Add hardware binding spec: OpenWorker Deck (MHS-compatible companion hardware)

[Hdhaidong]

Summary

• Adds docs/hardware-bindings/openworker-deck.md — an integration spec for binding an OpenWorker coworker to the OpenWorker Deck, an MHS-compatible hardware gateway: the agent's hardware connect

• Covers the integration surface only: discovery/registration, the MQTT topic tree (transport, security, both directions), read/write discipline, the physical permission gate, model-call authorization, privacy model, and audit stream

• Adds docs/hardware-bindings/assets/mandatory-auth-gate.svg — an architecture diagram of the mandatory authorization gate (models → hardware gate → local data, signed-output return path, blocked direct paths, audit strip)

• Proposes a docs/hardware-bindings/ convention for MHS-compatible companion hardware — this is the first entry

What the Deck is

Two roles in one device: a desk console that mirrors the coworker's live todo list on a 4″ screen with physical Approve/Deny permission buttons, and an industrial + wireless gateway (Modbus RTU/TCP, CAN/J1939, OBD-II, BLE 5.2, LoRa) that registers bridged devices on the network following the MHS pattern. Agent-agnostic — any MHS-compatible agent can bind. One connect, two directions: the agent reaches down to machines; telemetry and fault codes flow back up.

Companion to #593 (Hardware Repair Companion), whose hardware-link skill describes the agent side of the same MHS pattern; this spec describes the hardware side.

Read/write discipline (short version)

• Reads are safe by default — fault codes, hour meters, sensor values; no approval needed, everything timestamped

• Writes pass a human-pressed button — resets, calibrations, actuator tests; no software authorization path exists

• Never defeats an interlock — safety limits, e-stops, protective stops are never written, in plain-language MHS safety labels

Boundaries

• Integration spec only — product documentation, renders and specification tables stay in the product repository

• Design-stage hardware, EVT target specs; firmware MIT, open source

• MHS is a research preview — the binding degrades gracefully and tracks the spec as it stabilizes

• Independent community project, not affiliated with or endorsed by the OpenWorker project

Test plan

• Markdown renders correctly on GitHub

• SVG diagram renders on GitHub (relative path assets/mandatory-auth-gate.svg)

• Topic tree sketch is consistent with the MHS↔topic mapping described in Add Hardware Repair Companion coworker: appliance & machinery repair with live diagnostics #593's hardware-link skill

• Read/write discipline wording matches MHS plain-language safety label conventions