feat(simulation): add S1 qualification run repository

2026-07-24 17:37:55 +03:00
parent a19053dfd4
commit fc8c81dbc4
8 changed files with 1764 additions and 5 deletions
@@ -24,7 +24,7 @@ Each gate produces evidence and an explicit GO, PAUSE or BLOCKED result.
 | Plugin isolation | GO (laboratory control plane) — vendor backend/frontend and optional scene controls are plugin-owned; manifest/runtime descriptor parity, versioned handshake, lifecycle health and transport correlation fail closed while execution remains in-process |
 | K1 application control | GO (physical staged cycle) — after fixing the PCAP-proven `sint64` time field, one explicit UI launch completed all 14 canonical operations on one control session, reached live `SCANNING + project + init_ready`, displayed real points, then one explicit STOP returned K1 to unbound `READY`. No retry or fallback command was sent. Native-project reuse through LixelGO/USB remains an independent verification |
 | Stage 8 product storage | PAUSE — retention, replication, encryption, capacity monitoring and long-run browser/WASM stress remain deployment gates |
-| Simulation Polygon | SIM S0 GO — dedicated Docker-free D-only worker, exact accepted pins, stock Ackermann PX4/ROS 2/Gazebo telemetry, authoritative clock, pause/2 ms step, 1×/2× RTF/resource baselines, repeated clean lifecycle and all nine digest-bound evidence claims passed target doctor. S1 orchestrator/control, navigation/safety acceptance and real actuator authority remain absent |
+| Simulation Polygon | SIM S0 GO; S1A repository boundary implemented — dedicated Docker-free D-only worker and exact stack/clock/resource evidence are accepted. Typed immutable run identity, lifecycle journal, canonical rover command envelopes, authority/TTL checks, artifact index, reset identity and fail-closed restart recovery are implemented locally. Provider process orchestration, PX4 command delivery, watchdog/failsafe evidence, navigation/safety acceptance and real actuator authority remain absent |

 USB project copying remains optional ground truth rather than a blocker for the
 now-verified network path. Owner-operated LixelGO traffic verifies the MQTT
@@ -150,8 +150,11 @@ uv run missioncore-sim s0 doctor --json

 Without the exact admitted target-worker evidence its correct result remains
 `INCOMPLETE`. S1 starts from the accepted S0 version/storage/time/process
-boundary and must add server-owned lifecycle, canonical rover commands,
-TTL/watchdog/failsafe evidence and immutable qualification runs.
+boundary. Its S1A increment implements server-owned immutable run identity,
+legal lifecycle transitions, canonical rover command envelopes, authority/TTL
+admission, append-only artifacts and restart reconciliation. Process ownership,
+PX4 delivery, heartbeat/watchdog execution and captured failsafe outcomes remain
+the next S1 increments.

 ## Stage 0 — repository and host baseline

@@ -503,6 +503,37 @@ match the exact candidate generation.

 K1, Nav2 and top-level UI do not block S1 backend acceptance.

+#### S1A implementation status
+
+The first S1 increment is implemented in `k1link.simulation.contracts` and
+`k1link.simulation.run_store`:
+
+- the immutable manifest owns run/episode identity, exact scenario/profile
+  digests, Mission Core revision, provider pins, host profile, seed,
+  reproducibility tier, clock domain and fail-closed authority;
+- lifecycle and domain events are stored as exclusive, individually atomic,
+  contiguous records; state is reconstructed by replay and the immutable
+  manifest is never rewritten;
+- only legal lifecycle edges are admitted; terminal history and its artifact
+  index are sealed;
+- Ackermann speed/steering and Differential speed/yaw-rate commands require a
+  positive monotonic sequence, simulation-time expiry and the current authority
+  generation; non-finite values, over-limit TTL, stale generations, direct
+  actuator authority and commands outside `running` fail closed;
+- replay/shadow cannot causally accept commands, while HIL and
+  controller-in-loop admission remain blocked pending a separate safety gate;
+- restart reconciliation marks an active run `failed` with
+  `orchestrator-recovery-interrupted`; it never hides a resume;
+- reset is accepted only after the prior run is terminal and creates a new
+  linked run and episode identity;
+- registered artifacts use confined relative POSIX paths, SHA-256 and
+  append-only sequence records.
+
+The repository root is caller-supplied so unit tests and development remain
+portable. The target Simulation Orchestrator must bind that root under the
+accepted `/mnt/d/NDC_MISSIONCORE` storage boundary; S1 provider orchestration
+and target evidence are not implied by this increment.
+
 ### S2

 - Gazebo LiDAR/odometry feed the ROS 2/Nav2 baseline.
@@ -100,3 +100,28 @@ The doctor reports `INCOMPLETE` until it is running on the reviewed target with
 resolved/accepted pins and all required evidence. On the accepted profile
 generation and nine-claim confined evidence set it returned `GO`; it cannot
 infer that result from repository state alone.
+
+## S1A implementation
+
+`k1link.simulation.contracts` now defines the first product-owned
+`QualificationRun`, provider/authority/artifact provenance, canonical
+Ackermann and Differential rover setpoints, and qualification events.
+`k1link.simulation.run_store` persists them as an immutable manifest plus
+one-file-per-sequence append-only journals. Exclusive creation and file/directory
+fsync prevent partially acknowledged records; loading rejects gaps, identity
+drift, non-regular records and illegal lifecycle history.
+
+The aggregate derives its current state by replay. Terminal runs cannot accept
+new events, commands or artifacts. A restart never silently resumes an active
+run: reconciliation terminates it as `failed` with
+`orchestrator-recovery-interrupted`. Reset requires a terminal parent and
+creates a new linked run/episode. Commands are admitted only for a running
+closed-loop virtual run with the current authority generation and bounded
+simulation-time TTL. Replay/shadow commands, direct actuator authority and
+ungated HIL/controller-in-loop admission fail closed.
+
+This increment proves the local lifecycle/repository contract. It does not yet
+own provider processes, transmit a PX4 setpoint, execute heartbeat/watchdog
+failsafe behavior, or qualify navigation/safety behavior. The target
+orchestrator must place the caller-supplied repository root under the accepted
+D-only worker boundary.