76 lines
3.3 KiB
Markdown
76 lines
3.3 KiB
Markdown
# ADR 0040: Dual-evidence replay threat boundary
|
|
|
|
Date: 2026-08-05
|
|
Status: accepted and implemented for M4.6
|
|
|
|
## Context
|
|
|
|
Historical camera-first experiments correctly kept camera semantics separate
|
|
from LiDAR metric support, but the phrase "camera-first" is not an acceptable
|
|
product threat architecture. The RAVNOVES00 camera detector visibly misses some
|
|
unclassified occupied structures, while camera proposals without qualified
|
|
LiDAR support cannot establish metric clearance. Making either sensor a gate for
|
|
the other would discard useful evidence.
|
|
|
|
The portable RAVNOVES00 recording also has no admitted measured vehicle body or
|
|
qualified LiDAR-to-body mount. A recorded threat experiment therefore needs an
|
|
explicit virtual geometry without weakening the physical rig contract in ADR
|
|
0035.
|
|
|
|
## Decision
|
|
|
|
Mission Core threat assessment consumes two independent evidence paths:
|
|
|
|
```text
|
|
camera proposals ---------------------> camera-only uncertainty
|
|
| |
|
|
+---- optional association ----+ |
|
|
v v
|
|
LiDAR occupied geometry ----------> LocalObstacleMap ---> ThreatAssessment
|
|
```
|
|
|
|
Neither path is called first:
|
|
|
|
- camera publishes image-space object proposals and optional semantics;
|
|
- LiDAR publishes metric occupied components, including geometry with no class;
|
|
- association enriches evidence but is not an admission gate;
|
|
- current metric geometry may produce `threat` or `not-threat` from corridor
|
|
geometry and bounded relative motion;
|
|
- camera-only, held, expired or otherwise incomplete evidence produces
|
|
`unknown`, never a safe decision;
|
|
- semantic class, detector ID and persistent identity are excluded from the
|
|
threat calculation.
|
|
|
|
M4.6 fixes a versioned replay hypothesis: body length `1.0 m`, width `0.6 m`,
|
|
nominal sensor height `1.25 m`, forward corridor `8 m`, rear margin `0.5 m`,
|
|
lateral clearance `0.2 m` and prediction horizon `5 s`. These values may be used
|
|
only with `replay-simulated` authority. They do not populate or qualify
|
|
`missioncore.rig-geometry/v1`, and they cannot support physical collision,
|
|
navigation, safety or actuation claims.
|
|
|
|
## Evidence and presentation
|
|
|
|
The accepted replay must publish immutable frame, fixture, report and visual
|
|
ledgers. Visual evidence uses the common LAB viewer and reusable renderers:
|
|
|
|
- full recorded camera video with synchronized proposal boxes;
|
|
- exact camera samples with metric range or explicit missing range;
|
|
- synchronized point cloud, occupied cells, virtual body and corridor in 3D and
|
|
plan view;
|
|
- visible threat/not-threat/unknown and `replay-simulated` authority.
|
|
|
|
Visuals are an inspection surface, not ground truth. Independent object-centric
|
|
labels remain a separate gate.
|
|
|
|
## Consequences
|
|
|
|
- Unclassified concrete, vegetation or road furniture can remain visible to the
|
|
metric path without inventing a semantic label.
|
|
- A camera detection cannot become safe merely because LiDAR support is absent.
|
|
- New detectors and LiDAR geometry providers may replace either side behind the
|
|
existing contracts without changing the threat provider.
|
|
- Physical body/mount qualification and live acceptance remain intentional debt.
|
|
- ADR 0035 remains valid for ownership of semantics, metric support and physical
|
|
rig qualification; this ADR supersedes camera-first wording for the canonical
|
|
product decision graph.
|