feat(perception): stabilize pre-capture methodology

This commit is contained in:
DCCONSTRUCTIONS
2026-07-28 17:47:06 +03:00
parent 1f20e0d7d9
commit d729abab31
65 changed files with 9698 additions and 152 deletions
+19 -1
View File
@@ -3,7 +3,25 @@
This plan supersedes the app-dependent experiment order in the reference Bible.
Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
## Current checkpoint — 2026-07-24
## Architecture stabilization checkpoint — 2026-07-28
| Gate | Current result |
| --- | --- |
| RAVNOVES00 methodology | CORRECTED — E41 proves E37 labels are engineering evidence, not independent truth, and reproduces connected development/evaluation overlap. The 146-row slice is historical evaluated visible validation. |
| Prediction/evaluation boundary | GO — truth-free E41 predictor package/result are physically separate from E37 and reproduce E40 predictions exactly; the visible evaluator runs only after inference. |
| Source-scoped quality | PAUSE — E40 visible engineering evaluation is 84.2466% presence, 84.2466% geometry association and 94.5205% freshness, with 11 high-severity failures, complete accounting and zero false-free claims. This is not a blind accuracy gate. |
| Structural regressions | GO (bounded) — E42 passes predictor identity/order/chunk invariance and PointSlab order/SE(3) checks. Raw-producer and cross-route invariance remain unproved. |
| Native pipeline telemetry | GO for producer/normalizer contract — lifecycle events and JSONL/MQTT sink boundaries exist and an E41 smoke run records real stage accounting. Durable Worker 006 MQTT wiring/deployment remains pending. |
| Evidence storage | MEASURED — E44 finds 525,471,092 logical bytes, 312,753,179 unique-content bytes and 1.680146× amplification across 14 E30–E40 roots. Exact-content references/deduplication precede any format migration. |
| Future transfer | PREREGISTERED — E43 freezes same-K1/mount/calibration/firmware, required streams, connected-component split and independent label reveal. Capture and labels do not yet exist. |
| Product interface | DEFERRED — no new windows, page anatomy or design changes are part of this stabilization increment. |
The governing decision is
[`ADR 0032`](adr/0032-ravnoves00-methodology-correction-before-transfer.md).
Historical E37–E40 artifacts remain immutable; only the claims made from them
change.
## Earlier checkpoint — 2026-07-24
| Stage | Result |
| --- | --- |
+30 -6
View File
@@ -8,7 +8,8 @@ explainability implemented; L2.6e recorded-source-paced bounded shadow
qualified; E28 complete worker replay accepted; E29 camera-first semantic and
parallel geometry-only replay implemented; E30–E35 source-scoped qualification
accepted; RAVNOVES00 reference-source product maturation active; E36 transfer
deferred by ADR 0030
preregistered and deferred by ADR 0030/0032; E41 methodology boundary, E42
metamorphic checks and E44 amplification audit complete
Scope: passively received real-time K1 point/pose evidence, immutable replay and
future live shadow processing
Explicitly out of scope: K1 firmware modification, a new onboard exporter, new
@@ -652,6 +653,9 @@ to its source session under that audit profile. The transfer replay was not
created. ADR 0030 subsequently deferred TEST007 and E36 as current priorities:
RAVNOVES00 source-scoped quality, product workflow and a reference release
candidate now come first. No new capture is required or authorized by default.
ADR 0032 retains that priority while preregistering the later same-K1/new-route
capture under E43. The protocol is frozen; no capture or labels currently
exist.
The active gates are defined in
`docs/20_RAVNOVES00_REFERENCE_SOURCE_PRODUCT_PLAN.md`.
@@ -719,17 +723,37 @@ allowed to change; E31 determined the E32 profile; E32 determined the E33
runtime input; E32/E33 then bound the E34 layer; E32–E34 then bound E35.
Exact nominal and degradation accounting are closed, so A8 is complete.
R1 perception quality is now measured by two immutable Worker 006 results.
R1 perception quality was initially measured by two immutable Worker 006 results.
E38 established the baseline at 82.2% presence, 81.5% geometry association,
95.2% freshness and 14 high-severity failures. E39 result
`e39-perception-refinement-2fd253940c9d9a2fd3b3237f3f0932f81a9f69741935d793771243d5779af464`
used a fixed package-bound camera + LiDAR feature projection and improved
presence and geometry association to 84.9% while reducing high-severity
failures to 8. Freshness remained above target at 93.2%. Its development
cross-validation exceeded 90% but did not predict the sealed result, so R1
remains open. The next iteration is development-only grouped time/scene
qualification with a source-coordinate-free representation; validation is not
opened for item-level tuning.
cross-validation exceeded 90% but did not predict the evaluated slice, so R1
remains open.
