What to build
Run a simulated delivery route with payload custody, reserve/alternate landing planning and loss-of-link contingencies.
Acceptance criteria
- Model mass/CG changes, release verification, recipient/site confirmation and endurance margins.
- Exercise redundant links, degraded navigation, containment, diversion and fleet handover in simulation.
- Document the required authorization/detect-and-avoid/operational evidence for long-range BVLOS separately from software capability.
Blocked by
- #10 Mission engine: run and resume an owned waypoint mission
- #11 Navigation: avoid an obstacle and land at a selected site
- #7 Drivers: implement acknowledged MAVLink commands, missions and parameters
- #9 Operations: record, replay and diagnose native missions
Scope and evidence
This is planned work, not a claim of implemented capability. Preserve explicit operator authority and report simulator, bench, HIL and vehicle evidence separately. The owned implementation must remain replaceable behind the shared driver and mission contracts.
Carried-load characterization checkpoint
Published source: c0779cf. Native Stacks cargo:load-bench runs centered/forward carried load, a prescribed load split and link-loss cases on the owned sensor/estimator/control/authority multirotor loop. The point-mass and CG model changes the actual simulated rigid-body dynamics. The split is a prescribed model event, not a release command or verified delivery. Link loss expires authority and drives the board model neutral while actual motor lag remains visible.
Model, evidence and limits. Current-host source checks cover the cargo physics and public CLI; four actual compiled scenarios passed outside the checkout. Published to origin/main at c0779cf. Exact-commit CI passed all five jobs on Linux/Bun 1.4.3: 1,066 passed, 39 skipped, zero failed and 407,300 assertions across 159 files, plus 13 Python bridge tests and compiled command checks. Skips are not executed evidence. Post-main CI also passed all five jobs.
The original acceptance boxes remain unchecked. Delivery mission logic, site/recipient confirmation, release ACK, custody, measured or modeled route energy margin, redundant links, diversion and fleet handover remain open. No physical flight, cargo delivery, detect-and-avoid or BVLOS operational qualification is claimed.
Published configured modeled delivery checkpoint
PR #97, source f22ca67, adds native cargo:mission <request> with explicit mass/CG, receiver, release height, alternate and declared power/reserve. The actual owned sensor/estimator/control/authority loop drives load separation, captured mechanism/receiver custody, return or alternate landing, and primary/backup link failover for one vehicle. Ten additional failures bind observed release/receipt phases and retain uncertainty and independent board/plant settling after host termination.
Current-host qualification: 167 focused tests passed with 6,711 assertions across 17 files, plus 18 process/cleanup regression tests with 77 assertions across two files. Native lint, runtime/app/view types, roadmap/parity, docs and CLI builds passed. All 31 actual copied CLI cases passed outside the checkout; all original 17 cargo summaries remained byte-identical. Independent Spec and Standards reviews passed on the combined 38-file patch. The native docs build has 94 HTML pages and no missing targets among 7,084 local links and 94 assets; mobile navigation and homepage target loss were checked in a browser.
Exact-source release CI passed all five jobs: 2,076 native tests passed, 41 skipped, zero failed, 504,977 assertions across 234 files, plus 13 Python bridge tests and all 31 copied cargo cases. The original workflow ZIP and cargo artifact were each retained once; report hashes and actual outcomes were verified. This checkpoint was published to origin/main at f22ca67 as Chris, with no coauthors and a normal fast-forward. Post-main CI passed all five jobs. The original acceptance boxes remain unchecked. Distinct-vehicle fleet handover, electrical/measured endurance, durable cargo/runtime reconciliation, physical release/recipient validation and operational authorization/detect-and-avoid evidence remain open. Declared power budgets are not measured Wh; two links for boot 55/session 123 are not fleet handover. Physical outputs stay inhibited and recipient identity is not authenticated.
Shared-clock runtime prerequisite
PR #98, source 5bf7ca9, adds retained step/result/close vehicle sessions. Distinct raw IMU/GNSS boot identities, estimator references and authority/watchdog scopes now run at the same modeled epochs. One host can stop and its board/plant settle while the peer continues fresh policy. Captured initial state, bound methods, captured adapter results and closure checks prevent reentrant callbacks/getters from restoring output or doing later owned work.
