From a19053dfd47577fb66cc63f605ba29ea2314f6aa Mon Sep 17 00:00:00 2001 From: DCCONSTRUCTIONS Date: Fri, 24 Jul 2026 17:24:26 +0300 Subject: [PATCH] docs(simulation): accept Polygon SIM S0 --- README.md | 18 ++- docs/01_IMPLEMENTATION_PLAN.md | 19 ++- docs/12_SIMULATION_POLYGON_PRODUCT_AND_SRS.md | 15 ++- ...mulation-polygon-qualification-boundary.md | 9 +- ...007_SIM_S0_ACCEPTANCE_20260724.redacted.md | 126 ++++++++++++++++++ 5 files changed, 163 insertions(+), 24 deletions(-) create mode 100644 docs/lab/007_SIM_S0_ACCEPTANCE_20260724.redacted.md diff --git a/README.md b/README.md index 2a4dbe6..648b8fe 100644 --- a/README.md +++ b/README.md @@ -129,16 +129,22 @@ lifecycle, authority, canonical contracts, provenance and reports; Gazebo, PX4 SITL, ROS 2, Nav2 and viewers remain replaceable providers. Simulation, replay, digital twin, HIL and physical shadow keep distinct causal run kinds. -The current implementation is SIM S0 preflight only. Its strict candidate -profile fixes D-only worker placement, loopback ports, process ownership, -Gazebo simulation time and disabled real/direct actuator authority. The doctor -does not install or launch anything and cannot report `GO` without -digest-bound target-worker evidence: +SIM S0 is accepted on the reviewed D-only worker. Its strict profile fixes +loopback-only process isolation, exact provider pins, a 2 ms physics step, +1×/2× RTF/resource budgets and disabled real/direct actuator authority. Two +accepted-profile stock-rover runs and nine digest-bound evidence claims passed; +the target doctor returned `GO`. The doctor remains read-only and a development +host without the private evidence pack still returns `INCOMPLETE`: ```bash -uv run missioncore-sim s0 doctor --json +uv run missioncore-sim s0 doctor \ + --evidence /path/to/private/evidence.yaml \ + --json ``` +This accepts simulation infrastructure, not navigation behavior, safety +behavior, S1 command authority or real actuator control. + See the [Polygon product/SRS](docs/12_SIMULATION_POLYGON_PRODUCT_AND_SRS.md), [ADR 0015](docs/adr/0015-simulation-polygon-qualification-boundary.md) and the [SIM S0 worker runbook](docs/runbooks/SIM_S0_AI_WORKER.md). diff --git a/docs/01_IMPLEMENTATION_PLAN.md b/docs/01_IMPLEMENTATION_PLAN.md index c99921b..522b283 100644 --- a/docs/01_IMPLEMENTATION_PLAN.md +++ b/docs/01_IMPLEMENTATION_PLAN.md @@ -3,7 +3,7 @@ This plan supersedes the app-dependent experiment order in the reference Bible. Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result. -## Current checkpoint — 2026-07-20 +## Current checkpoint — 2026-07-24 | Stage | Result | | --- | --- | @@ -24,7 +24,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result. | Plugin isolation | GO (laboratory control plane) — vendor backend/frontend and optional scene controls are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process | | K1 application control | GO (physical staged cycle) — after fixing the PCAP-proven `sint64` time field, one explicit UI launch completed all 14 canonical operations on one control session, reached live `SCANNING + project + init_ready`, displayed real points, then one explicit STOP returned K1 to unbound `READY`. No retry or fallback command was sent. Native-project reuse through LixelGO/USB remains an independent verification | | Stage 8 product storage | PAUSE — retention, replication, encryption, capacity monitoring and long-run browser/WASM stress remain deployment gates | -| Simulation Polygon | STARTED, NOT ACCEPTED — product/SRS and ADR 0015 define a separate qualification boundary; SIM S0 has a strict candidate D-only/version/clock/port/process profile and read-only doctor. No target-worker evidence, rover run, navigation/safety acceptance or real actuator authority exists | +| Simulation Polygon | SIM S0 GO — dedicated Docker-free D-only worker, exact accepted pins, stock Ackermann PX4/ROS 2/Gazebo telemetry, authoritative clock, pause/2 ms step, 1×/2× RTF/resource baselines, repeated clean lifecycle and all nine digest-bound evidence claims passed target doctor. S1 orchestrator/control, navigation/safety acceptance and real actuator authority remain absent | USB project copying remains optional ground truth rather than a blocker for the now-verified network path. Owner-operated LixelGO traffic verifies the MQTT @@ -129,16 +129,18 @@ The Polygon branch follows and [`ADR 0015`](adr/0015-simulation-polygon-qualification-boundary.md). It does not reorder or weaken the K1 physical-evidence gates in this document. -Its first gate is SIM S0: +Its first gate, SIM S0, is accepted: -- candidate Windows 11/WSL2 Ubuntu 24.04 