# Lab 007: SIM S0 acceptance

Date: 2026-07-24 (Europe/Moscow).

## Scope

This lab closes the infrastructure qualification gate for Mission Core
Polygon. It validates the exact D-only worker profile, stock PX4 Ackermann
runtime, ROS 2 telemetry, Gazebo time control, 1×/2× resource behavior,
deterministic shutdown and digest-bound evidence admission.

It does not accept S1 orchestration, rover command behavior, Nav2 navigation,
safety behavior, HIL, physical shadow or real actuator control.
`actuator_authority=false` throughout.

## Accepted profile

- profile ID: `ai-worker-px4-gazebo-v1`;
- profile SHA-256:
  `aeecf5005301db230e1340b85215cbbd862b72974a22b8c43767c28be8453e2f`;
- evidence tooling commit:
  `2548bb57403411ce9c8374151e3bfa34ac0866ee`;
- target: dedicated Docker-free `MissionCore-Sim` WSL2 Ubuntu 24.04 on D;
- all seven component pins: resolved and `accepted`;
- all seven mutable roots: present under `/mnt/d/NDC_MISSIONCORE`;
- disk at final doctor: 365.55 GiB free, above the 300 GiB start and
  200 GiB stop thresholds.

Exact ROS 2, Gazebo, PX4, `px4_msgs`, PX4 Gazebo model, Micro XRCE-DDS Agent and
Nav2 versions remain recorded in the qualification profile and Lab 006.

## Accepted runs

The exact accepted-profile generation produced two immutable runs:

- `20260724T155000Z-accepted-1x`;
- `20260724T160000Z-accepted-2x`.

Both runs passed:

- stock world `rover`, model `rover_ackermann_0`;
- PX4 v1.17.0 and Micro XRCE-DDS session;
- ROS 2 `/fmu/out/vehicle_status_v1`;
- authoritative Gazebo `/clock`;
- loopback-only network namespace;
- pause, single-step and declared speed behavior;
- structured resource baseline;
- clean shutdown with no owned process residue.

The vehicle stayed disarmed. No actuator command was issued.

## Time acceptance

| Case | Pause advance | Single step | Measured RTF | Accepted range |
| --- | ---: | ---: | ---: | ---: |
| 1× | 0 ns | +2,000,000 ns / +1 iteration | 0.981913 | 0.8–1.2 |
| 2× | 0 ns | +2,000,000 ns / +1 iteration | 1.967258 | 1.6–2.4 |

Gazebo `/clock` is the closed-loop simulation authority. The zero pause
advance and exact 2 ms single-step are observed deltas, not inferred settings.

## Resource acceptance

| Metric | 1× | 2× | Contract |
| --- | ---: | ---: | ---: |
| Samples at 500 ms | 15 | 15 | at least 6 |
| Peak owned RSS | 407,629,824 B | 408,756,224 B | at most 2 GiB |
| Peak owned CPU | 101.8% | 169.2% | at most 800% |
| Minimum available WSL RAM | 28,437,897,216 B | 28,662,071,296 B | at least 8 GiB |
| Minimum D free | 392,613,560,320 B | 392,568,233,984 B | at least 200 GiB |
| Maximum swap used | 0 B | 0 B | observed |

Global GPU context peaked at 13,579 MiB used and 52% utilization in both cases.
Those values include unrelated co-tenants and are intentionally not attributed
to headless S0.

## Evidence admission

The private D-only evidence generation contains nine redacted JSON artifacts
and one manifest, approximately 100 KiB total:

1. worker inventory;
2. D-only physical placement;
3. PX4 stock-rover launch;
4. ROS 2 telemetry;
5. authoritative simulation clock;
6. pause/step/speed;
7. clean stop with no orphans;
8. 1× resource baseline;
9. 2× resource baseline.

Every manifest entry is `pass`, names a confined regular file and binds its
SHA-256. The manifest binds the accepted profile SHA-256. Failed diagnostic
generations were not reused.

## Target doctor

The read-only doctor returned:

```text
verdict=go
target_host_match=true
profile-contract=pass
authority-contract=pass
clock-contract=pass
port-registry=pass
process-registry=pass
target-host=pass
d-only-storage=pass
disk-budget=pass
version-lock=pass
required-tools=pass
factual-evidence=pass
```

The persisted redacted `doctor.json` SHA-256 is
`6a2571bd7af0e85b1345201068ccd4bffa215f84a8a9f62a4357d5dbfa236c6c`.

## Verdict

`GO` for SIM S0 infrastructure qualification.

The next permitted product phase is SIM S1: server-owned start/pause/resume/
step/reset/stop, immutable `QualificationRun`, canonical Ackermann and
Differential rover commands, TTL/heartbeat/watchdog, stop-on-loss and captured
PX4 failsafe behavior. No real-control permission is created by this verdict.
