docs(simulation): record S1 target bootstrap and UI gates
This commit is contained in:
DCCONSTRUCTIONS
parent
630d1ae819
commit
e1809ac9e1
|
|
@ -160,6 +160,12 @@ Pause/resume/step/reset/stop are owned by the application service through a
|
|||
worker port. Stock-rover provider specs, target-worker execution and PX4/Gazebo
|
||||
control mapping are still pending factual acceptance.
|
||||
|
||||
Commit `630d1ae` has passed the first D-only `MissionCore-Sim` bootstrap
|
||||
(`20 passed`, no retained test process). The first visible milestone is now
|
||||
split explicitly: UI-0 is a read-only direct run view after real target
|
||||
start/stop/recovery is proven; the top-level Polygon control surface remains
|
||||
gated on S1 command and safety acceptance.
|
||||
|
||||
See the [Polygon product/SRS](docs/12_SIMULATION_POLYGON_PRODUCT_AND_SRS.md),
|
||||
[ADR 0015](docs/adr/0015-simulation-polygon-qualification-boundary.md) and the
|
||||
[SIM S0 worker runbook](docs/runbooks/SIM_S0_AI_WORKER.md).
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
|
|||
| Plugin isolation | GO (laboratory control plane) — vendor backend/frontend and optional scene controls are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process |
|
||||
| K1 application control | GO (physical staged cycle) — after fixing the PCAP-proven `sint64` time field, one explicit UI launch completed all 14 canonical operations on one control session, reached live `SCANNING + project + init_ready`, displayed real points, then one explicit STOP returned K1 to unbound `READY`. No retry or fallback command was sent. Native-project reuse through LixelGO/USB remains an independent verification |
|
||||
| Stage 8 product storage | PAUSE — retention, replication, encryption, capacity monitoring and long-run browser/WASM stress remain deployment gates |
|
||||
| Simulation Polygon | SIM S0 GO; S1A complete; S1B ownership foundation implemented locally — immutable run/journal/command contracts, exact-S0/D-only admission, idempotent application lifecycle, one-active-run authority and PGID process supervision with deterministic shutdown are implemented and tested. Target stock-rover provider specs/execution, PX4 command delivery, telemetry/frames, watchdog/failsafe evidence, navigation/safety acceptance and real actuator authority remain absent |
|
||||
| Simulation Polygon | SIM S0 GO; S1A complete; S1B ownership foundation passed target bootstrap — exact commit `630d1ae` runs inside D-only `MissionCore-Sim` with 20 target tests and zero test-process residue. Target stock-rover provider specs/execution, PX4 command delivery, telemetry/frames, watchdog/failsafe evidence, navigation/safety acceptance and real actuator authority remain absent. UI-0 is planned after target lifecycle; top-level Polygon remains gated |
|
||||
|
||||
USB project copying remains optional ground truth rather than a blocker for the
|
||||
now-verified network path. Owner-operated LixelGO traffic verifies the MQTT
|
||||
|
|
|
|||
|
|
@ -564,6 +564,11 @@ pause/step/reset evidence remain open. The application service's port can be
|
|||
implemented worker-locally without turning SSH or an operator shell into the
|
||||
product data plane.
|
||||
|
||||
The exact commit `630d1ae` has passed the first target bootstrap inside
|
||||
`MissionCore-Sim`: its immutable Git archive was admitted under D, both S1 test
|
||||
modules returned `20 passed`, and no test process residue remained. This proves
|
||||
target executability of the ownership foundation, not the real provider graph.
|
||||
|
||||
### S2
|
||||
|
||||
- Gazebo LiDAR/odometry feed the ROS 2/Nav2 baseline.
|
||||
|
|
@ -600,15 +605,33 @@ Polygon is planned as the seventh top-level bounded context:
|
|||
Center | Fleet | Observation | Polygon | Missions | Data | System
|
||||
```
|
||||
|
||||
Two UI gates are intentionally distinct.
|
||||
|
||||
### UI-0 — early read-only run view
|
||||
|
||||
After target S1B proves persisted start/stop/recovery history, a direct internal
|
||||
run view may expose:
|
||||
|
||||
- run identity, lifecycle and terminal reason;
|
||||
- authoritative clock and current pause/running state;
|
||||
- provider health/process ownership;
|
||||
- qualification events and admitted artifact links;
|
||||
- explicit limitations and gate status.
|
||||
|
||||
UI-0 has no PX4 transport, no control commands and no top-level Polygon
|
||||
navigation claim. It is a development/acceptance surface backed only by the
|
||||
server-owned run repository.
|
||||
|
||||
### UI-1 — top-level Polygon
|
||||
|
||||
Top-level UI implementation begins only after:
|
||||
|
||||
1. this SRS and the clock/frame/authority contracts are accepted;
|
||||
2. S1 backend lifecycle is proven;
|
||||
2. S1 target backend lifecycle and command authority are proven;
|
||||
3. run history is persisted independently of a browser session.
|
||||
|
||||
The future UI may present Scenarios, Run, Control, History, Compare and Report.
|
||||
It cannot own provider processes, bypass authority checks or write directly to
|
||||
PX4.
|
||||
UI-1 may present Scenarios, Run, Control, History, Compare and Report. It cannot
|
||||
own provider processes, bypass authority checks or write directly to PX4.