worker profile; +- exact Windows 11 / dedicated `MissionCore-Sim` WSL2 Ubuntu 24.04 worker + profile; - all mutable runtime bytes physically on D; - ROS 2 Jazzy, Gazebo Harmonic, PX4 v1.17.0, matching `px4_msgs`, Micro XRCE-DDS and Nav2 compatibility; - authoritative Gazebo `/clock`; - loopback port and deterministic process ownership; -- target-worker rover/telemetry/pause/step/stop/resource evidence; -- explicit `GO`, `INCOMPLETE` or `BLOCKED` result. +- target-worker rover/telemetry/pause/2 ms step/1×/2× resource evidence; +- target doctor `GO` for profile SHA-256 + `aeecf5005301db230e1340b85215cbbd862b72974a22b8c43767c28be8453e2f`. The repository doctor is side-effect free: @@ -146,7 +148,10 @@ The repository doctor is side-effect free: uv run missioncore-sim s0 doctor --json ``` -Without admitted target-worker evidence its correct result is `INCOMPLETE`. +Without the exact admitted target-worker evidence its correct result remains +`INCOMPLETE`. S1 starts from the accepted S0 version/storage/time/process +boundary and must add server-owned lifecycle, canonical rover commands, +TTL/watchdog/failsafe evidence and immutable qualification runs. ## Stage 0 — repository and host baseline diff --git a/docs/12_SIMULATION_POLYGON_PRODUCT_AND_SRS.md b/docs/12_SIMULATION_POLYGON_PRODUCT_AND_SRS.md index 9c87498..d2253f0 100644 --- a/docs/12_SIMULATION_POLYGON_PRODUCT_AND_SRS.md +++ b/docs/12_SIMULATION_POLYGON_PRODUCT_AND_SRS.md @@ -52,20 +52,21 @@ accepted navigation behavior, safety behavior or real actuator control. Polygon is now a parallel product branch. As of this document: - P0 architecture and SRS are committed on the Polygon branch; -- SIM S0 has a strict candidate qualification profile and read-only doctor; -- the dedicated D-only worker distribution has been created and the candidate +- SIM S0 has a strict accepted qualification profile and read-only doctor; +- the dedicated D-only worker distribution has been created and the accepted PX4/Gazebo/ROS 2/Nav2 stack has been installed without using Docker; - PX4 v1.17.0 and the stock Ackermann rover have completed repeated factual smoke runs with ROS 2 vehicle status, Gazebo clock and clean shutdown; - the exact accepted-profile generation has passed pause freeze, one 2 ms single-step, 1×/2× speed and structured resource cases; -- the complete digest-bound S0 evidence manifest and final target doctor - verdict are the remaining S0 admission steps; +- all nine digest-bound S0 evidence claims validate and the target doctor + returns `GO` for profile SHA-256 + `aeecf5005301db230e1340b85215cbbd862b72974a22b8c43767c28be8453e2f`; - `actuator_authority=false`; - `navigation_or_safety_accepted=false`. -The doctor must report `INCOMPLETE` until exact worker evidence is supplied. A -repository manifest is never enough for a `GO`. +The doctor reports `GO` only on the matching target with the exact confined +worker evidence. A repository manifest alone remains insufficient. ## 3. Goals @@ -380,7 +381,7 @@ The S0 accepted line is: - Gazebo Harmonic; - PX4 Autopilot v1.17.0; - matching `px4_msgs` v1.17.0 generation; -- Micro XRCE-DDS Agent v2.4.3 candidate; +- Micro XRCE-DDS Agent v2.4.3; - Nav2 Jazzy; - PX4 Gazebo stock rover models. diff --git a/docs/adr/0015-simulation-polygon-qualification-boundary.md b/docs/adr/0015-simulation-polygon-qualification-boundary.md index ff93658..a978f9e 100644 --- a/docs/adr/0015-simulation-polygon-qualification-boundary.md +++ b/docs/adr/0015-simulation-polygon-qualification-boundary.md @@ -2,7 +2,7 @@ ## Status -Accepted for architecture and SIM S0 implementation on 2026-07-24. +Accepted for architecture; SIM S0 qualification returned `GO` on 2026-07-24. Navigation behavior, safety behavior and real actuator authority are not accepted. @@ -76,7 +76,7 @@ reports easy to misuse. The qualification doctor is deliberately read-only: -- `simulation/s0/qualification-profile.yaml` is the candidate stack, +- `simulation/s0/qualification-profile.yaml` is the accepted S0 stack, storage, clock, authority, port and process contract. - `k1link.simulation.s0` strictly validates that contract and optional digest-bound worker evidence. @@ -97,5 +97,6 @@ evidence generation. These scripts are qualification tooling; the S1 Simulation Orchestrator remains the future product lifecycle owner. The doctor reports `INCOMPLETE` until it is running on the reviewed target with -resolved/accepted pins and all required evidence. It cannot infer `GO` from the -repository state. +resolved/accepted pins and all required evidence. On the accepted profile +generation and nine-claim confined evidence set