A certification program, not a vague protocol claim
Router fleets are not uniform. One CPE may include a strong USP/TR-369 agent. Another may need a firmware package, vendor adapter, or a different management path. ISPAgents treats USP support as a device certification program so vendors and ISPs know exactly which models, firmware versions, and workflows are ready.
The goal is practical: certify what works, document what does not, and avoid selling broad support before the evidence exists.
The two integration paths
- Existing USP agent: ISPAgents validates tenant-prefixed credentials, MQTT topics, broker ACLs, data-model discovery, supported workflows, reconnect, recovery, and UI evidence.
- Agent build or port: ISPAgents assesses firmware access, package support, resource limits, vendor APIs, adapter layers, TR-181 mapping, install, upgrade, and recovery.
If a router cannot run a persistent agent and cannot expose the required local management APIs, it should be marked unsupported for USP instead of forced into an unreliable rollout.
Certification levels
- Integration Ready: the agent connects, authenticates, uses tenant-scoped topics, appears in the right tenant, and has first-contact evidence.
- ISPAgents Certified: inventory, interface visibility, Wi-Fi/AP reads where supported, diagnostics, reconnect, recovery, tenant isolation, and known limitations are proven.
- ISPAgents Advanced Certified: state-changing workflows such as safe Set, reboot, firmware/package actions, telemetry, Bulk Data, or vendor-specific actions are proven with rollback and audit evidence.
The checklist vendors and ISPs should expect
- Intake: vendor, model, product class, hardware revision, firmware range, USP version, transport, workflows, rollback owner, and test window.
- Feasibility: existing agent or port path, broker configuration, CA trust, credential setup, topic configuration, reboot behavior, upgrade behavior, storage, RAM, and persistence.
- Security: tenant-prefixed username, no bare usernames, strict MQTT topic ACLs, cross-tenant rejection, bad-credential logging, and setup-key protection.
- TR-181 mapping: DeviceInfo, Ethernet, IP, Wi-Fi Radio, SSID, AccessPoint, diagnostics, Bulk Data, SoftwareModules, and documented unsupported objects.
- Interoperability: first contact, data-model discovery, online/offline state, interface inventory, Wi-Fi/AP visibility, diagnostics, and recovery from bad credentials.
- Advanced workflows: safe Get, safe Set preview/apply, Operate, reboot, firmware workflow, telemetry, and vendor-specific actions where supported.
- Browser evidence: device list, device detail, data model, security posture, operation queue, and blocked cross-tenant access.
- Canary: one tenant, one router model, narrow scope, monitoring, credential revocation, broker ACL rollback, and support handover.
The certified device matrix
Every supported router should have a matrix row with:
- Vendor.
- Model.
- Product class.
- Firmware range.
- USP agent and version.
- USP version.
- Transport.
- Certification level.
- Supported workflows.
- Known limitations.
- Evidence path.
- Status: red, yellow, or green.
Red means unsupported or blocked. Yellow means pilot only. Green means commercially supported for the listed workflows and firmware range.
What ISPAgents will not promise
ISPAgents should not promise shell or terminal access through USP. USP is a structured device-management protocol, not a generic remote shell.
ISPAgents should also avoid claiming support for every USP-capable router. Support is certified per vendor, model, firmware range, agent version, and workflow.
When to start
Start certification when a vendor, ISP, or hardware partner can provide one of these:
- A router with an existing configurable USP/TR-369 agent.
- OpenWrt, Yocto, vendor Linux, SDK, or package access.
- Lab hardware and firmware images.
- Documentation for local Wi-Fi, interface, diagnostics, firmware, identity, and reboot APIs.
- A support owner who can test recovery and rollback.
The first commercial rollout should remain a controlled canary: one tenant, one router family, one firmware range, and only the workflows already proven in the certification evidence.