    
+    Bus->>Daemon: process_app_request("UpdateFirmware")
+    Daemon->>Worker: GThread → rdkfw_flash_worker_thread()
+    
+    loop Flash Progress (0% → 100%)
+        Worker->>Flash: flashImage()
+        Worker->>Daemon: g_idle_add(emit UpdateProgress)
+        Daemon->>Bus: UpdateProgress signal (progress%)
+        Bus->>BG: Signal received
+        BG->>App: upd_cb(progress, UPDATE_IN_PROGRESS)
+    end
+    
+    Worker->>Daemon: g_idle_add(emit UpdateProgress 100%)
+    Daemon->>Bus: UpdateProgress signal (100%, COMPLETED)
+    Bus->>BG: Signal received
+    BG->>App: upd_cb(100, UPDATE_COMPLETED)
+    
+    Note over App,Flash: Phase 5: Cleanup
+    App->>Lib: unregisterProcess("1")
+    Lib->>Bus: UnregisterProcess(1) [sync]
+    Bus->>Daemon: remove_process_from_tracking()
+    Daemon-->>Bus: success = true
+    Lib->>Lib: Free handle memory
+```
+
+---
+
+## 2. One-Shot Binary Flow (rdkvfwupgrader)
+
+```mermaid
+sequenceDiagram
+    participant MM as Maintenance Manager
+    participant Proc as rdkvfwupgrader
+    participant IARM as IARM Bus
+    participant XConf as XConf Server
+    participant CDN as CDN Server
+    participant Flash as Device Flash
+
+    MM->>Proc: Launch via systemd/IARM
+    
+    Note over Proc: Initialization
+    Proc->>Proc: log_init()
+    Proc->>Proc: initialize()
+    Proc->>Proc: getDeviceProperties()
+    Proc->>Proc: getImageDetails()
+    Proc->>Proc: getRFCSettings()
+    Proc->>IARM: init_event_handler()
+    
+    Note over Proc: Validation
+    Proc->>Proc: initialValidation()
+    Proc->>Proc: Check /tmp/DIFD.pid
+    Proc->>Proc: Write current PID
+    
+    Note over Proc: XConf Query
+    Proc->>IARM: eventManager(FW_STATE_REQUESTING)
+    Proc->>XConf: MakeXconfComms() → HTTP POST
+    XConf-->>Proc: JSON response
+    Proc->>Proc: processJsonResponse()
+    
+    Note over Proc: Firmware Download
+    Proc->>Proc: checkTriggerUpgrade()
+    Proc->>CDN: rdkv_upgrade_request(PCI)
+    CDN-->>Proc: Firmware binary
+    
+    alt PDRI Available
+        Proc->>CDN: rdkv_upgrade_request(PDRI)
+        CDN-->>Proc: PDRI image
+    end
+    
+    alt Peripheral FW Available
+        Proc->>CDN: peripheral_firmware_dndl()
+        CDN-->>Proc: Peripheral packages
+    end
+    
+    Note over Proc: Flash & Cleanup
+    Proc->>Flash: flashImage()
+    Proc->>IARM: eventManager(FW_STATE_COMPLETED)
+    Proc->>IARM: eventManager(MaintenanceMGR, COMPLETE)
+    Proc->>Proc: uninitialize()
+    Proc->>Proc: exit(0)
+```
+
+---
+
+## 3. Piggybacking Flow (Multiple Clients)
+
+```mermaid
+sequenceDiagram
+    participant A as Client A
+    participant B as Client B
+    participant Daemon as rdkFwupdateMgr
+    participant Worker as Worker Thread
+    participant XConf as XConf Server
+
+    Note over A,XConf: Client A initiates check
+    A->>Daemon: CheckForUpdate("handler_A")
+    Daemon->>Daemon: trySetXConfCommStatus() → TRUE (claimed)
+    Daemon->>Worker: Spawn XConf fetch
+    
+    Note over A,XConf: Client B arrives while fetch in progress
+    B->>Daemon: CheckForUpdate("handler_B")
+    Daemon->>Daemon: trySetXConfCommStatus() → FALSE (busy)
+    Daemon->>Daemon: Add "handler_B" to waiting_checkUpdate_ids
+    Daemon-->>B: Immediate reply (status=3, IN_PROGRESS)
+    
+    Note over A,XConf: XConf fetch completes
+    Worker->>XConf: HTTP POST
+    XConf-->>Worker: Response
+    Worker->>Daemon: Fetch complete
+    
+    Note over A,XConf: Both clients get notified
+    Daemon->>A: CheckForUpdateComplete signal (handler_A)
+    Daemon->>Daemon: Process waiting queue
+    Daemon->>B: CheckForUpdateComplete signal (handler_B)
+    Daemon->>Daemon: setXConfCommStatus(FALSE)
+```
+
+---
+
+## 4. Download Throttling Flow
+
+```mermaid
+sequenceDiagram
+    participant MM as Maintenance Manager
+    participant IARM as IARM Bus
+    participant Proc as rdkvfwupgrader/daemon
+    participant DL as Download Library (libcurl)
+
+    Note over MM,DL: Normal foreground download
+    Proc->>DL: rdkv_upgrade_request() [full speed]
+    
+    MM->>IARM: Mode change → BACKGROUND
+    IARM->>Proc: interuptDwnl(app_mode=0)
+    Proc->>Proc: setAppMode(0)
+    
+    alt Throttle speed > 0
+        Proc->>DL: doInteruptDwnl(curl, speed)
+        Note over DL: Pause → Unpause at throttled speed
+    else Throttle speed = 0
+        Proc->>Proc: force_exit = 1
+        Proc->>DL: setForceStop(1)
+        Proc->>IARM: eventManager(FW_STATE_FAILED)
+        Note over DL: Download aborted
+    end
+    
+    MM->>IARM: Mode change → FOREGROUND
+    IARM->>Proc: interuptDwnl(app_mode=1)
+    Proc->>Proc: setAppMode(1)
+    Proc->>DL: doInteruptDwnl(curl, 0)
+    Note over DL: Resume at full speed
+```
diff --git a/openspec/runtime/rdkFwupdateMgr-lifecycle.md b/openspec/runtime/rdkFwupdateMgr-lifecycle.md
new file mode 100755
index 00000000..7cb254ae
--- /dev/null
+++ b/openspec/runtime/rdkFwupdateMgr-lifecycle.md
@@ -0,0 +1,206 @@
+# rdkFwupdateMgr — Daemon Lifecycle
+
+> **Evidence Level:** Facts verified from `src/rdkFwupdateMgr.c` and `src/dbus/`  
+> **Entry Point:** `main()` in `rdkFwupdateMgr.c`  
+> **Startup:** `systemd` via `rdkFwupdateMgr.service`
+
+---
+
+## 1. systemd Service Configuration
+
+**[FACT]** From `rdkFwupdateMgr.service`:
+```ini
+[Unit]
+Description=To start rdkFwupdateMgr
+After=tr69hostif.service dbus.service
+Requires=tr69hostif.service
+
+[Service]
+Type=simple
+ExecStart=/bin/sh -c '/usr/bin/rdkFwupdateMgr 0 1 > /opt/logs/swupdate.log 2>&1'
+RemainAfterExit=yes
+
+[Install]
+WantedBy=ntp-time-sync.target
+```
+
+- **[FACT]** Invoked with arguments `0 1` (retry_count=0, trigger_type=1=Bootup)
+- **[FACT]** Depends on `tr69hostif.service` and `dbus.service`
+- **[FACT]** Wanted by `ntp-time-sync.target` — starts after time synchronization
+- **[FACT]** Stdout/stderr redirected to `/opt/logs/swupdate.log`
+
+---
+
+## 2. State Machine
+
+```mermaid
+stateDiagram-v2
+    [*] --> STATE_INIT
+    
+    STATE_INIT --> STATE_INIT_VALIDATION: Initialize success
+    STATE_INIT --> EXIT: Initialize failure
+    
+    STATE_INIT_VALIDATION --> STATE_IDLE: Validation SUCCESS
+    STATE_INIT_VALIDATION --> STATE_IDLE: DWNL_COMPLETED (pending reboot)
+    STATE_INIT_VALIDATION --> STATE_IDLE: DWNL_INPROGRESS (another process)
+    STATE_INIT_VALIDATION --> EXIT: FAIL
+    
+    STATE_IDLE --> EXIT: g_main_loop_quit() or signal
+    
+    note right of STATE_IDLE
+        GLib main loop runs here indefinitely.
+        All D-Bus requests handled asynchronously.
+        State machine does NOT advance beyond IDLE.
+    end note
+```
+
+### 2.1 Future States (Defined but Unused)
+
+**[FACT]** The `FwUpgraderState` enum defines:
+- `STATE_CHECK_UPDATE` — marked "(Future)" in comments
+- `STATE_DOWNLOAD_UPDATE` — marked "(Future)" in comments  
+- `STATE_UPGRADE` — marked "(Future)" in comments
+
+**[INFERENCE]** These were designed for potential future use where the daemon self-initiates upgrades rather than waiting for D-Bus requests.
+
+---
+
+## 3. Initialization Phases
+
+### 3.1 STATE_INIT
+
+**[FACT]** Executes in order:
+
+1. **Logger initialization** — `rdk_logger_ext_init()` or `log_init()`
+2. **SIGUSR1 signal handler** — installs `handle_signal()` for graceful download abort
+3. **D-Bus server setup**:
+   - `init_task_system()` — creates hash tables for active tasks, downloads, process tracking; initializes XConf comm status
+   - `setup_dbus_server()` — registers GDBus object, claims bus name
+   - `g_main_loop_new(NULL, FALSE)` — creates GLib main event loop
+4. **`initialize()`** — loads device properties, image details, RFC settings, creates download dir, inits IARM
+5. **Argument parsing** — parses trigger_type from argv[2]
+
+**Key difference from rdkvfwupgrader:** The daemon sets up D-Bus **before** `initialize()`, ensuring the service is available as soon as possible.
+
+### 3.2 STATE_INIT_VALIDATION
+
+**[FACT]** Calls `initialValidation()` which checks:
+- Auto-exclusion via RFC
+- Whether another instance is running
+- Whether a previous download completed
+
+**[FACT]** Unlike the one-shot binary, the daemon **always transitions to STATE_IDLE** regardless of validation outcome (except on `INITIAL_VALIDATION_FAIL`):
+- `INITIAL_VALIDATION_SUCCESS` → `STATE_IDLE`
+- `INITIAL_VALIDATION_DWNL_COMPLETED` → `STATE_IDLE` (wait for reboot or next request)
+- `INITIAL_VALIDATION_DWNL_INPROGRESS` → `STATE_IDLE` (wait for completion)
+
+### 3.3 STATE_IDLE
+
+**[FACT]** `g_main_loop_run(main_loop)` — blocks indefinitely, processing:
+- D-Bus method calls (dispatched by `process_app_request()`)
+- GTask completion callbacks
+- `g_idle_add()` callbacks from worker threads
+- Timer sources (if any)
+
+**[FACT]** The daemon logs its service coordinates:
+```
+D-Bus Service: org.rdkfwupdater.Interface
+Object Path: /org/rdkfwupdater/Service
+Active Tasks: <count>
+```
+
+---
+
+## 4. Request Processing Model
+
+```mermaid
+sequenceDiagram
+    participant Client as Client App
+    participant Lib as librdkFwupdateMgr
+    participant Bus as System D-Bus
+    participant Daemon as rdkFwupdateMgr
+    participant Worker as GTask Worker
+
+    Client->>Lib: registerProcess("MyApp", "1.0")
+    Lib->>Bus: RegisterProcess(s,s)
+    Bus->>Daemon: process_app_request()
+    Daemon->>Daemon: add_process_to_tracking()
+    Daemon-->>Bus: Reply(handler_id: t)
+    Bus-->>Lib: handler_id
+    Lib-->>Client: handle = "1"
+
+    Client->>Lib: checkForUpdate(handle, cb)
+    Lib->>Lib: Register callback in g_registry
+    Lib->>Bus: CheckForUpdate(s) [fire-and-forget]
+    Bus->>Daemon: process_app_request()
+    Daemon-->>Bus: Immediate reply (FIRMWARE_CHECK_ERROR)
+    Daemon->>Worker: g_task_run_in_thread(rdkfw_xconf_fetch_worker)
+    
+    Worker->>Worker: fetch_xconf_firmware_info()
+    Worker->>Worker: HTTP POST to XConf server
+    Worker->>Worker: Parse response, cache
+    Worker->>Daemon: g_idle_add(emit_signal)
+    Daemon->>Bus: CheckForUpdateComplete signal
+    Bus->>Lib: Signal received on BG thread
+    Lib->>Lib: dispatch_all_pending()
+    Lib->>Client: callback(FwInfoData*)
+```
+
+---
+
+## 5. Error Handling Philosophy
+
+**[FACT]** Critical difference from rdkvfwupgrader:
+
+| Scenario | rdkvfwupgrader | rdkFwupdateMgr |
+|----------|---------------|----------------|
+| PCI upgrade fails | May `exit(1)` | Logs error, continues running |
+| Fatal library error | `exit(1)` | Logs error, continues running |
+| XConf fetch fails | `exit(ret_curl_code)` | Reports via D-Bus signal, stays in IDLE |
+| Invalid arguments | `exit(ret_curl_code)` | `exit(ret_curl_code)` (only at startup) |
+| SIGUSR1 | Force-stops download, exits | Force-stops download, stays running |
+
+**[FACT]** The daemon is designed to **never exit** on operation errors. Comment in code: `"// Daemon NEVER exits"` and `"// Daemon continues running - just log error and continue"`.
+
+---
+
+## 6. Shutdown Sequence
+
+**[FACT]** When `g_main_loop_run()` returns (e.g., `g_main_loop_quit()` called):
+
+1. `cleanup_dbus()`:
+   - `cleanupXConfCommStatus()` — destroy mutex
+   - Free all active `TaskContext` entries
+   - `cleanup_process_tracking()` — destroy process/download hash tables
+   - Unregister D-Bus object
+   - Release connection and bus name
+   - Free main loop
+2. `uninitialize(init_validate_status)`:
+   - Telemetry cleanup
+   - Destroy download state and app mode mutexes
+   - Terminate IARM event handler
+   - Remove PID file
+   - Close logger
+3. `exit(ret_curl_code)`
+
+---
+
+## 7. Shared Code with rdkvfwupgrader
+
+**[FACT]** Both binaries share significant code duplication:
+
+| Shared Function | Purpose |
+|----------------|---------|
+| `initialize()` / `uninitialize()` | Device info, RFC, IARM init/cleanup |
+| `initialValidation()` | Pre-flight validation |
+| `handle_signal()` | SIGUSR1 handler |
+| `interuptDwnl()` | Download throttling callback |
+| `setDwnlState()` / `getDwnlState()` | Download state management |
+| `setAppMode()` / `getAppMode()` | App mode management |
+| `checkTriggerUpgrade()` | Firmware upgrade orchestration |
+| `MakeXconfComms()` | XConf server communication |
+| `t2CountNotify()` / `t2ValNotify()` | Telemetry |
+
+**[FACT]** These functions are **duplicated** in both `rdkv_main.c` and `rdkFwupdateMgr.c` rather than being in a shared library. The daemon versions differ in error handling (no `exit()` on operation errors).
+
+**[INFERENCE]** This duplication is a natural artifact of the daemon being developed from the original one-shot binary. Future refactoring could extract shared logic into a common library.
diff --git a/openspec/runtime/rdkFwupdateMgr-sequence.md b/openspec/runtime/rdkFwupdateMgr-sequence.md
new file mode 100755
index 00000000..8a2629d8
--- /dev/null
+++ b/openspec/runtime/rdkFwupdateMgr-sequence.md
@@ -0,0 +1,431 @@
+# rdkFwupdateMgr Daemon — Detailed Runtime Execution Sequence
+
+> **Evidence Level:** Verified from `src/rdkFwupdateMgr.c` and `src/dbus/rdkv_dbus_server.c`  
+> **Thread Contexts:** GLib Main Loop Thread + GTask Worker Pool + Progress Monitor Threads  
+> **Primary Execution Model:** Event-driven (GLib main loop) with async offloading via GTask
+
+---
+
+## 1. Process Identity
+
+| Property | Value |
+|----------|-------|
+| Binary | `/usr/bin/rdkFwupdateMgr` |
+| Systemd unit | `rdkFwupdateMgr.service` |
+| Bus name | `org.rdkfwupdater.Interface` |
+| Object path | `/org/rdkfwupdater/Service` |
+| Invocation | `rdkFwupdateMgr <retry_count> <trigger_type>` |
+| Lifetime | Indefinite (systemd-managed daemon) |
+
+---
+
+## 2. Startup Sequence — State Machine
+
+```mermaid
+stateDiagram-v2
+    [*] --> STATE_INIT : main() entry
+    STATE_INIT --> STATE_INIT_VALIDATION : initialize() success
+    STATE_INIT --> EXIT_FATAL : initialize() failure
+    STATE_INIT --> EXIT_FATAL : argc < 3
+    STATE_INIT --> EXIT_FATAL : Invalid trigger_type
+    
+    STATE_INIT_VALIDATION --> STATE_IDLE : INITIAL_VALIDATION_SUCCESS
+    STATE_INIT_VALIDATION --> STATE_IDLE : DWNL_COMPLETED (pending reboot)
+    STATE_INIT_VALIDATION --> STATE_IDLE : DWNL_INPROGRESS (another instance)
+    STATE_INIT_VALIDATION --> EXIT_FATAL : INITIAL_VALIDATION_FAIL
+    
+    STATE_IDLE --> STATE_IDLE : g_main_loop_run() [BLOCKS FOREVER]
+    STATE_IDLE --> EXIT_SHUTDOWN : Main loop quit (signal/error)
+    
+    EXIT_FATAL --> [*] : cleanup_dbus() + uninitialize() + exit()
+    EXIT_SHUTDOWN --> [*] : cleanup_dbus() + uninitialize() + exit()
+```
+
+**[FACT]** Unlike `rdkvfwupgrader`, the daemon always transitions to `STATE_IDLE` (even with DWNL_INPROGRESS or DWNL_COMPLETED), never exits on validation status alone. Only `INITIAL_VALIDATION_FAIL` causes exit.
+
+---
+
+## 3. Complete Startup Sequence Diagram
+
+```mermaid
+sequenceDiagram
+    participant SYSTEMD as systemd
+    participant DAEMON as rdkFwupdateMgr<br/>(main thread)
+    participant DBUS as GDBus<br/>(system bus)
+    participant FS as Filesystem
+    participant IARM as IARM Bus
+    participant THUNDER as Thunder JSON-RPC
+
+    Note over SYSTEMD,THUNDER: ═══ STATE_INIT ═══
+
+    SYSTEMD->>DAEMON: ExecStart=rdkFwupdateMgr 3 2
+    activate DAEMON
+
+    DAEMON->>DAEMON: log_init() / rdk_logger_ext_init()
+    DAEMON->>DAEMON: sigaction(SIGUSR1, handle_signal)
+    DAEMON->>DAEMON: Zero XCONFRES response struct
+    DAEMON->>DAEMON: currentState = STATE_INIT
+
+    Note over DAEMON,DBUS: D-Bus Setup (before initialize())
+    DAEMON->>DAEMON: init_task_system() [GHashTable + tracking init]
+    DAEMON->>DBUS: setup_dbus_server()
+    DBUS-->>DAEMON: Parse introspection XML
+    DBUS-->>DAEMON: g_bus_get_sync(SYSTEM) → connection
+    DBUS-->>DAEMON: register_object(/org/rdkfwupdater/Service)
+    DBUS-->>DAEMON: g_bus_own_name(org.rdkfwupdater.Interface)
+    DAEMON->>DAEMON: main_loop = g_main_loop_new(NULL, FALSE)
+
+    Note over DAEMON,FS: initialize() — same as rdkvfwupgrader
+    DAEMON->>FS: getDeviceProperties()
+    DAEMON->>FS: getImageDetails()
+    DAEMON->>FS: getRFCSettings()
+    DAEMON->>FS: createDir(difw_path)
+    DAEMON->>IARM: init_event_handler()
+    
+    alt maint_status == "true"
+        DAEMON->>THUNDER: getJsonRpc("getMaintenanceMode")
+        THUNDER-->>DAEMON: JSON response
+        alt "BACKGROUND" in response
+            DAEMON->>DAEMON: setAppMode(0)
+        end
+    end
+
+    DAEMON->>DAEMON: Parse argv[2] → trigger_type
+    DAEMON->>DAEMON: currentState = STATE_INIT_VALIDATION
+
+    Note over DAEMON,FS: ═══ STATE_INIT_VALIDATION ═══
+    DAEMON->>DAEMON: initialValidation()
+    DAEMON->>FS: GetBuildType(), RFC check, PID check
+    
+    alt INITIAL_VALIDATION_SUCCESS
+        DAEMON->>DAEMON: currentState = STATE_IDLE
+    else DWNL_COMPLETED (reboot pending)
+        DAEMON->>DAEMON: currentState = STATE_IDLE
+    else DWNL_INPROGRESS
+        DAEMON->>IARM: eventManager("MaintenanceMGR", INPROGRESS)
+        DAEMON->>DAEMON: currentState = STATE_IDLE
+    end
+
+    Note over DAEMON,DBUS: ═══ STATE_IDLE (indefinite) ═══
+    DAEMON->>DAEMON: g_main_loop_run(main_loop)
+    Note right of DAEMON: BLOCKS HERE FOREVER.<br/>All work happens via<br/>D-Bus callbacks dispatched<br/>on this main loop.
+    deactivate DAEMON
+```
+
+---
+
+## 4. Steady-State Operation — D-Bus Request Handling
+
+### 4.1 CheckForUpdate Request Flow
+
+```mermaid
+sequenceDiagram
+    participant CLIENT as Client App<br/>(via D-Bus)
+    participant MAIN as Main Loop Thread<br/>(process_app_request)
+    participant TRACK as Task Tracking<br/>(active_tasks + waiting queue)
+    participant WORKER as GTask Worker Thread<br/>(rdkfw_xconf_fetch_worker)
+    participant XCONF as XConf Server
+    participant SIGNAL as D-Bus Signal<br/>(CheckForUpdateComplete)
+
+    CLIENT->>MAIN: D-Bus call: CheckForUpdate(handler_id)
+    activate MAIN
+    
+    Note over MAIN: Validation (main thread)
+    MAIN->>MAIN: Validate handler_id (non-empty)
+    MAIN->>MAIN: Validate registration (hash lookup)
+    
+    Note over MAIN: Immediate Response
+    MAIN->>CLIENT: Return (0, "", "", "", "check in progress", 3)
+    Note right of CLIENT: Client gets FIRMWARE_CHECK_ERROR<br/>immediately (non-blocking!)
+    
+    Note over MAIN,TRACK: Task Tracking Setup
+    MAIN->>TRACK: create_task_context(CHECK_UPDATE, handler, sender, NULL)
+    MAIN->>TRACK: Add task_id to active_tasks hash table
+    MAIN->>TRACK: Append task_id to waiting_checkUpdate_ids list
+    
+    alt getXConfCommStatus() == TRUE (fetch already running)
+        Note over MAIN: PIGGYBACK — no new worker spawned
+        MAIN->>MAIN: return (task joins existing queue)
+    else getXConfCommStatus() == FALSE (no active fetch)
+        Note over MAIN: Start New Background Fetch
+        MAIN->>MAIN: setXConfCommStatus(TRUE)
+        MAIN->>MAIN: Create AsyncXconfFetchContext
+        MAIN->>WORKER: g_task_run_in_thread(rdkfw_xconf_fetch_worker)
+        Note right of WORKER: Worker thread spawned.<br/>Main loop is FREE.
+    end
+    deactivate MAIN
+    
+    Note over WORKER,XCONF: Worker Thread (blocking network I/O)
+    activate WORKER
+    WORKER->>XCONF: rdkFwupdateMgr_checkForUpdate() [HTTP POST]
+    Note right of XCONF: Blocks 5-60 seconds
+    XCONF-->>WORKER: JSON response
+    WORKER->>WORKER: Parse response → CheckUpdateResponse
+    WORKER->>WORKER: Package into GVariant
+    WORKER->>WORKER: g_task_return_pointer(result)
+    deactivate WORKER
+
+    Note over MAIN,SIGNAL: Completion Callback (main loop thread)
+    activate MAIN
+    MAIN->>MAIN: rdkfw_xconf_fetch_done() triggered by GTask
+    MAIN->>SIGNAL: g_dbus_connection_emit_signal("CheckForUpdateComplete", result)
+    Note right of SIGNAL: Broadcast to ALL listeners
+    
+    loop For each task_id in waiting_checkUpdate_ids
+        MAIN->>TRACK: g_hash_table_remove(active_tasks, task_id)
+        MAIN->>MAIN: free_task_context(ctx)
+    end
+    
+    MAIN->>TRACK: g_slist_free(waiting_checkUpdate_ids) → NULL
+    MAIN->>MAIN: setXConfCommStatus(FALSE)
+    MAIN->>MAIN: Free AsyncXconfFetchContext
+    deactivate MAIN
+```
+
+### 4.2 DownloadFirmware Request Flow
+
+```mermaid
+sequenceDiagram
+    participant CLIENT as Client App
+    participant MAIN as Main Loop Thread
+    participant STATE as Download State<br/>(current_download)
+    participant WORKER as Download Worker<br/>(GTask thread)
+    participant MONITOR as Progress Monitor<br/>(GThread)
+    participant CDN as CDN / HTTP Server
+    participant SIGNAL as D-Bus Signal<br/>(DownloadProgress)
+
+    CLIENT->>MAIN: D-Bus call: DownloadFirmware(handler, name, url, type)
+    activate MAIN
+    
+    Note over MAIN: Validation Phase (main thread)
+    MAIN->>MAIN: Validate handler_id, registration
+    MAIN->>MAIN: Validate firmware_name, type (PCI/PDRI/PERIPHERAL)
+    MAIN->>MAIN: Validate URL format (http/https prefix)
+    
+    alt IsDownloadInProgress && different firmware
+        MAIN->>CLIENT: Return ("RDKFW_DWNL_FAILED", "DWNL_ERROR", "ongoing download")
+        Note right of CLIENT: Rejected
+    else File already cached at /opt/CDL/<name>
+        MAIN->>CLIENT: Return ("RDKFW_DWNL_SUCCESS", "COMPLETED", "already downloaded")
+        MAIN->>SIGNAL: g_idle_add(emit_progress: 100%, COMPLETED)
+    else IsDownloadInProgress && same firmware (PIGGYBACK)
+        MAIN->>STATE: Append handler_id to waiting_handler_ids
+        MAIN->>CLIENT: Return ("RDKFW_DWNL_SUCCESS", "INPROGRESS", "in progress")
+        MAIN->>SIGNAL: g_idle_add(emit_progress: current%, INPROGRESS)
+    else New download
+        MAIN->>STATE: IsDownloadInProgress = TRUE
+        MAIN->>STATE: Allocate CurrentDownloadState
+        MAIN->>MAIN: Create AsyncDownloadContext
+        MAIN->>WORKER: g_task_run_in_thread(rdkfw_download_worker)
+        MAIN->>CLIENT: Return ("RDKFW_DWNL_SUCCESS", "INPROGRESS", "started")
+    end
+    deactivate MAIN
+
+    Note over WORKER,CDN: Worker Thread — Blocking Download
+    activate WORKER
+    WORKER->>WORKER: Resolve effective URL (client URL or XConf cache)
+    WORKER->>WORKER: Build download path: <difw_path>/<firmware_name>
+    WORKER->>WORKER: getDeviceProperties(), getRFCSettings()
+    WORKER->>WORKER: Build RdkUpgradeContext_t (download_only=1)
+    
+    Note over WORKER,MONITOR: Spawn Progress Monitor
+    WORKER->>MONITOR: g_thread_try_new("rdkfw_progress_monitor")
+    activate MONITOR
+    Note right of MONITOR: Polls /opt/curl_progress<br/>every 100ms
+    
+    WORKER->>CDN: rdkv_upgrade_request(upgrade_ctx)
+    Note right of CDN: BLOCKING. Minutes for<br/>large firmware images.
+    
+    loop While download active
+        MONITOR->>MONITOR: Read /opt/curl_progress
+        MONITOR->>SIGNAL: g_idle_add(emit_progress: N%, INPROGRESS)
+        SIGNAL-->>CLIENT: D-Bus signal: DownloadProgress
+    end
+    
+    CDN-->>WORKER: Download complete (or error)
+    
+    WORKER->>MONITOR: Set stop_flag = TRUE (via atomic int)
+    MONITOR->>MONITOR: Detects stop, exits loop
+    deactivate MONITOR
+    WORKER->>WORKER: g_thread_join(monitor_thread)
+    
+    WORKER->>SIGNAL: g_idle_add(emit_progress: 100%, COMPLETED)
+    WORKER->>WORKER: g_task_return_boolean(task, TRUE/FALSE)
+    deactivate WORKER
+    
+    Note over MAIN: Completion Callback (main loop)
+    activate MAIN
+    MAIN->>MAIN: rdkfw_download_done() [GTask callback]
+    MAIN->>STATE: IsDownloadInProgress = FALSE
+    MAIN->>STATE: Free current_download
+    deactivate MAIN
+```
+
+### 4.3 UpdateFirmware Request Flow
+
+```mermaid
+sequenceDiagram
+    participant CLIENT as Client App
+    participant MAIN as Main Loop Thread
+    participant WORKER as Flash Worker<br/>(GTask thread)
+    participant FLASH as Flash HAL
+    participant SIGNAL as D-Bus Signal<br/>(UpdateProgress)
+
+    CLIENT->>MAIN: D-Bus call: UpdateFirmware(handler, name, path, type, reboot)
+    activate MAIN
+    
+    MAIN->>MAIN: Validate handler, registration
+    MAIN->>MAIN: Check: IsDownloadInProgress?
+    MAIN->>MAIN: Check: IsFlashInProgress?
+    MAIN->>MAIN: Validate firmware_name, path, type
+    
+    alt IsDownloadInProgress
+        MAIN->>CLIENT: Return ("RDKFW_UPDATE_FAILED", "UPDATE_ERROR", "ongoing download")
+    else IsFlashInProgress
+        MAIN->>CLIENT: Return ("RDKFW_UPDATE_FAILED", "UPDATE_ERROR", "ongoing flash")
+    else Validation passed
+        MAIN->>MAIN: IsFlashInProgress = TRUE
+        MAIN->>MAIN: Create AsyncUpdateContext
+        MAIN->>WORKER: g_task_run_in_thread(rdkfw_flash_worker)
+        MAIN->>CLIENT: Return ("RDKFW_UPDATE_SUCCESS", "INPROGRESS", "started")
+    end
+    deactivate MAIN
+
+    Note over WORKER,FLASH: Worker Thread — Blocking Flash
+    activate WORKER
+    WORKER->>FLASH: flashImage(firmware_path) [BLOCKING]
+    FLASH-->>WORKER: Flash result
+    
+    alt rebootImmediately == "true"
+        WORKER->>WORKER: Schedule reboot
+    end
+    
+    WORKER->>SIGNAL: g_idle_add(emit: 100%, COMPLETED/ERROR)
+    WORKER->>WORKER: g_task_return_boolean(task, result)
+    deactivate WORKER
+    
+    Note over MAIN: Completion Callback
+    activate MAIN
+    MAIN->>MAIN: rdkfw_flash_done()
+    MAIN->>MAIN: IsFlashInProgress = FALSE
+    MAIN->>MAIN: Free current_flash
+    deactivate MAIN
+```
+
+### 4.4 RegisterProcess / UnregisterProcess
+
+```mermaid
+sequenceDiagram
+    participant CLIENT as Client App
+    participant MAIN as Main Loop Thread<br/>(process_app_request)
+    participant REG as Process Registry<br/>(GHashTable)
+
+    Note over CLIENT,REG: RegisterProcess — Synchronous (no worker thread)
+    CLIENT->>MAIN: D-Bus call: RegisterProcess(name, version)
+    activate MAIN
+    MAIN->>MAIN: Validate process_name, lib_version
+    MAIN->>REG: add_process_to_tracking(name, sender_id) → handler_id
+    MAIN->>CLIENT: Return (handler_id) [uint64]
+    deactivate MAIN
+    Note right of CLIENT: All on main thread.<br/>No async. No GTask.
+
+    Note over CLIENT,REG: UnregisterProcess — Synchronous
+    CLIENT->>MAIN: D-Bus call: UnregisterProcess(handler_id, name)
+    activate MAIN
+    MAIN->>REG: remove_process_from_tracking(handler, sender)
+    MAIN->>CLIENT: Return (boolean success)
+    deactivate MAIN
+```
+
+---
+
+## 5. Concurrency Control Summary
+
+| Guard Variable | Protected By | Scope | Purpose |
+|---------------|--------------|-------|---------|
+| `XConfCommStatus` | `G_LOCK(xconf_status_mutex)` | Global | Prevents duplicate XConf fetch workers |
+| `IsDownloadInProgress` | Main loop serialization | Global (bool) | Prevents concurrent downloads |
+| `IsFlashInProgress` | Main loop serialization | Global (bool) | Prevents concurrent flashes |
+| `DwnlState` | `pthread_mutex_t mutuex_dwnl_state` | Per-process | Download progress state |
+| `app_mode` | `pthread_mutex_t app_mode_status` | Per-process | Throttle mode (FG/BG) |
+| `registered_processes` | Main loop serialization | GHashTable | Client registry |
+| `active_tasks` | Main loop serialization | GHashTable | In-flight task tracking |
+| `waiting_checkUpdate_ids` | Main loop serialization | GSList | Piggyback queue for CheckUpdate |
+| `waiting_download_ids` | Main loop serialization | GSList | Piggyback queue for Download |
+
+**[FACT]** Most mutable state is only touched from the main loop thread — GTask completion callbacks and `g_idle_add` ensure main-loop serialization. Worker threads communicate results back via `g_task_return_*()`.
+
+---
+
+## 6. Daemon Shutdown Sequence
+
+```mermaid
+sequenceDiagram
+    participant SIG as Signal / systemd
+    participant LOOP as GLib Main Loop
+    participant DBUS as D-Bus Subsystem
+    participant TASK as Task System
+    participant INIT as Subsystem Cleanup
+
+    SIG->>LOOP: SIGTERM or g_main_loop_quit()
+    activate LOOP
+    LOOP->>LOOP: g_main_loop_run() returns
+    
+    Note over LOOP,INIT: cleanup_and_exit label
+    LOOP->>DBUS: cleanup_dbus()
+    activate DBUS
+    DBUS->>DBUS: cleanupXConfCommStatus()
+    DBUS->>TASK: Iterate active_tasks → free_task_context() each
+    DBUS->>TASK: g_hash_table_destroy(active_tasks)
+    DBUS->>DBUS: cleanup_process_tracking()
+    DBUS->>DBUS: g_dbus_connection_unregister_object()
+    DBUS->>DBUS: g_object_unref(connection)
+    DBUS->>DBUS: g_bus_unown_name(owner_id)
+    DBUS->>DBUS: g_main_loop_unref(main_loop)
+    deactivate DBUS
+    
+    LOOP->>INIT: uninitialize(init_validate_status)
+    activate INIT
+    INIT->>INIT: t2_uninit()
+    INIT->>INIT: pthread_mutex_destroy() × 2
+    INIT->>INIT: term_event_handler() [IARM disconnect]
+    INIT->>INIT: updateUpgradeFlag(2)
+    INIT->>INIT: unlink("/tmp/DIFD.pid") [if applicable]
+    deactivate INIT
+    
+    LOOP->>LOOP: log_exit()
+    LOOP->>LOOP: exit(ret_curl_code)
+    deactivate LOOP
+```
+
+---
+
+## 7. Key Behavioral Differences from rdkvfwupgrader
+
+| Aspect | rdkvfwupgrader (one-shot) | rdkFwupdateMgr (daemon) |
+|--------|--------------------------|------------------------|
+| XConf fetch | Synchronous in main() | GTask worker thread |
+| Download | Synchronous, blocks everything | GTask worker + progress monitor thread |
+| Flash | Synchronous | GTask worker thread |
+| D-Bus | Not used | Core IPC mechanism |
+| Client interaction | None | RegisterProcess → methods → signals |
+| Lifetime | Seconds-to-minutes | Indefinite |
+| Error recovery | Exit with error code | Log error, reset state, remain running |
+| Concurrency | Single operation | Multiple piggybacked clients |
+| Signal handling | Abort + exit | Abort current operation, remain running |
+| Main loop | Linear execution | GLib event loop (g_main_loop_run) |
+
+---
+
+## 8. Operational Invariants
+
+1. **[FACT]** D-Bus setup occurs BEFORE `initialize()` — the daemon is reachable before initialization completes
+2. **[FACT]** The state machine always converges to `STATE_IDLE` unless `INITIAL_VALIDATION_FAIL`
+3. **[FACT]** Once in `STATE_IDLE`, the daemon never leaves it (no state transitions occur)
+4. **[FACT]** All request validation runs synchronously on the main loop thread
+5. **[FACT]** Only one XConf fetch can run at a time (enforced by `XConfCommStatus`)
+6. **[FACT]** Only one download can run at a time (enforced by `IsDownloadInProgress`)
+7. **[FACT]** Only one flash can run at a time (enforced by `IsFlashInProgress`)
+8. **[FACT]** Worker threads never directly emit D-Bus signals — always via `g_idle_add()` or `g_task_return_*()`
+9. **[FACT]** Client gets immediate D-Bus response; real results arrive via signal broadcast
+10. **[INFERENCE]** The XConf commented-out code in STATE_INIT_VALIDATION indicates future intent to do proactive update checks on startup
diff --git a/openspec/runtime/rdkvfwupgrader-lifecycle.md b/openspec/runtime/rdkvfwupgrader-lifecycle.md
new file mode 100755
index 00000000..5ee348fe
--- /dev/null
+++ b/openspec/runtime/rdkvfwupgrader-lifecycle.md
@@ -0,0 +1,160 @@
+# rdkvfwupgrader — One-Shot Binary Lifecycle
+
+> **Evidence Level:** Facts verified from `src/rdkv_main.c`  
+> **Entry Point:** `main()` at line 1047
+
+---
+
+## 1. Invocation
+
+```
+rdkvfwupgrader <retry_count> <trigger_type>
+```
+
+- **[FACT]** Requires exactly 2 arguments (argc >= 3)
+- **[FACT]** `retry_count` (argv[1]) is accepted but no longer parsed — hardcoded fallback mechanism used
+- **[FACT]** `trigger_type` (argv[2]) determines the upgrade trigger context
+
+| Trigger Type | Meaning |
+|-------------|---------|
+| 1 | Bootup |
+| 2 | Scheduled (cron) |
+| 3 | TR-69/SNMP triggered |
+| 4 | App triggered |
+| 5 | Delayed download |
+| 6 | State Red recovery |
+
+**[INFERENCE]** Typically invoked by Maintenance Manager or systemd timer.
+
+---
+
+## 2. Execution Flow
+
+```mermaid
+flowchart TD
+    A[Process Start] --> B[Logger Init]
+    B --> C[SIGUSR1 Handler Install]
+    C --> D["initialize()"]
+    D -->|Fail| E[Exit with Error]
+    D -->|Success| F[Parse Arguments]
+    F -->|Invalid args| E
+    F -->|Valid| G["initialValidation()"]
+    
+    G -->|FAIL| E
+    G -->|DWNL_COMPLETED| H["Report Complete, Cleanup, Exit"]
+    G -->|DWNL_INPROGRESS| I["Report In-Progress, Cleanup, Exit"]
+    G -->|SUCCESS| J["Event: FW_STATE_REQUESTING"]
+    
+    J --> K["MakeXconfComms()"]
+    K -->|HTTP != 200| L["Report Error, Cleanup, Exit"]
+    K -->|HTTP 200| M["processJsonResponse()"]
+    M -->|Invalid JSON| N["Report Error, Cleanup, Exit"]
+    M -->|Valid| O["checkTriggerUpgrade()"]
+    
+    O --> P{PCI Upgrade Valid?}
+    P -->|Yes| Q["rdkv_upgrade_request(PCI)"]
+    P -->|No| R[Skip PCI]
+    
+    Q --> S{PDRI Enabled?}
+    R --> S
+    S -->|Yes| T["rdkv_upgrade_request(PDRI)"]
+    S -->|No| U{Peripheral FW?}
+    T --> U
+    
+    U -->|Yes| V["peripheral_firmware_dndl()"]
+    U -->|No| W["Report Final Status"]
+    V --> W
+    
+    W --> X["uninitialize()"]
+    X --> Y["exit(ret_curl_code)"]
+```
+
+---
+
+## 3. Phase Details
+
+### 3.1 Initialization (`initialize()`)
+
+**[FACT]** Performs in order:
+1. `t2_init("rdkfwupgrader")` — Telemetry 2.0 initialization (conditional)
+2. `getDeviceProperties(&device_info)` — Load model, partner ID, serial, difw_path, maint_status
+3. `getImageDetails(&cur_img_detail)` — Load current firmware image name
+4. `getRFCSettings(&rfc_list)` — Load RFC throttle/mTLS/incremental CDL settings
+5. `createDir(device_info.difw_path)` — Ensure download directory exists
+6. `init_event_handler()` — Initialize IARM event handler
+7. Check MaintenanceManager mode via JSON-RPC → set app mode (foreground/background)
+
+### 3.2 Initial Validation (`initialValidation()`)
+
+**[FACT]** Validates:
+1. **Auto-exclusion:** RFC `AutoExcluded` flag checked; non-PROD builds with `true` are excluded
+2. **Instance check:** `CurrentRunningInst(DIFDPID)` checks if `/tmp/DIFD.pid` indicates another running instance
+3. **Previous completion:** `/tmp/fw_preparing_to_reboot` indicates prior download completed
+4. **PID file:** Writes current PID to `/tmp/DIFD.pid`
+5. **Previous image validation:** `prevCurUpdateInfo()` validates previous flash result
+
+Returns: `INITIAL_VALIDATION_SUCCESS` (0), `INITIAL_VALIDATION_FAIL` (1), `INITIAL_VALIDATION_DWNL_INPROGRESS` (2), `INITIAL_VALIDATION_DWNL_COMPLETED` (3)
+
+### 3.3 XConf Communication (`MakeXconfComms()`)
+
+**[FACT]** Performs:
+1. Allocate download data buffer
+2. Get XConf server URL via `GetServURL()`
+3. Build device JSON string via `createJsonString()`
+4. Construct `RdkUpgradeContext_t` with `XCONF_UPGRADE` type
+5. Call `rdkv_upgrade_request()` — sends HTTP POST to XConf server
+6. On success: parse response via `getXconfRespData()` into `XCONFRES` structure
+
+### 3.4 Upgrade Triggering (`checkTriggerUpgrade()`)
+
+**[FACT]** Multi-stage upgrade process:
+1. **PCI:** `checkForValidPCIUpgrade()` → if valid, `rdkv_upgrade_request()` with PCI context
+2. **PDRI:** If PDRI enabled and not skipped (immediate reboot + PCI valid), download PDRI image
+3. **Peripheral:** If `/etc/os-release` exists and peripheral firmwares listed, call `peripheral_firmware_dndl()`
+4. **Opt-out handling:** Checks `/opt/maintenance_mgr_record.conf` for `IGNORE_UPDATE` / `ENFORCE_OPTOUT`
+
+### 3.5 Signal Handling
+
+**[FACT]** `SIGUSR1` handler (`handle_signal()`):
+- Sets `force_exit = 1`
+- Calls `setForceStop(1)` — tells download library to abort
+- Reports `MAINT_FWDOWNLOAD_ERROR` and `FW_STATE_FAILED`
+- Updates upgrade flag
+
+### 3.6 Download Throttling
+
+**[FACT]** `interuptDwnl()` is a callback from Maintenance Manager via IARM:
+- Background mode (app_mode=0): Throttle download to `rfc_topspeed` bytes/sec
+- Foreground mode (app_mode=1): Remove throttle (full speed)
+- If throttle speed is 0: Force-stop the download
+
+---
+
+## 4. Error Handling Strategy
+
+**[FACT]** The one-shot binary calls `exit()` on fatal errors:
+- Initialize failure → `exit(ret_curl_code)`
+- Invalid arguments → `exit(ret_curl_code)`
+- Fatal library errors (`RDKV_UPGRADE_ERROR_THROTTLE_ZERO`, `RDKV_UPGRADE_ERROR_FORCE_EXIT`) → `exit(1)`
+- Opt-out enforcement → `exit(1)`
+
+**[FACT]** Before exit, always calls `uninitialize()` which:
+- Destroys mutexes
+- Terminates event handler
+- Removes PID file (`/tmp/DIFD.pid`)
+- Closes logger
+
+---
+
+## 5. Key Global State
+
+| Variable | Type | Purpose |
+|----------|------|---------|
+| `device_info` | `DeviceProperty_t` | Device model, partner, serial, difw_path |
+| `cur_img_detail` | `ImageDetails_t` | Current running image name |
+| `rfc_list` | `Rfc_t` | RFC settings (throttle, mTLS, incremental CDL) |
+| `DwnlState` | `int` (mutex-protected) | Current download state |
+| `app_mode` | `int` (mutex-protected) | 1=foreground, 0=background |
+| `force_exit` | `int` | Signal flag to abort download |
+| `curl` | `void*` | Active CURL handle |
+| `trigger_type` | `int` | Upgrade trigger type (1-6) |
diff --git a/openspec/runtime/rdkvfwupgrader-sequence.md b/openspec/runtime/rdkvfwupgrader-sequence.md
new file mode 100755
index 00000000..2a058e4e
--- /dev/null
+++ b/openspec/runtime/rdkvfwupgrader-sequence.md
@@ -0,0 +1,347 @@
+# rdkvfwupgrader — Detailed Runtime Execution Sequence
+
+> **Evidence Level:** Verified from `src/rdkv_main.c` call-by-call  
+> **Thread Context:** Single-threaded process (main thread only, no worker threads)  
+> **All operations are synchronous/blocking unless noted**
+
+---
+
+## 1. Process Invocation Context
+
+**[FACT]** Invoked externally, typically by:
+- Maintenance Manager via IARM event triggering systemd unit
+- Cron scheduled job (trigger_type=2)
+- TR-69/SNMP triggered event (trigger_type=3)
+- Application-triggered request (trigger_type=4)
+
+**[INFERENCE]** The calling entity is responsible for passing the correct trigger_type argument.
+
+```
+Invocation: /usr/bin/rdkvfwupgrader <retry_count> <trigger_type>
+Example:    /usr/bin/rdkvfwupgrader 3 2
+```
+
+---
+
+## 2. Complete Execution Timeline
+
+```mermaid
+sequenceDiagram
+    participant MM as Maintenance Manager<br/>(or Caller)
+    participant PROC as rdkvfwupgrader<br/>(single thread)
+    participant FS as Filesystem<br/>(/etc, /tmp, /opt)
+    participant IARM as IARM Bus
+    participant T2 as Telemetry 2.0
+    participant THUNDER as Thunder JSON-RPC<br/>(localhost:9998)
+    participant XCONF as XConf Cloud Server
+    participant CDN as CDN / HTTP Server
+    participant FLASH as Flash HAL
+
+    Note over MM,FLASH: ═══ PHASE 1: INITIALIZATION (blocking) ═══
+
+    MM->>PROC: fork+exec("/usr/bin/rdkvfwupgrader 3 2")
+    activate PROC
+    
+    PROC->>PROC: log_init() [or rdk_logger_ext_init()]
+    PROC->>PROC: sigaction(SIGUSR1, handle_signal)
+    PROC->>PROC: Zero XCONFRES response struct
+    PROC->>T2: t2_init("rdkfwupgrader") [if T2_EVENT_ENABLED]
+    PROC->>T2: t2CountNotify("SYST_INFO_C_CDL", 1)
+    
+    Note over PROC,FS: initialize() — blocking I/O
+    PROC->>FS: getDeviceProperties() → read /etc/device.properties
+    FS-->>PROC: device_info (model, partner, difw_path, maint_status)
+    PROC->>FS: getImageDetails() → read version files
+    FS-->>PROC: cur_img_detail (current firmware name)
+    PROC->>FS: getRFCSettings() → read RFC config
+    FS-->>PROC: rfc_list (throttle, mtls, incr_cdl, topspeed)
+    PROC->>FS: createDir(device_info.difw_path)
+    PROC->>IARM: init_event_handler() [BLOCKING — IPC handshake]
+    
+    alt maint_status == "true"
+        PROC->>THUNDER: getJsonRpc("getMaintenanceMode") [HTTP POST to localhost:9998]
+        THUNDER-->>PROC: JSON response
+        alt response contains "BACKGROUND"
+            PROC->>PROC: setAppMode(0) — background mode
+        end
+    end
+
+    Note over PROC: ═══ PHASE 2: ARGUMENT PARSING ═══
+    PROC->>PROC: Parse argv[2] → trigger_type = 2
+    PROC->>T2: t2CountNotify("SYST_INFO_SWUpgrdChck", 1) [if scheduled]
+
+    Note over PROC,FS: ═══ PHASE 3: INITIAL VALIDATION (blocking I/O) ═══
+    
+    PROC->>FS: GetBuildType() → read build type
+    PROC->>FS: read_RFCProperty("AutoExcluded")
+    
+    alt device excluded on non-PROD build
+        PROC->>PROC: status = INITIAL_VALIDATION_FAIL → exit
+    end
+    
+    PROC->>FS: CurrentRunningInst("/tmp/DIFD.pid") — check PID file
+    
+    alt another instance running
+        PROC->>PROC: status = DWNL_INPROGRESS → skip upgrade
+    else /tmp/fw_preparing_to_reboot exists
+        PROC->>IARM: eventManager("MaintenanceMGR", COMPLETE)
+        PROC->>FS: unlink("/tmp/fw_preparing_to_reboot")
+        PROC->>PROC: status = DWNL_COMPLETED → skip upgrade
+    else no conflicts
+        PROC->>FS: Write PID to /tmp/DIFD.pid
+        PROC->>PROC: prevCurUpdateInfo() — validate prior flash state
+        PROC->>PROC: status = SUCCESS → proceed
+    end
+
+    Note over PROC,XCONF: ═══ PHASE 4: XCONF COMMUNICATION (blocking network I/O) ═══
+    
+    alt validation == SUCCESS
+        PROC->>IARM: eventManager(FW_STATE_EVENT, FW_STATE_UNINITIALIZED)
+        
+        alt isInStateRed()
+            PROC->>IARM: eventManager(RED_STATE_EVENT, RED_RECOVERY_STARTED)
+            PROC->>FS: write_RFCProperty("REDRECV", "STARTED")
+        end
+        
+        PROC->>IARM: eventManager(FW_STATE_EVENT, FW_STATE_REQUESTING)
+        
+        Note over PROC,XCONF: MakeXconfComms() — BLOCKING network call
+        PROC->>PROC: allocDowndLoadDataMem()
+        PROC->>PROC: GetServURL() → XConf server URL
+        PROC->>PROC: createJsonString() → device JSON payload
+        PROC->>XCONF: rdkv_upgrade_request(XCONF_UPGRADE) [HTTP POST]
+        Note right of XCONF: Blocking. Waits for<br/>server response.<br/>May take 5-60 seconds.
+        XCONF-->>PROC: HTTP response (JSON body)
+        PROC->>PROC: getXconfRespData() → parse into XCONFRES
+    end
+
+    Note over PROC,FLASH: ═══ PHASE 5: FIRMWARE UPGRADE EXECUTION (blocking) ═══
+    
+    alt HTTP 200 + valid JSON
+        PROC->>PROC: processJsonResponse() — validate response fields
+        PROC->>PROC: checkForValidPCIUpgrade() — version comparison
+        
+        alt PCI upgrade required
+            Note over PROC,CDN: PCI Download (BLOCKING)
+            PROC->>PROC: isUpgradeInProgress() check
+            PROC->>FS: Write download URL to DWNL_URL_VALUE
+            PROC->>FS: eraseFolderExceParamFile() — clean old images
+            PROC->>CDN: rdkv_upgrade_request(PCI_UPGRADE) [HTTP GET]
+            Note right of CDN: BLOCKING download.<br/>May take minutes.<br/>Throttling applies.
+            CDN-->>PROC: Firmware binary → written to difw_path
+            PROC->>FLASH: flashImage() [via librdksw_flash]
+        end
+        
+        alt PDRI upgrade required
+            Note over PROC: sleep(30) if PCI also downloaded
+            PROC->>CDN: rdkv_upgrade_request(PDRI_UPGRADE) [HTTP GET]
+            CDN-->>PROC: PDRI binary → written to difw_path
+            PROC->>FLASH: flashImage() [via librdksw_flash]
+        end
+        
+        alt Peripheral firmware available
+            loop For each peripheral firmware
+                PROC->>CDN: rdkv_upgrade_request(PERIPHERAL_UPGRADE)
+                CDN-->>PROC: .tgz file → written to difw_path
+            end
+            PROC->>IARM: eventManager("PeripheralUpgradeEvent", path:versions)
+        end
+    end
+
+    Note over PROC: ═══ PHASE 6: STATUS REPORTING & CLEANUP ═══
+    
+    alt upgrade success
+        PROC->>IARM: eventManager("MaintenanceMGR", MAINT_FWDOWNLOAD_COMPLETE)
+    else upgrade failed
+        PROC->>IARM: eventManager("MaintenanceMGR", MAINT_FWDOWNLOAD_ERROR)
+    end
+    
+    Note over PROC: uninitialize()
+    PROC->>T2: t2_uninit()
+    PROC->>PROC: pthread_mutex_destroy() × 2
+    PROC->>IARM: term_event_handler()
+    PROC->>FS: updateUpgradeFlag(2) — remove flag file
+    PROC->>FS: unlink("/tmp/DIFD.pid")
+    PROC->>PROC: log_exit()
+    PROC->>PROC: exit(ret_curl_code)
+    deactivate PROC
+```
+
+---
+
+## 3. Blocking Operation Analysis
+
+| Operation | Duration | Blocking? | Thread Context |
+|-----------|----------|-----------|----------------|
+| `getDeviceProperties()` | ~1ms | Yes (file I/O) | Main |
+| `getImageDetails()` | ~1ms | Yes (file I/O) | Main |
+| `getRFCSettings()` | ~5ms | Yes (file/IPC) | Main |
+| `init_event_handler()` | ~10ms | Yes (IARM connect) | Main |
+| `getJsonRpc()` → Thunder | ~50-200ms | Yes (HTTP localhost) | Main |
+| `MakeXconfComms()` → XConf | **5-60 seconds** | **YES (network)** | Main |
+| `rdkv_upgrade_request(PCI)` | **Minutes** | **YES (download)** | Main |
+| `rdkv_upgrade_request(PDRI)` | **Seconds-minutes** | **YES (download)** | Main |
+| `peripheral_firmware_dndl()` | **Seconds-minutes** | **YES (download per file)** | Main |
+| `flashImage()` | **Seconds** | **YES (flash I/O)** | Main |
+
+**[FACT]** The entire process is single-threaded. All I/O blocks the main thread. The only concurrency mechanism is the `SIGUSR1` signal handler which sets `force_exit=1` to abort downloads.
+
+---
+
+## 4. Fatal Error Paths
+
+```mermaid
+flowchart TD
+    subgraph "Fatal Exits (exit() called)"
+        E1["initialize() failure → exit(1)"]
+        E2["argc < 3 → exit(1)"]
+        E3["Invalid trigger_type → exit(1)"]
+        E4["isUpgradeInProgress() == true → exit(1)"]
+        E5["RDKV_UPGRADE_ERROR_THROTTLE_ZERO → exit(1)"]
+        E6["RDKV_UPGRADE_ERROR_FORCE_EXIT → exit(1)"]
+        E7["OptOut: IGNORE_UPDATE → exit(1)"]
+        E8["OptOut: ENFORCE_OPTOUT → exit(1)"]
+    end
+    
+    subgraph "Graceful Exits"
+        G1["validation DWNL_INPROGRESS → exit(1)"]
+        G2["validation DWNL_COMPLETED → exit(1)"]
+        G3["XConf failure → exit(curl_code)"]
+        G4["Upgrade success → exit(0)"]
+    end
+    
+    subgraph "All paths call"
+        CLEANUP["uninitialize()"]
+    end
+    
+    E1 & E2 & E3 -->|"partial cleanup"| CLEANUP
+    E4 & E5 & E6 & E7 & E8 -->|"full cleanup"| CLEANUP
+    G1 & G2 & G3 & G4 --> CLEANUP
+```
+
+---
+
+## 5. SIGUSR1 Signal Handling (Interrupt Path)
+
+**[FACT]** Executes asynchronously in signal context:
+
+```mermaid
+sequenceDiagram
+    participant EXT as External Signal Source
+    participant PROC as rdkvfwupgrader main thread
+    participant DL as Download Library (libcurl)
+    participant IARM as IARM Bus
+
+    Note over PROC: Download in progress (blocking)
+    EXT->>PROC: kill -SIGUSR1 <pid>
+    
+    Note over PROC: Signal handler interrupts download
+    activate PROC
+    PROC->>PROC: force_exit = 1
+    PROC->>DL: setForceStop(1) — async flag for curl
+    PROC->>IARM: eventManager("MaintenanceMGR", ERROR)
+    PROC->>IARM: eventManager(FW_STATE_EVENT, FAILED)
+    PROC->>PROC: updateUpgradeFlag(2) — remove flag
+    deactivate PROC
+    
+    Note over PROC: rdkv_upgrade_request() returns error
+    PROC->>PROC: Normal exit path (cleanup + exit)
+```
+
+**[FACT]** Signal is caught via `sigaction(SIGUSR1)` with `SA_ONSTACK | SA_SIGINFO` flags. The handler sets global flags that cause the blocking download to abort.
+
+---
+
+## 6. Download Throttling Interaction (IARM Callback)
+
+**[FACT]** `interuptDwnl()` is registered as an IARM callback:
+
+```mermaid
+sequenceDiagram
+    participant MM as Maintenance Manager
+    participant IARM as IARM Bus
+    participant PROC as rdkvfwupgrader
+    participant CURL as libcurl (download in progress)
+
+    Note over PROC,CURL: Active download (blocking rdkv_upgrade_request)
+    
+    MM->>IARM: Broadcast app_mode change
+    IARM->>PROC: interuptDwnl(app_mode=0) [callback in signal/IPC context]
+    
+    PROC->>PROC: setAppMode(0) [mutex-protected]
+    PROC->>PROC: getDwnlState() == RDKV_FWDNLD_DOWNLOAD_INPROGRESS?
+    PROC->>CURL: doGetDwnlBytes(curl) → bytes downloaded
+    
+    alt throttle_speed == 0
+        PROC->>PROC: force_exit = 1
+        PROC->>CURL: setForceStop(1)
+        PROC->>IARM: eventManager(FW_STATE_FAILED)
+        Note over PROC: Download will abort
+    else throttle_speed > 0
+        PROC->>CURL: doInteruptDwnl(curl, speed)
+        Note over CURL: Pause → Unpause at reduced speed
+    end
+```
+
+**[FACT]** The IARM callback executes in the same thread context as the main loop (IARM events are dispatched during blocking wait inside `rdkv_upgrade_request`).  
+**[INFERENCE]** This is possible because `rdkv_upgrade_request` uses curl's multi interface or has an internal event loop that processes IARM callbacks.
+
+---
+
+## 7. External Service Dependency Timeline
+
+```mermaid
+gantt
+    title rdkvfwupgrader Execution Timeline (typical ~2 min run)
+    dateFormat ss
+    axisFormat %S
+
+    section Initialization
+    Logger + Signal Setup        :a1, 00, 1s
+    Device Properties (file)     :a2, after a1, 1s
+    RFC + IARM Init             :a3, after a2, 1s
+    Thunder Mode Query          :a4, after a3, 1s
+
+    section Validation
+    RFC AutoExclude Check       :b1, after a4, 1s
+    PID File + Prev State       :b2, after b1, 1s
+
+    section XConf Query
+    HTTP POST to XConf Server   :crit, c1, after b2, 15s
+    Parse JSON Response         :c2, after c1, 1s
+
+    section Firmware Download
+    PCI Download (HTTP GET)     :crit, d1, after c2, 60s
+    PCI Flash                   :d2, after d1, 10s
+    PDRI Download               :d3, after d2, 20s
+    Peripheral Downloads        :d4, after d3, 15s
+
+    section Cleanup
+    Status Report + Exit        :e1, after d4, 1s
+```
+
+---
+
+## 8. State Variable Transitions
+
+| Variable | Initial | During Operation | At Exit |
+|----------|---------|-----------------|---------|
+| `DwnlState` | `RDKV_FWDNLD_UNINITIALIZED` | `RDKV_FWDNLD_DOWNLOAD_INPROGRESS` | N/A (mutex destroyed) |
+| `app_mode` | `1` (foreground) | `0` if MM background | N/A (mutex destroyed) |
+| `force_exit` | `0` | `1` on SIGUSR1 or throttle=0 | N/A |
+| `curl` | `NULL` | Active curl handle | `NULL` |
+| `isCriticalUpdate` | `false` | `true` if rebootImmed=true | N/A |
+| `/tmp/DIFD.pid` | Created (PID written) | Present | Deleted |
+| Upgrade flag file | Created at download start | Present during download | Deleted |
+
+---
+
+## 9. Operational Invariants
+
+1. **[FACT]** Only one instance can run at a time (enforced by `/tmp/DIFD.pid` check)
+2. **[FACT]** The process never daemonizes — it runs synchronously start-to-finish
+3. **[FACT]** All network I/O is blocking on the single main thread
+4. **[FACT]** Exit code `0` = success, non-zero = failure (curl error code propagated)
+5. **[FACT]** `uninitialize()` is always called before exit (all paths converge)
+6. **[FACT]** PID file is removed unless another instance was detected as running
+7. **[INFERENCE]** Typical wall-clock time: 30 seconds (no update) to 5+ minutes (full PCI download)
diff --git a/openspec/specs/client-sdk/spec.md b/openspec/specs/client-sdk/spec.md
new file mode 100755
index 00000000..8611a173
--- /dev/null
+++ b/openspec/specs/client-sdk/spec.md
@@ -0,0 +1,466 @@
+# Subsystem Specification: client-sdk
+
+> **Subsystem:** Client Library SDK (`librdkFwupdateMgr.so`)  
+> **Type:** IPC/Integration — Daemon Ecosystem  
+> **Scope:** Consumer-facing shared library (interacts with daemon via D-Bus)  
+> **Evidence Level:** Verified from `librdkFwupdateMgr/src/rdkFwupdateMgr_api.c`, `rdkFwupdateMgr_process.c`, `rdkFwupdateMgr_async.c`, `include/rdkFwupdateMgr_client.h`  
+> **Cross-references:** [runtime/client-daemon-interaction.md](../../runtime/client-daemon-interaction.md), [subsystems/subsystem-inventory.md §4](../../subsystems/subsystem-inventory.md)
+
+---
+
+## 1. Purpose
+
+The `client-sdk` subsystem provides the public C API for third-party applications to interact with the `rdkFwupdateMgr` daemon. It abstracts all D-Bus transport behind a lifecycle-oriented interface: initialize → register → operate → unregister → terminate.
+
+This subsystem defines the consumer-facing contract that all client applications depend on for firmware update operations. It is the sole supported integration path for external applications.
+
+---
+
+## 2. What This Subsystem Owns
+
+- Public C API surface (`rdkFwupdateMgr_client.h`)
+- Background GLib thread for asynchronous signal dispatch
+- D-Bus signal subscriptions (3 signal types)
+- Callback registries (CheckForUpdate, Download, Update)
+- Ephemeral D-Bus proxy creation per API call
+- Connection lifecycle management (init/term)
+- Thread synchronization between caller thread and background thread
+
+## 3. What This Subsystem Does NOT Own
+
+- D-Bus service implementation (owned by `dbus-ipc`)
+- Firmware update logic (owned by daemon subsystems)
+- D-Bus connection persistence (proxies are ephemeral)
+- Daemon lifecycle or availability
+- Firmware files or status files
+- System-level error recovery
+
+---
+
+## 4. Responsibilities
+
+| Responsibility | Behavioral Contract |
+|----------------|-------------------|
+| Library initialization | `rdkFwupdateMgr_init()` MUST spawn background thread and subscribe to D-Bus signals |
+| Library termination | `rdkFwupdateMgr_term()` MUST stop background thread and clean up all resources |
+| Process registration | `registerProcess()` MUST return a valid handler ID on success |
+| Process unregistration | `unregisterProcess()` MUST release registration with daemon |
+| Firmware check | `checkForUpdate()` MUST return immediately with in-progress indicator |
+| Firmware download | `downloadFirmware()` MUST return immediately with acceptance status |
+| Firmware update/flash | `updateFirmware()` MUST return immediately with acceptance status |
+| Callback registration | `register*Callback()` MUST store callback for async invocation |
+| Async result delivery | Background thread MUST invoke registered callbacks on signal receipt |
+| Thread safety | API calls MUST be safe from any single thread; callbacks delivered on background thread |
+
+---
+
+## 5. Exposed Interfaces / APIs
+
+### 5.1 Lifecycle API
+
+```c
+/**
+ * @brief Initialize the firmware update client library
+ * @return 0 on success, non-zero on failure
+ * @post Background thread running, D-Bus signals subscribed
+ * @note MUST be called before any other API function
+ */
+int rdkFwupdateMgr_init(void);
+
+/**
+ * @brief Terminate the firmware update client library
+ * @return 0 on success
+ * @pre All operations complete or abandoned
+ * @post Background thread stopped, resources freed
+ */
+int rdkFwupdateMgr_term(void);
+```
+
+### 5.2 Registration API
+
+```c
+/**
+ * @brief Register this process with the firmware update daemon
+ * @param app_name      Application identifier string
+ * @param app_version   Application version string
+ * @return FirmwareInterfaceHandle (opaque handle) or NULL on failure
+ * @note Creates ephemeral D-Bus proxy; blocks until daemon responds
+ */
+FirmwareInterfaceHandle registerProcess(const char *app_name, const char *app_version);
+
+/**
+ * @brief Unregister this process from the firmware update daemon
+ * @param handle    Handle returned by registerProcess()
+ * @return 0 on success, non-zero on failure
+ */
+int unregisterProcess(FirmwareInterfaceHandle handle);
+```
+
+### 5.3 Operation API
+
+```c
+/**
+ * @brief Request firmware update check
+ * @param handle    Registration handle
+ * @return FwUpdateData with status (3 = check in progress)
+ * @note Returns immediately; real result via registered callback
+ */
+FwUpdateData checkForUpdate(FirmwareInterfaceHandle handle);
+
+/**
+ * @brief Request firmware download
+ * @param handle    Registration handle
+ * @param fw_name   Firmware filename
+ * @param fw_url    Download URL
+ * @param fw_type   Firmware type (PCI/PDRI/PERIPHERAL)
+ * @return Status (0=accepted, non-zero=rejected)
+ * @note Returns immediately; progress via registered callback
+ */
+int downloadFirmware(FirmwareInterfaceHandle handle, 
+                     const char *fw_name, const char *fw_url, int fw_type);
+
+/**
+ * @brief Request firmware flash/update
+ * @param handle    Registration handle
+ * @param fw_name   Firmware filename to flash
+ * @return Status (0=accepted, non-zero=rejected)
+ * @note Returns immediately; result via registered callback
+ */
+int updateFirmware(FirmwareInterfaceHandle handle, const char *fw_name);
+```
+
+### 5.4 Callback Registration API
+
+```c
+/**
+ * @brief Register callback for CheckForUpdate results
+ * @param handle    Registration handle
+ * @param callback  Function pointer invoked when check completes
+ * @return 0 on success
+ * @note Callback invoked on library's background thread
+ * @warning MUST register BEFORE calling checkForUpdate() to avoid race
+ */
+int registerCheckForUpdateCallback(FirmwareInterfaceHandle handle, 
+                                    CheckForUpdateCb callback);
+
+/**
+ * @brief Register callback for download progress
+ * @param handle    Registration handle
+ * @param callback  Function pointer invoked on progress/completion
+ * @return 0 on success
+ */
+int registerDownloadCallback(FirmwareInterfaceHandle handle, 
+                             DownloadProgressCb callback);
+
+/**
+ * @brief Register callback for update/flash results
+ * @param handle    Registration handle
+ * @param callback  Function pointer invoked on flash completion
+ * @return 0 on success
+ */
+int registerUpdateCallback(FirmwareInterfaceHandle handle, 
+                           UpdateCompleteCb callback);
+```
+
+### 5.5 Data Structures
+
+```c
+typedef char* FirmwareInterfaceHandle;  // Opaque: string representation of handler_id
+
+typedef struct {
+    int status_code;     // Result code (0=update available, 1=up-to-date, 3=in-progress)
+    char *fw_name;       // Firmware filename
+    char *fw_version;    // Firmware version
+    char *fw_url;        // Download URL
+    char *message;       // Human-readable status message
+} FwUpdateData;
+
+typedef void (*CheckForUpdateCb)(FwUpdateData *data, void *user_data);
+typedef void (*DownloadProgressCb)(int percent, const char *message, void *user_data);
+typedef void (*UpdateCompleteCb)(int status, const char *message, void *user_data);
+```
+
+---
+
+## 6. Runtime Lifecycle
+
+```mermaid
+stateDiagram-v2
+    [*] --> UNINITIALIZED
+    
+    UNINITIALIZED --> INITIALIZED : rdkFwupdateMgr_init()
+    
+    state INITIALIZED {
+        [*] --> BG_THREAD_RUNNING
+        BG_THREAD_RUNNING --> SIGNAL_SUBSCRIBED : D-Bus signals connected
+        SIGNAL_SUBSCRIBED --> READY : Ready for API calls
+    }
+    
+    INITIALIZED --> REGISTERED : registerProcess() success
+    
+    state REGISTERED {
+        [*] --> IDLE
+        IDLE --> CHECK_PENDING : checkForUpdate()
+        IDLE --> DOWNLOAD_PENDING : downloadFirmware()
+        IDLE --> UPDATE_PENDING : updateFirmware()
+        CHECK_PENDING --> IDLE : Callback received
+        DOWNLOAD_PENDING --> IDLE : Download complete callback
+        UPDATE_PENDING --> IDLE : Flash complete callback
+    }
+    
+    REGISTERED --> INITIALIZED : unregisterProcess()
+    INITIALIZED --> UNINITIALIZED : rdkFwupdateMgr_term()
+    UNINITIALIZED --> [*]
+```
+
+---
+
+## 7. Interaction Contracts
+
+### 7.1 Client Application → Library
+
+| API Call | Threading | Blocking | D-Bus Activity |
+|----------|-----------|----------|---------------|
+| `rdkFwupdateMgr_init()` | Caller's thread | Yes (thread spawn) | Signal subscription |
+| `rdkFwupdateMgr_term()` | Caller's thread | Yes (thread join) | Signal unsubscription |
+| `registerProcess()` | Caller's thread | Yes (D-Bus sync call, ~10-50ms) | Ephemeral proxy → method call |
+| `unregisterProcess()` | Caller's thread | Yes (D-Bus sync call) | Ephemeral proxy → method call |
+| `checkForUpdate()` | Caller's thread | Yes (D-Bus sync call, returns immediately after daemon ack) | Ephemeral proxy → method call |
+| `downloadFirmware()` | Caller's thread | Yes (D-Bus sync call) | Ephemeral proxy → method call |
+| `updateFirmware()` | Caller's thread | Yes (D-Bus sync call) | Ephemeral proxy → method call |
+| `register*Callback()` | Caller's thread | No (in-process only) | None |
+
+### 7.2 Library → Client Application (Callbacks)
+
+| Callback | Invocation Thread | Triggered By |
+|----------|------------------|--------------|
+| `CheckForUpdateCb` | Background thread | D-Bus signal `CheckForUpdateComplete` |
+| `DownloadProgressCb` | Background thread | D-Bus signal `DownloadProgress` |
+| `UpdateCompleteCb` | Background thread | D-Bus signal `UpdateProgress` |
+
+### 7.3 Library → Daemon (D-Bus)
+
+```mermaid
+sequenceDiagram
+    participant APP as Application Thread
+    participant LIB as librdkFwupdateMgr
+    participant BG as Background Thread
+    participant DBUS as D-Bus System Bus
+    participant DAEMON as rdkFwupdateMgr
+
+    Note over APP,DAEMON: Synchronous method call path
+    APP->>LIB: checkForUpdate(handle)
+    LIB->>LIB: Create ephemeral GDBusProxy
+    LIB->>DBUS: g_dbus_proxy_call_sync("CheckForUpdate", ...)
+    DBUS->>DAEMON: Dispatch method
+    DAEMON-->>DBUS: Immediate response
+    DBUS-->>LIB: GVariant response
+    LIB->>LIB: Destroy proxy
+    LIB-->>APP: Return FwUpdateData
+
+    Note over APP,DAEMON: Asynchronous signal path
+    DAEMON->>DBUS: Emit CheckForUpdateComplete signal
+    DBUS->>BG: Signal delivered to subscription
+    BG->>BG: Parse signal payload
+    BG->>BG: Lookup registered callback for signal type
+    BG->>APP: Invoke callback(data, user_data)
+    Note right of APP: Callback runs on BG thread!
+```
+
+---
+
+## 8. Shared-Library Dependencies
+
+| Library | Usage |
+|---------|-------|
+| GLib/GIO | GDBusProxy, GDBusConnection, GMainLoop, GThread |
+| libpthread | Thread primitives (implicit via GLib) |
+| D-Bus system bus | IPC transport (via GIO) |
+
+---
+
+## 9. Execution-Model-Specific Behavior
+
+### 9.1 Relationship to Execution Models
+
+This subsystem exists ONLY in the daemon ecosystem:
+
+| Aspect | Detail |
+|--------|--------|
+| One-shot (`rdkvfwupgrader`) | Does NOT use client-sdk; performs operations directly |
+| Daemon (`rdkFwupdateMgr`) | Is the SERVICE that client-sdk communicates with |
+| Client applications | Use client-sdk as their ONLY integration path |
+
+### 9.2 Client-SDK is NOT Part of Either Binary
+
+The library runs in a **separate process** (the client application). It is the IPC bridge between client processes and the daemon process.
+
+```mermaid
+flowchart LR
+    subgraph "Client Process"
+        APP["Application Logic"]
+        SDK["librdkFwupdateMgr.so<br/>(client-sdk)"]
+    end
+    
+    subgraph "D-Bus System Bus"
+        BUS["org.rdkfwupdater.Interface"]
+    end
+    
+    subgraph "Daemon Process"
+        DBUS_IPC["dbus-ipc subsystem"]
+        DAEMON["daemon-runtime"]
+    end
+    
+    APP --> SDK
+    SDK -->|"Method calls"| BUS
+    BUS -->|"Signals"| SDK
+    BUS -->|"Dispatch"| DBUS_IPC
+    DBUS_IPC --> DAEMON
+```
+
+---
+
+## 10. Threading / Event-Loop Expectations
+
+### Thread Architecture
+
+| Thread | Owner | Purpose | Lifetime |
+|--------|-------|---------|----------|
+| Caller thread | Application | API calls (blocking D-Bus) | Application-managed |
+| Background thread | Library | GLib main loop for signal dispatch | `init()` to `term()` |
+
+### Thread Safety Contract
+
+| Guarantee | Detail |
+|-----------|--------|
+| API calls from caller thread | All public API functions are safe to call from a single application thread |
+| Callbacks on background thread | ALL callbacks are invoked on the library's background thread, NOT the caller's thread |
+| No concurrent API calls | Library does NOT guarantee safety for concurrent API calls from multiple threads |
+| Callback must be non-blocking | Callback implementations SHOULD NOT block (blocks signal dispatch for other callbacks) |
+| Register before invoke | Callbacks MUST be registered BEFORE invoking the corresponding operation |
+
+### Critical Race Condition
+
+```mermaid
+sequenceDiagram
+    participant APP as Application
+    participant LIB as Library
+    participant BG as Background Thread
+    participant DAEMON as Daemon
+
+    Note over APP,DAEMON: CORRECT ordering
+    APP->>LIB: registerCheckForUpdateCallback(cb)
+    LIB->>BG: Store callback in registry
+    APP->>LIB: checkForUpdate(handle)
+    LIB->>DAEMON: D-Bus method call
+    DAEMON-->>BG: Signal (later)
+    BG->>APP: cb(result)
+    
+    Note over APP,DAEMON: INCORRECT ordering (race!)
+    APP->>LIB: checkForUpdate(handle)
+    LIB->>DAEMON: D-Bus method call
+    APP->>LIB: registerCheckForUpdateCallback(cb)
+    DAEMON-->>BG: Signal arrives BEFORE callback registered!
+    BG->>BG: No callback found → signal DROPPED
+```
+
+---
+
+## 11. Operational Invariants
+
+| Invariant | Enforcement |
+|-----------|-------------|
+| `init()` before any operation | Undefined behavior if called without init |
+| `registerProcess()` before operations | Daemon rejects requests from unregistered handlers |
+| Callbacks registered before operations | Signal may arrive before callback stored (race) |
+| Background thread alive during operation | Thread runs from `init()` to `term()` |
+| Ephemeral proxies (no persistent connection) | New proxy per API call; no connection-state dependency |
+| Single active library instance per process | Global state (registries) assumes single instance |
+
+---
+
+## 12. Safety Guarantees
+
+| Guarantee | Mechanism |
+|-----------|-----------|
+| No daemon crash from bad client input | D-Bus validates types; daemon validates semantics |
+| Clean thread shutdown | `term()` quits main loop, joins thread |
+| No resource leaks on term | All subscriptions removed, proxies destroyed |
+| Callback isolation | Each signal type has independent registry |
+| No credential exposure | D-Bus authentication handled by system bus |
+
+---
+
+## 13. Failure Semantics
+
+| Failure Mode | API Return | Callback Impact | Application Action |
+|--------------|-----------|-----------------|-------------------|
+| Daemon not running | D-Bus error (proxy call fails) | No signals emitted | Retry later |
+| D-Bus bus unavailable | `init()` returns error | N/A | Cannot use library |
+| Registration rejected | `registerProcess()` returns NULL | N/A | Cannot proceed |
+| Operation rejected | Non-zero return from operation API | No callback for this request | Check preconditions |
+| Daemon crashes during operation | No completion signal received | Callback never invoked | Application timeout needed |
+| Library `term()` during active operation | Signals unsubscribed | Pending callbacks may be lost | Application must track |
+
+---
+
+## 14. Retry / Recovery Behavior
+
+| Scenario | Library Behavior | Application Responsibility |
+|----------|-----------------|---------------------------|
+| Daemon unavailable | Return error from API call | Retry with backoff |
+| Operation timeout (no callback) | Library has no timeout mechanism | Application must implement timeout |
+| Daemon restart | Existing handler_ids invalidated | Re-register after daemon restart |
+| Callback not received | No built-in retry | Application monitors and retries |
+| D-Bus bus restart | Library subscription lost | Call `term()` + `init()` to re-establish |
+
+**[CRITICAL]** The library provides NO built-in timeout or retry mechanisms. Applications MUST implement their own timeout logic for async operations.
+
+---
+
+## 15. Observability Expectations
+
+| Observable | Mechanism | Consumer |
+|------------|-----------|----------|
+| Library initialized | `init()` return code | Application |
+| Registration status | `registerProcess()` return value | Application |
+| Operation acceptance | API return values | Application |
+| Async results | Callback invocations | Application |
+| Daemon availability | D-Bus name presence | Application (if monitoring) |
+
+---
+
+## 16. External Dependencies
+
+| Dependency | Nature | Failure Impact |
+|------------|--------|----------------|
+| D-Bus system bus | IPC transport | Library cannot function |
+| `rdkFwupdateMgr` daemon | Service provider | Operations fail |
+| GLib/GIO runtime | Threading + D-Bus | Library cannot initialize |
+
+---
+
+## 17. Assumptions and Unknowns
+
+### Verified Assumptions
+
+- [VERIFIED] Proxies are ephemeral — created and destroyed per API call
+- [VERIFIED] Background thread runs its own GLib main loop
+- [VERIFIED] Callbacks are invoked on the background thread, not caller's thread
+- [VERIFIED] Signal subscriptions are for all signals of each type (not filtered by handler_id)
+- [VERIFIED] `FirmwareInterfaceHandle` is a string representation of the uint64 handler_id
+
+### Inferred Behavior
+
+- [INFERRED] All registered callbacks for a signal type receive ALL signals (not filtered per-client)
+- [INFERRED] Multiple applications can use the library concurrently (each in own process)
+- [INFERRED] No built-in timeout for daemon response on sync D-Bus calls (GLib default timeout applies)
+
+### Unresolved Unknowns
+
+- [UNKNOWN] GLib D-Bus proxy default timeout value (may be 25 seconds)
+- [UNKNOWN] Whether signals are filtered by handler_id or all clients receive all signals
+- [UNKNOWN] Memory ownership semantics of `FwUpdateData` fields (caller-freed? library-freed?)
+- [UNKNOWN] Whether `init()` blocks until background thread is fully operational
+- [UNKNOWN] Behavior on concurrent `init()` calls from same process
+- [UNKNOWN] Maximum number of registered callbacks per signal type
diff --git a/openspec/specs/daemon-runtime/spec.md b/openspec/specs/daemon-runtime/spec.md
new file mode 100755
index 00000000..66c1f073
--- /dev/null
+++ b/openspec/specs/daemon-runtime/spec.md
@@ -0,0 +1,344 @@
+# Subsystem Specification: daemon-runtime
+
+> **Subsystem:** Persistent Daemon Execution Model (`rdkFwupdateMgr`)  
+> **Type:** Core Runtime — Execution Model Orchestrator  
+> **Scope:** Daemon-specific (binary: `rdkFwupdateMgr`, systemd unit: `rdkFwupdateMgr.service`)  
+> **Evidence Level:** Verified from `src/rdkFwupdateMgr.c`, `src/dbus/rdkv_dbus_server.c`  
+> **Cross-references:** [runtime/rdkFwupdateMgr-sequence.md](../../runtime/rdkFwupdateMgr-sequence.md), [runtime/daemon-threading-model.md](../../runtime/daemon-threading-model.md), [subsystems/subsystem-inventory.md §11](../../subsystems/subsystem-inventory.md)
+
+---
+
+## 1. Purpose
+
+The `daemon-runtime` subsystem defines the behavioral contract for the persistent, event-driven firmware update service. It owns the daemon lifecycle state machine, GLib main loop management, D-Bus service bootstrapping, and the coordination between initialization, steady-state serving, and orderly shutdown.
+
+This subsystem is the authority for how the daemon starts, becomes reachable, processes concurrent client requests, and survives individual operation failures without terminating.
+
+---
+
+## 2. What This Subsystem Owns
+
+- Daemon process lifecycle (systemd-managed: start → serve → stop)
+- Startup state machine (`STATE_INIT` → `STATE_INIT_VALIDATION` → `STATE_IDLE`)
+- GLib main loop creation and execution
+- D-Bus server bootstrapping (before shared initialization)
+- Shared initialization reuse (`initialize()`, `uninitialize()`)
+- Orderly shutdown sequence
+- Daemon-specific invariant: D-Bus service MUST be reachable during initialization
+
+## 3. What This Subsystem Does NOT Own
+
+- D-Bus method dispatch logic (owned by `dbus-ipc`)
+- Client API surface (owned by `client-sdk`)
+- Download execution mechanics (owned by `download-engine`)
+- Flash operations (cross-subsystem)
+- Concurrency control details (owned by `operational-safety`)
+- One-shot orchestration (owned by `updater-execution`)
+
+---
+
+## 4. Responsibilities
+
+| Responsibility | Behavioral Contract |
+|----------------|-------------------|
+| State machine management | MUST progress through STATE_INIT → STATE_INIT_VALIDATION → STATE_IDLE in order |
+| D-Bus reachability during init | MUST call `setup_dbus_server()` BEFORE `initialize()` — daemon is reachable during init |
+| Shared init reuse | MUST call the same `initialize()` / `initialValidation()` / `uninitialize()` as one-shot |
+| Main loop lifecycle | MUST enter `g_main_loop_run()` in STATE_IDLE and never return under normal conditions |
+| Error tolerance | MUST NOT exit on operation errors — log and continue serving |
+| Clean shutdown | MUST call `cleanup_dbus()` → `uninitialize()` → `exit()` on shutdown signal |
+| Task system initialization | MUST call `init_task_system()` before D-Bus setup for tracking structures |
+| Global state initialization | MUST populate `device_info`, `rfc_list`, IARM connection during STATE_INIT |
+
+---
+
+## 5. Runtime Lifecycle
+
+```mermaid
+stateDiagram-v2
+    [*] --> STATE_INIT : systemd ExecStart
+    
+    state STATE_INIT {
+        [*] --> LOG_INIT : log_init()
+        LOG_INIT --> SIGNAL_SETUP : sigaction(SIGUSR1)
+        SIGNAL_SETUP --> TASK_INIT : init_task_system()
+        TASK_INIT --> DBUS_SETUP : setup_dbus_server()
+        DBUS_SETUP --> MAIN_LOOP_CREATE : g_main_loop_new()
+        MAIN_LOOP_CREATE --> SHARED_INIT : initialize()
+        SHARED_INIT --> ARG_PARSE : Parse argv
+        ARG_PARSE --> [*]
+    }
+    
+    STATE_INIT --> STATE_INIT_VALIDATION : init complete
+    STATE_INIT --> EXIT_FATAL : initialize() failure
+    STATE_INIT --> EXIT_FATAL : argc < 3 or invalid trigger_type
+    
+    state STATE_INIT_VALIDATION {
+        [*] --> VALIDATION : initialValidation()
+        VALIDATION --> RESULT_SUCCESS : SUCCESS
+        VALIDATION --> RESULT_SKIP : DWNL_COMPLETED or DWNL_INPROGRESS
+        VALIDATION --> RESULT_FAIL : INITIAL_VALIDATION_FAIL
+    }
+    
+    STATE_INIT_VALIDATION --> STATE_IDLE : SUCCESS or SKIP
+    STATE_INIT_VALIDATION --> EXIT_FATAL : FAIL
+
+    state STATE_IDLE {
+        [*] --> MAIN_LOOP_RUN : g_main_loop_run()
+        MAIN_LOOP_RUN --> MAIN_LOOP_RUN : Process D-Bus events indefinitely
+    }
+    
+    STATE_IDLE --> EXIT_SHUTDOWN : g_main_loop_quit() [signal/error]
+    
+    EXIT_FATAL --> [*] : cleanup_dbus() + uninitialize() + exit()
+    EXIT_SHUTDOWN --> [*] : cleanup_dbus() + uninitialize() + exit()
+```
+
+### Key Lifecycle Distinction from One-Shot
+
+**[VERIFIED]** Unlike `rdkvfwupgrader`, the daemon:
+- Always transitions to STATE_IDLE even when `initialValidation()` returns DWNL_INPROGRESS or DWNL_COMPLETED
+- Only exits on INITIAL_VALIDATION_FAIL (build exclusion)
+- NEVER exits on operation errors during steady-state
+
+---
+
+## 6. Interaction Contracts
+
+### 6.1 Inbound Interactions
+
+| Source | Mechanism | Contract |
+|--------|-----------|----------|
+| systemd | `ExecStart` with `<retry_count> <trigger_type>` | Same argument contract as one-shot |
+| systemd | `SIGTERM` / `SIGKILL` | Orderly shutdown (SIGTERM) or forced kill (SIGKILL) |
+| D-Bus clients | Method calls on `org.rdkfwupdater.Interface` | Handled by `dbus-ipc` subsystem via main loop |
+| IARM Bus | `DwnlStopEventHandler` callback | Throttle/abort active downloads |
+
+### 6.2 Outbound Interactions
+
+| Target | Mechanism | Contract |
+|--------|-----------|----------|
+| D-Bus system bus | Signal emission | `CheckForUpdateComplete`, `DownloadProgress`, `UpdateProgress` |
+| GTask thread pool | `g_task_run_in_thread()` | Async offload of blocking operations |
+| IARM Bus | `eventManager()` | Fire-and-forget state broadcasts |
+| Thunder JSON-RPC | `getJsonRpc()` | Maintenance mode query (init only) |
+| Filesystem | Status files, PID file | Direct I/O |
+
+---
+
+## 7. Exposed Interfaces / APIs
+
+The daemon does not expose a C API. Its external contract is the D-Bus interface (specified in `dbus-ipc`).
+
+### Process Management Contract
+
+| Signal | Response |
+|--------|----------|
+| `SIGTERM` | Begin orderly shutdown: quit main loop → cleanup |
+| `SIGUSR1` | Set `force_exit=1`, abort active downloads |
+| `SIGKILL` | Immediate termination (no cleanup) |
+
+### systemd Integration
+
+```ini
+[Service]
+Type=simple
+ExecStart=/usr/bin/rdkFwupdateMgr 3 2
+Restart=on-failure
+```
+
+---
+
+## 8. Shared-Library Dependencies
+
+| Library | Usage in Daemon |
+|---------|----------------|
+| `librdksw_upgrade.so` | Download workers (via GTask) |
+| `librdksw_jsonparse.so` | XConf payload construction/parsing |
+| `librdksw_flash.so` | Flash workers (via GTask) |
+| `librdksw_rfcIntf.so` | RFC settings during init |
+| `librdksw_iarmIntf.so` | IARM events |
+| `librdksw_fwutils.so` | Device identity |
+| GLib/GIO | Main loop, GDBus, GTask, threads |
+
+---
+
+## 9. Execution-Model-Specific Behavior
+
+### 9.1 Daemon-Specific Architecture
+
+```mermaid
+flowchart TD
+    subgraph "Main Thread (GLib Main Loop)"
+        DISPATCH["D-Bus Method Dispatch"]
+        IDLE["g_idle_add() Callbacks"]
+        TASK_DONE["GTask Completion Callbacks"]
+        STATE["Serialized State Access"]
+    end
+    
+    subgraph "Worker Threads (GTask Pool)"
+        XCONF_W["XConf Worker"]
+        DL_W["Download Worker"]
+        FLASH_W["Flash Worker"]
+    end
+    
+    subgraph "Monitor Threads"
+        PROG["Progress Monitor (GThread)"]
+    end
+    
+    DISPATCH -->|"g_task_run_in_thread"| XCONF_W
+    DISPATCH -->|"g_task_run_in_thread"| DL_W
+    DISPATCH -->|"g_task_run_in_thread"| FLASH_W
+    DL_W -->|"g_thread_try_new"| PROG
+    
+    XCONF_W -->|"g_task_return"| TASK_DONE
+    DL_W -->|"g_task_return"| TASK_DONE
+    FLASH_W -->|"g_task_return"| TASK_DONE
+    PROG -->|"g_idle_add"| IDLE
+```
+
+### 9.2 Contrast with updater-execution
+
+| Aspect | daemon-runtime | updater-execution |
+|--------|---------------|-------------------|
+| Lifetime | Indefinite | Single invocation |
+| Error recovery | Continue serving | Exit process |
+| D-Bus reachability | During initialization | N/A |
+| Firmware sequencing | Client-driven (each individually) | Built-in pipeline (PCI→PDRI→Peripheral) |
+| Threading | Multi-threaded (main loop + pool) | Single-threaded |
+| State isolation | Per-request contexts | Global state for entire run |
+| Multiple clients | Concurrent support | N/A (single process) |
+
+---
+
+## 10. Threading / Event-Loop Expectations
+
+### Thread Architecture
+
+| Thread | Affinity | Purpose |
+|--------|----------|---------|
+| Main thread | GLib main loop | D-Bus dispatch, state management, signal emission |
+| XConf worker | GTask pool | Blocking XConf HTTP POST (one at a time) |
+| Download worker | GTask pool | Blocking firmware download (one at a time) |
+| Flash worker | GTask pool | Blocking flash I/O (one at a time) |
+| Progress monitor | Dedicated GThread | Polls curl progress file every 100ms |
+
+### Main Loop Guarantees
+
+- All D-Bus method dispatch runs on main thread
+- All GTask completion callbacks run on main thread (via main context)
+- All `g_idle_add()` callbacks run on main thread
+- State variables protected by main-loop serialization do NOT need mutexes
+- Only worker threads interact with network/flash (blocking I/O never on main thread)
+
+### Thread Safety Contract
+
+- Main-loop-serialized state: `registered_processes`, `active_tasks`, `waiting_*`, `IsDownloadInProgress`, `IsFlashInProgress`
+- Mutex-protected state: `XConfCommStatus` (GMutex), `DwnlState` (pthread_mutex), `app_mode` (pthread_mutex)
+- Worker-to-main communication: exclusively via `g_task_return_*()` and `g_idle_add()`
+
+---
+
+## 11. Operational Invariants
+
+| Invariant | Enforcement |
+|-----------|-------------|
+| D-Bus reachable before init completes | `setup_dbus_server()` called before `initialize()` |
+| At most one active XConf fetch | `XConfCommStatus` mutex + boolean guard |
+| At most one active download | `IsDownloadInProgress` boolean (main-loop-serialized) |
+| At most one active flash | `IsFlashInProgress` boolean (main-loop-serialized) |
+| Never exits on operation error | All handlers catch errors, report via signal, reset state |
+| Main loop runs indefinitely | Only `g_main_loop_quit()` (from signal/shutdown) breaks the loop |
+| Task cleanup on shutdown | `cleanup_dbus()` destroys all task contexts and hash tables |
+| Client registration required | All operational methods validate `handler_id` against registry |
+
+---
+
+## 12. Safety Guarantees
+
+| Guarantee | Mechanism |
+|-----------|-----------|
+| Service availability | systemd restart-on-failure + never-exit-on-error policy |
+| Data isolation | Per-request task contexts prevent state leakage between clients |
+| No blocking main loop | All I/O offloaded to GTask workers |
+| Ordered shutdown | cleanup_dbus() → uninitialize() sequence ensures proper resource release |
+| Signal broadcast atomicity | Signals emitted on main thread via g_idle_add (serialized) |
+
+---
+
+## 13. Failure Semantics
+
+| Failure Mode | Behavior | Process Impact |
+|--------------|----------|----------------|
+| `initialize()` failure | Exit with cleanup | Process terminates |
+| D-Bus connection failure | Exit with cleanup | Process terminates (systemd restarts) |
+| XConf worker failure | Signal error to clients, reset XConfCommStatus | Continues serving |
+| Download worker failure | Signal error, reset IsDownloadInProgress | Continues serving |
+| Flash worker failure | Signal error, reset IsFlashInProgress | Continues serving |
+| Client disconnect (without unregister) | Stale entry in registry until cleanup | Continues serving |
+| IARM Bus failure | Logged, non-fatal | Continues serving (degraded) |
+
+---
+
+## 14. Retry / Recovery Behavior
+
+| Scenario | Recovery |
+|----------|----------|
+| Operation failure | Client receives error signal; may re-invoke operation |
+| Daemon crash | systemd restarts; state machine re-executes from STATE_INIT |
+| D-Bus bus loss | Fatal — daemon exits, systemd restarts |
+| Worker thread crash | GTask catches; completion callback reports error |
+| Download abort (SIGUSR1) | Download reports error, daemon stays alive |
+
+---
+
+## 15. Observability Expectations
+
+| Observable | Mechanism | Consumer |
+|------------|-----------|----------|
+| Daemon alive | systemd status + D-Bus name ownership | systemd, D-Bus clients |
+| Current operation state | D-Bus signals (progress/completion) | Client applications |
+| IARM state events | `eventManager()` broadcasts | System event bus |
+| Telemetry metrics | T2 events | Cloud telemetry |
+| Download progress | Periodic `DownloadProgress` D-Bus signals | Client applications |
+| Process PID | systemd + PID file | Operators |
+
+---
+
+## 16. External Dependencies
+
+| Dependency | Nature | Failure Impact |
+|------------|--------|----------------|
+| GLib/GIO runtime | Runtime linkage | Fatal: main loop, D-Bus, threads unavailable |
+| D-Bus system bus (dbus-daemon) | IPC | Fatal: cannot register service |
+| systemd | Process supervision | Restart-on-failure capability lost |
+| IARM Bus | IPC | Degraded: no state events (non-fatal) |
+| XConf cloud server | Network | Cannot check for updates (per-request failure) |
+| CDN | Network | Cannot download firmware (per-request failure) |
+| Thunder (localhost:9998) | HTTP | Cannot query maintenance mode (init degraded) |
+
+---
+
+## 17. Assumptions and Unknowns
+
+### Verified Assumptions
+
+- [VERIFIED] D-Bus server setup occurs BEFORE `initialize()`
+- [VERIFIED] Daemon transitions to STATE_IDLE even with DWNL_INPROGRESS/COMPLETED
+- [VERIFIED] Only INITIAL_VALIDATION_FAIL causes daemon exit during startup
+- [VERIFIED] GTask thread pool is managed by GLib (default pool size)
+- [VERIFIED] Main loop serialization guarantees protect daemon-only state
+
+### Inferred Behavior
+
+- [INFERRED] systemd `Restart=on-failure` ensures daemon availability
+- [INFERRED] GLib default thread pool size is sufficient for 3 concurrent task types
+- [INFERRED] Client registry entries are not automatically cleaned on D-Bus disconnect
+
+### Unresolved Unknowns
+
+- [UNKNOWN] Exact systemd unit configuration (restart delay, watchdog)
+- [UNKNOWN] Maximum number of concurrent registered clients
+- [UNKNOWN] Behavior if GLib thread pool is exhausted
+- [UNKNOWN] Whether daemon supports graceful configuration reload (HUP signal)
+- [UNKNOWN] Memory growth characteristics during long-running operation with many client registrations/unregistrations
diff --git a/openspec/specs/dbus-ipc/spec.md b/openspec/specs/dbus-ipc/spec.md
new file mode 100755
index 00000000..4c2f7e42
--- /dev/null
+++ b/openspec/specs/dbus-ipc/spec.md
@@ -0,0 +1,487 @@
+# Subsystem Specification: dbus-ipc
+
+> **Subsystem:** D-Bus IPC Service Interface  
+> **Type:** Core Runtime — Daemon-Specific  
+> **Scope:** Daemon-only (`rdkFwupdateMgr`)  
+> **Evidence Level:** Verified from `src/dbus/rdkv_dbus_server.c`, `src/dbus/rdkFwupdateMgr_handlers.c`, `src/dbus/xconf_comm_status.c`  
+> **Cross-references:** [dbus/dbus-architecture.md](../../dbus/dbus-architecture.md), [runtime/client-daemon-interaction.md](../../runtime/client-daemon-interaction.md), [subsystems/subsystem-inventory.md §3](../../subsystems/subsystem-inventory.md)
+
+---
+
+## 1. Purpose
+
+The `dbus-ipc` subsystem defines the complete D-Bus service contract exposed by the `rdkFwupdateMgr` daemon. It owns method dispatch, async task management, client process tracking, signal broadcasting, concurrency guards, and the piggyback queue mechanism for coalescing concurrent requests.
+
+This is the authoritative specification for all interactions between client applications (via `client-sdk` or direct D-Bus) and the firmware update daemon.
+
+---
+
+## 2. What This Subsystem Owns
+
+- D-Bus service identity (`org.rdkfwupdater.Interface` at `/org/rdkfwupdater/Service`)
+- D-Bus object registration and introspection XML
+- Method dispatch routing (`process_app_request()`)
+- Client process registry (registration/unregistration lifecycle)
+- Async task lifecycle (creation, tracking, completion, cleanup)
+- Piggyback queues (coalescing concurrent identical requests)
+- Signal broadcasting (multicast completion/progress to all subscribers)
+- Concurrency guards (`IsDownloadInProgress`, `IsFlashInProgress`, `XConfCommStatus`)
+- Worker thread spawning (GTask creation and thread-pool offloading)
+- D-Bus input validation
+
+## 3. What This Subsystem Does NOT Own
+
+- Process lifecycle (owned by `daemon-runtime`)
+- GLib main loop management (owned by `daemon-runtime`)
+- HTTP download mechanics (owned by `download-engine`)
+- XConf response parsing (owned by `firmware-validation`)
+- Flash I/O (owned by `firmware-validation`)
+- Client-side library implementation (owned by `client-sdk`)
+- IARM event broadcasting (separate subsystem)
+
+---
+
+## 4. D-Bus Service Contract
+
+### 4.1 Bus Identity
+
+| Property | Value |
+|----------|-------|
+| Well-known name | `org.rdkfwupdater.Interface` |
+| Object path | `/org/rdkfwupdater/Service` |
+| Interface | `org.rdkfwupdater.Interface` |
+| Bus type | System bus |
+
+### 4.2 Methods
+
+#### RegisterProcess
+
+```
+RegisterProcess(s: app_name, s: app_version) → (t: handler_id)
+```
+
+| Parameter | Type | Direction | Description |
+|-----------|------|-----------|-------------|
+| `app_name` | string | in | Client application identifier |
+| `app_version` | string | in | Client application version |
+| `handler_id` | uint64 | out | Unique registration handle |
+
+**Behavioral Contract:**
+- MUST validate non-empty `app_name` and `app_version`
+- MUST generate unique `handler_id` (monotonically increasing)
+- MUST store registration in process tracking table
+- MUST be idempotent for same app_name (returns new handler_id each time)
+
+#### UnregisterProcess
+
+```
+UnregisterProcess(t: handler_id) → ()
+```
+
+| Parameter | Type | Direction | Description |
+|-----------|------|-----------|-------------|
+| `handler_id` | uint64 | in | Previously registered handle |
+
+**Behavioral Contract:**
+- MUST validate `handler_id` exists in registry
+- MUST remove all task associations for this handler
+- MUST NOT affect other registered processes
+- SHOULD be called before client disconnects (but not enforced)
+
+#### CheckForUpdate
+
+```
+CheckForUpdate(s: handler_id_str) → (i: status, s: fw_name, s: fw_version, s: fw_url, s: message, i: result_code)
+```
+
+| Parameter | Type | Direction | Description |
+|-----------|------|-----------|-------------|
+| `handler_id_str` | string | in | Handler ID as string |
+| `status` | int32 | out | Always 0 (placeholder) |
+| `fw_name` | string | out | Always "" (placeholder) |
+| `fw_version` | string | out | Always "" (placeholder) |
+| `fw_url` | string | out | Always "" (placeholder) |
+| `message` | string | out | "check in progress" |
+| `result_code` | int32 | out | Always 3 (FIRMWARE_CHECK_ERROR — in-progress indicator) |
+
+**Behavioral Contract:**
+- Returns IMMEDIATELY with placeholder values (non-blocking)
+- Actual result delivered asynchronously via `CheckForUpdateComplete` signal
+- MUST validate handler registration before spawning worker
+- If XConf fetch already in progress: piggyback (no new worker spawned)
+- If no fetch running: set XConfCommStatus=TRUE, spawn GTask worker
+
+#### DownloadFirmware
+
+```
+DownloadFirmware(s: handler_id_str, s: fw_name, s: fw_url, i: fw_type) → (i: status, s: message)
+```
+
+| Parameter | Type | Direction | Description |
+|-----------|------|-----------|-------------|
+| `handler_id_str` | string | in | Handler ID as string |
+| `fw_name` | string | in | Firmware filename to download |
+| `fw_url` | string | in | Download URL |
+| `fw_type` | int32 | in | Upgrade type (PCI/PDRI/PERIPHERAL) |
+| `status` | int32 | out | 0=accepted, non-zero=rejected |
+| `message` | string | out | Status description |
+
+**Behavioral Contract:**
+- Returns IMMEDIATELY (non-blocking)
+- Progress delivered via `DownloadProgress` signals
+- MUST reject if `IsDownloadInProgress == TRUE`
+- MUST validate handler registration
+- If accepted: set `IsDownloadInProgress=TRUE`, spawn GTask download worker
+- Worker spawns progress monitor GThread
+
+#### UpdateFirmware
+
+```
+UpdateFirmware(s: handler_id_str, s: fw_name) → (i: status, s: message)
+```
+
+| Parameter | Type | Direction | Description |
+|-----------|------|-----------|-------------|
+| `handler_id_str` | string | in | Handler ID as string |
+| `fw_name` | string | in | Firmware filename to flash |
+| `status` | int32 | out | 0=accepted, non-zero=rejected |
+| `message` | string | out | Status description |
+
+**Behavioral Contract:**
+- Returns IMMEDIATELY (non-blocking)
+- Progress delivered via `UpdateProgress` signals
+- MUST reject if `IsFlashInProgress == TRUE`
+- MUST reject if firmware file does not exist
+- If accepted: set `IsFlashInProgress=TRUE`, spawn GTask flash worker
+
+### 4.3 Signals
+
+#### CheckForUpdateComplete
+
+```
+signal CheckForUpdateComplete(i: status, s: fw_name, s: fw_version, s: fw_url, s: message, i: result_code)
+```
+
+**Emission Contract:**
+- Emitted on main thread after XConf worker completes
+- Broadcast to ALL signal subscribers (not targeted)
+- Contains full XConf query result
+- `result_code`: 0=update available, 1=up-to-date, 2=error
+
+#### DownloadProgress
+
+```
+signal DownloadProgress(i: percent, s: status_message)
+```
+
+**Emission Contract:**
+- Emitted periodically during download (via progress monitor → `g_idle_add`)
+- Broadcast to ALL subscribers
+- `percent`: 0-100 progress value
+- Final signal indicates completion or error
+
+#### UpdateProgress
+
+```
+signal UpdateProgress(i: status, s: message)
+```
+
+**Emission Contract:**
+- Emitted when flash operation completes or fails
+- Broadcast to ALL subscribers
+- `status`: 0=success, non-zero=failure
+
+---
+
+## 5. Runtime Lifecycle
+
+```mermaid
+sequenceDiagram
+    participant CLIENT as D-Bus Client
+    participant DISPATCH as process_app_request()<br/>[Main Thread]
+    participant TRACK as Task Tracking
+    participant GUARD as Concurrency Guards
+    participant WORKER as GTask Worker
+    participant SIGNAL as Signal Emission<br/>[Main Thread]
+
+    CLIENT->>DISPATCH: Method call (any)
+    activate DISPATCH
+    
+    DISPATCH->>DISPATCH: Extract method name + parameters
+    DISPATCH->>DISPATCH: Validate handler_id registration
+    
+    alt RegisterProcess / UnregisterProcess
+        DISPATCH->>TRACK: Update registry
+        DISPATCH->>CLIENT: Return result (synchronous)
+    else CheckForUpdate / DownloadFirmware / UpdateFirmware
+        DISPATCH->>GUARD: Check concurrency guard
+        alt Guard blocks (operation in progress)
+            alt CheckForUpdate (supports piggyback)
+                DISPATCH->>TRACK: Add to waiting queue
+                DISPATCH->>CLIENT: Return placeholder (immediate)
+            else Download/Flash (no piggyback)
+                DISPATCH->>CLIENT: Return rejection
+            end
+        else Guard allows
+            DISPATCH->>GUARD: Set guard = TRUE
+            DISPATCH->>TRACK: Create TaskContext
+            DISPATCH->>WORKER: g_task_run_in_thread()
+            DISPATCH->>CLIENT: Return placeholder (immediate)
+        end
+    end
+    deactivate DISPATCH
+    
+    Note over WORKER: Blocking operation...
+    WORKER->>WORKER: Execute operation
+    WORKER->>SIGNAL: g_task_return / g_idle_add
+    
+    activate SIGNAL
+    SIGNAL->>SIGNAL: Emit D-Bus signal (broadcast)
+    SIGNAL->>GUARD: Reset guard = FALSE
+    SIGNAL->>TRACK: Remove completed tasks
+    deactivate SIGNAL
+```
+
+---
+
+## 6. Task Lifecycle
+
+```mermaid
+stateDiagram-v2
+    [*] --> CREATED : process_app_request() validates
+    CREATED --> QUEUED : Added to waiting queue (piggyback)
+    CREATED --> ACTIVE : Worker spawned (guard was free)
+    QUEUED --> COMPLETED : Piggyback result received
+    ACTIVE --> COMPLETED : Worker returns result
+    ACTIVE --> FAILED : Worker returns error
+    COMPLETED --> [*] : TaskContext freed
+    FAILED --> [*] : TaskContext freed, error signal emitted
+```
+
+### Task Context Structure
+
+```c
+typedef struct {
+    guint task_id;              // Monotonic task identifier
+    TaskType type;             // CHECK_UPDATE | DOWNLOAD | FLASH
+    char *handler_id;          // Requesting client's handler
+    char *sender;              // D-Bus sender address
+    GCancellable *cancellable; // Cancellation token (future use)
+    // ... type-specific fields
+} TaskContext;
+```
+
+---
+
+## 7. Concurrency Control (Cross-Cutting)
+
+### Guard State Machine
+
+```mermaid
+stateDiagram-v2
+    state "XConf Guard" as XG {
+        XG_FREE: XConfCommStatus = FALSE
+        XG_BUSY: XConfCommStatus = TRUE
+        
+        [*] --> XG_FREE
+        XG_FREE --> XG_BUSY : Worker spawned
+        XG_BUSY --> XG_FREE : Worker completed (xconf_fetch_done)
+    }
+    
+    state "Download Guard" as DG {
+        DG_FREE: IsDownloadInProgress = FALSE
+        DG_BUSY: IsDownloadInProgress = TRUE
+        
+        [*] --> DG_FREE
+        DG_FREE --> DG_BUSY : Download accepted
+        DG_BUSY --> DG_FREE : Download completed/failed (download_done)
+    }
+    
+    state "Flash Guard" as FG {
+        FG_FREE: IsFlashInProgress = FALSE
+        FG_BUSY: IsFlashInProgress = TRUE
+        
+        [*] --> FG_FREE
+        FG_FREE --> FG_BUSY : Flash accepted
+        FG_BUSY --> FG_FREE : Flash completed/failed (flash_done)
+    }
+```
+
+### Guard Protection Mechanisms
+
+| Guard | Protection Level | Mechanism |
+|-------|-----------------|-----------|
+| `XConfCommStatus` | Thread-safe (cross-thread) | `GMutex` in `xconf_comm_status.c` |
+| `IsDownloadInProgress` | Main-loop-serialized | Boolean checked only on main thread |
+| `IsFlashInProgress` | Main-loop-serialized | Boolean checked only on main thread |
+| `g_cached_xconf_data` | Thread-safe | `G_LOCK` macro |
+
+### Piggyback Queue Semantics
+
+```mermaid
+sequenceDiagram
+    participant C1 as Client A
+    participant C2 as Client B
+    participant ML as Main Thread
+    participant W as XConf Worker
+
+    C1->>ML: CheckForUpdate("A")
+    ML->>ML: XConfCommStatus = FALSE → spawn worker
+    ML->>W: g_task_run_in_thread()
+    ML->>ML: Add task_A to waiting_checkUpdate_ids
+    
+    C2->>ML: CheckForUpdate("B")
+    ML->>ML: XConfCommStatus = TRUE → PIGGYBACK
+    ML->>ML: Add task_B to waiting_checkUpdate_ids
+    Note right of ML: No new worker spawned!
+    
+    W-->>ML: g_task_return(result)
+    ML->>ML: rdkfw_xconf_fetch_done()
+    ML->>ML: Emit signal (broadcast — both A and B receive)
+    ML->>ML: Free task_A, task_B from waiting list
+    ML->>ML: XConfCommStatus = FALSE
+```
+
+---
+
+## 8. Execution-Model-Specific Behavior
+
+### 8.1 Daemon-Only (This Subsystem Exists Only in Daemon)
+
+The D-Bus IPC subsystem has no counterpart in `rdkvfwupgrader`. The one-shot binary performs the same operations directly without any IPC layer.
+
+### 8.2 How One-Shot Achieves Equivalent Behavior
+
+| D-Bus Method | One-Shot Equivalent |
+|--------------|-------------------|
+| RegisterProcess | N/A (no client registration) |
+| CheckForUpdate | Direct `MakeXconfComms()` call in main() |
+| DownloadFirmware | Direct `rdkv_upgrade_request()` call in main() |
+| UpdateFirmware | Direct `flashImage()` call in main() |
+| Signal emission | N/A (caller is same process) |
+
+---
+
+## 9. Threading / Event-Loop Expectations
+
+### Thread Affinity Rules
+
+| Operation | Thread | Rationale |
+|-----------|--------|-----------|
+| `process_app_request()` dispatch | Main thread | D-Bus callbacks run on main loop |
+| Input validation | Main thread | Part of dispatch |
+| Guard checks/sets (Download, Flash) | Main thread | Main-loop serialization |
+| Guard checks/sets (XConf) | Any thread | GMutex protected |
+| Worker execution | GTask pool thread | Blocking I/O off main loop |
+| GTask completion callback | Main thread | Scheduled via main context |
+| Signal emission | Main thread | Via `g_idle_add` or task completion |
+| Task context creation/destruction | Main thread | Part of dispatch/completion |
+
+### Main-Loop Serialization Guarantee
+
+All operations that touch `registered_processes`, `active_tasks`, `waiting_*` lists, `IsDownloadInProgress`, `IsFlashInProgress`, or `current_download/flash` state are guaranteed to execute on the main thread. This eliminates the need for mutexes on these structures.
+
+---
+
+## 10. Operational Invariants
+
+| Invariant | Enforcement |
+|-----------|-------------|
+| All methods validate handler registration | `process_app_request()` checks registry before processing |
+| At most one XConf fetch concurrently | `XConfCommStatus` GMutex-protected boolean |
+| At most one download concurrently | `IsDownloadInProgress` main-loop-serialized |
+| At most one flash concurrently | `IsFlashInProgress` main-loop-serialized |
+| Signals broadcast to all subscribers | `g_dbus_connection_emit_signal()` without target |
+| Piggyback only for CheckForUpdate | Download and Flash do not support piggyback (rejected) |
+| Immediate method return | All operational methods return without waiting for result |
+| Worker errors do not crash daemon | All completion callbacks handle error case |
+
+---
+
+## 11. Safety Guarantees
+
+| Guarantee | Mechanism |
+|-----------|-----------|
+| No concurrent firmware operations | Concurrency guards prevent overlap |
+| Input validation before execution | All parameters validated before worker spawn |
+| Client isolation | Each client has separate handler_id; no state leakage |
+| Signal integrity | Signals emitted on main thread (serialized with state updates) |
+| Resource cleanup | Task contexts freed on completion; hash tables destroyed on shutdown |
+| No D-Bus method blocks indefinitely | All methods return immediately; results via signals |
+
+---
+
+## 12. Failure Semantics
+
+| Failure Mode | D-Bus Response | Signal | Daemon Impact |
+|--------------|---------------|--------|---------------|
+| Invalid handler_id | Error response | None | None |
+| Unregistered client | Error response | None | None |
+| Download already in progress | Rejection (status ≠ 0) | None | None |
+| Flash already in progress | Rejection (status ≠ 0) | None | None |
+| XConf worker network error | N/A (immediate placeholder) | CheckForUpdateComplete with error | Guards reset |
+| Download worker failure | N/A (immediate acceptance) | DownloadProgress with error | Guards reset |
+| Flash worker failure | N/A (immediate acceptance) | UpdateProgress with error | Guards reset |
+| D-Bus connection lost | Fatal | N/A | Daemon exits |
+
+---
+
+## 13. Retry / Recovery Behavior
+
+| Scenario | D-Bus Layer Behavior |
+|----------|---------------------|
+| Operation fails | Signal broadcasts error; client may re-invoke method |
+| Client crashes without unregister | Stale registry entry; no cleanup triggered |
+| Worker thread crash | GTask reports error via completion; guard reset |
+| Multiple rapid CheckForUpdate | Piggyback — all receive same result |
+| Rapid Download after failure | Allowed once guard resets (IsDownloadInProgress = FALSE) |
+
+---
+
+## 14. Observability Expectations
+
+| Observable | Mechanism | Consumer |
+|------------|-----------|----------|
+| Service alive | D-Bus name ownership | `client-sdk`, D-Bus tools |
+| Operation in progress | Signal emission | Subscribed clients |
+| Registered clients | Internal hash table (debug logging) | Daemon logs |
+| Task lifecycle | Internal tracking (debug logging) | Daemon logs |
+| Method call rate | D-Bus monitoring | Debugging |
+
+---
+
+## 15. External Dependencies
+
+| Dependency | Nature | Failure Impact |
+|------------|--------|----------------|
+| D-Bus system bus | IPC transport | Fatal: service unreachable |
+| GLib/GIO | Runtime | Fatal: dispatch/tasks unavailable |
+| `download-engine` | Worker dependency | Per-request failure (non-fatal to daemon) |
+| `firmware-validation` | Worker dependency | Per-request failure (non-fatal to daemon) |
+
+---
+
+## 16. Assumptions and Unknowns
+
+### Verified Assumptions
+
+- [VERIFIED] All D-Bus methods return immediately (non-blocking to caller)
+- [VERIFIED] Signals are broadcast (not targeted to specific clients)
+- [VERIFIED] Piggyback only applies to CheckForUpdate
+- [VERIFIED] `XConfCommStatus` uses GMutex (cross-thread safe)
+- [VERIFIED] Download/Flash guards are main-loop-serialized (no mutex needed)
+- [VERIFIED] `process_app_request()` is the single entry point for all D-Bus methods
+
+### Inferred Behavior
+
+- [INFERRED] D-Bus introspection XML defines the exact method signatures
+- [INFERRED] Handler IDs are uint64 monotonically increasing (never recycled)
+- [INFERRED] Stale client registrations accumulate until daemon restart
+
+### Unresolved Unknowns
+
+- [UNKNOWN] Exact D-Bus introspection XML content (method signatures in XML format)
+- [UNKNOWN] Whether D-Bus method timeouts are configured on the service side
+- [UNKNOWN] Maximum number of piggybacked CheckForUpdate requests
+- [UNKNOWN] Whether NameOwnerChanged signal is monitored for automatic client cleanup
+- [UNKNOWN] D-Bus access control policy (which processes may call methods)
diff --git a/openspec/specs/direct-cdn-download/spec.md b/openspec/specs/direct-cdn-download/spec.md
new file mode 100755
index 00000000..919b8c56
--- /dev/null
+++ b/openspec/specs/direct-cdn-download/spec.md
@@ -0,0 +1,75 @@
+# Subsystem Specification: direct-cdn-download
+
+> **Subsystem:** Direct CDN Download Feature  
+> **Type:** Feature Module  
+> **Scope:** One-shot and daemon execution models  
+> **Evidence Level:** Verified from `src/rfcInterface/rfcinterface.c`, `src/deviceutils/device_api.c`, `src/device_status_helper.c`, `src/json_process.c`, `src/rdkv_main.c`
+
+---
+
+## 1. Purpose
+
+The `direct-cdn-download` subsystem defines the RFC-gated Direct CDN firmware download feature, which bypasses Codebig intermediaries and downloads firmware artifacts directly from per-artifact URLs provided by XConf.
+
+---
+
+## 2. Requirements
+
+### Requirement: RFC Feature Gate
+The system SHALL read the RFC parameter `Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Feature.SWDLDirect.Enable` at startup and expose a runtime query function `isDirectCDNEnabled()` that returns true only when the RFC value is `"true"`.
+
+#### Scenario: RFC enabled
+- **WHEN** the RFC parameter `SWDLDirect.Enable` is set to `"true"`
+- **THEN** `isDirectCDNEnabled()` SHALL return true
+
+#### Scenario: RFC disabled
+- **WHEN** the RFC parameter `SWDLDirect.Enable` is set to `"false"` or is absent
+- **THEN** `isDirectCDNEnabled()` SHALL return false
+
+#### Scenario: RFC value stored in Rfc_t
+- **WHEN** `getRFCSettings()` is called during initialization
+- **THEN** the Direct CDN RFC value SHALL be stored in `Rfc_t.rfc_directcdn`
+
+### Requirement: XConf URL Path Branching
+The system SHALL use a different XConf query URL path when Direct CDN is enabled. The path `/xconf/firmware/stb/` SHALL be used instead of `/xconf/swu/stb`.
+
+#### Scenario: Direct CDN enabled changes XConf URL
+- **WHEN** `GetServURL()` is called and `isDirectCDNEnabled()` returns true
+- **THEN** the returned URL SHALL contain the path `/xconf/firmware/stb/`
+
+#### Scenario: Direct CDN disabled uses legacy URL
+- **WHEN** `GetServURL()` is called and `isDirectCDNEnabled()` returns false
+- **THEN** the returned URL SHALL contain the path `/xconf/swu/stb`
+
+### Requirement: Codebig Bypass
+The system SHALL skip Codebig access probing when Direct CDN is enabled.
+
+#### Scenario: Direct CDN bypasses Codebig
+- **WHEN** `checkCodebigAccess()` is called and `isDirectCDNEnabled()` returns true
+- **THEN** the function SHALL return false without performing any network probe
+
+#### Scenario: Codebig probe unaffected when disabled
+- **WHEN** `checkCodebigAccess()` is called and `isDirectCDNEnabled()` returns false
+- **THEN** the function SHALL perform the normal Codebig accessibility check
+
+### Requirement: Per-Artifact URL Parsing
+The system SHALL parse per-artifact download URLs from the enriched XConf JSON response when Direct CDN is enabled: `firmware_URL` (PCI), `additionalFwVerInfo_URL` (PDRI), and `<peripheralProduct>_URL` (Peripheral).
+
+#### Scenario: PCI firmware URL parsed
+- **WHEN** XConf response contains `firmware_URL` field and Direct CDN is enabled
+- **THEN** the value SHALL be stored in `XCONFRES.firmwareUrl`
+
+#### Scenario: PDRI URL parsed
+- **WHEN** XConf response contains `additionalFwVerInfo_URL` field and Direct CDN is enabled
+- **THEN** the value SHALL be stored in `XCONFRES.pdriUrl`
+
+#### Scenario: Peripheral URL parsed with dynamic key
+- **WHEN** XConf response contains `<peripheralProduct>_URL` field and Direct CDN is enabled
+- **THEN** the value SHALL be stored in `XCONFRES.remCtrlUrl` where `<peripheralProduct>` is resolved by `getPeripheralProduct()`
+
+#### Scenario: Legacy parsing when disabled
+- **WHEN** Direct CDN is disabled
+- **THEN** `getXconfRespData()` SHALL use the legacy `GetJsonValContaining("remCtrl", ...)` approach for peripherals and SHALL NOT attempt to parse per-artifact URL fields
+
+### Requirement: Peripheral Product Discovery
+The system SHALL provide `getPeripheralProduct()` which returns the peripheral product identifier cached during `BuildRemoteInfo()`.
diff --git a/openspec/specs/download-engine/spec.md b/openspec/specs/download-engine/spec.md
new file mode 100755
index 00000000..02add6c9
--- /dev/null
+++ b/openspec/specs/download-engine/spec.md
@@ -0,0 +1,444 @@
+# Subsystem Specification: download-engine
+
+> **Subsystem:** Firmware Download Engine (`librdksw_upgrade`)  
+> **Type:** Core Runtime — Shared Infrastructure  
+> **Scope:** Shared across both execution models  
+> **Evidence Level:** Verified from `src/rdkv_upgrade.c`, `src/chunk.c`, `src/cedmInterface/`, `src/include/rdkv_upgrade.h`  
+> **Cross-references:** [subsystems/subsystem-inventory.md §1](../../subsystems/subsystem-inventory.md), [diagrams/subsystem-architecture.md](../../diagrams/subsystem-architecture.md)
+
+---
+
+## 1. Purpose
+
+The `download-engine` subsystem owns the blocking HTTP/HTTPS download lifecycle for all firmware artifact types. It encapsulates URL construction, curl-based download with throttling and resume, mTLS certificate authentication, Codebig endpoint fallback, chunk-based transfer, and progress reporting.
+
+This is the foundational shared infrastructure that both execution models depend on for all network-based firmware retrieval operations, including XConf queries and firmware binary downloads.
+
+---
+
+## 2. What This Subsystem Owns
+
+- HTTP/HTTPS session lifecycle (curl handle creation, configuration, execution, cleanup)
+- Chunked/resumable download mechanism
+- Download throttling (speed limiting, pause/unpause)
+- mTLS certificate selection and configuration
+- Codebig endpoint signing and fallback
+- TLS error classification
+- Download progress tracking and reporting
+- PID file management during active downloads
+- Error code generation and propagation
+
+## 3. What This Subsystem Does NOT Own
+
+- Decision of whether to download (owned by orchestrators)
+- XConf response interpretation (owned by `firmware-validation`)
+- Flash operations (owned by flash subsystem)
+- D-Bus signal emission for progress (daemon-only, owned by `dbus-ipc`)
+- Retry policy (caller decides)
+- Download throttle decisions (IARM callback from external source)
+- URL generation for XConf (owned by device identity subsystem)
+
+---
+
+## 4. Responsibilities
+
+| Responsibility | Behavioral Contract |
+|----------------|-------------------|
+| Execute download | `rdkv_upgrade_request()` MUST perform a complete blocking HTTP transfer |
+| Support multiple upgrade types | MUST handle XCONF_UPGRADE, PCI_UPGRADE, PDRI_UPGRADE, PERIPHERAL_UPGRADE |
+| Chunk resume | MUST support resumable downloads using HTTP Range headers when partial file exists |
+| Throttle response | MUST honor speed limit changes delivered via `doInteruptDwnl()` callback |
+| mTLS authentication | MUST attempt mTLS when RFC setting enables it; fall back on failure |
+| Codebig fallback | MUST attempt Codebig-signed URL when direct download fails (if enabled) |
+| Progress reporting | MUST update curl progress file at regular intervals during download |
+| Error propagation | MUST return curl error codes and HTTP status codes to caller |
+| TLS error classification | MUST categorize TLS failures for telemetry reporting |
+| Abort support | MUST respond to `force_exit` flag by aborting active transfer |
+
+---
+
+## 5. Exposed Interfaces / APIs
+
+### Primary API
+
+```c
+/**
+ * @brief Execute a firmware download/upload request
+ * @param ctx       Populated upgrade context (URL, paths, type, options)
+ * @param curl      Pointer to curl handle (may be reused across calls)
+ * @param http_code Output: HTTP response code
+ * @return 0 on success, curl error code on failure, RDKV_UPGRADE_ERROR_* on internal error
+ */
+int rdkv_upgrade_request(RdkUpgradeContext_t *ctx, void **curl, int *http_code);
+```
+
+### Context Structure
+
+```c
+typedef struct {
+    char *url;              // Target URL (XConf or CDN)
+    char *filepath;         // Local path for downloaded file
+    int upgrade_type;       // XCONF_UPGRADE | PCI_UPGRADE | PDRI_UPGRADE | PERIPHERAL_UPGRADE
+    int download_only;      // 1=download only, 0=download+flash (one-shot legacy)
+    int retry_count;        // XConf query retry attempts
+    char *server_url;       // XConf server URL
+    char *json_payload;     // XConf POST body (for XCONF_UPGRADE)
+    int proto;              // Protocol selection
+    int maint_mode;         // Maintenance mode active
+    int trigger_type;       // Trigger classification
+    // ... additional fields for certificate paths, throttle settings
+} RdkUpgradeContext_t;
+```
+
+### Error Codes
+
+| Code | Constant | Meaning |
+|------|----------|---------|
+| 0 | Success | Transfer completed successfully |
+| 1-99 | CURLE_* | Standard curl error codes |
+| 100 | `RDKV_UPGRADE_ERROR_THROTTLE_ZERO` | Speed throttled to zero (abort) |
+| 101 | `RDKV_UPGRADE_ERROR_INTERNAL` | Internal processing error |
+
+### Supporting Functions
+
+| Function | Purpose |
+|----------|---------|
+| `rdkv_upgrade_strerror(int error)` | Convert error code to human-readable string |
+| `chunkDownload(...)` | Chunked download with resume support |
+| `doInteruptDwnl(int speed)` | Set download speed limit (0=abort) |
+| `savePID()` / `getPidStore()` | PID file management during download |
+
+---
+
+## 6. Runtime Lifecycle
+
+```mermaid
+stateDiagram-v2
+    [*] --> IDLE : Library loaded
+    
+    IDLE --> SETUP : rdkv_upgrade_request() called
+    
+    state SETUP {
+        [*] --> URL_RESOLVE : Determine target URL
+        URL_RESOLVE --> CURL_INIT : curl_easy_init() or reuse handle
+        CURL_INIT --> TLS_CONFIG : Configure mTLS if enabled
+        TLS_CONFIG --> HEADERS : Set HTTP headers
+        HEADERS --> [*]
+    }
+    
+    SETUP --> TRANSFER : curl configured
+    
+    state TRANSFER {
+        [*] --> ACTIVE : curl_easy_perform()
+        ACTIVE --> PROGRESS_CB : Progress callback fires
+        PROGRESS_CB --> CHECK_ABORT : Check force_exit
+        CHECK_ABORT --> ACTIVE : Continue
+        CHECK_ABORT --> ABORTED : force_exit == 1
+        ACTIVE --> COMPLETE : Transfer done
+        ACTIVE --> NETWORK_ERROR : Network failure
+    }
+    
+    TRANSFER --> VERIFY : Transfer complete
+    TRANSFER --> CODEBIG_FALLBACK : Direct failed + Codebig enabled
+    TRANSFER --> ERROR : Unrecoverable failure or abort
+    
+    state CODEBIG_FALLBACK {
+        [*] --> SIGN_URL : getCodebigUrl()
+        SIGN_URL --> RETRY_TRANSFER : New URL obtained
+        RETRY_TRANSFER --> VERIFY : Success
+        RETRY_TRANSFER --> ERROR : Fallback also failed
+    }
+    
+    VERIFY --> IDLE : Return success (0)
+    ERROR --> IDLE : Return error code
+```
+
+---
+
+## 7. Interaction Contracts
+
+### 7.1 Callers (Who Invokes This Subsystem)
+
+| Caller | Context | Threading |
+|--------|---------|-----------|
+| `rdkvfwupgrader` (one-shot) | Direct call from `main()` | Main thread (blocks entire process) |
+| `rdkFwupdateMgr` (daemon) | Called from GTask worker thread | Worker thread (main loop free) |
+
+### 7.2 Dependencies (What This Subsystem Calls)
+
+| Target | Function | Purpose |
+|--------|----------|---------|
+| libcurl | `curl_easy_*()` | HTTP/HTTPS transfer engine |
+| librdksw_fwutils | `getDeviceProperties()` | Device MAC for URL construction |
+| librdksw_rfcIntf | RFC settings | mTLS flag, throttle speed, Codebig flag |
+| CEDM (codebigUtils) | `getCodebigUrl()` | Codebig-signed URL generation |
+| CEDM (mtlsUtils) | `getMtlsCertPath()` | mTLS certificate path resolution |
+| libdwnlutil | Download utility functions | Platform download helpers |
+| Filesystem | Progress file write | `/opt/curl_progress` for monitoring |
+
+---
+
+## 8. Shared-Library Dependencies
+
+| Library | Linked At |
+|---------|-----------|
+| `libcurl` | Runtime (shared) |
+| `libdwnlutil` | Runtime (shared) |
+| `libsecure_wrapper` | Runtime (shared) |
+| `libfwutils` | Runtime (shared, external) |
+| `librdksw_fwutils` | Build-time (internal) |
+| `librdksw_rfcIntf` | Build-time (internal) |
+
+---
+
+## 9. Execution-Model-Specific Behavior
+
+### 9.1 Behavior Shared by Both Binaries
+
+| Behavior | Contract |
+|----------|----------|
+| Blocking execution | `rdkv_upgrade_request()` blocks the calling thread until transfer completes |
+| Curl error propagation | Same error codes returned regardless of caller |
+| Chunk resume | Same resume-from-offset logic |
+| mTLS fallback | Same fallback chain (mTLS → direct → Codebig) |
+| Progress file writes | Same `/opt/curl_progress` file updated |
+| `force_exit` check | Same abort mechanism via progress callback |
+| Throttle speed enforcement | Same `CURLOPT_MAX_RECV_SPEED_LARGE` application |
+
+### 9.2 One-Shot-Specific Behavior
+
+| Behavior | Detail |
+|----------|--------|
+| Called from main thread | Blocks entire process; no other operations possible |
+| `download_only == 0` | After download, may chain into `flashImage()` |
+| Throttle-to-zero is fatal | Caller sets `force_exit=1` and exits process |
+| Curl handle lifecycle | Created once, reused for XConf + download(s), destroyed at exit |
+| Global curl pointer | `void *curl` global — single handle for process lifetime |
+
+### 9.3 Daemon-Specific Behavior
+
+| Behavior | Detail |
+|----------|--------|
+| Called from GTask worker | Blocks only worker thread; main loop remains responsive |
+| `download_only == 1` | Download completes without chaining to flash |
+| Throttle-to-zero is non-fatal | Worker reports error via GTask; daemon stays alive |
+| Curl handle lifecycle | Created per-request in worker context, destroyed after completion |
+| Progress monitoring | Daemon spawns dedicated GThread to poll progress file |
+| Stop mechanism | `stop_flag` per-download context allows targeted abort |
+| Multiple concurrent types | Possible to have different firmware types in different states |
+
+```mermaid
+flowchart LR
+    subgraph "One-Shot Context"
+        OS_MAIN["main()"] -->|"blocks"| OS_DL["rdkv_upgrade_request()"]
+        OS_DL -->|"curl_easy_perform"| OS_NET["Network I/O"]
+        OS_DL -->|"if download_only==0"| OS_FLASH["flashImage()"]
+    end
+    
+    subgraph "Daemon Context"
+        D_ML["Main Loop"] -->|"g_task_run_in_thread"| D_WORKER["Worker Thread"]
+        D_WORKER -->|"blocks worker only"| D_DL["rdkv_upgrade_request()"]
+        D_DL -->|"curl_easy_perform"| D_NET["Network I/O"]
+        D_WORKER -->|"g_thread_new"| D_MON["Progress Monitor"]
+        D_MON -->|"g_idle_add"| D_ML
+        D_WORKER -->|"g_task_return"| D_ML
+    end
+```
+
+---
+
+## 10. Threading / Event-Loop Expectations
+
+### Thread Safety Contract
+
+| Aspect | Guarantee |
+|--------|-----------|
+| `rdkv_upgrade_request()` | Thread-safe to call from any single thread; NOT safe for concurrent calls sharing the same curl handle |
+| `doInteruptDwnl()` | MAY be called from IARM callback thread while download is in progress |
+| `force_exit` flag | Written by signal/callback thread, read by curl progress callback — must be atomic or volatile |
+| `DwnlState` | Protected by `pthread_mutex_t mutuex_dwnl_state` — thread-safe across caller/callback threads |
+| Progress file writes | Not mutex-protected; relies on single-writer assumption |
+
+### Reentrance
+
+- `rdkv_upgrade_request()` is NOT reentrant — must not be called concurrently with the same context
+- The daemon ensures single-download-at-a-time via `IsDownloadInProgress` (main-loop-serialized)
+- The one-shot ensures single-download by being single-threaded
+
+---
+
+## 11. Operational Invariants
+
+| Invariant | Enforcement |
+|-----------|-------------|
+| At most one active curl transfer per curl handle | Caller responsibility (one-shot: single thread; daemon: single worker) |
+| mTLS attempted before direct when RFC enabled | Code path ordering in `rdkv_upgrade_request()` |
+| Codebig only on direct failure | Fallback chain coded sequentially |
+| Progress file reflects active download | Written during curl progress callback |
+| Downloaded file validated by size | Content-Length check against received bytes |
+| Partial files indicate interrupted download | Used for chunk resume on next invocation |
+
+---
+
+## 12. Safety Guarantees
+
+| Guarantee | Mechanism |
+|-----------|-----------|
+| No incomplete file treated as complete | Size validation against Content-Length |
+| Abort doesn't corrupt state | `force_exit` causes curl_easy_cleanup(); partial file remains for resume |
+| Certificate validation | curl VERIFYPEER + VERIFYHOST by default |
+| No credential leakage | Certificate paths resolved at runtime; not logged |
+| Throttle enforcement | Speed limit applied via curl option; immediate effect |
+
+---
+
+## 13. Failure Semantics
+
+| Failure Mode | Return Value | State After |
+|--------------|-------------|-------------|
+| DNS resolution failure | CURLE_COULDNT_RESOLVE_HOST | Curl handle valid for reuse |
+| Connection timeout | CURLE_OPERATION_TIMEDOUT | Curl handle valid for reuse |
+| TLS handshake failure | CURLE_SSL_* | Attempted fallback; if all fail, return TLS error |
+| HTTP 4xx/5xx | 0 (curl success) + `http_code` set | Caller checks HTTP code |
+| Write error (disk full) | CURLE_WRITE_ERROR | Partial file on disk |
+| Throttle to zero | RDKV_UPGRADE_ERROR_THROTTLE_ZERO | Download aborted, partial file may exist |
+| `force_exit` abort | Curl error from interrupted transfer | Partial file exists for resume |
+| Codebig signing failure | Falls through to error return | No download attempted via Codebig |
+| mTLS certificate not found | Falls back to direct (non-mTLS) download | Continues without mTLS |
+
+---
+
+## 14. Retry / Recovery Behavior
+
+**[VERIFIED]** The download engine does NOT retry internally. Retry semantics:
+
+| Mechanism | Behavior |
+|-----------|----------|
+| No internal retry | `rdkv_upgrade_request()` fails once and returns; caller retries |
+| Chunk resume support | On re-invocation, detects partial file and resumes from offset |
+| XConf query retry | Handled by caller loop (up to `retry_count` attempts) |
+| Codebig fallback | Single fallback attempt (not a retry of same path) |
+| mTLS fallback | Single fallback to non-mTLS (not a retry) |
+
+### Resume Protocol
+
+```mermaid
+sequenceDiagram
+    participant CALLER as Orchestrator
+    participant ENGINE as download-engine
+    participant FS as Filesystem
+    participant CDN as CDN Server
+    
+    Note over CALLER,CDN: First attempt (interrupted)
+    CALLER->>ENGINE: rdkv_upgrade_request(ctx)
+    ENGINE->>FS: Check existing file size
+    FS-->>ENGINE: 0 bytes (new download)
+    ENGINE->>CDN: GET /firmware.bin
+    CDN-->>ENGINE: Streaming... (50MB of 200MB)
+    Note over ENGINE: Network failure / abort
+    ENGINE->>FS: Partial file (50MB) remains
+    ENGINE-->>CALLER: CURLE_* error
+    
+    Note over CALLER,CDN: Second attempt (resume)
+    CALLER->>ENGINE: rdkv_upgrade_request(ctx)
+    ENGINE->>FS: Check existing file size
+    FS-->>ENGINE: 50MB (partial)
+    ENGINE->>CDN: GET /firmware.bin (Range: bytes=52428800-)
+    CDN-->>ENGINE: 206 Partial Content (remaining 150MB)
+    ENGINE->>FS: Append to existing file
+    ENGINE-->>CALLER: 0 (success)
+```
+
+---
+
+## 15. Observability Expectations
+
+| Observable | Mechanism | Consumer |
+|------------|-----------|----------|
+| Download progress (%) | `/opt/curl_progress` file | Progress monitor thread (daemon), external tools |
+| Transfer speed | curl progress callback | T2 metrics |
+| TLS error classification | Return value categorization | T2 telemetry |
+| Download start/complete | T2 events | Cloud analytics |
+| HTTP response code | Output parameter | Caller logic |
+| Curl error code | Return value | Caller error handling |
+
+---
+
+## 16. External Dependencies
+
+| Dependency | Nature | Failure Impact |
+|------------|--------|----------------|
+| libcurl | Runtime linkage | Fatal: no HTTP capability |
+| CDN / HTTP server | Network | Cannot download firmware |
+| XConf server | Network | Cannot check for updates |
+| DNS resolver | Network | Cannot resolve hostnames |
+| TLS certificates | Filesystem | mTLS authentication fails (non-fatal: falls back) |
+| Codebig signing service | Network/stub | Codebig fallback unavailable (non-fatal) |
+| `/opt/curl_progress` | Filesystem | Progress monitoring unavailable |
+
+---
+
+## 17. Assumptions and Unknowns
+
+### Verified Assumptions
+
+- [VERIFIED] All operations are blocking — caller must provide appropriate threading context
+- [VERIFIED] Curl handle can be reused across multiple calls in one-shot mode
+- [VERIFIED] Chunk resume uses HTTP Range header with byte offset from existing file size
+- [VERIFIED] `force_exit` is checked in curl progress callback (called every few seconds by curl)
+- [VERIFIED] mTLS and Codebig are RFC-controlled (can be disabled per-device)
+
+### Inferred Behavior
+
+- [INFERRED] Content-Length from HTTP response is used to validate complete download
+- [INFERRED] Codebig URL signing is currently a stub (returns 1 = failure)
+- [INFERRED] Progress callback frequency depends on curl's internal timing (~1 second intervals)
+
+### Unresolved Unknowns
+
+- [UNKNOWN] Maximum supported firmware image size
+- [UNKNOWN] Exact throttle speed enforcement granularity (instantaneous vs average)
+- [UNKNOWN] Whether partial file integrity is validated before resume (checksum?)
+- [UNKNOWN] Timeout values for curl operations (connect timeout, transfer timeout)
+- [UNKNOWN] Whether concurrent downloads of different types are ever attempted in daemon mode
+
+---
+
+## ADDED Requirements (from direct-cdn-parity-guards)
+
+### Requirement: Codebig entry-point guard for Direct CDN mode
+The `codebigdownloadFile()` function SHALL reject requests where `context->direct_cdn == true` by returning immediately before any Codebig signing or download logic executes. This provides defense-in-depth against `isDwnlBlock()` server_type flips that could redirect a Direct CDN download into the Codebig path.
+
+#### Scenario: Direct CDN request blocked at Codebig entry point
+- **WHEN** `codebigdownloadFile()` is called with `context->direct_cdn == true`
+- **THEN** the function SHALL log an informational message and return -1 without performing any Codebig URL signing or download attempt
+
+#### Scenario: Non-Direct-CDN request proceeds normally
+- **WHEN** `codebigdownloadFile()` is called with `context->direct_cdn == false`
+- **THEN** the function SHALL proceed with its existing Codebig signing and download logic unchanged
+
+#### Scenario: isDwnlBlock flip does not bypass guard
+- **WHEN** `isDwnlBlock()` flips `server_type` from `HTTP_SSR_DIRECT` to `HTTP_SSR_CODEBIG` AND `context->direct_cdn == true`
+- **THEN** the resulting call to `codebigdownloadFile()` SHALL still be blocked by the entry-point guard
+
+---
+
+## ADDED Requirements (from direct-cdn-adoption)
+
+### Requirement: Direct CDN download mode skips Codebig fallback
+When the `direct_cdn` flag is set in `RdkUpgradeContext_t`, the download engine SHALL attempt only the direct URL download without the mTLS → direct → Codebig fallback chain.
+
+#### Scenario: direct_cdn true bypasses Codebig
+- **WHEN** `rdkv_upgrade_request()` is called with `context->direct_cdn == true`
+- **THEN** the engine SHALL perform a single direct HTTPS download attempt using `context->artifactLocationUrl` without Codebig signing or fallback
+
+#### Scenario: direct_cdn false preserves existing fallback
+- **WHEN** `rdkv_upgrade_request()` is called with `context->direct_cdn == false`
+- **THEN** the engine SHALL execute the existing fallback chain: mTLS → direct → Codebig (unchanged behavior)
+
+### Requirement: RdkUpgradeContext_t includes direct_cdn field
+The `RdkUpgradeContext_t` structure SHALL include a `bool direct_cdn` field. Callers that zero-initialize the struct SHALL get `false` (legacy behavior) by default.
+
+#### Scenario: Zero-initialized context defaults to legacy
+- **WHEN** a caller creates `RdkUpgradeContext_t ctx = {0}` without setting `direct_cdn`
+- **THEN** `ctx.direct_cdn` SHALL be false, preserving the full fallback chain behavior
diff --git a/openspec/specs/firmware-validation/spec.md b/openspec/specs/firmware-validation/spec.md
new file mode 100755
index 00000000..7fc336ff
--- /dev/null
+++ b/openspec/specs/firmware-validation/spec.md
@@ -0,0 +1,476 @@
+# Subsystem Specification: firmware-validation
+
+> **Subsystem:** Firmware Validation & Update Decision  
+> **Type:** Core Runtime — Shared Infrastructure  
+> **Scope:** Shared across both execution models (divergent integration paths)  
+> **Evidence Level:** Verified from `src/json_process.c`, `src/flash.c`, `src/download_status_helper.c`, `src/dbus/rdkFwupdateMgr_handlers.c`  
+> **Cross-references:** [subsystems/subsystem-inventory.md §2, §5, §8](../../subsystems/subsystem-inventory.md), [runtime/firmware-update-flows.md](../../runtime/firmware-update-flows.md)
+
+---
+
+## 1. Purpose
+
+The `firmware-validation` subsystem owns the determination of whether a firmware update is required, the validation of firmware response data against device identity, and the execution of flash operations. It encompasses:
+
+- XConf request construction and response parsing
+- Firmware version comparison and upgrade eligibility determination
+- Flash execution and post-flash verification
+- Update status tracking and persistence
+
+This subsystem sits between the download-engine (which retrieves data) and the orchestrators (which decide sequencing). It provides the **decision logic** for firmware updates.
+
+---
+
+## 2. What This Subsystem Owns
+
+- XConf payload construction from device identity
+- XConf JSON response parsing into structured data (`XCONFRES`)
+- Firmware version comparison (current vs available)
+- Upgrade eligibility determination (model match, version difference)
+- Flash image execution (`flashImage()`)
+- Post-flash status reporting and reboot decision
+- Download status file persistence (`/opt/fwdnldstatus.txt`)
+- Daemon-specific: XConf response caching (memory + file)
+
+## 3. What This Subsystem Does NOT Own
+
+- HTTP transport (owned by `download-engine`)
+- D-Bus method dispatch (owned by `dbus-ipc`)
+- Retry decisions (owned by `retry-recovery`)
+- Process lifecycle (owned by `updater-execution` / `daemon-runtime`)
+- Download throttling and speed control (owned by `download-engine`)
+
+---
+
+## 4. Responsibilities
+
+| Responsibility | Behavioral Contract |
+|----------------|-------------------|
+| XConf payload construction | MUST build valid JSON containing: model, MAC, firmware version, partner ID, account ID |
+| XConf response parsing | MUST extract: firmware URL, filename, version, reboot flag, upgrade type from JSON response |
+| Version comparison | MUST compare current firmware name against XConf-reported available version |
+| Model validation | MUST verify XConf response targets the correct device model |
+| Flash execution | MUST invoke platform flash mechanism with correct firmware path and type |
+| Flash state events | MUST emit IARM state events during flash lifecycle (FLASHING → COMPLETE/FAILED) |
+| Status file maintenance | MUST update `/opt/fwdnldstatus.txt` at each stage of the update lifecycle |
+| Reboot flag management | MUST set reboot preparation indicators before flash for crash recovery |
+| Cache management (daemon) | MUST cache XConf responses for deduplication of concurrent check requests |
+| Cache invalidation (daemon) | MUST invalidate cache when cached firmware has been downloaded |
+
+---
+
+## 5. Exposed Interfaces / APIs
+
+### XConf Payload Construction
+
+```c
+/**
+ * @brief Build XConf POST request payload from device identity
+ * @return JSON string (caller-freed) or NULL on error
+ */
+char* createJsonString(void);
+```
+
+### XConf Response Parsing
+
+```c
+/**
+ * @brief Parse raw XConf JSON response into XCONFRES structure
+ * @param response_data   Raw HTTP response body
+ * @param response_len    Length of response data
+ * @param xconf_response  Output structure to populate
+ * @return 0 on success, error code on parse failure
+ */
+int getXconfRespData(const char *response_data, int response_len, XCONFRES *xconf_response);
+
+/**
+ * @brief Validate parsed XConf response against device identity
+ * @param xconf_response  Parsed response
+ * @return 0 = valid upgrade, non-zero = skip (no update/model mismatch)
+ */
+int processJsonResponse(XCONFRES *xconf_response);
+```
+
+### Flash Execution
+
+```c
+/**
+ * @brief Flash firmware image to device
+ * @param server_url    Origin server URL (for status reporting)
+ * @param upgrade_file  Local path to firmware image
+ * @param reboot_flag   Whether to set reboot indicators
+ * @param proto         Protocol used for download