it returned `GO`; it cannot +infer that result from repository state alone. diff --git a/docs/lab/007_SIM_S0_ACCEPTANCE_20260724.redacted.md b/docs/lab/007_SIM_S0_ACCEPTANCE_20260724.redacted.md new file mode 100644 index 0000000..fc8f164 --- /dev/null +++ b/docs/lab/007_SIM_S0_ACCEPTANCE_20260724.redacted.md @@ -0,0 +1,126 @@ +# Lab 007: SIM S0 acceptance + +Date: 2026-07-24 (Europe/Moscow). + +## Scope + +This lab closes the infrastructure qualification gate for Mission Core +Polygon. It validates the exact D-only worker profile, stock PX4 Ackermann +runtime, ROS 2 telemetry, Gazebo time control, 1×/2× resource behavior, +deterministic shutdown and digest-bound evidence admission. + +It does not accept S1 orchestration, rover command behavior, Nav2 navigation, +safety behavior, HIL, physical shadow or real actuator control. +`actuator_authority=false` throughout. + +## Accepted profile + +- profile ID: `ai-worker-px4-gazebo-v1`; +- profile SHA-256: + `aeecf5005301db230e1340b85215cbbd862b72974a22b8c43767c28be8453e2f`; +- evidence tooling commit: + `2548bb57403411ce9c8374151e3bfa34ac0866ee`; +- target: dedicated Docker-free `MissionCore-Sim` WSL2 Ubuntu 24.04 on D; +- all seven component pins: resolved and `accepted`; +- all seven mutable roots: present under `/mnt/d/NDC_MISSIONCORE`; +- disk at final doctor: 365.55 GiB free, above the 300 GiB start and + 200 GiB stop thresholds. + +Exact ROS 2, Gazebo, PX4, `px4_msgs`, PX4 Gazebo model, Micro XRCE-DDS Agent and +Nav2 versions remain recorded in the qualification profile and Lab 006. + +## Accepted runs + +The exact accepted-profile generation produced two immutable runs: + +- `20260724T155000Z-accepted-1x`; +- `20260724T160000Z-accepted-2x`. + +Both runs passed: + +- stock world `rover`, model `rover_ackermann_0`; +- PX4 v1.17.0 and Micro XRCE-DDS session; +- ROS 2 `/fmu/out/vehicle_status_v1`; +- authoritative Gazebo `/clock`; +- loopback-only network namespace; +- pause, single-step and declared speed behavior; +- structured resource baseline; +- clean shutdown with no owned process residue. + +The vehicle stayed disarmed. No actuator command was issued. + +## Time acceptance + +| Case | Pause advance | Single step | Measured RTF | Accepted range | +| --- | ---: | ---: | ---: | ---: | +| 1× | 0 ns | +2,000,000 ns / +1 iteration | 0.981913 | 0.8–1.2 | +| 2× | 0 ns | +2,000,000 ns / +1 iteration | 1.967258 | 1.6–2.4 | + +Gazebo `/clock` is the closed-loop simulation authority. The zero pause +advance and exact 2 ms single-step are observed deltas, not inferred settings. + +## Resource acceptance + +| Metric | 1× | 2× | Contract | +| --- | ---: | ---: | ---: | +| Samples at 500 ms | 15 | 15 | at least 6 | +| Peak owned RSS | 407,629,824 B | 408,756,224 B | at most 2 GiB | +| Peak owned CPU | 101.8% | 169.2% | at most 800% | +| Minimum available WSL RAM | 28,437,897,216 B | 28,662,071,296 B | at least 8 GiB | +| Minimum D free | 392,613,560,320 B | 392,568,233,984 B | at least 200 GiB | +| Maximum swap used | 0 B | 0 B | observed | + +Global GPU context peaked at 13,579 MiB used and 52% utilization in both cases. +Those values include unrelated co-tenants and are intentionally not attributed +to headless S0. + +## Evidence admission + +The private D-only evidence generation contains nine redacted JSON artifacts +and one manifest, approximately 100 KiB total: + +1. worker inventory; +2. D-only physical placement; +3. PX4 stock-rover launch; +4. ROS 2 telemetry; +5. authoritative simulation clock; +6. pause/step/speed; +7. clean stop with no orphans; +8. 1× resource baseline; +9. 2× resource baseline. + +Every manifest entry is `pass`, names a confined regular file and binds its +SHA-256. The manifest binds the accepted profile SHA-256. Failed diagnostic +generations were not reused. + +## Target doctor + +The read-only doctor returned: + +```text +verdict=go +target_host_match=true +profile-contract=pass +authority-contract=pass +clock-contract=pass +port-registry=pass +process-registry=pass +target-host=pass +d-only-storage=pass +disk-budget=pass +version-lock=pass +required-tools=pass +factual-evidence=pass +``` + +The persisted redacted `doctor.json` SHA-256 is +`6a2571bd7af0e85b1345201068ccd4bffa215f84a8a9f62a4357d5dbfa236c6c`. + +## Verdict + +`GO` for SIM S0 infrastructure qualification. + +The next permitted product phase is SIM S1: server-owned start/pause/resume/ +step/reset/stop, immutable `QualificationRun`, canonical Ackermann and +Differential rover commands, TTL/heartbeat/watchdog, stop-on-loss and captured +PX4 failsafe behavior. No real-control permission is created by this verdict.