Here is a list of all documented files with brief descriptions:

docs
architecture
diagrams
templates
examples
2oo2-cross-comparison
west
process_a.c
process_b.c
process_c.c
2oo2-geographic-redundancy
east
process_a.c	EAST Site - Process A (Vital Channel A - CPU0)
process_b.c	EAST Site - Process B (Vital Channel B - CPU1 / Standby)
process_c.c	EAST Site - Process C (Non-Vital Service Channel)
voter
voter.c	2oo2 Voter - Performs vital voting per site
west
process_a.c
process_b.c
process_c.c
main.c	Multi-Site Geographic Redundancy Example
redundancy_multi_site.c	Multi-Site Redundancy Implementation
redundancy_multi_site.h	Multi-Site 2oo2 Redundancy with Active/Standby Failover
linux-posix-app
main.c	Linux POSIX example application demonstrating RteFramework
qnx-rtos-app
main.c	QNX RTOS example application demonstrating RteFramework
channel_callbacks_example.c	Example: Channel naming and callback-based event handling
channel_configuration_example.c	Example: How users configure channels for online/standby redundancy
geo_distributed_checkpoint_sync.c	Example: two rte_channel_t links (one per "machine"), registered into a rte_voter_t and synchronized via rte_checkpoint (ADR-017, rewired onto rte_voter_t by ADR-025) instead of wall-clock agreement
ipc-pubsub-example.c	IPC Publish-Subscribe Pattern Example
ipc-request-reply-example.c	IPC Request-Reply Pattern Example
vital_channel_dual_transport.c	Example: Voted Channel with Dual Transport (Shared Memory + TCP/IP)
include
rte
app
appmanager
rte_appmanager.h	Application Manager abstraction for RteFramework applications
oal
clocksync
rte_clocksync.h	Pluggable wall-clock synchronization OSAdapter (ADR-017)
flow
rte_flow.h	OS Abstraction Layer - OCORA PI-API-compatible Flow service
fsou
rte_fsou.h	Fail-Safe Output Unit (FSOU) output permission, optional OSAdapter seam (ADR-041, proposed)
ipc
rte_ipc.h	OS Abstraction Layer - Inter-process/inter-task communication service
rte_ipc_pubsub.h	IPC Publish-Subscribe Pattern (one-to-many broadcasting)
rte_ipc_request_reply.h	IPC Request-Reply Pattern (RPC-style communication)
log
rte_log.h	OS Abstraction Layer - Logging/diagnostics service
memory
rte_mem_util.h	Thin, MISRA-visible wrappers over the three raw memory-block primitives (fill/copy/compare) every other Platform_RTE or downstream-application module needs but has no business calling libc's <string.h> directly for - rte_mem_set()/rte_mem_copy()/ rte_mem_compare() are the ONE sanctioned call site for each underlying libc function, so an audit for "does this codebase call libc string/memory functions directly" has exactly one file to check instead of grepping every translation unit for <string.h>. Deliberately NOT a "safe string library" (no strcpy/strcat/strlen-style variable-length text handling) - this framework and every application built on it work in fixed-size buffers throughout (CLAUDE.md: no malloc/free), so the only primitives actually needed are fixed-length block operations
rte_memory.h	OS Abstraction Layer - Static memory reservation service
rte_safe_ptr.h	Safe-pointer wrapper: bounds + NULL + corruption-canary checked access to a raw memory region, so callers never perform raw pointer arithmetic on a buffer directly
mutex
rte_mutex.h	OS Abstraction Layer - Mutual exclusion service
netlink
rte_netlink.h	OS Abstraction Layer - Point-to-point network link service
nvm
rte_nvm.h	OS Abstraction Layer - Non-Volatile Memory service
platform
rte_platform.h	OS Abstraction Layer - Real-time platform configuration service (ADR-035)
protocol
rte_protocol_adapter.h	Communication Protocol Adapter Interface (UDP, TCP, DDS)
random
rte_random.h	OS Abstraction Layer - Cryptographically secure random bytes
reboot
rte_reboot.h	OS Abstraction Layer - Controlled reboot service (ADR-004 section 3)
task
rte_task.h	OS Abstraction Layer - Task/thread scheduling service
timer
rte_timer.h	OS Abstraction Layer - Timer service
redundancy
channel_link