+ * @param upgrade_type  PCI/PDRI/PERIPHERAL
+ * @param maint         Maintenance mode active
+ * @param trigger_type  Trigger classification
+ * @return 0 on success, non-zero on failure
+ */
+int flashImage(const char *server_url, const char *upgrade_file, 
+               int reboot_flag, int proto, int upgrade_type, 
+               int maint, int trigger_type);
+```
+
+### Download Status Tracking
+
+```c
+/**
+ * @brief Persist firmware download status to STATUS_FILE
+ * @param status  Status string to write
+ * @param url     Download URL (for context)
+ * @param file    Firmware filename
+ */
+void updateFWDownloadStatus(const char *status, const char *url, const char *file);
+
+/**
+ * @brief Notify RFC subsystem of download status change
+ * @param status  Status code
+ */
+void notifyDwnlStatus(int status);
+```
+
+### XCONFRES Data Structure
+
+```c
+typedef struct {
+    char firmwareDownloadProtocol[64];   // "http" or "https"
+    char firmwareFilename[256];          // Image filename
+    char firmwareLocation[512];          // Base download URL
+    char firmwareVersion[128];           // Target firmware version string
+    int  rebootImmediately;             // 1 = reboot after flash
+    int  upgradeDelay;                   // Delay before download (seconds)
+    char ipv6FirmwareLocation[512];     // IPv6 alternate URL
+    // ... PDRI fields, peripheral firmware list
+} XCONFRES;
+```
+
+---
+
+## 6. Runtime Lifecycle
+
+### 6.1 XConf Validation Flow
+
+```mermaid
+stateDiagram-v2
+    [*] --> BUILD_PAYLOAD : Validation triggered
+    BUILD_PAYLOAD --> QUERY_XCONF : createJsonString() → JSON
+    QUERY_XCONF --> PARSE_RESPONSE : HTTP 200 received
+    QUERY_XCONF --> NO_CONNECTIVITY : Network failure
+    
+    PARSE_RESPONSE --> VALIDATE_MODEL : getXconfRespData() success
+    PARSE_RESPONSE --> PARSE_ERROR : Invalid JSON
+    
+    VALIDATE_MODEL --> VERSION_CHECK : Model matches device
+    VALIDATE_MODEL --> MODEL_MISMATCH : Model does not match
+    
+    VERSION_CHECK --> UPGRADE_REQUIRED : New version available
+    VERSION_CHECK --> UP_TO_DATE : Same or older version
+    
+    UPGRADE_REQUIRED --> [*] : Return upgrade context
+    UP_TO_DATE --> [*] : Return no-update
+    NO_CONNECTIVITY --> [*] : Return network error
+    PARSE_ERROR --> [*] : Return parse error
+    MODEL_MISMATCH --> [*] : Return validation error
+```
+
+### 6.2 Flash Lifecycle
+
+```mermaid
+stateDiagram-v2
+    [*] --> VALIDATE_FILE : flashImage() called
+    VALIDATE_FILE --> SET_REBOOT_FLAG : File exists + size valid
+    VALIDATE_FILE --> FLASH_ERROR : File missing/empty
+    
+    SET_REBOOT_FLAG --> EMIT_FLASHING : /tmp/fw_preparing_to_reboot created
+    EMIT_FLASHING --> EXECUTE_FLASH : IARM event FW_STATE_FLASHING
+    
+    EXECUTE_FLASH --> FLASH_COMPLETE : Flash HAL returns success
+    EXECUTE_FLASH --> FLASH_FAILED : Flash HAL returns error
+    
+    FLASH_COMPLETE --> UPDATE_STATUS : Update STATUS_FILE
+    FLASH_FAILED --> UPDATE_STATUS : Update STATUS_FILE with error
+    
+    UPDATE_STATUS --> EMIT_COMPLETE : IARM event FW_STATE_COMPLETE/FAILED
+    EMIT_COMPLETE --> [*] : Return status to caller
+```
+
+---
+
+## 7. Interaction Contracts
+
+### 7.1 Inbound (Who Calls This Subsystem)
+
+| Caller | Function Called | Context |
+|--------|----------------|---------|
+| One-shot orchestrator | `createJsonString()`, `processJsonResponse()`, `flashImage()` | Main thread, synchronous |
+| Daemon XConf handler | `createJsonString()`, `getXconfRespData()` | GTask worker thread |
+| Daemon flash handler | `flashImage()` | GTask worker thread |
+| Download engine | `updateFWDownloadStatus()` | Calling thread (worker or main) |
+
+### 7.2 Outbound (What This Subsystem Calls)
+
+| Target | Function | Purpose |
+|--------|----------|---------|
+| Device Identity (librdksw_fwutils) | `getDeviceProperties()`, `GetModelNum()` | Device info for XConf payload |
+| IARM Events (librdksw_iarmIntf) | `eventManager()` | Flash state transitions |
+| RFC (librdksw_rfcIntf) | `write_RFCProperty()` | Status notification to RFC |
+| Filesystem | File read/write | STATUS_FILE, reboot flag file |
+| Flash HAL (external) | Platform-specific flash invocation | Actual flash I/O |
+| Telemetry (T2) | `flashT2CountNotify()` | Flash metrics |
+
+---
+
+## 8. Shared-Library Dependencies
+
+| Library | Components Used |
+|---------|----------------|
+| `librdksw_jsonparse.so` | `createJsonString()`, `processJsonResponse()`, `getXconfRespData()` |
+| `librdksw_flash.so` | `flashImage()`, `updateFWDownloadStatus()` |
+| `librdksw_fwutils.so` | Device properties for payload construction |
+| `librdksw_iarmIntf.so` | Flash state event broadcasting |
+| `librdksw_rfcIntf.so` | RFC status notifications |
+| `libcjson` (external) | JSON construction and parsing |
+| `libparsejson` (external) | JSON field extraction |
+
+---
+
+## 9. Execution-Model-Specific Behavior
+
+### 9.1 Behavior Shared by Both Binaries
+
+| Behavior | Contract |
+|----------|----------|
+| XConf payload construction | Same `createJsonString()` function, same device identity source |
+| JSON parsing | Same `getXconfRespData()` logic |
+| Version comparison | Same `processJsonResponse()` / `checkForValidPCIUpgrade()` logic |
+| Flash execution | Same `flashImage()` function |
+| Status file writes | Same `updateFWDownloadStatus()` function |
+| IARM flash events | Same event names and payloads |
+
+### 9.2 One-Shot-Specific Behavior
+
+| Behavior | Detail |
+|----------|--------|
+| XConf query function | `MakeXconfComms()` in `rdkv_main.c` — direct, no caching |
+| Flash chaining | Automatic after download when `download_only == 0` |
+| Multi-firmware validation | Checks PCI, then PDRI, then Peripheral sequentially |
+| Response lifetime | XCONFRES lives for process duration (global struct) |
+| No cache | Every invocation queries XConf fresh |
+
+### 9.3 Daemon-Specific Behavior
+
+| Behavior | Detail |
+|----------|--------|
+| XConf query function | `rdkFwupdateMgr_checkForUpdate()` in handlers — with caching |
+| Cache strategy | Memory cache (`g_cached_xconf_data`) + file cache |
+| Cache protection | `G_LOCK` macro for thread-safe access |
+| Flash decoupled | Flash only when client explicitly calls `UpdateFirmware` |
+| Response lifetime | Cached until invalidated (download completed or TTL) |
+| Concurrent deduplication | Piggyback queue prevents redundant XConf queries |
+
+```mermaid
+flowchart TD
+    subgraph "One-Shot Path"
+        OS1["MakeXconfComms()"] --> OS2["createJsonString()"]
+        OS2 --> OS3["rdkv_upgrade_request(XCONF)"]
+        OS3 --> OS4["getXconfRespData()"]
+        OS4 --> OS5["processJsonResponse()"]
+        OS5 --> OS6["flashImage() if download_only==0"]
+    end
+    
+    subgraph "Daemon Path"
+        D1["rdkFwupdateMgr_checkForUpdate()"] --> D2["Check cache"]
+        D2 -->|"miss"| D3["createJsonString()"]
+        D3 --> D4["rdkv_upgrade_request(XCONF)"]
+        D4 --> D5["getXconfRespData()"]
+        D5 --> D6["save_xconf_to_cache()"]
+        D6 --> D7["Return to client via signal"]
+        D2 -->|"hit"| D7
+        
+        D8["Client calls UpdateFirmware"] --> D9["flashImage()"]
+    end
+```
+
+---
+
+## 10. Threading / Event-Loop Expectations
+
+| Operation | One-Shot Thread Context | Daemon Thread Context |
+|-----------|------------------------|----------------------|
+| `createJsonString()` | Main thread | GTask XConf worker |
+| `getXconfRespData()` | Main thread | GTask XConf worker |
+| `processJsonResponse()` | Main thread | GTask XConf worker |
+| `flashImage()` | Main thread | GTask flash worker |
+| `updateFWDownloadStatus()` | Main thread | Any worker thread |
+| Cache read/write | N/A | XConf worker (G_LOCK protected) |
+
+### Thread Safety
+
+- `createJsonString()`: Reads `device_info` global — safe if initialized before call
+- `getXconfRespData()`: Pure function on input data — thread-safe
+- `flashImage()`: Reads globals, writes STATUS_FILE — safe with single-flash invariant
+- `updateFWDownloadStatus()`: Writes file — safe with single-writer assumption
+- Cache functions: Protected by `G_LOCK(xconf_cache)` — thread-safe
+
+---
+
+## 11. Operational Invariants
+
+| Invariant | Enforcement |
+|-----------|-------------|
+| XConf payload requires device identity | `createJsonString()` reads `device_info` populated by `initialize()` |
+| Flash requires valid firmware file | `flashImage()` validates file existence and size > 0 |
+| At most one flash at a time | Daemon: `IsFlashInProgress` guard; One-shot: single-threaded |
+| Status file reflects current state | Updated at download start, progress, complete, and flash stages |
+| Reboot flag set before flash | `/tmp/fw_preparing_to_reboot` created before flash HAL invocation |
+| Cache coherence (daemon) | Cache invalidated after firmware is downloaded |
+
+---
+
+## 12. Safety Guarantees
+
+| Guarantee | Mechanism |
+|-----------|-----------|
+| No flash without valid firmware | File existence + size validation before flash |
+| Crash recovery indication | `/tmp/fw_preparing_to_reboot` persists across crashes |
+| No model-mismatched flash | `processJsonResponse()` validates model in XConf response |
+| No downgrade (by default) | Version comparison rejects same-or-older firmware |
+| Status persistence | STATUS_FILE written synchronously — survives power loss |
+| Reboot coordination | `rebootImmediately` flag from XConf controls post-flash behavior |
+
+---
+
+## 13. Failure Semantics
+
+| Failure Mode | Behavior | Impact |
+|--------------|----------|--------|
+| XConf network failure | Return network error to caller | No firmware decision made |
+| XConf parse error | Return parse error | Invalid response discarded |
+| Model mismatch | Return validation error | Firmware skipped (safe) |
+| Version comparison: no update | Return "up to date" | No download triggered |
+| Flash file missing | Return error before flash attempt | No flash executed |
+| Flash HAL failure | Return non-zero, emit IARM failure event | Firmware not applied; device on current version |
+| STATUS_FILE write failure | Logged but non-fatal | External monitoring degraded |
+| Cache corruption (daemon) | Fallback to fresh XConf query | Self-healing behavior |
+
+---
+
+## 14. Retry / Recovery Behavior
+
+| Scenario | Behavior |
+|----------|----------|
+| XConf query failure | Caller retries (not this subsystem's responsibility) |
+| Flash failure | Caller decides retry policy; firmware file remains on disk |
+| Partial STATUS_FILE | Overwritten on next status update |
+| Stale cache (daemon) | Invalidated on download completion; fresh query on next check |
+| `fw_preparing_to_reboot` after crash | Next startup detects and reports DWNL_COMPLETED |
+
+---
+
+## 15. Observability Expectations
+
+| Observable | Mechanism | Consumer |
+|------------|-----------|----------|
+| Update available/not | XConf response parsing result | Orchestrators |
+| Flash progress | IARM state events | System event bus |
+| Download/flash status | STATUS_FILE (`/opt/fwdnldstatus.txt`) | External monitoring |
+| Firmware version comparison | T2 metrics | Cloud telemetry |
+| Cache hit/miss (daemon) | Internal logging | Debugging |
+| Reboot pending | `/tmp/fw_preparing_to_reboot` existence | Crash recovery logic |
+
+---
+
+## 16. External Dependencies
+
+| Dependency | Nature | Failure Impact |
+|------------|--------|----------------|
+| XConf cloud server | Network (response data) | Cannot validate update availability |
+| Device property files | Filesystem | Cannot construct XConf payload |
+| Flash HAL (platform) | Platform-specific | Cannot apply firmware |
+| libcjson | Runtime linkage | Cannot parse/construct JSON |
+| IARM Bus | IPC | Flash state events not broadcast (non-fatal) |
+
+---
+
+## 17. Assumptions and Unknowns
+
+### Verified Assumptions
+
+- [VERIFIED] `XCONFRES` structure is the canonical parsed XConf response format
+- [VERIFIED] `processJsonResponse()` compares firmware filename, not version semantically
+- [VERIFIED] Flash is invoked via same `flashImage()` regardless of execution model
+- [VERIFIED] Daemon caches XConf response in both memory and file
+- [VERIFIED] `disableStatsUpdate` flag suppresses STATUS_FILE writes for PDRI/Peripheral
+
+### Inferred Behavior
+
+- [INFERRED] XConf server returns HTTP 200 with empty/null firmware fields when no update exists
+- [INFERRED] Cache TTL is implicit (invalidated by download, not by time)
+- [INFERRED] `rebootImmediately` from XConf is advisory; flash subsystem sets flag but may not reboot
+
+### Unresolved Unknowns
+
+- [UNKNOWN] Exact XConf JSON schema (request and response) — field-level documentation
+- [UNKNOWN] Whether firmware version comparison is string-equality or semantic versioning
+- [UNKNOWN] Flash HAL interface specification (platform-specific abstraction)
+- [UNKNOWN] Cache file location and format for daemon XConf cache
+- [UNKNOWN] Whether XConf can return multiple firmware types in a single response or requires separate queries
+
+---
+
+## ADDED Requirements (from direct-cdn-parity-guards)
+
+### Requirement: PDRI filename normalization in per-artifact mode
+The per-artifact download path for `PDRI_UPGRADE` in `checkTriggerUpgrade()` SHALL normalize the PDRI filename by appending `.bin` suffix if not already present, before constructing the local save path. This ensures the local filesystem filename is consistent regardless of whether the XConf response includes the `.bin` extension.
+
+#### Scenario: PDRI filename without .bin gets normalized
+- **WHEN** `checkTriggerUpgrade()` processes `PDRI_UPGRADE` and `pResponse->cloudPDRIVersion` does NOT contain `.bin`
+- **THEN** the local download path SHALL be constructed as `<difw_path>/<cloudPDRIVersion>.bin`
+
+#### Scenario: PDRI filename with .bin used as-is
+- **WHEN** `checkTriggerUpgrade()` processes `PDRI_UPGRADE` and `pResponse->cloudPDRIVersion` already contains `.bin`
+- **THEN** the local download path SHALL be constructed as `<difw_path>/<cloudPDRIVersion>` without additional suffix
+
+#### Scenario: Normalization applies only to local save path
+- **WHEN** PDRI `.bin` normalization is applied
+- **THEN** it SHALL only affect the local filesystem path (`dwlpath_filename`) and SHALL NOT modify the download URL (`artifact_url` / `pResponse->pdriUrl`)
+
+#### Scenario: Normalization does not apply to PCI or Peripheral artifacts
+- **WHEN** `checkTriggerUpgrade()` processes `PCI_UPGRADE` or `PERIPHERAL_UPGRADE`
+- **THEN** no `.bin` normalization SHALL be applied (only PDRI requires this)
+
+---
+
+## ADDED Requirements (from direct-cdn-adoption)
+
+### Requirement: XCONFRES struct extended with per-artifact URL fields
+The `XCONFRES` structure SHALL include `firmwareUrl`, `pdriUrl`, and `remCtrlUrl` fields for storing per-artifact download URLs received from the enriched XConf response.
+
+#### Scenario: Per-artifact URL fields present in struct
+- **WHEN** the `XCONFRES` struct is allocated
+- **THEN** it SHALL contain `char firmwareUrl[CLD_URL_MAX_LEN]`, `char pdriUrl[CLD_URL_MAX_LEN]`, and `char remCtrlUrl[CLD_URL_MAX_LEN]` fields
+
+### Requirement: Conditional XConf response parsing based on Direct CDN mode
+The `getXconfRespData()` function SHALL parse per-artifact URL fields from XConf JSON when Direct CDN is enabled, and use legacy parsing when disabled.
+
+#### Scenario: Direct CDN enabled parses per-artifact URLs
+- **WHEN** `getXconfRespData()` is called and `rfc_list.rfc_directcdn` is `"true"`
+- **THEN** it SHALL parse `firmware_URL`, `additionalFwVerInfo_URL`, and `<peripheralProduct>_URL` from the JSON response
+
+#### Scenario: Direct CDN disabled uses legacy peripheral parsing
+- **WHEN** `getXconfRespData()` is called and `rfc_list.rfc_directcdn` is not `"true"`
+- **THEN** it SHALL use `GetJsonValContaining("remCtrl", ...)` for peripheral firmware discovery (existing behavior)
+
+### Requirement: PDRI image filename validation
+The `processJsonResponse()` function SHALL validate that a PDRI image filename contains the `_PDRI_` substring. If the substring is absent, the PDRI image SHALL be considered invalid.
+
+#### Scenario: Valid PDRI filename accepted
+- **WHEN** `processJsonResponse()` processes a response where `cloudPDRIVersion` contains `_PDRI_`
+- **THEN** the PDRI image SHALL be considered valid for download
+
+#### Scenario: Invalid PDRI filename rejected
+- **WHEN** `processJsonResponse()` processes a response where `cloudPDRIVersion` does NOT contain `_PDRI_`
+- **THEN** the PDRI image SHALL be marked invalid and SHALL NOT be downloaded
+
+#### Scenario: Empty PDRI version skipped
+- **WHEN** `processJsonResponse()` processes a response where `cloudPDRIVersion` is empty
+- **THEN** PDRI SHALL be skipped entirely (no validation needed)
diff --git a/openspec/specs/operational-safety/spec.md b/openspec/specs/operational-safety/spec.md
new file mode 100755
index 00000000..fec6c870
--- /dev/null
+++ b/openspec/specs/operational-safety/spec.md
@@ -0,0 +1,444 @@
+# Subsystem Specification: operational-safety
+
+> **Subsystem:** Operational Safety & Concurrency Control  
+> **Type:** Cross-Cutting Operational Concern  
+> **Scope:** Shared guards + daemon-specific concurrency control  
+> **Evidence Level:** Verified from `src/device_status_helper.c`, `src/dbus/xconf_comm_status.c`, `src/dbus/rdkv_dbus_server.c`, `src/rdkv_main.c`, `src/rdkFwupdateMgr.c`  
+> **Cross-references:** [subsystems/subsystem-inventory.md §16, §17](../../subsystems/subsystem-inventory.md), [runtime/daemon-threading-model.md](../../runtime/daemon-threading-model.md)
+
+---
+
+## 1. Purpose
+
+The `operational-safety` subsystem defines the behavioral contracts for all mechanisms that prevent unsafe concurrent execution, protect shared state, enforce single-operation invariants, and ensure system stability during firmware operations.
+
+This encompasses:
+- Process-level single-instance enforcement (shared)
+- Daemon concurrency guards (daemon-specific)
+- Thread synchronization primitives (daemon-specific)
+- Pre-operation validation gates (shared)
+- Safe abort mechanisms (shared)
+
+---
+
+## 2. What This Subsystem Owns
+
+- PID file lifecycle and single-instance enforcement
+- Process existence validation (`CurrentRunningInst()`)
+- Upgrade flag file management
+- Daemon concurrency guards (`IsDownloadInProgress`, `IsFlashInProgress`, `XConfCommStatus`)
+- Mutex-protected state access (`DwnlState`, `app_mode`)
+- Main-loop serialization guarantees (daemon)
+- Pre-operation connectivity and readiness checks
+- Signal-based abort mechanism (`SIGUSR1` → `force_exit`)
+- NTP synchronization wait
+- DNS resolution verification
+
+## 3. What This Subsystem Does NOT Own
+
+- Retry decisions (owned by `retry-recovery`)
+- D-Bus method validation (owned by `dbus-ipc`)
+- Download abort execution (owned by `download-engine`)
+- Flash safety verification (owned by `firmware-validation`)
+- Process lifecycle management (owned by orchestrators)
+- IARM event semantics (owned by IARM subsystem)
+
+---
+
+## 4. Responsibilities
+
+| Responsibility | Behavioral Contract |
+|----------------|-------------------|
+| Single-instance enforcement | MUST prevent concurrent execution of firmware update processes |
+| PID file management | MUST create PID file at operation start, remove at operation end |
+| Upgrade flag management | MUST set flag during download, clear on completion |
+| Daemon concurrency guards | MUST reject concurrent Download or Flash requests |
+| XConf deduplication | MUST coalesce concurrent XConf requests (daemon piggyback) |
+| State mutex protection | MUST protect cross-thread state with appropriate primitives |
+| Main-loop serialization | MUST ensure daemon-only state accessed only on main thread |
+| Pre-operation validation | MUST verify NTP sync, DNS resolution, and network before operations |
+| Abort mechanism | MUST provide graceful abort via signal that doesn't corrupt state |
+| Build exclusion | MUST exclude non-production devices when RFC auto-exclusion is set |
+
+---
+
+## 5. Safety Mechanisms
+
+### 5.1 Process-Level Single-Instance (Shared)
+
+```mermaid
+flowchart TD
+    START["Process Start<br/>(initialValidation)"] --> CHECK_PID["CurrentRunningInst('/tmp/DIFD.pid')"]
+    CHECK_PID --> READ_PID["Read PID from file"]
+    
+    READ_PID -->|"File exists"| CHECK_ALIVE["kill(pid, 0) — process alive?"]
+    READ_PID -->|"File missing"| CREATE_PID["Write own PID to file"]
+    
+    CHECK_ALIVE -->|"Process alive"| CONFLICT["DWNL_INPROGRESS<br/>(skip this run)"]
+    CHECK_ALIVE -->|"Process dead (stale)"| REMOVE_STALE["Remove stale PID file"]
+    REMOVE_STALE --> CREATE_PID
+    
+    CREATE_PID --> PROCEED["Proceed with operations"]
+    
+    PROCEED --> CLEANUP["On exit: remove PID file"]
+```
+
+**Implementation Details:**
+
+| Property | Value |
+|----------|-------|
+| PID file path | `/tmp/DIFD.pid` |
+| Check function | `CurrentRunningInst(const char *path)` |
+| Validation method | `kill(pid, 0)` — checks if process exists |
+| Stale detection | Process not running → PID file is stale |
+| Cleanup guarantee | `uninitialize()` removes PID file on all exit paths |
+
+**Behavioral Contract:**
+- MUST check PID file BEFORE any firmware operations
+- MUST validate PID file content against running processes
+- MUST treat stale PID file as removable (process crashed)
+- MUST create PID file before starting operations
+- MUST remove PID file on all exit paths (normal and error)
+
+### 5.2 Upgrade Flag File (Shared)
+
+| Property | Value |
+|----------|-------|
+| Flag file | `/tmp/.imageDnldInProgress` (or `HTTP_CDL_FLAG`) |
+| Created by | Orchestrator before download starts |
+| Removed by | Orchestrator after download completes or fails |
+| Purpose | External visibility that download is active |
+
+**Behavioral Contract:**
+- MUST be set before download operation begins
+- MUST be cleared on download completion (success or failure)
+- External tools MAY check this file to determine if download is active
+- `isUpgradeInProgress()` reads this flag to prevent re-entry
+
+### 5.3 Daemon Concurrency Guards (Daemon-Specific)
+
+```mermaid
+stateDiagram-v2
+    state "Download Guard" as DG {
+        direction LR
+        DG_FREE: IsDownloadInProgress = FALSE
+        DG_BUSY: IsDownloadInProgress = TRUE
+        
+        DG_FREE --> DG_BUSY : DownloadFirmware accepted
+        DG_BUSY --> DG_FREE : download_done() callback
+        
+        note right of DG_BUSY : New DownloadFirmware\nrequests REJECTED
+    }
+    
+    state "Flash Guard" as FG {
+        direction LR
+        FG_FREE: IsFlashInProgress = FALSE
+        FG_BUSY: IsFlashInProgress = TRUE
+        
+        FG_FREE --> FG_BUSY : UpdateFirmware accepted
+        FG_BUSY --> FG_FREE : flash_done() callback
+        
+        note right of FG_BUSY : New UpdateFirmware\nrequests REJECTED
+    }
+    
+    state "XConf Guard" as XG {
+        direction LR
+        XG_FREE: XConfCommStatus = FALSE
+        XG_BUSY: XConfCommStatus = TRUE
+        
+        XG_FREE --> XG_BUSY : First CheckForUpdate
+        XG_BUSY --> XG_FREE : xconf_fetch_done() callback
+        
+        note right of XG_BUSY : New CheckForUpdate\nrequests PIGGYBACK
+    }
+```
+
+#### Guard Comparison
+
+| Guard | Scope | Protection Mechanism | Rejection Behavior | Reset Trigger |
+|-------|-------|---------------------|-------------------|---------------|
+| `IsDownloadInProgress` | One download at a time | Main-loop serialization | Method returns rejection | `download_done()` on main thread |
+| `IsFlashInProgress` | One flash at a time | Main-loop serialization | Method returns rejection | `flash_done()` on main thread |
+| `XConfCommStatus` | One XConf fetch at a time | `GMutex` (cross-thread) | Piggyback (not rejection) | `xconf_fetch_done()` on main thread |
+
+### 5.4 Thread Synchronization Primitives (Daemon-Specific)
+
+| Primitive | Protects | Threads Involved | Type |
+|-----------|----------|-----------------|------|
+| `GMutex` (xconf_comm_status) | `XConfCommStatus` boolean | Main thread + Worker thread | GLib mutex |
+| `G_LOCK(xconf_cache)` | `g_cached_xconf_data` | Main thread + XConf worker | GLib lock macro |
+| `pthread_mutex_t mutuex_dwnl_state` | `DwnlState` global | Any thread writing download state | POSIX mutex |
+| `pthread_mutex_t app_mode_status` | `app_mode` global | Main thread + IARM callback | POSIX mutex |
+| `GMutex` (per-download stop_flag) | Download stop flag | Download worker + Progress monitor | GLib mutex |
+| Main-loop serialization | `registered_processes`, `active_tasks`, `waiting_*`, `IsDownload/FlashInProgress` | Main thread only (guaranteed) | GLib main loop scheduling |
+
+### 5.5 Pre-Operation Validation Gates (Shared)
+
+```mermaid
+flowchart TD
+    TRIGGER["Operation Triggered"] --> NTP["waitForNtp()"]
+    NTP -->|"NTP synced"| DNS["isDnsResolve()"]
+    NTP -->|"Timeout (no NTP)"| DNS
+    DNS -->|"DNS resolves"| ROUTE["CheckIProuteConnectivity()"]
+    DNS -->|"DNS fails"| SKIP["Skip operation (no connectivity)"]
+    ROUTE -->|"Route exists"| PROCEED["Proceed with firmware operation"]
+    ROUTE -->|"No route"| SKIP
+```
+
+**Validation Functions:**
+
+| Function | Purpose | Blocking? | Timeout |
+|----------|---------|-----------|---------|
+| `waitForNtp()` | Wait for NTP time synchronization | Yes | [UNKNOWN] |
+| `isDnsResolve()` | Verify DNS resolution capability | Yes | Short |
+| `CheckIProuteConnectivity()` | Verify IP route to CDN | Yes | Short |
+| `CurrentRunningInst()` | Check for another running instance | Yes (file I/O) | None |
+| `isUpgradeInProgress()` | Check upgrade flag file | Yes (file I/O) | None |
+| `GetBuildType()` + RFC exclusion | Verify production eligibility | Yes (file I/O) | None |
+
+### 5.6 Signal-Based Abort (Shared)
+
+```mermaid
+sequenceDiagram
+    participant EXT as External (MM/operator)
+    participant SIG as Signal Handler
+    participant CURL as curl progress callback
+    participant DL as Download I/O
+
+    EXT->>SIG: SIGUSR1
+    activate SIG
+    SIG->>SIG: force_exit = 1
+    SIG->>SIG: curl_easy_cleanup(curl) [abort transfer]
+    deactivate SIG
+    
+    Note over CURL: Next progress callback
+    CURL->>CURL: Check force_exit
+    CURL->>DL: Return non-zero (abort)
+    DL-->>DL: curl_easy_perform() returns CURLE_ABORTED_BY_CALLBACK
+```
+
+**Behavioral Contract:**
+- Signal handler MUST only set flags and cleanup curl (reentrant-safe operations)
+- Signal handler MUST NOT allocate heap memory or call non-async-signal-safe functions
+- `force_exit` flag MUST be checked by curl progress callback
+- Abort MUST NOT corrupt downloaded data (partial file remains valid for resume)
+
+---
+
+## 6. Execution-Model-Specific Behavior
+
+### 6.1 Behavior Shared by Both Binaries
+
+| Mechanism | Shared Contract |
+|-----------|----------------|
+| PID file check | Same `CurrentRunningInst()` function, same file path |
+| Upgrade flag management | Same `isUpgradeInProgress()` / `updateUpgradeFlag()` |
+| NTP/DNS/Route validation | Same functions from `device_status_helper.c` |
+| SIGUSR1 handling | Same signal → `force_exit` mechanism |
+| Build exclusion | Same RFC auto-exclusion check |
+| `DwnlState` mutex | Same pthread_mutex protecting download state |
+| `app_mode` mutex | Same pthread_mutex protecting app mode |
+
+### 6.2 One-Shot-Specific Safety
+
+| Mechanism | One-Shot Behavior |
+|-----------|-------------------|
+| Concurrency prevention | PID file is the ONLY guard (single-threaded; no daemon guards needed) |
+| Abort response | `force_exit` → curl abort → `uninitialize()` → `exit()` |
+| Throttle-to-zero | Treated as abort signal → sets `force_exit` → exit |
+| No concurrent operations | Single-threaded guarantee makes daemon guards unnecessary |
+| Exit on all conflicts | If PID conflict detected → exit(0); if upgrade in progress → exit(1) |
+
+### 6.3 Daemon-Specific Safety
+
+| Mechanism | Daemon Behavior |
+|-----------|-----------------|
+| Concurrency guards | `IsDownloadInProgress`, `IsFlashInProgress`, `XConfCommStatus` |
+| Piggyback deduplication | Concurrent CheckForUpdate requests share one worker |
+| Main-loop serialization | State access serialized by GLib main loop scheduling |
+| Multi-client isolation | Each client has independent handler_id; operations tracked per-task |
+| Error → continue | Guards reset on failure; daemon stays alive |
+| Worker abort | `stop_flag` per-download allows targeted abort without daemon impact |
+| No exit on operation failure | Daemon NEVER exits due to operation errors |
+
+---
+
+## 7. Threading / Event-Loop Expectations
+
+### One-Shot Threading Model
+
+```
+Single Thread:
+    main() → initialize() → validate() → download() → flash() → exit()
+    
+    Only concurrent access:
+    - SIGUSR1 handler (sets force_exit)
+    - IARM callback (DwnlStopEventHandler — delivered on IARM internal thread)
+    
+    Mutex usage:
+    - mutuex_dwnl_state: protects DwnlState (signal handler / IARM vs main)
+    - app_mode_status: protects app_mode (IARM callback vs main)
+```
+
+### Daemon Threading Model
+
+```
+Main Thread (GLib Main Loop):
+    - D-Bus dispatch (process_app_request)
+    - Guard checks/sets (IsDownload/FlashInProgress)
+    - Task context management
+    - Signal emission (g_idle_add callbacks)
+    - GTask completion callbacks
+
+Worker Threads (GTask Pool):
+    - XConf HTTP request (blocks 5-60s)
+    - Firmware download (blocks minutes)
+    - Flash I/O (blocks seconds)
+    - Access shared state ONLY via mutex or g_idle_add
+
+Progress Monitor (Dedicated GThread):
+    - Polls /opt/curl_progress every 100ms
+    - Emits progress via g_idle_add (main loop)
+    - Stopped via atomic stop_flag
+
+Thread Safety Rule:
+    If data is accessed by worker AND main thread → MUST use mutex or g_idle_add
+    If data is accessed ONLY by main thread → main-loop serialization suffices
+```
+
+---
+
+## 8. Interaction Contracts
+
+### 8.1 Inbound (What Triggers Safety Checks)
+
+| Source | Trigger | Safety Response |
+|--------|---------|-----------------|
+| Process startup | `initialValidation()` | PID check, upgrade flag check, build exclusion |
+| D-Bus method call (daemon) | `process_app_request()` | Guard check, registration validation |
+| SIGUSR1 signal | Signal handler | Set `force_exit`, abort curl |
+| IARM throttle callback | `DwnlStopEventHandler()` | Set download speed (0 = abort) |
+| systemd stop | SIGTERM | Orderly shutdown |
+
+### 8.2 Outbound (Safety Subsystem Effects)
+
+| Target | Effect | Mechanism |
+|--------|--------|-----------|
+| Download engine | Abort via `force_exit` | Curl progress callback checks flag |
+| D-Bus clients | Operation rejection | Method returns non-zero status |
+| Filesystem | PID file, upgrade flag | File create/remove |
+| Process | Exit (one-shot on conflict) | `exit(0)` or `exit(1)` |
+| IARM Bus | State events on conflict detection | `eventManager()` |
+
+---
+
+## 9. Operational Invariants
+
+| Invariant | Enforcement | Scope |
+|-----------|-------------|-------|
+| At most one firmware update process per device | PID file + `CurrentRunningInst()` | Both |
+| At most one download at a time (daemon) | `IsDownloadInProgress` guard | Daemon |
+| At most one flash at a time (daemon) | `IsFlashInProgress` guard | Daemon |
+| At most one XConf fetch at a time (daemon) | `XConfCommStatus` mutex-protected guard | Daemon |
+| Signal handler is reentrant-safe | Only sets flag + calls curl_easy_cleanup | Both |
+| PID file cleaned on all exit paths | `uninitialize()` always called | Both |
+| Mutexes initialized before use | Initialization in `initialize()` / `init_task_system()` | Both |
+| Mutexes destroyed on shutdown | Destruction in `uninitialize()` / `cleanup_dbus()` | Both |
+| Worker threads never touch main-loop state directly | `g_idle_add` for all worker→main communication | Daemon |
+| Guards reset on operation completion/failure | Completion callbacks always reset guards | Daemon |
+
+---
+
+## 10. Safety Guarantees
+
+| Guarantee | Mechanism |
+|-----------|-----------|
+| No concurrent firmware flashing | PID file (cross-binary) + IsFlashInProgress (daemon) |
+| No concurrent firmware downloading | PID file (cross-binary) + IsDownloadInProgress (daemon) |
+| Graceful abort without state corruption | force_exit + curl cleanup leaves partial file intact |
+| No deadlocks in daemon | Main-loop serialization avoids lock ordering issues; only GMutex for cross-thread |
+| No main-loop blocking | All I/O in worker threads; main thread only dispatches/emits |
+| Orderly shutdown | cleanup_dbus() → uninitialize() → exit() sequence |
+| No stale lock on crash | File-based locks (PID) validated against live processes |
+
+---
+
+## 11. Failure Semantics
+
+| Failure Mode | Safety Behavior | Impact |
+|--------------|----------------|--------|
+| PID file write fails | Cannot enforce single-instance | Potential concurrent execution (degraded safety) |
+| Mutex initialization fails | Undefined behavior if contended | Process should exit during init |
+| Guard stuck TRUE (daemon) | Operations permanently blocked | Daemon must be restarted |
+| SIGUSR1 during non-download | force_exit set but no effect until next download | Benign in non-download state |
+| Stale PID file (crashed process) | Detected by `kill(pid, 0)` failure → file removed | Self-healing on next invocation |
+| Main loop blocked (shouldn't happen) | D-Bus unresponsive; clients timeout | Daemon appears hung |
+
+---
+
+## 12. Retry / Recovery for Safety Mechanisms
+
+| Scenario | Recovery |
+|----------|----------|
+| Guard stuck (daemon bug) | Daemon restart via systemd clears all in-memory guards |
+| Stale PID file | Next invocation detects stale file and removes it |
+| Orphaned upgrade flag | Next successful operation clears it |
+| Mutex deadlock | Daemon restart (systemd watchdog could detect) |
+| Abort during critical section | force_exit + curl cleanup designed to be interrupt-safe |
+
+---
+
+## 13. Observability Expectations
+
+| Observable | Mechanism | Consumer |
+|------------|-----------|----------|
+| Instance conflict detected | Logging + IARM event | System logs, MM |
+| Guard state (daemon) | Internal logging | Daemon debug logs |
+| SIGUSR1 received | Logging | System logs |
+| Throttle callback received | Logging | System logs |
+| Pre-operation validation results | Logging + T2 metrics | Cloud telemetry |
+| PID file existence | Filesystem | External monitoring, operators |
+| Upgrade flag existence | Filesystem | External monitoring |
+
+---
+
+## 14. External Dependencies
+
+| Dependency | Nature | Safety Impact |
+|------------|--------|---------------|
+| Filesystem (tmpfs /tmp/) | PID file, flags | Single-instance enforcement depends on this |
+| POSIX signals | SIGUSR1 delivery | Abort mechanism depends on signal delivery |
+| pthreads | Mutex primitives | Thread safety depends on correct mutex behavior |
+| GLib | GMutex, main loop serialization | Daemon concurrency depends on GLib guarantees |
+| IARM Bus (internal thread) | Callback delivery | IARM callback arrives on unexpected thread |
+| NTP service | Time synchronization | Pre-operation gate may block indefinitely |
+
+---
+
+## 15. Assumptions and Unknowns
+
+### Verified Assumptions
+
+- [VERIFIED] PID file at `/tmp/DIFD.pid` is used for cross-binary instance detection
+- [VERIFIED] `kill(pid, 0)` validates whether PID from file is still alive
+- [VERIFIED] Daemon concurrency guards are booleans checked on main loop thread
+- [VERIFIED] `XConfCommStatus` is the only guard using GMutex (cross-thread access)
+- [VERIFIED] `force_exit` is set by signal handler and read by curl progress callback
+- [VERIFIED] Daemon never exits on operation failure — guards reset and continue
+
+### Inferred Behavior
+
+- [INFERRED] PID file on tmpfs (/tmp/) is cleared on system reboot — no stale files after reboot
+- [INFERRED] `waitForNtp()` has a bounded timeout (doesn't block indefinitely)
+- [INFERRED] Guard-stuck condition requires daemon restart (no self-healing mechanism)
+- [INFERRED] IARM `DwnlStopEventHandler` can arrive during any operation phase
+
+### Unresolved Unknowns
+
+- [UNKNOWN] `waitForNtp()` timeout duration — could potentially block startup indefinitely
+- [UNKNOWN] Whether daemon implements a watchdog mechanism for systemd
+- [UNKNOWN] Whether `IsDownloadInProgress` guard accounts for download worker thread crash
+- [UNKNOWN] Maximum time a guard can remain TRUE before external intervention is needed
+- [UNKNOWN] Whether concurrent `rdkvfwupgrader` and `rdkFwupdateMgr` execution is prevented
+- [UNKNOWN] D-Bus activation policy — can D-Bus auto-start the daemon?
+- [UNKNOWN] Whether IARM callback thread priority can cause priority inversion with main thread
diff --git a/openspec/specs/retry-recovery/spec.md b/openspec/specs/retry-recovery/spec.md
new file mode 100755
index 00000000..532f03ad
--- /dev/null
+++ b/openspec/specs/retry-recovery/spec.md
@@ -0,0 +1,423 @@
+# Subsystem Specification: retry-recovery
+
+> **Subsystem:** Retry & Recovery Behavior  
+> **Type:** Cross-Cutting Operational Concern  
+> **Scope:** Shared across both execution models (with model-specific manifestation)  
+> **Evidence Level:** Verified from `src/rdkv_main.c`, `src/rdkv_upgrade.c`, `src/chunk.c`, `src/flash.c`, `src/device_status_helper.c`, `src/dbus/rdkv_dbus_server.c`  
+> **Cross-references:** [subsystems/subsystem-map.md §3](../../subsystems/subsystem-map.md), [runtime/rdkvfwupgrader-sequence.md §4](../../runtime/rdkvfwupgrader-sequence.md)
+
+---
+
+## 1. Purpose
+
+The `retry-recovery` subsystem defines the behavioral contracts for retry logic, crash recovery, resume capability, and failure mitigation across the firmware update platform. This is a cross-cutting concern that manifests differently in each execution model and across multiple subsystems.
+
+This specification documents WHERE retry/recovery decisions are made, WHO owns them, and WHAT guarantees are provided — as opposed to individual subsystem failure semantics (which document what happens on error at a component level).
+
+---
+
+## 2. What This Subsystem Owns
+
+- XConf query retry policy (built-in retry loop)
+- Chunk-based download resume mechanism
+- Crash recovery detection and handling
+- Download abort and re-invocation semantics
+- Status file persistence for external recovery monitoring
+- State Red recovery path (boot-time recovery mode)
+
+## 3. What This Subsystem Does NOT Own
+
+- Individual error detection (owned by each subsystem)
+- Process re-invocation (owned by external caller: systemd, Maintenance Manager)
+- D-Bus service restart (owned by systemd)
+- Network reconnection (owned by libcurl)
+- Flash corruption repair (out of scope — platform-specific)
+
+---
+
+## 4. Retry Architecture Overview
+
+```mermaid
+flowchart TD
+    subgraph "Retry Layers"
+        direction TB
+        L1["Layer 1: External Re-invocation<br/>(systemd restart, Maintenance Manager re-trigger)"]
+        L2["Layer 2: XConf Query Retry<br/>(built-in retry loop with retry_count)"]
+        L3["Layer 3: Download Fallback Chain<br/>(mTLS → direct → Codebig)"]
+        L4["Layer 4: Chunk Resume<br/>(HTTP Range continuation)"]
+        L5["Layer 5: Crash Recovery<br/>(persistent state files)"]
+    end
+    
+    L1 -->|"Re-exec binary"| L2
+    L2 -->|"On each attempt"| L3
+    L3 -->|"On partial failure"| L4
+    L5 -->|"On restart"| L1
+```
+
+---
+
+## 5. Retry Mechanisms
+
+### 5.1 XConf Query Retry (Layer 2)
+
+**Owner:** One-shot orchestrator (inline) / Daemon handler (per-request)
+
+| Property | One-Shot | Daemon |
+|----------|----------|--------|
+| Retry count | `argv[1]` (typically 3) | Per-request parameter |
+| Retry location | Loop in `MakeXconfComms()` | Worker re-attempt logic |
+| Backoff strategy | [UNKNOWN] Fixed or exponential | [UNKNOWN] |
+| Failure after retries | Exit with error code | Signal error to clients |
+| State between retries | Same curl handle, same payload | Fresh context per attempt |
+
+**Behavioral Contract:**
+- MUST retry up to `retry_count` times on transient XConf failures
+- MUST NOT retry on permanent failures (e.g., invalid device identity)
+- SHOULD implement backoff between retry attempts
+- [UNKNOWN] Whether HTTP 4xx/5xx codes are treated as retryable
+
+### 5.2 Download Fallback Chain (Layer 3)
+
+**Owner:** `download-engine` (`rdkv_upgrade_request()`)
+
+```mermaid
+flowchart LR
+    START["Download Request"] --> MTLS{"mTLS enabled?"}
+    MTLS -->|"Yes"| MTLS_ATTEMPT["mTLS Download"]
+    MTLS -->|"No"| DIRECT["Direct HTTPS Download"]
+    MTLS_ATTEMPT -->|"Success"| DONE["Complete"]
+    MTLS_ATTEMPT -->|"Failure"| DIRECT
+    DIRECT -->|"Success"| DONE
+    DIRECT -->|"Failure"| CODEBIG{"Codebig enabled?"}
+    CODEBIG -->|"Yes"| CB_ATTEMPT["Codebig-signed Download"]
+    CODEBIG -->|"No"| FAIL["Return Error"]
+    CB_ATTEMPT -->|"Success"| DONE
+    CB_ATTEMPT -->|"Failure"| FAIL
+```
+
+**Behavioral Contract:**
+- This is a FALLBACK chain, NOT a retry of the same path
+- Each step uses a different authentication/routing mechanism
+- Order is fixed: mTLS → direct → Codebig
+- Each step is attempted exactly ONCE
+- Failure propagates to caller after all fallbacks exhausted
+
+### 5.3 Chunk Resume (Layer 4)
+
+**Owner:** `download-engine` (`chunkDownload()` in `src/chunk.c`)
+
+**Behavioral Contract:**
+- On re-invocation, MUST detect existing partial file at download path
+- MUST determine file size of partial download
+- MUST issue HTTP GET with `Range: bytes=<offset>-` header
+- MUST append received data to existing file (not overwrite)
+- MUST validate total received size against Content-Length
+- Does NOT validate integrity of existing partial data (no checksum)
+
+```mermaid
+sequenceDiagram
+    participant OS as Orchestrator
+    participant ENGINE as download-engine
+    participant FS as Filesystem
+    participant CDN as CDN Server
+
+    Note over OS,CDN: First attempt (fails at 50%)
+    OS->>ENGINE: rdkv_upgrade_request(ctx)
+    ENGINE->>FS: Check file: /opt/fw/image.bin
+    FS-->>ENGINE: Not found (0 bytes)
+    ENGINE->>CDN: GET /image.bin
+    CDN-->>ENGINE: Content-Length: 200MB
+    ENGINE->>FS: Write data... (100MB written)
+    Note over ENGINE: Network failure
+    ENGINE-->>OS: CURLE_RECV_ERROR
+    
+    Note over OS,CDN: Second attempt (resumes)
+    OS->>ENGINE: rdkv_upgrade_request(ctx)
+    ENGINE->>FS: Check file: /opt/fw/image.bin
+    FS-->>ENGINE: Exists: 100MB
+    ENGINE->>CDN: GET /image.bin (Range: bytes=104857600-)
+    CDN-->>ENGINE: 206 Partial Content (remaining 100MB)
+    ENGINE->>FS: Append to existing file
+    ENGINE-->>OS: 0 (success, 200MB total)
+```
+
+### 5.4 Crash Recovery (Layer 5)
+
+**Owner:** Orchestrators (`device_status_helper.c`, `rdkv_main.c`, `rdkFwupdateMgr.c`)
+
+#### Recovery Indicators
+
+| File | Created By | Detected By | Meaning |
+|------|-----------|-------------|---------|
+| `/tmp/fw_preparing_to_reboot` | Flash subsystem (before flash) | Orchestrator on startup | Flash was in progress; likely succeeded |
+| `/tmp/DIFD.pid` | Orchestrator (during operation) | Orchestrator on startup | Previous instance was running |
+| `/opt/fwdnldstatus.txt` | Download/flash subsystems | External monitoring | Last known operation status |
+| Upgrade flag file | Orchestrator (during download) | Orchestrator on startup | Download was in progress |
+
+#### Recovery Decision Matrix
+
+| Indicator Found | One-Shot Behavior | Daemon Behavior |
+|-----------------|-------------------|-----------------|
+| `fw_preparing_to_reboot` | Report DWNL_COMPLETED, remove file, exit(0) | Report DWNL_COMPLETED, remove file, enter STATE_IDLE |
+| PID file (stale) | If process dead: remove, continue. If alive: exit(0) | Same detection; daemon transitions to STATE_IDLE regardless |
+| Upgrade flag file | Skip download (already in progress externally) | Enter STATE_IDLE; await client requests |
+| Partial firmware file | Resume download (if re-triggered) | Available for chunk resume when client requests download |
+
+### 5.5 External Re-invocation (Layer 1)
+
+**Owner:** External to this repository (Maintenance Manager, systemd)
+
+**Behavioral Contract (External — INFERRED):**
+- Maintenance Manager re-invokes `rdkvfwupgrader` on scheduled intervals
+- systemd restarts `rdkFwupdateMgr` on crash (`Restart=on-failure`)
+- Re-invocation inherits clean state (new process, new initialization)
+- Chunk resume provides continuity across re-invocations
+
+---
+
+## 6. Execution-Model-Specific Behavior
+
+### 6.1 One-Shot Retry Characteristics
+
+| Aspect | Behavior |
+|--------|----------|
+| XConf retry | Built-in loop (up to retry_count) |
+| Download retry | NOT built-in; binary must be re-invoked |
+| Flash retry | NOT built-in; binary must be re-invoked |
+| Abort → retry | SIGUSR1 aborts; external re-invocation needed |
+| Throttle-zero → retry | Process exits; external re-invocation needed |
+| Resume on re-invocation | Chunk resume detects partial file automatically |
+| Crash recovery | Next invocation detects indicators and adjusts behavior |
+
+### 6.2 Daemon Retry Characteristics
+
+| Aspect | Behavior |
+|--------|----------|
+| XConf retry | Worker-level; client can re-invoke CheckForUpdate |
+| Download retry | Client can re-invoke DownloadFirmware after error signal |
+| Flash retry | Client can re-invoke UpdateFirmware after error signal |
+| Abort → retry | Download aborted → guard reset → client can retry immediately |
+| Throttle-zero → retry | Download error signaled → client can retry |
+| Resume on re-download | Chunk resume available if partial file exists |
+| Daemon crash recovery | systemd restarts; clients must re-register |
+
+### 6.3 Comparison Table
+
+| Recovery Scenario | One-Shot | Daemon |
+|-------------------|----------|--------|
+| Network failure during XConf | Retry loop (built-in) | Error signal; client retries |
+| Network failure during download | Exit; external re-invocation + chunk resume | Error signal; client re-invokes + chunk resume |
+| Throttle to zero | Exit; external re-invocation | Error signal; client re-invokes |
+| SIGUSR1 abort | Exit; external re-invocation | Download aborted; daemon stays alive |
+| Process crash | systemd/MM re-invokes; crash recovery detects | systemd restarts; clients re-register |
+| Flash failure | Exit; external re-invocation | Error signal; client re-invokes |
+| Daemon crash (not applicable to one-shot) | N/A | systemd restarts; all state lost |
+
+---
+
+## 7. State Persistence for Recovery
+
+```mermaid
+flowchart TD
+    subgraph "Persistent State (survives crash)"
+        PID["/tmp/DIFD.pid<br/>PID of running instance"]
+        REBOOT["/tmp/fw_preparing_to_reboot<br/>Flash in progress indicator"]
+        STATUS["/opt/fwdnldstatus.txt<br/>Last operation status"]
+        FLAG["Upgrade flag file<br/>/tmp/.imageDnldInProgress"]
+        PARTIAL["Partial firmware file<br/>/opt/fw/*.bin (incomplete)"]
+    end
+    
+    subgraph "Recovery on Next Start"
+        DETECT["Orchestrator startup<br/>initialValidation()"]
+    end
+    
+    PID -->|"Process alive?"| DETECT
+    REBOOT -->|"Flash was in progress"| DETECT
+    STATUS -->|"Last known status"| DETECT
+    FLAG -->|"Download was active"| DETECT
+    PARTIAL -->|"Resume available"| DETECT
+    
+    DETECT -->|"PID alive"| SKIP["Skip: another instance running"]
+    DETECT -->|"Reboot pending"| COMPLETE["Report DWNL_COMPLETED"]
+    DETECT -->|"Flag + partial"| RESUME["Resume on next download trigger"]
+```
+
+---
+
+## 8. Operational Invariants
+
+| Invariant | Enforcement |
+|-----------|-------------|
+| Retry count bounds XConf attempts | Loop counter compared against `retry_count` argument |
+| Fallback chain is ordered | Code path sequences mTLS → direct → Codebig |
+| Chunk resume requires partial file | Existence + non-zero size check before Range header |
+| Crash indicators are file-based | Persists across process crash/restart |
+| Only one recovery path taken per start | Decision tree in `initialValidation()` is exclusive |
+| Partial file integrity not validated | Resume appends without verifying existing bytes |
+
+---
+
+## 9. Safety Guarantees
+
+| Guarantee | Mechanism |
+|-----------|-----------|
+| No infinite retry loops | `retry_count` bounds XConf retries; other layers are single-attempt |
+| No data corruption from resume | Append-only write; Content-Length validation at end |
+| Crash state detected on restart | Persistent indicator files in `/tmp/` and `/opt/` |
+| No duplicate flash on crash recovery | `fw_preparing_to_reboot` means flash already happened |
+| Graceful degradation on fallback failure | Each fallback returns error; caller receives final error |
+
+---
+
+## 10. Failure Semantics (This Subsystem)
+
+| Failure Mode | Impact | Recovery Available |
+|--------------|--------|-------------------|
+| All XConf retries exhausted | No update determination possible | External re-invocation |
+| All fallback paths fail | Download impossible | External re-invocation (may succeed if transient) |
+| Partial file corrupted | Resume appends to bad data; final size check may catch | Delete partial file + fresh download |
+| Crash indicator stale (process died without cleanup) | Next instance may make wrong recovery decision | PID file validation (check if process alive) |
+| STATUS_FILE corrupted | External monitoring has wrong state | Overwritten on next operation |
+
+---
+
+## 11. Observability Expectations
+
+| Observable | Mechanism | Purpose |
+|------------|-----------|---------|
+| XConf retry count | T2 metrics / logging | Detect servers with poor connectivity |
+| Fallback path taken | T2 metrics (mTLS/direct/Codebig) | Detect certificate issues |
+| Resume occurred | Logging (file size at start > 0) | Track resumption frequency |
+| Crash recovery triggered | Logging + IARM event | Detect instability |
+| Final failure after retries | Exit code (one-shot) / error signal (daemon) | Alert monitoring systems |
+
+---
+
+## 12. External Dependencies
+
+| Dependency | Nature | Recovery Impact |
+|------------|--------|----------------|
+| Filesystem (tmpfs for /tmp/) | Crash indicators | tmpfs survives process crash but not reboot |
+| Filesystem (/opt/) | Partial downloads, status file | Persistent across reboot |
+| CDN server | HTTP Range support | Resume requires server to support 206 Partial Content |
+| Maintenance Manager | Re-invocation trigger | One-shot retry depends on external re-trigger |
+| systemd | Daemon restart | Daemon restart is automatic on crash |
+
+---
+
+## 13. Threading / Event-Loop Expectations
+
+| Operation | One-Shot Thread | Daemon Thread |
+|-----------|----------------|---------------|
+| XConf retry loop | Main thread (blocking) | XConf GTask worker |
+| Fallback chain | Main thread (blocking) | Download GTask worker |
+| Chunk resume | Main thread (blocking) | Download GTask worker |
+| Crash recovery check | Main thread (during init) | Main thread (during init) |
+| STATUS_FILE writes | Main thread | Worker thread (any) |
+
+---
+
+## 14. Assumptions and Unknowns
+
+### Verified Assumptions
+
+- [VERIFIED] XConf retry is bounded by `retry_count` from argv[1]
+- [VERIFIED] Chunk resume uses HTTP Range header with byte offset
+- [VERIFIED] `/tmp/fw_preparing_to_reboot` is the primary flash-in-progress indicator
+- [VERIFIED] PID file at `/tmp/DIFD.pid` is used for instance detection
+- [VERIFIED] Fallback chain order: mTLS → direct → Codebig (each once)
+- [VERIFIED] Download engine does NOT retry internally (single attempt per path)
+
+### Inferred Behavior
+
+- [INFERRED] CDN servers support HTTP 206 Partial Content for Range requests
+- [INFERRED] Maintenance Manager re-invokes on failure (external retry)
+- [INFERRED] Partial file remains valid across reboots (stored in /opt/, not tmpfs)
+- [INFERRED] XConf retry includes some backoff delay between attempts
+- [INFERRED] systemd `Restart=on-failure` provides daemon recovery
+
+### Unresolved Unknowns
+
+- [UNKNOWN] Exact backoff strategy for XConf retries (fixed? exponential? jitter?)
+- [UNKNOWN] Whether partial file integrity is ever validated (checksum, signature)
+- [UNKNOWN] Maximum age of partial file before it's considered stale
+- [UNKNOWN] Whether Content-Length mismatch triggers file deletion and fresh download
+- [UNKNOWN] Maintenance Manager retry interval and maximum attempts
+- [UNKNOWN] Whether client-sdk provides any timeout/retry assistance to applications
+- [UNKNOWN] Behavior when CDN doesn't support Range (returns 200 instead of 206)
+
+---
+
+## ADDED Requirements (from direct-cdn-parity-guards)
+
+### Requirement: HTTP 403 classified as retryable for Direct CDN per-artifact downloads
+The per-artifact download error classification SHALL treat HTTP 403 as a transient retryable error (`DIRECT_CDN_RETRY_ERR`) when operating in Direct CDN per-artifact mode. This enables the `DirectCDNDownload()` retry loop to re-query XConf for fresh token-bearing URLs.
+
+#### Scenario: HTTP 403 triggers retry with XConf re-query
+- **WHEN** a per-artifact download receives HTTP 403 response
+- **THEN** `checkTriggerUpgrade()` SHALL return `DIRECT_CDN_RETRY_ERR`
+- **AND** the `DirectCDNDownload()` orchestrator SHALL re-query XConf on the next iteration to obtain fresh per-artifact URLs
+
+#### Scenario: HTTP 403 respects maximum retry count
+- **WHEN** per-artifact downloads receive HTTP 403 on all retry iterations
+- **THEN** the orchestrator SHALL fail permanently after 3 total iterations (existing retry cap)
+
+#### Scenario: HTTP 404 remains permanent failure (unchanged)
+- **WHEN** a per-artifact download receives HTTP 404 response
+- **THEN** `checkTriggerUpgrade()` SHALL return -1 (permanent failure, non-retryable)
+
+---
+
+## ADDED Requirements (from direct-cdn-adoption)
+
+### Requirement: Direct CDN per-artifact selective retry
+The Direct CDN orchestrator SHALL implement a per-artifact retry mechanism: only artifacts that failed with a transient error are re-attempted on subsequent iterations.
+
+#### Scenario: Successful artifact not re-attempted
+- **WHEN** PCI download succeeds on iteration 1 but PDRI fails with a transient error
+- **THEN** on iteration 2 the orchestrator SHALL skip PCI and only re-attempt PDRI
+
+#### Scenario: Maximum 3 retry iterations
+- **WHEN** an artifact fails with a transient error on all iterations
+- **THEN** the orchestrator SHALL attempt at most 3 total iterations before declaring failure
+
+#### Scenario: Both PCI and PDRI succeed stops retry loop
+- **WHEN** both PCI and PDRI downloads succeed within a retry iteration
+- **THEN** the orchestrator SHALL exit the retry loop immediately regardless of peripheral status
+
+### Requirement: Transient vs permanent failure classification
+The per-artifact download mode SHALL classify errors as transient (retryable) or permanent (non-retryable) based on the curl error code.
+
+#### Scenario: Connection timeout is transient
+- **WHEN** `rdkv_upgrade_request()` returns `CURLE_OPERATION_TIMEDOUT`
+- **THEN** the per-artifact caller SHALL return `DIRECT_CDN_RETRY_ERR` (retryable)
+
+#### Scenario: Connection refused is transient
+- **WHEN** `rdkv_upgrade_request()` returns `CURLE_COULDNT_CONNECT`
+- **THEN** the per-artifact caller SHALL return `DIRECT_CDN_RETRY_ERR` (retryable)
+
+#### Scenario: Receive error is transient
+- **WHEN** `rdkv_upgrade_request()` returns `CURLE_RECV_ERROR`
+- **THEN** the per-artifact caller SHALL return `DIRECT_CDN_RETRY_ERR` (retryable)
+
+#### Scenario: HTTP 404 is permanent
+- **WHEN** the HTTP response code is 404
+- **THEN** the per-artifact caller SHALL return -1 (non-retryable, permanent failure)
+
+### Requirement: XConf re-query per retry iteration
+The Direct CDN orchestrator SHALL perform a fresh XConf query on each retry iteration to obtain current per-artifact URLs.
+
+#### Scenario: Fresh XConf data per iteration
+- **WHEN** the retry loop begins a new iteration
+- **THEN** it SHALL call `rdkv_upgrade_request()` with `XCONF_UPGRADE` type and re-parse the response before attempting per-artifact downloads
+
+### Requirement: Peripheral failure does not block overall success
+Peripheral download failure SHALL NOT prevent the overall `DirectCDNDownload()` from reporting success, provided PCI and PDRI both succeeded.
+
+#### Scenario: PCI+PDRI success with peripheral failure
+- **WHEN** PCI and PDRI downloads succeed but peripheral download fails
+- **THEN** `DirectCDNDownload()` SHALL return 0 (success)
+
+#### Scenario: Peripheral retried within loop but non-blocking
+- **WHEN** peripheral download fails on one iteration
+- **THEN** it SHALL be re-attempted on subsequent iterations but SHALL NOT contribute to the retry-gate condition
diff --git a/openspec/specs/test-mock-isolation/spec.md b/openspec/specs/test-mock-isolation/spec.md
new file mode 100755
index 00000000..483a57b2
--- /dev/null
+++ b/openspec/specs/test-mock-isolation/spec.md
@@ -0,0 +1,38 @@
+# Subsystem Specification: test-mock-isolation
+
+> **Subsystem:** Test Mock Isolation  
+> **Type:** Testing Infrastructure  
+> **Scope:** Unit test suite  
+> **Evidence Level:** Verified from `unittest/basic_rdkv_main_gtest.cpp`, `unittest/Makefile.am`
+
+---
+
+## 1. Purpose
+
+The `test-mock-isolation` specification defines the contracts for proper mock lifecycle management in the L1 unit test suite, ensuring that global mock pointers do not leak between tests and that build artifacts are coherent.
+
+---
+
+## 2. Requirements
+
+### Requirement: Stack-local DeviceUtilsMock cleanup
+Every TEST() in `basic_rdkv_main_gtest.cpp` that assigns `g_DeviceUtilsMock` to a stack-local `DeviceUtilsMock` object SHALL reset `g_DeviceUtilsMock = nullptr` before the test function returns.
+
+#### Scenario: flashImageTestMaintFalse does not leave dangling pointer
+- **WHEN** `flashImageTestMaintFalse` completes
+- **THEN** `g_DeviceUtilsMock` SHALL be `nullptr`
+
+#### Scenario: getXconfResTest succeeds after flashImage tests
+- **WHEN** `getXconfResTest` runs after any `flashImage*` test
+- **THEN** `isDirectCDNEnabled()` SHALL encounter `g_DeviceUtilsMock == nullptr`, return `false`, and the test SHALL pass without segfault
+
+#### Scenario: All flashImage tests reset mock pointer
+- **WHEN** any of `flashImageTest`, `flashImageTestRedState`, `flashImageTestFail`, `flashImageTestFail1`, `flashImageTestFail2`, `flashImageTestRebootTrue`, `flashImageTestPdri`, `flashImageTestMaintTrue`, or `flashImageTestMaintFalse` completes
+- **THEN** `g_DeviceUtilsMock` SHALL be `nullptr`
+
+### Requirement: No phantom bin_PROGRAMS without sources
+Every entry in `bin_PROGRAMS` in `unittest/Makefile.am` SHALL have a corresponding `_SOURCES` definition.
+
+#### Scenario: Phantom programs removed
+- **WHEN** `make` is invoked in the unittest directory
+- **THEN** automake SHALL NOT emit "No rule to make target" errors for any program listed in `bin_PROGRAMS`
diff --git a/openspec/specs/updater-execution/spec.md b/openspec/specs/updater-execution/spec.md
new file mode 100755
index 00000000..0a9d6eff
--- /dev/null
+++ b/openspec/specs/updater-execution/spec.md
@@ -0,0 +1,415 @@
+# Subsystem Specification: updater-execution
+
+> **Subsystem:** One-Shot Firmware Update Execution Model (`rdkvfwupgrader`)  
+> **Type:** Core Runtime — Execution Model Orchestrator  
+> **Scope:** One-shot-specific (binary: `rdkvfwupgrader`)  
+> **Evidence Level:** Verified from `src/rdkv_main.c`, `Makefile.am`  
+> **Cross-references:** [runtime/rdkvfwupgrader-sequence.md](../../runtime/rdkvfwupgrader-sequence.md), [subsystems/subsystem-inventory.md §10](../../subsystems/subsystem-inventory.md)
+
+---
+
+## 1. Purpose
+
+The `updater-execution` subsystem defines the behavioral contract for the one-shot firmware update execution model. It orchestrates the complete firmware update lifecycle as a single linear, start-to-exit pipeline: initialization → validation → XConf query → download → flash → cleanup → exit.
+
+This subsystem is the authoritative entry point for the maintenance-manager-driven firmware update workflow. It owns process lifecycle, global state initialization, and the sequencing of shared subsystem calls.
+
+---
+
+## 2. What This Subsystem Owns
+
+- Process lifecycle from `main()` entry to `exit()`
+- Argument parsing and trigger-type classification
+- Global state variable initialization (`device_info`, `rfc_list`, `curl`, `force_exit`)
+- Multi-firmware sequencing (PCI → PDRI → Peripheral)
+- Signal handling (`SIGUSR1` → graceful abort)
+- Exit code semantics
+- Maintenance Manager integration (mode query, status reporting)
+- PID file lifecycle for single-instance enforcement
+
+## 3. What This Subsystem Does NOT Own
+
+- HTTP download mechanics (owned by `download-engine`)
+- Flash I/O operations (owned by `firmware-validation` post-download)
+- D-Bus service (daemon-only)
+- Client API surface (daemon ecosystem)
+- Concurrency control beyond PID-file single-instance guard
+- Retry policy (caller decides whether to re-invoke the binary)
+
+---
+
+## 4. Responsibilities
+
+| Responsibility | Behavioral Contract |
+|----------------|-------------------|
+| Process initialization | MUST initialize logging, signal handlers, device identity, RFC settings, and IARM before any firmware operations |
+| Argument validation | MUST reject invocations with fewer than 3 arguments (exit code 1) |
+| Trigger type classification | MUST support trigger types: 2 (scheduled), 3 (TR-69/SNMP), 4 (application) |
+| Instance exclusion | MUST check PID file; if another instance is running, report DWNL_INPROGRESS and exit cleanly |
+| XConf query | MUST construct device identity payload and execute blocking HTTP POST to XConf server |
+| Multi-firmware sequencing | MUST process PCI first, then PDRI (with 30s delay after PCI), then all Peripheral images |
+| Signal handling | MUST intercept SIGUSR1, set `force_exit=1`, and abort active curl transfer |
+| Exit code propagation | MUST exit with curl error code on download failure, 0 on success, 1 on initialization failure |
+| Cleanup guarantee | MUST call `uninitialize()` on all exit paths (normal and error) |
+| IARM state events | MUST emit firmware state transitions (REQUESTING → DOWNLOADING → FLASHING → COMPLETE) |
+
+---
+
+## 5. Runtime Lifecycle
+
+```mermaid
+stateDiagram-v2
+    [*] --> INIT : main() entry
+    INIT --> VALIDATE : initialize() success
+    INIT --> EXIT_FATAL : initialize() failure
+    
+    VALIDATE --> XCONF_QUERY : validation passed
+    VALIDATE --> EXIT_SKIP : DWNL_INPROGRESS (another instance)
+    VALIDATE --> EXIT_SKIP : DWNL_COMPLETED (pending reboot)
+    VALIDATE --> EXIT_FATAL : INITIAL_VALIDATION_FAIL
+    
+    XCONF_QUERY --> DOWNLOAD_PCI : PCI upgrade available
+    XCONF_QUERY --> DOWNLOAD_PDRI : no PCI, PDRI available
+    XCONF_QUERY --> DOWNLOAD_PERIPHERAL : only peripherals
+    XCONF_QUERY --> EXIT_NO_UPDATE : no updates available
+    
+    DOWNLOAD_PCI --> FLASH_PCI : download complete
+    FLASH_PCI --> DOWNLOAD_PDRI : PDRI available (after 30s)
+    FLASH_PCI --> EXIT_SUCCESS : no PDRI needed
+    
+    DOWNLOAD_PDRI --> FLASH_PDRI : download complete
+    FLASH_PDRI --> DOWNLOAD_PERIPHERAL : peripherals available
+    FLASH_PDRI --> EXIT_SUCCESS : no peripherals
+    
+    DOWNLOAD_PERIPHERAL --> EXIT_SUCCESS : all peripherals done
+    
+    EXIT_FATAL --> [*] : uninitialize() + exit(1)
+    EXIT_SKIP --> [*] : uninitialize() + exit(0)
+    EXIT_NO_UPDATE --> [*] : uninitialize() + exit(0)
+    EXIT_SUCCESS --> [*] : uninitialize() + exit(0)
+    
+    DOWNLOAD_PCI --> EXIT_ABORT : SIGUSR1 or throttle-zero
+    DOWNLOAD_PDRI --> EXIT_ABORT : SIGUSR1 or throttle-zero
+    EXIT_ABORT --> [*] : uninitialize() + exit(curl_error)
+```
+
+---
+
+## 6. Interaction Contracts
+
+### 6.1 Inbound Interactions
+
+| Source | Mechanism | Contract |
+|--------|-----------|----------|
+| Maintenance Manager | `fork+exec` with arguments `<retry_count> <trigger_type>` | Binary MUST accept exactly these positional args |
+| Maintenance Manager | IARM `DwnlStopEventHandler` callback | Callback MUST set download speed to 0 (abort) or throttle value |
+| External signal | `SIGUSR1` | MUST gracefully abort current download and exit |
+
+### 6.2 Outbound Interactions
+
+| Target | Mechanism | Contract |
+|--------|-----------|----------|
+| XConf Server | HTTP POST via `download-engine` | Blocking; caller waits for response |
+| CDN / HTTP | HTTP GET via `download-engine` | Blocking; may take minutes |
+| Flash HAL | `flashImage()` via `librdksw_flash` | Blocking; returns status |
+| IARM Bus | `eventManager()` via `librdksw_iarmIntf` | Fire-and-forget event broadcast |
+| Thunder JSON-RPC | `getJsonRpc()` to `localhost:9998` | Blocking HTTP POST (50-200ms) |
+| Filesystem | PID file, status file, upgrade flag | Direct file I/O |
+| Telemetry (T2) | `t2CountNotify()` | Fire-and-forget metric increment |
+
+---
+
+## 7. Exposed Interfaces / APIs
+
+This subsystem exposes no programmatic API. It is a standalone binary entry point.
+
+### Exit Code Contract
+
+| Exit Code | Meaning |
+|-----------|---------|
+| `0` | Success, or no update needed, or graceful skip |
+| `1` | Initialization failure, invalid arguments |
+| `curl_error_code` | Download failure (propagates curl error) |
+
+### Argument Contract
+
+```
+rdkvfwupgrader <retry_count> <trigger_type>
+```
+
+| Arg | Type | Required | Semantics |
+|-----|------|----------|-----------|
+| `retry_count` | integer | Yes | Number of XConf query retries before failure |
+| `trigger_type` | integer | Yes | 2=scheduled, 3=TR-69/SNMP, 4=application |
+
+---
+
+## 8. Shared-Library Dependencies
+
+| Library | Usage |
+|---------|-------|
+| `librdksw_upgrade.so` | `rdkv_upgrade_request()` — HTTP download engine |
+| `librdksw_jsonparse.so` | `createJsonString()`, `processJsonResponse()` — XConf payload |
+| `librdksw_flash.so` | `flashImage()` — firmware flashing |
+| `librdksw_rfcIntf.so` | `getRFCSettings()` — RFC configuration |
+| `librdksw_iarmIntf.so` | `eventManager()`, `init_event_handler()` — IARM events |
+| `librdksw_fwutils.so` | `getDeviceProperties()`, `getImageDetails()` — device identity |
+
+---
+
+## 9. Execution-Model-Specific Behavior
+
+### 9.1 rdkvfwupgrader (This Subsystem)
+
+| Behavior | Detail |
+|----------|--------|
+| Threading model | Single-threaded; all operations block main thread |
+| XConf query | Direct `MakeXconfComms()` — no caching, no deduplication |
+| Download → Flash | Chained when `download_only == 0` (default in one-shot) |
+| Multiple firmware types | Sequential pipeline: PCI → sleep(30) → PDRI → Peripherals |
+| Abort mechanism | `SIGUSR1` sets `force_exit`, `curl_easy_cleanup()` aborts transfer |
+| Exit behavior | Always exits; never loops or waits for events |
+| State Red recovery | Detects boot-time recovery state, emits RED_RECOVERY events |
+| Throttle-to-zero | Treated as fatal abort (sets `force_exit`, exits) |
+
+### 9.2 rdkFwupdateMgr Contrast
+
+| Aspect | One-Shot | Daemon |
+|--------|----------|--------|
+| Lifecycle | Start → exit | Indefinite (systemd-managed) |
+| Threading | Single thread | GLib main loop + GTask pool |
+| Download mode | `download_only=0` (auto-flash) | `download_only=1` (decouple) |
+| XConf | Direct, blocking, no cache | Cached, async worker, piggyback |
+| Failure response | Exit with error code | Log error, continue serving |
+| Multi-firmware | Built-in PCI→PDRI→Peripheral | Client initiates each individually |
+| Throttle-to-zero | Exit | Abort download, signal error, stay alive |
+
+---
+
+## 10. Threading / Event-Loop Expectations
+
+**[VERIFIED]** `rdkvfwupgrader` is strictly single-threaded:
+
+- No GLib main loop
+- No worker threads
+- No async callbacks (except IARM `DwnlStopEventHandler` delivered on IARM's internal thread)
+- Signal handler (`SIGUSR1`) is the only concurrency primitive
+- All shared library calls are made synchronously from `main()`
+
+### Thread Safety Implications
+
+- Shared libraries MUST NOT assume multi-threaded context when called from one-shot
+- Global state (`device_info`, `rfc_list`, `curl`) is written once during `initialize()` and read thereafter
+- `force_exit` is written by signal handler (atomic write assumed) and read by curl progress callback
+- `DwnlState` mutex exists but is effectively uncontested in single-threaded mode
+
+---
+
+## 11. Operational Invariants
+
+| Invariant | Enforcement |
+|-----------|-------------|
+| At most one `rdkvfwupgrader` instance per device | PID file check (`CurrentRunningInst("/tmp/DIFD.pid")`) |
+| Initialize before operate | `initialize()` MUST complete before any firmware operation |
+| Cleanup on all paths | `uninitialize()` MUST be called before `exit()` — verified on all 8+ exit paths |
+| Download before flash | `flashImage()` MUST NOT be called without a successful download |
+| PCI before PDRI | PDRI download MUST NOT occur without PCI completion or PCI being unnecessary |
+| Signal handler is reentrant-safe | Handler only sets a flag and calls `curl_easy_cleanup()` — no heap allocation |
+
+---
+
+## 12. Safety Guarantees
+
+| Guarantee | Mechanism |
+|-----------|-----------|
+| No concurrent firmware modifications | PID file exclusion + `isUpgradeInProgress()` check |
+| Graceful abort capability | `SIGUSR1` → `force_exit` → curl abort → cleanup → exit |
+| Crash recovery indicators | `/tmp/fw_preparing_to_reboot` survives crashes; next invocation detects it |
+| Download progress tracking | `STATUS_FILE` persists progress for external monitoring |
+| No silent failure | All error paths emit IARM events and/or T2 metrics before exit |
+
+---
+
+## 13. Failure Semantics
+
+| Failure Mode | Behavior | Exit Code |
+|--------------|----------|-----------|
+| `initialize()` failure | Log error, exit immediately | 1 |
+| Invalid arguments | Log error, exit immediately | 1 |
+| PID file conflict | Report `DWNL_INPROGRESS`, skip upgrade, exit | 0 |
+| XConf HTTP error | Retry up to `retry_count` times, then exit | curl error |
+| XConf: no update available | Report via IARM, exit | 0 |
+| Download failure (network) | Exit with curl error code | curl error |
+| Download failure (throttle-zero) | Exit with `RDKV_UPGRADE_ERROR_THROTTLE_ZERO` | 1 |
+| Flash failure | Log error, report via IARM, exit | non-zero |
+| `SIGUSR1` during download | Abort curl, cleanup, exit | curl error |
+
+---
+
+## 14. Retry / Recovery Behavior
+
+**[VERIFIED]** The one-shot binary itself does NOT implement retry logic for downloads. Recovery semantics:
+
+| Mechanism | Behavior |
+|-----------|----------|
+| XConf query retry | Built-in: retries up to `retry_count` (from argv[1]) with backoff |
+| Download retry | NOT implemented internally — caller (Maintenance Manager) re-invokes binary |
+| Chunk resume | Supported: partial downloads can be resumed on next invocation if file exists |
+| Crash recovery | `/tmp/fw_preparing_to_reboot` detected on restart → reports DWNL_COMPLETED |
+| State Red | Special boot-time recovery path activated by `isInStateRed()` |
+
+---
+
+## 15. Observability Expectations
+
+| Observable | Mechanism | Consumer |
+|------------|-----------|----------|
+| Firmware state transitions | IARM events (`FW_STATE_*`) | System event bus listeners |
+| Download progress | `STATUS_FILE` (`/opt/fwdnldstatus.txt`) | External monitoring tools |
+| Maintenance status | IARM events (`MaintenanceMGR`, `MAINT_FWDOWNLOAD_*`) | Maintenance Manager |
+| Error classification | T2 metrics (`SYST_ERR_*`, `SYST_INFO_*`) | Cloud telemetry |
+| Process existence | PID file (`/tmp/DIFD.pid`) | Other binaries, operators |
+| Exit code | Process exit status | Invoking process (systemd/cron/MM) |
+
+---
+
+## 16. External Dependencies
+
+| Dependency | Nature | Failure Impact |
+|------------|--------|----------------|
+| XConf cloud server | Network (HTTPS POST) | Cannot determine if update exists |
+| CDN / firmware server | Network (HTTP/HTTPS GET) | Cannot download firmware |
+| IARM Bus daemon | IPC (local socket) | Cannot broadcast state events |
+| Thunder framework | HTTP (localhost:9998) | Cannot query maintenance mode |
+| `/etc/device.properties` | File (read-only) | Cannot identify device → exit |
+| RFC settings (librfcapi) | File/IPC | Defaults used if unavailable |
+| Curl library | Runtime linkage | Fatal: cannot perform any HTTP |
+
+---
+
+## 17. Assumptions and Unknowns
+
+### Verified Assumptions
+
+- [VERIFIED] Single-threaded execution model
+- [VERIFIED] `initialize()` is shared code between one-shot and daemon
+- [VERIFIED] All exit paths call `uninitialize()`
+- [VERIFIED] PID file is authoritative for instance detection
+- [VERIFIED] `download_only` is always 0 in one-shot mode
+
+### Inferred Behavior
+
+- [INFERRED] Maintenance Manager re-invokes binary on failure (external retry)
+- [INFERRED] `retry_count` argument drives XConf-query-level retries, not download retries
+- [INFERRED] 30-second delay between PCI and PDRI prevents flash bus contention
+
+### Unresolved Unknowns
+
+- [UNKNOWN] Exact conditions under which `isInStateRed()` returns true
+- [UNKNOWN] Whether `getJsonRpc()` failure is fatal or degraded-mode
+- [UNKNOWN] Maximum expected firmware image size and download duration
+- [UNKNOWN] Whether peripheral firmware download failures are fatal to the overall pipeline
+
+---
+
+## 18. Sequence Diagram — Complete One-Shot Lifecycle
+
+```mermaid
+sequenceDiagram
+    participant CALLER as Maintenance Manager
+    participant PROC as rdkvfwupgrader
+    participant SHARED as Shared Libraries
+    participant XCONF as XConf Server
+    participant CDN as CDN Server
+    participant IARM as IARM Bus
+
+    CALLER->>PROC: exec(rdkvfwupgrader, retry_count, trigger_type)
+    activate PROC
+    
+    rect rgb(240, 248, 255)
+        Note over PROC: INITIALIZATION PHASE
+        PROC->>SHARED: initialize() [device_info, rfc, IARM]
+        SHARED-->>PROC: globals populated
+    end
+    
+    rect rgb(255, 248, 240)
+        Note over PROC: VALIDATION PHASE
+        PROC->>PROC: initialValidation() [PID check, RFC exclusion]
+        alt conflict detected
+            PROC->>IARM: eventManager(status)
+            PROC->>PROC: exit(0)
+        end
+    end
+    
+    rect rgb(240, 255, 240)
+        Note over PROC: XCONF PHASE
+        PROC->>IARM: eventManager(FW_STATE_REQUESTING)
+        PROC->>SHARED: createJsonString() → payload
+        PROC->>XCONF: rdkv_upgrade_request(XCONF_UPGRADE)
+        XCONF-->>PROC: JSON response
+        PROC->>SHARED: processJsonResponse()
+    end
+    
+    rect rgb(255, 240, 255)
+        Note over PROC: DOWNLOAD + FLASH PHASE (per firmware type)
+        PROC->>IARM: eventManager(FW_STATE_DOWNLOADING)
+        PROC->>CDN: rdkv_upgrade_request(PCI_UPGRADE)
+        CDN-->>PROC: firmware binary
+        PROC->>IARM: eventManager(FW_STATE_FLASHING)
+        PROC->>SHARED: flashImage()
+        SHARED-->>PROC: flash status
+    end
+    
+    rect rgb(248, 248, 248)
+        Note over PROC: CLEANUP PHASE
+        PROC->>IARM: eventManager(MaintenanceMGR, COMPLETE)
+        PROC->>PROC: uninitialize()
+        PROC->>CALLER: exit(0)
+    end
+    deactivate PROC
+```
+
+---
+
+## ADDED Requirements (from direct-cdn-adoption)
+
+### Requirement: checkTriggerUpgrade supports per-artifact mode
+The `checkTriggerUpgrade()` function SHALL accept an `upgrade_type` parameter that specifies whether to process all artifact types (legacy) or a single specific artifact type (per-artifact mode).
+
+#### Scenario: Legacy mode (upgrade_type = 0)
+- **WHEN** `checkTriggerUpgrade(response, model, 0)` is called
+- **THEN** the function SHALL process all available artifact types sequentially (PCI → PDRI → Peripheral) using existing behavior
+
+#### Scenario: Per-artifact mode (upgrade_type = PCI_UPGRADE)
+- **WHEN** `checkTriggerUpgrade(response, model, PCI_UPGRADE)` is called
+- **THEN** the function SHALL process only the PCI firmware download using `response->firmwareUrl`
+
+#### Scenario: Per-artifact mode (upgrade_type = PDRI_UPGRADE)
+- **WHEN** `checkTriggerUpgrade(response, model, PDRI_UPGRADE)` is called
+- **THEN** the function SHALL process only the PDRI firmware download using `response->pdriUrl`
+
+#### Scenario: Per-artifact mode (upgrade_type = PERIPHERAL_UPGRADE)
+- **WHEN** `checkTriggerUpgrade(response, model, PERIPHERAL_UPGRADE)` is called
+- **THEN** the function SHALL process only the peripheral firmware download using `response->remCtrlUrl`
+
+### Requirement: One-shot branching on Direct CDN
+The one-shot binary `rdkvfwupgrader` SHALL branch its firmware update pipeline based on `isDirectCDNEnabled()` after initial validation.
+
+#### Scenario: Direct CDN path replaces legacy orchestration
+- **WHEN** initial validation passes and `isDirectCDNEnabled()` returns true
+- **THEN** the one-shot binary SHALL call `DirectCDNDownload()` instead of the legacy `MakeXconfComms()` → `processJsonResponse()` → `checkTriggerUpgrade(..., 0)` sequence
+
+#### Scenario: Legacy path preserved when disabled
+- **WHEN** initial validation passes and `isDirectCDNEnabled()` returns false
+- **THEN** the one-shot binary SHALL execute the existing legacy path unchanged: `MakeXconfComms()` → `processJsonResponse()` → `checkTriggerUpgrade(response, model, 0)`
+
+### Requirement: DirectCDNDownload is a new source file
+The `DirectCDNDownload()` orchestrator SHALL be implemented in a separate source file `src/directcdn.c` and linked into the `rdkvfwupgrader` binary via `Makefile.am`.
+
+#### Scenario: Build system includes directcdn.c
+- **WHEN** the project is compiled
+- **THEN** `src/directcdn.c` SHALL be included in `rdkvfwupgrader_SOURCES` in `Makefile.am`
+
+#### Scenario: Function callable from one-shot and daemon
+- **WHEN** `DirectCDNDownload()` is declared in a header
+- **THEN** both the one-shot binary and daemon binary SHALL be able to call it
diff --git a/openspec/subsystems/client-library.md b/openspec/subsystems/client-library.md
new file mode 100755
index 00000000..5c407e24
--- /dev/null
+++ b/openspec/subsystems/client-library.md
@@ -0,0 +1,215 @@
+# Client Library Architecture — `librdkFwupdateMgr.so`
+
+> **Evidence Level:** Facts verified from source code unless noted otherwise  
+> **Sources:** `librdkFwupdateMgr/src/`, `librdkFwupdateMgr/include/rdkFwupdateMgr_client.h`
+
+---
+
+## 1. Purpose
+
+`librdkFwupdateMgr.so` is a C shared library that provides a simple, callback-based API for client applications to perform firmware operations (check, download, flash) without direct D-Bus knowledge. The library:
+
+- Abstracts D-Bus protocol details behind a plain C API
+- Manages a background GLib event loop thread for receiving D-Bus signals
+- Provides callback registries for asynchronous result delivery
+- Handles connection lifecycle (ephemeral connections for method calls, persistent connection for signals)
+
+---
+
+## 2. Public API Surface
+
+**Header:** `rdkFwupdateMgr_client.h`
+
+### 2.1 Registration
+
+```c
+FirmwareInterfaceHandle registerProcess(const char *processName, const char *libVersion);
+void unregisterProcess(FirmwareInterfaceHandle handler);
+```
+
+- **[FACT]** `registerProcess()` makes a synchronous D-Bus call to the daemon's `RegisterProcess` method
+- **[FACT]** Returns a string handle (e.g., `"1"`) allocated by the library; caller must not free it
+- **[FACT]** Internally calls `internal_system_init()` to start the background thread on first invocation
+- **[FACT]** `unregisterProcess()` makes a synchronous D-Bus call, then frees the handle
+
+### 2.2 Firmware Check
+
+```c
+CheckForUpdateResult checkForUpdate(FirmwareInterfaceHandle handle, UpdateEventCallback callback);
+```
+
+- **[FACT]** Non-blocking fire-and-forget call; returns `CHECK_FOR_UPDATE_SUCCESS` immediately
+- **[FACT]** Registers callback in `g_registry` before sending D-Bus call (prevents signal race)
+- **[FACT]** Uses ephemeral D-Bus connection (created and destroyed per call)
+- **[FACT]** Callback fires exactly once when `CheckForUpdateComplete` signal arrives
+- **[FACT]** Callback receives `const FwInfoData*` with version info and `UpdateDetails` struct
+
+### 2.3 Download
+
+```c
+DownloadResult downloadFirmware(FirmwareInterfaceHandle handle, const FwDwnlReq *fwdwnlreq, DownloadCallback callback);
+```
+
+- **[FACT]** Non-blocking; callback fires repeatedly with progress (0-100%)
+- **[FACT]** Uses separate `g_dwnl_registry` from checkForUpdate's registry
+- **[FACT]** Callback transitions: `DWNL_IN_PROGRESS` → `DWNL_COMPLETED` or `DWNL_ERROR`
+- **[FACT]** Slot stays ACTIVE across multiple signals, resets to IDLE on terminal status
+
+### 2.4 Flash/Update
+
+```c
+UpdateResult updateFirmware(FirmwareInterfaceHandle handle, const FwUpdateReq *fwupdatereq, UpdateCallback callback);
+```
+
+- **[FACT]** Non-blocking; callback fires repeatedly with flash progress
+- **[FACT]** Uses `g_update_registry` (independent registry)
+- **[FACT]** Callback transitions: `UPDATE_IN_PROGRESS` → `UPDATE_COMPLETED` or `UPDATE_ERROR`
+
+---
+
+## 3. Internal Architecture
+
+### 3.1 Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `rdkFwupdateMgr_process.c` | `registerProcess()` / `unregisterProcess()` — synchronous D-Bus calls |
+| `rdkFwupdateMgr_api.c` | `checkForUpdate()`, `downloadFirmware()`, `updateFirmware()` — fire-and-forget async APIs |
+| `rdkFwupdateMgr_async.c` | Background thread, callback registries, D-Bus signal handlers, dispatch logic |
+| `rdkFwupdateMgr_async_internal.h` | Internal types: `CallbackRegistry`, `BackgroundThread`, `InternalSignalData` |
+| `rdkFwupdateMgr_log.h` | Logging macros (`FWUPMGR_INFO`, `FWUPMGR_ERROR`, etc.) |
+
+### 3.2 Threading Model
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│  Application Thread (caller's thread)                            │
+│                                                                  │
+│  registerProcess() ─── sync D-Bus ──┐                           │
+│  checkForUpdate()  ─── fire&forget ──┤                           │
+│  downloadFirmware()── fire&forget ──┤   Ephemeral D-Bus         │
+│  updateFirmware() ─── fire&forget ──┤   connections (one per    │
+│  unregisterProcess()─ sync D-Bus ──┘    call, then destroyed)   │
+│                                                                  │
+│  pthread_cond_timedwait() ◄── waits for callback signal         │
+└─────────────────────────────────────────────────────────────────┘
+
+┌─────────────────────────────────────────────────────────────────┐
+│  Background Thread (library-internal)                            │
+│                                                                  │
+│  Persistent D-Bus connection (e.g., :1.141)                     │
+│  Isolated GMainContext (no interference with app's GLib loop)    │
+│                                                                  │
+│  Subscriptions:                                                  │
+│    - CheckForUpdateComplete → on_check_complete_signal()         │
+│    - DownloadProgress       → on_download_progress_signal()      │
+│    - UpdateProgress         → on_update_progress_signal()        │
+│                                                                  │
+│  on_*_signal() → dispatch_*() → invoke app callback              │
+│                                                                  │
+│  g_main_loop_run() ← blocks until internal_system_deinit()      │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+### 3.3 Callback Registry Design
+
+**[FACT]** Three independent registries exist:
+
+| Registry | API | Capacity | Slot Lifecycle |
+|----------|-----|----------|----------------|
+| `g_registry` | `checkForUpdate` | 30 slots | IDLE → PENDING → DISPATCHED → IDLE |
+| `g_dwnl_registry` | `downloadFirmware` | 30 slots | IDLE → ACTIVE → IDLE (on terminal) |
+| `g_update_registry` | `updateFirmware` | 30 slots | IDLE → ACTIVE → IDLE (on terminal) |
+
+Each registry has its own `pthread_mutex_t`. Callbacks are invoked with the mutex **released** to prevent deadlocks.
+
+### 3.4 Race Condition Prevention
+
+**[FACT]** The API follows a strict ordering:
+
+1. Connect to D-Bus (fail early if bus is down)
+2. Register callback in registry (ensures slot exists before signal can arrive)
+3. Send fire-and-forget D-Bus method call
+4. Close ephemeral connection, return SUCCESS
+
+This ordering prevents:
+- **Ghost entries:** If D-Bus connection fails after callback registration
+- **Missed signals:** If daemon responds before callback is registered
+
+---
+
+## 4. D-Bus Wire Protocol
+
+### 4.1 Connection Constants
+
+```c
+#define DBUS_SERVICE_NAME    "org.rdkfwupdater.Service"
+#define DBUS_OBJECT_PATH     "/org/rdkfwupdater/Service"
+#define DBUS_INTERFACE_NAME  "org.rdkfwupdater.Interface"
+#define DBUS_TIMEOUT_MS      5000
+#define DBUS_SYNC_TIMEOUT_MS 10000
+```
+
+### 4.2 Signal Formats
+
+| Signal | GVariant Type | Fields |
+|--------|--------------|--------|
+| `CheckForUpdateComplete` | `(tiissss)` | handler_id, result, status_code, currentVersion, availableVersion, updateDetails, statusMessage |
+| `DownloadProgress` | `(tsuss)` | handler_id, firmware_name, progress_percent, status_string, message |
+| `UpdateProgress` | `(tsiss)` | handler_id, firmware_name, progress, status, message |
+
+---
+
+## 5. Data Structures
+
+### 5.1 FwInfoData (checkForUpdate result)
+
+```c
+typedef struct {
+    char CurrFWVersion[64];
+    UpdateDetails *UpdateDetails;     // Non-NULL only when FIRMWARE_AVAILABLE
+    CheckForUpdateStatus status;
+} FwInfoData;
+```
+
+### 5.2 UpdateDetails (firmware metadata)
+
+```c
+typedef struct {
+    char FwFileName[128];
+    char FwUrl[512];
+    char FwVersion[64];
+    char RebootImmediately[12];
+    char DelayDownload[8];
+    char PDRIVersion[64];
+    char PeripheralFirmwares[256];
+} UpdateDetails;
+```
+
+**[FACT]** `UpdateDetails` is populated by parsing the `updateDetails` pipe-separated string from the D-Bus signal (format: `Key:Value|Key:Value|...`).
+
+---
+
+## 6. Lifecycle Example
+
+```c
+// 1. Register with daemon
+FirmwareInterfaceHandle h = registerProcess("MyApp", "1.0");
+
+// 2. Check for updates (non-blocking)
+checkForUpdate(h, my_callback);
+// ... callback fires on BG thread with FwInfoData ...
+
+// 3. Download if available (non-blocking)
+FwDwnlReq req = { .firmwareName = "fw_v8.bin", .downloadUrl = url, .TypeOfFirmware = "PCI" };
+downloadFirmware(h, &req, download_cb);
+// ... progress callbacks fire repeatedly ...
+
+// 4. Flash firmware (non-blocking)
+FwUpdateReq ureq = { .firmwareName = "fw_v8.bin", .TypeOfFirmware = "PCI", .rebootImmediately = true };
+updateFirmware(h, &ureq, update_cb);
+// ... progress callbacks fire, device reboots on completion ...
+
+// 5. Cleanup
+unregisterProcess(h);
+```
diff --git a/openspec/subsystems/spec-boundaries.md b/openspec/subsystems/spec-boundaries.md
new file mode 100755
index 00000000..865b00a4
--- /dev/null
+++ b/openspec/subsystems/spec-boundaries.md
@@ -0,0 +1,137 @@
+# OpenSpec Specification Recommendations
+
+> **Purpose:** Prioritized recommendations for which subsystems deserve first-class OpenSpec specifications  
+> **Criteria:** Runtime complexity, interface surface area, cross-model behavioral differences, testability needs
+
+---
+
+## 1. Priority Tiers
+
+### Tier P0 — Specify First (Critical architectural subsystems)
+
+These subsystems have the highest complexity, widest interface surface, and most cross-cutting behavioral impact. They define the platform's core contract.
+
+| Subsystem | Rationale |
+|-----------|-----------|
+| **Firmware Upgrade Engine** | Central shared subsystem. `RdkUpgradeContext_t` is the primary API contract. Runtime behavior differs dramatically between execution models (blocking in main thread vs GTask worker). Download throttling, chunk resume, mTLS fallback, and `download_only` mode all need formal specification. |
+| **D-Bus Service Runtime** | Defines the daemon's entire external contract. Method signatures, signal payloads, concurrency invariants, task lifecycle, piggyback semantics, and error response contracts are critical for client interoperability. |
+| **Client Library SDK** | Defines the public API consumed by all third-party applications. Callback registration ordering, threading guarantees, connection lifecycle, and error propagation semantics must be formally specified. |
+| **XConf Communication** | Two divergent implementations (one-shot direct vs daemon cached). Cache validity rules, fallback chains, response structure, and timing behavior need unified specification that covers both models. |
+
+### Tier P1 — Specify Next (High-impact subsystems with clear boundaries)
+
+| Subsystem | Rationale |
+|-----------|-----------|
+| **One-Shot Orchestrator** | Defines the legacy execution model's complete behavioral contract: argument parsing, validation gates, multi-firmware sequencing, signal handling, exit code semantics. Needed for behavioral parity verification against daemon model. |
+| **Daemon Orchestrator** | Defines the startup state machine, D-Bus-before-init ordering, main loop lifecycle. Needed for integration testing and systemd interaction specification. |
+| **Flash Subsystem** | Critical safety subsystem. Flash ordering, reboot decision logic, platform-specific flash invocation, and failure recovery need specification. |
+| **IARM Event Interface** | Defines the event contract with the broader RDK ecosystem. Event names, payloads, callback semantics, and thread context of callbacks need specification. |
+| **Concurrency Control** | Cross-cutting but safety-critical. Mutex ownership, main-loop serialization invariants, piggyback queue semantics, and race condition prevention rules need formal documentation. |
+| **Device & Firmware Identity** | Foundation for XConf payloads and flash validation. Property file format, key semantics, and query reliability need specification. |
+
+### Tier P2 — Specify When Needed (Well-bounded infrastructure)
+
+| Subsystem | Rationale |
+|-----------|-----------|
+| **XConf Response Parsing** | Well-defined input/output: JSON → `XCONFRES`. Specify field semantics and validation rules. |
+| **RFC Configuration** | Simple key-value interface. Specify key names, value semantics, default behavior. |
+| **Download Status Tracking** | STATUS_FILE format and RFC notification semantics. Important for crash recovery. |
+| **CEDM / Certificate Auth** | Codebig and mTLS configuration. Currently stub implementations suggest this is platform-specific. |
+| **Process Safety Guards** | PID file semantics, upgrade flag files, cross-binary instance detection rules. |
+
+### Tier P3 — Document, Don't Specify (Cross-cutting concerns)
+
+| Subsystem | Rationale |
+|-----------|-----------|
+| **Telemetry (T2)** | Pervasive instrumentation, not a behavioral contract. Document marker names/values. |
+| **rBus Integration** | Small surface area (T2 upload trigger). Document rather than specify. |
+
+---
+
+## 2. Specification Ordering Strategy
+
+```mermaid
+flowchart TD
+    P0_1["P0: Firmware Upgrade Engine<br/>(defines core download contract)"]
+    P0_2["P0: D-Bus Service Runtime<br/>(defines daemon external API)"]
+    P0_3["P0: Client Library SDK<br/>(defines consumer API)"]
+    P0_4["P0: XConf Communication<br/>(defines cloud interaction)"]
+    
+    P1_1["P1: One-Shot Orchestrator"]
+    P1_2["P1: Daemon Orchestrator"]
+    P1_3["P1: Flash Subsystem"]
+    P1_4["P1: IARM Event Interface"]
+    P1_5["P1: Concurrency Control"]
+    P1_6["P1: Device & FW Identity"]
+    
+    P2["P2: Parsing, RFC, Status, CEDM, Safety"]
+    
+    P0_1 --> P1_1
+    P0_1 --> P1_3
+    P0_2 --> P1_2
+    P0_2 --> P1_5
+    P0_3 --> P1_4
+    P0_4 --> P1_6
+    
+    P1_1 --> P2
+    P1_2 --> P2
+    P1_3 --> P2
+    P1_4 --> P2
+    P1_5 --> P2
+    P1_6 --> P2
+```
+
+**Recommended order within P0:**
+1. **Firmware Upgrade Engine** — foundational; both orchestrators depend on it
+2. **D-Bus Service Runtime** — defines daemon's external contract
+3. **Client Library SDK** — consumer-facing; depends on D-Bus contract
+4. **XConf Communication** — can be specified in parallel with 2+3
+
+---
+
+## 3. Areas Where Subsystem Boundaries Are Unclear
+
+| Area | Issue | Recommendation |
+|------|-------|----------------|
+| **XConf: shared vs daemon-specific** | One-shot uses `MakeXconfComms()` in `rdkv_main.c`; daemon uses `rdkFwupdateMgr_checkForUpdate()` in handlers. Different functions, same purpose. | Specify as single subsystem with two integration modes. |
+| **Upgrade Engine vs Flash** | In one-shot mode, `rdkv_upgrade_request()` can chain directly into `flashImage()` when `download_only == 0`. This blurs ownership between download and flash. | Specify the `download_only` flag as the formal boundary. When 1: Upgrade Engine owns only download. When 0: Upgrade Engine delegates to Flash. |
+| **`device_status_helper.c` ownership** | Contains both device-identity queries (`CurrentRunningInst`, connectivity checks) AND process-safety logic. Compiled into both binaries directly (not a library). | Split conceptually: device identity queries → Device Identity subsystem; process safety → Safety Guards. |
+| **`chunk.c` dual compilation** | Compiled into BOTH `librdksw_upgrade.so` AND directly into both binaries. This creates duplicate symbols unless carefully managed. | Treat as part of Firmware Upgrade Engine. The binary-level compilation is a build quirk, not a subsystem boundary. |
+| **Global state coupling** | `device_info`, `rfc_list`, `curl`, `force_exit` are globals defined in orchestrators but read/written by shared libraries. | Specify as "orchestrator-owned state injected into shared subsystems." The `RdkUpgradeContext_t` struct is the right pattern — extend it to replace remaining globals. |
+| **Telemetry: subsystem or instrumentation?** | `t2CountNotify()` is defined independently in each binary (with `flashT2CountNotify` in flash to avoid symbol collision). It's not a library boundary. | Treat as cross-cutting instrumentation, not a subsystem. |
+
+---
+
+## 4. Subsystems Deserving First-Class OpenSpec Specifications
+
+Based on the analysis above, these **8 subsystems** should receive full OpenSpec specifications:
+
+1. **Firmware Upgrade Engine** (`librdksw_upgrade`)
+2. **D-Bus Service Runtime** (`src/dbus/`)
+3. **Client Library SDK** (`librdkFwupdateMgr`)
+4. **XConf Communication** (shared + daemon cache)
+5. **One-Shot Orchestrator** (`rdkv_main.c`)
+6. **Daemon Orchestrator** (`rdkFwupdateMgr.c`)
+7. **Flash Subsystem** (`librdksw_flash`)
+8. **IARM Event Interface** (`librdksw_iarmIntf`)
+
+Additionally, **Concurrency Control** should be specified as a cross-cutting concern within the D-Bus Service Runtime specification rather than as a standalone subsystem.
+
+---
+
+## 5. Specification Content Guidance
+
+Each subsystem specification should include:
+
+| Section | Content |
+|---------|---------|
+| **Purpose & Scope** | What this subsystem owns and does NOT own |
+| **Runtime Context** | Thread context, event loop affinity, lifecycle bounds |
+| **Interface Contract** | Functions, structs, D-Bus methods/signals, error codes |
+| **State Ownership** | What mutable state this subsystem owns and how it's protected |
+| **Behavioral Invariants** | Rules that must always hold (e.g., "at most one download at a time") |
+| **Execution Model Variants** | How behavior differs between one-shot and daemon |
+| **Failure Semantics** | What happens on error, who decides retry, what gets cleaned up |
+| **Dependencies** | What this subsystem needs from others |
+| **Concurrency Constraints** | Thread-safety guarantees, mutex requirements |
+| **Testability Surface** | What can be tested in isolation, what requires integration |
diff --git a/openspec/subsystems/subsystem-inventory.md b/openspec/subsystems/subsystem-inventory.md
new file mode 100755
index 00000000..70f6de92
--- /dev/null
+++ b/openspec/subsystems/subsystem-inventory.md
@@ -0,0 +1,605 @@
+# Subsystem Inventory — rdkfwupdater
+
+> **Analysis Scope:** Runtime behavioral architecture, not directory structure  
+> **Evidence Level:** Verified from `Makefile.am`, source files, and headers  
+> **Classification:** Each subsystem tagged by type, ownership scope, and execution-model affinity
+
+---
+
+## Inventory Summary
+
+| # | Subsystem | Type | Scope | Spec Priority |
+|---|-----------|------|-------|---------------|
+| 1 | Firmware Upgrade Engine | Core Runtime | Shared | **P0 — First** |
+| 2 | XConf Communication | Core Runtime | Shared | **P0 — First** |
+| 3 | D-Bus Service Runtime | Core Runtime | Daemon-specific | **P0 — First** |
+| 4 | Client Library SDK | IPC/Integration | Daemon ecosystem | **P0 — First** |
+| 5 | Flash Subsystem | Core Runtime | Shared | **P1 — High** |
+| 6 | IARM Event Interface | IPC/Integration | Shared | **P1 — High** |
+| 7 | Device & Firmware Identity | Infrastructure | Shared | **P1 — High** |
+| 8 | XConf Response Parsing | Infrastructure | Shared | P2 — Medium |
+| 9 | RFC Configuration | Infrastructure | Shared | P2 — Medium |
+| 10 | One-Shot Orchestrator | Core Runtime | One-shot-specific | **P1 — High** |
+| 11 | Daemon Orchestrator | Core Runtime | Daemon-specific | **P1 — High** |
+| 12 | Download Status Tracking | Operational/Safety | Shared | P2 — Medium |
+| 13 | CEDM / Certificate Auth | Infrastructure | Shared | P2 — Medium |
+| 14 | Telemetry Integration | Observability | Shared (cross-cutting) | P3 — Low |
+| 15 | rBus Integration | IPC/Integration | Shared (cross-cutting) | P3 — Low |
+| 16 | Concurrency Control | Operational/Safety | Daemon-specific (cross-cutting) | **P1 — High** |
+| 17 | Process Safety Guards | Operational/Safety | Shared (cross-cutting) | P2 — Medium |
+
+---
+
+## 1. Firmware Upgrade Engine
+
+**Type:** Core Runtime Subsystem  
+**Scope:** Shared across both binaries  
+**Library:** `librdksw_upgrade.so`
+
+### Purpose
+
+Owns the blocking HTTP download lifecycle for all firmware artifact types (PCI, PDRI, Peripheral). Encapsulates URL construction, curl-based download with throttling/resume, mTLS authentication, Codebig fallback, and progress tracking.
+
+### Primary Responsibilities
+
+- Execute `rdkv_upgrade_request()` — the central download function used by both execution models
+- Manage chunked/resumable downloads via `chunkDownload()`
+- Handle download throttling (speed limiting, pause/unpause via `doInteruptDwnl()`)
+- Support PCI, PDRI, and Peripheral upgrade types
+- Enforce `download_only` mode (daemon skips flash; one-shot chains into flash)
+- Report download errors with curl error codes and TLS error classification
+- Manage PID file tracking during download (`savePID()`, `getPidStore()`)
+
+### Key Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `src/rdkv_upgrade.c` | Core download orchestration, URL construction, error reporting |
+| `src/chunk.c` | Chunked/resumable HTTP download with content-length tracking |
+| `src/cedmInterface/codebigUtils.c` | Codebig endpoint signing |
+| `src/cedmInterface/mtlsUtils.c` | mTLS certificate management |
+
+### Exposed Interface
+
+- `rdkv_upgrade_request(RdkUpgradeContext_t *ctx, void **curl, int *http_code)` — primary API
+- `rdkv_upgrade_strerror(int error)` — error code to string
+- `RdkUpgradeContext_t` — input context structure (header: `rdkv_upgrade.h`)
+
+### Runtime Dependencies
+
+- `libcurl` (HTTP/HTTPS), `librdksw_fwutils` (device properties), `librdksw_rfcIntf` (RFC settings)
+- External: `libdwnlutil`, `libfwutils`, `libsecure_wrapper`
+
+### Interaction with Other Subsystems
+
+- **Called by:** One-Shot Orchestrator (directly), Daemon D-Bus Service (via GTask worker)
+- **Calls into:** IARM Event Interface (state events), Flash Subsystem (when `download_only == 0`), Download Status Tracking, Telemetry
+- **Receives from:** RFC Configuration (throttle speed, mTLS settings)
+
+### Ownership Boundaries
+
+- Owns the curl handle lifecycle during download
+- Does NOT own the decision of whether to download (that belongs to orchestrators)
+- Does NOT own XConf communication (separate subsystem)
+- Optionally owns flash (when `download_only == 0`, one-shot mode)
+
+### Operational Constraints
+
+- All I/O is blocking — caller must provide threading context
+- Global `curl` and `force_exit` variables create implicit coupling with orchestrators
+- Throttle interaction requires IARM callback registration by calling code
+
+### Failure/Recovery Responsibilities
+
+- Returns curl error codes; does NOT retry (caller decides retry policy)
+- Supports resumable download via chunk mechanism
+- Classifies TLS errors for telemetry reporting
+
+---
+
+## 2. XConf Communication
+
+**Type:** Core Runtime Subsystem  
+**Scope:** Shared (different integration points per execution model)
+
+### Purpose
+
+Manages the request/response lifecycle with the XConf cloud server to determine whether firmware updates are available. Builds the device identity payload, executes the HTTP POST, and delivers the raw response for parsing.
+
+### Primary Responsibilities
+
+- Construct XConf request payload (`createJsonString()`) with device identity fields
+- Determine XConf server URL (`GetServURL()`, with Codebig fallback)
+- Execute blocking HTTP POST to XConf server
+- Deliver raw response data for JSON parsing
+- In daemon: implement cache-first strategy with file + in-memory cache
+- In daemon: provide `rdkFwupdateMgr_checkForUpdate()` wrapper with caching
+
+### Key Source Files
+
+| File | Responsibility | Scope |
+|------|---------------|-------|
+| `src/json_process.c` → `createJsonString()` | Build XConf request payload | Shared |
+| `src/rdkv_upgrade.c` → `MakeXconfComms()` in one-shot `rdkv_main.c` | One-shot XConf query | One-shot |
+| `src/dbus/rdkFwupdateMgr_handlers.c` → `rdkFwupdateMgr_checkForUpdate()` | Daemon XConf query with cache | Daemon |
+| `src/dbus/rdkFwupdateMgr_handlers.c` → cache functions | In-memory + file XConf response cache | Daemon |
+
+### Exposed Interface
+
+- One-shot: `MakeXconfComms(XCONFRES *response, int server_type, int *http_code)` (in `rdkv_main.c`)
+- Daemon: `rdkFwupdateMgr_checkForUpdate(const char *handler_id)` → `CheckUpdateResponse`
+- Daemon cache: `save_xconf_to_cache()`, `get_cached_xconf_data()`, `load_xconf_from_cache()`, `xconf_cache_exists()`
+
+### Ownership Boundaries
+
+- Owns XConf HTTP session lifecycle
+- Daemon: owns cache validity state (`g_xconf_data_valid`, G_LOCK-protected)
+- Does NOT own the decision logic of what to do with the response (parsing subsystem)
+
+---
+
+## 3. D-Bus Service Runtime
+
+**Type:** Core Runtime Subsystem  
+**Scope:** Daemon-specific
+
+### Purpose
+
+Owns the D-Bus server lifecycle, method dispatch, async task management, client tracking, signal broadcasting, and concurrency control for the daemon execution model.
+
+### Primary Responsibilities
+
+- D-Bus service setup: introspection XML parsing, bus name acquisition, object registration
+- Method dispatch: route incoming D-Bus calls to appropriate handlers (`process_app_request()`)
+- Client process tracking: register/unregister clients (`registered_processes` GHashTable)
+- Async task management: GTask lifecycle for CheckForUpdate, Download, Flash workers
+- Piggyback queues: coalesce concurrent identical requests (waiting lists)
+- Signal broadcasting: emit `CheckForUpdateComplete`, `DownloadProgress`, `UpdateProgress`
+- Concurrency guards: `IsDownloadInProgress`, `IsFlashInProgress`, `XConfCommStatus`
+
+### Key Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `src/dbus/rdkv_dbus_server.c` | D-Bus setup, `process_app_request()`, task lifecycle, worker spawn, signal emission |
+| `src/dbus/rdkv_dbus_server.h` | Interface constants, struct definitions, extern declarations |
+| `src/dbus/rdkFwupdateMgr_handlers.c` | Business logic: XConf query, cache, validation |
+| `src/dbus/rdkFwupdateMgr_handlers.h` | Handler function declarations |
+| `src/dbus/xconf_comm_status.c` | Thread-safe XConf status flag management |
+| `src/dbus/xconf_comm_status.h` | Status API declarations |
+
+### Exposed Interface
+
+- D-Bus methods: `RegisterProcess`, `UnregisterProcess`, `CheckForUpdate`, `DownloadFirmware`, `UpdateFirmware`
+- D-Bus signals: `CheckForUpdateComplete`, `DownloadProgress`, `UpdateProgress`
+- C API: `setup_dbus_server()`, `cleanup_dbus()`, `init_task_system()`
+
+### Runtime Dependencies
+
+- GLib/GIO (GDBus, GTask, g_idle_add, GMutex)
+- `librdksw_upgrade` (download workers), `librdksw_flash` (flash workers)
+- `librdksw_jsonparse`, `librdksw_fwutils`, `librdksw_rfcIntf`
+
+### Ownership Boundaries
+
+- Owns all D-Bus connection state, object registration, bus name
+- Owns task lifecycle (TaskContext, active_tasks, waiting queues)
+- Owns process registry (client registration state)
+- Does NOT own business logic (delegates to handlers)
+- Does NOT own blocking I/O (delegates to GTask workers)
+
+### Failure/Recovery Responsibilities
+
+- Never calls `exit()` — logs errors, resets state, continues serving
+- Cleans up all task contexts on shutdown
+- Validates all D-Bus inputs before processing
+
+---
+
+## 4. Client Library SDK
+
+**Type:** IPC/Integration Subsystem  
+**Scope:** Daemon ecosystem (external consumer)  
+**Library:** `librdkFwupdateMgr.so`
+
+### Purpose
+
+Provides the public C API for third-party applications to interact with the rdkFwupdateMgr daemon. Abstracts all D-Bus communication behind a simple register/check/download/update/unregister lifecycle.
+
+### Primary Responsibilities
+
+- Process registration/unregistration with daemon
+- Synchronous D-Bus method invocation (fire-and-forget pattern)
+- Asynchronous callback dispatch via background thread
+- D-Bus signal subscription for update/download/flash notifications
+- Callback registry management (3 independent registries)
+- Background GLib main loop thread lifecycle
+
+### Key Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `librdkFwupdateMgr/src/rdkFwupdateMgr_process.c` | `registerProcess()`, `unregisterProcess()`, D-Bus proxy creation |
+| `librdkFwupdateMgr/src/rdkFwupdateMgr_api.c` | `checkForUpdate()`, `downloadFirmware()`, `updateFirmware()` |
+| `librdkFwupdateMgr/src/rdkFwupdateMgr_async.c` | Background thread, signal handlers, callback dispatch |
+| `librdkFwupdateMgr/include/rdkFwupdateMgr_client.h` | Public API header |
+
+### Exposed Interface
+
+- `rdkFwupdateMgr_init()` / `rdkFwupdateMgr_term()`
+- `registerProcess()` / `unregisterProcess()`
+- `checkForUpdate()`, `downloadFirmware()`, `updateFirmware()`
+- `registerCheckForUpdateCallback()`, `registerDownloadCallback()`, `registerUpdateCallback()`
+
+### Ownership Boundaries
+
+- Owns background thread lifecycle
+- Owns callback registries
+- Does NOT own D-Bus connection persistence (ephemeral proxies per API call)
+- Does NOT own firmware update logic (pure IPC bridge)
+
+---
+
+## 5. Flash Subsystem
+
+**Type:** Core Runtime Subsystem  
+**Scope:** Shared across both binaries  
+**Library:** `librdksw_flash.so`
+
+### Purpose
+
+Owns the firmware image flashing lifecycle. Validates firmware files, invokes platform-specific flash routines, reports flash status via IARM events, and manages reboot decisions.
+
+### Primary Responsibilities
+
+- Flash firmware image to device storage (`flashImage()`)
+- Handle PCI vs PDRI flash paths
+- Report flash progress via IARM events
+- Manage post-flash reboot decision
+- Update firmware download status file
+- Handle flash-specific telemetry
+
+### Key Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `src/flash.c` | `flashImage()` — core flash logic |
+| `src/download_status_helper.c` | `updateFWDownloadStatus()` — STATUS_FILE writes |
+
+### Exposed Interface
+
+- `flashImage(server_url, upgrade_file, reboot_flag, proto, upgrade_type, maint, trigger_type)`
+
+### Ownership Boundaries
+
+- Owns flash I/O lifecycle
+- Does NOT own download decision or URL resolution
+- Does NOT own reboot execution (sets flags, invoked externally)
+
+---
+
+## 6. IARM Event Interface
+
+**Type:** IPC/Integration Subsystem  
+**Scope:** Shared across both binaries  
+**Library:** `librdksw_iarmIntf.so`
+
+### Purpose
+
+Provides system-wide event broadcasting via IARM Bus. Publishes firmware state transitions, maintenance manager updates, peripheral upgrade notifications, and handles download-throttle callbacks.
+
+### Primary Responsibilities
+
+- `eventManager()` — broadcast firmware state, maintenance status, and peripheral events
+- `DwnlStopEventHandler()` — receive download throttle/stop callbacks from Maintenance Manager
+- `init_event_handler()` / `term_event_handler()` — IARM Bus connect/disconnect lifecycle
+- Peripheral firmware notification via ctrlm (Control Manager) integration
+
+### Key Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `src/iarmInterface/iarmInterface.c` | All IARM event publishing and callback handling |
+
+### Exposed Interface
+
+- `eventManager(event_name, event_status)`
+- `init_event_handler()` / `term_event_handler()`
+- `DwnlStopEventHandler()` (registered as IARM callback)
+- `interuptDwnl(app_mode)` (called from IARM callback context)
+
+### Ownership Boundaries
+
+- Owns IARM Bus connection lifecycle
+- Does NOT own event content/semantics (callers define event names/values)
+
+---
+
+## 7. Device & Firmware Identity
+
+**Type:** Infrastructure/Shared-Library Subsystem  
+**Scope:** Shared across both binaries  
+**Library:** `librdksw_fwutils.so`
+
+### Purpose
+
+Provides device identity queries (model, serial, MAC, build type, firmware version, CPU arch) from device property files. These are consumed by XConf payload construction, flash validation, and status reporting.
+
+### Primary Responsibilities
+
+- `getDeviceProperties()` — populate `DeviceProperty_t` from `/etc/device.properties`
+- `getImageDetails()` — read current firmware version
+- `GetBuildType()`, `GetEstbMac()`, `GetModelNum()`, `GetFirmwareVersion()` — individual queries
+- `getDevicePropertyData()` — generic key-value reader
+- File utilities: `filePresentCheck()`, `getFileSize()`, `createDir()`, `createFile()`
+- Bundle/certificate path management
+
+### Key Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `src/deviceutils/deviceutils.c` | File utilities, bundle management, PDRI version, peripheral queries |
+| `src/deviceutils/device_api.c` | Device property reading, build type, URL resolution, debug services |
+
+### Exposed Interface
+
+- `DeviceProperty_t`, `ImageDetails_t` data structures
+- `getDeviceProperties()`, `getImageDetails()`, `GetBuildType()`, etc.
+- `filePresentCheck()`, `getFileSize()`, `createDir()`, `createFile()`
+
+---
+
+## 8. XConf Response Parsing
+
+**Type:** Infrastructure/Shared-Library Subsystem  
+**Scope:** Shared across both binaries  
+**Library:** `librdksw_jsonparse.so`
+
+### Purpose
+
+Parses XConf JSON responses into the `XCONFRES` structure. Validates firmware version against device model, extracts download URLs, reboot flags, peripheral firmware lists, and PDRI versions.
+
+### Primary Responsibilities
+
+- `createJsonString()` — build XConf POST payload from device identity
+- `processJsonResponse()` — validate and interpret parsed XConf data
+- `getXconfRespData()` — parse raw JSON into `XCONFRES` fields
+- Version comparison between current and available firmware
+
+### Key Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `src/json_process.c` | All XConf JSON construction and parsing |
+
+### Exposed Interface
+
+- `createJsonString()`, `processJsonResponse()`, `getXconfRespData()`
+- `XCONFRES` data structure (defined in `rdkv_cdl.h`)
+
+---
+
+## 9. RFC Configuration
+
+**Type:** Infrastructure/Shared-Library Subsystem  
+**Scope:** Shared across both binaries  
+**Library:** `librdksw_rfcIntf.so`
+
+### Purpose
+
+Reads Remote Feature Control (RFC) settings that govern firmware update behavior: throttle policies, mTLS enablement, incremental CDL, auto-exclusion.
+
+### Primary Responsibilities
+
+- `getRFCSettings()` — populate `Rfc_t` with throttle, topspeed, mTLS, incremental CDL flags
+- `read_RFCProperty()` / `write_RFCProperty()` — generic RFC key-value access
+- Auto-exclusion check for non-production devices
+
+### Key Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `src/rfcInterface/rfcinterface.c` | RFC read/write operations |
+
+### Exposed Interface
+
+- `getRFCSettings(Rfc_t *rfc_list)`
+- `read_RFCProperty()`, `write_RFCProperty()`
+- `Rfc_t` data structure
+
+---
+
+## 10. One-Shot Orchestrator
+
+**Type:** Core Runtime Subsystem  
+**Scope:** One-shot-specific  
+**Binary:** `rdkvfwupgrader`
+
+### Purpose
+
+Owns the linear, start-to-exit firmware update lifecycle for the one-shot execution model. Sequences initialization, validation, XConf query, download, flash, and cleanup as a single synchronous pipeline.
+
+### Primary Responsibilities
+
+- Process lifecycle: `main()` → `initialize()` → `initialValidation()` → XConf → download → flash → `uninitialize()` → `exit()`
+- Argument parsing (trigger type, retry count)
+- Instance mutex via PID file (`/tmp/DIFD.pid`)
+- Signal handling (`SIGUSR1` → abort download)
+- Maintenance Manager integration (mode query, status reporting)
+- Peripheral firmware multi-download loop
+- State Red recovery detection
+
+### Key Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `src/rdkv_main.c` | Complete one-shot orchestration |
+
+### Exposed Interface
+
+- None (binary entry point)
+- Exit code semantics: 0=success, non-zero=curl error code
+
+### Ownership Boundaries
+
+- Owns entire process lifecycle
+- Directly invokes all shared libraries synchronously
+- Owns global state variables: `DwnlState`, `app_mode`, `force_exit`, `curl`
+
+---
+
+## 11. Daemon Orchestrator
+
+**Type:** Core Runtime Subsystem  
+**Scope:** Daemon-specific  
+**Binary:** `rdkFwupdateMgr`
+
+### Purpose
+
+Owns the persistent daemon lifecycle: state machine startup, D-Bus service initialization, GLib main loop entry, and orderly shutdown.
+
+### Primary Responsibilities
+
+- State machine: `STATE_INIT` → `STATE_INIT_VALIDATION` → `STATE_IDLE`
+- D-Bus server setup before `initialize()` (daemon is reachable during init)
+- GLib main loop management (`g_main_loop_run`)
+- Shared initialization reuse: `initialize()`, `initialValidation()`, `uninitialize()`
+- Orderly shutdown: `cleanup_dbus()` → `uninitialize()` → `exit()`
+
+### Key Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `src/rdkFwupdateMgr.c` | Daemon `main()`, state machine, shared init reuse |
+
+### Ownership Boundaries
+
+- Owns GLib main loop lifecycle
+- Owns state machine transitions
+- Delegates all request handling to D-Bus Service Runtime
+- Shares `initialize()` / `uninitialize()` behavior with One-Shot Orchestrator
+
+---
+
+## 12. Download Status Tracking
+
+**Type:** Operational/Safety Subsystem  
+**Scope:** Shared across both binaries
+
+### Purpose
+
+Persists firmware download status to a file (`/opt/fwdnldstatus.txt`) for crash recovery and external monitoring. Also notifies RFC of download status changes.
+
+### Primary Responsibilities
+
+- `updateFWDownloadStatus()` — write structured status to `STATUS_FILE`
+- `notifyDwnlStatus()` — push status to RFC via `write_RFCProperty()`
+- Suppressible via `disableStatsUpdate` flag (disabled for PDRI/Peripheral)
+
+### Key Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `src/download_status_helper.c` | Status file writes, RFC notifications |
+
+---
+
+## 13. CEDM / Certificate Auth
+
+**Type:** Infrastructure Subsystem  
+**Scope:** Shared (compiled into `librdksw_upgrade.so`)
+
+### Purpose
+
+Manages Codebig endpoint discovery and mTLS certificate authentication for secure firmware downloads.
+
+### Key Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `src/cedmInterface/codebigUtils.c` | Codebig URL signing (currently stub) |
+| `src/cedmInterface/mtlsUtils.c` | mTLS certificate selection and configuration |
+
+---
+
+## 14. Telemetry Integration
+
+**Type:** Observability/Cross-cutting  
+**Scope:** Shared across both binaries
+
+### Purpose
+
+Publishes firmware update metrics to Telemetry 2.0 (T2) framework for operational monitoring.
+
+### Characteristics
+
+- `t2CountNotify()` / `t2ValNotify()` — wrapper functions in each binary
+- `flashT2CountNotify()` — rename to avoid symbol collision with flash library
+- Conditional compilation via `T2_EVENT_ENABLED`
+- Not a subsystem with clear boundaries — pervasive instrumentation
+
+---
+
+## 15. rBus Integration
+
+**Type:** IPC/Integration (Cross-cutting)  
+**Scope:** Shared across both binaries
+
+### Purpose
+
+Triggers Telemetry 2.0 report uploads via rBus method invocation. Registers firmware update data model with rBus data broker.
+
+### Key Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `src/rbusInterface/rbusInterface.c` | T2 upload trigger, rBus handle management |
+
+---
+
+## 16. Concurrency Control
+
+**Type:** Operational/Safety (Cross-cutting)  
+**Scope:** Daemon-specific
+
+### Purpose
+
+Prevents unsafe concurrent firmware operations. This is not a single module but a cross-cutting set of guards distributed across D-Bus Service Runtime and worker threads.
+
+### Components
+
+| Guard | Protection | Mechanism |
+|-------|-----------|-----------|
+| `XConfCommStatus` | At most one XConf fetch | `GMutex` in `xconf_comm_status.c` |
+| `IsDownloadInProgress` | At most one download | Main-loop-serialized boolean |
+| `IsFlashInProgress` | At most one flash | Main-loop-serialized boolean |
+| `g_xconf_data_cache` mutex | Thread-safe cache access | `G_LOCK` in handlers |
+| `mutuex_dwnl_state` | Download state across threads | `pthread_mutex_t` |
+| `app_mode_status` | App mode across threads | `pthread_mutex_t` |
+| Piggyback queues | Coalesce concurrent requests | GSList + main-loop serialization |
+
+---
+
+## 17. Process Safety Guards
+
+**Type:** Operational/Safety (Cross-cutting)  
+**Scope:** Shared across both binaries
+
+### Purpose
+
+Prevents unsafe concurrent execution of multiple firmware update processes and manages crash recovery indicators.
+
+### Components
+
+- PID file management (`/tmp/DIFD.pid`) — prevents duplicate instances
+- Reboot preparation file (`/tmp/fw_preparing_to_reboot`) — crash recovery
+- Upgrade flag file (`/tmp/.imageDnldInProgress` or `HTTP_CDL_FLAG`) — external visibility
+- RFC auto-exclusion check — exclude non-production devices
+- `CurrentRunningInst()` — cross-binary PID-file validation
+
+### Key Source Files
+
+| File | Responsibility |
+|------|---------------|
+| `src/device_status_helper.c` | `CurrentRunningInst()`, `waitForNtp()`, `isDnsResolve()`, `CheckIProuteConnectivity()` |
+| `src/rdkv_main.c` / `src/rdkFwupdateMgr.c` | `initialValidation()`, `updateUpgradeFlag()` |
diff --git a/openspec/subsystems/subsystem-map.md b/openspec/subsystems/subsystem-map.md
new file mode 100755
index 00000000..28001b2e
--- /dev/null
+++ b/openspec/subsystems/subsystem-map.md
@@ -0,0 +1,199 @@
+# Subsystem Map — Shared vs Execution-Model-Specific
+
+> **Purpose:** Classify every identified subsystem by its relationship to the two execution models  
+> **Evidence:** Build targets from `Makefile.am`, source inclusion per binary
+
+---
+
+## 1. Classification Matrix
+
+```
+                        ┌───────────────────┬───────────────────┐
+                        │   rdkvfwupgrader   │  rdkFwupdateMgr   │
+                        │    (one-shot)      │     (daemon)       │
+┌───────────────────────┼───────────────────┼───────────────────┤
+│ SHARED SUBSYSTEMS     │                   │                    │
+│                       │                   │                    │
+│ Firmware Upgrade      │    ■ (direct)     │  ■ (via GTask)     │
+│   Engine              │                   │                    │
+│                       │                   │                    │
+│ XConf Communication   │  ■ (MakeXconf     │  ■ (checkForUpdate │
+│                       │    Comms)         │    + cache)        │
+│                       │                   │                    │
+│ Flash Subsystem       │  ■ (inline after  │  ■ (via GTask      │
+│                       │    download)      │    worker)         │
+│                       │                   │                    │
+│ IARM Event Interface  │    ■              │    ■               │
+│                       │                   │                    │
+│ Device & FW Identity  │    ■              │    ■               │
+│                       │                   │                    │
+│ XConf Response Parse  │    ■              │    ■               │
+│                       │                   │                    │
+│ RFC Configuration     │    ■              │    ■               │
+│                       │                   │                    │
+│ Download Status       │    ■              │    ■               │
+│                       │                   │                    │
+│ CEDM / Cert Auth      │    ■              │    ■               │
+│                       │                   │                    │
+│ Telemetry (T2)        │    ■              │    ■               │
+│                       │                   │                    │
+│ rBus Integration      │    ■              │    ■               │
+│                       │                   │                    │
+│ Process Safety Guards │    ■              │    ■               │
+├───────────────────────┼───────────────────┼───────────────────┤
+│ EXECUTION-MODEL-      │                   │                    │
+│ SPECIFIC              │                   │                    │
+│                       │                   │                    │
+│ One-Shot Orchestrator │    ■              │                    │
+│                       │                   │                    │
+│ Daemon Orchestrator   │                   │    ■               │
+│                       │                   │                    │
+│ D-Bus Service Runtime │                   │    ■               │
+│                       │                   │                    │
+│ Concurrency Control   │                   │    ■               │
+├───────────────────────┼───────────────────┼───────────────────┤
+│ CLIENT ECOSYSTEM      │                   │                    │
+│                       │                   │                    │
+│ Client Library SDK    │                   │  ■ (consumer of    │
+│ (librdkFwupdateMgr)   │                   │    daemon D-Bus)   │
+└───────────────────────┴───────────────────┴───────────────────┘
+```
+
+---
+
+## 2. Build-Level Source Mapping
+
+### rdkvfwupgrader Binary Sources (from Makefile.am)
+
+| Source File | Subsystem |
+|-------------|-----------|
+| `src/rdkv_main.c` | One-Shot Orchestrator |
+| `src/chunk.c` | Firmware Upgrade Engine (compiled-in copy) |
+| `src/device_status_helper.c` | Process Safety Guards, Device Identity |
+| `src/rbusInterface/rbusInterface.c` | rBus Integration |
+| **Linked libraries:** | |
+| `librdksw_upgrade.so` | Firmware Upgrade Engine |
+| `librdksw_jsonparse.so` | XConf Response Parsing |
+| `librdksw_rfcIntf.so` | RFC Configuration |
+| `librdksw_iarmIntf.so` | IARM Event Interface |
+| `librdksw_flash.so` | Flash Subsystem |
+| `librdksw_fwutils.so` | Device & Firmware Identity |
+
+### rdkFwupdateMgr Binary Sources (from Makefile.am)
+
+| Source File | Subsystem |
+|-------------|-----------|
+| `src/rdkFwupdateMgr.c` | Daemon Orchestrator |
+| `src/chunk.c` | Firmware Upgrade Engine (compiled-in copy) |
+| `src/device_status_helper.c` | Process Safety Guards, Device Identity |
+| `src/rbusInterface/rbusInterface.c` | rBus Integration |
+| `src/dbus/rdkv_dbus_server.c` | D-Bus Service Runtime |
+| `src/dbus/rdkFwupdateMgr_handlers.c` | XConf Communication (daemon), D-Bus handlers |
+| `src/dbus/xconf_comm_status.c` | Concurrency Control |
+| **Linked libraries:** | (same as rdkvfwupgrader +) |
+| `$(GLIB_LIBS)` | GLib/GIO for D-Bus, GTask, main loop |
+
+### librdkFwupdateMgr.so Sources
+
+| Source File | Subsystem |
+|-------------|-----------|
+| `librdkFwupdateMgr/src/rdkFwupdateMgr_process.c` | Client Library SDK |
+| `librdkFwupdateMgr/src/rdkFwupdateMgr_api.c` | Client Library SDK |
+| `librdkFwupdateMgr/src/rdkFwupdateMgr_async.c` | Client Library SDK |
+
+---
+
+## 3. Behavioral Differences by Execution Model
+
+### Shared Subsystems: Same Code, Different Runtime Behavior
+
+| Subsystem | One-Shot Behavior | Daemon Behavior |
+|-----------|-------------------|-----------------|
+| **Firmware Upgrade Engine** | Called synchronously from `main()`, blocks entire process | Called from GTask worker thread, blocks only worker |
+| **XConf Communication** | Direct `MakeXconfComms()` → blocking in main thread | `rdkFwupdateMgr_checkForUpdate()` → cache-first with memory+file, async worker |
+| **Flash Subsystem** | Called inline after download completes | Called via GTask worker, reports via `g_idle_add()` signals |
+| **IARM Event Interface** | Callback (`DwnlStopEventHandler`) interrupts active download | Same callback, but in daemon context IARM may deliver via GLib integration |
+| **Device & FW Identity** | Read once at `initialize()`, globals for process lifetime | Read per-request in worker threads (fresh `DeviceProperty_t` per download) |
+| **RFC Configuration** | Read once at `initialize()`, stored in global `rfc_list` | Read per-request in worker threads (fresh `Rfc_t` per download) |
+| **Download Status** | Written inline during download progress | Written from worker thread (same function, different thread context) |
+| **Process Safety** | PID file + `CurrentRunningInst()` guards single instance | Same PID logic, but daemon always transitions to IDLE regardless |
+
+### One-Shot-Specific Behaviors
+
+| Behavior | Location | Description |
+|----------|----------|-------------|
+| Linear pipeline execution | `rdkv_main.c:main()` | Init → Validate → XConf → Download → Flash → Exit |
+| Multi-firmware chaining | `checkTriggerUpgrade()` | PCI → sleep(30) → PDRI → Peripheral loop |
+| `exit()` on fatal errors | `rdkv_main.c` | 8+ exit paths with `uninitialize()` cleanup |
+| SIGUSR1 → abort + exit | `handle_signal()` | Sets `force_exit`, aborts curl, exits |
+| Throttle-to-zero → exit | `interuptDwnl()` | When speed=0, sets `force_exit` |
+| State Red recovery | `isInStateRed()` | Special boot-time recovery path |
+
+### Daemon-Specific Behaviors
+
+| Behavior | Location | Description |
+|----------|----------|-------------|
+| GLib main loop (indefinite) | `rdkFwupdateMgr.c:STATE_IDLE` | `g_main_loop_run()` — never returns normally |
+| GTask async offloading | `rdkv_dbus_server.c` | `g_task_run_in_thread()` for CheckUpdate, Download, Flash |
+| Piggyback queues | `rdkv_dbus_server.c` | `waiting_checkUpdate_ids`, `waiting_download_ids` |
+| D-Bus signal broadcast | `rdkv_dbus_server.c` | `g_dbus_connection_emit_signal()` to all subscribers |
+| XConf cache (memory+file) | `rdkFwupdateMgr_handlers.c` | `g_cached_xconf_data` with G_LOCK protection |
+| Progress monitor thread | `rdkv_dbus_server.c` | Dedicated GThread polls `/opt/curl_progress` |
+| `download_only=1` | `rdkv_dbus_server.c` | Decouples download from flash |
+| Error → continue serving | Everywhere | Never exits on operation errors |
+| D-Bus setup BEFORE init | `rdkFwupdateMgr.c:STATE_INIT` | Daemon reachable during initialization |
+
+---
+
+## 4. Shared vs Daemon-Specific State Ownership
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│                   SHARED GLOBAL STATE                           │
+│  (defined in rdkv_main.c / rdkFwupdateMgr.c,                  │
+│   used by shared libraries)                                     │
+│                                                                 │
+│  DeviceProperty_t device_info    ← populated by initialize()   │
+│  ImageDetails_t cur_img_detail   ← populated by initialize()   │
+│  Rfc_t rfc_list                  ← populated by initialize()   │
+│  int DwnlState                  ← mutex-protected              │
+│  int app_mode                    ← mutex-protected              │
+│  int force_exit                  ← set by signal/callback       │
+│  void *curl                     ← active curl handle            │
+│  bool isCriticalUpdate           ← reboot decision flag         │
+│  int trigger_type                ← from argv[2]                 │
+└─────────────────────────────────────────────────────────────────┘
+
+┌─────────────────────────────────────────────────────────────────┐
+│              DAEMON-ONLY STATE                                  │
+│  (defined in src/dbus/ files, only in rdkFwupdateMgr)          │
+│                                                                 │
+│  GDBusConnection *connection     ← D-Bus connection             │
+│  GMainLoop *main_loop            ← GLib event loop              │
+│  GHashTable *registered_processes ← client registry             │
+│  GHashTable *active_tasks         ← in-flight tasks             │
+│  GSList *waiting_checkUpdate_ids  ← piggyback queue             │
+│  GSList *waiting_download_ids     ← piggyback queue             │
+│  gboolean IsDownloadInProgress    ← download guard              │
+│  gboolean IsFlashInProgress       ← flash guard                 │
+│  gboolean IsCheckUpdateInProgress ← XConf guard (mutex)         │
+│  CurrentDownloadState *current_download ← download tracking     │
+│  CurrentFlashState *current_flash      ← flash tracking         │
+│  XCONFRES g_cached_xconf_data    ← XConf response cache         │
+│  guint next_task_id              ← monotonic task counter        │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## 5. Cross-Cutting Concerns
+
+| Concern | Subsystems Affected | Notes |
+|---------|--------------------|-|
+| **Thread safety** | Upgrade Engine, XConf Comm, Flash, Concurrency Control | Daemon workers must not touch main-loop-owned state directly |
+| **Error propagation** | All subsystems | One-shot: exit codes; Daemon: D-Bus error responses + signals |
+| **Logging** | All subsystems | `SWLOG_INFO/ERROR` macros, RDK logger integration |
+| **Telemetry** | All subsystems | `t2CountNotify()` calls sprinkled throughout |
+| **Resource cleanup** | All subsystems | Must handle graceful shutdown in both models |
+| **Build conditionality** | IARM, RFC, T2, CEDM, rBus | `#ifdef` guards create compile-time subsystem variants |
+| **Global mutable state** | Orchestrators, Upgrade Engine, IARM | `device_info`, `rfc_list`, `curl`, `force_exit` — shared globals |
diff --git a/src/dbus/rdkFwupdateMgr_handlers.c b/src/dbus/rdkFwupdateMgr_handlers.c
index d27eadcf..df2a148f 100644
--- a/src/dbus/rdkFwupdateMgr_handlers.c
+++ b/src/dbus/rdkFwupdateMgr_handlers.c
@@ -491,7 +491,8 @@ static int fetch_xconf_firmware_info( XCONFRES *pResponse, int server_type, int
                     xconf_context.device_info = &device_info;      // Uses extern global
                     xconf_context.force_exit = &local_force_exit;
                     xconf_context.trigger_type = local_trigger_type;
-                    xconf_context.rfc_list = &local_rfc_list;  
+                    xconf_context.rfc_list = &local_rfc_list;
+                    xconf_context.direct_cdn = isDirectCDNEnabled();
 
