save

Signed-off-by: Onur Özkan <work@onurozkan.dev>

ground-suite/docs/KAPTAN_INTEGRATION.md

@@ -0,0 +1,29 @@
+# Future Kaptan and Cerebrum integration
+
+`KaptanDataSource` is intentionally a rejecting skeleton. Current firmware is
+telemetry-only and the repository safety boundary rejects inbound authority.
+No reviewed command API, authenticated source binding, or capability exchange
+exists, so this release claims none.
+
+A future adapter must define and review:
+
+- authenticated source and vehicle identity, key provisioning/rotation, and
+  persistent anti-replay state;
+- MAVLink 2 signing policy and exact Kaptan dialect/schema revision;
+- snapshot/restart epochs, sequence wrap, time synchronization, stale data,
+  reconnect and partial-fleet behavior;
+- capability negotiation for vehicle/task/formation/action-queue behavior;
+- idempotent command IDs, exact target binding, authority leases,
+  acknowledgement/rejection, cancellation, expiry, and reconciliation;
+- safe handling of unsupported or downgraded firmware.
+
+`AutonomyCoordinatorPort` separately models capability discovery and exchange
+of desired outcomes, constraints, success criteria, proposals, explanations,
+and typed errors. `FakeCerebrumAdapter` is contract-tested. The real Cerebrum
+transport, concurrency semantics, conflict resolution, plan provenance,
+versioning, timeout policy, and safety certification remain unresolved. A
+wire protocol must not be inferred from the TypeScript interface.
+
+The next integration step is a reviewed, read-only Kaptan telemetry adapter
+that validates signed source-to-vehicle bindings and event freshness without
+adding command authority.