GridTwin-HIL

Every home battery, solar inverter and EV charger is protected by controller software that must cut power within milliseconds of a fault. Testing that software safely needs hardware-in-the-loop rigs that cost tens of thousands of dollars, so small teams test against mocks and find timing bugs in the field. GridTwin-HIL turns a $20 STM32 into an emulated lithium battery and BMS that speaks real Modbus RTU and timestamps the controller's safety trip in hardware, to the microsecond. A real Raspberry Pi runs the controller under test. Meta Muse agents then attack it: an attacker (Muse Spark) designs fault scenarios on the real hardware, a judge (Muse Spark Open, open weights, on Baseten) reproduces each failure and finds the minimal failing case, a fixer (Muse Spark) writes the patch, the judge reviews it, and the orchestrator deploys and re-verifies it on the hardware. Each round attacks the controller as patched by the previous one. Only the hardware decides: a finding without a measured failure is refused in code, the judge can only name a failure its own runs reproduced, and hidden checks the agents never see guard against fixes tuned to the bench. Results: nearly 300 hardware runs. The agents found and fixed four real safety bugs, including a 503 ms deadline miss hidden behind the fixer's own claim (now about 100 ms worst case). After an outside review we added a fail-safe interlock and attacks on the controller itself (kill, freeze, cut wire). The open-weights judge then approved five patches that still hid a classic watchdog bug, and a hidden hardware check rejected all five: that round is honestly left open. Every run, patch and verdict is logged in the repo, with 46 Python tests and 25 firmware checks in CI.