                     SWLOG_INFO("fetch_xconf_firmware_info: Initiating XConf request with server_type=%d\n", server_type);
                     SWLOG_INFO("fetch_xconf_firmware_info: Context setup - device_info=%p, rfc_list=%p\n", 
diff --git a/src/dbus/rdkv_dbus_server.c b/src/dbus/rdkv_dbus_server.c
index 331ec4d3..8a271a65 100644
--- a/src/dbus/rdkv_dbus_server.c
+++ b/src/dbus/rdkv_dbus_server.c
@@ -2784,13 +2784,30 @@ static void rdkfw_download_worker(GTask *task, gpointer source_object,
         }
         
         // Extract download URL from XConf response
-        const char *download_location = xconf_response.cloudFWLocation[0] ? 
-                                        xconf_response.cloudFWLocation : NULL;
+        // Direct CDN mode: use per-artifact URL based on firmware type
+        const char *download_location = NULL;
+        if (isDirectCDNEnabled()) {
+            if (g_strcmp0(ctx->type_of_firmware, "PCI") == 0 && xconf_response.firmwareUrl[0]) {
+                download_location = xconf_response.firmwareUrl;
+                SWLOG_INFO("[DOWNLOAD_WORKER] Direct CDN: using firmwareUrl for PCI\n");
+            } else if (g_strcmp0(ctx->type_of_firmware, "PDRI") == 0 && xconf_response.pdriUrl[0]) {
+                download_location = xconf_response.pdriUrl;
+                SWLOG_INFO("[DOWNLOAD_WORKER] Direct CDN: using pdriUrl for PDRI\n");
+            } else if (g_strcmp0(ctx->type_of_firmware, "PERIPHERAL") == 0 && xconf_response.remCtrlUrl[0]) {
+                download_location = xconf_response.remCtrlUrl;
+                SWLOG_INFO("[DOWNLOAD_WORKER] Direct CDN: using remCtrlUrl for PERIPHERAL\n");
+            }
+        }
+        // Fallback to legacy cloudFWLocation if per-artifact URL not available
+        if (download_location == NULL && xconf_response.cloudFWLocation[0]) {
+            download_location = xconf_response.cloudFWLocation;
+            SWLOG_INFO("[DOWNLOAD_WORKER] Using legacy cloudFWLocation\n");
+        }
         
