Matter IoT Compatibility Guide
Use this skill when implementing, upgrading, reviewing, or certifying Matter
devices, commissioners, controllers, bridges, or SDK integrations. Start with
the quick checks below, then load the reference that matches the work.
Reference index
| Reference |
Topics |
| commissioning-fabrics-security.md |
Setup flows, QR and NFC onboarding, Wi-Fi USD, fabrics, credentials, access control, attestation, and certification boundaries |
| networking-transport-icd.md |
BLE integration, MRP, TCP, discovery, ICD behavior, diagnostics transfer, and network infrastructure |
| data-model-platform-migrations.md |
Data-model API changes, generated code, scenes, endpoint identity, reporting, cluster migrations, and test-harness corrections |
| devices-energy-closures.md |
Vacuums, closures, energy, metering, thermostats, soil measurement, and security sensors |
| cameras-media.md |
Camera certification, streams, WebRTC, Push AV, recording, snapshots, PTZ, chimes, and ICE configuration |
First decide which authority applies
- Treat a Matter specification release as the source of normative behavior and
certification requirements.
- Treat an SDK tag as implementation guidance, migration behavior, generated
code, platform support, and test-harness behavior.
- Do not infer conformance solely from an SDK feature. Confirm requirements in
the authorized specification and test plan.
- When public announcements omit cluster IDs, encodings, conformance language,
state machines, or test vectors, do not invent those details.
- Preserve fallbacks when a feature requires both device and commissioner
support.
Breaking upgrade checks
SDK integrations
- Update
BlePlatformDelegate implementations for removed obsolete methods,
CHIP_ERROR returns, optional BLE-device-event suppression, and BleLayer
state inspection.
- Move APIs formerly under
chip::app::InteractionModel to
chip::app::DataModel; account for the old DataModel abstraction becoming
Provider.
- Remove dependencies on generated event-list-attribute support.
- Convert Python commissionable-node discovery integrations to
asyncio.
- Stop storing or reading PASE verifier bits in
RendezvousParameters.
- Rename source references from
TlsCertificateManagementCluster to
TLSCertificateManagementCluster.
- Regenerate Access Control metadata from XML cluster version 2, not version 3.
- Recheck ESP32 ICD build configuration and camera-generated code when moving
to the later SDK tag.
Security and privacy
- Perform Access Control authorization before checking whether a target exists;
reversing the order leaks protected-target existence.
- During commissioning, allow ecosystems to consult Device Attestation
Certificate revocation lists.
- Do not impose an unconditional ICAC requirement on commissioners where the
operational-credential flow permits a chain without one.
- Update certification-derived discovery checks for TXT-record
T keys and
discriminator subtypes.
Camera integrations
- Treat allocated AV streams as persistent resources.
- Enforce advertised audio/video usage constraints on allocation and
modification.
- Start video with allocated parameters and validate stream modification and
deallocation in the cluster implementation.
- Reject watermark or on-screen-display requests unless the corresponding
capability is advertised.
- Revalidate recording configurations and update Push AV clip-upload ordering
after upgrading.
Commissioning quick reference
Enhanced setup and multipacks
Enhanced Setup Flow lets a commissioner present localized manufacturer terms,
collect consent, return the response to the device, and let the device adjust
functionality. A commissioner that does not support this flow must retain the
manufacturer-application Custom Commissioning Flow fallback.
A single QR payload can describe several devices in a multipack. SDK
commissioners may also receive concatenated QR codes over BLE, and Darwin can
connect using multiple discriminators.
NFC modes are not interchangeable
| Mode |
What NFC carries |
Other transport required? |
| Onboarding tag |
The same onboarding payload represented by QR or numeric setup codes |
Yes, commissioning finishes elsewhere |
| SDK commissioning support |
SetupPayload support, power-state indication, and platform commissioning management |
Depends on the implemented SDK path |
| Bidirectional commissioning |
The full commissioning exchange, including before full device power |
No |
Do not turn a reverted SDK cherry-pick into released behavior. Check the exact
tag before claiming NFC support.
Wi-Fi-only commissioning
Wi-Fi-only products may commission through Wi-Fi Unsynchronized Service
Discovery when the commissioner supports that path. Do not assume universal
commissioner support or silently remove another viable rendezvous path.
Fabric and credential quick reference
- A controller may restore itself from an already stored fabric without
resupplying its NOC chain.
