The problem in the field

Every site's spec is prose plus a PDF plus a Teams thread. The installer reads what they can, sets what they remember, and the sign-off is "it shows a picture." Six months later somebody inherits the site and has no way to know what the cameras were supposed to be set to, let alone whether they still are.

Why the usual answers fail

Vendor config tools are per-camera UIs with a screenshot as the record. Bulk tools push settings and don't read them back, so a camera that answers 200 and quietly ignores you looks the same as one that complied. Nothing re-checks the site after the truck leaves, and nothing undoes a bad change.

What I built

Commissioning as code. Desired state lives in specs/*.yaml. A read-only plan shows the live-to-desired diff. The apply runs only after explicit approval, checks its postconditions by reading the camera back, and rolls back if a postcondition fails. A later conformance check compares the site to the spec again. A model can write the spec and explain deviations in plain language; the apply itself is deterministic and does not involve a model.

How it works

Phase 1 covers parameters and PTZ presets, with a JSON handoff and six acceptance tests, including a verify that fails when something changes out of band and a forced-fail rollback. It passed live on a Q6358. Phase 2 deploys AXIS Object Analytics scenarios with merge-by-name and readback, watches events over a TLS WebSocket, reads presets back, and rolls scenarios back on a failed apply. The walk test on August 30 saw one motion event inside a 60-second window on a P3285, and produced this:

handoff   lobby · AXIS P3285-LVE · 2026-08-30
  plan       3 changes   2 params · 1 preset
  apply      approved    postconditions 3/3
  readback   preset "entry"            ok
  event      motion, 1 in 60 s window  ok
  rollback   not needed
  output     handoff/lobby-20260830.json → .pdf
  PASS     installer ________   owner ________

The JSON handoff is the source of truth. The PDF is rendered from it: a PASS or FAIL badge, the device block, the plan, what was applied, any verification failures, rollback status, and signature lines.

Where it stands

Beta, AXIS only, one bench. The quirks it has already caught are the reason readback exists. A Q6358 on OS 12.9 returns 204 for setserverpresetname and never persists the name. A P3285 on OS 12.7 needs --anyauth on ACAP endpoints. The camera clock drifted 17 seconds without NTP, so events are stamped with host time. No integrator has trialed it, and the AXIS OS 13 preview has breaking changes I haven't absorbed yet.

What's next

Put it in front of installers. The kill criterion is written down: three integrators decline, or it cuts the checklist by less than 30 percent, and I stop. The wireless Commissioning Walk may end up living here as one more pin in the same handoff.