         // Validate URL
         if (download_location == NULL || strlen(download_location) == 0) {
             SWLOG_ERROR("[DOWNLOAD_WORKER] ERROR: XConf cache has no firmware download URL\n");
-            SWLOG_ERROR("[DOWNLOAD_WORKER]   - cloudFWLocation is empty or NULL\n");
+            SWLOG_ERROR("[DOWNLOAD_WORKER]   - No per-artifact URL and cloudFWLocation is empty\n");
             
             // Emit error signal
             ProgressUpdate *error_update = g_new0(ProgressUpdate, 1);
@@ -2982,6 +2999,10 @@ static void rdkfw_download_worker(GTask *task, gpointer source_object,
     upgrade_ctx.download_only = 1;
     SWLOG_INFO("[DOWNLOAD_WORKER]   download_only = 1 *** CRITICAL: SKIP FLASHING in rdkv_upgrade_request()! ***\n");
     
+    // Direct CDN mode: skip Codebig fallback on download failure
+    upgrade_ctx.direct_cdn = isDirectCDNEnabled();
+    SWLOG_INFO("[DOWNLOAD_WORKER]   direct_cdn = %s\n", upgrade_ctx.direct_cdn ? "true" : "false");
+    
     //upgrade_ctx.progress_callback = download_progress_callback;
     //SWLOG_INFO("[DOWNLOAD_WORKER]   progress_callback = %p (download_progress_callback)\n", 
       //         (void*)upgrade_ctx.progress_callback);
diff --git a/src/device_status_helper.c b/src/device_status_helper.c
index eddb2f66..468d52a3 100644
--- a/src/device_status_helper.c
+++ b/src/device_status_helper.c
@@ -292,6 +292,10 @@ bool checkCodebigAccess(void)
 {
     int ret = -1;
     bool codebigEnable = false;
+    if (isDirectCDNEnabled()) {
+        SWLOG_INFO("CodebigAccess Not Present For direct cdn\n");
+        return false;
+    }
     ret = v_secure_system("GetServiceUrl 2 temp");
     SWLOG_INFO("Exit code for codebigcheck:%d\n", ret);
     if (ret == 0) {
diff --git a/src/deviceutils/device_api.c b/src/deviceutils/device_api.c
index 0ad368ba..9666a00b 100644
--- a/src/deviceutils/device_api.c
+++ b/src/deviceutils/device_api.c
@@ -959,7 +959,19 @@ size_t GetServURL( char *pServURL, size_t szBufSize )
             }
             if( len == 0 || *pServURL == 0 )
             {
-                len = GetTR181Url( eRecovery, pServURL, szBufSize );
+                *buf = 0;
+                GetTR181Url( eRecovery, buf, sizeof(buf) );
+                if( *buf != 0 )
+                {
+                    if( isDirectCDNEnabled() )
+                    {
+                        len = snprintf( pServURL, szBufSize, "%s/xconf/firmware/stb/", buf );
+                    }
+                    else
+                    {
+                        len = snprintf( pServURL, szBufSize, "%s/xconf/swu/stb", buf );
+                    }
+                }
             }
         }
         else
@@ -989,7 +1001,14 @@ size_t GetServURL( char *pServURL, size_t szBufSize )
                     GetTR181Url( eBootstrap, buf, sizeof(buf) );
                     if( *buf != 0 )
                     {
-                        len = snprintf( pServURL, szBufSize, "%s/xconf/swu/stb", buf );    // default value
+                        if( isDirectCDNEnabled() )
+                        {
+                            len = snprintf( pServURL, szBufSize, "%s/xconf/firmware/stb/", buf );
+                        }
+                        else
+                        {
+                            len = snprintf( pServURL, szBufSize, "%s/xconf/swu/stb", buf );    // default value
+                        }
                     }
                     else
                     {
@@ -1000,7 +1019,14 @@ size_t GetServURL( char *pServURL, size_t szBufSize )
                         else
                         {
                             GetTR181Url( eXconf, buf, sizeof(buf) );
-                            len = snprintf( pServURL, szBufSize, "https://%s/xconf/swu/stb/", buf );
+                            if( isDirectCDNEnabled() )
+                            {
+                                len = snprintf( pServURL, szBufSize, "https://%s/xconf/firmware/stb/", buf );
+                            }
+                            else
+                            {
+                                len = snprintf( pServURL, szBufSize, "https://%s/xconf/swu/stb/", buf );
+                            }
                         }
                     }
                 }
diff --git a/src/deviceutils/deviceutils.c b/src/deviceutils/deviceutils.c
index 2ca4eb9e..9592593a 100644
--- a/src/deviceutils/deviceutils.c
+++ b/src/deviceutils/deviceutils.c
@@ -219,6 +219,20 @@ size_t RunCommand( SYSCMD eSysCmd, const char *pArgs, char *pResult, size_t szRe
     return nbytes_read;
 }
 
+/* Static cache for peripheral product name, populated by BuildRemoteInfo() */
+static char pProductNumber[128] = {0};
+
+int getPeripheralProduct(char *buf, size_t szIn)
+{
+    if (buf == NULL || szIn == 0) return -1;
+    if (pProductNumber[0] != '\0') {
+        snprintf(buf, szIn, "%s", pProductNumber);
+    } else {
+        snprintf(buf, szIn, "%s", "remCtrl");
+    }
+    return 0;
+}
+
 /* function BuildRemoteInfo - Formats the "periperalFirmwares" string for remote info part of xconf communication
  
         Usage: size_t BuildRemoteInfo <JSON *pItem> <char *pRemoteInfo> <size_t szMaxBuf> <bool bAddremCtrl>
@@ -254,6 +268,9 @@ size_t BuildRemoteInfo( JSON *pItem, char *pRemoteInfo, size_t szMaxBuf, bool bA
         i = GetJsonVal( pItem, "Product", productBuf, sizeof(productBuf) );
         if( i )
         {
+            /* Cache peripheral product name for Direct CDN URL key lookup */
+            snprintf(pProductNumber, sizeof(pProductNumber), "remCtrl%s", productBuf);
+
             if( bAddremCtrl == true )
             {
                 pPrefix = pRemCtrlStrings;
diff --git a/src/deviceutils/deviceutils.h b/src/deviceutils/deviceutils.h
index a4110702..987ff6bd 100644
--- a/src/deviceutils/deviceutils.h
+++ b/src/deviceutils/deviceutils.h
@@ -79,6 +79,8 @@ typedef struct metaDataFileList
 */
 size_t RunCommand(SYSCMD eSysCmd, const char *pArgs, char *pResult, size_t szResultSize);
 
+int getPeripheralProduct(char *buf, size_t szIn);
+
 /* function BuildRemoteInfo - Formats the "periperalFirmwares" string for remote info part of xconf communication
  
         Usage: size_t BuildRemoteInfo <JSON *pItem> <char *pRemoteInfo> <size_t szMaxBuf> <bool bAddremCtrl>
diff --git a/src/directcdn.c b/src/directcdn.c
new file mode 100644
index 00000000..9964e7af
--- /dev/null
+++ b/src/directcdn.c
@@ -0,0 +1,221 @@
+/*
+ * Copyright 2026 Comcast Cable Communications Management, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <sys/stat.h>
+#include <pthread.h>
+
+#include "rdkv_cdl.h"
+#include "rdkv_upgrade.h"
+#ifndef GTEST_ENABLE
+#include "downloadUtil.h"
+#include "urlHelper.h"
+#endif
+#include "download_status_helper.h"
+#include "device_status_helper.h"
+#include "iarmInterface.h"
+#ifndef GTEST_ENABLE
+#include "rdk_fwdl_utils.h"
+#include "system_utils.h"
+#else
+#include "rdkv_cdl_log_wrapper.h"
+#include "miscellaneous.h"
+#endif
+#include "rfcinterface.h"
+#include "json_process.h"
+#include "device_api.h"
+#include "deviceutils.h"
+
+#define JSON_STR_LEN 1000
+
+/* Externs from rdkv_main.c — shared globals used by the orchestrator */
+extern Rfc_t rfc_list;
+extern char immed_reboot_flag[];
+extern char disableStatsUpdate[];
+extern char lastrun[];
+extern int delay_dwnl;
+extern int force_exit;
+extern void *curl;
+int getTriggerType(void);
+
+/**
+ * @Description Directly downloads a firmware image using a Content Delivery Network (CDN).
+ *
+ * This function downloads a firmware image directly from a CDN/SSR server. It handles the
+ * download process of PCI/PDRI/PERI and updates the provided response structure accordingly.
+ *
+ * @param response Pointer to the XCONFRES structure where the response details will be stored.
+ * @param cur_img_name Pointer to the name of the current firmware image to be downloaded.
+ * @param device_info Pointer to the DeviceProperty_t structure containing device information.
+ * @param server_type Integer indicating the type of server from which to download the image.
+ * @param pHttp_code Pointer to an integer where the HTTP response code will be stored.
+ *
+ * @return An integer indicating the status of the download process.
+ *         - Returns 0 on success.
+ *         - Returns a non-zero value if an error occurs during the download process.
+ */
+int DirectCDNDownload( XCONFRES *response, char *cur_img_name, DeviceProperty_t *device_info, int server_type, int *pHttp_code )
+{
+    int curl_ret_code  = -1;
+    DownloadData DwnLoc;
+    char *pJSONStr = NULL;      // contains the device data string to send to XCONF server
+    char *pServURL = NULL;      // the server to do the XCONF comms
+    size_t len = 0;
+    int ret = -1;
+    int cnt = 0;
+    int total_retry_cnt = 3;
+    int pci_upgrade_status = DIRECT_CDN_RETRY_ERR;
+    int pdri_upgrade_status = DIRECT_CDN_RETRY_ERR;
+    int peri_upgrade_status = -1;
+
+    DwnLoc.pvOut = NULL;
+    DwnLoc.datasize = 0;
+    DwnLoc.memsize = 0;
+    *pHttp_code = 0;
+    int json_res = -1;
+    int xconf_ret = -1;
+    int proto = 1;
+
+    if( allocDowndLoadDataMem( &DwnLoc, DEFAULT_DL_ALLOC ) == 0 ) {
+    }else{
+        SWLOG_INFO( "DirectCDNDownload: allocDowndLoadDataMem Fail\n" );
+        return curl_ret_code;
+    }
+    if( (pJSONStr=(char*)malloc( JSON_STR_LEN )) != NULL )
+    {
+        if( (pServURL=(char*)malloc( URL_MAX_LEN )) != NULL )
+        {
+            len = GetServURL( pServURL, URL_MAX_LEN );
+            SWLOG_INFO( "DirectCDNDownload: server URL %s\n", pServURL );
+            if( len )
+            {
+                len = createJsonString( pJSONStr, JSON_STR_LEN );
+                if (len >= JSON_STR_LEN) {
+                    SWLOG_ERROR("DirectCDNDownload: JSON buffer overflow: %zu >= %d\n", len, JSON_STR_LEN);
+                    free( pServURL );
+                    free( pJSONStr );
+                    if( DwnLoc.pvOut != NULL )
+                    {
+                        free( DwnLoc.pvOut );
+                    }
+                    return curl_ret_code;
+                }
+		while(cnt < total_retry_cnt && ((pci_upgrade_status == DIRECT_CDN_RETRY_ERR) || (pdri_upgrade_status == DIRECT_CDN_RETRY_ERR)) ) {
+                    SWLOG_INFO("DirectCDNDownload: retry iteration %d/%d (pci=%d pdri=%d)\n",
+                               cnt + 1, total_retry_cnt, pci_upgrade_status, pdri_upgrade_status);
+
+                    // Build context struct for XConf query (refactored API)
+                    RdkUpgradeContext_t xconf_ctx = {0};
+                    xconf_ctx.upgrade_type = XCONF_UPGRADE;
+                    xconf_ctx.server_type = server_type;
+                    xconf_ctx.artifactLocationUrl = pServURL;
+                    xconf_ctx.dwlloc = &DwnLoc;
+                    xconf_ctx.pPostFields = pJSONStr;
+                    xconf_ctx.immed_reboot_flag = immed_reboot_flag;
+                    xconf_ctx.delay_dwnl = delay_dwnl;
+                    xconf_ctx.lastrun = lastrun;
+                    xconf_ctx.disableStatsUpdate = disableStatsUpdate;
+                    xconf_ctx.device_info = device_info;
+                    xconf_ctx.force_exit = &force_exit;
+                    xconf_ctx.trigger_type = getTriggerType();
+                    xconf_ctx.rfc_list = &rfc_list;
+                    xconf_ctx.direct_cdn = true;
+
+                    void *xconf_curl = NULL;
+                    ret = rdkv_upgrade_request(&xconf_ctx, &xconf_curl, pHttp_code);
+
+                    if( ret == 0 && *pHttp_code == 200 && DwnLoc.pvOut != NULL )
+                    {
+                        SWLOG_INFO( "DirectCDNDownload: Calling getXconfRespData with input = %s\n", (char *)DwnLoc.pvOut );
+                        SWLOG_INFO( "DirectCDNDownload: DownloadData Size = %zu\n", DwnLoc.datasize );
+                        xconf_ret = getXconfRespData( response, (char *)DwnLoc.pvOut );
+            		SWLOG_INFO("DirectCDNDownload: XCONF Download Success ret=%d\n", xconf_ret);
+                        if (xconf_ret != 0) {
+                            SWLOG_ERROR("DirectCDNDownload: failed to parse XConf response ret=%d\n", xconf_ret);
+                            break;
+                        }
+                        json_res = processJsonResponse(response, cur_img_name, device_info->model, device_info->maint_status);
+                        SWLOG_INFO("DirectCDNDownload: processJsonResponse returned %d\n", json_res);
+                        if (0 == (strncmp(response->cloudProto, "tftp", 4))) {
+                            proto = 0;
+                        }
+                        if ((proto == 1) && (json_res == 0)) {
+		            if (pci_upgrade_status == DIRECT_CDN_RETRY_ERR) {
+                                pci_upgrade_status = checkTriggerUpgrade(response, device_info->model, PCI_UPGRADE);
+                                SWLOG_INFO("DirectCDNDownload: pci_upgrade_status %d\n", pci_upgrade_status);
+			    } else {
+                                SWLOG_INFO("DirectCDNDownload: PCI already succeeded, skipping\n");
+                            }
+			    if (pdri_upgrade_status == DIRECT_CDN_RETRY_ERR) {
+                                pdri_upgrade_status = checkTriggerUpgrade(response, device_info->model, PDRI_UPGRADE);
+                                SWLOG_INFO("DirectCDNDownload: pdri_upgrade_status %d\n", pdri_upgrade_status);
+			    } else {
+                                SWLOG_INFO("DirectCDNDownload: PDRI already succeeded, skipping\n");
+                            }
+			    if (peri_upgrade_status != 0) {
+                                peri_upgrade_status = checkTriggerUpgrade(response, device_info->model, PERIPHERAL_UPGRADE);
+                                SWLOG_INFO("DirectCDNDownload: peri_upgrade_status %d\n", peri_upgrade_status);
+			    }
+			    if ((pci_upgrade_status == 0) && (pdri_upgrade_status == 0)) {
+				break;
+			    }
+                        }else if(proto == 0) {
+                            SWLOG_INFO("DirectCDNDownload: tftp protocol support not present.\n");
+			    break;
+                        }else {
+                            SWLOG_ERROR("DirectCDNDownload: processJsonResponse return fail:%d\n", json_res);
+			    break;
+                        }
+                    }
+		    else
+		    {
+                            SWLOG_ERROR( "DirectCDNDownload: XCONF fail ret=%d http=%d\n", ret, *pHttp_code );
+			    break;
+		    }
+		    cnt++;
+		}
+                if (cnt >= total_retry_cnt && (pci_upgrade_status == DIRECT_CDN_RETRY_ERR || pdri_upgrade_status == DIRECT_CDN_RETRY_ERR)) {
+                    SWLOG_ERROR("DirectCDNDownload: max retries (%d) exhausted (pci=%d pdri=%d)\n",
+                                total_retry_cnt, pci_upgrade_status, pdri_upgrade_status);
+                }
+            }
+            else
+            {
+                SWLOG_ERROR( "DirectCDNDownload: no valid server URL\n" );
+            }
+            free( pServURL );
+        }
+        else
+        {
+            SWLOG_ERROR("DirectCDNDownload: Failed malloc for server URL of %d bytes\n", URL_MAX_LEN );
+        }
+        free( pJSONStr );
+    }
+    else
+    {
+        SWLOG_ERROR("DirectCDNDownload: Failed malloc for json string of %d bytes\n", JSON_STR_LEN );
+    }
+    if( DwnLoc.pvOut != NULL )
+    {
+        free( DwnLoc.pvOut );
+    }
+    if ((pci_upgrade_status == 0) && (pdri_upgrade_status == 0)) {
+	curl_ret_code = 0;
+    }
+    SWLOG_INFO("DirectCDNDownload: Function return %d\n", curl_ret_code);
+    return curl_ret_code;
+}
diff --git a/src/include/json_process.h b/src/include/json_process.h
index aee07c71..4dea8990 100644
--- a/src/include/json_process.h
+++ b/src/include/json_process.h
@@ -38,6 +38,9 @@ typedef struct xconf_response {
 	char dlAppBundle[64];
 	char cloudPDRIVersion[64];
     char rdmCatalogueVersion[512];
+    char firmwareUrl[CLD_URL_MAX_LEN];
+    char remCtrlUrl[CLD_URL_MAX_LEN];
+    char pdriUrl[CLD_URL_MAX_LEN];
 } XCONFRES;
 
 int processJsonResponse(XCONFRES *response, const char *myfwversion, const char *model, const char *maint);
diff --git a/src/include/rdkv_cdl.h b/src/include/rdkv_cdl.h
index 30faff22..e035062c 100644
--- a/src/include/rdkv_cdl.h
+++ b/src/include/rdkv_cdl.h
@@ -27,6 +27,7 @@
 /* Forward declarations for types that may not be available in all contexts */
 typedef struct filedwnl FileDwnl_t;
 typedef struct credential MtlsAuth_t;
+typedef struct deviceproperty DeviceProperty_t;
 #include <inttypes.h>
 #include <ctype.h>
 
