1.5 KiB
Future Kaptan and Cerebrum integration
KaptanDataSource is intentionally a rejecting skeleton. Current firmware is
telemetry-only and the repository safety boundary rejects inbound authority.
No reviewed command API, authenticated source binding, or capability exchange
exists, so this release claims none.
A future adapter must define and review:
- authenticated source and vehicle identity, key provisioning/rotation, and persistent anti-replay state;
- MAVLink 2 signing policy and exact Kaptan dialect/schema revision;
- snapshot/restart epochs, sequence wrap, time synchronization, stale data, reconnect and partial-fleet behavior;
- capability negotiation for vehicle/task/formation/action-queue behavior;
- idempotent command IDs, exact target binding, authority leases, acknowledgement/rejection, cancellation, expiry, and reconciliation;
- safe handling of unsupported or downgraded firmware.
AutonomyCoordinatorPort separately models capability discovery and exchange
of desired outcomes, constraints, success criteria, proposals, explanations,
and typed errors. FakeCerebrumAdapter is contract-tested. The real Cerebrum
transport, concurrency semantics, conflict resolution, plan provenance,
versioning, timeout policy, and safety certification remain unresolved. A
wire protocol must not be inferred from the TypeScript interface.
The next integration step is a reviewed, read-only Kaptan telemetry adapter that validates signed source-to-vehicle bindings and event freshness without adding command authority.