# Future Kaptan and Cerebrum integration

`KaptanDataSource` is intentionally a rejecting skeleton. Current firmware is
telemetry-only and the repository safety boundary rejects inbound authority.
No reviewed command API, authenticated source binding, or capability exchange
exists, so this release claims none.

A future adapter must define and review:

- authenticated source and vehicle identity, key provisioning/rotation, and
  persistent anti-replay state;
- MAVLink 2 signing policy and exact Kaptan dialect/schema revision;
- snapshot/restart epochs, sequence wrap, time synchronization, stale data,
  reconnect and partial-fleet behavior;
- capability negotiation for vehicle/task/formation/action-queue behavior;
- idempotent command IDs, exact target binding, authority leases,
  acknowledgement/rejection, cancellation, expiry, and reconciliation;
- safe handling of unsupported or downgraded firmware.

`AutonomyCoordinatorPort` separately models capability discovery and exchange
of desired outcomes, constraints, success criteria, proposals, explanations,
and typed errors. `FakeCerebrumAdapter` is contract-tested. The real Cerebrum
transport, concurrency semantics, conflict resolution, plan provenance,
versioning, timeout policy, and safety certification remain unresolved. A
wire protocol must not be inferred from the TypeScript interface.

The next integration step is a reviewed, read-only Kaptan telemetry adapter
that validates signed source-to-vehicle bindings and event freshness without
adding command authority.