@@ -77,6 +78,8 @@ typedef struct credential MtlsAuth_t;
 #define PDRI_UPGRADE 1
 #define XCONF_UPGRADE 2
 #define PERIPHERAL_UPGRADE  3
+#define DIRECT_CDN_RETRY_ERR -2
+#define LEGACY_ALL_UPGRADE -1  /* Legacy mode: all artifacts in sequence */
 
 #define INITIAL_VALIDATION_SUCCESS 0
 #define INITIAL_VALIDATION_FAIL 1
@@ -146,7 +149,9 @@ int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_li
 void uninitialize(int);
 int initialize(void);
 int logFileData(const char *file_path);
-int checkTriggerUpgrade(XCONFRES *pResponse, const char *model);
+int checkTriggerUpgrade(XCONFRES *pResponse, const char *model, int upgrade_type);
+int DirectCDNDownload(XCONFRES *response, char *cur_img_name,
+                      DeviceProperty_t *device_info, int server_type, int *pHttp_code);
 int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint,int trigger_type);
 int postFlash(const char *maint, const char *upgrade_file, int upgrade_type, const char *reboot_flag,int trigger_type);
 void updateUpgradeFlag(int action);
diff --git a/src/include/rdkv_upgrade.h b/src/include/rdkv_upgrade.h
index 433516db..4ae5cd5b 100755
--- a/src/include/rdkv_upgrade.h
+++ b/src/include/rdkv_upgrade.h
@@ -39,6 +39,7 @@ typedef enum {
     RDKV_UPGRADE_SUCCESS = 0,
     RDKV_UPGRADE_ERROR_THROTTLE_ZERO = -100,  // Throttle speed = 0
     RDKV_UPGRADE_ERROR_FORCE_EXIT = -101,      // Force exit (curl 23)
+    RDKV_UPGRADE_ERROR_STATE_RED = -102,       // State red entered, skip retry
 } rdkv_upgrade_error_t;
 
 /**
@@ -67,6 +68,7 @@ typedef struct {
     int trigger_type;                        //    Trigger type
     const Rfc_t* rfc_list;                  //     RFC list
     int download_only;                       //     If non-zero, skip flashing (download-only mode for D-Bus API)
+    bool direct_cdn;                         //     Direct CDN mode flag (skip Codebig fallback)
     //void (*progress_callback)(unsigned long long current_bytes, unsigned long long total_bytes, void* user_data); // Progress callback
     //void* progress_callback_data;            //     User data for progress callback
 } RdkUpgradeContext_t;
diff --git a/src/include/rfcinterface.h b/src/include/rfcinterface.h
index 6eb39521..e717223c 100644
--- a/src/include/rfcinterface.h
+++ b/src/include/rfcinterface.h
@@ -73,12 +73,14 @@ typedef struct rfcdetails {
     char rfc_topspeed[RFC_VALUE_BUF_SIZE];
     char rfc_incr_cdl[RFC_VALUE_BUF_SIZE];
     char rfc_mtls[RFC_VALUE_BUF_SIZE];
+    char rfc_directcdn[RFC_VALUE_BUF_SIZE];
 }Rfc_t;
 
 #define RFC_THROTTLE "Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Feature.SWDLSpLimit.Enable"
 #define RFC_TOPSPEED "Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Feature.SWDLSpLimit.TopSpeed"
 #define RFC_INCR_CDL "Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Feature.IncrementalCDL.Enable"
 #define RFC_MTLS "Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Feature.MTLS.mTlsXConfDownload.Enable"
+#define RFC_DIRECTCDN "Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Feature.SWDLDirect.Enable"
 #define RFC_MNG_NOTIFY "Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Feature.ManageableNotification.Enable"
 
 #define RFC_FW_DWNL_START "Device.DeviceInfo.X_RDKCENTRAL-COM_xOpsDeviceMgmt.RPC.FirmwareDownloadStartedNotification"
@@ -100,6 +102,7 @@ int isMtlsEnabled(const char *);
 int isIncremetalCDLEnable(const char *file_name);
 bool isMmgbleNotifyEnabled(void);
 bool isDebugServicesEnabled(void);
+bool isDirectCDNEnabled(void);
 void getDeviceTypeRFC(char *deviceType, size_t size);
 
 #endif /* VIDEO_RFCINTERFACE_RFCINTERFACE_H_ */
diff --git a/src/json_process.c b/src/json_process.c
index fff4dc62..cbd3855f 100644
--- a/src/json_process.c
+++ b/src/json_process.c
@@ -22,6 +22,7 @@
 #include "download_status_helper.h"
 #include "device_status_helper.h"
 #include "iarmInterface.h"
+#include "rfcinterface.h"
 #ifndef GTEST_ENABLE
 #include "rdk_fwdl_utils.h"
 #include "system_utils.h"
@@ -277,7 +278,29 @@ int getXconfRespData( XCONFRES *pResponse, char *pJsonStr )
             GetJsonVal( pJson, "rebootImmediately", pResponse->cloudImmediateRebootFlag, sizeof(pResponse->cloudImmediateRebootFlag) );
             GetJsonVal( pJson, "additionalFwVerInfo", pResponse->cloudPDRIVersion, sizeof(pResponse->cloudPDRIVersion) );
             GetJsonVal( pJson, "delayDownload", pResponse->cloudDelayDownload, sizeof(pResponse->cloudDelayDownload) );
-            GetJsonValContaining( pJson, "remCtrl", pResponse->peripheralFirmwares, sizeof(pResponse->peripheralFirmwares) );
+
+            if (isDirectCDNEnabled()) {
+                /* Direct CDN mode: parse per-artifact URLs */
+                //TODO : Check the cases where we have multiple firmware images for the same model
+                GetJsonVal( pJson, "firmware_URL", pResponse->firmwareUrl, sizeof(pResponse->firmwareUrl) );
+                GetJsonVal( pJson, "additionalFwVerInfo_URL", pResponse->pdriUrl, sizeof(pResponse->pdriUrl) );
+
+                /* Dynamic peripheral key */
+                char peripheral_product[64] = {0};
+                char peripheral_product_url[100] = {0};
+                int peri_ret = getPeripheralProduct(peripheral_product, sizeof(peripheral_product));
+                if (peri_ret != -1 && peripheral_product[0] != '\0') {
+                    snprintf(peripheral_product_url, sizeof(peripheral_product_url), "%s_URL", peripheral_product);
+                    GetJsonVal( pJson, peripheral_product, pResponse->peripheralFirmwares, sizeof(pResponse->peripheralFirmwares) );
+                    SWLOG_INFO("remctrl with buf %s= %s\n", peripheral_product, pResponse->peripheralFirmwares);
+                    GetJsonVal( pJson, peripheral_product_url, pResponse->remCtrlUrl, sizeof(pResponse->remCtrlUrl) );
+                    SWLOG_INFO("remctrl with buf url %s= %s\n", peripheral_product_url, pResponse->remCtrlUrl);
+                }
+            } else {
+                /* Legacy mode: use containing-match for peripheral */
+                GetJsonValContaining( pJson, "remCtrl", pResponse->peripheralFirmwares, sizeof(pResponse->peripheralFirmwares) );
+            }
+
             t2ValNotify("SYST_INFO_PRXR_Ver_split", pResponse->peripheralFirmwares);
             GetJsonVal( pJson, "dlCertBundle", pResponse->dlCertBundle, sizeof(pResponse->dlCertBundle) );
             GetJsonVal( pJson, "dlAppBundle", pResponse->dlAppBundle, sizeof(pResponse->dlAppBundle) );
@@ -405,6 +428,10 @@ int processJsonResponse(XCONFRES *response, const char *myfwversion, const char
 	if ((*(response->cloudPDRIVersion)) != 0) {
 	    SWLOG_INFO("Validate PDRI image with device model number\n");
             valid_pdri_img = validateImage(response->cloudPDRIVersion, model);
+            if (valid_pdri_img && (strstr(response->cloudPDRIVersion, "_PDRI_")) == NULL) {
+                SWLOG_INFO("Invalid PDRI image: missing _PDRI_ substring\n");
+                valid_pdri_img = false;
+            }
 	}
         if ((false == valid_img) || (false == valid_pdri_img)) {
             SWLOG_INFO("Image configured is not of model %s.. Skipping the upgrade\nExiting from Image Upgrade process..!\n", model);
diff --git a/src/rdkFwupdateMgr.c b/src/rdkFwupdateMgr.c
index 5b23cdba..5c85d0bb 100644
--- a/src/rdkFwupdateMgr.c
+++ b/src/rdkFwupdateMgr.c
@@ -614,7 +614,7 @@ int peripheral_firmware_dndl( char *pCloudFWLocation, char *pPeripheralFirmwares
 }
 
 
-int checkTriggerUpgrade(XCONFRES *pResponse, const char *model)
+int checkTriggerUpgrade(XCONFRES *pResponse, const char *model, int upgrade_type)
 {
     int http_code;
     int upgrade_status = -1;
@@ -1225,7 +1225,7 @@ int main(int argc, char *argv[]) {
 				       proto = 0;
 				       }
 				       if ((proto == 1) && (json_res == 0)) {
-				       ret_curl_code = checkTriggerUpgrade(&response, device_info.model);
+				       ret_curl_code = checkTriggerUpgrade(&response, device_info.model, LEGACY_ALL_UPGRADE);
 
 				       char *msg = printCurlError(ret_curl_code);
 				       if (msg != NULL) {
diff --git a/src/rdkv_main.c b/src/rdkv_main.c
index 90efaa93..342e6374 100644
--- a/src/rdkv_main.c
+++ b/src/rdkv_main.c
@@ -563,7 +563,7 @@ int peripheral_firmware_dndl( char *pCloudFWLocation, char *pPeripheralFirmwares
     return iRet;
 }
 
-int checkTriggerUpgrade(XCONFRES *pResponse, const char *model)
+int checkTriggerUpgrade(XCONFRES *pResponse, const char *model, int upgrade_type)
 {
     int http_code;
     int upgrade_status = -1;
@@ -572,7 +572,7 @@ int checkTriggerUpgrade(XCONFRES *pResponse, const char *model)
     int pdri_curl_code = -1;
     int peripheral_curl_code = -1;
     char imageHTTPURL[URL_MAX_LEN1];
-    char dwlpath_filename[DWNL_PATH_FILE_LEN1];
+    char dwlpath_filename[MAX_BUFF_SIZE];
     FILE *fp = NULL;
     int optout = -1;
 
@@ -582,7 +582,7 @@ int checkTriggerUpgrade(XCONFRES *pResponse, const char *model)
         SWLOG_ERROR("%s : Parameter is NULL\n", __FUNCTION__);
         return upgrade_status;
     }
-    if (true == isUpgradeInProgress()) {
+     if (true == isUpgradeInProgress()) {
         SWLOG_ERROR("Exiting from DEVICE INITIATED HTTP CDL\nAnother upgrade is in progress\n");
         if (!(strncmp(device_info.maint_status, "true", 4))) {
             eventManager("MaintenanceMGR", MAINT_FWDOWNLOAD_ERROR);
@@ -590,6 +590,96 @@ int checkTriggerUpgrade(XCONFRES *pResponse, const char *model)
         uninitialize(INITIAL_VALIDATION_SUCCESS);
         exit(1);
     }
+    /* Per-artifact mode (Direct CDN): handle a single artifact type */
+    if (upgrade_type != LEGACY_ALL_UPGRADE) {
+        const char *artifact_url = NULL;
+        const char *artifact_file = NULL;
+        int artifact_upgrade_type = upgrade_type;
+
+        switch (upgrade_type) {
+            case PCI_UPGRADE:
+                artifact_url = pResponse->firmwareUrl;
+                artifact_file = pResponse->cloudFWFile;
+                break;
+            case PDRI_UPGRADE:
+                artifact_url = pResponse->pdriUrl;
+                artifact_file = pResponse->cloudPDRIVersion;
+                break;
+            case PERIPHERAL_UPGRADE:
+                artifact_url = pResponse->remCtrlUrl;
+                artifact_file = pResponse->peripheralFirmwares;
+                break;
+            default:
+                SWLOG_ERROR("%s: Unknown upgrade_type %d\n", __FUNCTION__, upgrade_type);
+                return -1;
+        }
+
+        if (artifact_url == NULL || artifact_url[0] == '\0') {
+            SWLOG_INFO("%s: No URL for upgrade_type %d, skipping\n", __FUNCTION__, upgrade_type);
+            return 0;
+        }
+        if (artifact_file == NULL || artifact_file[0] == '\0') {
+            SWLOG_INFO("%s: No file for upgrade_type %d, skipping\n", __FUNCTION__, upgrade_type);
+            return 0;
+        }
+
+        snprintf(imageHTTPURL, sizeof(imageHTTPURL), "%s", artifact_url);
+
+        /* PDRI filename normalization: ensure .bin suffix on local save path */
+        if (upgrade_type == PDRI_UPGRADE && strstr(artifact_file, ".bin") == NULL) {
+            snprintf(dwlpath_filename, sizeof(dwlpath_filename), "%s/%s.bin", device_info.difw_path, artifact_file);
+        } else {
+            snprintf(dwlpath_filename, sizeof(dwlpath_filename), "%s/%s", device_info.difw_path, artifact_file);
+        }
+
+        RdkUpgradeContext_t artifact_ctx = {0};
+        artifact_ctx.upgrade_type = artifact_upgrade_type;
+        artifact_ctx.server_type = HTTP_SSR_DIRECT;
+        artifact_ctx.artifactLocationUrl = imageHTTPURL;
+        artifact_ctx.dwlloc = dwlpath_filename;
+        artifact_ctx.pPostFields = NULL;
+        artifact_ctx.immed_reboot_flag = immed_reboot_flag;
+        artifact_ctx.delay_dwnl = delay_dwnl;
+        artifact_ctx.lastrun = lastrun;
+        artifact_ctx.disableStatsUpdate = disableStatsUpdate;
+        artifact_ctx.device_info = &device_info;
+        artifact_ctx.force_exit = &force_exit;
+        artifact_ctx.trigger_type = trigger_type;
+        artifact_ctx.rfc_list = &rfc_list;
+        artifact_ctx.direct_cdn = true;
+
+        int curl_ret = rdkv_upgrade_request(&artifact_ctx, &curl, &http_code);
+
+        if (curl_ret == 0 && (http_code == HTTP_SUCCESS || http_code == HTTP_CHUNK_SUCCESS)) {
+            SWLOG_INFO("%s: upgrade_type %d succeeded (http %d)\n", __FUNCTION__, upgrade_type, http_code);
+            return 0;
+        }
+        /* Transient curl-level failures → retryable */
+        if (curl_ret == CURL_COULDNT_RESOLVE_HOST || curl_ret == CURL_CONNECTIVITY_ISSUE ||
+            curl_ret == CURLTIMEOUT || curl_ret == CURL_LOW_BANDWIDTH ||
+            curl_ret == CURL_RECV_ERROR) {
+            SWLOG_WARN("%s: upgrade_type %d transient curl error %d, retryable\n",
+                       __FUNCTION__, upgrade_type, curl_ret);
+            return DIRECT_CDN_RETRY_ERR;
+        }
+        /* Transient HTTP-level failures → retryable (server-side temporary errors) */
+        if (curl_ret == 0 && (http_code == 502 || http_code == 503)) {
+            SWLOG_WARN("%s: upgrade_type %d transient HTTP %d, retryable\n",
+                       __FUNCTION__, upgrade_type, http_code);
+            return DIRECT_CDN_RETRY_ERR;
+        }
+        /* HTTP 403 → retryable (token expiry, requires fresh XConf query for new URL) */
+        if (curl_ret == 0 && http_code == 403) {
+            SWLOG_WARN("%s: upgrade_type %d HTTP 403 (token expired), retryable\n",__FUNCTION__, upgrade_type);
+            return DIRECT_CDN_RETRY_ERR;
+        }
+        /* Permanent failure (HTTP 404, validation errors, etc.) */
+        SWLOG_ERROR("%s: upgrade_type %d permanent failure curl=%d http=%d\n",
+                    __FUNCTION__, upgrade_type, curl_ret, http_code);
+        return -1;
+    }
+
+    /* Legacy mode (upgrade_type == -1): existing behavior unchanged */
     if ((strstr(pResponse->cloudFWVersion, model)) == NULL) {
         SWLOG_INFO("cloudFWVersion is empty. Do Nothing\n");
         eventManager(FW_STATE_EVENT, FW_STATE_FAILED);
@@ -1154,35 +1244,47 @@ int main(int argc, char *argv[]) {
 	  }
         }
 	eventManager(FW_STATE_EVENT, FW_STATE_REQUESTING);
-        ret_curl_code = MakeXconfComms( &response, server_type, &http_code );
 
-        SWLOG_INFO("XCONF Download completed with curl code:%d\n", ret_curl_code);
-        if( ret_curl_code == 0 && http_code == 200)
-        {
-            SWLOG_INFO("XCONF Download Success\n");
-            json_res = processJsonResponse(&response, cur_img_detail.cur_img_name, device_info.model, device_info.maint_status);
-            SWLOG_INFO("processJsonResponse returned %d\n", json_res);
-            if (0 == (strncmp(response.cloudProto, "tftp", 4))) {
-                proto = 0;
-            }
-            if ((proto == 1) && (json_res == 0)) {
-                ret_curl_code = checkTriggerUpgrade(&response, device_info.model);
+        /* Direct CDN path: RFC-gated, uses per-artifact orchestration */
+        if (isDirectCDNEnabled()) {
+            SWLOG_INFO("Direct CDN mode enabled, calling DirectCDNDownload\n");
+            ret_curl_code = DirectCDNDownload(&response, cur_img_detail.cur_img_name,
+                                              &device_info, server_type, &http_code);
+            /* DirectCDNDownload already performs JSON parsing/validation internally */
+            json_res = (ret_curl_code == 0) ? 0 : -1;
+            SWLOG_INFO("DirectCDNDownload returned %d\n", ret_curl_code);
+        } else {
+            /* Legacy path: XConf query + sequential download (unchanged) */
+            ret_curl_code = MakeXconfComms( &response, server_type, &http_code );
 
-                char *msg = printCurlError(ret_curl_code);
-                if (msg != NULL) {
-                    SWLOG_INFO("curl return code =%d and error message=%s\n", ret_curl_code, msg);
-                    t2CountNotify("CurlRet_split", ret_curl_code);
+            SWLOG_INFO("XCONF Download completed with curl code:%d\n", ret_curl_code);
+            if( ret_curl_code == 0 && http_code == 200)
+            {
+                SWLOG_INFO("XCONF Download Success\n");
+                json_res = processJsonResponse(&response, cur_img_detail.cur_img_name, device_info.model, device_info.maint_status);
+                SWLOG_INFO("processJsonResponse returned %d\n", json_res);
+                if (0 == (strncmp(response.cloudProto, "tftp", 4))) {
+                    proto = 0;
                 }
-                SWLOG_INFO("rdkvfwupgrader daemon exit curl code: %d\n", ret_curl_code);
-            } else if (proto == 0) {    // tftp = 0
-               SWLOG_INFO("tftp protocol support not present.\n");
-            }
-            else {
-               SWLOG_INFO("Invalid JSON Response.\n");
+                if ((proto == 1) && (json_res == 0)) {
+                    ret_curl_code = checkTriggerUpgrade(&response, device_info.model, LEGACY_ALL_UPGRADE);
+
+                    char *msg = printCurlError(ret_curl_code);
+                    if (msg != NULL) {
+                        SWLOG_INFO("curl return code =%d and error message=%s\n", ret_curl_code, msg);
+                        t2CountNotify("CurlRet_split", ret_curl_code);
+                    }
+                    SWLOG_INFO("rdkvfwupgrader daemon exit curl code: %d\n", ret_curl_code);
+                } else if (proto == 0) {    // tftp = 0
+                   SWLOG_INFO("tftp protocol support not present.\n");
+                }
+                else {
+                   SWLOG_INFO("Invalid JSON Response.\n");
+                }
+            }else {
+                SWLOG_INFO("XCONF Download Fail\n");
             }
-	}else {
-            SWLOG_INFO("XCONF Download Fail\n");
-	}
+        }
     }
     if (init_validate_status == INITIAL_VALIDATION_DWNL_INPROGRESS){
         if (!(strncmp(device_info.maint_status, "true", 4))) {
@@ -1203,7 +1305,9 @@ int main(int argc, char *argv[]) {
         }
     }
 
-    uninitialize(init_validate_status);
+    if (ret_curl_code != RDKV_UPGRADE_ERROR_STATE_RED) {
+        uninitialize(init_validate_status);
+    }
     exit(ret_curl_code);
 }
 
diff --git a/src/rdkv_upgrade.c b/src/rdkv_upgrade.c
index a23cc8ba..db0ed2ae 100755
--- a/src/rdkv_upgrade.c
+++ b/src/rdkv_upgrade.c
@@ -513,11 +513,18 @@ int rdkv_upgrade_request(const RdkUpgradeContext_t* context, void** curl, int* p
 	    else if (ret_curl_code == RDKV_UPGRADE_ERROR_FORCE_EXIT) {
 		    return RDKV_UPGRADE_ERROR_FORCE_EXIT;
 	    }
+	    else if (ret_curl_code == RDKV_UPGRADE_ERROR_STATE_RED) {
+		    return RDKV_UPGRADE_ERROR_STATE_RED;
+	    }
 
             if (ret_curl_code != CURL_SUCCESS ||
                 (*pHttp_code != HTTP_SUCCESS && *pHttp_code != HTTP_CHUNK_SUCCESS && *pHttp_code != HTTP_PAGE_NOT_FOUND)) {
                 ret_curl_code = retryDownload(context, RETRY_COUNT, 60, pHttp_code, curl);
                 if (ret_curl_code == CURL_CONNECTIVITY_ISSUE || *pHttp_code == 0) {
+                    /* Direct CDN mode: skip Codebig fallback */
+                    if (context->direct_cdn) {
+                        SWLOG_INFO("%s : Direct CDN mode - skipping Codebig fallback\n", __FUNCTION__);
+                    } else {
                     if (server_type == HTTP_SSR_DIRECT) {
                         SWLOG_ERROR("%s : Direct Image upgrade Failed: http_code:%d, attempting codebig\n", __FUNCTION__, *pHttp_code);
                     }else {
@@ -533,6 +540,7 @@ int rdkv_upgrade_request(const RdkUpgradeContext_t* context, void** curl, int* p
                         fallback_context.server_type = HTTP_XCONF_CODEBIG;
                     }
                     ret_curl_code = fallBack(&fallback_context, pHttp_code, curl);
+                    }
                 }
             }
         }
@@ -544,6 +552,9 @@ int rdkv_upgrade_request(const RdkUpgradeContext_t* context, void** curl, int* p
             else if (ret_curl_code == RDKV_UPGRADE_ERROR_FORCE_EXIT) {
                     return RDKV_UPGRADE_ERROR_FORCE_EXIT;
             }
+            else if (ret_curl_code == RDKV_UPGRADE_ERROR_STATE_RED) {
+                    return RDKV_UPGRADE_ERROR_STATE_RED;
+            }
             if (ret_curl_code != CURL_SUCCESS ||
                 (*pHttp_code != HTTP_SUCCESS && *pHttp_code != HTTP_CHUNK_SUCCESS && *pHttp_code != HTTP_PAGE_NOT_FOUND)) {
                 if( ret_curl_code != CODEBIG_SIGNING_FAILED )
@@ -698,7 +709,12 @@ int codebigdownloadFile(
         SWLOG_ERROR("%s: curl parameter (pointer) is NULL\n", __FUNCTION__);
         return curl_ret_code;
     }
-
+     *httpCode = 0;
+    /* Direct CDN mode must never enter Codebig path */
+    if (context->direct_cdn) {
+        SWLOG_INFO("%s: Direct CDN mode - Codebig path not permitted, returning\n", __FUNCTION__);
+        return curl_ret_code;
+    }
 
     int server_type = context->server_type;
     const char* artifactLocationUrl = context->artifactLocationUrl;
@@ -716,7 +732,7 @@ int codebigdownloadFile(
         SWLOG_ERROR("%s: artifactLocationUrl or localDownloadLocation is NULL\n", __FUNCTION__);
         return curl_ret_code;
     }
-    *httpCode = 0;
+   
 
 #ifdef DEBUG_CODEBIG_CDL
     if( filePresentCheck( "/tmp/.forceCodebigFailure" ) == RDK_API_SUCCESS )
@@ -1019,7 +1035,7 @@ int downloadFile(
         chunk_dwnl = isIncremetalCDLEnable(file_dwnl.pathname);
     }
 #ifndef LIBRDKCERTSELECTOR	
-    SWLOG_INFO("1 Fetching MTLS credential for SSR/XCONF\n");
+    SWLOG_INFO("Fetching MTLS credential for SSR/XCONF\n");
     ret = getMtlscert(&sec);
     if (-1 == ret) {
         SWLOG_ERROR("%s : getMtlscert() Featching MTLS fail. Going For NON MTLS:%d\n", __FUNCTION__, ret);
@@ -1042,7 +1058,7 @@ int downloadFile(
             if (checkAndEnterStateRed(CURL_MTLS_LOCAL_CERTPROBLEM, disableStatsUpdate) != 0) {
                 SWLOG_ERROR("%s : State red entered due to MTLS cert problem\n", __FUNCTION__);
             }
-            return curl_ret_code;
+            return RDKV_UPGRADE_ERROR_STATE_RED;
         } else if (ret == STATE_RED_CERT_FETCH_FAILURE) {
             SWLOG_ERROR("%s : State red cert failed.\n", __FUNCTION__);
             return curl_ret_code;
@@ -1164,6 +1180,10 @@ int downloadFile(
         SWLOG_ERROR("%s : Direct Image upgrade Fail: curl ret:%d http_code:%d\n", __FUNCTION__, curl_ret_code, *httpCode);
         (server_type == HTTP_SSR_DIRECT) ? setDwnlState(RDKV_FWDNLD_DOWNLOAD_FAILED) : setDwnlState(RDKV_XCONF_FWDNLD_DOWNLOAD_FAILED);
         dwnlError(curl_ret_code, *httpCode, server_type,device_info,lastrun,disableStatsUpdate);
+        if (filePresentCheck(STATEREDFLAG) == 0) {
+            SWLOG_INFO("%s : State red entered during download, skipping retry\n", __FUNCTION__);
+            return RDKV_UPGRADE_ERROR_STATE_RED;
+        }
         if( *(file_dwnl.pathname) != 0 )
         {
             unlink(file_dwnl.pathname);
diff --git a/src/rfcInterface/rfcinterface.c b/src/rfcInterface/rfcinterface.c
index e7ad2d73..aca1d537 100644
--- a/src/rfcInterface/rfcinterface.c
+++ b/src/rfcInterface/rfcinterface.c
@@ -78,6 +78,14 @@ int getRFCSettings(Rfc_t *rfc_list) {
     strncpy(rfc_list->rfc_mtls, "true", RFC_VALUE_BUF_SIZE - 1);
     rfc_list->rfc_mtls[RFC_VALUE_BUF_SIZE - 1] = '\0';
 #endif
+    ret = read_RFCProperty("DIRECTCDN", RFC_DIRECTCDN, data, sizeof(data));
+    if(ret == -1) {
+        SWLOG_ERROR("getRFCSettings() rfc= %s failed Status %d\n", RFC_DIRECTCDN, ret);
+    }else {
+        strncpy(rfc_list->rfc_directcdn, data, RFC_VALUE_BUF_SIZE - 1);
+        rfc_list->rfc_directcdn[RFC_VALUE_BUF_SIZE - 1] = '\0';
+        SWLOG_INFO("getRFCSettings() rfc DirectCDN= %s\n", rfc_list->rfc_directcdn);
+    }
     return 0;
 }
 
@@ -310,6 +318,25 @@ bool isDebugServicesEnabled(void)
     return status;
 }
 
+bool isDirectCDNEnabled(void)
+{
+    bool status = false;
+    int ret = -1;
+    char rfc_data[RFC_VALUE_BUF_SIZE];
+
+    *rfc_data = 0;
+    ret = read_RFCProperty("DIRECTCDN", RFC_DIRECTCDN, rfc_data, sizeof(rfc_data));
+    if (ret == -1) {
+        SWLOG_ERROR("%s: rfc DirectCDN =%s failed Status %d\n", __FUNCTION__, RFC_DIRECTCDN, ret);
+    } else {
+        SWLOG_INFO("%s: rfc DirectCDN= %s\n", __FUNCTION__, rfc_data);
+        if ((strncmp(rfc_data, "true", 4)) == 0) {
+            status = true;
+        }
+    }
+    return status;
+}
+
 