The E41 source audit corrects the meaning of those measurements. E37's
`independent_ground_truth=false` provenance, connected group overlap and
prediction/evaluation co-location mean the 146 cases were historically
evaluated visible engineering labels, not a sealed blind set. E40 package-bound
result
`e40-perception-product-gate-e96eec9fd68c3ffaaee898d46285dd329191267200011680f084c75095b92e9a`
reached 84.2466% presence, 84.2466% geometry association and 94.5205% freshness
with 11 high-severity failures, complete accounting and zero false-free claims.
It remains useful source-scoped engineering evidence and does not close R1.
E41 result
`e41-methodology-audit-703dac176f20843ad6fbb9a1060b199942fba05e3bb34d3e2264ee87c7bfdd96`
reproduces `14` exact-frame, `38` track, `58` fixed-time-block and `59`
connected whole-track-or-scene overlaps. The replacement predictor package and
prediction contain no reference/split/scoring material, reproduce E40
predictions exactly and are evaluated only afterward by
`e41-visible-evaluation-57aa6c8569e8339630406e3c88cd539df13917fb08c1af57f0baae5cdd1069d2`.
E42 adds bounded structural invariants; E44 measures exact-content
amplification; E43 freezes the later independent transfer protocol. ADR 0032
contains the corrected decision boundary and current priority order.
E36 is the first generalization gate. A separate product decision follows:
either keep the result as operator/shadow evidence, or start L5 occupied-space
integration. No LAB in this cycle can enable navigation, commands or safety
+13 -1
View File
@@ -32,12 +32,24 @@ candidate is accepted:
- new perception and product iterations use RAVNOVES00;
- each iteration creates a new immutable LAB and never rewrites an older one;
- TEST007, E36 and new physical collection are deferred, not required gates;
- TEST007 and E36 replay are deferred, not required current gates;
- no agent may initiate or imply a new capture without explicit operator
authorization;
- the active quality target is at least `90%` on each frozen task-level
validation dimension, never one unqualified aggregate accuracy number.
ADR 0032 corrects the present validation meaning. E37's 146-row slice is
historical evaluated visible engineering validation: its labels are not
independent truth and its development/evaluation groups overlap. It remains an
immutable comparison contract, but it cannot close a blind accuracy gate.
Prediction packages must exclude truth, split, severity and scoring material,
and evaluation must join those artifacts only after prediction.
The owner has authorized preparation for a later same-K1/new-route recording,
not agent-initiated collection. E43 freezes that future protocol before data
exists. Until the recording is supplied, no LAB result, metric or transfer
claim is created for it.
This policy is a development priority, not a universality claim. Later
second-source transfer remains required before any cross-route or cross-camera
generalization statement.
@@ -1,8 +1,8 @@
# RAVNOVES00 reference-source product plan
Date: 2026-07-27
Date: 2026-07-28
Status: active
Status: active; methodology corrected by ADR 0032
ADR 0030 makes RAVNOVES00 the sole physical reference source for the current
Mission Core product-maturation cycle. This plan turns that decision into
@@ -24,13 +24,20 @@ missions. Mission Core should answer:
The product is not being designed for adversarial, tactical or continuously
novel environments.
## Acceptance meaning
## Acceptance meaning after source audit
`90%` is a target for reviewed task-level correctness on RAVNOVES00, not a
generic marketing accuracy score.
The next acceptance contract must freeze a validation set before further
tuning and measure at least:
E37 froze a useful source-scoped engineering contract, but E41 proved that its
labels are not independent ground truth and its development/validation rows
share frames, tracks and time/scene components. The existing 146-row slice is
therefore **historical evaluated visible validation**, not a sealed blind set.
Its metrics remain useful for immutable method comparison, but cannot prove
independent perception accuracy.
The next independent acceptance contract must freeze a leakage-free validation
set before labels are revealed and measure at least:
| Dimension | Question | Source-scoped target |
| --- | --- | ---: |
@@ -44,30 +51,35 @@ Targets apply separately. A strong presence score cannot compensate for bad
geometry association or hidden stale evidence.
The reviewed denominator, sampling strata and severity classes must be frozen
before the next tuning cycle. Development items may be used for diagnosis and
changes; sealed validation items may only be used for evaluation. High-impact
before the next independent tuning cycle. Connected scene/track/time components,
not individual item hashes, are the minimum partition unit. Development items
may be used for diagnosis and changes; independent validation labels remain
unavailable to the predictor until frozen predictions exist. High-impact
failures remain blocking even when an aggregate percentage passes.