rte_channel.h	A single redundant "channel": an opaque transport handle plus send/receive callbacks, with basic health bookkeeping
channel_service
rte_channel_service.h	Application-facing named channel service
rte_channel_service_flow_osadapter.h	Rte_osadapter_channel_service_t implementation over rte_flow
checkpoint
rte_checkpoint.h	Bounded checkpoint rendezvous for distributed vital channels (ADR-017)
checksum
rte_checksum.h	Checksum and CRC utilities for data integrity in redundant systems
config
rte_redundancy_config.h	Application-level redundancy topology configuration (2oo2 / 2oo2 with redundancy / 2oo3 / NMR), loaded from a small JSON file at startup
cross_comparator
rte_cross_comparator.h	Pairwise comparison between exactly 2 registered rte_channel_t links (ADR-025)
dual
rte_dual_channel.h	"DualChannel" layer of ADR-020: wraps 1..N redundant rte_dual_msgchannel_t links for fault-tolerant, always-send + bounded-ACK-wait delivery
rte_dual_frames.h	Layer-2 (DualChannel-owned) frame kind/header definitions for ADR-020 - shared between rte_dual_channel.h and rte_dual_negotiator.h so both can refer to the same wire structs without either depending on the other (rte_dual_channel_t has no knowledge of rte_dual_negotiator_t at all; the negotiator is the one-directional dependent - see ADR-020 section 3 and this module's own README note on ownership direction)
rte_dual_msgchannel.h	"Channel" layer of ADR-020: one EN 50159-defended message channel over one already-open rte_netlink_handle_t
rte_dual_negotiator.h	Dual state negotiator of ADR-020: decides rte_dual_state_t for both this instance and its peer, driven over an attached rte_dual_channel_t's STATE-frame flow
rte_dual_types.h	Shared enums for the rte_dual module (ADR-020): dual-instance state negotiation and the redundant, EN 50159-defended messaging channel it can run over
election
rte_election.h	N-way election primitive (ADR-039): generalizes rte_dual_negotiator's pairwise older-startup-timestamp-wins tie-break to RTE_REDUNDANCY_CONFIG_MAX_REPLICAS candidates, for the 2oo3/NMR topologies rte_dual_negotiator cannot express
safechannel
rte_safechannel.h	Unified, transport-hiding channel factory (ADR-022)
site_role
rte_site_role.h	Site role service (ADR-040 step 2): the inter-site link, ONLINE/STANDBY negotiation, partner supervision, dispatcher takeover handling, warm-standby snapshot sync and the FAULTED flush - the mechanism the Capella model places in RTE Redundancy Services. The application is a declarative Site Role Client: it supplies its local facts (faulted, single-channel, readiness, A/B sibling) and its state codec, and is told when its role changes. The decision rules are rte_site_role_policy.h
rte_site_role_policy.h	Site-role policy: one pure decision function for "should this channel promote, demote or stay?" and the timing predicates of standby sync, takeover and the both-STANDBY tie-break
state_transfer
rte_state_transfer.h	Declarative registry of application state that must survive a STANDBY -> ONLINE promotion (RCA/OCORA compatibility initiative)
voter
rte_voter.h	N-way voting across registered rte_channel_t links (2oo2/2oo3/NMR)
watchdog
rte_watchdog.h	Watchdog mechanism for detecting system/task hang conditions
utils
buffer
rte_buffer.h	Cross-layer data buffer abstraction (ADR-002)
cast
rte_cast.h	Checked integer casting between all fixed-width types and size_t (ADR-003). Every conversion in the codebase - narrowing, widening, or sign-changing - goes through one of these functions instead of a bare C-style cast
lifecycle
rte_lifecycle.h	Process-wide application setup-phase lock (ADR-026)
notify
rte_notify.h	Fixed-capacity registered-callback list shape (ADR-030)
safestate
rte_safestate.h	Safe-state transitions and checked assertions (ADR-004)