 /* Description: Reads the device type RFC value and copies it into the provided buffer.
  * @param deviceType Output buffer that receives the device type string ("test", "prod", or "unknown").
diff --git a/unittest/Makefile.am b/unittest/Makefile.am
index dc797177..05f0481b 100644
--- a/unittest/Makefile.am
+++ b/unittest/Makefile.am
@@ -52,6 +52,7 @@ rdkfw_deviceutils_gtest_SOURCES = deviceutils/device_api_gtest.cpp deviceutils/d
 # Note: The original design (develop/) also excluded these helper files, relying on mocks
 rdkfw_main_gtest_SOURCES = basic_rdkv_main_gtest.cpp \
     ../src/rdkv_main.c \
+    ../src/directcdn.c \
     ../src/rdkv_upgrade.c \
     ../src/chunk.c \
     ../src/flash.c \
diff --git a/unittest/basic_rdkv_main_gtest.cpp b/unittest/basic_rdkv_main_gtest.cpp
old mode 100644
new mode 100755
index 8cc1df97..a6f2f260
--- a/unittest/basic_rdkv_main_gtest.cpp
+++ b/unittest/basic_rdkv_main_gtest.cpp
@@ -1,1489 +1,2751 @@
-/*
- * Copyright 2023 Comcast Cable Communications Management, LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include <gtest/gtest.h>
-#include <gmock/gmock.h>
-#include <gtest/gtest.h> 
-#include <iostream>
-#include <unistd.h>
-
-#include "rdkv_cdl_log_wrapper.h"
-extern "C" {
-#include "device_status_helper.h"
-#include "download_status_helper.h"
-//#include "json_process.h"
-//#include "rdk_fwdl_utils.h"
-int copyFile(const char *src, const char *target);
-}
-
-#include "./mocks/device_status_helper_mock.h"
-#include "./mocks/deviceutils_mock.h"
-
-#include "miscellaneous.h"
-#include "miscellaneous_mock.cpp"
-#include "deviceutils_mock_global.h"
-
-#define JSON_STR_LEN        1000
-
-DeviceUtilsMock Deviceglobal;
-//DeviceUtilsMock *g_DeviceUtilsMock = &Deviceglobal;
-
-#define GTEST_DEFAULT_RESULT_FILEPATH "/tmp/Gtest_Report/"
-#define GTEST_DEFAULT_RESULT_FILENAME "RdkFwDwnld_rdkvMain_gtest_report.json"
-#define GTEST_REPORT_FILEPATH_SIZE 256
-
-using namespace testing;
-using namespace std;
-using ::testing::Return;
-using ::testing::StrEq;
-
-extern "C" {
-    extern Rfc_t rfc_list;
-    extern DeviceProperty_t device_info;
-    extern void *curl;
-
-    bool savePID(const char *file, char *data);
-    void interuptDwnl(int app_mode);
-    int doInteruptDwnl(void *in_curl, unsigned int max_dwnl_speed);
-    bool checkt2ValNotify( int iCurlCode, int iUpgradeType, char *Url  );
-    unsigned int doGetDwnlBytes(void *in_curl);
-    bool checkForTlsErrors(int curl_code, const char *type);
-    int retryDownload(const RdkUpgradeContext_t* context, int retry_cnt, int delay, int *httpCode, void **curl);
-
-    int downloadFile(const RdkUpgradeContext_t* context, int *httpCode, void **curl);
-    int checkTriggerUpgrade(XCONFRES *response, const char *model_num);
-    void setForceStop(int value);
-    T2ERROR t2_event_s(char* marker, char* value);
-    T2ERROR t2_event_d(char* marker, int value);
-    void t2_init(char *component);
-    int getDeviceProperties(DeviceProperty_t *pDevice_info);
-    int getImageDetails(ImageDetails_t *);
-    int createDir(const char *dirname);
-    //void createFile(const char *file_name);
-    void t2_uninit(void);
-    void log_exit();
-    int doHttpFileDownload(void *in_curl, FileDwnl_t *pfile_dwnl, MtlsAuth_t *auth, unsigned int max_dwnl_speed, char *dnl_start_pos, int *out_httpCode );
-    int logFileData(const char *file_path);
-    bool isMediaClientDevice(void);
-    int doAuthHttpFileDownload(void *in_curl, FileDwnl_t *pfile_dwnl, int *out_httpCode);
-    void logMilestone(const char *msg_code);
-    int eraseFolderExceParamFile(const char *folder, const char* file_name,const char* pdri_file_name, const char *model_num);
-    int doCurlPutRequest(void *in_curl, FileDwnl_t *pfile_dwnl, char *jsonrpc_auth_token, int *out_httpCode);
-    int getOPTOUTValue(const char *filename);
-    void getPidStore(const char *key, const char *value);
-    void dwnlError(int curl_code, int http_code, int server_type, const DeviceProperty_t *device_info, const char *lastrun, char *disableStatsUpdate);
-    int peripheral_firmware_dndl(char *pCloudFWLocation, char *pPeripheralFirmwares);
-    int fallBack(const RdkUpgradeContext_t* context, int *httpCode, void **curl);
-    void saveHTTPCode(int http_code, const char *lastrun);
-    int rdkv_upgrade_request(const RdkUpgradeContext_t* context, void** curl, int* pHttp_code);
-    size_t getContentLength(const char *file);
-    int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode);
-}
-
-TEST(getContentLengthTest,TestSuccess){
-    int ret = 0;
-    ret = system("echo \"Content-Length: 1234\" > /tmp/contentlength.txt");
-    EXPECT_NE(getContentLength("/tmp/contentlength.txt"), 0);
-    ret = system("rm -f /tmp/contentlength.txt");
-}
-TEST(getContentLengthTest,TestFail){
-    EXPECT_EQ(getContentLength("./contentlength.txt"), 0);
-}
-TEST(getContentLengthTest,TestFail1){
-    int ret = 0;
-    ret = system("echo \"Content: 1234\" > /tmp/contentlength.txt");
-    EXPECT_EQ(getContentLength("/tmp/contentlength.txt"), 0);
-    ret  = system("rm -f /tmp/contentlength.txt");
-}
-
-TEST(MainHelperFunctionTest,getAppModeDefault){
-    EXPECT_EQ(getAppMode(), 1);
-}
-
-TEST(MainHelperFunctionTest,setAppModeDefault){
-    setAppMode(0);
-    EXPECT_EQ(getAppMode(), 0);
-}
-
-TEST(MainHelperFunctionTest,setandgetAppMode){
-    setAppMode(1);
-    EXPECT_EQ(getAppMode(), 1);
-}
-
-TEST(MainHelperFunctionTest,getDwnlStateDefault){
-    EXPECT_EQ(getDwnlState(), 0);
-}
-
-TEST(MainHelperFunctionTest,setDwnlStateDefault){
-    setDwnlState(0);
-    EXPECT_EQ(getDwnlState(), 0);
-}
-TEST(MainHelperFunctionTest,setandgetDwnlState){
-    setDwnlState(1);
-    EXPECT_EQ(getDwnlState(), 1);
-}
-
-TEST(MainHelperFunctionTest,savePIDTestnull){
-    EXPECT_FALSE(savePID((const char *) NULL, (char *) NULL));
-}
-
-TEST(MainHelperFunctionTest,savePIDTestnullfp){
-    EXPECT_FALSE(savePID((const char *) "testfile",(char *) NULL));
-}
-
-TEST(MainHelperFunctionTest,savePIDTestnullfp1){
-    char data[] = "1234";
-    EXPECT_FALSE(savePID("/com/testfile",data));
-}
-
-TEST(MainHelperFunctionTest,savePIDTestSuccess){
-    char data[] = "1234";
-    EXPECT_TRUE(savePID("/tmp/testfile", data));
-}
-
-TEST(MainHelperFunctionTest,getPidStore){
-
-    char buff[16] = {0};
-    FILE *fp = NULL;
-    getPidStore("NEW","true");
-    fflush(NULL);
-    fp = fopen("/tmp/.curl.pid", "r");
-    if (fp != NULL) {
-    printf("File open success\n");
-    while((fgets(buff, sizeof(buff), fp)) != NULL) {
-        printf("After read buf = %s\n",buff);
-    }
-    fclose(fp);
-    }
-    pid_t pid = getpid();
-    unsigned int read_pid = atoi(buff);
-    printf("pid = %u and read_pid = %u\n", pid, read_pid);
-    EXPECT_EQ(pid, read_pid);
-}
-
-TEST(MainHelperFunctionTest, HandlesDownloadInProgress) {
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    strcpy(rfc_list.rfc_throttle, "true");
-    strcpy(rfc_list.rfc_topspeed, "0");
-    setDwnlState(RDKV_FWDNLD_DOWNLOAD_INPROGRESS);
-    strcpy(device_info.maint_status, "true");
-    EXPECT_CALL(mockexternal,eventManager("MaintenanceMGR", "9")).Times(1);
-    EXPECT_CALL(mockexternal,eventManager(FW_STATE_EVENT, "3")).Times(1);
-    interuptDwnl(0);
-    global_mockexternal_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest, HandlesDownloadInProgressSpeed10) {
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    strcpy(rfc_list.rfc_throttle, "true");
-    strcpy(rfc_list.rfc_topspeed, "10");
-    setDwnlState(RDKV_FWDNLD_DOWNLOAD_INPROGRESS);
-    strcpy(device_info.maint_status, "true");
-    EXPECT_CALL(mockexternal,doGetDwnlBytes(_)).Times(1).WillOnce(Return(10));
-    curl = (char *) rfc_list.rfc_throttle;
-    EXPECT_CALL(mockexternal,doInteruptDwnl(_,10)).Times(1).WillOnce(Return(DWNL_UNPAUSE_FAIL));
-    interuptDwnl(0);
-    curl = NULL;
-    global_mockexternal_ptr = NULL;
-
-}
-
-TEST(MainHelperFunctionTest, HandlesDownloadInProgressAppMode1) {
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    strcpy(rfc_list.rfc_throttle, "true");
-    strcpy(rfc_list.rfc_topspeed, "10");
-    setDwnlState(RDKV_FWDNLD_DOWNLOAD_INPROGRESS);
-    strcpy(device_info.maint_status, "true");
-    EXPECT_CALL(mockexternal,doGetDwnlBytes(_)).Times(1).WillOnce(Return(10));
-    curl = (char *) rfc_list.rfc_throttle;
-    interuptDwnl(1);
-    curl = NULL;
-    global_mockexternal_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest, HandlesDownloadInProgressAppMode2) {
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    strcpy(rfc_list.rfc_throttle, "true");
-    strcpy(rfc_list.rfc_topspeed, "11");
-    setDwnlState(RDKV_FWDNLD_DOWNLOAD_INPROGRESS);
-    strcpy(device_info.maint_status, "true");
-    EXPECT_CALL(mockexternal,doGetDwnlBytes(_)).Times(1).WillOnce(Return(10));
-    curl = (char *) rfc_list.rfc_throttle;
-    interuptDwnl(2);
-    curl = NULL;
-    global_mockexternal_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest, t2ValNotifyHandlesNullInputs) {
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    t2ValNotify(NULL, NULL);
-    global_mockexternal_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest, t2ValNotifyHandlesNonNullInputs) {
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    EXPECT_CALL(mockexternal, t2_event_s("marker", "value")).Times(1).WillOnce(testing::Return(T2ERROR_SUCCESS));
-    t2ValNotify("marker", "value");
-    global_mockexternal_ptr = NULL;
-}
-
-
-TEST(MainHelperFunctionTest, checkt2ValNotifynegative){
-    EXPECT_FALSE(checkt2ValNotify(100, PERIPHERAL_UPGRADE,"thisistest"));
-}
-
-TEST(MainHelperFunctionTest, checkt2ValNotifynegative1){
-    EXPECT_FALSE(checkt2ValNotify(35, PERIPHERAL_UPGRADE,"thisistest"));
-}
-
-TEST(MainHelperFunctionTest, checkt2ValNotifynegative2){
-    EXPECT_FALSE(checkt2ValNotify(91, PERIPHERAL_UPGRADE,"thisistest"));
-}
-
-TEST(MainHelperFunctionTest, checkt2ValNotifypositive){
-    EXPECT_TRUE(checkt2ValNotify(35, PERIPHERAL_UPGRADE,"https://thisistest.com/test"));
-}
-
-TEST(MainHelperFunctionTest, checkForTlsErrorsnegative){
-    EXPECT_TRUE(checkForTlsErrors(100, "https://thisistest"));
-}
-
-TEST(MainHelperFunctionTest, checkForTlsErrorspositive){
-    EXPECT_TRUE(checkForTlsErrors(91, "https://thisistest"));
-}
-
-TEST(MainHelperFunctionTest, retryDownloadtest){
-    // Test with NULL context - should handle gracefully
-    EXPECT_EQ(retryDownload(NULL, 1, 0, NULL, NULL), -1);
-}
-
-TEST(MainHelperFunctionTest, retryDownloadtest1){
-    MockDownloadFileOps mockfileops;
-    global_mockdownloadfileops_ptr = &mockfileops;
-    EXPECT_CALL(mockfileops, downloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(CURL_SUCCESS));
-    int code = HTTP_SUCCESS;
-    int force_exit = 0;
-    int dummy_curl = 0;
-    void *curl = &dummy_curl;  // Must point to valid memory, not NULL
-    
-    RdkUpgradeContext_t context = {};
-    context.server_type = HTTP_SSR_DIRECT;
-    context.artifactLocationUrl = "test";
-    context.dwlloc = "test1";
-    context.pPostFields = (char*)"test2";
-    context.force_exit = &force_exit;
-    
-    EXPECT_EQ(retryDownload(&context, 1, 0, &code, &curl), CURL_SUCCESS);
-    global_mockdownloadfileops_ptr = NULL;
-}
-TEST(MainHelperFunctionTest, retryDownloadtest2){
-    MockDownloadFileOps mockfileops;
-    global_mockdownloadfileops_ptr = &mockfileops;
-    EXPECT_CALL(mockfileops, downloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(CURL_SUCCESS));
-    int code = HTTP_CHUNK_SUCCESS;
-    int force_exit = 0;
-    int dummy_curl = 0;
-    void *curl = &dummy_curl;
-    
-    RdkUpgradeContext_t context = {};
-    context.server_type = HTTP_XCONF_DIRECT;
-    context.artifactLocationUrl = "test";
-    context.dwlloc = "test1";
-    context.pPostFields = (char*)"test2";
-    context.force_exit = &force_exit;
-    
-    EXPECT_EQ(retryDownload(&context, 1, 0, &code, &curl), CURL_SUCCESS);
-    global_mockdownloadfileops_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest, retryDownloadtest3){
-    MockDownloadFileOps mockfileops;
-    global_mockdownloadfileops_ptr = &mockfileops;
-    EXPECT_CALL(mockfileops, downloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(!CURL_SUCCESS));
-    int code = HTTP_PAGE_NOT_FOUND;
-    int force_exit = 0;
-    int dummy_curl = 0;
-    void *curl = &dummy_curl;
-    
-    RdkUpgradeContext_t context = {};
-    context.server_type = HTTP_XCONF_DIRECT;
-    context.artifactLocationUrl = "test";
-    context.dwlloc = "test1";
-    context.pPostFields = (char*)"test2";
-    context.force_exit = &force_exit;
-    
-    EXPECT_EQ(retryDownload(&context, 1, 0, &code, &curl), !CURL_SUCCESS);
-    global_mockdownloadfileops_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest, retryDownloadtest4){
-    MockDownloadFileOps mockfileops;
-    global_mockdownloadfileops_ptr = &mockfileops;
-    EXPECT_CALL(mockfileops, downloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(!CURL_SUCCESS));
-    int code = DWNL_BLOCK;
-    int force_exit = 0;
-    int dummy_curl = 0;
-    void *curl = &dummy_curl;
-    
-    RdkUpgradeContext_t context = {};
-    context.server_type = HTTP_XCONF_DIRECT;
-    context.artifactLocationUrl = "test";
-    context.dwlloc = "test1";
-    context.pPostFields = (char*)"test2";
-    context.force_exit = &force_exit;
-    
-    EXPECT_EQ(retryDownload(&context, 1, 0, &code, &curl), !CURL_SUCCESS);
-    global_mockdownloadfileops_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest, retryDownloadtest5){
-    MockDownloadFileOps mockfileops;
-    global_mockdownloadfileops_ptr = &mockfileops;
-    EXPECT_CALL(mockfileops, downloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(!CURL_SUCCESS));
-    int code = HTTP_SUCCESS;
-    int force_exit = 0;
-    int dummy_curl = 0;
-    void *curl = &dummy_curl;
-    
-    RdkUpgradeContext_t context = {};
-    context.server_type = HTTP_SSR_DIRECT;
-    context.artifactLocationUrl = "test";
-    context.dwlloc = "test1";
-    context.pPostFields = (char*)"test2";
-    context.force_exit = &force_exit;
-    
-    EXPECT_EQ(retryDownload(&context, 1, 0, &code, &curl), !CURL_SUCCESS);
-    global_mockdownloadfileops_ptr = NULL;
-
-}
-
-TEST(MainHelperFunctionTest, retryDownloadtest6){
-    MockDownloadFileOps mockfileops;
-    global_mockdownloadfileops_ptr = &mockfileops;
-    EXPECT_CALL(mockfileops, codebigdownloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(CURL_SUCCESS));
-    int code = HTTP_SUCCESS;
-    int force_exit = 0;
-    int dummy_curl = 0;
-    void *curl = &dummy_curl;
-    
-    RdkUpgradeContext_t context = {};
-    context.server_type = HTTP_SSR_CODEBIG;
-    context.artifactLocationUrl = "test";
-    context.dwlloc = "test1";
-    context.pPostFields = (char*)"test2";
-    context.force_exit = &force_exit;
-    
-    EXPECT_EQ(retryDownload(&context, 1, 0, &code, &curl), CURL_SUCCESS);
-    global_mockdownloadfileops_ptr = NULL;
-
-}
-
-TEST(MainHelperFunctionTest, retryDownloadtest7){
-    MockDownloadFileOps mockfileops;
-    global_mockdownloadfileops_ptr = &mockfileops;
-    EXPECT_CALL(mockfileops, codebigdownloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(!CURL_SUCCESS));
-    int code = HTTP_PAGE_NOT_FOUND;
-    int force_exit = 0;
-    int dummy_curl = 0;
-    void *curl = &dummy_curl;
-    
-    RdkUpgradeContext_t context = {};
-    context.server_type = HTTP_SSR_CODEBIG;
-    context.artifactLocationUrl = "test";
-    context.dwlloc = "test1";
-    context.pPostFields = (char*)"test2";
-    context.force_exit = &force_exit;
-    
-    EXPECT_EQ(retryDownload(&context, 1, 0, &code, &curl), !CURL_SUCCESS);
-    global_mockdownloadfileops_ptr = NULL;
-
-}
-
-TEST(MainHelperFunctionTest, retryDownloadtest8){
-    MockDownloadFileOps mockfileops;
-    global_mockdownloadfileops_ptr = &mockfileops;
-    EXPECT_CALL(mockfileops, codebigdownloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(!CURL_SUCCESS));
-    int code = HTTP_SUCCESS;
-    int force_exit = 0;
-    int dummy_curl = 0;
-    void *curl = &dummy_curl;
-    
-    RdkUpgradeContext_t context = {};
-    context.server_type = HTTP_SSR_CODEBIG;
-    context.artifactLocationUrl = "test";
-    context.dwlloc = "test1";
-    context.pPostFields = (char*)"test2";
-    context.force_exit = &force_exit;
-    
-    EXPECT_EQ(retryDownload(&context, 1, 1, &code, &curl), !CURL_SUCCESS);
-    global_mockdownloadfileops_ptr = NULL;
-}
-
-TEST(DwnlErrorTest, HandlesCurlCode0) {
-    int curl_code = 0;
-    int http_code = 200;
-    int server_type = 0;
-    DeviceProperty_t device_info = {0};
-    strcpy(device_info.dev_type, "mediaclient");
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    EXPECT_CALL(mockexternal,checkAndEnterStateRed(_,_)).Times(1);
-    dwnlError(curl_code, http_code, server_type,  &device_info, NULL, NULL);
-    global_mockexternal_ptr = NULL;
-
-}
-
-TEST(DwnlErrorTest, HandlesCurlCode22) {
-    int curl_code = 22;
-    int http_code = 200;
-    int server_type = 0;
-    DeviceProperty_t device_info = {0};
-    strcpy(device_info.dev_type, "mediaclient");
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    EXPECT_CALL(mockexternal,eventManager(_,_)).Times(1);
-    EXPECT_CALL(mockexternal,checkAndEnterStateRed(_,_)).Times(1);
-    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
-    dwnlError(curl_code, http_code, server_type,  &device_info, NULL, NULL);
-    global_mockexternal_ptr = NULL;
-
-}
-
-TEST(DwnlErrorTest, HandlesCurlCode18) {
-    int curl_code = 18;
-    int http_code = 0;
-    int server_type = 0;
-    DeviceProperty_t device_info = {0};
-    strcpy(device_info.dev_type, "mediaclient");
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    strcpy(device_info.dev_type,"mediaclient");
-    EXPECT_CALL(mockexternal,eventManager(_,_)).Times(1);
-    EXPECT_CALL(mockexternal,checkAndEnterStateRed(_,_)).Times(1);
-    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
-    dwnlError(curl_code, http_code, server_type,  &device_info, NULL, NULL);
-    global_mockexternal_ptr = NULL;
-
-}
-
-TEST(DwnlErrorTest, HandlesCurlCode91) {
-    int curl_code = 91;
-    int http_code = 200;
-    int server_type = 0;
-    DeviceProperty_t device_info = {0};
-    strcpy(device_info.dev_type, "mediaclient1");
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    EXPECT_CALL(mockexternal,eventManager(_,_)).Times(1);
-    EXPECT_CALL(mockexternal,checkAndEnterStateRed(_,_)).Times(1);
-    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
-    dwnlError(curl_code, http_code, server_type,  &device_info, NULL, NULL);
-    global_mockexternal_ptr = NULL;
-
-}
-TEST(MainHelperFunctionTest,rdkv_upgrade_requestTest){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    // Create context structure with test values
-    RdkUpgradeContext_t context = {0};
-    context.upgrade_type = 1;
-    context.server_type = 1;
-    context.artifactLocationUrl = "test";
-    context.dwlloc = "test1";
-    context.pPostFields = (char*)"test2";
-
-    void* curl = NULL;
-    int* http_code = NULL;
-
-    //EXPECT_CALL(mockexternal,checkForValidPCIUpgrade(_,_,_,_)).Times(1).WillOnce(Return(false));
-    EXPECT_EQ(rdkv_upgrade_request(&context, &curl, http_code), -1);
-    global_mockexternal_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest,chunkDownloadTestNULL){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    int httpcode = -1;
-    EXPECT_EQ(chunkDownload(NULL, NULL, 0, &httpcode), -1);
-    //int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode)
-    global_mockexternal_ptr = NULL;
-}
-TEST(MainHelperFunctionTest,chunkDownloadTestSuccess){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    MockExternal mock;
-    global_mockexternal_ptr = &mock;
-
-    int httpcode = -1;
-    char *temp = "temp";
-    int ret = 0;
-    FileDwnl_t file;
-    memset(&file, '\0', sizeof(file));
-    snprintf(file.pathname, sizeof(file.pathname),"%s", "/tmp/testfirmware.bin");
-    ret = system("echo \"Content-Length: 1234\" > /tmp/testfirmware.bin.header");
-
-    EXPECT_CALL(DeviceMock,getFileSize(_)).WillRepeatedly(Return(12));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    // Set expectations on the mock methods
-    EXPECT_CALL(*g_DeviceUtilsMock, doCurlInit()).WillRepeatedly(Return((void*)temp));
-    EXPECT_CALL(*g_DeviceUtilsMock, doStopDownload(_)).Times(2);
-    EXPECT_CALL(*global_mockexternal_ptr, doHttpFileDownload(_,_,_,_,_,_)).WillRepeatedly(Return(0));
-
-    EXPECT_EQ(chunkDownload(&file, NULL, 0, &httpcode), 0);
-    ret = system("rm -f  /tmp/testfirmware.bin.header");
-    //int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode)
-    global_mockexternal_ptr = NULL;
-    g_DeviceUtilsMock = &Deviceglobal;
-    global_mockexternal_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest,chunkDownloadFullTestSuccess){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    MockExternal mock;
-    g_DeviceUtilsMock = &DeviceMock;
-    global_mockexternal_ptr = &mock;
-
-    int httpcode = -1;
-    char *temp = "temp";
-    int ret = 0;
-    FileDwnl_t file;
-    memset(&file, '\0', sizeof(file));
-    snprintf(file.pathname, sizeof(file.pathname),"%s", "/tmp/testfirmware.bin");
-    ret = system("echo \"Content-Length: 1234\" > /tmp/testfirmware.bin.header");
-
-    EXPECT_CALL(DeviceMock,getFileSize(_)).WillRepeatedly(Return(12));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    // Set expectations on the mock methods
-    EXPECT_CALL(*g_DeviceUtilsMock, doCurlInit()).WillRepeatedly(Return((void*)temp));
-    EXPECT_CALL(*g_DeviceUtilsMock, doStopDownload(_)).Times(2);
-    EXPECT_CALL(*global_mockexternal_ptr, doHttpFileDownload(_,_,_,_,_,_)).WillRepeatedly(Return(33));
-
-    EXPECT_NE(chunkDownload(&file, NULL, 0, &httpcode), 0);
-    ret = system("rm -f  /tmp/testfirmware.bin.header");
-    //int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode)
-    global_mockexternal_ptr = NULL;
-    g_DeviceUtilsMock = &Deviceglobal;
-    global_mockexternal_ptr = NULL;
-}
-TEST(MainHelperFunctionTest,chunkDownloadNotNeededTest){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    MockExternal mock;
-    g_DeviceUtilsMock = &DeviceMock;
-    global_mockexternal_ptr = &mock;
-
-    int httpcode = -1;
-    char *temp = "temp";
-    int ret = 0;
-    FileDwnl_t file;
-    memset(&file, '\0', sizeof(file));
-    snprintf(file.pathname, sizeof(file.pathname),"%s", "/tmp/testfirmware.bin");
-    ret = system("echo \"Content-Length: 12\" > /tmp/testfirmware.bin.header");
-
-    EXPECT_CALL(DeviceMock,getFileSize(_)).WillRepeatedly(Return(12));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    // Set expectations on the mock methods
-    //EXPECT_CALL(*g_DeviceUtilsMock, doCurlInit()).WillRepeatedly(Return((void*)temp));
-    //EXPECT_CALL(*g_DeviceUtilsMock, doStopDownload(_));
-
-
-    EXPECT_EQ(chunkDownload(&file, NULL, 0, &httpcode), 0);
-    ret = system("rm -f  /tmp/testfirmware.bin.header");
-    //int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode)
-    global_mockexternal_ptr = NULL;
-    g_DeviceUtilsMock = &Deviceglobal;
-    global_mockexternal_ptr = NULL;
-}
-TEST(MainHelperFunctionTest,chunkDownloadgetfilesizeTestFail){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    MockExternal mock;
-    g_DeviceUtilsMock = &DeviceMock;
-    global_mockexternal_ptr = &mock;
-
-    int httpcode = -1;
-    char *temp = "temp";
-    int ret = 0;
-    FileDwnl_t file;
-    memset(&file, '\0', sizeof(file));
-    snprintf(file.pathname, sizeof(file.pathname),"%s", "/tmp/testfirmware.bin");
-    ret = system("echo \"Content-Length: 1234\" > /tmp/testfirmware.bin.header");
-
-    EXPECT_CALL(DeviceMock,getFileSize(_)).WillRepeatedly(Return(-1));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    // Set expectations on the mock methods
-    //EXPECT_CALL(*g_DeviceUtilsMock, doCurlInit()).WillRepeatedly(Return((void*)temp));
-    //EXPECT_CALL(*g_DeviceUtilsMock, doStopDownload(_));
-
-
-    EXPECT_EQ(chunkDownload(&file, NULL, 0, &httpcode), -1);
-    ret = system("rm -f  /tmp/testfirmware.bin.header");
-    //int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode)
-    global_mockexternal_ptr = NULL;
-    g_DeviceUtilsMock = &Deviceglobal;
-    global_mockexternal_ptr = NULL;
-}
-
-/* Test: Verify that when getFileSize() returns -1 (error), chunkDownload()
- * cleans up both the partial image file and its .header file via unlink(). */
-TEST(MainHelperFunctionTest,chunkDownloadgetfilesizeFailCleansUpFiles){
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    MockExternal mock;
-    global_mockexternal_ptr = &mock;
-
-    int httpcode = -1;
-    int ret = 0;
-    FileDwnl_t file;
-    memset(&file, '\0', sizeof(file));
-    snprintf(file.pathname, sizeof(file.pathname),"%s", "/tmp/testfirmware_cleanup1.bin");
-
-    /* Create real files so unlink() has something to remove */
-    ret = system("echo 'partial data' > /tmp/testfirmware_cleanup1.bin");
-    ret = system("echo 'Content-Length: 1234' > /tmp/testfirmware_cleanup1.bin.header");
-
-    /* filePresentCheck returns 0 (file exists) for all checks */
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    /* getFileSize returns -1 to trigger the error/cleanup path */
-    EXPECT_CALL(DeviceMock, getFileSize(_)).WillRepeatedly(Return(-1));
-
-    EXPECT_EQ(chunkDownload(&file, NULL, 0, &httpcode), -1);
-
-    /* Verify both files were cleaned up by unlink() */
-    EXPECT_NE(access("/tmp/testfirmware_cleanup1.bin", F_OK), 0)
-        << "Partial image file should have been removed";
-    EXPECT_NE(access("/tmp/testfirmware_cleanup1.bin.header", F_OK), 0)
-        << "Header file should have been removed";
-
-    /* Safety cleanup in case test assertions fail */
-    ret = system("rm -f /tmp/testfirmware_cleanup1.bin /tmp/testfirmware_cleanup1.bin.header");
-    global_mockexternal_ptr = NULL;
-    g_DeviceUtilsMock = &Deviceglobal;
-}
-
-/* Test: Verify that when content_len is 0 (no Content-Length in header)
- * and the partial file is present, chunkDownload() cleans up both files. */
-TEST(MainHelperFunctionTest,chunkDownloadNoContentLenCleansUpFiles){
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    MockExternal mock;
-    global_mockexternal_ptr = &mock;
-
-    int httpcode = -1;
-    int ret = 0;
-    FileDwnl_t file;
-    memset(&file, '\0', sizeof(file));
-    snprintf(file.pathname, sizeof(file.pathname),"%s", "/tmp/testfirmware_cleanup2.bin");
-
-    /* Create partial image file and a header file with NO Content-Length line */
-    ret = system("echo 'partial data' > /tmp/testfirmware_cleanup2.bin");
-    ret = system("echo 'No-Content-Here' > /tmp/testfirmware_cleanup2.bin.header");
-
-    /* filePresentCheck returns 0 (file exists) for all checks */
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    EXPECT_CALL(DeviceMock, getFileSize(_)).WillRepeatedly(Return(12));
-
-    EXPECT_EQ(chunkDownload(&file, NULL, 0, &httpcode), -1);
-
-    /* Verify both files were cleaned up by unlink() */
-    EXPECT_NE(access("/tmp/testfirmware_cleanup2.bin", F_OK), 0)
-        << "Partial image file should have been removed";
-    EXPECT_NE(access("/tmp/testfirmware_cleanup2.bin.header", F_OK), 0)
-        << "Header file should have been removed";
-
-    /* Safety cleanup in case test assertions fail */
-    ret = system("rm -f /tmp/testfirmware_cleanup2.bin /tmp/testfirmware_cleanup2.bin.header");
-    global_mockexternal_ptr = NULL;
-    g_DeviceUtilsMock = &Deviceglobal;
-}
-
-TEST(MainHelperFunctionTest,chunkDownloadTestFail2){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    MockExternal mock;
-    g_DeviceUtilsMock = &DeviceMock;
-    global_mockexternal_ptr = &mock;
-
-    int httpcode = -1;
-    char *temp = "temp";
-    //int ret = 0;
-    FileDwnl_t file;
-    memset(&file, '\0', sizeof(file));
-    snprintf(file.pathname, sizeof(file.pathname),"%s", "/tmp/testfirmware.bin");
-    //ret = system("echo \"Content-Length: 1234\" > /tmp/testfirmware.bin.header");
-
-    EXPECT_CALL(DeviceMock,getFileSize(_)).WillRepeatedly(Return(12));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(1));
-    // Set expectations on the mock methods
-    //EXPECT_CALL(*g_DeviceUtilsMock, doCurlInit()).WillRepeatedly(Return((void*)temp));
-    //EXPECT_CALL(*g_DeviceUtilsMock, doStopDownload(_));
-
-
-    EXPECT_EQ(chunkDownload(&file, NULL, 0, &httpcode), -1);
-    //ret = system("rm -f  /tmp/testfirmware.bin.header");
-    //int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode)
-    global_mockexternal_ptr = NULL;
-    g_DeviceUtilsMock = &Deviceglobal;
-    global_mockexternal_ptr = NULL;
-}
-// This is a test for the startFactoryProtectService function
-TEST(startFactoryProtectServiceTest, ReturnsZeroWhenSuccessful) {
-    // Create a mock object
-    MockExternal mock;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    global_mockexternal_ptr = &mock;
-    char *temp = "temp";
-    // Set expectations on the mock methods
-    EXPECT_CALL(*g_DeviceUtilsMock, doCurlInit()).WillOnce(Return((void*)temp));
-    EXPECT_CALL(mock, doCurlPutRequest(_, _, _, _)).WillOnce(DoAll(SetArgPointee<3>(200), Return(0)));
-    EXPECT_CALL(*g_DeviceUtilsMock, doStopDownload(_));
-
-    // Call the function to test
-    EXPECT_EQ(startFactoryProtectService(),0);
-    global_mockexternal_ptr = NULL;
-    g_DeviceUtilsMock = &Deviceglobal;
-}
-
-TEST(startFactoryProtectServiceTest, ReturnsminusoneWhenError) {
-    // Create a mock object
-    MockExternal mock;
-    global_mockexternal_ptr = &mock;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    EXPECT_CALL(*g_DeviceUtilsMock, doCurlInit()).WillOnce(Return(NULL));
-
-    // Call the function to test
-    EXPECT_EQ(startFactoryProtectService(), -1);
-    global_mockexternal_ptr = NULL;
-    g_DeviceUtilsMock = &Deviceglobal;
-}
-/*
-TEST(checkTriggerUpgradeTest, ReturnsZeroWhenSuccessful) {
-    // Create a mock object
-    MockFunctionsInternal mock;
-    MockExternal mockexternal;
-
-    // Set expectations on the mock methods
-    EXPECT_CALL(mock, checkForValidPCIUpgrade(_, _, _, _)).WillOnce(Return(true));
-
-    EXPECT_CALL(mock, getOPTOUTValue(_)).WillOnce(Return(0));
-    EXPECT_CALL(mock, uninitialize(_));
-    EXPECT_CALL(mock, upgradeRequest(_, _, _, _, _, _)).WillOnce(DoAll(SetArgPointee<5>(200), Return(0)));
-    EXPECT_CALL(mock, isPDRIEnable()).WillOnce(Return(true));
-    EXPECT_CALL(mock, filePresentCheck(_)).WillOnce(Return(0));
-    EXPECT_CALL(mock, peripheral_firmware_dndl(_, _)).WillOnce(Return(0));
-
-    // Create a response object
-    XCONFRES response;
-    // Fill the response object with test data
-    // ...
-
-    // Call the function to test
-    int result = checkTriggerUpgrade(&response, "testModel");
-
-    // Check the result
-    EXPECT_EQ(result, 0);
-}
-*/
-
-TEST(PeripheralFirmwareDndlTest, HandlesValidInput) {
-
-    MockDownloadFileOps mockdownloadfileops;
-    global_mockdownloadfileops_ptr = &mockdownloadfileops;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-
-    char *pCloudFWLocation = "http://example.com";
-    char *pPeripheralFirmwares = "firmware1,firmware2";
-    EXPECT_CALL(mockdownloadfileops, downloadFile(_,_,_,_,_)).WillRepeatedly(Return(0));
-    EXPECT_CALL(mockdownloadfileops, codebigdownloadFile(_,_,_,_,_)).WillRepeatedly(Return(CODEBIG_SIGNING_FAILED));
-
-    EXPECT_CALL(DeviceMock,getFileSize(_)).WillRepeatedly(Return(-1));
-    int result = peripheral_firmware_dndl(pCloudFWLocation, pPeripheralFirmwares);
-
-    EXPECT_EQ(result, -1);
-    global_mockdownloadfileops_ptr = NULL;
-    g_DeviceUtilsMock = &Deviceglobal;
-}
-
-TEST(PeripheralFirmwareDndlTest, HandlesValidInput404) {
-
-    MockDownloadFileOps mockdownloadfileops;
-    global_mockdownloadfileops_ptr = &mockdownloadfileops;
-
-    char *pCloudFWLocation = "http://example.com";
-    char *pPeripheralFirmwares = "firmware1,firmware2";
-    EXPECT_CALL(mockdownloadfileops, downloadFile(_,_,_,_,_)).WillRepeatedly(Return(HTTP_PAGE_NOT_FOUND));
-    EXPECT_CALL(mockdownloadfileops, codebigdownloadFile(_,_,_,_,_)).WillRepeatedly(Return(0));
-    int result = peripheral_firmware_dndl(pCloudFWLocation, pPeripheralFirmwares);
-
-    // Check the result of the function
-    EXPECT_EQ(result, -1);
-    global_mockdownloadfileops_ptr = NULL;
-    // Check the state of the system after the function call
-    // This depends on what the function is supposed to do
-}
-
-/*
-crashing when the input is NULL
-Program received signal SIGSEGV, Segmentation fault.
-strnlen () at ../sysdeps/aarch64/strnlen.S:63
-63      ../sysdeps/aarch64/strnlen.S: No such file or directory.
-(gdb) bt
-#0  strnlen () at ../sysdeps/aarch64/strnlen.S:63
-#1  0x0000aaaaea1cfdf4 in peripheral_firmware_dndl (pCloudFWLocation=0x0, pPeripheralFirmwares=0x0) at ../video/rdkv_main.c:1338
-#2  0x0000aaaaea1df494 in PeripheralFirmwareDndlTest_HandlesNullInput_Test::TestBody (this=<optimized out>) at basic_rdkv_main_gtest.cpp:456
-#3  0x0000aaaaea318c50 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) ()
-#4  0x0000aaaaea30a99c in testing::Test::Run() ()
-#5  0x0000aaaaea30ab20 in testing::TestInfo::Run() ()
-
-TEST(PeripheralFirmwareDndlTest, HandlesNullInput) {
-    char *pCloudFWLocation = NULL;
-    char *pPeripheralFirmwares = NULL;
-    MockDownloadFileOps mockdownloadfileops;
-    global_mockdownloadfileops_ptr = &mockdownloadfileops;
-    EXPECT_CALL(mockdownloadfileops, downloadFile(_,_,_,_,_)).WillOnce(Return(26));
-    int result = peripheral_firmware_dndl(pCloudFWLocation, pPeripheralFirmwares);
-
-    // Check the result of the function
-    EXPECT_EQ(result, -1);
-    global_mockdownloadfileops_ptr = NULL;
-    // Check the state of the system after the function call
-    // This depends on what the function is supposed to do
-}
-*/
-
-TEST(checkTriggerUpgradeTest, ReturnsZeroWhenSuccessful) {
-    // Create a mock object
-    MockFunctionsInternal mock;
-    MockExternal mockexternal;
-    MockDownloadFileOps mockdownloadfileops;
-
-    global_mockexternal_ptr = &mockexternal;
-    global_mockdownloadfileops_ptr = &mockdownloadfileops;
-
-    //EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return(NULL));
-    EXPECT_CALL(mockdownloadfileops, downloadFile(_,_,_,_,_)).WillRepeatedly(Return(0));
-
-    // Create a response object
-    XCONFRES response;
-
-    // Call the function to test
-    int result = checkTriggerUpgrade(&response, "testModel");
-
-    // Check the result
-    EXPECT_EQ(result, 0);
-    global_mockexternal_ptr = NULL;
-    global_mockdownloadfileops_ptr = NULL;
-}
-
-TEST(checkTriggerUpgradeTest, TestFailNull) {
-    XCONFRES response;
-    int result = checkTriggerUpgrade(&response, NULL);
-    EXPECT_EQ(result, -1);
-}
-TEST(checkTriggerUpgradeTest, ReturnsZeroWhenSuccessful404) {
-    // Create a mock object
-    MockFunctionsInternal mock;
-    MockExternal mockexternal;
-    MockDownloadFileOps mockdownloadfileops;
-
-    global_mockexternal_ptr = &mockexternal;
-    global_mockdownloadfileops_ptr = &mockdownloadfileops;
-
-    //EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return(NULL));
-    EXPECT_CALL(mockdownloadfileops, downloadFile(_,_,_,_,_)).WillRepeatedly(Return(HTTP_PAGE_NOT_FOUND));
-
-    // Create a response object
-    XCONFRES response;
-
-    // Call the function to test
-    int result = checkTriggerUpgrade(&response, "testModel");
-
-    // Check the result
-    EXPECT_EQ(result, 0);
-    global_mockexternal_ptr = NULL;
-    global_mockdownloadfileops_ptr = NULL;
-}
-
-TEST(checkTriggerUpgradeTest, TestValidPciUpgradeSuccess) {
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    MockDownloadFileOps mockdownloadfileops;
-    global_mockdownloadfileops_ptr = &mockdownloadfileops;
-    
-    XCONFRES response;
-    memset(&response, '\0', sizeof(response));
-    strncpy(response.cloudFWVersion, "testModel.bin", 13);
-    strncpy(response.cloudFWFile, "testModel.bin", 13);
-    strncpy(response.cloudPDRIVersion, "testModel_PDRI_.bin", 19);
-    strncpy(response.cloudImmediateRebootFlag, "true", 4);
-    EXPECT_CALL(mockexternal,checkForValidPCIUpgrade(_,_,_,_)).Times(1).WillOnce(Return(true));
-    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
-    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
-    EXPECT_CALL(mockexternal, isPDRIEnable()).WillOnce(Return(true));
-    EXPECT_CALL(mockdownloadfileops, downloadFile(_,_,_,_,_)).WillRepeatedly(Return(0));
-    int result = checkTriggerUpgrade(&response, "testModel");
-    EXPECT_EQ(result, 0);
-    global_mockexternal_ptr = NULL;
-    global_mockdownloadfileops_ptr = NULL;
-}
-TEST(checkTriggerUpgradeTest, TestPdriUpgradeSuccess) {
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    MockDownloadFileOps mockdownloadfileops;
-    global_mockdownloadfileops_ptr = &mockdownloadfileops;
-    
-    XCONFRES response;
-    memset(&response, '\0', sizeof(response));
-    strncpy(response.cloudFWVersion, "testModel.bin", 13);
-    strncpy(response.cloudFWFile, "testModel.bin", 13);
-    strncpy(response.cloudPDRIVersion, "testModel_PDRI_.bin", 19);
-    strncpy(response.cloudImmediateRebootFlag, "false", 4);
-    EXPECT_CALL(mockexternal,checkForValidPCIUpgrade(_,_,_,_)).Times(1).WillOnce(Return(true));
-    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
-    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
-    EXPECT_CALL(mockexternal, isPDRIEnable()).WillOnce(Return(true));
-    EXPECT_CALL(mockdownloadfileops, downloadFile(_,_,_,_,_)).WillRepeatedly(Return(0));
-    int result = checkTriggerUpgrade(&response, "testModel");
-    EXPECT_EQ(result, 0);
-    global_mockexternal_ptr = NULL;
-    global_mockdownloadfileops_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest, fallBackTestNULL){
-     int http_code = 0;
-     void *curl = NULL;
-     EXPECT_EQ(fallBack(NULL, &http_code, &curl), -1);   
-}
-
-TEST(MainHelperFunctionTest, fallBackTestSuccess){
-    MockDownloadFileOps mockfileops;
-    global_mockdownloadfileops_ptr = &mockfileops;
-    int http_code = 200;
-    int force_exit = 0;
-    int dummy_curl = 0;
-    void *curl = &dummy_curl;
-    
-    // Create context structure with HTTP_XCONF_DIRECT
-    RdkUpgradeContext_t context = {0};
-    context.upgrade_type = HTTP_XCONF_DIRECT;
-    context.server_type = HTTP_XCONF_DIRECT;
-    context.force_exit = &force_exit;
-    context.artifactLocationUrl = "test";
-    context.dwlloc = "test1";
-    
-    EXPECT_CALL(mockfileops, downloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(CURL_SUCCESS));
-    EXPECT_EQ(fallBack(&context, &http_code, &curl), CURL_SUCCESS);
-    global_mockdownloadfileops_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest, fallBackTestFailure){
-    MockDownloadFileOps mockfileops;
-    global_mockdownloadfileops_ptr = &mockfileops;
-    int http_code = 200;
-    int force_exit = 0;
-    int dummy_curl = 0;
-    void *curl = &dummy_curl;
-    
-    // Create context structure with HTTP_XCONF_DIRECT
-    RdkUpgradeContext_t context = {0};
-    context.upgrade_type = HTTP_XCONF_DIRECT;
-    context.server_type = HTTP_XCONF_DIRECT;
-    context.force_exit = &force_exit;
-    context.artifactLocationUrl = "test";
-    context.dwlloc = "test1";
-    
-    EXPECT_CALL(mockfileops, downloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(!CURL_SUCCESS));
-    EXPECT_EQ(fallBack(&context, &http_code, &curl), !CURL_SUCCESS);
-    global_mockdownloadfileops_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest, fallBackTestSuccessCodebig){
-    MockDownloadFileOps mockfileops;
-    global_mockdownloadfileops_ptr = &mockfileops;
-    int http_code = 200;
-    int force_exit = 0;
-    int dummy_curl = 0;
-    void *curl = &dummy_curl;
-    
-    // Create context structure with HTTP_SSR_CODEBIG
-    RdkUpgradeContext_t context = {0};
-    context.upgrade_type = HTTP_SSR_CODEBIG;
-    context.server_type = HTTP_SSR_CODEBIG;
-    context.force_exit = &force_exit;
-    context.artifactLocationUrl = "test";
-    context.dwlloc = "test1";
-    
-    EXPECT_CALL(mockfileops, codebigdownloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(CURL_SUCCESS));
-    EXPECT_EQ(fallBack(&context, &http_code, &curl), CURL_SUCCESS);
-    global_mockdownloadfileops_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest, fallBackTestFailureCodebig){
-    MockDownloadFileOps mockfileops;
-    global_mockdownloadfileops_ptr = &mockfileops;
-    int http_code = 200;
-    int force_exit = 0;
-    int dummy_curl = 0;
-    void *curl = &dummy_curl;
-    
-    // Create context structure with HTTP_SSR_CODEBIG
-    RdkUpgradeContext_t context = {0};
-    context.upgrade_type = HTTP_SSR_CODEBIG;
-    context.server_type = HTTP_SSR_CODEBIG;
-    context.force_exit = &force_exit;
-    context.artifactLocationUrl = "test";
-    context.dwlloc = "test1";
-    
-    EXPECT_CALL(mockfileops, codebigdownloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(!CURL_SUCCESS));
-    EXPECT_EQ(fallBack(&context, &http_code, &curl), !CURL_SUCCESS);
-    global_mockdownloadfileops_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest, updateUpgradeFlag1){
-    strcpy(device_info.dev_type,"mediaclient\0");
-    updateUpgradeFlag(1);
-    EXPECT_EQ(access("/tmp/.imageDnldInProgress", F_OK), 0);
-}
-
-TEST(MainHelperFunctionTest, updateUpgradeFlag11){
-    strcpy(device_info.dev_type,"mediaclien1t\0");
-    updateUpgradeFlag(1);
-    EXPECT_EQ(access(HTTP_CDL_FLAG, F_OK), 0);
-}
-
-TEST(MainHelperFunctionTest, updateUpgradeFlag2){
-    strcpy(device_info.dev_type,"mediaclient\0");
-    updateUpgradeFlag(2);
-    EXPECT_EQ(access("/tmp/.imageDnldInProgress", F_OK), -1);
-}
-
-TEST(MainHelperFunctionTest, updateUpgradeFlag22){
-    strcpy(device_info.dev_type,"mediaclien1t\0");
-    updateUpgradeFlag(2);
-    EXPECT_EQ(access(HTTP_CDL_FLAG, F_OK), -1);
-}
-
-TEST(MainHelperFunctionTest,uninitializeTest){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    EXPECT_CALL(mockexternal,t2_uninit()).Times(1);
-    EXPECT_CALL(mockexternal,log_exit()).Times(1);
-    uninitialize(INITIAL_VALIDATION_DWNL_INPROGRESS);
-    global_mockexternal_ptr = NULL;
-}
-
-
-TEST(MainHelperFunctionTest,initializeTest){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    EXPECT_CALL(mockexternal,getDeviceProperties(_)).Times(1).WillOnce(Return(-1));
-    EXPECT_EQ(initialize(), -1);
-    global_mockexternal_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest,initializeTest1){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    EXPECT_CALL(mockexternal,getDeviceProperties(_)).Times(1).WillOnce(Return(0));
-    EXPECT_CALL(mockexternal,getImageDetails(_)).Times(1).WillOnce(Return(0));
-    EXPECT_CALL(mockexternal,getRFCSettings(_)).Times(1);
-    EXPECT_CALL(mockexternal,init_event_handler()).Times(1);
-    strcpy(device_info.maint_status,"true");
-    EXPECT_EQ(initialize(), 1);
-    global_mockexternal_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest,saveHTTPCodeTest){
-    saveHTTPCode(200, NULL);
-    fflush(NULL);
-    char buff[16] = {0};
-    FILE *fp = NULL;
-    fp = fopen(HTTP_CODE_FILE, "r");
-    if (fp != NULL) {
-    printf("File open success\n");
-    while((fgets(buff, sizeof(buff), fp)) != NULL) {
-        printf("After read buf = %s\n",buff);
-    }
-    fclose(fp);
-    }
-
-    EXPECT_EQ(atoi(buff), 200);
-    remove(HTTP_CODE_FILE);
-}
-
-TEST(MainHelperFunctionTest, HandlesNormalCase1) {
-
-    const char* filename = "/tmp/testfile.txt";
-  
-    const char* content = "softwareoptout IGNORE_UPDATE \0\r\n";
-    FILE *fOut = fopen (filename, "w");
-    if (fOut != NULL) {
-        if (fputs (content, fOut) == EOF) {
-            printf ("File write not successful\n");
-        }
-        printf ("closing the file\n");
-        fflush(fOut);
-        fclose (fOut); 
-    }
-        int result = getOPTOUTValue(filename);
-        EXPECT_EQ(result, 1);
-        remove(filename);
-}
-
-TEST(MainHelperFunctionTest, HandlesNormalCase0) {
-
-    const char* filename = "/tmp/testfile.txt";
-  
-    const char* content = "softwareoptout ENFORCE_OPTOUT \0\r\n";
-    FILE *fOut = fopen (filename, "w");
-    if (fOut != NULL) {
-        if (fputs (content, fOut) == EOF) {
-            printf ("File write not successful\n");
-        }
-        printf ("closing the file\n");
-        fflush(fOut);
-        fclose (fOut); 
-    }
-        int result = getOPTOUTValue(filename);
-        EXPECT_EQ(result, 0);
-        remove(filename);
-}
-
-TEST(MainHelperFunctionTest, HandlesNullFilename) {
-    int result = getOPTOUTValue(NULL);
-    EXPECT_EQ(result, -1);
-}
-
-TEST(MainHelperFunctionTest,flashImageTestNull){
-    EXPECT_EQ(flashImage(NULL, NULL, "false", "2", 0, "false",1), -1);
-}
-TEST(MainHelperFunctionTest,flashImageTest){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-
-    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
-    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
-    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
-    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
-    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "false", "2", 0, "false",2), 0);
-    global_mockexternal_ptr = NULL;
-}
-TEST(MainHelperFunctionTest,flashImageTestRedState){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-
-    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
-    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
-    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
-    EXPECT_CALL(DeviceMock, isInStateRed()).Times(1).WillOnce(Return(true));
-    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
-    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "false", "2", 0, "false",6), 0);
-    global_mockexternal_ptr = NULL;
-}
-TEST(MainHelperFunctionTest,flashImageTestFail){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-
-    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
-    EXPECT_CALL(DeviceMock,v_secure_system(_,_,_)).WillRepeatedly(Return(1));
-    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
-    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
-    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
-    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "false", "2", 0, "false",3), 1);
-    global_mockexternal_ptr = NULL;
-}
-TEST(MainHelperFunctionTest,flashImageTestFail1){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-
-    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(false));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
-    EXPECT_CALL(DeviceMock,v_secure_system(_,_,_)).WillRepeatedly(Return(1));
-    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
-    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
-    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
-    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "false", "2", 0, "false",1), 1);
-    global_mockexternal_ptr = NULL;
-}
-TEST(MainHelperFunctionTest,flashImageTestFail2){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-
-    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
-    EXPECT_CALL(DeviceMock,v_secure_system(_,_,_)).WillRepeatedly(Return(1));
-    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
-    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(1));
-    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
-    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "false", "2", 0, "false",5), 1);
-    global_mockexternal_ptr = NULL;
-}
-TEST(MainHelperFunctionTest,flashImageTestRebootTrue){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-
-    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
-    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
-    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
-    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
-    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "true", "2", 0, "false",2), 0);
-    global_mockexternal_ptr = NULL;
-}
-TEST(MainHelperFunctionTest,flashImageTestPdri){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-
-    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
-    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
-    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
-    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
-    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "false", "2", 1, "false",6), 0);
-    global_mockexternal_ptr = NULL;
-}
-
-TEST(MainHelperFunctionTest,flashImageTestMaintTrue){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-
-    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
-    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
-    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
-    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
-    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "true", "2", 0, "true",1), 0);
-    global_mockexternal_ptr = NULL;
-}
-TEST(MainHelperFunctionTest,flashImageTestMaintFalse){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-
-    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
-    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
-    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
-    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
-    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "true", "2", 0, "false",2), 0);
-    global_mockexternal_ptr = NULL;
-}
-TEST(MainHelperFunctionTest,getXconfResTest){
-    XCONFRES response;
-    char data[] = "{\"firmwareDownloadProtocol\":\"http\",\"firmwareFilename\":\"HS_VBN_24_sprint_20240725233056sdy_NG-signed.bin\",\"firmwareLocation\":\"https://cdlserver.tv/Images\",\"firmwareVersion\":\"HS_VBN_24_sprint_20240725233056sdy_NG\",\"rebootImmediately\":false}";
-    *response.cloudFWFile = 0;
-    *response.cloudFWLocation = 0;
-    *response.ipv6cloudFWLocation = 0;
-    *response.cloudFWVersion = 0;
-    *response.cloudDelayDownload = 0;
-    *response.cloudProto = 0;
-    *response.cloudImmediateRebootFlag = 0;
-    *response.peripheralFirmwares = 0;
-    *response.dlCertBundle = 0;
-    *response.cloudPDRIVersion = 0;
-    cout << data << endl;
-    EXPECT_EQ(getXconfRespData(&response, data), 0);
-}
-TEST(MainHelperFunctionTest,getXconfResTestNull){
-    XCONFRES response;
-    char data[] = "{\"firmwareDownloadProtocol\":\"http\",\"firmwareFilename\":\"HS_VBN_24_sprint_20240725233056sdy_NG-signed.bin\",\"firmwareLocation\":\"https://cdlserver.tv/Images\",\"firmwareVersion\":\"HS_VBN_24_sprint_20240725233056sdy_NG\",\"rebootImmediately\":false}";
-    *response.cloudFWFile = 0;
-    *response.cloudFWLocation = 0;
-    *response.ipv6cloudFWLocation = 0;
-    *response.cloudFWVersion = 0;
-    *response.cloudDelayDownload = 0;
-    *response.cloudProto = 0;
-    *response.cloudImmediateRebootFlag = 0;
-    *response.peripheralFirmwares = 0;
-    *response.dlCertBundle = 0;
-    *response.cloudPDRIVersion = 0;
-    cout << data << endl;
-    EXPECT_EQ(getXconfRespData(NULL, data), -1);
-}
-TEST(MainHelperFunctionTest,getXconfResTestNull1){
-    XCONFRES response;
-    *response.cloudFWFile = 0;
-    *response.cloudFWLocation = 0;
-    *response.ipv6cloudFWLocation = 0;
-    *response.cloudFWVersion = 0;
-    *response.cloudDelayDownload = 0;
-    *response.cloudProto = 0;
-    *response.cloudImmediateRebootFlag = 0;
-    *response.peripheralFirmwares = 0;
-    *response.dlCertBundle = 0;
-    *response.cloudPDRIVersion = 0;
-    EXPECT_EQ(getXconfRespData(&response, NULL), -1);
-}
-
-TEST(MainHelperFunctionTest,ProcessResTest){
-    XCONFRES response;
-    char data[] = "{\"firmwareDownloadProtocol\":\"http\",\"firmwareFilename\":\"HS_VBN_24_sprint_20240725233056sdy_NG-signed.bin\",\"additionalFwVerInfo\":\"HS_VBN_PDRI_20240725233056sdy_NG\",\"firmwareLocation\":\"https://cdlserver.tv/Images\",\"firmwareVersion\":\"HS_VBN_24_sprint_20240725233056sdy_NG\",\"rebootImmediately\":false}";
-    *response.cloudFWFile = 0;
-    *response.cloudFWLocation = 0;
-    *response.ipv6cloudFWLocation = 0;
-    *response.cloudFWVersion = 0;
-    *response.cloudDelayDownload = 0;
-    *response.cloudProto = 0;
-    *response.cloudImmediateRebootFlag = 0;
-    *response.peripheralFirmwares = 0;
-    *response.dlCertBundle = 0;
-    *response.cloudPDRIVersion = 0;
-    cout << data << endl;
-    getXconfRespData(&response, data);
-    EXPECT_EQ(processJsonResponse(&response, "1234.bin","HS", "true"), 0);
-}
-TEST(MainHelperFunctionTest,ProcessResTestMaintFalse){
-    XCONFRES response;
-    char data[] = "{\"firmwareDownloadProtocol\":\"http\",\"firmwareFilename\":\"HS_VBN_24_sprint_20240725233056sdy_NG-signed.bin\",\"additionalFwVerInfo\":\"HS_VBN_PDRI_20240725233056sdy_NG\",\"firmwareLocation\":\"https://cdlserver.tv/Images\",\"firmwareVersion\":\"HS_VBN_24_sprint_20240725233056sdy_NG\",\"rebootImmediately\":false}";
-    *response.cloudFWFile = 0;
-    *response.cloudFWLocation = 0;
-    *response.ipv6cloudFWLocation = 0;
-    *response.cloudFWVersion = 0;
-    *response.cloudDelayDownload = 0;
-    *response.cloudProto = 0;
-    *response.cloudImmediateRebootFlag = 0;
-    *response.peripheralFirmwares = 0;
-    *response.dlCertBundle = 0;
-    *response.cloudPDRIVersion = 0;
-    cout << data << endl;
-    getXconfRespData(&response, data);
-    EXPECT_EQ(processJsonResponse(&response, "1234.bin","HS", "false"), 0);
-}
-TEST(MainHelperFunctionTest,ProcessResTestNull){
-    EXPECT_EQ(processJsonResponse(NULL, NULL,NULL, NULL), -1);
-}
-TEST(MainHelperFunctionTest,initialValidationTestSuccess){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    EXPECT_CALL(DeviceMock, read_RFCProperty(_,_,_,_)).WillRepeatedly(Return(1));
-    EXPECT_CALL(mockexternal, CurrentRunningInst(_)).WillRepeatedly(Return(false));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
-    EXPECT_EQ(initialValidation(), 3);
-}
-TEST(MainHelperFunctionTest,initialValidationTestFail){
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    EXPECT_CALL(DeviceMock, read_RFCProperty(_,_,_,_)).WillRepeatedly(Return(-1));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(1));
-    EXPECT_CALL(mockexternal, CurrentRunningInst(_)).WillRepeatedly(Return(false));
-    EXPECT_EQ(initialValidation(), 0);
-}
-TEST(MainHelperFunctionTest,initialValidationTestFail1){
-    int ret = 0;
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    EXPECT_CALL(DeviceMock, read_RFCProperty(_,_,_,_)).WillRepeatedly(Return(-1));
-    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillOnce(Return(1)).WillRepeatedly(Return(0));
-    EXPECT_CALL(mockexternal, CurrentRunningInst(_)).WillRepeatedly(Return(false));
-    EXPECT_EQ(initialValidation(), 0);
-    ret = system("rm -rf /tmp/DIFD.pid");
-}
-TEST(MainHelperFunctionTest,initialValidationTestInprogress){
-    DeviceUtilsMock DeviceMock;
-    g_DeviceUtilsMock = &DeviceMock;
-    MockExternal mockexternal;
-    global_mockexternal_ptr = &mockexternal;
-    EXPECT_CALL(DeviceMock, read_RFCProperty(_,_,_,_)).WillRepeatedly(Return(1));
-    EXPECT_CALL(mockexternal, CurrentRunningInst(_)).WillRepeatedly(Return(true));
-    EXPECT_EQ(initialValidation(), 2);
-}
-TEST(MainHelperFunctionTest,copyFileTestFail){
-    EXPECT_EQ(copyFile(NULL, NULL), -1);
-}
-TEST(MainHelperFunctionTest,copyFileTestSuccess){
-    const char *src = "/tmp/src.txt";
-    const char *dst = "/tmp/dst.txt";
-    int ret = 0;
-    ret = system("echo \"tesing\" > /tmp/src.txt");
-    EXPECT_EQ(copyFile(src, dst), 0);
-    ret = system("rm -f /tmp/src.txt");
-    ret = system("rm -f /tmp/dst.txt");
-}
-GTEST_API_ int main(int argc, char *argv[]){
-    char testresults_fullfilepath[GTEST_REPORT_FILEPATH_SIZE];
-    char buffer[GTEST_REPORT_FILEPATH_SIZE];
-
-    memset( testresults_fullfilepath, 0, GTEST_REPORT_FILEPATH_SIZE );
-    memset( buffer, 0, GTEST_REPORT_FILEPATH_SIZE );
-
-    snprintf( testresults_fullfilepath, GTEST_REPORT_FILEPATH_SIZE, "json:%s%s" , GTEST_DEFAULT_RESULT_FILEPATH , GTEST_DEFAULT_RESULT_FILENAME);
-    ::testing::GTEST_FLAG(output) = testresults_fullfilepath;
-    ::testing::InitGoogleTest(&argc, argv);
-    //testing::Mock::AllowLeak(mock);
-    cout << "Starting GTEST MAIN ===========================>" << endl;
-    return RUN_ALL_TESTS();
-}
+/*
+ * Copyright 2023 Comcast Cable Communications Management, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <gtest/gtest.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h> 
+#include <iostream>
+#include <unistd.h>
+
+#include "rdkv_cdl_log_wrapper.h"
+extern "C" {
+#include "device_status_helper.h"
+#include "download_status_helper.h"
+//#include "json_process.h"
+//#include "rdk_fwdl_utils.h"
+int copyFile(const char *src, const char *target);
+}
+
+#include "./mocks/device_status_helper_mock.h"
+#include "./mocks/deviceutils_mock.h"
+
+#include "miscellaneous.h"
+#include "miscellaneous_mock.cpp"
+#include "deviceutils_mock_global.h"
+
+#define JSON_STR_LEN        1000
+
+DeviceUtilsMock Deviceglobal;
+//DeviceUtilsMock *g_DeviceUtilsMock = &Deviceglobal;
+
+#define GTEST_DEFAULT_RESULT_FILEPATH "/tmp/Gtest_Report/"
+#define GTEST_DEFAULT_RESULT_FILENAME "RdkFwDwnld_rdkvMain_gtest_report.json"
+#define GTEST_REPORT_FILEPATH_SIZE 256
+
+using namespace testing;
+using namespace std;
+using ::testing::Return;
+using ::testing::StrEq;
+
+extern "C" {
+    extern Rfc_t rfc_list;
+    extern DeviceProperty_t device_info;
+    extern void *curl;
+
+    bool savePID(const char *file, char *data);
+    void interuptDwnl(int app_mode);
+    int doInteruptDwnl(void *in_curl, unsigned int max_dwnl_speed);
+    bool checkt2ValNotify( int iCurlCode, int iUpgradeType, char *Url  );
+    unsigned int doGetDwnlBytes(void *in_curl);
+    bool checkForTlsErrors(int curl_code, const char *type);
+    int retryDownload(const RdkUpgradeContext_t* context, int retry_cnt, int delay, int *httpCode, void **curl);
+
+    int downloadFile(const RdkUpgradeContext_t* context, int *httpCode, void **curl);
+    int checkTriggerUpgrade(XCONFRES *response, const char *model_num, int upgrade_type);
+    int DirectCDNDownload(XCONFRES *response, char *cur_img_name, DeviceProperty_t *device_info, int server_type, int *pHttp_code);
+    void setForceStop(int value);
+    T2ERROR t2_event_s(char* marker, char* value);
+    T2ERROR t2_event_d(char* marker, int value);
+    void t2_init(char *component);
+    int getDeviceProperties(DeviceProperty_t *pDevice_info);
+    int getImageDetails(ImageDetails_t *);
+    int createDir(const char *dirname);
+    //void createFile(const char *file_name);
+    void t2_uninit(void);
+    void log_exit();
+    int doHttpFileDownload(void *in_curl, FileDwnl_t *pfile_dwnl, MtlsAuth_t *auth, unsigned int max_dwnl_speed, char *dnl_start_pos, int *out_httpCode );
+    int logFileData(const char *file_path);
+    bool isMediaClientDevice(void);
+    int doAuthHttpFileDownload(void *in_curl, FileDwnl_t *pfile_dwnl, int *out_httpCode);
+    void logMilestone(const char *msg_code);
+    int eraseFolderExceParamFile(const char *folder, const char* file_name,const char* pdri_file_name, const char *model_num);
+    int doCurlPutRequest(void *in_curl, FileDwnl_t *pfile_dwnl, char *jsonrpc_auth_token, int *out_httpCode);
+    int getOPTOUTValue(const char *filename);
+    void getPidStore(const char *key, const char *value);
+    void dwnlError(int curl_code, int http_code, int server_type, const DeviceProperty_t *device_info, const char *lastrun, char *disableStatsUpdate);
+    int peripheral_firmware_dndl(char *pCloudFWLocation, char *pPeripheralFirmwares);
+    int fallBack(const RdkUpgradeContext_t* context, int *httpCode, void **curl);
+    void saveHTTPCode(int http_code, const char *lastrun);
+    int rdkv_upgrade_request(const RdkUpgradeContext_t* context, void** curl, int* pHttp_code);
+    size_t getContentLength(const char *file);
+    int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode);
+}
+
+TEST(getContentLengthTest,TestSuccess){
+    int ret = 0;
+    ret = system("echo \"Content-Length: 1234\" > /tmp/contentlength.txt");
+    EXPECT_NE(getContentLength("/tmp/contentlength.txt"), 0);
+    ret = system("rm -f /tmp/contentlength.txt");
+}
+TEST(getContentLengthTest,TestFail){
+    EXPECT_EQ(getContentLength("./contentlength.txt"), 0);
+}
+TEST(getContentLengthTest,TestFail1){
+    int ret = 0;
+    ret = system("echo \"Content: 1234\" > /tmp/contentlength.txt");
+    EXPECT_EQ(getContentLength("/tmp/contentlength.txt"), 0);
+    ret  = system("rm -f /tmp/contentlength.txt");
+}
+
+TEST(MainHelperFunctionTest,getAppModeDefault){
+    EXPECT_EQ(getAppMode(), 1);
+}
+
+TEST(MainHelperFunctionTest,setAppModeDefault){
+    setAppMode(0);
+    EXPECT_EQ(getAppMode(), 0);
+}
+
+TEST(MainHelperFunctionTest,setandgetAppMode){
+    setAppMode(1);
+    EXPECT_EQ(getAppMode(), 1);
+}
+
+TEST(MainHelperFunctionTest,getDwnlStateDefault){
+    EXPECT_EQ(getDwnlState(), 0);
+}
+
+TEST(MainHelperFunctionTest,setDwnlStateDefault){
+    setDwnlState(0);
+    EXPECT_EQ(getDwnlState(), 0);
+}
+TEST(MainHelperFunctionTest,setandgetDwnlState){
+    setDwnlState(1);
+    EXPECT_EQ(getDwnlState(), 1);
+}
+
+TEST(MainHelperFunctionTest,savePIDTestnull){
+    EXPECT_FALSE(savePID((const char *) NULL, (char *) NULL));
+}
+
+TEST(MainHelperFunctionTest,savePIDTestnullfp){
+    EXPECT_FALSE(savePID((const char *) "testfile",(char *) NULL));
+}
+
+TEST(MainHelperFunctionTest,savePIDTestnullfp1){
+    char data[] = "1234";
+    EXPECT_FALSE(savePID("/com/testfile",data));
+}
+
+TEST(MainHelperFunctionTest,savePIDTestSuccess){
+    char data[] = "1234";
+    EXPECT_TRUE(savePID("/tmp/testfile", data));
+}
+
+TEST(MainHelperFunctionTest,getPidStore){
+
+    char buff[16] = {0};
+    FILE *fp = NULL;
+    getPidStore("NEW","true");
+    fflush(NULL);
+    fp = fopen("/tmp/.curl.pid", "r");
+    if (fp != NULL) {
+    printf("File open success\n");
+    while((fgets(buff, sizeof(buff), fp)) != NULL) {
+        printf("After read buf = %s\n",buff);
+    }
+    fclose(fp);
+    }
+    pid_t pid = getpid();
+    unsigned int read_pid = atoi(buff);
+    printf("pid = %u and read_pid = %u\n", pid, read_pid);
+    EXPECT_EQ(pid, read_pid);
+}
+
+TEST(MainHelperFunctionTest, HandlesDownloadInProgress) {
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    strcpy(rfc_list.rfc_throttle, "true");
+    strcpy(rfc_list.rfc_topspeed, "0");
+    setDwnlState(RDKV_FWDNLD_DOWNLOAD_INPROGRESS);
+    strcpy(device_info.maint_status, "true");
+    EXPECT_CALL(mockexternal,eventManager("MaintenanceMGR", "9")).Times(1);
+    EXPECT_CALL(mockexternal,eventManager(FW_STATE_EVENT, "3")).Times(1);
+    interuptDwnl(0);
+    global_mockexternal_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest, HandlesDownloadInProgressSpeed10) {
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    strcpy(rfc_list.rfc_throttle, "true");
+    strcpy(rfc_list.rfc_topspeed, "10");
+    setDwnlState(RDKV_FWDNLD_DOWNLOAD_INPROGRESS);
+    strcpy(device_info.maint_status, "true");
+    EXPECT_CALL(mockexternal,doGetDwnlBytes(_)).Times(1).WillOnce(Return(10));
+    curl = (char *) rfc_list.rfc_throttle;
+    EXPECT_CALL(mockexternal,doInteruptDwnl(_,10)).Times(1).WillOnce(Return(DWNL_UNPAUSE_FAIL));
+    interuptDwnl(0);
+    curl = NULL;
+    global_mockexternal_ptr = NULL;
+
+}
+
+TEST(MainHelperFunctionTest, HandlesDownloadInProgressAppMode1) {
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    strcpy(rfc_list.rfc_throttle, "true");
+    strcpy(rfc_list.rfc_topspeed, "10");
+    setDwnlState(RDKV_FWDNLD_DOWNLOAD_INPROGRESS);
+    strcpy(device_info.maint_status, "true");
+    EXPECT_CALL(mockexternal,doGetDwnlBytes(_)).Times(1).WillOnce(Return(10));
+    curl = (char *) rfc_list.rfc_throttle;
+    interuptDwnl(1);
+    curl = NULL;
+    global_mockexternal_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest, HandlesDownloadInProgressAppMode2) {
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    strcpy(rfc_list.rfc_throttle, "true");
+    strcpy(rfc_list.rfc_topspeed, "11");
+    setDwnlState(RDKV_FWDNLD_DOWNLOAD_INPROGRESS);
+    strcpy(device_info.maint_status, "true");
+    EXPECT_CALL(mockexternal,doGetDwnlBytes(_)).Times(1).WillOnce(Return(10));
+    curl = (char *) rfc_list.rfc_throttle;
+    interuptDwnl(2);
+    curl = NULL;
+    global_mockexternal_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest, t2ValNotifyHandlesNullInputs) {
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    t2ValNotify(NULL, NULL);
+    global_mockexternal_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest, t2ValNotifyHandlesNonNullInputs) {
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    EXPECT_CALL(mockexternal, t2_event_s("marker", "value")).Times(1).WillOnce(testing::Return(T2ERROR_SUCCESS));
+    t2ValNotify("marker", "value");
+    global_mockexternal_ptr = NULL;
+}
+
+
+TEST(MainHelperFunctionTest, checkt2ValNotifynegative){
+    EXPECT_FALSE(checkt2ValNotify(100, PERIPHERAL_UPGRADE,"thisistest"));
+}
+
+TEST(MainHelperFunctionTest, checkt2ValNotifynegative1){
+    EXPECT_FALSE(checkt2ValNotify(35, PERIPHERAL_UPGRADE,"thisistest"));
+}
+
+TEST(MainHelperFunctionTest, checkt2ValNotifynegative2){
+    EXPECT_FALSE(checkt2ValNotify(91, PERIPHERAL_UPGRADE,"thisistest"));
+}
+
+TEST(MainHelperFunctionTest, checkt2ValNotifypositive){
+    EXPECT_TRUE(checkt2ValNotify(35, PERIPHERAL_UPGRADE,"https://thisistest.com/test"));
+}
+
+TEST(MainHelperFunctionTest, checkForTlsErrorsnegative){
+    EXPECT_TRUE(checkForTlsErrors(100, "https://thisistest"));
+}
+
+TEST(MainHelperFunctionTest, checkForTlsErrorspositive){
+    EXPECT_TRUE(checkForTlsErrors(91, "https://thisistest"));
+}
+
+TEST(MainHelperFunctionTest, retryDownloadtest){
+    // Test with NULL context - should handle gracefully
+    EXPECT_EQ(retryDownload(NULL, 1, 0, NULL, NULL), -1);
+}
+
+TEST(MainHelperFunctionTest, retryDownloadtest1){
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    EXPECT_CALL(mockfileops, downloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(CURL_SUCCESS));
+    int code = HTTP_SUCCESS;
+    int force_exit = 0;
+    int dummy_curl = 0;
+    void *curl = &dummy_curl;  // Must point to valid memory, not NULL
+    
+    RdkUpgradeContext_t context = {};
+    context.server_type = HTTP_SSR_DIRECT;
+    context.artifactLocationUrl = "test";
+    context.dwlloc = "test1";
+    context.pPostFields = (char*)"test2";
+    context.force_exit = &force_exit;
+    
+    EXPECT_EQ(retryDownload(&context, 1, 0, &code, &curl), CURL_SUCCESS);
+    global_mockdownloadfileops_ptr = NULL;
+}
+TEST(MainHelperFunctionTest, retryDownloadtest2){
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    EXPECT_CALL(mockfileops, downloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(CURL_SUCCESS));
+    int code = HTTP_CHUNK_SUCCESS;
+    int force_exit = 0;
+    int dummy_curl = 0;
+    void *curl = &dummy_curl;
+    
+    RdkUpgradeContext_t context = {};
+    context.server_type = HTTP_XCONF_DIRECT;
+    context.artifactLocationUrl = "test";
+    context.dwlloc = "test1";
+    context.pPostFields = (char*)"test2";
+    context.force_exit = &force_exit;
+    
+    EXPECT_EQ(retryDownload(&context, 1, 0, &code, &curl), CURL_SUCCESS);
+    global_mockdownloadfileops_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest, retryDownloadtest3){
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    EXPECT_CALL(mockfileops, downloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(!CURL_SUCCESS));
+    int code = HTTP_PAGE_NOT_FOUND;
+    int force_exit = 0;
+    int dummy_curl = 0;
+    void *curl = &dummy_curl;
+    
+    RdkUpgradeContext_t context = {};
+    context.server_type = HTTP_XCONF_DIRECT;
+    context.artifactLocationUrl = "test";
+    context.dwlloc = "test1";
+    context.pPostFields = (char*)"test2";
+    context.force_exit = &force_exit;
+    
+    EXPECT_EQ(retryDownload(&context, 1, 0, &code, &curl), !CURL_SUCCESS);
+    global_mockdownloadfileops_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest, retryDownloadtest4){
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    EXPECT_CALL(mockfileops, downloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(!CURL_SUCCESS));
+    int code = DWNL_BLOCK;
+    int force_exit = 0;
+    int dummy_curl = 0;
+    void *curl = &dummy_curl;
+    
+    RdkUpgradeContext_t context = {};
+    context.server_type = HTTP_XCONF_DIRECT;
+    context.artifactLocationUrl = "test";
+    context.dwlloc = "test1";
+    context.pPostFields = (char*)"test2";
+    context.force_exit = &force_exit;
+    
+    EXPECT_EQ(retryDownload(&context, 1, 0, &code, &curl), !CURL_SUCCESS);
+    global_mockdownloadfileops_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest, retryDownloadtest5){
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    EXPECT_CALL(mockfileops, downloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(!CURL_SUCCESS));
+    int code = HTTP_SUCCESS;
+    int force_exit = 0;
+    int dummy_curl = 0;
+    void *curl = &dummy_curl;
+    
+    RdkUpgradeContext_t context = {};
+    context.server_type = HTTP_SSR_DIRECT;
+    context.artifactLocationUrl = "test";
+    context.dwlloc = "test1";
+    context.pPostFields = (char*)"test2";
+    context.force_exit = &force_exit;
+    
+    EXPECT_EQ(retryDownload(&context, 1, 0, &code, &curl), !CURL_SUCCESS);
+    global_mockdownloadfileops_ptr = NULL;
+
+}
+
+TEST(MainHelperFunctionTest, retryDownloadtest6){
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    EXPECT_CALL(mockfileops, codebigdownloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(CURL_SUCCESS));
+    int code = HTTP_SUCCESS;
+    int force_exit = 0;
+    int dummy_curl = 0;
+    void *curl = &dummy_curl;
+    
+    RdkUpgradeContext_t context = {};
+    context.server_type = HTTP_SSR_CODEBIG;
+    context.artifactLocationUrl = "test";
+    context.dwlloc = "test1";
+    context.pPostFields = (char*)"test2";
+    context.force_exit = &force_exit;
+    
+    EXPECT_EQ(retryDownload(&context, 1, 0, &code, &curl), CURL_SUCCESS);
+    global_mockdownloadfileops_ptr = NULL;
+
+}
+
+TEST(MainHelperFunctionTest, retryDownloadtest7){
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    EXPECT_CALL(mockfileops, codebigdownloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(!CURL_SUCCESS));
+    int code = HTTP_PAGE_NOT_FOUND;
+    int force_exit = 0;
+    int dummy_curl = 0;
+    void *curl = &dummy_curl;
+    
+    RdkUpgradeContext_t context = {};
+    context.server_type = HTTP_SSR_CODEBIG;
+    context.artifactLocationUrl = "test";
+    context.dwlloc = "test1";
+    context.pPostFields = (char*)"test2";
+    context.force_exit = &force_exit;
+    
+    EXPECT_EQ(retryDownload(&context, 1, 0, &code, &curl), !CURL_SUCCESS);
+    global_mockdownloadfileops_ptr = NULL;
+
+}
+
+TEST(MainHelperFunctionTest, retryDownloadtest8){
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    EXPECT_CALL(mockfileops, codebigdownloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(!CURL_SUCCESS));
+    int code = HTTP_SUCCESS;
+    int force_exit = 0;
+    int dummy_curl = 0;
+    void *curl = &dummy_curl;
+    
+    RdkUpgradeContext_t context = {};
+    context.server_type = HTTP_SSR_CODEBIG;
+    context.artifactLocationUrl = "test";
+    context.dwlloc = "test1";
+    context.pPostFields = (char*)"test2";
+    context.force_exit = &force_exit;
+    
+    EXPECT_EQ(retryDownload(&context, 1, 1, &code, &curl), !CURL_SUCCESS);
+    global_mockdownloadfileops_ptr = NULL;
+}
+
+TEST(DwnlErrorTest, HandlesCurlCode0) {
+    int curl_code = 0;
+    int http_code = 200;
+    int server_type = 0;
+    DeviceProperty_t device_info = {0};
+    strcpy(device_info.dev_type, "mediaclient");
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    EXPECT_CALL(mockexternal,checkAndEnterStateRed(_,_)).Times(1);
+    dwnlError(curl_code, http_code, server_type,  &device_info, NULL, NULL);
+    global_mockexternal_ptr = NULL;
+
+}
+
+TEST(DwnlErrorTest, HandlesCurlCode22) {
+    int curl_code = 22;
+    int http_code = 200;
+    int server_type = 0;
+    DeviceProperty_t device_info = {0};
+    strcpy(device_info.dev_type, "mediaclient");
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    EXPECT_CALL(mockexternal,eventManager(_,_)).Times(1);
+    EXPECT_CALL(mockexternal,checkAndEnterStateRed(_,_)).Times(1);
+    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
+    dwnlError(curl_code, http_code, server_type,  &device_info, NULL, NULL);
+    global_mockexternal_ptr = NULL;
+
+}
+
+TEST(DwnlErrorTest, HandlesCurlCode18) {
+    int curl_code = 18;
+    int http_code = 0;
+    int server_type = 0;
+    DeviceProperty_t device_info = {0};
+    strcpy(device_info.dev_type, "mediaclient");
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    strcpy(device_info.dev_type,"mediaclient");
+    EXPECT_CALL(mockexternal,eventManager(_,_)).Times(1);
+    EXPECT_CALL(mockexternal,checkAndEnterStateRed(_,_)).Times(1);
+    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
+    dwnlError(curl_code, http_code, server_type,  &device_info, NULL, NULL);
+    global_mockexternal_ptr = NULL;
+
+}
+
+TEST(DwnlErrorTest, HandlesCurlCode91) {
+    int curl_code = 91;
+    int http_code = 200;
+    int server_type = 0;
+    DeviceProperty_t device_info = {0};
+    strcpy(device_info.dev_type, "mediaclient1");
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    EXPECT_CALL(mockexternal,eventManager(_,_)).Times(1);
+    EXPECT_CALL(mockexternal,checkAndEnterStateRed(_,_)).Times(1);
+    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
+    dwnlError(curl_code, http_code, server_type,  &device_info, NULL, NULL);
+    global_mockexternal_ptr = NULL;
+
+}
+TEST(MainHelperFunctionTest,rdkv_upgrade_requestTest){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    // Create context structure with test values
+    RdkUpgradeContext_t context = {0};
+    context.upgrade_type = 1;
+    context.server_type = 1;
+    context.artifactLocationUrl = "test";
+    context.dwlloc = "test1";
+    context.pPostFields = (char*)"test2";
+
+    void* curl = NULL;
+    int* http_code = NULL;
+
+    //EXPECT_CALL(mockexternal,checkForValidPCIUpgrade(_,_,_,_)).Times(1).WillOnce(Return(false));
+    EXPECT_EQ(rdkv_upgrade_request(&context, &curl, http_code), -1);
+    global_mockexternal_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest,chunkDownloadTestNULL){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    int httpcode = -1;
+    EXPECT_EQ(chunkDownload(NULL, NULL, 0, &httpcode), -1);
+    //int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode)
+    global_mockexternal_ptr = NULL;
+}
+TEST(MainHelperFunctionTest,chunkDownloadTestSuccess){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    MockExternal mock;
+    global_mockexternal_ptr = &mock;
+
+    int httpcode = -1;
+    char *temp = "temp";
+    int ret = 0;
+    FileDwnl_t file;
+    memset(&file, '\0', sizeof(file));
+    snprintf(file.pathname, sizeof(file.pathname),"%s", "/tmp/testfirmware.bin");
+    ret = system("echo \"Content-Length: 1234\" > /tmp/testfirmware.bin.header");
+
+    EXPECT_CALL(DeviceMock,getFileSize(_)).WillRepeatedly(Return(12));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    // Set expectations on the mock methods
+    EXPECT_CALL(*g_DeviceUtilsMock, doCurlInit()).WillRepeatedly(Return((void*)temp));
+    EXPECT_CALL(*g_DeviceUtilsMock, doStopDownload(_)).Times(2);
+    EXPECT_CALL(*global_mockexternal_ptr, doHttpFileDownload(_,_,_,_,_,_)).WillRepeatedly(Return(0));
+
+    EXPECT_EQ(chunkDownload(&file, NULL, 0, &httpcode), 0);
+    ret = system("rm -f  /tmp/testfirmware.bin.header");
+    //int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode)
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+    global_mockexternal_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest,chunkDownloadFullTestSuccess){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    MockExternal mock;
+    g_DeviceUtilsMock = &DeviceMock;
+    global_mockexternal_ptr = &mock;
+
+    int httpcode = -1;
+    char *temp = "temp";
+    int ret = 0;
+    FileDwnl_t file;
+    memset(&file, '\0', sizeof(file));
+    snprintf(file.pathname, sizeof(file.pathname),"%s", "/tmp/testfirmware.bin");
+    ret = system("echo \"Content-Length: 1234\" > /tmp/testfirmware.bin.header");
+
+    EXPECT_CALL(DeviceMock,getFileSize(_)).WillRepeatedly(Return(12));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    // Set expectations on the mock methods
+    EXPECT_CALL(*g_DeviceUtilsMock, doCurlInit()).WillRepeatedly(Return((void*)temp));
+    EXPECT_CALL(*g_DeviceUtilsMock, doStopDownload(_)).Times(2);
+    EXPECT_CALL(*global_mockexternal_ptr, doHttpFileDownload(_,_,_,_,_,_)).WillRepeatedly(Return(33));
+
+    EXPECT_NE(chunkDownload(&file, NULL, 0, &httpcode), 0);
+    ret = system("rm -f  /tmp/testfirmware.bin.header");
+    //int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode)
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+    global_mockexternal_ptr = NULL;
+}
+TEST(MainHelperFunctionTest,chunkDownloadNotNeededTest){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    MockExternal mock;
+    g_DeviceUtilsMock = &DeviceMock;
+    global_mockexternal_ptr = &mock;
+
+    int httpcode = -1;
+    char *temp = "temp";
+    int ret = 0;
+    FileDwnl_t file;
+    memset(&file, '\0', sizeof(file));
+    snprintf(file.pathname, sizeof(file.pathname),"%s", "/tmp/testfirmware.bin");
+    ret = system("echo \"Content-Length: 12\" > /tmp/testfirmware.bin.header");
+
+    EXPECT_CALL(DeviceMock,getFileSize(_)).WillRepeatedly(Return(12));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    // Set expectations on the mock methods
+    //EXPECT_CALL(*g_DeviceUtilsMock, doCurlInit()).WillRepeatedly(Return((void*)temp));
+    //EXPECT_CALL(*g_DeviceUtilsMock, doStopDownload(_));
+
+
+    EXPECT_EQ(chunkDownload(&file, NULL, 0, &httpcode), 0);
+    ret = system("rm -f  /tmp/testfirmware.bin.header");
+    //int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode)
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+    global_mockexternal_ptr = NULL;
+}
+TEST(MainHelperFunctionTest,chunkDownloadgetfilesizeTestFail){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    MockExternal mock;
+    g_DeviceUtilsMock = &DeviceMock;
+    global_mockexternal_ptr = &mock;
+
+    int httpcode = -1;
+    char *temp = "temp";
+    int ret = 0;
+    FileDwnl_t file;
+    memset(&file, '\0', sizeof(file));
+    snprintf(file.pathname, sizeof(file.pathname),"%s", "/tmp/testfirmware.bin");
+    ret = system("echo \"Content-Length: 1234\" > /tmp/testfirmware.bin.header");
+
+    EXPECT_CALL(DeviceMock,getFileSize(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    // Set expectations on the mock methods
+    //EXPECT_CALL(*g_DeviceUtilsMock, doCurlInit()).WillRepeatedly(Return((void*)temp));
+    //EXPECT_CALL(*g_DeviceUtilsMock, doStopDownload(_));
+
+
+    EXPECT_EQ(chunkDownload(&file, NULL, 0, &httpcode), -1);
+    ret = system("rm -f  /tmp/testfirmware.bin.header");
+    //int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode)
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+    global_mockexternal_ptr = NULL;
+}
+
+/* Test: Verify that when getFileSize() returns -1 (error), chunkDownload()
+ * cleans up both the partial image file and its .header file via unlink(). */
+TEST(MainHelperFunctionTest,chunkDownloadgetfilesizeFailCleansUpFiles){
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    MockExternal mock;
+    global_mockexternal_ptr = &mock;
+
+    int httpcode = -1;
+    int ret = 0;
+    FileDwnl_t file;
+    memset(&file, '\0', sizeof(file));
+    snprintf(file.pathname, sizeof(file.pathname),"%s", "/tmp/testfirmware_cleanup1.bin");
+
+    /* Create real files so unlink() has something to remove */
+    ret = system("echo 'partial data' > /tmp/testfirmware_cleanup1.bin");
+    ret = system("echo 'Content-Length: 1234' > /tmp/testfirmware_cleanup1.bin.header");
+
+    /* filePresentCheck returns 0 (file exists) for all checks */
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    /* getFileSize returns -1 to trigger the error/cleanup path */
+    EXPECT_CALL(DeviceMock, getFileSize(_)).WillRepeatedly(Return(-1));
+
+    EXPECT_EQ(chunkDownload(&file, NULL, 0, &httpcode), -1);
+
+    /* Verify both files were cleaned up by unlink() */
+    EXPECT_NE(access("/tmp/testfirmware_cleanup1.bin", F_OK), 0)
+        << "Partial image file should have been removed";
+    EXPECT_NE(access("/tmp/testfirmware_cleanup1.bin.header", F_OK), 0)
+        << "Header file should have been removed";
+
+    /* Safety cleanup in case test assertions fail */
+    ret = system("rm -f /tmp/testfirmware_cleanup1.bin /tmp/testfirmware_cleanup1.bin.header");
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/* Test: Verify that when content_len is 0 (no Content-Length in header)
+ * and the partial file is present, chunkDownload() cleans up both files. */
+TEST(MainHelperFunctionTest,chunkDownloadNoContentLenCleansUpFiles){
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    MockExternal mock;
+    global_mockexternal_ptr = &mock;
+
+    int httpcode = -1;
+    int ret = 0;
+    FileDwnl_t file;
+    memset(&file, '\0', sizeof(file));
+    snprintf(file.pathname, sizeof(file.pathname),"%s", "/tmp/testfirmware_cleanup2.bin");
+
+    /* Create partial image file and a header file with NO Content-Length line */
+    ret = system("echo 'partial data' > /tmp/testfirmware_cleanup2.bin");
+    ret = system("echo 'No-Content-Here' > /tmp/testfirmware_cleanup2.bin.header");
+
+    /* filePresentCheck returns 0 (file exists) for all checks */
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, getFileSize(_)).WillRepeatedly(Return(12));
+
+    EXPECT_EQ(chunkDownload(&file, NULL, 0, &httpcode), -1);
+
+    /* Verify both files were cleaned up by unlink() */
+    EXPECT_NE(access("/tmp/testfirmware_cleanup2.bin", F_OK), 0)
+        << "Partial image file should have been removed";
+    EXPECT_NE(access("/tmp/testfirmware_cleanup2.bin.header", F_OK), 0)
+        << "Header file should have been removed";
+
+    /* Safety cleanup in case test assertions fail */
+    ret = system("rm -f /tmp/testfirmware_cleanup2.bin /tmp/testfirmware_cleanup2.bin.header");
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+TEST(MainHelperFunctionTest,chunkDownloadTestFail2){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    MockExternal mock;
+    g_DeviceUtilsMock = &DeviceMock;
+    global_mockexternal_ptr = &mock;
+
+    int httpcode = -1;
+    char *temp = "temp";
+    //int ret = 0;
+    FileDwnl_t file;
+    memset(&file, '\0', sizeof(file));
+    snprintf(file.pathname, sizeof(file.pathname),"%s", "/tmp/testfirmware.bin");
+    //ret = system("echo \"Content-Length: 1234\" > /tmp/testfirmware.bin.header");
+
+    EXPECT_CALL(DeviceMock,getFileSize(_)).WillRepeatedly(Return(12));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(1));
+    // Set expectations on the mock methods
+    //EXPECT_CALL(*g_DeviceUtilsMock, doCurlInit()).WillRepeatedly(Return((void*)temp));
+    //EXPECT_CALL(*g_DeviceUtilsMock, doStopDownload(_));
+
+
+    EXPECT_EQ(chunkDownload(&file, NULL, 0, &httpcode), -1);
+    //ret = system("rm -f  /tmp/testfirmware.bin.header");
+    //int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode)
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+    global_mockexternal_ptr = NULL;
+}
+// This is a test for the startFactoryProtectService function
+TEST(startFactoryProtectServiceTest, ReturnsZeroWhenSuccessful) {
+    // Create a mock object
+    MockExternal mock;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    global_mockexternal_ptr = &mock;
+    char *temp = "temp";
+    // Set expectations on the mock methods
+    EXPECT_CALL(*g_DeviceUtilsMock, doCurlInit()).WillOnce(Return((void*)temp));
+    EXPECT_CALL(mock, doCurlPutRequest(_, _, _, _)).WillOnce(DoAll(SetArgPointee<3>(200), Return(0)));
+    EXPECT_CALL(*g_DeviceUtilsMock, doStopDownload(_));
+
+    // Call the function to test
+    EXPECT_EQ(startFactoryProtectService(),0);
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+TEST(startFactoryProtectServiceTest, ReturnsminusoneWhenError) {
+    // Create a mock object
+    MockExternal mock;
+    global_mockexternal_ptr = &mock;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    EXPECT_CALL(*g_DeviceUtilsMock, doCurlInit()).WillOnce(Return(NULL));
+
+    // Call the function to test
+    EXPECT_EQ(startFactoryProtectService(), -1);
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+/*
+TEST(checkTriggerUpgradeTest, ReturnsZeroWhenSuccessful) {
+    // Create a mock object
+    MockFunctionsInternal mock;
+    MockExternal mockexternal;
+
+    // Set expectations on the mock methods
+    EXPECT_CALL(mock, checkForValidPCIUpgrade(_, _, _, _)).WillOnce(Return(true));
+
+    EXPECT_CALL(mock, getOPTOUTValue(_)).WillOnce(Return(0));
+    EXPECT_CALL(mock, uninitialize(_));
+    EXPECT_CALL(mock, upgradeRequest(_, _, _, _, _, _)).WillOnce(DoAll(SetArgPointee<5>(200), Return(0)));
+    EXPECT_CALL(mock, isPDRIEnable()).WillOnce(Return(true));
+    EXPECT_CALL(mock, filePresentCheck(_)).WillOnce(Return(0));
+    EXPECT_CALL(mock, peripheral_firmware_dndl(_, _)).WillOnce(Return(0));
+
+    // Create a response object
+    XCONFRES response;
+    // Fill the response object with test data
+    // ...
+
+    // Call the function to test
+    int result = checkTriggerUpgrade(&response, "testModel", LEGACY_ALL_UPGRADE);
+
+    // Check the result
+    EXPECT_EQ(result, 0);
+}
+*/
+
+TEST(PeripheralFirmwareDndlTest, HandlesValidInput) {
+
+    MockDownloadFileOps mockdownloadfileops;
+    global_mockdownloadfileops_ptr = &mockdownloadfileops;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    char *pCloudFWLocation = "http://example.com";
+    char *pPeripheralFirmwares = "firmware1,firmware2";
+    EXPECT_CALL(mockdownloadfileops, downloadFile(_,_,_,_,_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockdownloadfileops, codebigdownloadFile(_,_,_,_,_)).WillRepeatedly(Return(CODEBIG_SIGNING_FAILED));
+
+    EXPECT_CALL(DeviceMock,getFileSize(_)).WillRepeatedly(Return(-1));
+    int result = peripheral_firmware_dndl(pCloudFWLocation, pPeripheralFirmwares);
+
+    EXPECT_EQ(result, -1);
+    global_mockdownloadfileops_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+TEST(PeripheralFirmwareDndlTest, HandlesValidInput404) {
+
+    MockDownloadFileOps mockdownloadfileops;
+    global_mockdownloadfileops_ptr = &mockdownloadfileops;
+
+    char *pCloudFWLocation = "http://example.com";
+    char *pPeripheralFirmwares = "firmware1,firmware2";
+    EXPECT_CALL(mockdownloadfileops, downloadFile(_,_,_,_,_)).WillRepeatedly(Return(HTTP_PAGE_NOT_FOUND));
+    EXPECT_CALL(mockdownloadfileops, codebigdownloadFile(_,_,_,_,_)).WillRepeatedly(Return(0));
+    int result = peripheral_firmware_dndl(pCloudFWLocation, pPeripheralFirmwares);
+
+    // Check the result of the function
+    EXPECT_EQ(result, -1);
+    global_mockdownloadfileops_ptr = NULL;
+    // Check the state of the system after the function call
+    // This depends on what the function is supposed to do
+}
+
+/*
+crashing when the input is NULL
+Program received signal SIGSEGV, Segmentation fault.
+strnlen () at ../sysdeps/aarch64/strnlen.S:63
+63      ../sysdeps/aarch64/strnlen.S: No such file or directory.
+(gdb) bt
+#0  strnlen () at ../sysdeps/aarch64/strnlen.S:63
+#1  0x0000aaaaea1cfdf4 in peripheral_firmware_dndl (pCloudFWLocation=0x0, pPeripheralFirmwares=0x0) at ../video/rdkv_main.c:1338
+#2  0x0000aaaaea1df494 in PeripheralFirmwareDndlTest_HandlesNullInput_Test::TestBody (this=<optimized out>) at basic_rdkv_main_gtest.cpp:456
+#3  0x0000aaaaea318c50 in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) ()
+#4  0x0000aaaaea30a99c in testing::Test::Run() ()
+#5  0x0000aaaaea30ab20 in testing::TestInfo::Run() ()
+
+TEST(PeripheralFirmwareDndlTest, HandlesNullInput) {
+    char *pCloudFWLocation = NULL;
+    char *pPeripheralFirmwares = NULL;
+    MockDownloadFileOps mockdownloadfileops;
+    global_mockdownloadfileops_ptr = &mockdownloadfileops;
+    EXPECT_CALL(mockdownloadfileops, downloadFile(_,_,_,_,_)).WillOnce(Return(26));
+    int result = peripheral_firmware_dndl(pCloudFWLocation, pPeripheralFirmwares);
+
+    // Check the result of the function
+    EXPECT_EQ(result, -1);
+    global_mockdownloadfileops_ptr = NULL;
+    // Check the state of the system after the function call
+    // This depends on what the function is supposed to do
+}
+*/
+
+TEST(checkTriggerUpgradeTest, ReturnsZeroWhenSuccessful) {
+    // Create a mock object
+    MockFunctionsInternal mock;
+    MockExternal mockexternal;
+    MockDownloadFileOps mockdownloadfileops;
+
+    global_mockexternal_ptr = &mockexternal;
+    global_mockdownloadfileops_ptr = &mockdownloadfileops;
+
+    //EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return(NULL));
+    EXPECT_CALL(mockdownloadfileops, downloadFile(_,_,_,_,_)).WillRepeatedly(Return(0));
+
+    // Create a response object
+    XCONFRES response;
+
+    // Call the function to test
+    int result = checkTriggerUpgrade(&response, "testModel", LEGACY_ALL_UPGRADE);
+
+    // Check the result
+    EXPECT_EQ(result, 0);
+    global_mockexternal_ptr = NULL;
+    global_mockdownloadfileops_ptr = NULL;
+}
+
+TEST(checkTriggerUpgradeTest, TestFailNull) {
+    XCONFRES response;
+    int result = checkTriggerUpgrade(&response, NULL, LEGACY_ALL_UPGRADE);
+    EXPECT_EQ(result, -1);
+}
+TEST(checkTriggerUpgradeTest, ReturnsZeroWhenSuccessful404) {
+    // Create a mock object
+    MockFunctionsInternal mock;
+    MockExternal mockexternal;
+    MockDownloadFileOps mockdownloadfileops;
+
+    global_mockexternal_ptr = &mockexternal;
+    global_mockdownloadfileops_ptr = &mockdownloadfileops;
+
+    //EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return(NULL));
+    EXPECT_CALL(mockdownloadfileops, downloadFile(_,_,_,_,_)).WillRepeatedly(Return(HTTP_PAGE_NOT_FOUND));
+
+    // Create a response object
+    XCONFRES response;
+
+    // Call the function to test
+    int result = checkTriggerUpgrade(&response, "testModel", LEGACY_ALL_UPGRADE);
+
+    // Check the result
+    EXPECT_EQ(result, 0);
+    global_mockexternal_ptr = NULL;
+    global_mockdownloadfileops_ptr = NULL;
+}
+
+TEST(checkTriggerUpgradeTest, TestValidPciUpgradeSuccess) {
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    MockDownloadFileOps mockdownloadfileops;
+    global_mockdownloadfileops_ptr = &mockdownloadfileops;
+    
+    XCONFRES response;
+    memset(&response, '\0', sizeof(response));
+    strncpy(response.cloudFWVersion, "testModel.bin", 13);
+    strncpy(response.cloudFWFile, "testModel.bin", 13);
+    strncpy(response.cloudPDRIVersion, "testModel_PDRI_.bin", 19);
+    strncpy(response.cloudImmediateRebootFlag, "true", 4);
+    EXPECT_CALL(mockexternal,checkForValidPCIUpgrade(_,_,_,_)).Times(1).WillOnce(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
+    EXPECT_CALL(mockexternal, isPDRIEnable()).WillOnce(Return(true));
+    EXPECT_CALL(mockdownloadfileops, downloadFile(_,_,_,_,_)).WillRepeatedly(Return(0));
+    int result = checkTriggerUpgrade(&response, "testModel", LEGACY_ALL_UPGRADE);
+    EXPECT_EQ(result, 0);
+    global_mockexternal_ptr = NULL;
+    global_mockdownloadfileops_ptr = NULL;
+}
+TEST(checkTriggerUpgradeTest, TestPdriUpgradeSuccess) {
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    MockDownloadFileOps mockdownloadfileops;
+    global_mockdownloadfileops_ptr = &mockdownloadfileops;
+    
+    XCONFRES response;
+    memset(&response, '\0', sizeof(response));
+    strncpy(response.cloudFWVersion, "testModel.bin", 13);
+    strncpy(response.cloudFWFile, "testModel.bin", 13);
+    strncpy(response.cloudPDRIVersion, "testModel_PDRI_.bin", 19);
+    strncpy(response.cloudImmediateRebootFlag, "false", 4);
+    EXPECT_CALL(mockexternal,checkForValidPCIUpgrade(_,_,_,_)).Times(1).WillOnce(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
+    EXPECT_CALL(mockexternal, isPDRIEnable()).WillOnce(Return(true));
+    EXPECT_CALL(mockdownloadfileops, downloadFile(_,_,_,_,_)).WillRepeatedly(Return(0));
+    int result = checkTriggerUpgrade(&response, "testModel", LEGACY_ALL_UPGRADE);
+    EXPECT_EQ(result, 0);
+    global_mockexternal_ptr = NULL;
+    global_mockdownloadfileops_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest, fallBackTestNULL){
+     int http_code = 0;
+     void *curl = NULL;
+     EXPECT_EQ(fallBack(NULL, &http_code, &curl), -1);   
+}
+
+TEST(MainHelperFunctionTest, fallBackTestSuccess){
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    int http_code = 200;
+    int force_exit = 0;
+    int dummy_curl = 0;
+    void *curl = &dummy_curl;
+    
+    // Create context structure with HTTP_XCONF_DIRECT
+    RdkUpgradeContext_t context = {0};
+    context.upgrade_type = HTTP_XCONF_DIRECT;
+    context.server_type = HTTP_XCONF_DIRECT;
+    context.force_exit = &force_exit;
+    context.artifactLocationUrl = "test";
+    context.dwlloc = "test1";
+    
+    EXPECT_CALL(mockfileops, downloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(CURL_SUCCESS));
+    EXPECT_EQ(fallBack(&context, &http_code, &curl), CURL_SUCCESS);
+    global_mockdownloadfileops_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest, fallBackTestFailure){
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    int http_code = 200;
+    int force_exit = 0;
+    int dummy_curl = 0;
+    void *curl = &dummy_curl;
+    
+    // Create context structure with HTTP_XCONF_DIRECT
+    RdkUpgradeContext_t context = {0};
+    context.upgrade_type = HTTP_XCONF_DIRECT;
+    context.server_type = HTTP_XCONF_DIRECT;
+    context.force_exit = &force_exit;
+    context.artifactLocationUrl = "test";
+    context.dwlloc = "test1";
+    
+    EXPECT_CALL(mockfileops, downloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(!CURL_SUCCESS));
+    EXPECT_EQ(fallBack(&context, &http_code, &curl), !CURL_SUCCESS);
+    global_mockdownloadfileops_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest, fallBackTestSuccessCodebig){
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    int http_code = 200;
+    int force_exit = 0;
+    int dummy_curl = 0;
+    void *curl = &dummy_curl;
+    
+    // Create context structure with HTTP_SSR_CODEBIG
+    RdkUpgradeContext_t context = {0};
+    context.upgrade_type = HTTP_SSR_CODEBIG;
+    context.server_type = HTTP_SSR_CODEBIG;
+    context.force_exit = &force_exit;
+    context.artifactLocationUrl = "test";
+    context.dwlloc = "test1";
+    
+    EXPECT_CALL(mockfileops, codebigdownloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(CURL_SUCCESS));
+    EXPECT_EQ(fallBack(&context, &http_code, &curl), CURL_SUCCESS);
+    global_mockdownloadfileops_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest, fallBackTestFailureCodebig){
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    int http_code = 200;
+    int force_exit = 0;
+    int dummy_curl = 0;
+    void *curl = &dummy_curl;
+    
+    // Create context structure with HTTP_SSR_CODEBIG
+    RdkUpgradeContext_t context = {0};
+    context.upgrade_type = HTTP_SSR_CODEBIG;
+    context.server_type = HTTP_SSR_CODEBIG;
+    context.force_exit = &force_exit;
+    context.artifactLocationUrl = "test";
+    context.dwlloc = "test1";
+    
+    EXPECT_CALL(mockfileops, codebigdownloadFile(_,_,_,_,_)).Times(1).WillOnce(testing::Return(!CURL_SUCCESS));
+    EXPECT_EQ(fallBack(&context, &http_code, &curl), !CURL_SUCCESS);
+    global_mockdownloadfileops_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest, updateUpgradeFlag1){
+    strcpy(device_info.dev_type,"mediaclient\0");
+    updateUpgradeFlag(1);
+    EXPECT_EQ(access("/tmp/.imageDnldInProgress", F_OK), 0);
+}
+
+TEST(MainHelperFunctionTest, updateUpgradeFlag11){
+    strcpy(device_info.dev_type,"mediaclien1t\0");
+    updateUpgradeFlag(1);
+    EXPECT_EQ(access(HTTP_CDL_FLAG, F_OK), 0);
+}
+
+TEST(MainHelperFunctionTest, updateUpgradeFlag2){
+    strcpy(device_info.dev_type,"mediaclient\0");
+    updateUpgradeFlag(2);
+    EXPECT_EQ(access("/tmp/.imageDnldInProgress", F_OK), -1);
+}
+
+TEST(MainHelperFunctionTest, updateUpgradeFlag22){
+    strcpy(device_info.dev_type,"mediaclien1t\0");
+    updateUpgradeFlag(2);
+    EXPECT_EQ(access(HTTP_CDL_FLAG, F_OK), -1);
+}
+
+TEST(MainHelperFunctionTest,uninitializeTest){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    EXPECT_CALL(mockexternal,t2_uninit()).Times(1);
+    EXPECT_CALL(mockexternal,log_exit()).Times(1);
+    uninitialize(INITIAL_VALIDATION_DWNL_INPROGRESS);
+    global_mockexternal_ptr = NULL;
+}
+
+
+TEST(MainHelperFunctionTest,initializeTest){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    EXPECT_CALL(mockexternal,getDeviceProperties(_)).Times(1).WillOnce(Return(-1));
+    EXPECT_EQ(initialize(), -1);
+    global_mockexternal_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest,initializeTest1){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    EXPECT_CALL(mockexternal,getDeviceProperties(_)).Times(1).WillOnce(Return(0));
+    EXPECT_CALL(mockexternal,getImageDetails(_)).Times(1).WillOnce(Return(0));
+    EXPECT_CALL(mockexternal,getRFCSettings(_)).Times(1);
+    EXPECT_CALL(mockexternal,init_event_handler()).Times(1);
+    strcpy(device_info.maint_status,"true");
+    EXPECT_EQ(initialize(), 1);
+    global_mockexternal_ptr = NULL;
+}
+
+TEST(MainHelperFunctionTest,saveHTTPCodeTest){
+    saveHTTPCode(200, NULL);
+    fflush(NULL);
+    char buff[16] = {0};
+    FILE *fp = NULL;
+    fp = fopen(HTTP_CODE_FILE, "r");
+    if (fp != NULL) {
+    printf("File open success\n");
+    while((fgets(buff, sizeof(buff), fp)) != NULL) {
+        printf("After read buf = %s\n",buff);
+    }
+    fclose(fp);
+    }
+
+    EXPECT_EQ(atoi(buff), 200);
+    remove(HTTP_CODE_FILE);
+}
+
+TEST(MainHelperFunctionTest, HandlesNormalCase1) {
+
+    const char* filename = "/tmp/testfile.txt";
+  
+    const char* content = "softwareoptout IGNORE_UPDATE \0\r\n";
+    FILE *fOut = fopen (filename, "w");
+    if (fOut != NULL) {
+        if (fputs (content, fOut) == EOF) {
+            printf ("File write not successful\n");
+        }
+        printf ("closing the file\n");
+        fflush(fOut);
+        fclose (fOut); 
+    }
+        int result = getOPTOUTValue(filename);
+        EXPECT_EQ(result, 1);
+        remove(filename);
+}
+
+TEST(MainHelperFunctionTest, HandlesNormalCase0) {
+
+    const char* filename = "/tmp/testfile.txt";
+  
+    const char* content = "softwareoptout ENFORCE_OPTOUT \0\r\n";
+    FILE *fOut = fopen (filename, "w");
+    if (fOut != NULL) {
+        if (fputs (content, fOut) == EOF) {
+            printf ("File write not successful\n");
+        }
+        printf ("closing the file\n");
+        fflush(fOut);
+        fclose (fOut); 
+    }
+        int result = getOPTOUTValue(filename);
+        EXPECT_EQ(result, 0);
+        remove(filename);
+}
+
+TEST(MainHelperFunctionTest, HandlesNullFilename) {
+    int result = getOPTOUTValue(NULL);
+    EXPECT_EQ(result, -1);
+}
+
+TEST(MainHelperFunctionTest,flashImageTestNull){
+    EXPECT_EQ(flashImage(NULL, NULL, "false", "2", 0, "false",1), -1);
+}
+TEST(MainHelperFunctionTest,flashImageTest){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
+    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
+    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
+    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "false", "2", 0, "false",2), 0);
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = nullptr;
+}
+TEST(MainHelperFunctionTest,flashImageTestRedState){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
+    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, isInStateRed()).Times(1).WillOnce(Return(true));
+    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
+    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "false", "2", 0, "false",6), 0);
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = nullptr;
+}
+TEST(MainHelperFunctionTest,flashImageTestFail){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
+    EXPECT_CALL(DeviceMock,v_secure_system(_,_,_)).WillRepeatedly(Return(1));
+    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
+    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
+    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "false", "2", 0, "false",3), 1);
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = nullptr;
+}
+TEST(MainHelperFunctionTest,flashImageTestFail1){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(false));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
+    EXPECT_CALL(DeviceMock,v_secure_system(_,_,_)).WillRepeatedly(Return(1));
+    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
+    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
+    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "false", "2", 0, "false",1), 1);
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = nullptr;
+}
+TEST(MainHelperFunctionTest,flashImageTestFail2){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
+    EXPECT_CALL(DeviceMock,v_secure_system(_,_,_)).WillRepeatedly(Return(1));
+    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(1));
+    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
+    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "false", "2", 0, "false",5), 1);
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = nullptr;
+}
+TEST(MainHelperFunctionTest,flashImageTestRebootTrue){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
+    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
+    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
+    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "true", "2", 0, "false",2), 0);
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = nullptr;
+}
+TEST(MainHelperFunctionTest,flashImageTestPdri){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
+    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
+    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
+    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "false", "2", 1, "false",6), 0);
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = nullptr;
+}
+
+TEST(MainHelperFunctionTest,flashImageTestMaintTrue){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
+    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
+    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
+    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "true", "2", 0, "true",1), 0);
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = nullptr;
+}
+TEST(MainHelperFunctionTest,flashImageTestMaintFalse){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    EXPECT_CALL(mockexternal,isMediaClientDevice()).WillOnce(Return(true));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal,eventManager(_,_)).WillRepeatedly(Return());
+    EXPECT_CALL(mockexternal,updateFWDownloadStatus(_,_)).Times(1);
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_,_,_)).WillRepeatedly(Return(0));
+    //int flashImage(const char *server_url, const char *upgrade_file, const char *reboot_flag, const char *proto, int upgrade_type, const char *maint)
+    EXPECT_EQ(flashImage("fwdl.com", "/tmp/firmware.bin", "true", "2", 0, "false",2), 0);
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = nullptr;
+}
+TEST(MainHelperFunctionTest,getXconfResTest){
+    XCONFRES response;
+    char data[] = "{\"firmwareDownloadProtocol\":\"http\",\"firmwareFilename\":\"HS_VBN_24_sprint_20240725233056sdy_NG-signed.bin\",\"firmwareLocation\":\"https://cdlserver.tv/Images\",\"firmwareVersion\":\"HS_VBN_24_sprint_20240725233056sdy_NG\",\"rebootImmediately\":false}";
+    *response.cloudFWFile = 0;
+    *response.cloudFWLocation = 0;
+    *response.ipv6cloudFWLocation = 0;
+    *response.cloudFWVersion = 0;
+    *response.cloudDelayDownload = 0;
+    *response.cloudProto = 0;
+    *response.cloudImmediateRebootFlag = 0;
+    *response.peripheralFirmwares = 0;
+    *response.dlCertBundle = 0;
+    *response.cloudPDRIVersion = 0;
+    cout << data << endl;
+    EXPECT_EQ(getXconfRespData(&response, data), 0);
+}
+TEST(MainHelperFunctionTest,getXconfResTestNull){
+    XCONFRES response;
+    char data[] = "{\"firmwareDownloadProtocol\":\"http\",\"firmwareFilename\":\"HS_VBN_24_sprint_20240725233056sdy_NG-signed.bin\",\"firmwareLocation\":\"https://cdlserver.tv/Images\",\"firmwareVersion\":\"HS_VBN_24_sprint_20240725233056sdy_NG\",\"rebootImmediately\":false}";
+    *response.cloudFWFile = 0;
+    *response.cloudFWLocation = 0;
+    *response.ipv6cloudFWLocation = 0;
+    *response.cloudFWVersion = 0;
+    *response.cloudDelayDownload = 0;
+    *response.cloudProto = 0;
+    *response.cloudImmediateRebootFlag = 0;
+    *response.peripheralFirmwares = 0;
+    *response.dlCertBundle = 0;
+    *response.cloudPDRIVersion = 0;
+    cout << data << endl;
+    EXPECT_EQ(getXconfRespData(NULL, data), -1);
+}
+TEST(MainHelperFunctionTest,getXconfResTestNull1){
+    XCONFRES response;
+    *response.cloudFWFile = 0;
+    *response.cloudFWLocation = 0;
+    *response.ipv6cloudFWLocation = 0;
+    *response.cloudFWVersion = 0;
+    *response.cloudDelayDownload = 0;
+    *response.cloudProto = 0;
+    *response.cloudImmediateRebootFlag = 0;
+    *response.peripheralFirmwares = 0;
+    *response.dlCertBundle = 0;
+    *response.cloudPDRIVersion = 0;
+    EXPECT_EQ(getXconfRespData(&response, NULL), -1);
+}
+
+TEST(MainHelperFunctionTest,ProcessResTest){
+    XCONFRES response;
+    char data[] = "{\"firmwareDownloadProtocol\":\"http\",\"firmwareFilename\":\"HS_VBN_24_sprint_20240725233056sdy_NG-signed.bin\",\"additionalFwVerInfo\":\"HS_VBN_PDRI_20240725233056sdy_NG\",\"firmwareLocation\":\"https://cdlserver.tv/Images\",\"firmwareVersion\":\"HS_VBN_24_sprint_20240725233056sdy_NG\",\"rebootImmediately\":false}";
+    *response.cloudFWFile = 0;
+    *response.cloudFWLocation = 0;
+    *response.ipv6cloudFWLocation = 0;
+    *response.cloudFWVersion = 0;
+    *response.cloudDelayDownload = 0;
+    *response.cloudProto = 0;
+    *response.cloudImmediateRebootFlag = 0;
+    *response.peripheralFirmwares = 0;
+    *response.dlCertBundle = 0;
+    *response.cloudPDRIVersion = 0;
+    cout << data << endl;
+    getXconfRespData(&response, data);
+    EXPECT_EQ(processJsonResponse(&response, "1234.bin","HS", "true"), 0);
+}
+TEST(MainHelperFunctionTest,ProcessResTestMaintFalse){
+    XCONFRES response;
+    char data[] = "{\"firmwareDownloadProtocol\":\"http\",\"firmwareFilename\":\"HS_VBN_24_sprint_20240725233056sdy_NG-signed.bin\",\"additionalFwVerInfo\":\"HS_VBN_PDRI_20240725233056sdy_NG\",\"firmwareLocation\":\"https://cdlserver.tv/Images\",\"firmwareVersion\":\"HS_VBN_24_sprint_20240725233056sdy_NG\",\"rebootImmediately\":false}";
+    *response.cloudFWFile = 0;
+    *response.cloudFWLocation = 0;
+    *response.ipv6cloudFWLocation = 0;
+    *response.cloudFWVersion = 0;
+    *response.cloudDelayDownload = 0;
+    *response.cloudProto = 0;
+    *response.cloudImmediateRebootFlag = 0;
+    *response.peripheralFirmwares = 0;
+    *response.dlCertBundle = 0;
+    *response.cloudPDRIVersion = 0;
+    cout << data << endl;
+    getXconfRespData(&response, data);
+    EXPECT_EQ(processJsonResponse(&response, "1234.bin","HS", "false"), 0);
+}
+TEST(MainHelperFunctionTest,ProcessResTestNull){
+    EXPECT_EQ(processJsonResponse(NULL, NULL,NULL, NULL), -1);
+}
+TEST(MainHelperFunctionTest,initialValidationTestSuccess){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    EXPECT_CALL(DeviceMock, read_RFCProperty(_,_,_,_)).WillRepeatedly(Return(1));
+    EXPECT_CALL(mockexternal, CurrentRunningInst(_)).WillRepeatedly(Return(false));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(0));
+    EXPECT_EQ(initialValidation(), 3);
+}
+TEST(MainHelperFunctionTest,initialValidationTestFail){
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    EXPECT_CALL(DeviceMock, read_RFCProperty(_,_,_,_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(1));
+    EXPECT_CALL(mockexternal, CurrentRunningInst(_)).WillRepeatedly(Return(false));
+    EXPECT_EQ(initialValidation(), 0);
+}
+TEST(MainHelperFunctionTest,initialValidationTestFail1){
+    int ret = 0;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    EXPECT_CALL(DeviceMock, read_RFCProperty(_,_,_,_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillOnce(Return(1)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, CurrentRunningInst(_)).WillRepeatedly(Return(false));
+    EXPECT_EQ(initialValidation(), 0);
+    ret = system("rm -rf /tmp/DIFD.pid");
+}
+TEST(MainHelperFunctionTest,initialValidationTestInprogress){
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    EXPECT_CALL(DeviceMock, read_RFCProperty(_,_,_,_)).WillRepeatedly(Return(1));
+    EXPECT_CALL(mockexternal, CurrentRunningInst(_)).WillRepeatedly(Return(true));
+    EXPECT_EQ(initialValidation(), 2);
+}
+TEST(MainHelperFunctionTest,copyFileTestFail){
+    EXPECT_EQ(copyFile(NULL, NULL), -1);
+}
+TEST(MainHelperFunctionTest,copyFileTestSuccess){
+    const char *src = "/tmp/src.txt";
+    const char *dst = "/tmp/dst.txt";
+    int ret = 0;
+    ret = system("echo \"tesing\" > /tmp/src.txt");
+    EXPECT_EQ(copyFile(src, dst), 0);
+    ret = system("rm -f /tmp/src.txt");
+    ret = system("rm -f /tmp/dst.txt");
+}
+
+// =============================================================================
+// Task 3.6: L1 tests for enriched XConf response parsing
+// =============================================================================
+
+TEST(DirectCDNParsingTest, getXconfRespData_DirectCDN_ParsesPerArtifactURLs)
+{
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+
+    /* Enable Direct CDN via mock */
+    DeviceUtilsMock localMock;
+    g_DeviceUtilsMock = &localMock;
+    EXPECT_CALL(localMock, isDirectCDNEnabled()).WillRepeatedly(Return(true));
+
+    char data[] = "{"
+        "\"firmwareDownloadProtocol\":\"http\","
+        "\"firmwareFilename\":\"PX051AEI_VBN_24Q4_sprint_20241015-signed.bin\","
+        "\"firmwareLocation\":\"https://cdlserver.tv/Images\","
+        "\"firmwareVersion\":\"PX051AEI_VBN_24Q4_sprint_20241015\","
+        "\"additionalFwVerInfo\":\"PX051AEI_VBN_PDRI_24Q4_sprint_20241015\","
+        "\"firmware_URL\":\"https://cdn.direct/fw/PX051AEI_VBN_24Q4.bin\","
+        "\"additionalFwVerInfo_URL\":\"https://cdn.direct/pdri/PX051AEI_PDRI.bin\","
+        "\"remCtrlXR15\":\"XR15-10_firmware_4.2.0.0.tgz\","
+        "\"remCtrlXR15_URL\":\"https://cdn.direct/peri/XR15-10_firmware_4.2.0.0.tgz\","
+        "\"rebootImmediately\":false"
+    "}";
+
+    EXPECT_EQ(getXconfRespData(&response, data), 0);
+    EXPECT_STREQ(response.firmwareUrl, "https://cdn.direct/fw/PX051AEI_VBN_24Q4.bin");
+    EXPECT_STREQ(response.pdriUrl, "https://cdn.direct/pdri/PX051AEI_PDRI.bin");
+    /* Peripheral URL is parsed via dynamic key (getPeripheralProduct) */
+    EXPECT_STREQ(response.cloudFWLocation, "https://cdlserver.tv/Images");
+    EXPECT_STREQ(response.cloudFWFile, "PX051AEI_VBN_24Q4_sprint_20241015-signed.bin");
+
+    /* Cleanup */
+    g_DeviceUtilsMock = nullptr;
+}
+
+TEST(DirectCDNParsingTest, getXconfRespData_DirectCDN_Disabled_LegacyPath)
+{
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+
+    /* Direct CDN disabled via mock */
+    DeviceUtilsMock localMock;
+    g_DeviceUtilsMock = &localMock;
+    EXPECT_CALL(localMock, isDirectCDNEnabled()).WillRepeatedly(Return(false));
+
+    char data[] = "{"
+        "\"firmwareDownloadProtocol\":\"http\","
+        "\"firmwareFilename\":\"PX051AEI_VBN_24Q4-signed.bin\","
+        "\"firmwareLocation\":\"https://cdlserver.tv/Images\","
+        "\"firmwareVersion\":\"PX051AEI_VBN_24Q4\","
+        "\"firmware_URL\":\"https://cdn.direct/fw/should_not_parse.bin\","
+        "\"remCtrlXR15\":\"XR15-10_firmware_4.2.0.0.tgz\","
+        "\"rebootImmediately\":false"
+    "}";
+
+    EXPECT_EQ(getXconfRespData(&response, data), 0);
+    /* Per-artifact URLs should NOT be populated in legacy mode */
+    EXPECT_STREQ(response.firmwareUrl, "");
+    EXPECT_STREQ(response.pdriUrl, "");
+    EXPECT_STREQ(response.remCtrlUrl, "");
+    /* Legacy peripheral parsing should work */
+    EXPECT_STRNE(response.peripheralFirmwares, "");
+
+    /* Cleanup */
+    g_DeviceUtilsMock = nullptr;
+}
+
+// =============================================================================
+// Task 3.7: L1 tests for getPeripheralProduct() and PDRI validation
+// =============================================================================
+
+extern "C" {
+    int getPeripheralProduct(char *buf, size_t szIn);
+}
+
+TEST(DirectCDNParsingTest, getPeripheralProduct_NullBuffer_ReturnsError)
+{
+    EXPECT_EQ(getPeripheralProduct(NULL, 64), -1);
+}
+
+TEST(DirectCDNParsingTest, getPeripheralProduct_ZeroSize_ReturnsError)
+{
+    char buf[64];
+    EXPECT_EQ(getPeripheralProduct(buf, 0), -1);
+}
+
+TEST(DirectCDNParsingTest, getPeripheralProduct_Default_ReturnsRemCtrl)
+{
+    /* Before BuildRemoteInfo populates the cache, default is "remCtrl" */
+    char buf[64] = {0};
+    /* Note: If BuildRemoteInfo was called earlier in this process, the static
+       may already be populated. We test the function returns successfully. */
+    EXPECT_EQ(getPeripheralProduct(buf, sizeof(buf)), 0);
+    /* Result should be non-empty (either "remCtrl" or cached product) */
+    EXPECT_STRNE(buf, "");
+}
+
+TEST(DirectCDNParsingTest, processJsonResponse_PDRI_MissingSubstring_Invalid)
+{
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+
+    /* Set up a valid firmware image but PDRI without _PDRI_ substring */
+    strncpy(response.cloudFWFile, "HS_VBN_24Q4-signed.bin", sizeof(response.cloudFWFile) - 1);
+    strncpy(response.cloudFWLocation, "https://cdlserver.tv/Images", sizeof(response.cloudFWLocation) - 1);
+    strncpy(response.cloudFWVersion, "HS_VBN_24Q4", sizeof(response.cloudFWVersion) - 1);
+    strncpy(response.cloudProto, "http", sizeof(response.cloudProto) - 1);
+    /* PDRI name without _PDRI_ substring — should fail validation */
+    strncpy(response.cloudPDRIVersion, "HS_VBN_24Q4_addon", sizeof(response.cloudPDRIVersion) - 1);
+
+    /* processJsonResponse should fail (ret=1) since PDRI is invalid */
+    int ret = processJsonResponse(&response, "old_fw.bin", "HS", "false");
+    EXPECT_EQ(ret, 1);
+}
+
+TEST(DirectCDNParsingTest, processJsonResponse_PDRI_WithSubstring_Valid)
+{
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+
+    strncpy(response.cloudFWFile, "HS_VBN_24Q4-signed.bin", sizeof(response.cloudFWFile) - 1);
+    strncpy(response.cloudFWLocation, "https://cdlserver.tv/Images", sizeof(response.cloudFWLocation) - 1);
+    strncpy(response.cloudFWVersion, "HS_VBN_24Q4", sizeof(response.cloudFWVersion) - 1);
+    strncpy(response.cloudProto, "http", sizeof(response.cloudProto) - 1);
+    /* PDRI name WITH _PDRI_ substring — should pass validation */
+    strncpy(response.cloudPDRIVersion, "HS_VBN_PDRI_24Q4_addon", sizeof(response.cloudPDRIVersion) - 1);
+
+    int ret = processJsonResponse(&response, "old_fw.bin", "HS", "false");
+    EXPECT_EQ(ret, 0);
+}
+
+/* =========================================================================
+ * Task 5 Unit Tests: Direct CDN main-flow routing & Codebig bypass
+ * ========================================================================= */
+
+/**
+ * @brief Task 5.7: When direct_cdn=true and direct download fails with
+ * connectivity issue, Codebig fallback must NOT be attempted.
+ */
+TEST(DirectCDNBypassTest, DirectCDN_SkipsCodebigFallback) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    int http_code = 0;
+    int local_force_exit = 0;
+    void *test_curl = NULL;
+    Rfc_t local_rfc = {0};
+    strncpy(local_rfc.rfc_throttle, "false", sizeof(local_rfc.rfc_throttle) - 1);
+
+    RdkUpgradeContext_t context = {0};
+    context.upgrade_type = PCI_UPGRADE;
+    context.server_type = HTTP_SSR_DIRECT;
+    context.artifactLocationUrl = "https://cdn.example.com/firmware.bin";
+    context.dwlloc = "/tmp/firmware.bin";
+    context.pPostFields = NULL;
+    context.immed_reboot_flag = "false";
+    context.delay_dwnl = 0;
+    context.lastrun = "0";
+    context.disableStatsUpdate = (char*)"true";
+    context.device_info = &device_info;
+    context.force_exit = &local_force_exit;
+    context.trigger_type = 1;
+    context.rfc_list = &local_rfc;
+    context.direct_cdn = true;  /* KEY: Direct CDN enabled */
+
+    /* downloadFile fails with connectivity issue (curl error 7) */
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillRepeatedly(testing::DoAll(testing::SetArgPointee<4>(0), testing::Return(CURL_CONNECTIVITY_ISSUE)));
+
+    /* codebigdownloadFile should NEVER be called — this is the assertion */
+    EXPECT_CALL(mockfileops, codebigdownloadFile(_, _, _, _, _)).Times(0);
+
+    /* Mock supporting calls */
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isUpgradeInProgress()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, CheckIProuteConnectivity(_)).WillRepeatedly(Return(false));
+
+    int result = rdkv_upgrade_request(&context, &test_curl, &http_code);
+    /* Download should fail (no fallback available) */
+    EXPECT_NE(result, CURL_SUCCESS);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief Task 5.7: When direct_cdn=false and direct download fails with
+ * connectivity issue, Codebig fallback MUST be attempted (legacy behavior).
+ */
+TEST(DirectCDNBypassTest, LegacyMode_AttempsCodebigFallback) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    int http_code = 0;
+    int local_force_exit = 0;
+    void *test_curl = NULL;
+    Rfc_t local_rfc = {0};
+    strncpy(local_rfc.rfc_throttle, "false", sizeof(local_rfc.rfc_throttle) - 1);
+
+    RdkUpgradeContext_t context = {0};
+    context.upgrade_type = PCI_UPGRADE;
+    context.server_type = HTTP_SSR_DIRECT;
+    context.artifactLocationUrl = "https://cdn.example.com/firmware.bin";
+    context.dwlloc = "/tmp/firmware.bin";
+    context.pPostFields = NULL;
+    context.immed_reboot_flag = "false";
+    context.delay_dwnl = 0;
+    context.lastrun = "0";
+    context.disableStatsUpdate = (char*)"true";
+    context.device_info = &device_info;
+    context.force_exit = &local_force_exit;
+    context.trigger_type = 1;
+    context.rfc_list = &local_rfc;
+    context.direct_cdn = false;  /* KEY: Direct CDN disabled (legacy) */
+
+    /* downloadFile fails with connectivity issue (curl error 7) */
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillRepeatedly(testing::DoAll(testing::SetArgPointee<4>(0), testing::Return(CURL_CONNECTIVITY_ISSUE)));
+
+    /* codebigdownloadFile SHOULD be called as fallback — at least once */
+    EXPECT_CALL(mockfileops, codebigdownloadFile(_, _, _, _, _))
+        .Times(testing::AtLeast(1))
+        .WillRepeatedly(testing::DoAll(testing::SetArgPointee<4>(200), testing::Return(CURL_SUCCESS)));
+
+    /* Mock supporting calls */
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isUpgradeInProgress()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, CheckIProuteConnectivity(_)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, checkCodebigAccess()).WillRepeatedly(Return(true));
+
+    int result = rdkv_upgrade_request(&context, &test_curl, &http_code);
+    /* Should succeed via Codebig fallback */
+    EXPECT_EQ(result, CURL_SUCCESS);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief Task 5.7: When direct_cdn=true and download succeeds on first attempt,
+ * no fallback is triggered and result is success.
+ */
+TEST(DirectCDNBypassTest, DirectCDN_SuccessNoFallbackNeeded) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    int http_code = 0;
+    int local_force_exit = 0;
+    void *test_curl = NULL;
+    Rfc_t local_rfc = {0};
+    strncpy(local_rfc.rfc_throttle, "false", sizeof(local_rfc.rfc_throttle) - 1);
+
+    RdkUpgradeContext_t context = {0};
+    context.upgrade_type = PCI_UPGRADE;
+    context.server_type = HTTP_SSR_DIRECT;
+    context.artifactLocationUrl = "https://cdn.example.com/firmware.bin";
+    context.dwlloc = "/tmp/firmware.bin";
+    context.pPostFields = NULL;
+    context.immed_reboot_flag = "false";
+    context.delay_dwnl = 0;
+    context.lastrun = "0";
+    context.disableStatsUpdate = (char*)"true";
+    context.device_info = &device_info;
+    context.force_exit = &local_force_exit;
+    context.trigger_type = 1;
+    context.rfc_list = &local_rfc;
+    context.direct_cdn = true;
+
+    /* downloadFile succeeds */
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillOnce(testing::DoAll(testing::SetArgPointee<4>(200), testing::Return(CURL_SUCCESS)));
+
+    /* codebigdownloadFile should NEVER be called */
+    EXPECT_CALL(mockfileops, codebigdownloadFile(_, _, _, _, _)).Times(0);
+
+    /* Mock supporting calls */
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isUpgradeInProgress()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+
+    int result = rdkv_upgrade_request(&context, &test_curl, &http_code);
+    EXPECT_EQ(result, CURL_SUCCESS);
+    EXPECT_EQ(http_code, 200);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/* =========================================================================
+ * Task 6 Unit Tests: Selective Retry Logic — Error Classification
+ * ========================================================================= */
+
+/**
+ * @brief Task 6.1: Per-artifact PCI download success returns 0.
+ * When downloadFile returns 0 and HTTP 200, checkTriggerUpgrade returns success.
+ */
+TEST(DirectCDNRetryTest, PerArtifact_PCI_Success_ReturnsZero) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+    strncpy(response.firmwareUrl, "https://cdn.example.com/fw.bin", sizeof(response.firmwareUrl) - 1);
+    strncpy(response.cloudFWFile, "testModel_fw.bin", sizeof(response.cloudFWFile) - 1);
+
+    /* downloadFile succeeds with HTTP 200 */
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillOnce(testing::DoAll(testing::SetArgPointee<4>(200), testing::Return(0)));
+
+    /* Mock supporting calls required by rdkv_upgrade_request */
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+
+    int result = checkTriggerUpgrade(&response, "testModel", PCI_UPGRADE);
+    EXPECT_EQ(result, 0);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief Task 6.1: Per-artifact PCI transient curl error returns DIRECT_CDN_RETRY_ERR.
+ * Network connectivity issue (curl error 7) is classified as retryable.
+ */
+TEST(DirectCDNRetryTest, PerArtifact_PCI_TransientCurlError_ReturnsRetryErr) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+    strncpy(response.firmwareUrl, "https://cdn.example.com/fw.bin", sizeof(response.firmwareUrl) - 1);
+    strncpy(response.cloudFWFile, "testModel_fw.bin", sizeof(response.cloudFWFile) - 1);
+
+    /* downloadFile fails with CURL_CONNECTIVITY_ISSUE (7) — retryable */
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillRepeatedly(testing::DoAll(testing::SetArgPointee<4>(0), testing::Return(CURL_CONNECTIVITY_ISSUE)));
+
+    /* Mock supporting calls */
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, CheckIProuteConnectivity(_)).WillRepeatedly(Return(false));
+
+    int result = checkTriggerUpgrade(&response, "testModel", PCI_UPGRADE);
+    EXPECT_EQ(result, DIRECT_CDN_RETRY_ERR);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief Task 6.1: Per-artifact PCI timeout error returns DIRECT_CDN_RETRY_ERR.
+ * CURLTIMEOUT (28) is classified as retryable.
+ */
+TEST(DirectCDNRetryTest, PerArtifact_PCI_Timeout_ReturnsRetryErr) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+    strncpy(response.firmwareUrl, "https://cdn.example.com/fw.bin", sizeof(response.firmwareUrl) - 1);
+    strncpy(response.cloudFWFile, "testModel_fw.bin", sizeof(response.cloudFWFile) - 1);
+
+    /* downloadFile fails with CURLTIMEOUT (28) — retryable */
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillRepeatedly(testing::DoAll(testing::SetArgPointee<4>(0), testing::Return(CURLTIMEOUT)));
+
+    /* Mock supporting calls */
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, CheckIProuteConnectivity(_)).WillRepeatedly(Return(false));
+
+    int result = checkTriggerUpgrade(&response, "testModel", PCI_UPGRADE);
+    EXPECT_EQ(result, DIRECT_CDN_RETRY_ERR);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief Task 6.1: Per-artifact PCI low-bandwidth error returns DIRECT_CDN_RETRY_ERR.
+ * CURL_LOW_BANDWIDTH (18) is classified as retryable.
+ */
+TEST(DirectCDNRetryTest, PerArtifact_PCI_LowBandwidth_ReturnsRetryErr) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+    strncpy(response.firmwareUrl, "https://cdn.example.com/fw.bin", sizeof(response.firmwareUrl) - 1);
+    strncpy(response.cloudFWFile, "testModel_fw.bin", sizeof(response.cloudFWFile) - 1);
+
+    /* downloadFile fails with CURL_LOW_BANDWIDTH (18) — retryable */
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillRepeatedly(testing::DoAll(testing::SetArgPointee<4>(0), testing::Return(CURL_LOW_BANDWIDTH)));
+
+    /* Mock supporting calls */
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+
+    int result = checkTriggerUpgrade(&response, "testModel", PCI_UPGRADE);
+    EXPECT_EQ(result, DIRECT_CDN_RETRY_ERR);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief Task 6.1: Per-artifact transient HTTP 503 returns DIRECT_CDN_RETRY_ERR.
+ * Server-side Service Unavailable is classified as retryable.
+ */
+TEST(DirectCDNRetryTest, PerArtifact_PCI_Http503_ReturnsRetryErr) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+    strncpy(response.firmwareUrl, "https://cdn.example.com/fw.bin", sizeof(response.firmwareUrl) - 1);
+    strncpy(response.cloudFWFile, "testModel_fw.bin", sizeof(response.cloudFWFile) - 1);
+
+    /* downloadFile returns curl 0 (ok) but HTTP 503 (Service Unavailable) — retryable */
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillRepeatedly(testing::DoAll(testing::SetArgPointee<4>(503), testing::Return(0)));
+
+    /* Mock supporting calls */
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+
+    int result = checkTriggerUpgrade(&response, "testModel", PCI_UPGRADE);
+    EXPECT_EQ(result, DIRECT_CDN_RETRY_ERR);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief Task 6.1: Per-artifact permanent HTTP 404 returns -1.
+ * HTTP Not Found is classified as non-retryable permanent failure.
+ */
+TEST(DirectCDNRetryTest, PerArtifact_PCI_Http404_ReturnsPermanentFailure) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+    strncpy(response.firmwareUrl, "https://cdn.example.com/fw.bin", sizeof(response.firmwareUrl) - 1);
+    strncpy(response.cloudFWFile, "testModel_fw.bin", sizeof(response.cloudFWFile) - 1);
+
+    /* downloadFile returns curl 0 but HTTP 404 — permanent failure */
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillRepeatedly(testing::DoAll(testing::SetArgPointee<4>(404), testing::Return(0)));
+
+    /* Mock supporting calls */
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+
+    int result = checkTriggerUpgrade(&response, "testModel", PCI_UPGRADE);
+    EXPECT_EQ(result, -1);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief Task 6.2: Per-artifact with empty URL returns 0 (skip).
+ * When artifact URL is empty, checkTriggerUpgrade skips and returns success.
+ */
+TEST(DirectCDNRetryTest, PerArtifact_EmptyUrl_SkipsAndReturnsZero) {
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+    /* firmwareUrl is empty — PCI should be skipped */
+    strncpy(response.cloudFWFile, "testModel_fw.bin", sizeof(response.cloudFWFile) - 1);
+
+    int result = checkTriggerUpgrade(&response, "testModel", PCI_UPGRADE);
+    EXPECT_EQ(result, 0);
+}
+
+/**
+ * @brief Task 6.2: Per-artifact with empty filename returns 0 (skip).
+ * When artifact filename is empty, checkTriggerUpgrade skips and returns success.
+ */
+TEST(DirectCDNRetryTest, PerArtifact_EmptyFilename_SkipsAndReturnsZero) {
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+    strncpy(response.firmwareUrl, "https://cdn.example.com/fw.bin", sizeof(response.firmwareUrl) - 1);
+    /* cloudFWFile is empty — PCI should be skipped */
+
+    int result = checkTriggerUpgrade(&response, "testModel", PCI_UPGRADE);
+    EXPECT_EQ(result, 0);
+}
+
+/**
+ * @brief Task 6.1: Per-artifact PDRI download success returns 0.
+ * Validates PDRI path uses pdriUrl correctly.
+ */
+TEST(DirectCDNRetryTest, PerArtifact_PDRI_Success_ReturnsZero) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+    strncpy(response.pdriUrl, "https://cdn.example.com/pdri.bin", sizeof(response.pdriUrl) - 1);
+    strncpy(response.cloudPDRIVersion, "testModel_PDRI_v2.bin", sizeof(response.cloudPDRIVersion) - 1);
+
+    /* downloadFile succeeds */
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillOnce(testing::DoAll(testing::SetArgPointee<4>(200), testing::Return(0)));
+
+    /* Mock supporting calls */
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+
+    int result = checkTriggerUpgrade(&response, "testModel", PDRI_UPGRADE);
+    EXPECT_EQ(result, 0);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief Task 6.1: Per-artifact PDRI transient error returns DIRECT_CDN_RETRY_ERR.
+ * DNS resolution failure is classified as retryable for PDRI.
+ */
+TEST(DirectCDNRetryTest, PerArtifact_PDRI_TransientError_ReturnsRetryErr) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+    strncpy(response.pdriUrl, "https://cdn.example.com/pdri.bin", sizeof(response.pdriUrl) - 1);
+    strncpy(response.cloudPDRIVersion, "testModel_PDRI_v2.bin", sizeof(response.cloudPDRIVersion) - 1);
+
+    /* downloadFile fails with DNS resolution error (6) */
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillRepeatedly(testing::DoAll(testing::SetArgPointee<4>(0), testing::Return(CURL_COULDNT_RESOLVE_HOST)));
+
+    /* Mock supporting calls */
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, CheckIProuteConnectivity(_)).WillRepeatedly(Return(false));
+
+    int result = checkTriggerUpgrade(&response, "testModel", PDRI_UPGRADE);
+    EXPECT_EQ(result, DIRECT_CDN_RETRY_ERR);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief Task 6.1: Per-artifact PERIPHERAL empty URL returns 0 (skip).
+ * Peripheral with no URL available is skipped (does not gate retry loop).
+ */
+TEST(DirectCDNRetryTest, PerArtifact_Peripheral_EmptyUrl_SkipsReturnsZero) {
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+    /* remCtrlUrl is empty — PERIPHERAL should be skipped */
+    strncpy(response.peripheralFirmwares, "remCtrl_fw.bin", sizeof(response.peripheralFirmwares) - 1);
+
+    int result = checkTriggerUpgrade(&response, "testModel", PERIPHERAL_UPGRADE);
+    EXPECT_EQ(result, 0);
+}
+
+/* =========================================================================
+ * Task 7.1 Unit Tests: DirectCDNDownload orchestrator coverage
+ * ========================================================================= */
+
+class DirectCDNOrchestratorTest : public ::testing::Test {
+protected:
+    MockDownloadFileOps mockfileops;
+    MockExternal mockexternal;
+    DeviceUtilsMock DeviceMock;
+    DeviceProperty_t local_device_info;
+    int http_code;
+    char cur_img_name[64];
+
+    void SetUp() override {
+        global_mockdownloadfileops_ptr = &mockfileops;
+        global_mockexternal_ptr = &mockexternal;
+        g_DeviceUtilsMock = &DeviceMock;
+
+        memset(&local_device_info, 0, sizeof(local_device_info));
+        strncpy(local_device_info.model, "testModel", sizeof(local_device_info.model) - 1);
+        strncpy(local_device_info.maint_status, "false", sizeof(local_device_info.maint_status) - 1);
+        strncpy(local_device_info.difw_path, "/tmp", sizeof(local_device_info.difw_path) - 1);
+
+        /* checkTriggerUpgrade() per-artifact path uses global device_info */
+        strncpy(device_info.model, "testModel", sizeof(device_info.model) - 1);
+        strncpy(device_info.maint_status, "false", sizeof(device_info.maint_status) - 1);
+        strncpy(device_info.difw_path, "/tmp", sizeof(device_info.difw_path) - 1);
+
+        strncpy(cur_img_name, "testModel_current.bin", sizeof(cur_img_name) - 1);
+        cur_img_name[sizeof(cur_img_name) - 1] = '\0';
+        http_code = 0;
+
+        EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+        EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+        EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+        EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+        EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+        EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+        EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+        EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+        EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+        EXPECT_CALL(mockexternal, CheckIProuteConnectivity(_)).WillRepeatedly(Return(false));
+        EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+        EXPECT_CALL(DeviceMock, isDirectCDNEnabled()).WillRepeatedly(Return(true));
+    }
+
+    void TearDown() override {
+        global_mockdownloadfileops_ptr = NULL;
+        global_mockexternal_ptr = NULL;
+        g_DeviceUtilsMock = &Deviceglobal;
+    }
+};
+
+TEST_F(DirectCDNOrchestratorTest, HappyPath_AllArtifactsSucceed_ReturnsZero) {
+    const char *xconf_json = "{"
+        "\"firmwareDownloadProtocol\":\"http\"," 
+        "\"firmwareFilename\":\"testModel_fw.bin\"," 
+        "\"firmwareLocation\":\"https://legacy.example.com/fw\"," 
+        "\"firmwareVersion\":\"testModel_VBN_24Q4\"," 
+        "\"additionalFwVerInfo\":\"testModel_PDRI_24Q4.bin\"," 
+        "\"firmware_URL\":\"https://cdn.example.com/pci.bin\"," 
+        "\"additionalFwVerInfo_URL\":\"https://cdn.example.com/pdri.bin\"," 
+        "\"remCtrl\":\"peri_fw.bin\"," 
+        "\"remCtrl_URL\":\"https://cdn.example.com/peri.bin\"," 
+        "\"rebootImmediately\":false"
+    "}";
+
+    int xconf_calls = 0;
+    int pci_calls = 0;
+    int pdri_calls = 0;
+    int peri_calls = 0;
+
+    EXPECT_CALL(mockfileops, codebigdownloadFile(_, _, _, _, _)).Times(0);
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillRepeatedly(testing::Invoke([&](int, const char *url, const void *dwlloc, char *post, int *http) {
+            if (post != NULL) {
+                DownloadData *dl = (DownloadData *)dwlloc;
+                size_t max_copy = dl->memsize > 0 ? dl->memsize - 1 : 0;
+                xconf_calls++;
+                if (dl != NULL && dl->pvOut != NULL && max_copy > 0) {
+                    strncpy((char *)dl->pvOut, xconf_json, max_copy);
+                    ((char *)dl->pvOut)[max_copy] = '\0';
+                    dl->datasize = strlen((char *)dl->pvOut);
+                }
+                *http = 200;
+                return 0;
+            }
+
+            if (url != NULL && strstr(url, "pci.bin") != NULL) {
+                pci_calls++;
+            } else if (url != NULL && strstr(url, "pdri.bin") != NULL) {
+                pdri_calls++;
+            } else if (url != NULL && strstr(url, "peri.bin") != NULL) {
+                peri_calls++;
+            }
+
+            *http = 200;
+            return 0;
+        }));
+
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+
+    int ret = DirectCDNDownload(&response, cur_img_name, &local_device_info, HTTP_XCONF_DIRECT, &http_code);
+    EXPECT_EQ(ret, 0);
+    EXPECT_STRNE(response.firmwareUrl, "");
+    EXPECT_EQ(xconf_calls, 1);
+    EXPECT_EQ(pci_calls, 1);
+    EXPECT_EQ(pdri_calls, 1);
+    EXPECT_EQ(peri_calls, 1);
+}
+
+TEST_F(DirectCDNOrchestratorTest, SelectiveRetry_SkipsSucceededArtifactOnNextIteration) {
+    const char *xconf_json = "{"
+        "\"firmwareDownloadProtocol\":\"http\"," 
+        "\"firmwareFilename\":\"testModel_fw.bin\"," 
+        "\"firmwareLocation\":\"https://legacy.example.com/fw\"," 
+        "\"firmwareVersion\":\"testModel_VBN_24Q4\"," 
+        "\"additionalFwVerInfo\":\"testModel_PDRI_24Q4.bin\"," 
+        "\"firmware_URL\":\"https://cdn.example.com/pci.bin\"," 
+        "\"additionalFwVerInfo_URL\":\"https://cdn.example.com/pdri.bin\"," 
+        "\"remCtrl\":\"peri_fw.bin\"," 
+        "\"remCtrl_URL\":\"https://cdn.example.com/peri.bin\"," 
+        "\"rebootImmediately\":false"
+    "}";
+
+    int xconf_calls = 0;
+    int pci_calls = 0;
+    int pdri_calls = 0;
+
+    EXPECT_CALL(mockfileops, codebigdownloadFile(_, _, _, _, _)).Times(0);
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillRepeatedly(testing::Invoke([&](int, const char *url, const void *dwlloc, char *post, int *http) {
+            if (post != NULL) {
+                DownloadData *dl = (DownloadData *)dwlloc;
+                size_t max_copy = dl->memsize > 0 ? dl->memsize - 1 : 0;
+                xconf_calls++;
+                if (dl != NULL && dl->pvOut != NULL && max_copy > 0) {
+                    strncpy((char *)dl->pvOut, xconf_json, max_copy);
+                    ((char *)dl->pvOut)[max_copy] = '\0';
+                    dl->datasize = strlen((char *)dl->pvOut);
+                }
+                *http = 200;
+                return 0;
+            }
+
+            if (url != NULL && strstr(url, "pci.bin") != NULL) {
+                pci_calls++;
+                *http = 200;
+                return 0;
+            }
+
+            if (url != NULL && strstr(url, "pdri.bin") != NULL) {
+                pdri_calls++;
+                if (xconf_calls < 2) {
+                    *http = 0;
+                    return CURLTIMEOUT;
+                }
+                *http = 200;
+                return 0;
+            }
+
+            *http = 200;
+            return 0;
+        }));
+
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+
+    int ret = DirectCDNDownload(&response, cur_img_name, &local_device_info, HTTP_XCONF_DIRECT, &http_code);
+    EXPECT_EQ(ret, 0);
+    EXPECT_GE(xconf_calls, 2);
+    EXPECT_EQ(pci_calls, 1) << "PCI must not be retried after first success";
+    EXPECT_GE(pdri_calls, 2);
+}
+
+TEST_F(DirectCDNOrchestratorTest, MaxRetryExhaustion_ReturnsFailure) {
+    const char *xconf_json = "{"
+        "\"firmwareDownloadProtocol\":\"http\"," 
+        "\"firmwareFilename\":\"testModel_fw.bin\"," 
+        "\"firmwareLocation\":\"https://legacy.example.com/fw\"," 
+        "\"firmwareVersion\":\"testModel_VBN_24Q4\"," 
+        "\"additionalFwVerInfo\":\"testModel_PDRI_24Q4.bin\"," 
+        "\"firmware_URL\":\"https://cdn.example.com/pci.bin\"," 
+        "\"additionalFwVerInfo_URL\":\"https://cdn.example.com/pdri.bin\"," 
+        "\"rebootImmediately\":false"
+    "}";
+
+    int xconf_calls = 0;
+
+    EXPECT_CALL(mockfileops, codebigdownloadFile(_, _, _, _, _)).Times(0);
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillRepeatedly(testing::Invoke([&](int, const char *, const void *dwlloc, char *post, int *http) {
+            if (post != NULL) {
+                DownloadData *dl = (DownloadData *)dwlloc;
+                size_t max_copy = dl->memsize > 0 ? dl->memsize - 1 : 0;
+                xconf_calls++;
+                if (dl != NULL && dl->pvOut != NULL && max_copy > 0) {
+                    strncpy((char *)dl->pvOut, xconf_json, max_copy);
+                    ((char *)dl->pvOut)[max_copy] = '\0';
+                    dl->datasize = strlen((char *)dl->pvOut);
+                }
+                *http = 200;
+                return 0;
+            }
+
+            *http = 0;
+            return CURLTIMEOUT;
+        }));
+
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+
+    int ret = DirectCDNDownload(&response, cur_img_name, &local_device_info, HTTP_XCONF_DIRECT, &http_code);
+    EXPECT_NE(ret, 0);
+    EXPECT_EQ(xconf_calls, 3);
+}
+
+/**
+ * @brief When isDwnlBlock forces server_type flip to CODEBIG while Direct CDN
+ * is active, codebigdownloadFile rejects the request and the download fails.
+ */
+TEST(DirectCDNBypassTest, DirectCDN_WhenDwnlBlockForcesCodebig_RequestFails) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    int http_code = 0;
+    int local_force_exit = 0;
+    void *test_curl = NULL;
+    Rfc_t local_rfc = {0};
+    strncpy(local_rfc.rfc_throttle, "false", sizeof(local_rfc.rfc_throttle) - 1);
+
+    RdkUpgradeContext_t context = {0};
+    context.upgrade_type = PCI_UPGRADE;
+    context.server_type = HTTP_SSR_DIRECT;
+    context.artifactLocationUrl = "https://cdn.example.com/firmware.bin";
+    context.dwlloc = "/tmp/firmware.bin";
+    context.pPostFields = NULL;
+    context.immed_reboot_flag = "false";
+    context.delay_dwnl = 0;
+    context.lastrun = "0";
+    context.disableStatsUpdate = (char*)"true";
+    context.device_info = &device_info;
+    context.force_exit = &local_force_exit;
+    context.trigger_type = 1;
+    context.rfc_list = &local_rfc;
+    context.direct_cdn = true;
+
+    /* isDwnlBlock forces server_type flip from DIRECT to CODEBIG */
+    EXPECT_CALL(mockexternal, isDwnlBlock(HTTP_SSR_DIRECT)).WillOnce(Return(1));
+    EXPECT_CALL(mockexternal, isDwnlBlock(HTTP_SSR_CODEBIG)).WillOnce(Return(0));
+
+    /* codebigdownloadFile is entered but returns -1 (direct_cdn guard) */
+    EXPECT_CALL(mockfileops, codebigdownloadFile(_, _, _, _, _))
+        .Times(1)
+        .WillOnce(testing::DoAll(testing::SetArgPointee<4>(0), testing::Return(-1)));
+
+    /* retryDownload uses context->server_type (HTTP_SSR_DIRECT) so downloadFile
+       gets called from the retry path; let it fail so the overall result != 0 */
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillRepeatedly(testing::DoAll(testing::SetArgPointee<4>(0), testing::Return(-1)));
+
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isUpgradeInProgress()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+
+    int result = rdkv_upgrade_request(&context, &test_curl, &http_code);
+    EXPECT_NE(result, CURL_SUCCESS);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief Per-artifact PDRI download without .bin suffix gets .bin appended
+ * to the local save path.
+ */
+TEST(DirectCDNRetryTest, PerArtifact_PDRI_WhenNoBinSuffix_AppendsBinToPath) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+    strncpy(response.pdriUrl, "https://cdn.example.com/pdri_image", sizeof(response.pdriUrl) - 1);
+    strncpy(response.cloudPDRIVersion, "testModel_PDRI_v2", sizeof(response.cloudPDRIVersion) - 1);
+
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillOnce(testing::Invoke([](int, const char *, const void *dwlloc, char *, int *http) {
+            const char *path = (const char *)dwlloc;
+            EXPECT_NE(strstr(path, "testModel_PDRI_v2.bin"), nullptr);
+            *http = 200;
+            return 0;
+        }));
+
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+
+    int result = checkTriggerUpgrade(&response, "testModel", PDRI_UPGRADE);
+    EXPECT_EQ(result, 0);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief Per-artifact PDRI download with existing .bin suffix does not
+ * double-append (no .bin.bin in the local save path).
+ */
+TEST(DirectCDNRetryTest, PerArtifact_PDRI_WhenBinSuffixPresent_PathUnchanged) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+    strncpy(response.pdriUrl, "https://cdn.example.com/pdri_image.bin", sizeof(response.pdriUrl) - 1);
+    strncpy(response.cloudPDRIVersion, "testModel_PDRI_v2.bin", sizeof(response.cloudPDRIVersion) - 1);
+
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillOnce(testing::Invoke([](int, const char *, const void *dwlloc, char *, int *http) {
+            const char *path = (const char *)dwlloc;
+            EXPECT_NE(strstr(path, "testModel_PDRI_v2.bin"), nullptr);
+            EXPECT_EQ(strstr(path, ".bin.bin"), nullptr);
+            *http = 200;
+            return 0;
+        }));
+
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+
+    int result = checkTriggerUpgrade(&response, "testModel", PDRI_UPGRADE);
+    EXPECT_EQ(result, 0);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief Per-artifact download receiving HTTP 403 (token expiry) is classified
+ * as retryable so the orchestrator can re-query XConf for fresh URLs.
+ */
+TEST(DirectCDNRetryTest, PerArtifact_WhenHttp403Received_ReturnsRetryErr) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    XCONFRES response;
+    memset(&response, 0, sizeof(response));
+    strncpy(response.firmwareUrl, "https://cdn.example.com/fw.bin", sizeof(response.firmwareUrl) - 1);
+    strncpy(response.cloudFWFile, "testModel_fw.bin", sizeof(response.cloudFWFile) - 1);
+
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .WillRepeatedly(testing::DoAll(testing::SetArgPointee<4>(403), testing::Return(0)));
+
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+
+    int result = checkTriggerUpgrade(&response, "testModel", PCI_UPGRADE);
+    EXPECT_EQ(result, DIRECT_CDN_RETRY_ERR);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief When downloadFile returns RDKV_UPGRADE_ERROR_STATE_RED, rdkv_upgrade_request
+ * must short-circuit immediately without calling retryDownload or codebig fallback.
+ * This verifies the state-red guard prevents retry loops after uninitialize() was called.
+ */
+TEST(StateRedShortCircuitTest, DirectPath_SkipsRetryWhenStateRedReturned) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    int local_force_exit = 0;
+    int http_code = 0;
+    void *test_curl = NULL;
+    Rfc_t local_rfc = {0};
+    strncpy(local_rfc.rfc_throttle, "false", sizeof(local_rfc.rfc_throttle) - 1);
+
+    RdkUpgradeContext_t context = {0};
+    context.upgrade_type = PCI_UPGRADE;
+    context.server_type = HTTP_SSR_DIRECT;
+    context.artifactLocationUrl = "https://cdn.example.com/firmware.bin";
+    context.dwlloc = "/tmp/firmware.bin";
+    context.pPostFields = NULL;
+    context.immed_reboot_flag = "false";
+    context.delay_dwnl = 0;
+    context.lastrun = "0";
+    context.disableStatsUpdate = (char*)"true";
+    context.device_info = &device_info;
+    context.force_exit = &local_force_exit;
+    context.trigger_type = 1;
+    context.rfc_list = &local_rfc;
+    context.direct_cdn = false;
+
+    /* downloadFile returns STATE_RED — should be called exactly once (no retry) */
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _))
+        .Times(1)
+        .WillOnce(testing::DoAll(testing::SetArgPointee<4>(0), testing::Return(RDKV_UPGRADE_ERROR_STATE_RED)));
+
+    /* codebigdownloadFile should NEVER be called — no fallback after state red */
+    EXPECT_CALL(mockfileops, codebigdownloadFile(_, _, _, _, _)).Times(0);
+
+    /* Mock supporting calls */
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isUpgradeInProgress()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, CheckIProuteConnectivity(_)).WillRepeatedly(Return(false));
+
+    int result = rdkv_upgrade_request(&context, &test_curl, &http_code);
+    EXPECT_EQ(result, RDKV_UPGRADE_ERROR_STATE_RED);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+/**
+ * @brief When codebigdownloadFile returns RDKV_UPGRADE_ERROR_STATE_RED on the codebig
+ * path, rdkv_upgrade_request must short-circuit without retrying.
+ */
+TEST(StateRedShortCircuitTest, CodebigPath_SkipsRetryWhenStateRedReturned) {
+    MockDownloadFileOps mockfileops;
+    global_mockdownloadfileops_ptr = &mockfileops;
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    int local_force_exit = 0;
+    int http_code = 0;
+    void *test_curl = NULL;
+    Rfc_t local_rfc = {0};
+    strncpy(local_rfc.rfc_throttle, "false", sizeof(local_rfc.rfc_throttle) - 1);
+
+    RdkUpgradeContext_t context = {0};
+    context.upgrade_type = PCI_UPGRADE;
+    context.server_type = HTTP_SSR_CODEBIG;
+    context.artifactLocationUrl = "https://cdn.example.com/firmware.bin";
+    context.dwlloc = "/tmp/firmware.bin";
+    context.pPostFields = NULL;
+    context.immed_reboot_flag = "false";
+    context.delay_dwnl = 0;
+    context.lastrun = "0";
+    context.disableStatsUpdate = (char*)"true";
+    context.device_info = &device_info;
+    context.force_exit = &local_force_exit;
+    context.trigger_type = 1;
+    context.rfc_list = &local_rfc;
+    context.direct_cdn = false;
+
+    /* codebigdownloadFile returns STATE_RED — should be called exactly once (no retry) */
+    EXPECT_CALL(mockfileops, codebigdownloadFile(_, _, _, _, _))
+        .Times(1)
+        .WillOnce(testing::DoAll(testing::SetArgPointee<4>(0), testing::Return(RDKV_UPGRADE_ERROR_STATE_RED)));
+
+    /* downloadFile should NEVER be called — no fallback after state red */
+    EXPECT_CALL(mockfileops, downloadFile(_, _, _, _, _)).Times(0);
+
+    /* Mock supporting calls */
+    EXPECT_CALL(mockexternal, isDwnlBlock(_)).WillRepeatedly(Return(0));
+    EXPECT_CALL(DeviceMock, filePresentCheck(_)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, isMediaClientDevice()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isDelayFWDownloadActive(_, _, _)).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isUpgradeInProgress()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, isMmgbleNotifyEnabled()).WillRepeatedly(Return(false));
+    EXPECT_CALL(mockexternal, updateFWDownloadStatus(_, _)).WillRepeatedly(Return(0));
+    EXPECT_CALL(mockexternal, logMilestone(_)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, eventManager(_, _)).Times(testing::AnyNumber());
+    EXPECT_CALL(mockexternal, checkPDRIUpgrade(_)).WillRepeatedly(Return(true));
+    EXPECT_CALL(DeviceMock, getDevicePropertyData(_, _, _)).WillRepeatedly(Return(-1));
+    EXPECT_CALL(mockexternal, CheckIProuteConnectivity(_)).WillRepeatedly(Return(false));
+
+    int result = rdkv_upgrade_request(&context, &test_curl, &http_code);
+    EXPECT_EQ(result, RDKV_UPGRADE_ERROR_STATE_RED);
+
+    global_mockdownloadfileops_ptr = NULL;
+    global_mockexternal_ptr = NULL;
+    g_DeviceUtilsMock = &Deviceglobal;
+}
+
+GTEST_API_ int main(int argc, char *argv[]){
+    char testresults_fullfilepath[GTEST_REPORT_FILEPATH_SIZE];
+    char buffer[GTEST_REPORT_FILEPATH_SIZE];
+
+    memset( testresults_fullfilepath, 0, GTEST_REPORT_FILEPATH_SIZE );
+    memset( buffer, 0, GTEST_REPORT_FILEPATH_SIZE );
+
+    snprintf( testresults_fullfilepath, GTEST_REPORT_FILEPATH_SIZE, "json:%s%s" , GTEST_DEFAULT_RESULT_FILEPATH , GTEST_DEFAULT_RESULT_FILENAME);
+    ::testing::GTEST_FLAG(output) = testresults_fullfilepath;
+    ::testing::InitGoogleTest(&argc, argv);
+    //testing::Mock::AllowLeak(mock);
+    cout << "Starting GTEST MAIN ===========================>" << endl;
+    return RUN_ALL_TESTS();
+}
diff --git a/unittest/device_status_helper_gtest.cpp b/unittest/device_status_helper_gtest.cpp
index 8f890085..61c5e3c2 100644
--- a/unittest/device_status_helper_gtest.cpp
+++ b/unittest/device_status_helper_gtest.cpp
@@ -383,14 +383,23 @@ TEST(TestupdateOPTOUTFile, TestName_Fail)
 }
 TEST_F(CreateJsonTestFixture, TestName_checkCodebigAccess_Success)
 {
+    EXPECT_CALL(*g_DeviceStatusMock, isDirectCDNEnabled()).Times(1).WillOnce(Return(false));
     EXPECT_CALL(*g_DeviceStatusMock, v_secure_system(_)).Times(1).WillOnce(Return(0));
     EXPECT_EQ(checkCodebigAccess(), true);
 }
 TEST_F(CreateJsonTestFixture, TestName_checkCodebigAccess_Fail)
 {
+    EXPECT_CALL(*g_DeviceStatusMock, isDirectCDNEnabled()).Times(1).WillOnce(Return(false));
     EXPECT_CALL(*g_DeviceStatusMock, v_secure_system(_)).Times(1).WillOnce(Return(1));
     EXPECT_EQ(checkCodebigAccess(), false);
 }
+TEST_F(CreateJsonTestFixture, TestName_checkCodebigAccess_DirectCDN_Bypass)
+{
+    EXPECT_CALL(*g_DeviceStatusMock, isDirectCDNEnabled()).Times(1).WillOnce(Return(true));
+    /* v_secure_system must NOT be called when Direct CDN is enabled */
+    EXPECT_CALL(*g_DeviceStatusMock, v_secure_system(_)).Times(0);
+    EXPECT_EQ(checkCodebigAccess(), false);
+}
 TEST_F(CreateJsonTestFixture, TestName_isStateRedSupported_Success)
 {
     EXPECT_CALL(*g_DeviceStatusMock, filePresentCheck (_)).Times(1).WillOnce(Return(0));
diff --git a/unittest/deviceutils/device_api_gtest.cpp b/unittest/deviceutils/device_api_gtest.cpp
index 05997aec..726ac72b 100644
--- a/unittest/deviceutils/device_api_gtest.cpp
+++ b/unittest/deviceutils/device_api_gtest.cpp
@@ -951,3 +951,150 @@ TEST_F(DeviceApiTestFixture,TestName_GetRemoteVers_Fail)
     char pRemoteInfo[256] = {0};
     EXPECT_EQ(GetRemoteVers(pRemoteInfo, sizeof(pRemoteInfo)), 0);
 }
+
+/* Direct CDN: GetServURL must return /xconf/firmware/stb/ when isDirectCDNEnabled() is true (bootstrap path) */
+TEST_F(DeviceApiTestFixture, TestName_GetServURL_DirectCDN_Bootstrap)
+{
+    char output[128];
+    int ret;
+    char servUrl[] = "https://xconf.example.com";
+
+    EXPECT_CALL(*g_DeviceUtilsMock, isInStateRed()).Times(1).WillOnce(Return(false));
+    EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(false));
+    EXPECT_CALL(*g_DeviceUtilsMock, isDirectCDNEnabled()).WillRepeatedly(Return(true));
+
+    ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
+    ret = system("rm -f /tmp/swupdate.conf");
+
+    /* Mock the bootstrap TR181 URL read */
+    EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _))
+        .Times(1)
+        .WillOnce(Invoke([&servUrl](char* type, const char* key, char *out_value, size_t datasize) {
+            strncpy(out_value, servUrl, datasize - 1);
+            out_value[datasize - 1] = '\0';
+            return (int)strlen(out_value);
+        }));
+
+    ret = GetServURL(output, sizeof(output));
+    EXPECT_GT(ret, 0);
+    EXPECT_NE(strstr(output, "/xconf/firmware/stb/"), nullptr);
+    EXPECT_EQ(strstr(output, "/xconf/swu/stb"), nullptr);
+
+    ret = system("rm -f /tmp/device_gtest.prop");
+    printf("DirectCDN Bootstrap URL = %s\n", output);
+}
+
+/* Direct CDN disabled: GetServURL must still return /xconf/swu/stb (bootstrap path, legacy) */
+TEST_F(DeviceApiTestFixture, TestName_GetServURL_DirectCDN_Disabled_Bootstrap)
+{
+    char output[128];
+    int ret;
+    char servUrl[] = "https://xconf.example.com";
+
+    EXPECT_CALL(*g_DeviceUtilsMock, isInStateRed()).Times(1).WillOnce(Return(false));
+    EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(false));
+    EXPECT_CALL(*g_DeviceUtilsMock, isDirectCDNEnabled()).WillRepeatedly(Return(false));
+
+    ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
+    ret = system("rm -f /tmp/swupdate.conf");
+
+    EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _))
+        .Times(1)
+        .WillOnce(Invoke([&servUrl](char* type, const char* key, char *out_value, size_t datasize) {
+            strncpy(out_value, servUrl, datasize - 1);
+            out_value[datasize - 1] = '\0';
+            return (int)strlen(out_value);
+        }));
+
+    ret = GetServURL(output, sizeof(output));
+    EXPECT_GT(ret, 0);
+    EXPECT_NE(strstr(output, "/xconf/swu/stb"), nullptr);
+    EXPECT_EQ(strstr(output, "/xconf/firmware/stb/"), nullptr);
+
+    ret = system("rm -f /tmp/device_gtest.prop");
+    printf("Legacy Bootstrap URL = %s\n", output);
+}
+
+/* Direct CDN: GetServURL must return https://<host>/xconf/firmware/stb/ when isDirectCDNEnabled() is true
+   and bootstrap URL is empty (xconf-host path) */
+TEST_F(DeviceApiTestFixture, TestName_GetServURL_DirectCDN_XconfHost)
+{
+    char output[128];
+    int ret;
+    char xconfHost[] = "xconf-prod.example.com";
+
+    EXPECT_CALL(*g_DeviceUtilsMock, isInStateRed()).Times(1).WillOnce(Return(false));
+    EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(false));
+    EXPECT_CALL(*g_DeviceUtilsMock, isDirectCDNEnabled()).WillRepeatedly(Return(true));
+
+    ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
+    ret = system("rm -f /tmp/swupdate.conf");
+
+    /* First read_RFCProperty call: eBootstrap → failure (buffer cleared), Second: eXconf → hostname */
+    EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _))
+        .Times(2)
+        .WillOnce(Invoke([](char* type, const char* key, char *out_value, size_t datasize) {
+            out_value[0] = '\0';  /* Ensure buffer is empty on bootstrap failure */
+            return -1;
+        }))
+        .WillOnce(Invoke([&xconfHost](char* type, const char* key, char *out_value, size_t datasize) {
+            strncpy(out_value, xconfHost, datasize - 1);
+            out_value[datasize - 1] = '\0';
+            return (int)strlen(out_value);
+        }));
+
+    ret = GetServURL(output, sizeof(output));
+    EXPECT_GT(ret, 0);
+    EXPECT_NE(strstr(output, "/xconf/firmware/stb/"), nullptr);
+    EXPECT_EQ(strstr(output, "/xconf/swu/stb"), nullptr);
+    EXPECT_NE(strstr(output, "https://"), nullptr);
+
+    ret = system("rm -f /tmp/device_gtest.prop");
+    printf("DirectCDN XconfHost URL = %s\n", output);
+}
+
+/* Direct CDN: GetServURL must return <host>/xconf/firmware/stb/ when isDirectCDNEnabled() is true
+   and device is in State Red (recovery path) */
+TEST_F(DeviceApiTestFixture, TestName_GetServURL_DirectCDN_StateRed_Recovery)
+{
+    char output[128];
+    int ret;
+    char recoveryUrl[] = "https://recovery.example.com";
+
+    EXPECT_CALL(*g_DeviceUtilsMock, isInStateRed()).Times(1).WillOnce(Return(true));
+    EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(false));
+    EXPECT_CALL(*g_DeviceUtilsMock, isDirectCDNEnabled()).WillRepeatedly(Return(true));
+    EXPECT_CALL(*g_DeviceUtilsMock, getDeviceTypeRFC(_, _))
+        .Times(1)
+        .WillOnce(Invoke([](char* deviceType, size_t size) {
+            strncpy(deviceType, "test", size - 1);
+            deviceType[size - 1] = '\0';
+        }));
+    EXPECT_CALL(*g_DeviceUtilsMock, getDevicePropertyData(StrEq("LABSIGNED_ENABLED"), _, _))
+        .Times(1)
+        .WillOnce(Invoke([](const char* /*model*/, char* data, int size) {
+            strncpy(data, "true", size - 1);
+            data[size - 1] = '\0';
+            return 0;
+        }));
+
+    ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
+    ret = system("rm -f /tmp/stateredrecovry.conf");
+
+    /* read_RFCProperty call: eRecovery → recovery host URL */
+    EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _))
+        .Times(1)
+        .WillOnce(Invoke([&recoveryUrl](char* type, const char* key, char *out_value, size_t datasize) {
+            strncpy(out_value, recoveryUrl, datasize - 1);
+            out_value[datasize - 1] = '\0';
+            return (int)strlen(out_value);
+        }));
+
+    ret = GetServURL(output, sizeof(output));
+    EXPECT_GT(ret, 0);
+    EXPECT_NE(strstr(output, "/xconf/firmware/stb/"), nullptr);
+    EXPECT_EQ(strstr(output, "/xconf/swu/stb"), nullptr);
+
+    ret = system("rm -f /tmp/device_gtest.prop");
+    printf("DirectCDN StateRed Recovery URL = %s\n", output);
+}
diff --git a/unittest/fwdl_interface_gtest.cpp b/unittest/fwdl_interface_gtest.cpp
index 682a11dd..e3a614e8 100644
--- a/unittest/fwdl_interface_gtest.cpp
+++ b/unittest/fwdl_interface_gtest.cpp
@@ -116,14 +116,14 @@ TEST_F(InterfaceTestFixture, TestName_getRFCSettingsSuccess)
 {
     Rfc_t rfcvalue;
     memset(&rfcvalue, '\0', sizeof(rfcvalue));
-    EXPECT_CALL(*g_InterfaceMock, getRFCParameter(_, _, _)).Times(3).WillRepeatedly(Return(1));
+    EXPECT_CALL(*g_InterfaceMock, getRFCParameter(_, _, _)).Times(4).WillRepeatedly(Return(1));
     EXPECT_EQ(getRFCSettings(&rfcvalue), 0);
 }
 TEST_F(InterfaceTestFixture, TestName_getRFCSettingsFail)
 {
     Rfc_t rfcvalue;
     memset(&rfcvalue, '\0', sizeof(rfcvalue));
-    EXPECT_CALL(*g_InterfaceMock, getRFCParameter(_, _, _)).Times(3).WillRepeatedly(Return(-1));
+    EXPECT_CALL(*g_InterfaceMock, getRFCParameter(_, _, _)).Times(4).WillRepeatedly(Return(-1));
     EXPECT_EQ(getRFCSettings(&rfcvalue), 0);
 }
 TEST_F(InterfaceTestFixture, TestName_write_RFCPropertySuccess2)
@@ -392,6 +392,31 @@ TEST_F(InterfaceTestFixture, TestName_invokeRbusDCMReport)
     rbusError_t status = invokeRbusDCMReport();
     EXPECT_EQ(status, RBUS_ERROR_SUCCESS);
 }
+TEST_F(InterfaceTestFixture, TestName_isDirectCDNEnabledTrue)
+{
+    EXPECT_CALL(*g_InterfaceMock, getRFCParameter(_, _, _))
+        .Times(1)
+        .WillOnce(Invoke([](char* /*type*/, const char* /*key*/, RFC_ParamData_t *param) {
+            snprintf(param->value, sizeof(param->value), "%s", "true");
+            return WDMP_SUCCESS;
+        }));
+    EXPECT_EQ(isDirectCDNEnabled(), true);
+}
+TEST_F(InterfaceTestFixture, TestName_isDirectCDNEnabledFalse)
+{
+    EXPECT_CALL(*g_InterfaceMock, getRFCParameter(_, _, _))
+        .Times(1)
+        .WillOnce(Invoke([](char* /*type*/, const char* /*key*/, RFC_ParamData_t *param) {
+            snprintf(param->value, sizeof(param->value), "%s", "false");
+            return WDMP_SUCCESS;
+        }));
+    EXPECT_EQ(isDirectCDNEnabled(), false);
+}
+TEST_F(InterfaceTestFixture, TestName_isDirectCDNEnabledAbsent)
+{
+    EXPECT_CALL(*g_InterfaceMock, getRFCParameter(_, _, _)).Times(1).WillOnce(Return(0));
+    EXPECT_EQ(isDirectCDNEnabled(), false);
+}
 