- Joint Commissioning groundwork includes a Joint Commissioning Window, ICAC
CSR issuance, cross-signing scaffolding, Joint Fabric status, and device
Joint Fabric mode.
- Joint Fabric administration lets cooperating controllers share one fabric
identity and one device fabric-table slot through coordinated common state.
- Do not invent the common datastore protocol or its failure semantics where
public material does not define them.
- PSA integrations may use backed SPAKE2+ and persistent ICD server keys.
- Operational Credentials support includes Vendor ID verification payloads and
signer certificates.
Network and transport quick reference
- Account for the longer default Thread MRP retry interval and MRP use during
Wi-Fi PAF commissioning; use analytics hooks when diagnosing retries.
- Control TCP server listening separately from other TCP behavior.
- Keep accepted server connections alive, close a connection on oversized
input, and avoid advertising IPv4 when IPv4 and IPv6 ports differ.
- Use TCP for large messages, camera image data, and faster firmware transfer
where the platform supports it.
- Treat ESP TCP enablement as an SDK backport rather than proof of universal
platform support.
- For continuous operational discovery, do not stop MinMDNS browsing after the
first result.
ICD quick reference
- Handle check-in at boot, persistent-subscription checks, check-in backoff, and
the updated
ICDManager interface.
- Expose active-mode duration, active-mode threshold, and idle-mode duration to
applications where supported.
- Use the maximum applicable
IdleModeDuration returned by the SDK getter.
- For a LIT ICD server, subscription loss triggers a check-in attempt in
addition to the normal lifecycle.
Data-model quick reference
DataModel::Provider supports invokes and endpoint device-type reporting.
- Bridged-device
KeepActive information includes StayActiveDuration.
- Node capability changes caused by firmware or user action can notify
controllers to re-evaluate configuration without recommissioning.
- Persistent endpoint unique IDs survive recommissioning and do not depend on
the administrator.
- Quieter Reporting suppresses unnecessary intermediate or unchanged values
across additional attributes and device types.
- Use
ServerClusterShim and optional-attribute abstractions for incremental
migration from legacy generated clusters to ServerClusterInterface.
Device-feature quick reference
Robot vacuums
Use the dedicated operational states and errors. Recheck sequential-command and
job-transition behavior against the authorized state machine.
Closures
Model reusable sliding, rotating, and opening motions with single-panel,
dual-panel, or nested mechanisms. SDK closure commands include stop, step,
set-target, move-to, and dimension control; round targets to declared
resolution and enforce secure-state and latching constraints.
Energy and metering
Distinguish electrical-energy tariff distribution from commodity-metering
server implementations. Support state-of-charge reporting and bidirectional
charging only when the relevant device behavior is implemented and certifiable.
Thermostats
Thermostat Suggestions may be evaluated against preferences, demand-response
commitments, manual changes, and other context. Presets may be time-bounded, and
declined suggestions can return standardized explanations.
Camera quick reference
- Camera capability includes two-way WebRTC media, local and remote access,
STUN/TURN traversal, multiple streams, PTZ, privacy and detection zones, and
local or cloud recording.
- One structured session can carry multiple independently optimized audio and
video streams for recording, display, analysis, or separate lenses.
- Snapshot delivery can use HEIC; recorded-video uploads can use HLS or DASH
through CMAF Interface-2.
- Represent installations whose PTZ home lies at an edge of the rotation range.
- Let controllers select a chime rather than always triggering the default;
account for clarified intercom signaling and integrated chimes.
- Install parsed ICE server configuration through
PeerConnection where the
SDK provides that path.
Upgrade workflow
- Identify the normative Matter release and the exact SDK tag independently.
- Locate each changed API, generated cluster, platform delegate, and test
script used by the project.
- Regenerate code where XML, ranges, command behavior, or cluster versions
changed.
- Preserve capability negotiation and fallback paths for commissioners,
transports, media features, and optional overlays.
- Add negative tests for access-control ordering, invalid recording
combinations, unsupported overlays, oversized TCP messages, and closure
safety constraints.
- Re-run certification tests against the matching authorized test plan.
- Use the topic references for the detailed behavior behind each check.