rte_safety_violation.h	Opt-in notification hook for the three new safety primitives (safe pointer, checked integer arithmetic, bounds check): a SEPARATE, dedicated handler from rte_safestate_handler_t (rte_safestate.h) - registering it does not change any of those primitives' own return-code contract (REQ-COMMON-CAST-004/ 005, REQ-OAL-SAFEPTR-001/002) in any way; with no handler registered (the default), nothing about their behavior changes at all
status
rte_status.h	Common status/error codes returned by every Safe API Framework function. Shared across all OS Abstraction Layer (OAL) services
string
rte_string.h	Bounded, checked string manipulation (ADR-006). Replaces strcpy/strcat/sprintf/atoi/strtok-style unbounded operations with checked equivalents built on rte_buffer_t
types
rte_types.h	Common fixed-width types and the caller-owned-storage handle pattern used by every OAL service (see ADR-001, section 3.4)
rte_osadapter
clocksync
rte_osadapter_clocksync.h	OSAdapter interface for clock synchronization
flow
rte_osadapter_flow.h	OSAdapter interface for OCORA PI-API Flow communication
fsou
rte_osadapter_fsou.h	OSAdapter interface for the Fail-Safe Output Unit (FSOU) output permission (ADR-041)
ipc
rte_osadapter_ipc.h	OSAdapter interface for inter-process communication
log
rte_osadapter_log.h	OSAdapter interface for logging and diagnostics
memory
rte_osadapter_memory.h	OSAdapter interface for static memory pool management
mutex
rte_osadapter_mutex.h	OSAdapter interface for mutual exclusion
netlink
rte_osadapter_netlink.h	OSAdapter interface for point-to-point network links
nvm
rte_osadapter_nvm.h	OSAdapter interface for non-volatile memory (NVM)
platform
rte_osadapter_platform.h	OSAdapter interface for real-time platform configuration
random
rte_osadapter_random.h	OSAdapter interface for cryptographically secure random bytes
reboot
rte_osadapter_reboot.h	OSAdapter interface for controlled system reboot
task
rte_osadapter_task.h	OSAdapter interface for task and thread scheduling
timer
rte_osadapter_timer.h	OSAdapter interface for monotonic timers and timestamps
rte_osadapter.h	OS Abstraction Layer - Master OSAdapter Interface
rte_osadapter_socket.h	OS Abstraction Layer - Raw OS Socket Interface for OSAdapters
src
app
appmanager
rte_appmanager.c	Application Manager implementation
core
rte_core_version.c	See rte/core/rte_core_version.h
oal
clocksync
rte_clocksync.c	Implementation of the pluggable clock-sync OSAdapter (ADR-017)
flow
rte_flow.c	Flow service: validates parameters, then dispatches to the OSAdapter registered via rte_osadapter_flow_register() (ADR-005). See rte_netlink.c for the pattern this follows
fsou
rte_fsou.c	Implementation of the optional FSOU output-permission OSAdapter seam (ADR-041)
ipc
rte_ipc.c	IPC service: validates parameters, then dispatches to the OSAdapter registered via rte_osadapter_ipc_register() (ADR-005)
rte_ipc_pubsub.c	IPC Publish-Subscribe implementation
rte_ipc_request_reply.c	IPC Request-Reply implementation
log
rte_log.c	Logging service: dispatches to the OSAdapter registered via rte_osadapter_log_register() (ADR-005). No OSAdapter registered is not an error for this service - see rte_log.h
memory
rte_memory.c	Memory pool service: validates parameters, then dispatches to the OSAdapter registered via rte_osadapter_memory_register() (ADR-005)
rte_safe_ptr.c	See rte_safe_ptr.h for behavior
mutex
rte_mutex.c	Mutex service: validates parameters, then dispatches to the OSAdapter registered via rte_osadapter_mutex_register() (ADR-033)
netlink
rte_netlink.c	Network link service: validates parameters, then dispatches to the OSAdapter registered via rte_osadapter_netlink_register() (ADR-005). See rte_ipc.c for the pattern this follows
nvm
rte_nvm.c	NVM service: validates parameters, then dispatches to the OSAdapter registered via rte_osadapter_nvm_register() (ADR-005)
osadapter
rte_osadapter.c	OS Abstraction Layer - Master OSAdapter and Socket Registration
platform
rte_platform.c	Real-time platform configuration service: validates parameters, then dispatches to the OSAdapter registered via rte_osadapter_platform_register() (ADR-005, ADR-035)
