30 lines
1.5 KiB
Markdown
30 lines
1.5 KiB
Markdown
# Future Kaptan and Cerebrum integration
|
|
|
|
`KaptanDataSource` is intentionally a rejecting skeleton. Current firmware is
|
|
telemetry-only and the repository safety boundary rejects inbound authority.
|
|
No reviewed command API, authenticated source binding, or capability exchange
|
|
exists, so this release claims none.
|
|
|
|
A future adapter must define and review:
|
|
|
|
- authenticated source and vehicle identity, key provisioning/rotation, and
|
|
persistent anti-replay state;
|
|
- MAVLink 2 signing policy and exact Kaptan dialect/schema revision;
|
|
- snapshot/restart epochs, sequence wrap, time synchronization, stale data,
|
|
reconnect and partial-fleet behavior;
|
|
- capability negotiation for vehicle/task/formation/action-queue behavior;
|
|
- idempotent command IDs, exact target binding, authority leases,
|
|
acknowledgement/rejection, cancellation, expiry, and reconciliation;
|
|
- safe handling of unsupported or downgraded firmware.
|
|
|
|
`AutonomyCoordinatorPort` separately models capability discovery and exchange
|
|
of desired outcomes, constraints, success criteria, proposals, explanations,
|
|
and typed errors. `FakeCerebrumAdapter` is contract-tested. The real Cerebrum
|
|
transport, concurrency semantics, conflict resolution, plan provenance,
|
|
versioning, timeout policy, and safety certification remain unresolved. A
|
|
wire protocol must not be inferred from the TypeScript interface.
|
|
|
|
The next integration step is a reviewed, read-only Kaptan telemetry adapter
|
|
that validates signed source-to-vehicle bindings and event freshness without
|
|
adding command authority.
|