Local qualification passed 308 tests and 16,472 assertions across 21 files, including 14 session/lifecycle cases. Native types/lint/docs/CLI builds passed, all six complete default profile reports and all 31 copied cargo outputs remained byte-identical, and independent Spec/Standards reviews passed. Exact-source CI finished failure. The native check passed 2,090 tests, with 41 skipped, zero failed and 506,826 assertions across 235 files in 4,673.76 seconds; all 31 copied cargo cases passed. Workspace browser, firmware and purge-namespace passed, but execution-browser failed before CDP discovery as tracked in #72. The original terminal ZIP was retained once, SHA-256 052b5407e1beee2baac2ba469a5b8542b6d277f7aefd1d653b2f439ed64f2977. This workflow does not qualify main publication. This source was later published through the successful #99 superset, as recorded below. At that checkpoint actual parcel intake, finite station handling and two-vehicle custody handover remained unimplemented; this shared-clock prerequisite does not satisfy the fleet acceptance criterion. Later supersets #99 and #100 passed and were published. Those results do not explain this failed startup.
One point-load intake prerequisite
PR #99, source 0eac2af, adds an actually empty receiving rigid body. A single matching parcel at its current joint enters the shared integrator through an inelastic impulse that conserves linear/angular momentum and retains raw kinetic loss, potential energy and continuous structural pose/motor state. A later separation cannot refill the joint. The expected load declaration does not add phantom initial mass.
Eight intake cases include independent world-frame momentum/energy accounting across nine evolved rotated bodies and actual subsequent acceleration. The final focused campaign passed 341 tests and 20,524 assertions across 24 files. Native types, Pickier lint, docs and portable CLI builds passed; all six complete default vehicle reports and all 31 copied cargo outputs remained byte-identical. Independent Spec/Standards reviews passed on the unchanged six-file source. Generated docs have 96 pages, 7,237 local links and 96 assets without missing targets. Full exact-source CI passed and this source is now on main; the publication record follows.
This is an ideal instantaneous point-joint primitive. It does not own a globally unique parcel, transport it through a finite station, grant current authority or produce a vehicle/mechanism custody ACK. Actual two-vehicle handover, its cancellation/uncertainty matrix and all physical/measured/operational qualification remain open. Issue #25 and its acceptance boxes remain incomplete.
Published intake and shared-clock prerequisites
Exact-source CI 40080999116 passed all five jobs: 2,098 native tests passed, 41 skipped, zero failed and 507,032 assertions across 236 files, plus 13 Python bridge tests and all 31 copied cargo cases. Original workflow and cargo ZIPs were each retained once. All cargo report hashes match the previous qualified Linux f22 release; local Mac reports have tiny binary64 differences and cross-host byte equality is not claimed. Both prerequisite commits retained their reviewed source hashes and were published to origin/main at 0eac2af as Chris with no coauthors through a normal fast-forward. PR #98's failed workflow remains a distinct unresolved startup failure under #72; this later success does not explain it. Finite station handling and actual two-vehicle authority/custody integration remain in progress, so issue #25 remains incomplete.
Finite station and receiving-task checkpoints, not yet on main
PR #101, source 47ebfc2, adds one existing parcel's exact ballistic fall, rough-plane capture, finite speed/acceleration-constrained rail, cancellation braking and single departure. The public integration uses real source separation and real receiving-body intake. Mass, contact epoch/impulse, mechanical loss and represented station work are retained. Eight station cases and a 111-test regression passed locally; native lint/types/docs passed and both reviews were clean. Exact-source CI passed all five jobs: 2,109 native tests passed, 41 skipped, zero failed and 516,089 assertions across 238 files, plus 13 Python bridge tests and 31 copied cargo cases. The original terminal ZIP and cargo artifact were each retained once; all 31 actual report hashes match the qualified Linux baseline.
PR #102, source 73d317a, adds the native quadcopter material-receive task, explicit pad, finite counted wait/alternate graph, correlated ACK and first-frame neutral commands under qualified contact. A real empty receiving body stays parked under its own raw-sensor/estimator/authority runtime when ACK is withheld. Tests also reproduced and fixed a sparse-ACK NaN bypass. Seven receiving cases and the final 109-test regression passed locally; six complete default vehicle reports remained byte-identical. Native lint/app/runtime types/docs passed and both independent reviews were clean in round 2. Exact-source CI passed all five jobs: 2,116 native tests passed, 41 skipped, zero failed and 518,649 assertions across 239 files, plus 13 Python bridge tests and 31 copied cargo cases. Original logs and the cargo artifact were each retained once; all 31 actual report hashes match the qualified Linux baseline.
These source checkpoints are on PR branches pending full qualification, not main. Neither demonstrates the complete fleet protocol. The actual intake receipt port, current mechanism authority, globally consumed single-parcel world ownership, two-live-vehicle custody graph, bounded failure/cancellation/uncertainty matrix and native fleet CLI remain open. Electrical/measured endurance, physical hardware and operational/BVLOS evidence remain separate. Issue #25's original acceptance boxes stay unchecked.
