feat(perception): add dual evidence replay threat
This commit is contained in:
DCCONSTRUCTIONS
@@ -2,7 +2,7 @@
|
||||
|
||||
Date: 2026-08-05
|
||||
|
||||
Status: in progress; M4.0–M4.5 accepted, M4.6 replay threat is next
|
||||
Status: in progress; M4.0–M4.6 accepted, M4.7 Worker 006 cutover is next
|
||||
|
||||
Audit base: `1b3e0b3` on `feat/simulation-polygon-s1`
|
||||
|
||||
@@ -107,7 +107,7 @@ Those systems remain separate platform workstreams.
|
||||
| Degradation | E35 executes six deterministic full-source variants; maximum recovery is 0.102 s against a 0.25 s gate | Accepted reusable regression primitive |
|
||||
| Recorded pacing | E33 processes all 4,489 frames at 10.006 FPS with depth-two queues, zero replacement/drop/deadline miss and 2.668 ms result-age p95 | Accepted stage runner evidence, not end-to-end perception evidence |
|
||||
| Motion | E51 emits 22,885 bounded motion candidates with complete accounting and no map-frame jump candidate | Candidate implementation exists; moving/static correctness is not accepted |
|
||||
| Threat/collision | E51/E53 intentionally publish collision unavailable because body and LiDAR-to-body geometry are unbound | Replay simulation is possible with an explicit virtual rig; physical threat acceptance remains deferred |
|
||||
| Threat/collision | M4.6 evaluates all 4,489 RAVNOVES00 frames with an explicit 1.0 × 0.6 m virtual body, 1.25 m sensor height and 8 m corridor | Accepted only as `replay-simulated`; physical threat/collision acceptance remains deferred |
|
||||
| Realtime worker | Worker 006 has healthy Triton and persistent perception containers plus live Telegraf | Infrastructure exists |
|
||||
| Worker graph | The persistent process still executes `run_e15_shadow_inference.py serve` with E15/E19/E8/E3/E23 profiles | Open architectural blocker: runtime remains LAB-generation-specific |
|
||||
| Model service | Canonical Triton currently exposes pinned `yolox_s` and `pointpillars`; PointPillars was rejected as a K1 product candidate | Reuse `yolox_s`; do not reopen PointPillars |
|
||||
@@ -425,6 +425,10 @@ Exit:
|
||||
|
||||
### M4.6 — implement replay-only threat assessment
|
||||
|
||||
Status: accepted on 2026-08-05. See the implementation record below and ADR
|
||||
0040. The virtual dimensions are a replay hypothesis, not a retroactive physical
|
||||
rig measurement.
|
||||
|
||||
Deliverables:
|
||||
|
||||
- define a versioned virtual rig and corridor profile for RAVNOVES00 replay;
|
||||
@@ -613,7 +617,7 @@ Milestone 4 is complete only when all of the following are true:
|
||||
contract.
|
||||
- [ ] Current, held, stale, unavailable and conflict states are explicit.
|
||||
- [ ] Moving/static/unknown state is measured without semantic-class dependence.
|
||||
- [ ] Replay-only threat assessment is explicit and cannot claim physical authority.
|
||||
- [x] Replay-only threat assessment is explicit and cannot claim physical authority.
|
||||
- [ ] Worker 006 runs the canonical graph instead of the E15-specific server.
|
||||
- [ ] Full source-paced replay, deterministic replay, degradation, recovery and
|
||||
soak gates pass.
|
||||
@@ -908,8 +912,56 @@ canonical temporal or motion bytes.
|
||||
|
||||
All fifteen M4.5 acceptance requirements are true. Synthetic tests cover ID and
|
||||
semantic-hint changes, moving, stationary, held, expiry, camera-only uncertainty
|
||||
and map-frame discontinuity. M4.5 is closed; M4.6 replay-only threat assessment
|
||||
is the next implementation phase.
|
||||
and map-frame discontinuity. This closed M4.5 and supplied the immutable input to
|
||||
the following M4.6 replay-only threat phase.
|
||||
|
||||
### 2026-08-05 — M4.6 dual-evidence replay threat
|
||||
|
||||
M4.6 is closed by `k1link.perception.threat` and the immutable replay builder in
|
||||
`k1link.perception.threat_replay`:
|
||||
|
||||
- `DualEvidenceReplayThreatProvider` consumes the canonical `LocalObstacleMap`;
|
||||
it does not select camera-first or LiDAR-first execution;
|
||||
- current LiDAR metric components are eligible for corridor assessment even when
|
||||
they have no semantic class or camera association;
|
||||
- camera-only observations and held/expired metric evidence publish `unknown`,
|
||||
never `not-threat`;
|
||||
- semantic hint and ephemeral detector/component identity do not participate in
|
||||
corridor intersection, closest approach or TTC;
|
||||
- the versioned replay profile fixes a virtual `1.0 × 0.6 m` body, nominal
|
||||
`1.25 m` sensor height, `8 m` forward corridor and `5 s` bounded prediction
|
||||
horizon; all documents retain `replay-simulated`, physical-collision false and
|
||||
actuation false authority.
