This lesson has one job: keep yesterday's access from becoming today's attack. Manufacture needs open test and debug; the field needs both locked; provisioning sits between, writing secrets while still half open. Lifecycle states draw those lines, and debug locking enforces them. A debug path that ignores lifecycle is a second, unaudited privilege system bolted onto the first.
The ladder is monotonic: manufacture, test, provisioning and field, each enabling less than the last, and it never steps back. Return is a fifth, terminal state: it is reached from field only by an authorised command, never leads back to field, keeps the secrets locked, and opens debug inside a scoped, logged window for failure analysis. Test mode and scan belong to the top of the ladder and lock below provisioning; field debug answers only through authentication, with the secure-boot recovery path as its model. The fuse topic owns the storage of the state; this lesson owns its enforcement: every debug and test enable is qualified by the current lifecycle state, and any retreat attempt raises a fault. The NanoSoC teaching values mirror the fuse table's five states so the two lessons share one vocabulary.
# not-run: lifecycle transitions, NanoSoC teaching values
manufacture -> test -> provisioning -> field -> return (terminal).
Forward moves: tester or authorised provisioning command; field -> return by authorised command only.
Backward moves: none exist; return has no outgoing transition and never reaches field again.
Debug enable = (state in {manufacture, test}) |
(authenticated AND state in {provisioning, field}) |
(authenticated AND scoped, logged window AND state == return).
Any enable asserted outside its states is a fault, not a request.Every debug and test path names the states where it is open, authenticated and locked; no path is stateless.
Retreat is impossible in the RTL with an assertion to prove it, and return is terminal, authorised and logged.
Field units expose exactly one debug path, authenticated, with its failure behaviour matching the secure-boot fail state.
Attempt every transition in both directions in simulation and confirm forward moves enable the documented paths while any retreat attempt faults. Then probe each debug interface in the field state without credentials and confirm uniform refusal that discloses nothing about the lock design. If a path answers, its lifecycle qualifier is missing or tied to the wrong state.
A move to the terminal return state with scoped, logged reopening (the unit never goes back to field), or authenticated debug through the field path. Permanent unlock, shared credentials, or a hidden strap each trade one diagnosis for an open fleet.