feat(perception): add bounded reference graph

src/k1link/perception/baseline.py

@@ -19,6 +19,14 @@ REUSE_INVENTORY_SCHEMA: Final = "missioncore.perception-reuse-inventory/v1"
 BASELINE_PROFILE_ID: Final = "m4-ravnoves00-recorded-realtime/v1"
 BASELINE_SOURCE_ID: Final = "RAVNOVES00"
 BASELINE_SESSION_ID: Final = "20260720T065719Z_viewer_live"
+BASELINE_CAMERA_SOURCE_ID: Final = "sensor.camera.right"
+BASELINE_RECORDED_JOB_ID: Final = "recorded-camera-602ac89026ed12978619801d"
+BASELINE_SOURCE_PACK_ID: Final = (
+    "e10-lidar-pack-576c994a6c814e2592dd6240ace3902a5db94843312c759a73ba0c9166157d2b"
+)
+BASELINE_SOURCE_PACK_SHA256: Final = (
+    "0685d24219d8236caf8b7f1685e93f6d6b59e7fd015a768d88a92bbe8b154944"
+)
 
 _SHA256 = re.compile(r"^[a-f0-9]{64}$")
 _EXPECTED_EVIDENCE_ROLES: Final = {
@@ -48,6 +56,19 @@ _EVIDENCE_KEYS: Final = {
     "identity_sha256",
     "file_sha256",
 }
+_SOURCE_KEYS: Final = {
+    "source_id",
+    "session_id",
+    "camera_source_id",
+    "recorded_job_id",
+    "frame_count",
+    "duration_seconds",
+    "frame_rate",
+    "modalities",
+    "camera_stream_sha256",
+    "source_pack_id",
+    "source_pack_artifact_sha256",
+}
 
 
 class BaselineContractError(ValueError):
@@ -90,10 +111,20 @@ def load_m4_baseline(path: Path) -> BaselineProfile:
         raise BaselineContractError("baseline profile identity changed")
 
     source = _object(document.get("source"), "source")
+    _exact_keys(source, _SOURCE_KEYS, "source")
     if source.get("source_id") != BASELINE_SOURCE_ID:
         raise BaselineContractError("M4 source must remain RAVNOVES00")
     if source.get("session_id") != BASELINE_SESSION_ID:
         raise BaselineContractError("M4 source session identity changed")
+    if source.get("camera_source_id") != BASELINE_CAMERA_SOURCE_ID:
+        raise BaselineContractError("M4 camera source identity changed")
+    if source.get("recorded_job_id") != BASELINE_RECORDED_JOB_ID:
+        raise BaselineContractError("M4 recorded job identity changed")
+    if source.get("source_pack_id") != BASELINE_SOURCE_PACK_ID:
+        raise BaselineContractError("M4 source pack identity changed")
+    if source.get("source_pack_artifact_sha256") != BASELINE_SOURCE_PACK_SHA256:
+        raise BaselineContractError("M4 source pack artifact identity changed")
+    _digest(source.get("camera_stream_sha256"), "camera stream digest")
     modalities = _string_array(source.get("modalities"), "source modalities")
     if set(modalities) != {"image", "registered-point-increment", "pose"}:
         raise BaselineContractError("baseline source must bind image, points and pose")
@@ -143,7 +174,7 @@ def verify_m4_baseline(repository_root: Path, profile: BaselineProfile) -> Basel
     """Resolve every immutable evidence document and verify its exact digest."""
 
     root = repository_root.resolve()
-    verified: list[str] = []
+    verified = list(_verify_source_artifacts(root, profile))
     for item in profile.evidence:
         evidence_path = (root / item.relative_path).resolve()
         if root not in evidence_path.parents:
@@ -173,6 +204,62 @@ def verify_m4_baseline(repository_root: Path, profile: BaselineProfile) -> Basel
     )
 
 
+def _verify_source_artifacts(root: Path, profile: BaselineProfile) -> tuple[str, ...]:
+    source = _object(profile.document.get("source"), "source")
+    recorded_job_id = _string(source.get("recorded_job_id"), "recorded job id")
+    camera_source_id = _string(source.get("camera_source_id"), "camera source id")
+    source_pack_id = _string(source.get("source_pack_id"), "source pack id")
+    expected_frames = _integer(source.get("frame_count"), "source frame count")
+    camera_root = (
+        root
+        / ".runtime/compute-jobs"
+        / recorded_job_id
+        / "input/camera"
+        / camera_source_id
+        / "epoch-1"
+    )
+    summary_path = camera_root / "summary.json"
+    index_path = camera_root / "index.jsonl"
+    summary = _read_object(summary_path)
+    if summary.get("schema_version") != "missioncore.camera-recording/v1":
+        raise BaselineContractError("camera recording summary schema changed")
+    if summary.get("source_id") != camera_source_id:
+        raise BaselineContractError("camera recording source identity changed")
+    if summary.get("status") != "complete":
+        raise BaselineContractError("camera recording is incomplete")
+    if _integer(summary.get("media_segment_count"), "camera segment count") != expected_frames:
+        raise BaselineContractError("camera recording frame count changed")
+    if summary.get("stream_sha256") != source.get("camera_stream_sha256"):
+        raise BaselineContractError("camera recording stream digest changed")
+    if _file_sha256(index_path) != summary.get("index_sha256"):
+        raise BaselineContractError("camera recording index digest changed")
+
+    pack_root = root / ".runtime/compute-experiments/e10/lidar-packs" / source_pack_id
+    pack_manifest_path = pack_root / "manifest.json"
+    pack_artifact_path = pack_root / "lidar-pack.npz"
+    pack_manifest = _read_object(pack_manifest_path)
+    if pack_manifest.get("schema_version") != "missioncore.e10-lidar-replay-pack/v1":
+        raise BaselineContractError("source pack schema changed")
+    if pack_manifest.get("pack_id") != source_pack_id:
+        raise BaselineContractError("source pack identity changed")
+    identity = _object(pack_manifest.get("identity"), "source pack identity")
+    if _integer(identity.get("frame_count"), "source pack frame count") != expected_frames:
+        raise BaselineContractError("source pack frame count changed")
+    artifact = _object(pack_manifest.get("artifact"), "source pack artifact")
+    expected_pack_sha = _string(
+        source.get("source_pack_artifact_sha256"),
+        "source pack artifact digest",
+    )
+    if artifact.get("sha256") != expected_pack_sha:
+        raise BaselineContractError("source pack manifest digest changed")
+    if _file_sha256(pack_artifact_path) != expected_pack_sha:
+        raise BaselineContractError("source pack artifact digest changed")
+    return tuple(
+        str(path.relative_to(root))
+        for path in (summary_path, index_path, pack_manifest_path, pack_artifact_path)
+    )
+
+
 def validate_reuse_inventory(path: Path) -> dict[str, object]:
     """Validate the M4 primitive/wrapper split used by architecture tests."""