|
||||
|
||||
## 21. Change control
|
||||
|
||||
|
|
|
|||
|
|
@ -51,8 +51,9 @@ reports easy to misuse.
|
|||
backend is C-backed and currently serves unrelated co-tenants.
|
||||
13. S1 uses exact `px4_msgs` directly. The experimental
|
||||
`px4-ros2-interface-lib` is not a mandatory S1 dependency.
|
||||
14. A top-level Polygon UI is gated on accepted contracts and a proven S1
|
||||
backend lifecycle with persisted run history.
|
||||
14. A read-only direct UI-0 run view may follow proven target S1B lifecycle and
|
||||
persisted history. Top-level Polygon UI and control remain gated on accepted
|
||||
S1 target command/lifecycle behavior.
|
||||
15. Real actuator authority requires a new decision and physical safety gate.
|
||||
16. S0 processes run inside an ephemeral loopback-only Linux network namespace.
|
||||
Micro XRCE-DDS Agent's UDP wildcard bind is acceptable only inside that
|
||||
|
|
@ -147,3 +148,9 @@ namespace creation, live readiness probes, restart-safe PID/start-token
|
|||
reconciliation and Gazebo world-control/PX4 command adapters remain open. The
|
||||
worker port deliberately fixes ownership semantics without prematurely fixing
|
||||
the eventual transport.
|
||||
|
||||
Commit `630d1ae` subsequently passed a D-only `MissionCore-Sim` bootstrap:
|
||||
the exact Git archive SHA was verified, both S1 test modules returned
|
||||
`20 passed`, and the test process-residue record was empty. This accepts target
|
||||
executability of the foundation only; it does not change the open real-provider
|
||||
boundaries above.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,72 @@
|
|||
# SIM S1 target bootstrap — 2026-07-24
|
||||
|
||||
## Result
|
||||
|
||||
`PASS` for the exact S1 source-generation/bootstrap boundary. This proves that
|
||||
the committed S1A/S1B contracts, repository, application service, worker guard
|
||||
and process-supervisor tests execute inside the accepted `MissionCore-Sim`
|
||||
target. It does not accept the stock-rover provider lifecycle, PX4 commands,
|
||||
telemetry, frames, watchdog behavior or S1 as a whole.
|
||||
|
||||
## Exact source generation
|
||||
|
||||
- Mission Core commit: `630d1ae`.
|
||||
- Branch: `feat/simulation-polygon-s1`.
|
||||
- Archive: `NODEDC_MISSION_CORE-s1-630d1ae.tgz`.
|
||||
- Archive SHA-256:
|
||||
`0ca5d3ffb008add6e793428e96b88920fdc65fa8d9982e5018ce7a4e83958dae`.
|
||||
- Source:
|
||||
`/mnt/d/NDC_MISSIONCORE/simulation/source/NODEDC_MISSION_CORE-630d1ae`.
|
||||
- Cache:
|
||||
`/mnt/d/NDC_MISSIONCORE/simulation/cache/mission-core-s1/`.
|
||||
|
||||
The archive was produced with `git archive` from the exact commit and an
|
||||
explicit path set. The pre-existing S0 source and evidence generations were not
|
||||
modified.
|
||||
|
||||
## Target and storage
|
||||
|
||||
- WSL distribution: `MissionCore-Sim`.
|
||||
- Python: `3.12.3`.
|
||||
- Kernel: WSL2 Linux `6.18.33.1-microsoft-standard-WSL2`, x86-64.
|
||||
- Mutable source, cache and evidence: D-only.
|
||||
- D free bytes at bootstrap: `392483127296`.
|
||||
- Evidence:
|
||||
`/mnt/d/NDC_MISSIONCORE/simulation/artifacts/s1/bootstrap/20260724T150000Z-630d1ae`.
|
||||
|
||||
## Validation
|
||||
|
||||
```text
|
||||
PYTHONPATH=src python3 -m pytest -q \
|
||||
tests/test_simulation_s1_run_store.py \
|
||||
tests/test_simulation_s1_orchestrator.py
|
||||
```
|
||||
|
||||
Result:
|
||||
|
||||
```text
|
||||
20 passed in 14.73s
|
||||
```
|
||||
|
||||
The evidence generation retains environment and source identity, target pytest
|
||||
output, source-file SHA-256 values, an empty process-residue record, an evidence
|
||||
digest index and `verdict=pass`.
|
||||
|
||||
## Accepted and open boundaries
|
||||
|
||||
Accepted:
|
||||
|
||||
- exact committed S1 source executes on the target worker;
|
||||
- the D-only source/cache/artifact split is viable;
|
||||
- local process-group tests stop without retained test processes;
|
||||
- S1 requires neither a global Python package install nor Docker.
|
||||
|
||||
Still open:
|
||||
|
||||
- concrete Gazebo/PX4/XRCE/ROS provider specifications;
|
||||
- product-owned loopback target namespace;
|
||||
- real-provider health and deterministic shutdown;
|
||||
- restart-safe PID/start-token reconciliation;
|
||||
- live pause/resume/step/reset;
|
||||
- Ackermann/Differential command mapping;
|
||||
- canonical `VehicleState`, frame conversion and failsafe evidence.
|
||||
Loading…
Reference in New Issue