What to build
Schedule, execute, inspect and repeat a simulated perimeter mission with docking/charging and explicit launch authority.
Acceptance criteria
- Implement dock alignment/landing, weather/power interlocks, contact/charge verification and abort/recovery.
- Keep scheduling separate from permission to launch; expose operator review and audit records.
- Test recurrence, missed runs, link loss, denied access and failure to dock without silently retrying a hazardous launch.
Blocked by
- #10 Mission engine: run and resume an owned waypoint mission
- #11 Navigation: avoid an obstacle and land at a selected site
- #7 Drivers: implement acknowledged MAVLink commands, missions and parameters
- #9 Operations: record, replay and diagnose native missions
Scope and evidence
This is planned work, not a claim of implemented capability. Preserve explicit operator authority and report simulator, bench, HIL and vehicle evidence separately. The owned implementation must remain replaceable behind the shared driver and mission contracts.
Retained patrol simulation and authenticated review checkpoint
The retained simulation and recording/replay checkpoint remains published at f325a09. Its post-main CI passed all five jobs: 956 passed, 39 skipped, 0 failed and 66,490 assertions. Recording remains unsigned exact same-engine replay of a finite model, without restored runtime state or authenticated vehicle identity.
Authenticated owner review and consumption are implemented at 235e11a, with bounded test failure diagnostics at a77a418. Native Stacks Actions, Gates, personal tokens, model-derived SQLite migrations and transactions persist schedule, occurrence and audit records. Review and consumption recheck current authority, bind immutable receipts to the original token and version, and preserve denied or consumed outcomes across restart. All routes remain metadata-only: launch and charging permission stay false, and no runtime, simulation, handoff or vehicle command is invoked.
Initial local integration passed 36 tests and 117 assertions. The later snapshot-contention correction passed 38 tests and 136 assertions, with application/runtime/scoped types and both Buddy/direct Pickier checks. Application/runtime types, Pickier, independent specification and standards reviews passed. Real separate-process quota, duplicate-key, opposing-review and consume races produced one winner with bounded refusal, and committed post-Gate credential changes rolled back protected ledger mutations. A previous consume race's unprinted loser status remains unknown; a later pass does not establish its cause. The reserved generic model routes exclude these private records; this is an application route boundary, not a claim about all framework bundles.
The snapshot-contention correction recognizes only the exact native Error tuples SQLITE_BUSY/5 and SQLITE_BUSY_SNAPSHOT/517. A real separate WAL writer committed after the service read snapshot; the first unchanged-classifier regression returned 500 with native 517 and rollback. The correction returns 503 while preserving the ledger, without an internal retry. A separate subsequent explicit request can succeed.
Published to origin/main at c0779cf. Exact-commit CI passed all five jobs on Linux/Bun 1.4.3: 1,066 passed, 39 skipped, zero failed and 407,300 assertions across 159 files, plus 13 Python bridge tests and compiled command checks. Skips are not executed evidence. Post-main CI also passed all five jobs.
The first 235e11a CI remains failed: the quota fixture failed during parent fixture model loading before the race/preflight, and execution-browser completion exceeded its existing 40-second guard. Their causes remain unresolved. New diagnostic evidence is allowlisted, private, bounded to 8 KiB and requested only on failure. Observed cancellation includes actual outer-fetch AbortError and CDP socket close; response-body cancellation and server stream-cancel callbacks are not established guarantees. Timeouts, production budgets and retry policies were preserved.
The a77a418 run also remains failed: the parent quota fixture could not resolve the validation runtime, and the consume race newly retained exact native SQLITE_BUSY_SNAPSHOT/517 identity. Delaying the eager race-parent database import and recording completed setup stages avoids premature fixture configuration; the exact historical missing-module cause remains unknown. The earlier unprinted consume loser remains unknown.
The 0e61892 run remains failed: the older CAS writer fixture failed during parent model loading, while the new real 517 snapshot regression passed. The exact historical missing-module cause remains unknown. Two fixtures now defer eager native imports until their existing temporary setup completes; their requests, locks, ledger oracles, guards and cleanup remain unchanged.
The original acceptance criteria remain unchecked. Next work includes a patrol workspace, production scheduling, broader weather/recovery behavior and physical/HIL qualification. Current evidence is synthetic simulation, real native HTTP/SQLite/process/browser behavior and cross-compilation, without unattended operation, physical flight/charging or measured endurance evidence.