protocol
rte_protocol_adapter.c	Registry and Dispatch for Protocol Adapters
rte_protocol_adapter_tcp.c	Raw TCP ProtocolAdapter Implementation using OSAdapter Sockets
rte_protocol_adapter_udp.c	Raw UDP ProtocolAdapter Implementation using OSAdapter Sockets
random
rte_random.c	Secure random bytes: validates parameters, then dispatches to the OSAdapter registered via rte_osadapter_random_register() (ADR-005)
reboot
rte_reboot.c	Reboot service: dispatches to the OSAdapter registered via rte_osadapter_reboot_register() (ADR-005)
task
rte_task.c	Task service: validates parameters, then dispatches to the OSAdapter registered via rte_osadapter_task_register() (ADR-005)
timer
rte_timer.c	Timer service: validates parameters, then dispatches to the OSAdapter registered via rte_osadapter_timer_register() (ADR-005)
redundancy
channel_link
rte_channel.c	One redundant channel: validates parameters, then dispatches to its configured send/recv callbacks, tracking health as a side effect (ADR-025)
channel_service
rte_channel_service.c	Validation and dispatch for the named channel service
rte_channel_service_flow_osadapter.c	See rte_channel_service_flow_osadapter.h
checkpoint
rte_checkpoint.c	Implementation of the bounded checkpoint rendezvous (ADR-017)
checksum
rte_checksum.c	CRC-64 implementation for data integrity checking
config
rte_redundancy_config.c	See rte_redundancy_config.h
cross_comparator
rte_cross_comparator.c	Pairwise channel comparison (ADR-025): validates parameters, receives from both registered channels, and compares them
dual
rte_dual_channel.c	"DualChannel" layer of ADR-020 - see rte_dual_channel.h
rte_dual_msgchannel.c	"Channel" layer of ADR-020 - see rte_dual_msgchannel.h
rte_dual_negotiator.c	Dual state negotiator of ADR-020 - see rte_dual_negotiator.h
rte_dual_types.c	Diagnostics-only string rendering for the rte_dual module's shared enums (ADR-020)
election
rte_election.c	See rte_election.h
safechannel
rte_safechannel.c	Unified channel factory: opens netlink links internally, wraps rte_dual_channel_t or a rte_voter_t over N rte_channel_t links (ADR-025) - see rte_safechannel.h and ADR-022
site_role
rte_site_role.c	See rte_site_role.h. Moved from RBC_GP's ab_gp_channel_negotiate.c (ADR-040 step 2): same link handling, same frame layout, same decisions, same log text; the application-specific parts (state codec, what a promotion takes over, readiness) are the Site Role Client's callbacks and local facts
rte_site_role_policy.c	See rte_site_role_policy.h. Moved unchanged from RBC_GP's ab_gp_site_role.c and the generic part of ab_gp_standby_policy.c (ADR-040 step 1); only the names changed
state_transfer
rte_state_transfer.c	See rte_state_transfer.h
voter
rte_voter.c	N-way voting engine (ADR-025): validates parameters, dispatches send/receive to every registered healthy channel, and - for receive - groups the responses by mutual agreement and picks the largest group meeting quorum
watchdog
rte_watchdog.c	Real watchdog implementation: a fixed-size pool of watchdog slots, timed via the already-portable rte_timer_now() OAL primitive rather than any new OS-specific timing code of its own (REQ-OAL-COMMON-010: no dynamic allocation)
utils
buffer
rte_buffer.c	Implementation of the cross-layer data buffer abstraction (ADR-002)
cast
rte_cast.c	Generated from ADR-003's template; see rte_cast.h for behavior. Every function widens its input to the int64_t/uint64_t matching the source's signedness, then range-checks against the destination's limit macros before performing the explicit cast
lifecycle
rte_lifecycle.c	Implementation of the process-wide application setup-phase lock - see rte_lifecycle.h
safestate
rte_safestate.c	Implementation of the safe-state transition facility (ADR-004)
rte_safety_violation.c	See rte_safety_violation.h for behavior
status
rte_status.c	Implementation of rte_status_to_string()
string
rte_string.c	Implementation of the bounded string module (ADR-006)