Alp SDK v0.10 — portable display path, hardened GD32 OTA, reproducible releases

Alp SDK v0.10 is a portability-and-plumbing release. It closes the last big gap where example code reached past the portable API into Zephyr directly, hardens the V2N GD32 supervisor bridge OTA path against a set of real failure modes, and makes a release build reproducible end to end. A same-day patch, v0.10.1, fixes a bootstrap defect that made the west extension commands unavailable on a fresh workspace.

The display path is now portable. lvgl-widgets-demo, lvgl-benchmark, lvgl-music-player, iot-dashboard, ai-camera-viewer, and drone-hud previously opened their panel through Zephyr’s own display driver and let Zephyr’s lvgl module auto-init the display. Each now opens the panel via alp_display_open() and binds it to LVGL through alp_gui_lvgl_attach(), owning the full sequence itself. A new lint, check_example_portability.py, rejects a direct Zephyr driver include in any example carrying a board.yaml, with an explicit reasoned allowlist for the handful that still have no portable surface to route through — so the boundary holds instead of eroding again.

The GD32 bridge OTA work is the part with silicon behind it. A slot that is not A or B is now rejected rather than silently mapped to slot A; a CRC-valid but truncated image is rejected at commit and before the bootloader jump; the bootloader orders metadata records newest-first and falls back to an older bootable record when the newest fails validation; the host gates OTA on protocol minor 6 or later so a current host cannot corrupt an older bridge; and OTA_BEGIN no longer erases its 236 KB slot synchronously, which used to stall the SPI reply and hang the host. Boot-select, dual-bank erase, and the background-erase path are silicon-validated on the GD32. The bridge also gains ADC oversampling and resolution control, PWM center-aligned mode, and ADC DSP runtime dispatch with a hardware FFT path.

On the tooling side, west alp-quality runs a named gate profile (quick, pr, full, release) and emits a human summary plus JSON, JUnit, and SARIF, with the pr profile selecting exactly the gates CI runs — one definition instead of two that drift. Releases now carry a deterministic CycloneDX SBOM derived from the lockfile with no wall-clock field, alongside a byte-reproducible source tarball, so identical inputs produce identical artifacts. The SDK version is single-sourced in metadata/sdk_version.yaml; README and docs derive it rather than hard-coding a label.

Status is unchanged from v0.9, and worth stating plainly: this cut adds no new silicon-verified SoM family. Two families carry hardware evidence — the E1M-X V2N (GD32 supervisor bridge) and the E1M-AEN801 (Alif Ensemble E8). The GD32 OTA fixes here are validated on V2N silicon for boot-select and the erase paths specifically. The CC3501E companion OTA cold-swap cycle is silicon-proven on the AEN801 EVK, but the E8’s own secure-boot and OTA production chain (MCUboot-slot0) is a separate path and stays bench-pending. i.MX 93, V2M/DEEPX, and the AEN30x–70x parts remain [UNTESTED] on real hardware, and the migrated display examples build clean but are not HiL flash-and-run verified. Budget your own bring-up time on anything outside the two verified families.