feat(simulation): add S1 qualification run repository

2026-07-24 17:37:55 +03:00
parent a19053dfd4
commit fc8c81dbc4
8 changed files with 1764 additions and 5 deletions
@@ -100,3 +100,28 @@ The doctor reports `INCOMPLETE` until it is running on the reviewed target with
 resolved/accepted pins and all required evidence. On the accepted profile
 generation and nine-claim confined evidence set it returned `GO`; it cannot
 infer that result from repository state alone.
+
+## S1A implementation
+
+`k1link.simulation.contracts` now defines the first product-owned
+`QualificationRun`, provider/authority/artifact provenance, canonical
+Ackermann and Differential rover setpoints, and qualification events.
+`k1link.simulation.run_store` persists them as an immutable manifest plus
+one-file-per-sequence append-only journals. Exclusive creation and file/directory
+fsync prevent partially acknowledged records; loading rejects gaps, identity
+drift, non-regular records and illegal lifecycle history.
+
+The aggregate derives its current state by replay. Terminal runs cannot accept
+new events, commands or artifacts. A restart never silently resumes an active
+run: reconciliation terminates it as `failed` with
+`orchestrator-recovery-interrupted`. Reset requires a terminal parent and
+creates a new linked run/episode. Commands are admitted only for a running
+closed-loop virtual run with the current authority generation and bounded
+simulation-time TTL. Replay/shadow commands, direct actuator authority and
+ungated HIL/controller-in-loop admission fail closed.
+
+This increment proves the local lifecycle/repository contract. It does not yet
+own provider processes, transmit a PX4 setpoint, execute heartbeat/watchdog
+failsafe behavior, or qualify navigation/safety behavior. The target
+orchestrator must place the caller-supplied repository root under the accepted
+D-only worker boundary.