Epic: worked example — footprint deltas across Baseline / Minimal / Secure / Hardened #1

Goal

One example repository that shows, in defensible numbers, what SolidSyslog costs on a
realistic secure networked device — and doubles as an integration walk-through. The diff (and
the commit history) between two tags is the tutorial; the committed measurements are the cost.

Target: FreeRTOS + lwIP + mbedTLS + FatFs on QEMU mps2-an385 (Cortex-M3), syslog-ng as the
collector. One target — we sell deltas, not absolute numbers.

Four states (git tags)

Each state is the previous one plus more capability selected from the same platform. Secure
is the recommended target for most CRA-facing or SL2 devices; Minimal is the cheaper floor;
Hardened is for when more must be proven. SL4 (write-once storage, hardware-held keys) is
platform/hardware, not library code — doc-only.

IEC 62443 certifies systems, not components, and the CRA concerns the whole product. These
examples show how a device contributes to a compliant system's audit-logging story —
guidance, not a guarantee of compliance.

How it's built

• One frozen Baseline. lwIP up, FatFs mounted, mbedTLS linked-but-not-run — the platform
  cost, below the line. SolidSyslog is not present in it.
• The device measures itself — flash, RAM, heap, and per-task stack on the two seams
  SolidSyslog occupies (a log source and a service worker) — and reports
  current − Baseline. A Baseline build reports ~0, which the test suite asserts, guarding
  against drift.
• One capability per commit; infra frozen at Baseline. git diff Baseline..Secure and the
  commit log between are the integration guide. A board-support/infra file changing in a later
  diff means something is wrong.
• One way to run — ./run.sh, the same locally and in CI: fire up the collector, build and
  run under QEMU, and report the measurements plus whatever the collector received.

Tracking

Work is tracked as the sub-issues of this epic. Any gap this surfaces in the library itself
(a missing callback, a needed tunable, a manifest hole) is filed as a normal story on the
solid-syslog board.