## Current path
| Gate | Deliverable | Exit |
| --- | --- | --- |
| R0 — acceptance contract | Freeze task ontology, reviewed denominator, development/validation split, metrics, severity and error budget over RAVNOVES00 | Reproducible evaluation with no post-result denominator changes |
| R0 — acceptance methodology | Preserve the E37 visible engineering contract, enforce predictor/evaluator separation and preregister an independent, leakage-free future split | No truth material in the predictor; connected-component split; labels revealed only after frozen prediction |
| R1 — perception quality | Iterate detector, camera↔geometry association, source-time handling and conservative corrections as new immutable LABs | Each task-level validation dimension reaches `>= 90%` or has an explicit bounded exception |
| R2 — temporal product state | Refine current/held/stale/unknown presentation and bounded occupied telemetry without polluting the persistent reconstruction | Stable task-relevant state, closed accounting and deterministic degradation |
| R3 — product workflow | Complete reusable source/LAB selection, method summary, visual evidence, comparison, controls and conclusion templates | A non-expert can understand the run; an engineer can inspect exact provenance and metrics |
| R3 — product workflow | Separate owner-reviewed interface phase; no new windows, page anatomy or design changes in the present stabilization increment | Product brief reviewed separately before implementation |
| R4 — reference release candidate | Replay the complete RAVNOVES00 source through the accepted pipeline at recorded pace with regression, resource and recovery evidence | Source-scoped release decision for the known-location product envelope |
| R5 — later transfer | Record a new route/camera only after explicit operator authorization and run the frozen release candidate unchanged | Generalization decision; no retuning before comparison |
| R5 — later transfer | Under the preregistered E43 protocol, record the same K1 and mount over a new route after explicit operator authorization; freeze predictions before independent labels are revealed | Generalization decision; no retuning before comparison |
R0–R4 are the active path. R5 is intentionally deferred.
R0–R2 and non-UI R4 preparation are the active stabilization path. R3 is
explicitly deferred for separate discussion. R5 has a frozen protocol but no
capture or labels yet.
## Current evidence
R0 is closed by immutable result
E37 created immutable result
`e37-ravnoves-acceptance-01b1efd586f747341c712d82f0907b39436a6f91ae92b1dfae987eca05fd8344`.
It freezes 486 reviewed RAVNOVES00 items as 340 development and 146 sealed
validation cases, with separate presence, geometry-association and freshness
references.
It freezes 486 reviewed RAVNOVES00 items as 340 development and 146 visible
evaluation cases, with separate presence, geometry-association and freshness
references. Its own provenance records `484` engineering-reviewed items, `2`
human exceptions and `independent_ground_truth=false`.
The first R1 measurement is immutable result
`e38-perception-baseline-a272f82988cd9a7e071fad94c3e9fb49daf804fdcca523f853445fd3113a62b1`.
@@ -84,15 +96,59 @@ Its fixed robust three-neighbour refinement used exact camera-crop, LiDAR
shape and projection features and was selected only through five-fold
development cross-validation. Development reached 90.3% presence, 90.6%
geometry association and 96.5% freshness without validation-label access.
Sealed validation reached 84.9%, 84.9% and 93.2% respectively. Accounting
The then-designated validation slice reached 84.9%, 84.9% and 93.2%
respectively. Accounting
remains 100%, false-free claims remain zero and high-severity failures fall
from 14 to 8, but R1 is still not accepted.
The next R1 iteration must address the development-to-validation gap before
adding model complexity: grouped time/scene development folds replace
item-hash folds, and a source-coordinate-free representation is compared under
that harder protocol. No individual E39 validation label may be used for
diagnosis, fitting or selection.
E40 package-bound result
`e40-perception-product-gate-e96eec9fd68c3ffaaee898d46285dd329191267200011680f084c75095b92e9a`
used `89` camera-only development rows over `125` feature dimensions (`90`
variable and `35` constant). Against the already-visible E37 evaluation slice
it reached `84.2466%` presence, `84.2466%` geometry association and
`94.5205%` freshness, with `11` high-severity failures, complete accounting and
zero false-free claims. It does not pass R1.
E41 then audited the implementation and artifacts together. Immutable audit
`e41-methodology-audit-703dac176f20843ad6fbb9a1060b199942fba05e3bb34d3e2264ee87c7bfdd96`
found overlap across `14` exact frames, `38` track identities, `58` fixed
50-frame time blocks and `59` connected whole-track-or-scene groups. It also
proved that E40 prediction and evaluation material were co-located. R0 is
therefore reopened for blind acceptance.