 GTEST_API_ int main(int argc, char *argv[]){
     char testresults_fullfilepath[GTEST_REPORT_FILEPATH_SIZE];
diff --git a/unittest/mocks/dbus_handlers_gmock.cpp b/unittest/mocks/dbus_handlers_gmock.cpp
index c39968d4..39bca7dc 100644
--- a/unittest/mocks/dbus_handlers_gmock.cpp
+++ b/unittest/mocks/dbus_handlers_gmock.cpp
@@ -234,6 +234,16 @@ int filePresentCheck(const char *filepath) {
 // RFC Interface Function Mocks
 // ============================================================================
 
+/**
+ * @brief Mock implementation of isDirectCDNEnabled
+ */
+bool isDirectCDNEnabled(void) {
+    if (mock_rfc_interface) {
+        return mock_rfc_interface->isDirectCDNEnabled();
+    }
+    return false;
+}
+
 /**
  * @brief Mock implementation of getRFCSettings
  */
diff --git a/unittest/mocks/dbus_handlers_gmock.h b/unittest/mocks/dbus_handlers_gmock.h
index adaa2e0e..20f9fd23 100644
--- a/unittest/mocks/dbus_handlers_gmock.h
+++ b/unittest/mocks/dbus_handlers_gmock.h
@@ -98,6 +98,7 @@ class MockRfcInterface {
     virtual ~MockRfcInterface() {}
     
     MOCK_METHOD(int, getRFCSettings, (Rfc_t *pRfc));
+    MOCK_METHOD(bool, isDirectCDNEnabled, ());
 };
 
 /**
diff --git a/unittest/mocks/device_status_helper_mock.cpp b/unittest/mocks/device_status_helper_mock.cpp
index a6254bb4..135f46a6 100644
--- a/unittest/mocks/device_status_helper_mock.cpp
+++ b/unittest/mocks/device_status_helper_mock.cpp
@@ -52,15 +52,15 @@ extern "C" size_t GetEstbMac(char *pEstbMac, size_t szBufSize)
     //snprintf(pEstbMac, szBufSize, "%s", "aa:bb:cc:dd:ee");
     return g_DeviceStatusMock->GetEstbMac(pEstbMac, szBufSize);
 }
-extern "C" int write_RFCProperty(const char *key, const char *value, RFCVALDATATYPE datatype)
+extern "C" int write_RFCProperty(char* type, const char *key, const char *value, RFCVALDATATYPE datatype)
 {
     if (!g_DeviceStatusMock)
     {
-	cout << "GetEstbMac g_DeviceStatusMock object is NULL" << endl;
+	cout << "write_RFCProperty g_DeviceStatusMock object is NULL" << endl;
         return 0;
     }
     printf("Inside Mock Function write_RFCProperty\n");
-    return g_DeviceStatusMock->write_RFCProperty(key, value, datatype);
+    return g_DeviceStatusMock->write_RFCProperty(type, key, value, datatype);
 }
 
 extern "C" size_t GetFirmwareVersion( char *pFWVersion, size_t szBufSize )
@@ -378,6 +378,17 @@ extern "C" void t2ValNotify(char *marker, char *val)
     return g_DeviceStatusMock->t2ValNotify(marker, val);
 }
 
+extern "C" bool isDirectCDNEnabled(void)
+{
+    if (!g_DeviceStatusMock)
+    {
+        cout << "isDirectCDNEnabled g_DeviceStatusMock object is NULL" << endl;
+        return false;
+    }
+    printf("Inside Mock Function isDirectCDNEnabled\n");
+    return g_DeviceStatusMock->isDirectCDNEnabled();
+}
+
 // Mock for swLog (logging function from common_utilities)
 extern "C" int swLog(int level, const char* format, ...)
 {
diff --git a/unittest/mocks/device_status_helper_mock.h b/unittest/mocks/device_status_helper_mock.h
index cfc0ac53..236c6395 100644
--- a/unittest/mocks/device_status_helper_mock.h
+++ b/unittest/mocks/device_status_helper_mock.h
@@ -22,7 +22,13 @@
 #include <gmock/gmock.h>
 
 #include "rdkv_cdl_log_wrapper.h"
+#ifdef __cplusplus
+extern "C" {
+#endif
 #include "rfcinterface.h"
+#ifdef __cplusplus
+}
+#endif
 //#include "rdk_fwdl_utils.h"  // Add this for BUILDTYPE from system library
 #define RDK_API_SUCCESS 0
 //int getDevicePropertyData(const char *model, char *data, int size);
@@ -52,7 +58,7 @@ class DeviceStatusInterface
 	virtual int filePresentCheck(const char *filename) = 0;
 	virtual bool isConnectedToInternet () = 0;
 	//virtual int updateFWDownloadStatus(struct FWDownloadStatus *fwdls, const char *disableStatsUpdate) = 0;
-	virtual int write_RFCProperty(const char *key, const char *value, RFCVALDATATYPE datatype) = 0;
+	virtual int write_RFCProperty(char* type, const char *key, const char *value, RFCVALDATATYPE datatype) = 0;
 	virtual void uninitialize(int data) = 0;
 	virtual void eventManager(const char *cur_event_name, const char *event_status) = 0;
 	virtual size_t GetPDRIFileNameUsingMFR( char *pPDRIFilename, size_t szBufSize ) = 0;
@@ -61,6 +67,7 @@ class DeviceStatusInterface
 	virtual void t2CountNotify(char *marker) = 0;
 	virtual void t2ValNotify(char *marker, char *val) = 0;
 	virtual int v_secure_system(const char *str ) = 0;
+	virtual bool isDirectCDNEnabled() = 0;
 };
 
 class DeviceStatusMock: public DeviceStatusInterface
@@ -89,8 +96,9 @@ class DeviceStatusMock: public DeviceStatusInterface
     	MOCK_METHOD(int, filePresentCheck, (const char *filename ), ());
     	MOCK_METHOD(bool, isConnectedToInternet, (), ());
     	MOCK_METHOD(int, v_secure_system, (const char *str ), ());
+    	MOCK_METHOD(bool, isDirectCDNEnabled, (), ());
     	//MOCK_METHOD(int, updateFWDownloadStatus, (struct FWDownloadStatus *fwdls, const char *disableStatsUpdate), ());
-    	MOCK_METHOD(int, write_RFCProperty, (const char *key, const char *value, RFCVALDATATYPE datatype), ());
+    	MOCK_METHOD(int, write_RFCProperty, (char* type, const char *key, const char *value, RFCVALDATATYPE datatype), ());
     	MOCK_METHOD(void, uninitialize, (int data), ());
     	MOCK_METHOD(void, eventManager, (const char *cur_event_name, const char *event_status), ());
     	MOCK_METHOD(size_t, GetPDRIFileName, ( char *pPDRIFilename, size_t szBufSize ), ());
diff --git a/unittest/mocks/deviceutils_mock.cpp b/unittest/mocks/deviceutils_mock.cpp
index fe65e68d..ebdbf4e9 100644
--- a/unittest/mocks/deviceutils_mock.cpp
+++ b/unittest/mocks/deviceutils_mock.cpp
@@ -220,6 +220,25 @@ extern "C" bool isDebugServicesEnabled(void) {
         return g_DeviceUtilsMock->isDebugServicesEnabled();
     }
 
+#ifndef HANDLER_TEST_ONLY
+extern "C" bool isDirectCDNEnabled(void) {
+        if (!g_DeviceUtilsMock) {
+            cout << "isDirectCDNEnabled g_DeviceUtilsMock object is NULL" << endl;
+            return false;
+        }
+        return g_DeviceUtilsMock->isDirectCDNEnabled();
+    }
+#endif
+
+#ifdef HANDLER_TEST_ONLY
+/* Stub for test binaries that don't link real deviceutils.c */
+extern "C" int getPeripheralProduct(char *buf, size_t szIn) {
+        if (buf == NULL || szIn == 0) return -1;
+        snprintf(buf, szIn, "%s", "remCtrl");
+        return 0;
+    }
+#endif
+
 extern "C" size_t GetHwMacAddress( char *iface, char *pMac, size_t szBufSize )
 {
     if (!g_DeviceUtilsMock)
diff --git a/unittest/mocks/deviceutils_mock.h b/unittest/mocks/deviceutils_mock.h
index a154b52b..f79d9b4d 100644
--- a/unittest/mocks/deviceutils_mock.h
+++ b/unittest/mocks/deviceutils_mock.h
@@ -56,6 +56,7 @@ class DeviceUtilsInterface
 	virtual int getFileSize(const char *filename) = 0;
 	virtual bool isInStateRed() = 0;
 	virtual bool isDebugServicesEnabled() = 0;
+	virtual bool isDirectCDNEnabled() = 0;
         virtual size_t GetHwMacAddress( char *iface, char *pMac, size_t szBufSize ) = 0;
 	virtual size_t GetModelNum( char *pModelNum, size_t szBufSize ) = 0;
         virtual void t2CountNotify(char *marker) = 0;
@@ -80,6 +81,7 @@ class DeviceUtilsMock: public DeviceUtilsInterface
 	MOCK_METHOD(int, getFileSize, (const char *filename ), ());
 	MOCK_METHOD(bool, isInStateRed, (), ());
 	MOCK_METHOD(bool, isDebugServicesEnabled, (), ());
+	MOCK_METHOD(bool, isDirectCDNEnabled, (), ());
 	MOCK_METHOD(void, getDeviceTypeRFC, (char*, size_t), ());
 	MOCK_METHOD(size_t, GetHwMacAddress, (char *iface, char *pMac, size_t szBufSize), ());
 	MOCK_METHOD(size_t, GetModelNum, ( char *pModelNum, size_t szBufSize ), ());
diff --git a/unittest/mocks/rdkFwupdateMgr_mock.cpp b/unittest/mocks/rdkFwupdateMgr_mock.cpp
index e113baed..620e1f51 100755
--- a/unittest/mocks/rdkFwupdateMgr_mock.cpp
+++ b/unittest/mocks/rdkFwupdateMgr_mock.cpp
@@ -94,6 +94,14 @@ extern "C" int getRFCSettings(Rfc_t *rfc_list) {
     return 0;
 }
 
+extern "C" bool isDirectCDNEnabled(void) {
+    /* Default to false (legacy behavior) when mock is not set up */
+    if (!g_RdkFwupdateMgrMock) {
+        return false;
+    }
+    return g_RdkFwupdateMgrMock->isDirectCDNEnabled();
+}
+
 // =============================================================================
 // Device/Image information functions
 // =============================================================================
diff --git a/unittest/mocks/rdkFwupdateMgr_mock.h b/unittest/mocks/rdkFwupdateMgr_mock.h
index fd5224c9..4a3e4d65 100755
--- a/unittest/mocks/rdkFwupdateMgr_mock.h
+++ b/unittest/mocks/rdkFwupdateMgr_mock.h
@@ -47,6 +47,7 @@ class RdkFwupdateMgrInterface {
     
     // RFC settings mock
     virtual void getRFCSettings(Rfc_t *rfc_list) = 0;
+    virtual bool isDirectCDNEnabled() = 0;
     
     // Image details mocks
     virtual size_t currentImg(char *pCurImg, size_t szBufSize) = 0;
@@ -74,6 +75,7 @@ class RdkFwupdateMgrMock : public RdkFwupdateMgrInterface {
     MOCK_METHOD(int, allocDowndLoadDataMem, (DownloadData *pDwnLoc, int size), ());
     MOCK_METHOD(void, freeDownLoadMem, (DownloadData *pDwnLoc), ());
     MOCK_METHOD(void, getRFCSettings, (Rfc_t *rfc_list), ());
+    MOCK_METHOD(bool, isDirectCDNEnabled, (), ());
     MOCK_METHOD(size_t, currentImg, (char *pCurImg, size_t szBufSize), ());
     MOCK_METHOD(size_t, GetFirmwareVersion, (char *pFWVersion, size_t szBufSize), ());
     MOCK_METHOD(int, filePresentCheck, (const char *filename), ());
diff --git a/unittest/rdkFwupdateMgr_handlers_gtest.cpp b/unittest/rdkFwupdateMgr_handlers_gtest.cpp
index aedaa5fa..dacf723d 100755
--- a/unittest/rdkFwupdateMgr_handlers_gtest.cpp
+++ b/unittest/rdkFwupdateMgr_handlers_gtest.cpp
@@ -1827,3 +1827,107 @@ TEST_F(RdkFwupdateMgrHandlersTest, FlashWorker_NullContext_ReturnsImmediately) {
     /* Note: This validates the CRITICAL_VALIDATION check at thread entry */
     /* Real thread business logic will be tested via UpdateFirmware handler tests */
 }
+
+/* =========================================================================
+ * Task 5.6: Direct CDN daemon routing tests
+ * ========================================================================= */
+
+/**
+ * @test fetch_xconf_firmware_info sets direct_cdn=true when RFC enabled
+ * @brief Verifies the daemon XConf handler propagates Direct CDN flag to context
+ */
+TEST_F(FetchXconfFirmwareInfoTest, DirectCDN_Enabled_SetsContextFlag) {
+    const char* test_url = "http://xconf.test.example.com/xconf/firmware/stb/";
+    const char* test_json = "{\"estbMacAddress\":\"AA:BB:CC:DD:EE:FF\"}";
+    const char* xconf_response = MOCK_XCONF_RESPONSE_UPDATE_AVAILABLE;
+
+    /* isDirectCDNEnabled returns true */
+    EXPECT_CALL(*g_RdkFwupdateMgrMock, isDirectCDNEnabled())
+        .WillRepeatedly(Return(true));
+
+    EXPECT_CALL(*g_RdkFwupdateMgrMock, createJsonString(testing::_, JSON_STR_LEN))
+        .WillOnce(testing::Invoke([test_json](char* pJSONStr, size_t szBufSize) {
+            strncpy(pJSONStr, test_json, szBufSize - 1);
+            pJSONStr[szBufSize - 1] = '\0';
+            return strlen(test_json);
+        }));
+
+    EXPECT_CALL(*g_RdkFwupdateMgrMock, allocDowndLoadDataMem(testing::_, DEFAULT_DL_ALLOC))
+        .WillOnce(testing::Invoke([xconf_response](DownloadData* pDwnLoc, int size) {
+            pDwnLoc->pvOut = malloc(strlen(xconf_response) + 1);
+            strcpy((char*)pDwnLoc->pvOut, xconf_response);
+            pDwnLoc->datasize = strlen(xconf_response);
+            pDwnLoc->memsize = strlen(xconf_response) + 1;
+            return 0;
+        }));
+
+    EXPECT_CALL(*g_RdkFwupdateMgrMock, GetServURL(testing::_, URL_MAX_LEN))
+        .WillOnce(testing::Invoke([test_url](char* pServURL, size_t szBufSize) {
+            strncpy(pServURL, test_url, szBufSize - 1);
+            pServURL[szBufSize - 1] = '\0';
+            return strlen(test_url);
+        }));
+
+    /* KEY ASSERTION: Verify context->direct_cdn == true when passed to rdkv_upgrade_request */
+    EXPECT_CALL(*g_RdkFwupdateMgrMock, rdkv_upgrade_request(testing::_, testing::_, testing::_))
+        .WillOnce(testing::Invoke([](const RdkUpgradeContext_t* context, void** curl, int* pHttp_code) {
+            EXPECT_TRUE(context->direct_cdn)
+                << "Context direct_cdn must be true when RFC is enabled";
+            *pHttp_code = 200;
+            return 0;
+        }));
+
+    int result = fetch_xconf_firmware_info(&response, 0, &http_code);
+    EXPECT_EQ(result, 0);
+    EXPECT_EQ(http_code, 200);
+}
+
+/**
+ * @test fetch_xconf_firmware_info sets direct_cdn=false when RFC disabled
+ * @brief Verifies legacy behavior: direct_cdn flag is false when Direct CDN RFC disabled
+ */
+TEST_F(FetchXconfFirmwareInfoTest, DirectCDN_Disabled_ContextFlagIsFalse) {
+    const char* test_url = "http://xconf.test.example.com/xconf/swu/stb";
+    const char* test_json = "{\"estbMacAddress\":\"AA:BB:CC:DD:EE:FF\"}";
+    const char* xconf_response = MOCK_XCONF_RESPONSE_UPDATE_AVAILABLE;
+
+    /* isDirectCDNEnabled returns false (legacy) */
+    EXPECT_CALL(*g_RdkFwupdateMgrMock, isDirectCDNEnabled())
+        .WillRepeatedly(Return(false));
+
+    EXPECT_CALL(*g_RdkFwupdateMgrMock, createJsonString(testing::_, JSON_STR_LEN))
+        .WillOnce(testing::Invoke([test_json](char* pJSONStr, size_t szBufSize) {
+            strncpy(pJSONStr, test_json, szBufSize - 1);
+            pJSONStr[szBufSize - 1] = '\0';
+            return strlen(test_json);
+        }));
+
+    EXPECT_CALL(*g_RdkFwupdateMgrMock, allocDowndLoadDataMem(testing::_, DEFAULT_DL_ALLOC))
+        .WillOnce(testing::Invoke([xconf_response](DownloadData* pDwnLoc, int size) {
+            pDwnLoc->pvOut = malloc(strlen(xconf_response) + 1);
+            strcpy((char*)pDwnLoc->pvOut, xconf_response);
+            pDwnLoc->datasize = strlen(xconf_response);
+            pDwnLoc->memsize = strlen(xconf_response) + 1;
+            return 0;
+        }));
+
+    EXPECT_CALL(*g_RdkFwupdateMgrMock, GetServURL(testing::_, URL_MAX_LEN))
+        .WillOnce(testing::Invoke([test_url](char* pServURL, size_t szBufSize) {
+            strncpy(pServURL, test_url, szBufSize - 1);
+            pServURL[szBufSize - 1] = '\0';
+            return strlen(test_url);
+        }));
+
+    /* KEY ASSERTION: Verify context->direct_cdn == false when RFC is disabled */
+    EXPECT_CALL(*g_RdkFwupdateMgrMock, rdkv_upgrade_request(testing::_, testing::_, testing::_))
+        .WillOnce(testing::Invoke([](const RdkUpgradeContext_t* context, void** curl, int* pHttp_code) {
+            EXPECT_FALSE(context->direct_cdn)
+                << "Context direct_cdn must be false when RFC is disabled";
+            *pHttp_code = 200;
+            return 0;
+        }));
+
+    int result = fetch_xconf_firmware_info(&response, 0, &http_code);
+    EXPECT_EQ(result, 0);
+    EXPECT_EQ(http_code, 200);
+}

From 43bba6303d8e927a96a43afe675751550a01b97c Mon Sep 17 00:00:00 2001
From: mkadinti <101405874+mkadinti@users.noreply.github.com>
Date: Mon, 22 Jun 2026 11:38:42 +0530
Subject: [PATCH 02/13] RDKTV-40244:[EntOS] [8.3p15s2] [A4K] TV repeatedly
 triggers MAINTENANCE_REBOOT instead of entering the Deep Sleep state. (#244)

* RDKTV-40244:[EntOS] [8.3p15s2] [A4K] TV repeatedly triggers MAINTENANCE_REBOOT instead of entering the Deep Sleep state.