|
||||
|
||||
The accepted immutable result is
|
||||
`m4-threat-replay-7e1613a3ea35638b5ea7a3f7c1c78fe9eba1a3adae540b652dec167f815d45b2`:
|
||||
|
||||
- `4,489 / 4,489` frames completed, zero failed;
|
||||
- `27,299` current metric, `37,995` stale/held and `10,158` camera-only evidence
|
||||
publications were each assessed exactly once;
|
||||
- decisions: `8,010 threat`, `6,610 not-threat`, `60,832 unknown`;
|
||||
- `21,958` geometry-only assessments remained in the decision path without a
|
||||
class requirement;
|
||||
- deterministic fixtures passed `9 / 9`; all four critical fixtures avoided a
|
||||
false `not-threat` outcome;
|
||||
- local uncapped execution measured `132.812 FPS`; provider latency was
|
||||
`3.932 ms` p50 and `17.567 ms` p95;
|
||||
- deterministic frame, visual and fixture ledgers are sealed by SHA-256
|
||||
`bf690358efb45c323db7172251074b33c3ef7ede6ae99bd8d3da53cfba86b142`,
|
||||
`fb022c6efd84f27c0916a6c87887443c9b43993ac4b1f9910332433152533dea`
|
||||
and `e217b61f3e8cf444f2620c0d815c18b2131eaafca29352bf12f78e05db96ee13`.
|
||||
|
||||
The standard LAB catalog exposes the exact result with a common evidence viewer:
|
||||
full recorded VIDEO, exact CAMERA samples with ranges/unknown boxes, and the same
|
||||
32 synchronized LiDAR point-cloud samples in interactive 3D and plan view. The
|
||||
recorded box overlay was extracted from E46C into a reusable component rather
|
||||
than copied into an M4-specific renderer. Visual availability is evidence for
|
||||
inspection, not independent ground truth.
|
||||
|
||||
M4.6 does not close moving/static correctness or object-presence correctness;
|
||||
those remain the independent M4.8 gate. It also does not authorize a physical
|
||||
mount, live K1, navigation, collision safety or commands. M4.7 is now the next
|
||||
implementation phase.
|
||||
|
||||
## Implementation order
|
||||
|
||||
|
||||
@@ -0,0 +1,75 @@
|
||||
# ADR 0040: Dual-evidence replay threat boundary
|
||||
|
||||
Date: 2026-08-05
|
||||
Status: accepted and implemented for M4.6
|
||||
|
||||
## Context
|
||||
|
||||
Historical camera-first experiments correctly kept camera semantics separate
|
||||
from LiDAR metric support, but the phrase "camera-first" is not an acceptable
|
||||
product threat architecture. The RAVNOVES00 camera detector visibly misses some
|
||||
unclassified occupied structures, while camera proposals without qualified
|
||||
LiDAR support cannot establish metric clearance. Making either sensor a gate for
|
||||
the other would discard useful evidence.
|
||||
|
||||
The portable RAVNOVES00 recording also has no admitted measured vehicle body or
|
||||
qualified LiDAR-to-body mount. A recorded threat experiment therefore needs an
|
||||
explicit virtual geometry without weakening the physical rig contract in ADR
|
||||
0035.
|
||||
|
||||
## Decision
|
||||
|
||||
Mission Core threat assessment consumes two independent evidence paths:
|
||||
|
||||
```text
|
||||
camera proposals ---------------------> camera-only uncertainty
|
||||
| |
|
||||
+---- optional association ----+ |
|
||||
v v
|
||||
LiDAR occupied geometry ----------> LocalObstacleMap ---> ThreatAssessment
|
||||
```
|
||||
|
||||
Neither path is called first:
|
||||
|
||||
- camera publishes image-space object proposals and optional semantics;
|
||||
- LiDAR publishes metric occupied components, including geometry with no class;
|
||||
- association enriches evidence but is not an admission gate;
|
||||
- current metric geometry may produce `threat` or `not-threat` from corridor
|
||||
geometry and bounded relative motion;
|
||||
- camera-only, held, expired or otherwise incomplete evidence produces
|
||||
`unknown`, never a safe decision;
|
||||
- semantic class, detector ID and persistent identity are excluded from the
|
||||
threat calculation.
|
||||
|
||||
M4.6 fixes a versioned replay hypothesis: body length `1.0 m`, width `0.6 m`,
|
||||
nominal sensor height `1.25 m`, forward corridor `8 m`, rear margin `0.5 m`,
|
||||
lateral clearance `0.2 m` and prediction horizon `5 s`. These values may be used
|
||||
only with `replay-simulated` authority. They do not populate or qualify
|
||||
`missioncore.rig-geometry/v1`, and they cannot support physical collision,
|
||||
navigation, safety or actuation claims.
|
||||
|
||||
## Evidence and presentation
|
||||
|
||||
The accepted replay must publish immutable frame, fixture, report and visual
|
||||
ledgers. Visual evidence uses the common LAB viewer and reusable renderers:
|
||||
|
||||
- full recorded camera video with synchronized proposal boxes;
|
||||
- exact camera samples with metric range or explicit missing range;
|
||||
- synchronized point cloud, occupied cells, virtual body and corridor in 3D and
|
||||
plan view;
|
||||
- visible threat/not-threat/unknown and `replay-simulated` authority.
|
||||
|
||||
Visuals are an inspection surface, not ground truth. Independent object-centric
|
||||
labels remain a separate gate.
|
||||
|
||||
## Consequences
|
||||
|
||||
- Unclassified concrete, vegetation or road furniture can remain visible to the
|
||||
metric path without inventing a semantic label.
|
||||
- A camera detection cannot become safe merely because LiDAR support is absent.
|
||||
- New detectors and LiDAR geometry providers may replace either side behind the
|
||||
existing contracts without changing the threat provider.
|
||||
- Physical body/mount qualification and live acceptance remain intentional debt.
|
||||
- ADR 0035 remains valid for ownership of semantics, metric support and physical
|
||||
rig qualification; this ADR supersedes camera-first wording for the canonical
|
||||
product decision graph.
|
||||
Reference in New Issue
Block a user