The replacement boundary is executable:
- predictor package
`e41-predictor-package-fb35f42698013c63c6d417fd3b26986e9d3b89d12dce138bab18fe4203d593ad`
contains no reference, split, severity, scoring or truth material;
- prediction result
`e41-predictions-adcc1671de44646145a396d5815e522d6b4257d6ead9ace995761751655b3aac`
reproduces the physical E40 predictions exactly;
- separate visible evaluation
`e41-visible-evaluation-57aa6c8569e8339630406e3c88cd539df13917fb08c1af57f0baae5cdd1069d2`
reproduces the E40 engineering metrics and blockers only after inference.
E42 immutable result
`e42-metamorphic-suite-c358204e0b9e10eea5871e90b7c4fbe2c132f1f6d87074b2c5ffec18eaeebb40`
passes predictor identity, row-order and chunk-boundary invariance, metadata
absence, PointSlab row-order invariance and rigid-coordinate equivariance. It
does not prove raw-producer or cross-route invariance.
E44 immutable audit
`e44-data-amplification-89791978894ec785009e5b76c9325de4d9e910237af57476c9331eb47a8ccca4`
measures `525,471,092` logical bytes versus `312,753,179` unique-content bytes
across 14 admitted E30–E40 roots: `1.680146×` amplification and
`212,717,913` exact duplicate bytes. The immediate storage action is
content-addressed referencing and exact deduplication, not an unmeasured
format/database migration.
E43 immutable protocol
`e43-future-capture-protocol-28f091b9648daffce988d44c183e21f56d77988061630de934f8003fb13701d8`
preregisters the later same-K1/new-route transfer. It requires the same mount,
calibration and firmware; `480–900 s` duration; at least `60 s` control bridge
and `360 s` new route; camera, registered LiDAR, pose and pipeline telemetry;
connected component partitioning; two independent reviewers; and label reveal
only after frozen prediction. No such capture or labels currently exist.
## Experiment rules
@@ -109,15 +165,28 @@ diagnosis, fitting or selection.
7. No run claims universal accuracy, planner fitness, navigation or safety
acceptance merely because its source-scoped target passes.
## Deferred work
## Deferred work and current priority
Until R4 closes, the following are not current blockers:
The current non-UI priority order is:
1. keep E37–E40 status language methodologically honest;
2. make the E41 predictor/evaluator boundary and E42 invariants mandatory
regression checks;
3. wire native pipeline telemetry into durable worker stages without inferring
absent measurements;
4. design exact-content references/deduplication from E44 before any storage
migration;
5. preserve E43 unchanged until the owner supplies the new capture.
The following remain outside the present stabilization increment:
- TEST007 qualification;
- E36 second-source transfer;
- a new physical route or camera capture;
- E36 replay until an admitted source exists;
- initiation of a new physical route/camera capture by an agent;
- second K1 or changed mount generalization;
- open-world and adversarial evaluation.
The existing E36 audit and its Ops card remain retained so transfer work can
resume later without reconstructing history.
The owner may provide a future recording under E43. Until it exists, current
work neither depends on it nor simulates its result. The existing E36 audit and
its Ops card remain retained so transfer work can resume without reconstructing
history.
@@ -22,6 +22,14 @@ The existing Worker 006 containers were renamed in place to
container identities were preserved, so this namespace migration did not restart the
inference or perception runtimes.
The compute-side native pipeline contract is now implemented. It emits
`missioncore.agent-pipeline-telemetry/v1` lifecycle documents through an injected
transport, and the telemetry normalizer preserves source, method, stage and stage-state
identities in the normalized series key. The E41 runner has exercised the JSONL
evidence sink against the immutable predictor package. This proves producer and
normalizer compatibility; it does not claim that the durable Worker 006 process has
been wired to the MQTT sink or deployed with this code.
## Decision
Mission Core treats a compute worker as a configurable **local compute contour**, not as
@@ -188,6 +196,7 @@ subscribe to `mission-core/v1/contours/+/agents/+/+`.
- Mission Core code stays responsible for product semantics and stable API contracts,
not OS-specific metric collection.
- Host, container, network and inference telemetry is stored in the normalized path.
Per-stage LAB processing telemetry remains unavailable until a laboratory worker
publishes the native `runtime` and `pipeline` topic contracts; the UI must keep those
stages explicitly unavailable rather than infer them from aggregate hardware load.
- Per-stage LAB processing telemetry has a native producer contract and an admitted
already-connected MQTT sink. It remains unavailable for a durable worker run until
that worker actually injects the sink and publishes the `pipeline` topic; consumers
must not infer stages from aggregate hardware load.
