Tested behaviour — HID Amico Biometric Reader¶
What was verified on real hardware. A limitation here belongs to the hardware, not to the adapter — where the panel cannot do something, it is recorded rather than hidden.
These results come from Protequ's behavior tests. They show how closely the adapter matches standard PQ behavior. An adapter is not required to pass them all, so a difference here is a fact to weigh, not proof of a defect.
| Result | Scenarios |
|---|---|
| Could not be tested — hardware missing | 6 |
| deferred_prereq_failed | 6 |
| Does not apply here | 5 |
| Works with a limitation | 2 |
| Works as expected | 15 |
What was checked¶
| Checked | Result | Note |
|---|---|---|
| The adapter connects to the device and reports itself online. | Works | — |
| A command that reaches the device is confirmed, not silently dropped. | Works | — |
| The adapter writes the device clock and the change is observable. | Works | — |
| A reset clears the device tables and re-pushes the whole dataset. | Works | — |
| Restarting the adapter neither duplicates audited history nor re-pushes unchanged data. | With a limitation | After restart: process the adapter reconnects and reaches lifecycle.ready, and the scenario's reject half holds: NO pq.event.access.synchronization.started follows the restart, i.e. the adapter does not auto-resync on process start. The positive half does not: no pq.event.connection.restored is published, and none exists anywhere in the session. That is consistent rather than broken — a killed-and-restarted adapter is a COLD START, and AAT-CROSS-CUTTING-UNIVERSAL-01's own card states that a cold start raises no connection.restored because "restored" asserts a recovery and nothing was lost. restored belongs to UNIVERSAL-02 (link loss), which is a wave-4 physical scenario. |
| A single credential change takes the sync path the device supports. | Works | — |
| Running sync twice with unchanged input is a no-op on the PQ side. | Works | — |
| A credential update is applied in place, not by duplicate. | Works | — |
| A sync never deletes a device address it created or updated in the same batch, so changing one person's credential set updates their existing records instead of destroying them. | Works | — |
| A full synchronization moves the whole owned AAT access dataset and reports the moved identities. | deferred_prereq_failed | — |
| Incremental synchronization after one person changes touches only that person and required dependencies. | deferred_prereq_failed | — |
| Selective synchronization with multiple pending people moves only the selected person. | deferred_prereq_failed | — |
| A schedule-bound grant uploads its time profile to the device (config, distinct from enforcement). | deferred_prereq_failed | — |
| An invalid credential configuration is rejected, not accepted and silently ignored. | deferred_prereq_failed | — |
| A command aimed at a Thing the running adapter does not hold fails fast with a reason. | deferred_prereq_failed | — |
| Importing the device configuration builds a tree matching the physical panel. | Works | — |
| Re-importing does not duplicate Things and preserves reconciled properties. | Works | — |
| A strike release from PQ opens the door momentarily and is confirmed. | With a limitation | — |
| A permanent-open (unlock) command holds the door open until cancelled. | Not tested | — |
| Deadbolt lock/unlock is exposed where the protocol has a real lock actuator. | Not tested | — |
| A momentary remote door open can be repeated without leaving stale door state. | Not tested | — |
| An operator command is confirmed by its paired audited event in the remote form, with attribution. | Not tested | — |
| A remote actuation whose action has a .remote audit variant surfaces as that attributed remote event — no adapter declares it ACK-only. | Not tested | — |
| A protocol message split across transport segments is reassembled before it is parsed. | Not tested | — |
| A command issued while the channel is held exclusively is refused, not deadlocked. | Works | — |
| Arming a partition from PQ arms it and is confirmed by an event. | Not applicable | — |
| Disarming a partition from PQ disarms it and is confirmed by an event. | Not applicable | — |
| A redundant arm on an already-armed partition fails fast, without hanging on a confirming event that cannot come. | Not applicable | — |
| A disarm issued during the exit delay resolves definitely, without an alarm. | Not applicable | — |
| A zone alarm surfaces on the partition the zone belongs to, not only on the zone — even when the device reports the trip against the zone address alone. | Not applicable | — |
| A card captured at the reader becomes that person's credential in PQ. | Works | — |
| A biometric template captured at the reader becomes that person's credential in PQ. | Works | — |
| An enrollment nobody completes leaves no credential behind. | Works | — |
| A template enrolled through PQ works at a device it was not captured on. | Works | — |