feat(perception): audit E36 second-source eligibility

2026-07-27 18:27:40 +03:00
parent b894945344
commit fa20079c9e
9 changed files with 1213 additions and 1 deletions
@@ -0,0 +1,67 @@
+# ADR 0029 — E36 second-source catalog admission
+
+Date: 2026-07-27
+
+Status: accepted; transfer replay blocked by missing source provenance
+
+## Context
+
+E31–E35 are accepted only for the immutable RAVNOVES00 source session. E36 is
+the first transfer gate: the exact accepted profile must run without retuning
+on another real K1 capture. A second recording is not eligible merely because
+it contains a point cloud or can be opened in the viewer. Camera, LiDAR, pose,
+host time, device, calibration and physical mount identities must all be
+bindable to that source.
+
+The local source catalog contains historical recordings, including TEST007.
+Publishing an empty LAB while no source is eligible would confuse a planning
+blocker with an experimental result.
+
+## Decision
+
+1. Source admission is a separate content-addressed audit before any E36 replay.
+2. The admission profile freezes the exact E31–E35 result identities and
+   forbids retuning.
+3. A candidate must be a ready physical K1 source with point cloud, trajectory,
+   video, exact host-time identity and at least 60 seconds of contiguous camera
+   evidence.
+4. Device identity is retained only as irreversible hashes in the redacted
+   inventory.
+5. Calibration and mount evidence must each bind explicitly to the candidate
+   `source_session_id`. A later snapshot from the same scanner and an assumed
+   handheld setup are not substitutes.
+6. Public datasets cannot satisfy this mounted K1 transfer gate.
+7. A blocked audit authorizes neither a new capture nor an E36 LAB
+   publication. Collection remains a separate operator decision.
+8. The audit result has no command, navigation or safety authority.
+
+## Catalog outcome
+
+Immutable audit:
+`e36-source-catalog-audit-c5a7b259f043c0a4f3be38f869af1e675dfaa43743e45fd4f43fac166d07f849`.
+
+Eleven physical source records were audited. TEST007 is the closest candidate:
+it is a ready distinct capture from the same accepted K1, has camera, LiDAR,
+pose and exact host-time evidence, and contains a sealed 2,061-frame camera
+window of approximately 206.073 seconds.
+
+TEST007 is not yet eligible because:
+
+- no calibration identity is bound to the TEST007 source session;
+- no physical mount profile or mount identity is bound to that session.
+
+CAM_REC_TEST also lacks those bindings and its longest contiguous camera window
+is only 22.884 seconds, below the frozen minimum. The remaining sources do not
+contain the required camera modality or accepted physical-source provenance.
+
+## Consequences
+
+- A9 has completed its catalog-admission sub-gate, but E36 transfer remains
+  blocked.
+- The next admissible action is provenance recovery or a new explicit binding
+  artifact for TEST007, based only on primary evidence. It is not threshold
+  tuning and does not rerun E32–E35.
+- If both bindings become available, the same audit can be rerun. Only an
+  eligible result authorizes packaging the frozen E32–E35 transfer replay.
+- Until then, Mission Core publishes no LAB E36 page and claims no
+  generalization beyond RAVNOVES00.