113 lines
5.4 KiB
Markdown
113 lines
5.4 KiB
Markdown
# ADR 0040: Dual-evidence replay threat boundary
|
|
|
|
Date: 2026-08-05
|
|
Status: accepted; representation handling amended by ADR 0041
|
|
|
|
## Context
|
|
|
|
Historical camera-first experiments correctly kept camera semantics separate
|
|
from LiDAR metric support, but the phrase "camera-first" is not an acceptable
|
|
product threat architecture. The RAVNOVES00 camera detector visibly misses some
|
|
unclassified occupied structures, while camera proposals without qualified
|
|
LiDAR support cannot establish metric clearance. Making either sensor a gate for
|
|
the other would discard useful evidence.
|
|
|
|
The portable RAVNOVES00 recording also has no admitted measured vehicle body or
|
|
qualified LiDAR-to-body mount. A recorded threat experiment therefore needs an
|
|
explicit virtual geometry without weakening the physical rig contract in ADR
|
|
0035.
|
|
|
|
The first M4.6 implementation incorrectly treated the instantaneous LiDAR frame
|
|
as the virtual body frame. The K1 calibration proves that camera-forward is near
|
|
LiDAR `-Y`, not `+X`, and the handheld pose contains real roll and pitch. That
|
|
made the replay corridor approximately 90 degrees off the route and rotated the
|
|
SLAM world with the operator's hand. Result `m4-threat-replay-7e1613...` is
|
|
superseded and is not admissible M4.6 evidence.
|
|
|
|
The subsequent result `m4-threat-replay-78a06d...` corrected the body frame but
|
|
still treated each recorded `lio_pcl` message as a complete current scan. ADR
|
|
0041 withdraws that result and adds the missing rolling-map representation
|
|
boundary. The dual-evidence and gravity-stable body-frame decisions below remain
|
|
valid.
|
|
|
|
## Decision
|
|
|
|
Mission Core threat assessment consumes two independent evidence paths:
|
|
|
|
```text
|
|
camera proposals ---------------------> camera-only uncertainty
|
|
| |
|
|
+---- optional association ----+ |
|
|
v v
|
|
LiDAR occupied geometry ----------> LocalObstacleMap ---> ThreatAssessment
|
|
```
|
|
|
|
Neither path is called first:
|
|
|
|
- camera publishes image-space object proposals and optional semantics;
|
|
- LiDAR publishes metric occupied components, including geometry with no class;
|
|
- association enriches evidence but is not an admission gate;
|
|
- current metric geometry may produce `threat` or `not-threat` from corridor
|
|
geometry and bounded relative motion;
|
|
- camera-only, held, expired or otherwise incomplete evidence produces
|
|
`unknown`, never a safe decision;
|
|
- semantic class, detector ID and persistent identity are excluded from the
|
|
threat calculation.
|
|
|
|
M4.6 fixes a versioned replay hypothesis: body length `1.0 m`, width `0.6 m`,
|
|
nominal sensor height `1.25 m`, forward corridor `8 m`, rear margin `0.5 m`,
|
|
lateral clearance `0.2 m` and prediction horizon `5 s`. These values may be used
|
|
only with `replay-simulated` authority. They do not populate or qualify
|
|
`missioncore.rig-geometry/v1`, and they cannot support physical collision,
|
|
navigation, safety or actuation claims.
|
|
|
|
The virtual collision frame is a gravity-stable `base_footprint`, not the
|
|
instantaneous sensor frame:
|
|
|
|
- the K1 vendor SLAM map remains the stable world in which mapped points live;
|
|
- the rolling local-surface model supplies only the vertical ground origin and
|
|
a quality check, not a permanent level-world assumption;
|
|
- forward is the smoothed SLAM trajectory tangent and is independently checked
|
|
against the calibrated camera optical axis;
|
|
- unavailable height, excessive local slope or camera/route disagreement makes
|
|
that frame unqualified instead of silently rotating the corridor;
|
|
- a mounted vehicle replaces this replay-only derivation with one measured,
|
|
rigid `T_body_from_sensor`; the detector, obstacle map and threat policy do not
|
|
change.
|
|
|
|
The sensor may therefore be mounted at a non-level angle or noncentral position
|
|
as long as it is rigid and its one-time body extrinsic is known. Vehicle roll
|
|
and pitch do not corrupt the SLAM map; a future 3D swept-volume planner may use
|
|
`base_link`, while the current 2D corridor remains explicitly tied to
|
|
`base_footprint`.
|
|
|
|
## Evidence and presentation
|
|
|
|
The accepted replay must publish immutable frame, fixture, report and visual
|
|
ledgers. Visual evidence uses the common LAB viewer and reusable renderers:
|
|
|
|
- full recorded camera video with synchronized proposal boxes;
|
|
- exact camera samples with metric range or explicit missing range;
|
|
- synchronized point cloud, occupied cells, virtual body and corridor in 3D and
|
|
plan view;
|
|
- mandatory regression frames `138` and `274`, which exposed the original
|
|
sensor/body-axis failure;
|
|
- mandatory frame `1880`, which exposes loss of occupied structures when a
|
|
registered map increment is mistaken for a complete scan;
|
|
- visible threat/not-threat/unknown and `replay-simulated` authority.
|
|
|
|
Visuals are an inspection surface, not ground truth. Independent object-centric
|
|
labels remain a separate gate.
|
|
|
|
## Consequences
|
|
|
|
- Unclassified concrete, vegetation or road furniture can remain visible to the
|
|
metric path without inventing a semantic label.
|
|
- A camera detection cannot become safe merely because LiDAR support is absent.
|
|
- New detectors and LiDAR geometry providers may replace either side behind the
|
|
existing contracts without changing the threat provider.
|
|
- Physical body/mount qualification and live acceptance remain intentional debt.
|
|
- ADR 0035 remains valid for ownership of semantics, metric support and physical
|
|
rig qualification; this ADR supersedes camera-first wording for the canonical
|
|
product decision graph.
|