@@ -0,0 +1,89 @@
# ADR 0032 — RAVNOVES00 methodology correction before transfer
Date: 2026-07-28
Status: accepted for implementation
## Context
E37–E40 produced useful, immutable source-scoped engineering evidence, but the
architecture report was written before the source implementation and artifacts were
audited together. E41 reproduced the exact data lineage and found four methodological
limits:
1. E37 contains `484` engineering-reviewed labels and `2` human exception labels; it
explicitly declares `independent_ground_truth=false`.
2. The nominal `340` development / `146` validation split is not group-independent.
Development and validation overlap by `14` exact frames, `38` track identities,
`58` fixed 50-frame time blocks and `59` connected whole-track-or-scene groups.
3. The E40 worker package co-located prediction inputs with the visible acceptance
rows and split assignments.
4. E38–E40 therefore measure performance against a historically evaluated,
source-scoped engineering contract. They are not blind accuracy gates.
This does not invalidate their physical predictions, closed accounting or conservative
authority. It changes the claim that those artifacts are allowed to support.
## Decision
1. Historical E37–E40 artifacts remain immutable evidence. Their metrics are retained,
but “sealed”, “blind” and independent-accuracy language is removed from current
status.
2. The current `146`-item slice is named **historical evaluated visible validation**.
It may compare immutable methods against the source-scoped engineering contract; it
may not prove independent perception accuracy or cross-route generalization.
3. Prediction and evaluation are physically separated. The E41 predictor package and
result contain no acceptance rows, references, split assignments, severity or
scoring state. The visible evaluator joins predictions to E37 only after inference.
4. Runtime identity records the environment that actually executed a result. A local
run records the repository lock, Python and NumPy identities and is not represented
as a Worker 006 container run.
5. Structural invariants are exercised independently of the visible labels. E42
verifies predictor identity, row-order and chunk-boundary invariance plus PointSlab
row-order invariance and rigid-coordinate equivariance.
6. Native per-stage telemetry is a compute contract. Stages publish
`started/completed/failed`, exact source/method/run identity, duration and accounting
through an injected sink. A JSONL evidence sink and an already-connected MQTT sink
are admitted; no network transport starts implicitly.
7. Current storage work starts with content-addressed references and exact-content
deduplication. E44 measures `1.680146×` amplification across the admitted E30–E40
package/result roots. It does not authorize a storage-format or database migration.
8. The later same-K1 transfer capture is preregistered before collection. E43 freezes
minimum streams, route/control-bridge duration, connected scene/track/time
partitioning, independent human review and truth reveal only after frozen
prediction.
9. Product windows, page anatomy and new design work are outside this stabilization
decision and remain a separate owner review.
## Current immutable evidence
- methodology audit:
`e41-methodology-audit-703dac176f20843ad6fbb9a1060b199942fba05e3bb34d3e2264ee87c7bfdd96`;
- truth-free predictor package:
`e41-predictor-package-fb35f42698013c63c6d417fd3b26986e9d3b89d12dce138bab18fe4203d593ad`;
- truth-free prediction result:
`e41-predictions-adcc1671de44646145a396d5815e522d6b4257d6ead9ace995761751655b3aac`;
- visible engineering evaluation:
`e41-visible-evaluation-57aa6c8569e8339630406e3c88cd539df13917fb08c1af57f0baae5cdd1069d2`;
- metamorphic suite:
`e42-metamorphic-suite-c358204e0b9e10eea5871e90b7c4fbe2c132f1f6d87074b2c5ffec18eaeebb40`;
- preregistered future-capture protocol:
`e43-future-capture-protocol-28f091b9648daffce988d44c183e21f56d77988061630de934f8003fb13701d8`;
- data-amplification audit:
`e44-data-amplification-89791978894ec785009e5b76c9325de4d9e910237af57476c9331eb47a8ccca4`.
## Consequences
- RAVNOVES00 remains the active engineering reference source, but R0 is reopened as an
independent-truth and leakage-free-partition gate.
- E40 does not pass R1: the visible evaluation is `84.2466%` for presence,
`84.2466%` for geometry association and `94.5205%` for freshness, with `11`
high-severity failures, complete accounting and zero false-free claims.
- Further threshold or model tuning against the visible 146 items cannot close the
blind gate. It may only create another explicitly visible engineering comparison.
- Work that does not require a new recording can proceed now: methodology enforcement,
predictor/evaluator separation, invariants, telemetry, exact-content deduplication
design and preregistration.
- A later new-route recording can close an independent transfer question only if the
E43 protocol passes before labels are revealed. Until that capture exists,
cross-route quality remains unknown rather than failed or inferred.