Alp SDK v0.16 — Renode is retired, CC3501E firmware v0.3.0 ships OTA_PROMOTE, and Fedora and Rocky hosts get a bootstrap command they can actually run

Alp SDK v0.16 released on 2026-08-23, and its headline is a removal. Renode is retired from the SDK outright under ADR 0022 Amendment 2 (#1502): the tan renode verb, the four pr-renode-* CI workflows and the four hand-maintained copies of the Renode v1.16.1 pin, the Alif Ensemble E8 and Renesas RZ/V2N platform models, the Renode-only test fixtures, and the examples/aen/aen-sim-vision example whose only run path was tan renode. Every live documentation claim goes with them. The ADR itself has a history worth knowing: accepted 2026-08-04, withdrawn 2026-08-07, then re-instated and widened 2026-08-17 — the withdrawal held for ten days and is preserved verbatim in the record rather than rewritten.

What to do instead: build and flash to real hardware with tan build and tan flash, or run a single image headless under native_sim with tan run when it has no cross-core dependency. There is no simulated substitute for the cross-core RPMsg handshake specifically — that must be verified on silicon. The SDK states the cost without softening it: alp-sdk loses its pre-silicon simulator coverage with no replacement planned, and after this change no CI job boots any alp-sdk image on any core. The V2N M33 sci0 console path loses its only automated check. If you were using Renode as a pre-silicon gate, budget bench time to replace it. One thing is deliberately retained: board.yaml keeps diagnostics.sim_console everywhere, because it serves the Alp Studio hardware simulator and never was a Renode concern.

The CC3501E Wi-Fi and BLE companion firmware cuts v0.3.0 on wire protocol 4 — the first published prebuilt blob to carry the OTA_PROMOTE opcode (#1609). It ships signed, with a detached ECDSA-P256/SHA-256 signature and a .sha256, and all six AEN SoM presets now point at it; the superseded v0.2.0 blob stays in the tree rather than being deleted, because it is a published signed artifact people may already hold. The firmware version and the wire-protocol number are two independent counters, and this release exists partly to stop them being conflated. It lands with the bench-found fixes it needed to ship: GET_DIAG_INFO now reports the real Wi-Fi role and heap instead of two fields that lied, the soft-AP no longer runs with the network processor left in its low-power ELP state, WIFI_AP_STOP moved its blocking radio teardown off the SPI interrupt context, wifi connect and wifi ap refuse wpa3 with an empty passphrase instead of silently downgrading to WPA2-PSK, and cc3501e_wifi_connect() stopped debiting a phantom 100 ms on every healthy poll — which had been collapsing a caller-supplied timeout_ms to roughly a third of what was asked.

A Fedora, Rocky or Arch developer running the bootstrap was handed sudo apt-get install -y cmake verbatim, in the machine-readable field the VS Code extension consumes, on a host with no apt-get (#1464). metadata/bootstrap.json now keys prerequisites.install.linux by package manager rather than flat by tool: apt stays required and complete, dnf is new, and pacman deliberately ships no entry at all rather than an unattended pacman -S against a stale sync database — a known way to break an Arch install. Every shipped command was proven by running it in a real container (fedora:42, rockylinux:9, with debian:12 as the control) and confirming the binary landed on PATH, and a new workflow re-runs that proof on every relevant pull request. The dnf map is deliberately incomplete on one entry: the RHEL-derivative default repos carry ninja under no name at all, so no dnf-ecosystem-uniform command exists and none was guessed.

On the inference side, the Cortex-A55 gains a CPU floor via ONNX Runtime — default-off behind ALP_SDK_USE_ORT_CPU and ordered strictly last in backend auto-resolution, so it never displaces DRP-AI3 or DEEPX by accident. A new public accessor, alp_inference_last_invoke_latency_us(), replaces the hand-rolled cycle-counter timing the two in-tree camera-vision harnesses each carried: alp_inference_invoke() now brackets the backend executor in both dispatchers and stores the last successful invoke duration in microseconds. A failed invoke never updates it, and on Zephyr the value saturates rather than wrapping, so ALP_ERR_NOT_READY means only "no successful invoke yet" and never "too slow to report".

Four corrections tighten the AEN flash path, and they are the ones to read if you flash Alif parts. E1M-AEN401 and AEN601 m55_hp board trees still carried the old symmetric slot0, so the planner published a slot0_load_address of 0x802b0000 for an image linked at 0x80010000. Three AEN bench flash scripts wrote MRAM, never read their own verifybin result, and exited 0 on a failed flash. A storage[] entry naming an AEN MRAM sub-region resolved and decorated a Devicetree label the board tree never defines, and the orchestrator now refuses to report status: ok on an unverified flash device label. And on real E8 silicon the on-SoM DP83825 Ethernet PHY answers at MDIO address 0, not the address 1 the devicetree had declared.

The rest of the release is supply-chain and CI hardening. Three workflows spliced externally-chosen GitHub Actions context straight into unguarded run: blocks — a template injection reachable from a fork pull request, since a git branch name may legally contain shell metacharacters — and the gate that now blocks it was widened to cover the actions/github-script script sink as well. Every Action reference is pinned to a commit SHA, with a gate and a bump path so the pins do not rot; every checkout stopped persisting the run token into local git config; every workflow job carries a runtime cap after one lane could hang for six hours; apt-get is time-bounded after a trickling mirror hung CI for roughly eleven hours; and shellcheck widened from the bench scripts to every shipped .sh file. Separately, the design record for the model and edge-AI lifecycle surface lands ahead of the code it plans — two specs and eight implementation plans, design only, published so that roughly 3,800 lines of reasoning stop being reachable only through a 77-file pull request that cannot merge.

Status stays honest and it did not move much. The SDK verification ledger now parses 84 silicon-gated rows: 11 verified, 35 partial, 39 untested, 1 failing. Silicon evidence still covers two SoM families — the E1M-X V2N and the E1M-AEN801 — while i.MX 93, V2M/DEEPX and the AEN30x–70x parts remain [UNTESTED] on real hardware. The ONNX Runtime backend is explicitly not a bench result: the Yocto recipe builds (997 tasks, producing libonnxruntime.so.1.28.0 for cortexa55), but a green build is not a working inference and no SKU has run it on silicon. Alongside this release, the tan build CLI cut v0.6.0 on 2026-08-24 — the release a default install actually produces, since the earlier v0.6.0-rc1 shipped as a GitHub pre-release the installers never resolved. tan v0.6.0 requires alp-sdk v0.16.0 or newer, and pins its planner mirror and vendored fixtures to that release tag rather than to a dev commit for the first time.