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* RDKTV-40244:[EntOS] [8.3p15s2] [A4K] TV repeatedly triggers MAINTENANCE_REBOOT instead of entering the Deep Sleep state.

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 src/iarmInterface/iarmInterface.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/iarmInterface/iarmInterface.c b/src/iarmInterface/iarmInterface.c
index 1f16f237..e20139ee 100644
--- a/src/iarmInterface/iarmInterface.c
+++ b/src/iarmInterface/iarmInterface.c
@@ -381,6 +381,12 @@ size_t GetPDRIFileNameUsingMFR(char *pPDRIFilename, size_t szBufSize)
         len = 0;
     }
 
+    /* Strip trailing newline/carriage-return if present (MFR may include them) */
+    len = strnlen(pPDRIFilename, szBufSize);
+    while (len > 0 && (pPDRIFilename[len - 1] == '\n' || pPDRIFilename[len - 1] == '\r')) {
+        pPDRIFilename[--len] = '\0';
+    }
+
     return len;
 }
 #else
@@ -404,8 +410,15 @@ size_t GetPDRIFileNameUsingMFR(char *pPDRIFilename, size_t szBufSize) {
         return 0;
     }
 
-    /* Safe copy */
-    strcpy(pPDRIFilename, pdriFileName);
+    /* Bounded copy with explicit null termination */
+    strncpy(pPDRIFilename, pdriFileName, szBufSize - 1);
+    pPDRIFilename[szBufSize - 1] = '\0';
+
+    /* Strip trailing newline/carriage-return if present */
+    len = strnlen(pPDRIFilename, szBufSize);
+    while (len > 0 && (pPDRIFilename[len - 1] == '\n' || pPDRIFilename[len - 1] == '\r')) {
+        pPDRIFilename[--len] = '\0';
+    }
 
     return len;  /* length excluding '\0' */
 }

From c2fba0ec6bb522f2ee9b795c911a47ae5185e103 Mon Sep 17 00:00:00 2001
From: Saranya2421 <saranya.suvi@gmail.com>
Date: Wed, 24 Jun 2026 10:30:51 +0530
Subject: [PATCH 03/13] RDKEMW-19246: Enable development builds to download the
 rdm package from rdm-versioned-packages.conf (#256)

---
 src/json_process.c                  |  32 +++++++
 unittest/basic_rdkv_main_gtest.cpp  | 132 +++++++++++++++++++++++++++-
 unittest/mocks/deviceutils_mock.cpp |   8 +-
 3 files changed, 170 insertions(+), 2 deletions(-)

diff --git a/src/json_process.c b/src/json_process.c
index cbd3855f..401830dd 100644
--- a/src/json_process.c
+++ b/src/json_process.c
@@ -348,6 +348,8 @@ int processJsonResponse(XCONFRES *response, const char *myfwversion, const char
     char current_img[64];
     FILE *fp = NULL;
     int ret = -1;
+    BUILDTYPE eBuildType;
+	char buf[64];
 
     last_dwnl_img[0] = 0;
     current_img[0] = 0;
@@ -414,6 +416,36 @@ int processJsonResponse(XCONFRES *response, const char *myfwversion, const char
                 }
             }
 
+            if (GetBuildType(buf, sizeof(buf), &eBuildType) > 0 &&
+                           (eBuildType != ePROD) && (eBuildType != eUNKNOWN)) {
+                FILE *bundleFp = fopen("/opt/rdm-versioned-packages.conf", "r");
+                if (bundleFp != NULL) {
+                    char tempbuffer[1024] = {0};
+                    if (fgets(tempbuffer, sizeof(tempbuffer), bundleFp) != NULL) {
+                        size_t len = strlen(tempbuffer);
+                        
+                        // Detect truncation: if buffer is full and last char is not \n, it was truncated
+                        if (len == sizeof(tempbuffer) - 1 && tempbuffer[len - 1] != '\n') {
+                            SWLOG_ERROR("dlBundle override rejected: line truncated (exceeds %zu bytes)\n", sizeof(tempbuffer) - 1);
+                        } else {
+                            // Trim trailing \r\n
+                            while (len > 0 && (tempbuffer[len - 1] == '\n' || tempbuffer[len - 1] == '\r')) {
+                                tempbuffer[--len] = '\0';
+                            }
+                            
+                            if (len > 0) {
+                                strncpy(dlBundle, tempbuffer, sizeof(dlBundle) - 1);
+                                dlBundle[sizeof(dlBundle) - 1] = '\0';
+                                SWLOG_INFO("Non-prod build: overriding dlBundle with /opt/rdm-versioned-packages.conf: %s\n", dlBundle);
+                            } else {
+                                SWLOG_ERROR("dlBundle override rejected: empty after trimming\n");
+                            }
+                        }
+                    }
+                    fclose(bundleFp);
+                }
+            }
+
 	    if ((access("/usr/bin/rdm", F_OK) == 0) && (strlen(dlBundle) > 0)) {
     	        // file exists
 		SWLOG_INFO("RDM binary is present\n");
diff --git a/unittest/basic_rdkv_main_gtest.cpp b/unittest/basic_rdkv_main_gtest.cpp
index a6f2f260..254d14ad 100755
--- a/unittest/basic_rdkv_main_gtest.cpp
+++ b/unittest/basic_rdkv_main_gtest.cpp
@@ -18,9 +18,10 @@
 
 #include <gtest/gtest.h>
 #include <gmock/gmock.h>
-#include <gtest/gtest.h> 
 #include <iostream>
 #include <unistd.h>
+#include <string>
+#include <sys/stat.h>
 
 #include "rdkv_cdl_log_wrapper.h"
 extern "C" {
@@ -96,6 +97,48 @@ extern "C" {
     int chunkDownload(FileDwnl_t *pfile_dwnl, MtlsAuth_t *sec, unsigned int speed_limit, int *httpcode);
 }
 
+static const char* kBuildTypeFile = "/tmp/device_gtest.prop";
+static const char* kRdmOverrideConfig = "/opt/rdm-versioned-packages.conf";
+static const char* kRdmBinaryPath = "/usr/bin/rdm";
+
+static bool WriteTextFile(const char* path, const std::string& content)
+{
+    FILE* fp = fopen(path, "w");
+    if (fp == NULL) {
+        return false;
+    }
+    const size_t written = fwrite(content.c_str(), 1, content.size(), fp);
+    fclose(fp);
+    return written == content.size();
+}
+
+static bool EnsureRdmBinaryForTest()
+{
+    if (access(kRdmBinaryPath, F_OK) == 0) {
+        return true;
+    }
+
+    FILE* fp = fopen(kRdmBinaryPath, "w");
+    if (fp == NULL) {
+        return false;
+    }
+    fputs("#!/bin/sh\nexit 0\n", fp);
+    fclose(fp);
+    chmod(kRdmBinaryPath, 0755);
+    return (access(kRdmBinaryPath, F_OK) == 0);
+}
+
+static void PrepareBundleResponse(XCONFRES* response)
+{
+    memset(response, 0, sizeof(*response));
+    snprintf(response->cloudFWFile, sizeof(response->cloudFWFile), "%s", "HS_bundle_test-signed.bin");
+    snprintf(response->cloudFWLocation, sizeof(response->cloudFWLocation), "%s", "https://cdlserver.tv/Images");
+    snprintf(response->cloudFWVersion, sizeof(response->cloudFWVersion), "%s", "HS_bundle_test");
+    snprintf(response->cloudProto, sizeof(response->cloudProto), "%s", "http");
+    snprintf(response->dlCertBundle, sizeof(response->dlCertBundle), "%s", "xconf-cert");
+    snprintf(response->dlAppBundle, sizeof(response->dlAppBundle), "%s", "xconf-app");
+}
+
 TEST(getContentLengthTest,TestSuccess){
     int ret = 0;
     ret = system("echo \"Content-Length: 1234\" > /tmp/contentlength.txt");
@@ -1430,6 +1473,93 @@ TEST(MainHelperFunctionTest,ProcessResTestMaintFalse){
 TEST(MainHelperFunctionTest,ProcessResTestNull){
     EXPECT_EQ(processJsonResponse(NULL, NULL,NULL, NULL), -1);
 }
+TEST(MainHelperFunctionTest,ProcessResTest_NonProdBuild_UsesOverrideBundleConfig)
+{
+    if (!EnsureRdmBinaryForTest()) {
+        GTEST_SKIP() << "Cannot create/access /usr/bin/rdm in this environment";
+    }
+
+    ASSERT_TRUE(WriteTextFile(kBuildTypeFile, "BUILD_TYPE=vbn\n"));
+
+    /* Make sure the override directory/path is usable in CI */
+    FILE* verifyDir = fopen(kRdmOverrideConfig, "w");
+    if (verifyDir == NULL) {
+        unlink(kBuildTypeFile);
+        GTEST_SKIP() << "Cannot create /opt/rdm-versioned-packages.conf in this environment";
+    }
+    fclose(verifyDir);
+
+    ASSERT_TRUE(WriteTextFile(kRdmOverrideConfig, "dlCertBundle=cfg-cert|dlAppBundle=cfg-app\n"));
+
+    FILE* fp = fopen(kRdmOverrideConfig, "r");
+    if (fp == NULL) {
+        unlink(kBuildTypeFile);
+        unlink(kRdmOverrideConfig);
+        GTEST_SKIP() << "Cannot read /opt/rdm-versioned-packages.conf in this environment";
+    }
+    fclose(fp);
+
+    XCONFRES response;
+    PrepareBundleResponse(&response);
+
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    std::string capturedCmd;
+    EXPECT_CALL(DeviceMock, v_secure_system(_, _, _))
+        .WillOnce(testing::Invoke([&capturedCmd](const char* mode, const char* cmd, const char* opt) -> FILE* {
+            (void)mode;
+            (void)opt;
+            capturedCmd = (cmd != NULL) ? cmd : "";
+            return (FILE*)1;
+        }));
+
+    processJsonResponse(&response, "old_fw.bin", "HS", "false");
+
+    EXPECT_EQ(capturedCmd.find("dlCertBundle=cfg-cert|dlAppBundle=cfg-app"), std::string::npos);
+
+    g_DeviceUtilsMock = nullptr;
+    unlink(kBuildTypeFile);
+    unlink(kRdmOverrideConfig);
+}
+TEST(MainHelperFunctionTest,ProcessResTest_ProdBuild_DoesNotUseOverrideBundleConfig)
+{
+    if (!EnsureRdmBinaryForTest()) {
+        GTEST_SKIP() << "Cannot create/access /usr/bin/rdm in this environment";
+    }
+
+    FILE* verifyDir = fopen(kRdmOverrideConfig, "w");
+    if (verifyDir == NULL) {
+         GTEST_SKIP() << "Cannot create /opt/rdm-versioned-packages.conf in this environment";
+    }
+    fclose(verifyDir);
+
+    ASSERT_TRUE(WriteTextFile(kRdmOverrideConfig, "dlCertBundle=cfg-cert|dlAppBundle=cfg-app\n"));
+
+    ASSERT_TRUE(WriteTextFile(kBuildTypeFile, "BUILD_TYPE=prod\n"));
+
+    XCONFRES response;
+    PrepareBundleResponse(&response);
+
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+    std::string capturedCmd;
+    EXPECT_CALL(DeviceMock, v_secure_system(_, _, _))
+        .WillOnce(testing::Invoke([&capturedCmd](const char* mode, const char* cmd, const char* opt) -> FILE* {
+            (void)mode;
+            (void)opt;
+            capturedCmd = (cmd != NULL) ? cmd : "";
+            return (FILE*)1;
+        }));
+
+    processJsonResponse(&response, "old_fw.bin", "HS", "false");
+
+    EXPECT_NE(capturedCmd.find("dlCertBundle=xconf-cert|dlAppBundle=xconf-app"), std::string::npos);
+    EXPECT_EQ(capturedCmd.find("dlCertBundle=cfg-cert|dlAppBundle=cfg-app"), std::string::npos);
+    g_DeviceUtilsMock = nullptr;
+
+    unlink(kBuildTypeFile);
+    unlink(kRdmOverrideConfig);
+}
 TEST(MainHelperFunctionTest,initialValidationTestSuccess){
     MockExternal mockexternal;
     global_mockexternal_ptr = &mockexternal;
diff --git a/unittest/mocks/deviceutils_mock.cpp b/unittest/mocks/deviceutils_mock.cpp
index ebdbf4e9..aaa5ba95 100644
--- a/unittest/mocks/deviceutils_mock.cpp
+++ b/unittest/mocks/deviceutils_mock.cpp
@@ -18,6 +18,7 @@
 
 #include "deviceutils_mock.h"
 #include <iostream>
+#include <cstdarg>
 
 using namespace std;
 
@@ -31,8 +32,13 @@ extern "C" int v_secure_system(const char *mode, ...)
         cout << "v_secure_system g_DeviceUtilsMock object is NULL" << endl;
         return NULL;  // Return error code instead of NULL
     }
+    char formattedCmd[2048] = {0};
+    va_list args;
+    va_start(args, mode);
+    vsnprintf(formattedCmd, sizeof(formattedCmd), mode, args);
+    va_end(args);
     printf("Inside Mock Function v_secure_system\n");
-    return g_DeviceUtilsMock->v_secure_system(mode, NULL, NULL);
+    return (int)g_DeviceUtilsMock->v_secure_system(mode, formattedCmd, NULL);
 }
 //extern "C" FILE* v_secure_popen(const char *mode, const char *cmd, const char *opt )
 extern "C" FILE* v_secure_popen(const char *mode, ...)

From 3befd94adcc207c7850ff126dc6250c68fd68d01 Mon Sep 17 00:00:00 2001
From: ssahu777 <satyasundar_sahu@comcast.com>
Date: Thu, 25 Jun 2026 12:00:03 +0000
Subject: [PATCH 04/13] 1.8.0 release changelog updates

---
 CHANGELOG.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ac7afe6e..52ccbdb8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,11 +4,21 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [1.8.0](https://github.com/rdkcentral/rdkfwupdater/compare/1.7.0...1.8.0)
+
+- RDKEMW-19246: Enable development builds to download the rdm package from rdm-versioned-packages.conf [`#256`](https://github.com/rdkcentral/rdkfwupdater/pull/256)
+- RDKTV-40244:[EntOS] [8.3p15s2] [A4K] TV repeatedly triggers MAINTENANCE_REBOOT instead of entering the Deep Sleep state. [`#244`](https://github.com/rdkcentral/rdkfwupdater/pull/244)
+- RDKEMW-9150:[SECVULN] - HTTPS support for firmware download-OpenSpec Integration [`#249`](https://github.com/rdkcentral/rdkfwupdater/pull/249)
+- Merge tag '1.7.0' into develop [`3c495b9`](https://github.com/rdkcentral/rdkfwupdater/commit/3c495b9f7df529a944af92f5bae00c758c33e2f6)
+
 #### [1.7.0](https://github.com/rdkcentral/rdkfwupdater/compare/1.6.2...1.7.0)
 
+> 11 May 2026
+
 - RDKEMW-18236:[Xione UK] : Chunk download is failing during curl 28/56 timeout scenarios [`#246`](https://github.com/rdkcentral/rdkfwupdater/pull/246)
 - RDKEMW-16947 : Retrieve the PDRI version programmatically within rdkf… [`#241`](https://github.com/rdkcentral/rdkfwupdater/pull/241)
 - RDKEMW-17052: Daemon thread lifecycle management [`#236`](https://github.com/rdkcentral/rdkfwupdater/pull/236)
+- 1.7.0 release changelog updates [`646ab25`](https://github.com/rdkcentral/rdkfwupdater/commit/646ab251cb25ee1c3415dd5a43fe97334b789408)
 - Merge tag '1.6.2' into develop [`b8fed87`](https://github.com/rdkcentral/rdkfwupdater/commit/b8fed879e0472cc598f12d81f2f721fb489935c3)
 
 #### [1.6.2](https://github.com/rdkcentral/rdkfwupdater/compare/1.6.1...1.6.2)

From 98e09f3b81b42bae299abc479ddadc6451cadd4b Mon Sep 17 00:00:00 2001
From: Saranya2421 <saranya.suvi@gmail.com>
Date: Tue, 30 Jun 2026 17:54:13 +0530
Subject: [PATCH 05/13] RDKEMW-20453: Support file override to install
 versioned RDM packages for non-PROD builds (#258)

* RDKEMW-20453: Support file override to install versioned RDM packages for non-PROD

Co-authored-by: Saranya <saranya_elango@comcast.com>
---
 src/json_process.c                 | 72 ++++++++++++++++++++----------
 unittest/basic_rdkv_main_gtest.cpp | 54 ++++++++++++++++++++++
 2 files changed, 103 insertions(+), 23 deletions(-)

diff --git a/src/json_process.c b/src/json_process.c
index 401830dd..4e3fd32d 100644
--- a/src/json_process.c
+++ b/src/json_process.c
@@ -349,7 +349,8 @@ int processJsonResponse(XCONFRES *response, const char *myfwversion, const char
     FILE *fp = NULL;
     int ret = -1;
     BUILDTYPE eBuildType;
-	char buf[64];
+    char buf[64];
+    bool is_dev_build = false;
 
     last_dwnl_img[0] = 0;
     current_img[0] = 0;
@@ -385,7 +386,18 @@ int processJsonResponse(XCONFRES *response, const char *myfwversion, const char
             fprintf( fp, "%s\n", response->rdmCatalogueVersion );
             fclose( fp );
         }
-        if (response->dlCertBundle[0] != 0 || response->dlAppBundle[0] != '\0') {
+
+        if (GetBuildType(buf, sizeof(buf), &eBuildType) > 0 &&
+                    (eBuildType != ePROD) && (eBuildType != eUNKNOWN)) {
+            is_dev_build = true;
+        }
+
+	FILE *bundleFp = NULL;
+        if (is_dev_build) {
+            bundleFp = fopen("/opt/rdm-versioned-packages.conf", "r");
+        }
+
+        if (response->dlCertBundle[0] != '\0' || response->dlAppBundle[0] != '\0' || bundleFp != NULL) {
             SWLOG_INFO("Calling rdm Versioned_app download to process bundle update\n");
 	    
 	    char dlBundle[1024] = {0};
@@ -394,6 +406,10 @@ int processJsonResponse(XCONFRES *response, const char *myfwversion, const char
             if (response->dlCertBundle[0] != '\0') {
                 int retval = snprintf(dlBundle, available, "dlCertBundle=%s", response->dlCertBundle);
                 if (retval < 0 || retval >= available) {
+                    if (bundleFp != NULL) {
+                        fclose(bundleFp);
+                        bundleFp = NULL;
+                    }
                     SWLOG_ERROR("dlCertBundle string too long, truncation occurred\n");
                     return ret;
                 }
@@ -411,39 +427,49 @@ int processJsonResponse(XCONFRES *response, const char *myfwversion, const char
                 }
 
                 if (retval < 0 || retval >= available) {
+                    if (bundleFp != NULL) {
+                        fclose(bundleFp);
+                        bundleFp = NULL;
+                    }
                     SWLOG_ERROR("dlAppBundle string too long, truncation occurred\n");
                     return ret;
                 }
             }
 
-            if (GetBuildType(buf, sizeof(buf), &eBuildType) > 0 &&
-                           (eBuildType != ePROD) && (eBuildType != eUNKNOWN)) {
-                FILE *bundleFp = fopen("/opt/rdm-versioned-packages.conf", "r");
-                if (bundleFp != NULL) {
-                    char tempbuffer[1024] = {0};
-                    if (fgets(tempbuffer, sizeof(tempbuffer), bundleFp) != NULL) {
-                        size_t len = strlen(tempbuffer);
-                        
-                        // Detect truncation: if buffer is full and last char is not \n, it was truncated
-                        if (len == sizeof(tempbuffer) - 1 && tempbuffer[len - 1] != '\n') {
-                            SWLOG_ERROR("dlBundle override rejected: line truncated (exceeds %zu bytes)\n", sizeof(tempbuffer) - 1);
-                        } else {
-                            // Trim trailing \r\n
-                            while (len > 0 && (tempbuffer[len - 1] == '\n' || tempbuffer[len - 1] == '\r')) {
-                                tempbuffer[--len] = '\0';
-                            }
-                            
-                            if (len > 0) {
+            if (bundleFp != NULL) {
+                char tempbuffer[1024];
+                tempbuffer[0] = 0;
+                if (fgets(tempbuffer, sizeof(tempbuffer), bundleFp) != NULL) {
+                    size_t len = strlen(tempbuffer);
+
+                    // Detect truncation: full buffer with no trailing \n is truncated only if not EOF
+                    if (len == sizeof(tempbuffer) - 1 && tempbuffer[len - 1] != '\n' && !feof(bundleFp)) {
+                        SWLOG_ERROR("dlBundle override rejected: line truncated (exceeds %zu bytes)\n", sizeof(tempbuffer) - 1);
+                    } else {
+                        // Trim trailing \r\n
+                        while (len > 0 && (tempbuffer[len - 1] == '\n' || tempbuffer[len - 1] == '\r')) {
+                            tempbuffer[--len] = '\0';
+                        }
+
+                        if (len > 0) {
+                            if (strpbrk(tempbuffer, "\"\\`$") != NULL) {
+                                SWLOG_ERROR("dlBundle override rejected: contains unsafe character(s) [\"\\`$]\n");
+                            } else {
+                                if (response->dlCertBundle[0] == '\0' && response->dlAppBundle[0] == '\0') {
+                                    SWLOG_INFO("Non-prod build: XCONF bundle values empty, using /opt/rdm-versioned-packages.conf\n");
+                                } else {
+                                    SWLOG_INFO("Non-prod build: overriding XCONF bundle values using /opt/rdm-versioned-packages.conf\n");
+                                }
                                 strncpy(dlBundle, tempbuffer, sizeof(dlBundle) - 1);
                                 dlBundle[sizeof(dlBundle) - 1] = '\0';
                                 SWLOG_INFO("Non-prod build: overriding dlBundle with /opt/rdm-versioned-packages.conf: %s\n", dlBundle);
-                            } else {
-                                SWLOG_ERROR("dlBundle override rejected: empty after trimming\n");
                             }
+                        } else {
+                            SWLOG_ERROR("dlBundle override rejected: empty after trimming\n");
                         }
                     }
-                    fclose(bundleFp);
                 }
+                fclose(bundleFp);
             }
 
 	    if ((access("/usr/bin/rdm", F_OK) == 0) && (strlen(dlBundle) > 0)) {
diff --git a/unittest/basic_rdkv_main_gtest.cpp b/unittest/basic_rdkv_main_gtest.cpp
index 254d14ad..20b625aa 100755
--- a/unittest/basic_rdkv_main_gtest.cpp
+++ b/unittest/basic_rdkv_main_gtest.cpp
@@ -1521,6 +1521,60 @@ TEST(MainHelperFunctionTest,ProcessResTest_NonProdBuild_UsesOverrideBundleConfig
     unlink(kBuildTypeFile);
     unlink(kRdmOverrideConfig);
 }
+TEST(MainHelperFunctionTest,ProcessResTest_NonProdBuild_ConfigOnlyOverrideTriggersRdm)
+{
+    MockExternal mockexternal;
+    global_mockexternal_ptr = &mockexternal;
+    EXPECT_CALL(mockexternal, GetBuildType(_, _))
+	    .WillRepeatedly(testing::Invoke([](char* buf, size_t size) -> int {
+             snprintf(buf, size, "dev");
+	     return 3;
+    }));
+ 
+    if (!EnsureRdmBinaryForTest()) {
+        GTEST_SKIP() << "Cannot create/access /usr/bin/rdm in this environment";
+    }
+
+    ASSERT_TRUE(WriteTextFile(kBuildTypeFile, "BUILD_TYPE=dev\n"));
+
+    FILE* verifyDir = fopen(kRdmOverrideConfig, "w");
+    if (verifyDir == NULL) {
+        unlink(kBuildTypeFile);
+        GTEST_SKIP() << "Cannot create /opt/rdm-versioned-packages.conf in this environment";
+    }
+    fclose(verifyDir);
+
+    const std::string configBundle = "dlCertBundle=cfg-only-cert|dlAppBundle=cfg-only-app";
+    ASSERT_TRUE(WriteTextFile(kRdmOverrideConfig, configBundle + "\n"));
+
+    XCONFRES response;
+    PrepareBundleResponse(&response);
+    response.dlCertBundle[0] = '\0';
+    response.dlAppBundle[0] = '\0';
+
+    DeviceUtilsMock DeviceMock;
+    g_DeviceUtilsMock = &DeviceMock;
+
+    std::string capturedCmd;
+    EXPECT_CALL(DeviceMock, v_secure_system(_, _, _))
+        .Times(1)
+        .WillOnce(testing::Invoke([&capturedCmd](const char* mode, const char* cmd, const char* opt) -> FILE* {
+            (void)mode;
+            (void)opt;
+            capturedCmd = (cmd != NULL) ? cmd : "";
+            return (FILE*)1;
+        }));
+
+    processJsonResponse(&response, "old_fw.bin", "HS", "false");
+
+    EXPECT_NE(capturedCmd.find("rdm -v \""), std::string::npos);
+    EXPECT_NE(capturedCmd.find(configBundle), std::string::npos);
+
+    global_mockexternal_ptr = nullptr;
+    g_DeviceUtilsMock = nullptr;
+    unlink(kBuildTypeFile);
+    unlink(kRdmOverrideConfig);
+}
 TEST(MainHelperFunctionTest,ProcessResTest_ProdBuild_DoesNotUseOverrideBundleConfig)
 {
     if (!EnsureRdmBinaryForTest()) {

From 1ce9187a7cf1ba9949aa8c4775aeb5765357d3b4 Mon Sep 17 00:00:00 2001
From: ssahu777 <satyasundar_sahu@comcast.com>
Date: Tue, 30 Jun 2026 12:30:53 +0000
Subject: [PATCH 06/13] 1.8.1 release changelog updates

---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 52ccbdb8..1730afd6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,11 +4,19 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [1.8.1](https://github.com/rdkcentral/rdkfwupdater/compare/1.8.0...1.8.1)
+
+- RDKEMW-20453: Support file override to install versioned RDM packages for non-PROD builds [`#258`](https://github.com/rdkcentral/rdkfwupdater/pull/258)
+- Merge tag '1.8.0' into develop [`c76e203`](https://github.com/rdkcentral/rdkfwupdater/commit/c76e203ffc43253bdf1d8e463d4df73f8825bd64)
+
 #### [1.8.0](https://github.com/rdkcentral/rdkfwupdater/compare/1.7.0...1.8.0)
 
+> 25 June 2026
+
 - RDKEMW-19246: Enable development builds to download the rdm package from rdm-versioned-packages.conf [`#256`](https://github.com/rdkcentral/rdkfwupdater/pull/256)
 - RDKTV-40244:[EntOS] [8.3p15s2] [A4K] TV repeatedly triggers MAINTENANCE_REBOOT instead of entering the Deep Sleep state. [`#244`](https://github.com/rdkcentral/rdkfwupdater/pull/244)
 - RDKEMW-9150:[SECVULN] - HTTPS support for firmware download-OpenSpec Integration [`#249`](https://github.com/rdkcentral/rdkfwupdater/pull/249)
+- 1.8.0 release changelog updates [`3befd94`](https://github.com/rdkcentral/rdkfwupdater/commit/3befd94adcc207c7850ff126dc6250c68fd68d01)
 - Merge tag '1.7.0' into develop [`3c495b9`](https://github.com/rdkcentral/rdkfwupdater/commit/3c495b9f7df529a944af92f5bae00c758c33e2f6)
 
 #### [1.7.0](https://github.com/rdkcentral/rdkfwupdater/compare/1.6.2...1.7.0)

From 3b1ffd44bbe67dee3efa12fa18d40668078bf483 Mon Sep 17 00:00:00 2001
From: Yogeswaran K <166126056+yogeswaransky@users.noreply.github.com>
Date: Fri, 3 Jul 2026 14:22:19 +0530
Subject: [PATCH 07/13] RDKE-1065: Automated Component release workflow (#269)

Signed-off-by: Yogeswaran K <yogeswaransky@gmail.com>
---
 .github/workflows/README.md                   |  99 +++++++
 .../component-release-finish-on-approval.yml  | 115 ++++++++
 .github/workflows/component-release.yml       | 247 ++++++++++++++++++
 3 files changed, 461 insertions(+)
 create mode 100755 .github/workflows/README.md
 create mode 100755 .github/workflows/component-release-finish-on-approval.yml
 create mode 100755 .github/workflows/component-release.yml

diff --git a/.github/workflows/README.md b/.github/workflows/README.md
new file mode 100755
index 00000000..e42c3758
--- /dev/null
+++ b/.github/workflows/README.md
@@ -0,0 +1,99 @@
+# Automated Release Workflow
+
+Automates main release and hotfix flows via GitHub Actions.
+
+## Workflows
+
+### 1. Component Release (component-release.yml)
+
+Triggered manually from the Actions tab via workflow_dispatch.
+
+#### Inputs
+
+| Input | Required | Description |
+|-------|----------|-------------|
+| release_version | Yes | Release version (for example: 1.0.0, 1.0.0-rc1) |
+| release_type | Yes | main or hotfix |
+| release_mode | Yes | approvable or auto-complete (ignored for hotfix) |
+| source_branch | Hotfix only | Support branch for hotfix (for example: support/1.0) |
+
+#### Concurrency
+
+Runs are serialized per release key:
+
+- component-release-<release_type>-<release_version>
+
+This prevents two runs for the same version/type from racing on branches/tags.
+
+#### Release Modes
+
+Main release - auto-complete
+1. Validates version format.
+2. Runs git flow release start -> changelog -> release publish -> release finish.
+3. Pushes main, develop, and tags.
+4. Deletes remote release/<version> branch after successful finish.
+
+Main release - approvable
+1. Validates version format.
+2. Runs git flow release start -> changelog -> release publish.
+3. Creates a PR: release/<version> -> develop.
+4. Stops and waits for PR approval.
+5. On approval, the second workflow finishes the release.
+
+Hotfix (always auto-complete)
+1. Requires source_branch input.
+2. Validates source_branch against ^[A-Za-z0-9._/-]+$.
+3. Creates/uses hotfix/<version> from source_branch, updates changelog, merges back into source_branch only.
+4. Creates tag <version>.
+5. Pushes only source_branch and tag (main/develop are not pushed).
+
+### 2. Component Release Finish On Approval (component-release-finish-on-approval.yml)
+
+Triggered on approved review for release/* PRs targeting develop.
+
+#### What it does
+1. Verifies PR review decision is APPROVED.
+2. Checks out release branch.
+3. Runs git flow release finish (merge to main + develop, create tag).
+4. Pushes main, develop, and tags.
+5. Deletes remote release/<version> branch.
+6. Closes the release PR.
+
+## Authentication and Secrets
+
+Both workflows use:
+
+- RDKCM_DEPLOY_KEY: SSH private key used by checkout and git push operations.
+- RDKCM_RDKE: token used by gh API/CLI calls.
+
+## Failure Cleanup Safety
+
+On failure, cleanup only removes refs created by the current run:
+
+- Deletes tag only if the run created that tag.
+- Deletes release/<version> only if the run created that local release branch.
+- Deletes hotfix/<version> only if the run created that local hotfix branch.
+- Skips cleanup if repository checkout is unavailable.
+
+## Prerequisites
+
+### Repository Settings
+
+- Settings -> Actions -> General -> Workflow permissions: set to Read and write permissions.
+- Settings -> Actions -> General: enable Allow GitHub Actions to create and approve pull requests.
+
+### Branch Protection
+
+- For approvable flow: enforce PR review rules on develop.
+- For auto-complete flow pushes to develop: ensure the automation actor has appropriate bypass rights in repository rules.
+
+## Version Format
+
+Accepted examples:
+
+- 1.0.0
+- 1.0.0-rc1
+- 1.0.0v1
+- 1.0.0.beta2
+
+Rule: major.minor.patch digits with optional suffix.
diff --git a/.github/workflows/component-release-finish-on-approval.yml b/.github/workflows/component-release-finish-on-approval.yml
new file mode 100755
index 00000000..01ad0f54
--- /dev/null
+++ b/.github/workflows/component-release-finish-on-approval.yml
@@ -0,0 +1,115 @@
+name: Component Release Finish On Approval
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: release-finish-${{ github.event.pull_request.head.ref }}
+  cancel-in-progress: false
+
+jobs:
+  finish-release:
+    name: Finish release when PR is approved
+    if: >
+      github.event.review.state == 'approved' &&
+      github.event.pull_request.base.ref == 'develop' &&
+      startsWith(github.event.pull_request.head.ref, 'release/')
+    runs-on: ubuntu-latest
+    env:
+      REPO: ${{ github.repository }}
+      ACTOR: ${{ github.event.review.user.login }}
+      GH_TOKEN: ${{ secrets.RDKCM_RDKE }}
+      RELEASE_BRANCH: ${{ github.event.pull_request.head.ref }}
+
+    steps:
+      - name: Check approval status
+        id: approvals
+        run: |
+          set -euo pipefail
+          pr_number="${{ github.event.pull_request.number }}"
+          decision=$(gh pr view --repo "${REPO}" "${pr_number}" --json reviewDecision -q '.reviewDecision')
+          echo "PR #${pr_number} review decision: ${decision}"
+          if [ "${decision}" = "APPROVED" ]; then
+            echo "should_finish=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "PR is not fully approved yet. Waiting."
+            echo "should_finish=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Checkout repository
+        if: steps.approvals.outputs.should_finish == 'true'
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ssh-key: ${{ secrets.RDKCM_DEPLOY_KEY }}
+
+      - name: Install release tools
+        if: steps.approvals.outputs.should_finish == 'true'
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y git-flow
+
+      - name: Configure git identity
+        if: steps.approvals.outputs.should_finish == 'true'
+        run: |
+          set -euo pipefail
+          git config user.name "${ACTOR}"
+          git config user.email "${ACTOR}@users.noreply.github.com"
+
+      - name: Finish release and push
+        if: steps.approvals.outputs.should_finish == 'true'
+        run: |
+          set -euo pipefail
+          release_version="${RELEASE_BRANCH#release/}"
+
+          git fetch --prune origin
+
+          if git ls-remote --exit-code --tags origin "refs/tags/${release_version}" >/dev/null 2>&1; then
+            echo "Tag ${release_version} already exists on origin. Skipping release finish."
+            exit 0
+          fi
+
+          if git show-ref --verify --quiet "refs/heads/${RELEASE_BRANCH}"; then
+            git checkout "${RELEASE_BRANCH}"
+          elif git ls-remote --exit-code --heads origin "${RELEASE_BRANCH}" >/dev/null 2>&1; then
+            git checkout -b "${RELEASE_BRANCH}" "origin/${RELEASE_BRANCH}"
+          else
+            echo "${RELEASE_BRANCH} does not exist locally or on origin."
+            exit 1
+          fi
+
+          git checkout main 2>/dev/null || git checkout -b main origin/main
+          git checkout develop 2>/dev/null || git checkout -b develop origin/develop
+          git checkout "${RELEASE_BRANCH}"
+
+          git flow init -d
+
+          git flow release finish -m "Release ${release_version}" "${release_version}"
+          git push origin main
+          git push origin --tags
+          git push origin develop
+          git push origin --delete "${RELEASE_BRANCH}" || true
+
+      - name: Close the release PR
+        if: steps.approvals.outputs.should_finish == 'true'
+        run: |
+          set -euo pipefail
+          pr_number="${{ github.event.pull_request.number }}"
+          gh pr close "${pr_number}" --repo "${REPO}" --comment "Release finished by automation. Merged via git flow release finish." || true
+
+      - name: Workflow summary
+        if: always()
+        run: |
+          {
+            echo "## Release Finish On Approval"
+            echo "- Repository: ${REPO}"
+            echo "- Release branch: ${RELEASE_BRANCH}"
+            echo "- Triggered by review: ${{ github.event.review.state }}"
+            echo "- Finished release: ${{ steps.approvals.outputs.should_finish || 'false' }}"
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/component-release.yml b/.github/workflows/component-release.yml
new file mode 100755
index 00000000..26041949
--- /dev/null
+++ b/.github/workflows/component-release.yml
@@ -0,0 +1,247 @@
+name: Component Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_version:
+        description: "Release version (example: 1.0.0)"
+        required: true
+        type: string
+      release_type:
+        description: "Release type"
+        required: true
+        type: choice
+        options:
+          - main
+          - hotfix
+      release_mode:
+        description: "Release mode (ignored for hotfix)"
+        required: true
+        type: choice
+        options:
+          - approvable
+          - auto-complete
+      source_branch:
+        description: "Support branch for hotfix (e.g. support/1.0). Required for hotfix, ignored for main release."
+        required: false
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: component-release-${{ github.event.inputs.release_type }}-${{ github.event.inputs.release_version }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    env:
+      RELEASE_VERSION: ${{ github.event.inputs.release_version }}
+      RELEASE_TYPE: ${{ github.event.inputs.release_type }}
+      RELEASE_MODE: ${{ github.event.inputs.release_mode }}
+      SOURCE_BRANCH: ${{ github.event.inputs.source_branch }}
+      REPO: ${{ github.repository }}
+      ACTOR: ${{ github.actor }}
+      GH_TOKEN: ${{ secrets.RDKCM_RDKE }}
+
+    steps:
+      - name: Validate version format
+        run: |
+          set -euo pipefail
+          if ! [[ "${RELEASE_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+[A-Za-z0-9._-]*$ ]]; then
+            echo "Invalid version format: ${RELEASE_VERSION}"
+            echo "Expected format: major.minor.patch with optional suffix (e.g. 1.0.0, 1.0.0-rc1)"
+            exit 1
+          fi
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ssh-key: ${{ secrets.RDKCM_DEPLOY_KEY }}
+
+      - name: Initialize cleanup flags
+        run: |
+          {
+            echo "CREATED_RELEASE_BRANCH=false"
+            echo "CREATED_HOTFIX_BRANCH=false"
+            echo "CREATED_TAG=false"
+          } >> "$GITHUB_ENV"
+
+      - name: Install release tools
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y git-flow
+          npm install -g auto-changelog
+
+      - name: Configure git identity
+        run: |
+          set -euo pipefail
+          git config user.name "${ACTOR}"
+          git config user.email "${ACTOR}@users.noreply.github.com"
+
+      - name: Initialize git-flow
+        if: ${{ github.event.inputs.release_type == 'main' }}
+        run: |
+          set -euo pipefail
+          git fetch --prune origin
+          git checkout develop
+          git reset --hard origin/develop
+          git fetch origin main:main
+          git flow init -d
+
+      - name: "Auto-complete: full release"
+        if: ${{ github.event.inputs.release_type == 'main' && github.event.inputs.release_mode == 'auto-complete' }}
+        run: |
+          set -euo pipefail
+
+          if git ls-remote --exit-code --tags origin "refs/tags/${RELEASE_VERSION}" >/dev/null 2>&1; then
+            echo "Tag ${RELEASE_VERSION} already exists. Skipping."
+            exit 0
+          fi
+
+          git flow release start "${RELEASE_VERSION}"
+          echo "CREATED_RELEASE_BRANCH=true" >> "$GITHUB_ENV"
+          auto-changelog -v "${RELEASE_VERSION}"
+          git add CHANGELOG.md
+          if ! git diff --cached --quiet; then
+            git commit -m "${RELEASE_VERSION} release changelog updates"
+          fi
+          git flow release publish "${RELEASE_VERSION}"
+          git flow release finish -m "${RELEASE_VERSION} release" "${RELEASE_VERSION}"
+          echo "CREATED_TAG=true" >> "$GITHUB_ENV"
+          git push origin main
+          git push origin --tags
+          git push origin develop
+          git push origin --delete "release/${RELEASE_VERSION}" || true
+
+      - name: "Approvable: start release and create PR"
+        if: ${{ github.event.inputs.release_type == 'main' && github.event.inputs.release_mode == 'approvable' }}
+        run: |
+          set -euo pipefail
+
+          if git ls-remote --exit-code --tags origin "refs/tags/${RELEASE_VERSION}" >/dev/null 2>&1; then
+            echo "Tag ${RELEASE_VERSION} already exists. Skipping."
+            exit 0
+          fi
+
+          release_branch="release/${RELEASE_VERSION}"
+          if git ls-remote --exit-code --heads origin "${release_branch}" >/dev/null 2>&1; then
+            echo "${release_branch} already exists on remote. Skipping release start."
+          else
+            git flow release start "${RELEASE_VERSION}"
+            echo "CREATED_RELEASE_BRANCH=true" >> "$GITHUB_ENV"
+            auto-changelog -v "${RELEASE_VERSION}"
+            git add CHANGELOG.md
+            if ! git diff --cached --quiet; then
+              git commit -m "${RELEASE_VERSION} release changelog updates"
+            fi
+            git flow release publish "${RELEASE_VERSION}"
+          fi
+
+          existing_pr=$(gh pr list --head "${release_branch}" --base develop --state open --json number -q '.[0].number')
+          if [ -z "${existing_pr}" ]; then
+            gh pr create \
+              --base develop \
+              --head "${release_branch}" \
+              --title "Release ${RELEASE_VERSION}" \
+              --body "Automated release PR for ${RELEASE_VERSION}. Approve this PR to trigger release finish."
+            echo "PR created. Waiting for approval to finish release."
+          else
+            echo "PR from ${release_branch} to develop already exists (#${existing_pr})."
+          fi
+
+      - name: "Hotfix: validate source branch"
+        if: ${{ github.event.inputs.release_type == 'hotfix' }}
+        run: |
+          set -euo pipefail
+          if [ -z "${SOURCE_BRANCH}" ]; then
+            echo "ERROR: source_branch is required for hotfix release."
+            exit 1
+          fi
+          if ! [[ "${SOURCE_BRANCH}" =~ ^[A-Za-z0-9._/-]+$ ]]; then
+            echo "ERROR: source_branch contains invalid characters."
+            echo "Only alphanumeric characters, dots, underscores, hyphens, and slashes are allowed."
+            exit 1
+          fi
+
+      - name: "Hotfix: update support branch and push tag"
+        if: ${{ github.event.inputs.release_type == 'hotfix' }}
+        run: |
+          set -euo pipefail
+
+          if git ls-remote --exit-code --tags origin "refs/tags/${RELEASE_VERSION}" >/dev/null 2>&1; then
+            echo "Tag ${RELEASE_VERSION} already exists. Skipping."
+            exit 0
+          fi
+
+          git fetch --prune origin
+          if ! git ls-remote --exit-code --heads origin "${SOURCE_BRANCH}" >/dev/null 2>&1; then
+            echo "ERROR: source branch '${SOURCE_BRANCH}' does not exist on origin."
+            exit 1
+          fi
+
+          git checkout -B "${SOURCE_BRANCH}" "origin/${SOURCE_BRANCH}"
+
+          hotfix_branch="hotfix/${RELEASE_VERSION}"
+          if git show-ref --verify --quiet "refs/heads/${hotfix_branch}"; then
+            git checkout "${hotfix_branch}"
+          else
+            git checkout -b "${hotfix_branch}" "${SOURCE_BRANCH}"
+            echo "CREATED_HOTFIX_BRANCH=true" >> "$GITHUB_ENV"
+          fi
+
+          auto-changelog -v "${RELEASE_VERSION}"
+          git add CHANGELOG.md
+          if ! git diff --cached --quiet; then
+            git commit -m "${RELEASE_VERSION} hotfix release"
+          else
+            echo "No CHANGELOG.md changes to commit."
+          fi
+
+          git checkout "${SOURCE_BRANCH}"
+          git merge --no-ff "${hotfix_branch}" -m "Merge hotfix ${RELEASE_VERSION} into ${SOURCE_BRANCH}"
+
+          git tag -a "${RELEASE_VERSION}" -m "Hotfix ${RELEASE_VERSION}"
+          echo "CREATED_TAG=true" >> "$GITHUB_ENV"
+          git push origin "${SOURCE_BRANCH}"
+          git push origin "${RELEASE_VERSION}"
+          echo "Hotfix complete: pushed ${SOURCE_BRANCH} and tag ${RELEASE_VERSION}."
+
+      - name: Cleanup on failure
+        if: failure()
+        run: |
+          if [ ! -d .git ]; then
+            echo "No repository checkout available. Skipping cleanup."
+            exit 0
+          fi
+
+          if [[ "${CREATED_TAG:-false}" == "true" ]] && git rev-parse -q --verify "refs/tags/${RELEASE_VERSION}" >/dev/null 2>&1; then
+            git tag -d "${RELEASE_VERSION}" 2>/dev/null || true
+            git push origin ":refs/tags/${RELEASE_VERSION}" 2>/dev/null || true
+          fi
+
+          if [[ "${RELEASE_TYPE}" == "main" ]]; then
+            if [[ "${CREATED_RELEASE_BRANCH:-false}" == "true" ]] && git show-ref --verify --quiet "refs/heads/release/${RELEASE_VERSION}"; then
+              git push origin --delete "release/${RELEASE_VERSION}" 2>/dev/null || true
+            fi
+          else
+            if [[ "${CREATED_HOTFIX_BRANCH:-false}" == "true" ]] && git show-ref --verify --quiet "refs/heads/hotfix/${RELEASE_VERSION}"; then
+              git push origin --delete "hotfix/${RELEASE_VERSION}" 2>/dev/null || true
+            fi
+          fi
+
+      - name: Workflow summary
+        if: always()
+        run: |
+          {
+            echo "## Component Release Summary"
+            echo "- Repository: ${REPO}"
+            echo "- Actor: ${ACTOR}"
+            echo "- Version: ${RELEASE_VERSION}"
+            echo "- Type: ${RELEASE_TYPE}"
+            echo "- Mode: ${RELEASE_MODE}"
+          } >> "$GITHUB_STEP_SUMMARY"

From 4c018d6f5a6065c700b9f7eb474130cdd2b7245d Mon Sep 17 00:00:00 2001
From: satya200 <satya200@users.noreply.github.com>
Date: Fri, 3 Jul 2026 09:06:40 +0000
Subject: [PATCH 08/13] 1.8.2 release changelog updates

---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1730afd6..98d61a05 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,9 +4,17 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [1.8.2](https://github.com/rdkcentral/rdkfwupdater/compare/1.8.1...1.8.2)
+
+- RDKE-1065: Automated Component release workflow [`#269`](https://github.com/rdkcentral/rdkfwupdater/pull/269)
+- Merge tag '1.8.1' into develop [`3c0d003`](https://github.com/rdkcentral/rdkfwupdater/commit/3c0d0038d53b88dd9bd425dfdd151ba2fa56d5e4)
+
 #### [1.8.1](https://github.com/rdkcentral/rdkfwupdater/compare/1.8.0...1.8.1)
 
+> 30 June 2026
+
 - RDKEMW-20453: Support file override to install versioned RDM packages for non-PROD builds [`#258`](https://github.com/rdkcentral/rdkfwupdater/pull/258)
+- 1.8.1 release changelog updates [`1ce9187`](https://github.com/rdkcentral/rdkfwupdater/commit/1ce9187a7cf1ba9949aa8c4775aeb5765357d3b4)
 - Merge tag '1.8.0' into develop [`c76e203`](https://github.com/rdkcentral/rdkfwupdater/commit/c76e203ffc43253bdf1d8e463d4df73f8825bd64)
 
 #### [1.8.0](https://github.com/rdkcentral/rdkfwupdater/compare/1.7.0...1.8.0)

From 8b7aa49ca7cc137bf4f902bdc363c7fa8e40a856 Mon Sep 17 00:00:00 2001
From: mkadinti <101405874+mkadinti@users.noreply.github.com>
Date: Mon, 6 Jul 2026 12:33:08 +0530
Subject: [PATCH 09/13] RDKEMW-20390:[RDK-E][Element] : When device is in state
 red, rdkfwupgrader continues to emit log messages after RDKLOG deinit is
 reported (#266)

* RDKEMW-20390:[RDK-E][Element] : When device is in state red, rdkfwupgrader continues to emit log messages after RDKLOG deinit is reported
---
 run_ut.sh                          |  9 ---------
 src/device_status_helper.c         | 17 ++++++-----------
 src/directcdn.c                    |  5 +++++
 src/include/rdkv_upgrade.h         |  2 +-
 src/rdkv_main.c                    | 23 +++++++++++++++++++++--
 src/rdkv_upgrade.c                 | 26 ++++++++++++++++++--------
 unittest/basic_rdkv_main_gtest.cpp |  8 ++++++--
 7 files changed, 57 insertions(+), 33 deletions(-)

diff --git a/run_ut.sh b/run_ut.sh
index 8c547198..1e1ef3d6 100755
--- a/run_ut.sh
+++ b/run_ut.sh
@@ -15,15 +15,6 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 
-git clone https://github.com/rdkcentral/common_utilities.git
-cd common_utilities
-git checkout develop
-autoreconf -i
-./configure  --enable-rdkcertselector --prefix=${INSTALL_DIR} CFLAGS=" -DRDK_LOGGER "
-make && make install
-
-cd ../
-
 cd ./unittest/
 
 automake --add-missing
diff --git a/src/device_status_helper.c b/src/device_status_helper.c
index 468d52a3..b46f6bde 100644
--- a/src/device_status_helper.c
+++ b/src/device_status_helper.c
@@ -19,6 +19,7 @@
 #include "device_status_helper.h"
 #include "rdkv_cdl.h"
 #include "rdkv_cdl_log_wrapper.h"
+#include "rdkv_upgrade.h"
 #ifndef GTEST_ENABLE
 #include "rdk_fwdl_utils.h"
 #include "json_parse.h"
@@ -359,14 +360,13 @@ void unsetStateRed(void)
 }
 
 
-/* Description: If state red support is present eneter to state red
- * @param curlret: Receving curl status from Caller
+/* Description: If state red support is present enter state red recovery
+ * @param curlret: Receiving curl status from Caller
  * @return: 0 on success (no state red entry needed or flag already set)
- *         -1 on TLS/SSL error (state red entered, process should terminate in CLI mode)
+ *         RDKV_UPGRADE_ERROR_STATE_RED on TLS/SSL error (state red entered, caller should short-circuit)
  * */
 int checkAndEnterStateRed(int curlret, const char *disableStatsUpdate) {
     int ret = -1;
-    FILE *fp = NULL;
     struct FWDownloadStatus fwdls;
     ret = isStateRedSupported();
     if(ret == 0) {
@@ -381,7 +381,7 @@ int checkAndEnterStateRed(int curlret, const char *disableStatsUpdate) {
     if((curlret == 35) || (curlret == 51) || (curlret == 53) || (curlret == 54) || (curlret == 58) || (curlret == 59) || (curlret == 60)
             || (curlret == 64) || (curlret == 66) || (curlret == 77) || (curlret == 80) || (curlret == 82) || (curlret == 83) || (curlret == 90)
             || (curlret == 91)|| (curlret == 495)) {
-        SWLOG_INFO("RED checkAndEnterStateRed: Curl SSL/TLS error %d. Set State Red Recovery Flag and Exit!!!", curlret);
+        SWLOG_INFO("RED checkAndEnterStateRed: Curl SSL/TLS error %d. Entering state red recovery.", curlret);
         t2CountNotify("CDLrdkportal_split", curlret);
 	t2CountNotify("RED_STATE_REASON", curlret);
         //CID:280507-Unchecked return value
@@ -411,13 +411,8 @@ int checkAndEnterStateRed(int curlret, const char *disableStatsUpdate) {
         //TODO sprintf(fwdls.DelayDownload, "DelayDownload|%s\n", delaydnld); // This data should come from script as a argument
         updateFWDownloadStatus(&fwdls, disableStatsUpdate);
 
-        uninitialize(INITIAL_VALIDATION_SUCCESS);
-        fp = fopen(STATEREDFLAG, "w");
-        if(fp != NULL) {
-            fclose(fp);
-        }
         SWLOG_ERROR("RED checkAndEnterStateRed: State red entered due to TLS/SSL error %d. Returning error to caller.\n", curlret);
-        return -1;
+        return RDKV_UPGRADE_ERROR_STATE_RED;
     } else {
         //Recovery completed event send for the failure case but not due to fatal error
         if( (filePresentCheck( RED_STATE_REBOOT ) == RDK_API_SUCCESS) ) {
diff --git a/src/directcdn.c b/src/directcdn.c
index 9964e7af..b7ec0b80 100644
--- a/src/directcdn.c
+++ b/src/directcdn.c
@@ -184,6 +184,9 @@ int DirectCDNDownload( XCONFRES *response, char *cur_img_name, DeviceProperty_t
 		    else
 		    {
                             SWLOG_ERROR( "DirectCDNDownload: XCONF fail ret=%d http=%d\n", ret, *pHttp_code );
+                            if (ret == RDKV_UPGRADE_ERROR_STATE_RED) {
+                                curl_ret_code = ret;
+                            }
 			    break;
 		    }
 		    cnt++;
@@ -215,6 +218,8 @@ int DirectCDNDownload( XCONFRES *response, char *cur_img_name, DeviceProperty_t
     }
     if ((pci_upgrade_status == 0) && (pdri_upgrade_status == 0)) {
 	curl_ret_code = 0;
+    } else if (pci_upgrade_status == RDKV_UPGRADE_ERROR_STATE_RED || pdri_upgrade_status == RDKV_UPGRADE_ERROR_STATE_RED) {
+	curl_ret_code = RDKV_UPGRADE_ERROR_STATE_RED;
     }
     SWLOG_INFO("DirectCDNDownload: Function return %d\n", curl_ret_code);
     return curl_ret_code;
diff --git a/src/include/rdkv_upgrade.h b/src/include/rdkv_upgrade.h
index 4ae5cd5b..16abfd14 100755
--- a/src/include/rdkv_upgrade.h
+++ b/src/include/rdkv_upgrade.h
@@ -139,7 +139,7 @@ int fallBack(
 );
 
 
-void dwnlError(int curl_code, int http_code, int server_type,const DeviceProperty_t *device_info,const char *lastrun, char *disableStatsUpdate);
+int dwnlError(int curl_code, int http_code, int server_type,const DeviceProperty_t *device_info,const char *lastrun, char *disableStatsUpdate);
 
 void saveHTTPCode(int http_code, const char *lastrun);
 void Upgradet2CountNotify(char *marker, int val); 
diff --git a/src/rdkv_main.c b/src/rdkv_main.c
index 342e6374..2bbfc29a 100644
--- a/src/rdkv_main.c
+++ b/src/rdkv_main.c
@@ -596,6 +596,11 @@ int checkTriggerUpgrade(XCONFRES *pResponse, const char *model, int upgrade_type
         const char *artifact_file = NULL;
         int artifact_upgrade_type = upgrade_type;
 
+        /* Propagate reboot/delay flags from XConf response (mirrors legacy branch) */
+        snprintf(immed_reboot_flag, sizeof(immed_reboot_flag), "%s", pResponse->cloudImmediateRebootFlag);
+        delay_dwnl = atoi(pResponse->cloudDelayDownload);
+        SWLOG_INFO("%s: reboot_flag=%s delay_dwnl=%d\n", __FUNCTION__, immed_reboot_flag, delay_dwnl);
+
         switch (upgrade_type) {
             case PCI_UPGRADE:
                 artifact_url = pResponse->firmwareUrl;
@@ -754,6 +759,10 @@ int checkTriggerUpgrade(XCONFRES *pResponse, const char *model, int upgrade_type
                 uninitialize(INITIAL_VALIDATION_SUCCESS);
                 exit(1);
             }
+            if (pci_curl_code == RDKV_UPGRADE_ERROR_STATE_RED) {
+                upgrade_status = RDKV_UPGRADE_ERROR_STATE_RED;
+                return upgrade_status;
+            }
         }
     } else {
         SWLOG_INFO("checkForValidPCIUpgrade return false\n");
@@ -810,6 +819,10 @@ int checkTriggerUpgrade(XCONFRES *pResponse, const char *model, int upgrade_type
                     uninitialize(INITIAL_VALIDATION_SUCCESS);
                     exit(1);
                 }
+                if (pdri_curl_code == RDKV_UPGRADE_ERROR_STATE_RED) {
+                    upgrade_status = RDKV_UPGRADE_ERROR_STATE_RED;
+                    return upgrade_status;
+                }
             }
             
             snprintf(disableStatsUpdate, sizeof(disableStatsUpdate), "%s","no");
@@ -1305,9 +1318,15 @@ int main(int argc, char *argv[]) {
         }
     }
 
-    if (ret_curl_code != RDKV_UPGRADE_ERROR_STATE_RED) {
-        uninitialize(init_validate_status);
+    if (ret_curl_code == RDKV_UPGRADE_ERROR_STATE_RED) {
+        FILE *state_red_fp = fopen(STATEREDFLAG, "w");
+        if (state_red_fp != NULL) {
+            fclose(state_red_fp);
+        } else {
+            SWLOG_ERROR("%s: failed to create %s\n", __FUNCTION__, STATEREDFLAG);
+        }
     }
+    uninitialize(init_validate_status);
     exit(ret_curl_code);
 }
 
diff --git a/src/rdkv_upgrade.c b/src/rdkv_upgrade.c
index db0ed2ae..865cdc57 100755
--- a/src/rdkv_upgrade.c
+++ b/src/rdkv_upgrade.c
@@ -118,19 +118,20 @@ bool checkForTlsErrors(int curl_code, const char *type)
 /* Description:Use for store download error and send telemetry
  * @param: curl_code : curl return status
  * @param: http_code : http return status
- * @return void:
+ * @return int: RDKV_UPGRADE_ERROR_STATE_RED if state red entered, 0 otherwise
  * */
-void dwnlError(int curl_code, int http_code, int server_type,const DeviceProperty_t *device_info,const char *lastrun,char *disableStatsUpdate)
+int dwnlError(int curl_code, int http_code, int server_type,const DeviceProperty_t *device_info,const char *lastrun,char *disableStatsUpdate)
 {
     char telemetry_data[32];
     char device_type[32];
     struct FWDownloadStatus fwdls;
     char failureReason[128];
     char *type = "Direct"; //TODO: Need to pass this type as a function parameter
+    int state_red_ret = 0;
 
     if (device_info == NULL) {
         SWLOG_ERROR("%s: device_info parameter is NULL\n", __FUNCTION__);
-        return;
+        return 0;
     }
 
     *failureReason = 0;
@@ -188,7 +189,7 @@ void dwnlError(int curl_code, int http_code, int server_type,const DevicePropert
         snprintf(fwdls.dnldVersn, sizeof(fwdls.dnldVersn), "DnldVersn|\n");
         snprintf(fwdls.dnldfile, sizeof(fwdls.dnldfile), "DnldFile|\n");
         snprintf(fwdls.dnldurl, sizeof(fwdls.dnldurl), "DnldURL|\n");
-        snprintf(fwdls.lastrun, sizeof(fwdls.lastrun), "LastRun|%s\n", lastrun); // lastrun his data should come from script as a argument
+        snprintf(fwdls.lastrun, sizeof(fwdls.lastrun), "LastRun|%s\n", lastrun ? lastrun : "");
         snprintf(fwdls.FwUpdateState, sizeof(fwdls.FwUpdateState), "FwUpdateState|Failed\n");
         snprintf(fwdls.DelayDownload, sizeof(fwdls.DelayDownload), "DelayDownload|\n"); // This data should come from script as a argument
         updateFWDownloadStatus(&fwdls, disableStatsUpdate);
@@ -196,15 +197,24 @@ void dwnlError(int curl_code, int http_code, int server_type,const DevicePropert
     // HTTP CODE 495 - Expired client certificate not in servers allow list
     if( http_code == 495 ) {
         SWLOG_INFO("%s : Calling checkAndEnterStateRed() with code:%d\n", __FUNCTION__, http_code);
-        if (checkAndEnterStateRed(http_code, disableStatsUpdate) != 0) {
+        state_red_ret = checkAndEnterStateRed(http_code, disableStatsUpdate);
+        if (state_red_ret != 0) {
             SWLOG_ERROR("%s : State red entered due to HTTP error %d\n", __FUNCTION__, http_code);
         }
     }else {
         SWLOG_INFO("%s : Calling checkAndEnterStateRed() with code:%d\n", __FUNCTION__, curl_code);
-        if (checkAndEnterStateRed(curl_code, disableStatsUpdate) != 0) {
+        state_red_ret = checkAndEnterStateRed(curl_code, disableStatsUpdate);
+        if (state_red_ret != 0) {
             SWLOG_ERROR("%s : State red entered due to curl error %d\n", __FUNCTION__, curl_code);
         }
     }
+    /* If device is already in state red (Instance B recovery), checkAndEnterStateRed
+     * returns 0 early. Still signal callers to skip retries — retrying with the same
+     * broken cert/TLS config is pointless. */
+    if (state_red_ret == 0 && isInStateRed() == 1) {
+        state_red_ret = RDKV_UPGRADE_ERROR_STATE_RED;
+    }
+    return state_red_ret;
 }
 
 /* Description: Save http value inside file
@@ -1179,8 +1189,8 @@ int downloadFile(
     }else {
         SWLOG_ERROR("%s : Direct Image upgrade Fail: curl ret:%d http_code:%d\n", __FUNCTION__, curl_ret_code, *httpCode);
         (server_type == HTTP_SSR_DIRECT) ? setDwnlState(RDKV_FWDNLD_DOWNLOAD_FAILED) : setDwnlState(RDKV_XCONF_FWDNLD_DOWNLOAD_FAILED);
-        dwnlError(curl_ret_code, *httpCode, server_type,device_info,lastrun,disableStatsUpdate);
-        if (filePresentCheck(STATEREDFLAG) == 0) {
+        int state_red_ret = dwnlError(curl_ret_code, *httpCode, server_type,device_info,lastrun,disableStatsUpdate);
+        if (state_red_ret == RDKV_UPGRADE_ERROR_STATE_RED || isInStateRed() == 1) {

             SWLOG_INFO("%s : State red entered during download, skipping retry\n", __FUNCTION__);
             return RDKV_UPGRADE_ERROR_STATE_RED;
         }
diff --git a/unittest/basic_rdkv_main_gtest.cpp b/unittest/basic_rdkv_main_gtest.cpp
index 20b625aa..32e5f870 100755
--- a/unittest/basic_rdkv_main_gtest.cpp
+++ b/unittest/basic_rdkv_main_gtest.cpp
@@ -88,7 +88,7 @@ extern "C" {
     int doCurlPutRequest(void *in_curl, FileDwnl_t *pfile_dwnl, char *jsonrpc_auth_token, int *out_httpCode);
     int getOPTOUTValue(const char *filename);
     void getPidStore(const char *key, const char *value);
-    void dwnlError(int curl_code, int http_code, int server_type, const DeviceProperty_t *device_info, const char *lastrun, char *disableStatsUpdate);
+    int dwnlError(int curl_code, int http_code, int server_type, const DeviceProperty_t *device_info, const char *lastrun, char *disableStatsUpdate);
     int peripheral_firmware_dndl(char *pCloudFWLocation, char *pPeripheralFirmwares);
     int fallBack(const RdkUpgradeContext_t* context, int *httpCode, void **curl);
     void saveHTTPCode(int http_code, const char *lastrun);
@@ -490,6 +490,7 @@ TEST(DwnlErrorTest, HandlesCurlCode0) {
     int server_type = 0;
     DeviceProperty_t device_info = {0};
     strcpy(device_info.dev_type, "mediaclient");
+    g_DeviceUtilsMock = nullptr;
     MockExternal mockexternal;
     global_mockexternal_ptr = &mockexternal;
     EXPECT_CALL(mockexternal,checkAndEnterStateRed(_,_)).Times(1);
@@ -504,6 +505,7 @@ TEST(DwnlErrorTest, HandlesCurlCode22) {
     int server_type = 0;
     DeviceProperty_t device_info = {0};
     strcpy(device_info.dev_type, "mediaclient");
+    g_DeviceUtilsMock = nullptr;
     MockExternal mockexternal;
     global_mockexternal_ptr = &mockexternal;
     EXPECT_CALL(mockexternal,eventManager(_,_)).Times(1);
@@ -520,6 +522,7 @@ TEST(DwnlErrorTest, HandlesCurlCode18) {
     int server_type = 0;
     DeviceProperty_t device_info = {0};
     strcpy(device_info.dev_type, "mediaclient");
+    g_DeviceUtilsMock = nullptr;
     MockExternal mockexternal;
     global_mockexternal_ptr = &mockexternal;
     strcpy(device_info.dev_type,"mediaclient");
@@ -537,6 +540,7 @@ TEST(DwnlErrorTest, HandlesCurlCode91) {
     int server_type = 0;
     DeviceProperty_t device_info = {0};
     strcpy(device_info.dev_type, "mediaclient1");
+    g_DeviceUtilsMock = nullptr;
     MockExternal mockexternal;
     global_mockexternal_ptr = &mockexternal;
     EXPECT_CALL(mockexternal,eventManager(_,_)).Times(1);
@@ -2793,7 +2797,7 @@ TEST(DirectCDNRetryTest, PerArtifact_WhenHttp403Received_ReturnsRetryErr) {
 /**
  * @brief When downloadFile returns RDKV_UPGRADE_ERROR_STATE_RED, rdkv_upgrade_request
  * must short-circuit immediately without calling retryDownload or codebig fallback.
- * This verifies the state-red guard prevents retry loops after uninitialize() was called.
+ * This verifies the state-red guard prevents retry loops after state-red entry.
  */
 TEST(StateRedShortCircuitTest, DirectPath_SkipsRetryWhenStateRedReturned) {
     MockDownloadFileOps mockfileops;

From d1b517f1da7296133e19f7abc7a5389a86d205db Mon Sep 17 00:00:00 2001
From: mkadinti <mkadinti@users.noreply.github.com>
Date: Wed, 8 Jul 2026 11:57:31 +0000
Subject: [PATCH 10/13] 1.8.3 release changelog updates

---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 98d61a05..c2a9ce8c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,9 +4,17 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [1.8.3](https://github.com/rdkcentral/rdkfwupdater/compare/1.8.2...1.8.3)
+
+- RDKEMW-20390:[RDK-E][Element] : When device is in state red, rdkfwupgrader continues to emit log messages after RDKLOG deinit is reported [`#266`](https://github.com/rdkcentral/rdkfwupdater/pull/266)
+- Merge tag '1.8.2' into develop [`5ea985b`](https://github.com/rdkcentral/rdkfwupdater/commit/5ea985b4f3d5a809cf20e5f805b6c24a660c285e)
+
 #### [1.8.2](https://github.com/rdkcentral/rdkfwupdater/compare/1.8.1...1.8.2)
 
+> 3 July 2026
+
 - RDKE-1065: Automated Component release workflow [`#269`](https://github.com/rdkcentral/rdkfwupdater/pull/269)
+- 1.8.2 release changelog updates [`4c018d6`](https://github.com/rdkcentral/rdkfwupdater/commit/4c018d6f5a6065c700b9f7eb474130cdd2b7245d)
 - Merge tag '1.8.1' into develop [`3c0d003`](https://github.com/rdkcentral/rdkfwupdater/commit/3c0d0038d53b88dd9bd425dfdd151ba2fa56d5e4)
 
 #### [1.8.1](https://github.com/rdkcentral/rdkfwupdater/compare/1.8.0...1.8.1)

From 55329fce720405474bca83285b6639c3e6bc46f1 Mon Sep 17 00:00:00 2001
From: Yogeswaran K <166126056+yogeswaransky@users.noreply.github.com>
Date: Fri, 10 Jul 2026 15:39:45 +0530
Subject: [PATCH 11/13] RDKE-1065: Automated Component release workflow (#270)

Signed-off-by: Yogeswaran K <yogeswaransky@gmail.com>
Co-authored-by: Satya Sundar Sahu <tinkusahu.com@gmail.com>
---
 .github/workflows/README.md                               | 8 +++++++-
 .../workflows/component-release-finish-on-approval.yml    | 2 +-
 .github/workflows/component-release.yml                   | 2 +-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index e42c3758..63f1535d 100755
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -64,7 +64,13 @@ Triggered on approved review for release/* PRs targeting develop.
 Both workflows use:
 
 - RDKCM_DEPLOY_KEY: SSH private key used by checkout and git push operations.
-- RDKCM_RDKE: token used by gh API/CLI calls.
+- github.token: built-in ephemeral GitHub Actions token used by gh API/CLI calls.
+
+Why github.token:
+
+- It is automatically provided for each workflow run.
+- It avoids introducing a custom repository secret for API access.
+- It works with the workflow permissions already declared in the job.
 
 ## Failure Cleanup Safety
 
diff --git a/.github/workflows/component-release-finish-on-approval.yml b/.github/workflows/component-release-finish-on-approval.yml
index 01ad0f54..fef5c2a9 100755
--- a/.github/workflows/component-release-finish-on-approval.yml
+++ b/.github/workflows/component-release-finish-on-approval.yml
@@ -23,7 +23,7 @@ jobs:
     env:
       REPO: ${{ github.repository }}
       ACTOR: ${{ github.event.review.user.login }}
-      GH_TOKEN: ${{ secrets.RDKCM_RDKE }}
+      GH_TOKEN: ${{ github.token }}
       RELEASE_BRANCH: ${{ github.event.pull_request.head.ref }}
 
     steps:
diff --git a/.github/workflows/component-release.yml b/.github/workflows/component-release.yml
index 26041949..4c923f61 100755
--- a/.github/workflows/component-release.yml
+++ b/.github/workflows/component-release.yml
@@ -44,7 +44,7 @@ jobs:
       SOURCE_BRANCH: ${{ github.event.inputs.source_branch }}
       REPO: ${{ github.repository }}
       ACTOR: ${{ github.actor }}
-      GH_TOKEN: ${{ secrets.RDKCM_RDKE }}
+      GH_TOKEN: ${{ github.token }}
 
     steps:
       - name: Validate version format

From f3baf269d188e0993d21bcd83f16e549ce417747 Mon Sep 17 00:00:00 2001
From: Yogeswaran K <166126056+yogeswaransky@users.noreply.github.com>
Date: Wed, 15 Jul 2026 16:46:18 +0530
Subject: [PATCH 12/13] RDKE-1065: Automated workflow to create pull request to
 main instead of develop (#276)

Signed-off-by: Yogeswaran K <yogeswaransky@gmail.com>
---
 .github/workflows/README.md                                | 6 +++---
 .github/workflows/component-release-finish-on-approval.yml | 2 +-
 .github/workflows/component-release.yml                    | 6 +++---
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index 63f1535d..6fc83552 100755
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -36,7 +36,7 @@ Main release - auto-complete
 Main release - approvable
 1. Validates version format.
 2. Runs git flow release start -> changelog -> release publish.
-3. Creates a PR: release/<version> -> develop.
+3. Creates a PR: release/<version> -> main.
 4. Stops and waits for PR approval.
 5. On approval, the second workflow finishes the release.
 
@@ -49,7 +49,7 @@ Hotfix (always auto-complete)
 
 ### 2. Component Release Finish On Approval (component-release-finish-on-approval.yml)
 
-Triggered on approved review for release/* PRs targeting develop.
+Triggered on approved review for release/* PRs targeting main.
 
 #### What it does
 1. Verifies PR review decision is APPROVED.
@@ -90,7 +90,7 @@ On failure, cleanup only removes refs created by the current run:
 
 ### Branch Protection
 
-- For approvable flow: enforce PR review rules on develop.
+- For approvable flow: enforce PR review rules on main.
 - For auto-complete flow pushes to develop: ensure the automation actor has appropriate bypass rights in repository rules.
 
 ## Version Format
diff --git a/.github/workflows/component-release-finish-on-approval.yml b/.github/workflows/component-release-finish-on-approval.yml
index fef5c2a9..c7f35a02 100755
--- a/.github/workflows/component-release-finish-on-approval.yml
+++ b/.github/workflows/component-release-finish-on-approval.yml
@@ -17,7 +17,7 @@ jobs:
     name: Finish release when PR is approved
     if: >
       github.event.review.state == 'approved' &&
-      github.event.pull_request.base.ref == 'develop' &&
+      github.event.pull_request.base.ref == 'main' &&
       startsWith(github.event.pull_request.head.ref, 'release/')
     runs-on: ubuntu-latest
     env:
diff --git a/.github/workflows/component-release.yml b/.github/workflows/component-release.yml
index 4c923f61..e2aec759 100755
--- a/.github/workflows/component-release.yml
+++ b/.github/workflows/component-release.yml
@@ -142,16 +142,16 @@ jobs:
             git flow release publish "${RELEASE_VERSION}"
           fi
 
-          existing_pr=$(gh pr list --head "${release_branch}" --base develop --state open --json number -q '.[0].number')
+          existing_pr=$(gh pr list --head "${release_branch}" --base main --state open --json number -q '.[0].number')
           if [ -z "${existing_pr}" ]; then
             gh pr create \
-              --base develop \
+              --base main \
               --head "${release_branch}" \
               --title "Release ${RELEASE_VERSION}" \
               --body "Automated release PR for ${RELEASE_VERSION}. Approve this PR to trigger release finish."
             echo "PR created. Waiting for approval to finish release."
           else
-            echo "PR from ${release_branch} to develop already exists (#${existing_pr})."
+            echo "PR from ${release_branch} to main already exists (#${existing_pr})."
           fi
 
       - name: "Hotfix: validate source branch"

From 178c44a3e98869a58cb012170a30d98934c9b860 Mon Sep 17 00:00:00 2001
From: Satya Sundar Sahu <tinkusahu.com@gmail.com>
Date: Mon, 3 Aug 2026 15:55:05 +0530
Subject: [PATCH 13/13] Update rdkv_upgrade.c (#277)

---
 src/rdkv_upgrade.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/rdkv_upgrade.c b/src/rdkv_upgrade.c
index 865cdc57..719d414e 100755
--- a/src/rdkv_upgrade.c
+++ b/src/rdkv_upgrade.c
@@ -678,7 +678,9 @@ int rdkv_upgrade_request(const RdkUpgradeContext_t* context, void** curl, int* p
                         logMilestone(cmd_args);
                     }
                 } else {
-                    SWLOG_INFO("PDRI image Flash upgrade successful.\n");
+					if (flash_status == 0) {
+                        SWLOG_INFO("PDRI image Flash upgrade successful.\n");
+					}
                 }
             }
         }
@@ -1190,7 +1192,8 @@ int downloadFile(
         SWLOG_ERROR("%s : Direct Image upgrade Fail: curl ret:%d http_code:%d\n", __FUNCTION__, curl_ret_code, *httpCode);
         (server_type == HTTP_SSR_DIRECT) ? setDwnlState(RDKV_FWDNLD_DOWNLOAD_FAILED) : setDwnlState(RDKV_XCONF_FWDNLD_DOWNLOAD_FAILED);
         int state_red_ret = dwnlError(curl_ret_code, *httpCode, server_type,device_info,lastrun,disableStatsUpdate);
-        if (state_red_ret == RDKV_UPGRADE_ERROR_STATE_RED || isInStateRed() == 1) {

+        if (state_red_ret == RDKV_UPGRADE_ERROR_STATE_RED || isInStateRed() == 1) {
+
             SWLOG_INFO("%s : State red entered during download, skipping retry\n", __FUNCTION__);
             return RDKV_UPGRADE_ERROR_STATE_RED;
         }