1---2name: matter-iot-knowledge-patch-23description: Matter (IoT)4license: MIT5---678# Matter IoT Compatibility Guide910Use this skill when implementing, upgrading, reviewing, or certifying Matter11devices, commissioners, controllers, bridges, or SDK integrations. Start with12the quick checks below, then load the reference that matches the work.1314## Reference index1516| Reference | Topics |17| --- | --- |18| [commissioning-fabrics-security.md](references/commissioning-fabrics-security.md) | Setup flows, QR and NFC onboarding, Wi-Fi USD, fabrics, credentials, access control, attestation, and certification boundaries |19| [networking-transport-icd.md](references/networking-transport-icd.md) | BLE integration, MRP, TCP, discovery, ICD behavior, diagnostics transfer, and network infrastructure |20| [data-model-platform-migrations.md](references/data-model-platform-migrations.md) | Data-model API changes, generated code, scenes, endpoint identity, reporting, cluster migrations, and test-harness corrections |21| [devices-energy-closures.md](references/devices-energy-closures.md) | Vacuums, closures, energy, metering, thermostats, soil measurement, and security sensors |22| [cameras-media.md](references/cameras-media.md) | Camera certification, streams, WebRTC, Push AV, recording, snapshots, PTZ, chimes, and ICE configuration |2324## First decide which authority applies2526- Treat a Matter specification release as the source of normative behavior and27 certification requirements.28- Treat an SDK tag as implementation guidance, migration behavior, generated29 code, platform support, and test-harness behavior.30- Do not infer conformance solely from an SDK feature. Confirm requirements in31 the authorized specification and test plan.32- When public announcements omit cluster IDs, encodings, conformance language,33 state machines, or test vectors, do not invent those details.34- Preserve fallbacks when a feature requires both device and commissioner35 support.3637## Breaking upgrade checks3839### SDK integrations4041- Update `BlePlatformDelegate` implementations for removed obsolete methods,42 `CHIP_ERROR` returns, optional BLE-device-event suppression, and `BleLayer`43 state inspection.44- Move APIs formerly under `chip::app::InteractionModel` to45 `chip::app::DataModel`; account for the old `DataModel` abstraction becoming46 `Provider`.47- Remove dependencies on generated event-list-attribute support.48- Convert Python commissionable-node discovery integrations to `asyncio`.49- Stop storing or reading PASE verifier bits in `RendezvousParameters`.50- Rename source references from `TlsCertificateManagementCluster` to51 `TLSCertificateManagementCluster`.52- Regenerate Access Control metadata from XML cluster version 2, not version 3.53- Recheck ESP32 ICD build configuration and camera-generated code when moving54 to the later SDK tag.5556### Security and privacy5758- Perform Access Control authorization before checking whether a target exists;59 reversing the order leaks protected-target existence.60- During commissioning, allow ecosystems to consult Device Attestation61 Certificate revocation lists.62- Do not impose an unconditional ICAC requirement on commissioners where the63 operational-credential flow permits a chain without one.64- Update certification-derived discovery checks for TXT-record `T` keys and65 discriminator subtypes.6667### Camera integrations6869- Treat allocated AV streams as persistent resources.70- Enforce advertised audio/video usage constraints on allocation and71 modification.72- Start video with allocated parameters and validate stream modification and73 deallocation in the cluster implementation.74- Reject watermark or on-screen-display requests unless the corresponding75 capability is advertised.76- Revalidate recording configurations and update Push AV clip-upload ordering77 after upgrading.7879## Commissioning quick reference8081### Enhanced setup and multipacks8283Enhanced Setup Flow lets a commissioner present localized manufacturer terms,84collect consent, return the response to the device, and let the device adjust85functionality. A commissioner that does not support this flow must retain the86manufacturer-application Custom Commissioning Flow fallback.8788A single QR payload can describe several devices in a multipack. SDK89commissioners may also receive concatenated QR codes over BLE, and Darwin can90connect using multiple discriminators.9192### NFC modes are not interchangeable9394| Mode | What NFC carries | Other transport required? |95| --- | --- | --- |96| Onboarding tag | The same onboarding payload represented by QR or numeric setup codes | Yes, commissioning finishes elsewhere |97| SDK commissioning support | `SetupPayload` support, power-state indication, and platform commissioning management | Depends on the implemented SDK path |98| Bidirectional commissioning | The full commissioning exchange, including before full device power | No |99100Do not turn a reverted SDK cherry-pick into released behavior. Check the exact101tag before claiming NFC support.102103### Wi-Fi-only commissioning104105Wi-Fi-only products may commission through Wi-Fi Unsynchronized Service106Discovery when the commissioner supports that path. Do not assume universal107commissioner support or silently remove another viable rendezvous path.108109## Fabric and credential quick reference110111- A controller may restore itself from an already stored fabric without112 resupplying its NOC chain.113- Joint Commissioning groundwork includes a Joint Commissioning Window, ICAC114 CSR issuance, cross-signing scaffolding, Joint Fabric status, and device115 Joint Fabric mode.116- Joint Fabric administration lets cooperating controllers share one fabric117 identity and one device fabric-table slot through coordinated common state.118- Do not invent the common datastore protocol or its failure semantics where119 public material does not define them.120- PSA integrations may use backed SPAKE2+ and persistent ICD server keys.121- Operational Credentials support includes Vendor ID verification payloads and122 signer certificates.123124## Network and transport quick reference125126- Account for the longer default Thread MRP retry interval and MRP use during127 Wi-Fi PAF commissioning; use analytics hooks when diagnosing retries.128- Control TCP server listening separately from other TCP behavior.129- Keep accepted server connections alive, close a connection on oversized130 input, and avoid advertising IPv4 when IPv4 and IPv6 ports differ.131- Use TCP for large messages, camera image data, and faster firmware transfer132 where the platform supports it.133- Treat ESP TCP enablement as an SDK backport rather than proof of universal134 platform support.135- For continuous operational discovery, do not stop MinMDNS browsing after the136 first result.137138## ICD quick reference139140- Handle check-in at boot, persistent-subscription checks, check-in backoff, and141 the updated `ICDManager` interface.142- Expose active-mode duration, active-mode threshold, and idle-mode duration to143 applications where supported.144- Use the maximum applicable `IdleModeDuration` returned by the SDK getter.145- For a LIT ICD server, subscription loss triggers a check-in attempt in146 addition to the normal lifecycle.147148## Data-model quick reference149150- `DataModel::Provider` supports invokes and endpoint device-type reporting.151- Bridged-device `KeepActive` information includes `StayActiveDuration`.152- Node capability changes caused by firmware or user action can notify153 controllers to re-evaluate configuration without recommissioning.154- Persistent endpoint unique IDs survive recommissioning and do not depend on155 the administrator.156- Quieter Reporting suppresses unnecessary intermediate or unchanged values157 across additional attributes and device types.158- Use `ServerClusterShim` and optional-attribute abstractions for incremental159 migration from legacy generated clusters to `ServerClusterInterface`.160161## Device-feature quick reference162163### Robot vacuums164165Use the dedicated operational states and errors. Recheck sequential-command and166job-transition behavior against the authorized state machine.167168### Closures169170Model reusable sliding, rotating, and opening motions with single-panel,171dual-panel, or nested mechanisms. SDK closure commands include stop, step,172set-target, move-to, and dimension control; round targets to declared173resolution and enforce secure-state and latching constraints.174175### Energy and metering176177Distinguish electrical-energy tariff distribution from commodity-metering178server implementations. Support state-of-charge reporting and bidirectional179charging only when the relevant device behavior is implemented and certifiable.180181### Thermostats182183Thermostat Suggestions may be evaluated against preferences, demand-response184commitments, manual changes, and other context. Presets may be time-bounded, and185declined suggestions can return standardized explanations.186187## Camera quick reference188189- Camera capability includes two-way WebRTC media, local and remote access,190 STUN/TURN traversal, multiple streams, PTZ, privacy and detection zones, and191 local or cloud recording.192- One structured session can carry multiple independently optimized audio and193 video streams for recording, display, analysis, or separate lenses.194- Snapshot delivery can use HEIC; recorded-video uploads can use HLS or DASH195 through CMAF Interface-2.196- Represent installations whose PTZ home lies at an edge of the rotation range.197- Let controllers select a chime rather than always triggering the default;198 account for clarified intercom signaling and integrated chimes.199- Install parsed ICE server configuration through `PeerConnection` where the200 SDK provides that path.201202## Upgrade workflow2032041. Identify the normative Matter release and the exact SDK tag independently.2052. Locate each changed API, generated cluster, platform delegate, and test206 script used by the project.2073. Regenerate code where XML, ranges, command behavior, or cluster versions208 changed.2094. Preserve capability negotiation and fallback paths for commissioners,210 transports, media features, and optional overlays.2115. Add negative tests for access-control ordering, invalid recording212 combinations, unsupported overlays, oversized TCP messages, and closure213 safety constraints.2146. Re-run certification tests against the matching authorized test plan.2157. Use the topic references for the detailed behavior behind each check.