Browser observation source f9b2917 also passed its complete five-job workflow and is now main. This is diagnostics qualification, not a fleet milestone or an explanation of #72. Station #101 and receiving task #102 remain on PR branches; their exact-source workflows subsequently passed as recorded above. Their publication awaits integration qualification with current main and the fleet checkpoint.
Two-live-carrier handover checkpoint, pending full CI
PR #103, source 287103d, connects the station and receiving-task prerequisites to two actual retained sensor/estimator/control/authority runtimes on one world clock. The single source parcel falls onto the finite station, travels to an initially empty receiving body, changes its actual mass/CG, obtains a later captured intake receipt, and completes the receiver's separate delivery and return. The world independently checks live host availability, boot/session, lease, policy age, pending command and neutral receiver outputs at actual intake. Its mass ledger retains one point and 3.1 kg total modeled mass.
The native Stacks cargo:fleet command has six bounded cases: nominal, receiver primary/both-link loss, host loss between grant and intake, withheld intake receipt, and a real small joint displacement that refuses stale rendezvous and preserves the loose falling parcel. Actual mass and captured custody remain separate. Exit 0/2/1 and a 16 KiB JSON ceiling are explicit. Model and limits.
Local qualification: 200 tests passed, zero failed, 21,670 assertions across 17 files; six copied standalone fleet cases passed outside the checkout, and all 31 older copied cargo outputs remain byte-identical to the qualified Mac baseline. Genuine public-port regressions reproduced and fixed invalid-pose custody confirmation, nonfinite navigation readiness and cancellation-callback reentry. Both independent reviews are clean on all 18 unchanged source/index pins. Native lint, app/runtime types, CLI/docs builds, roadmap and parity passed; generated docs have 7,774 local links without missing targets. The full local suite is withheld below its 4 GB free-space floor. Exact-source CI is running; this source is on the PR branch, not main.
This is a six-case modeled checkpoint. General phase-bound source/receiver faults, navigation degradation and containment across transfer, explicit operator cancellation/recovery, whole-world restart, collision avoidance and broader fleet planning remain open. Declared power budgets do not prove electrical/measured endurance. Physical hardware, authenticated identity, detect-and-avoid and long-range/BVLOS operational evidence remain separate. The original acceptance boxes remain unchecked.
Phase-bound fleet failures, pending full CI
PR #104, source 6aa4b19, expands the shared world from six to eleven cases. It adds receiver GNSS loss at actual rail start, source kill after captured station custody while the peer completes delivery, receiver kill after actual intake with real added mass but uncertain custody, actual pad motion stopped by receiving interlocks, and loaded fence-breach detection under a declared 8 N/2 s force ramp with the existing fixture-IMU estimator. No plant-position policy substitution or weakened sensor/fence gate is used. Neutral output does not guarantee containment against ongoing force or momentum.
The targeted regression passed 206 tests, zero failed and 21,775 assertions across 17 files, with both runtime mission-fence-breach and supervisor fence-breach reporting checked. All eleven copied fleet cases and 31 older copied cargo cases passed outside the checkout; the prior six fleet reports and all 31 older reports remain byte-identical to the qualified Mac baseline. Both independent reviews are clean on all eight unchanged source/index pins. Native lint/types/CLI/docs, roadmap and parity checks passed. Exact-source CI is running; source remains on its PR branch pending integration qualification, not main.
Every-phase source/receiver failure coverage, manual/operator cancellation and recovery, durable world state, general fleet planning, electrical/measured endurance and physical/operational acceptance remain open. The original acceptance boxes remain unchecked.
Retained operator transport recovery, pending full CI
PR #105, source c6f5114, makes the same two-carrier world retainable through exact-epoch step, detached snapshot/terminal result, scoped decide and idempotent close. An explicit operator can cancel finite rail motion, retain the single parcel while it brakes, wait and resume from its actual stopped point under the same receiving session and original receive deadline. Scope, current clock, sequence, authority and prior-intake checks prevent replay, failed-lease recovery and a second intake attempt after uncertainty. Close reports the actual revoked board outputs while preserving observation epochs and the unsettled point.
Native Stacks cargo:fleet-control and the standalone CLI expose four bounded cases: cancellation-only, stopped-rail cancel/resume, attempted-intake cancellation with refused recovery, and recovery refusal after navigation authority loss. They retain explicit outcomes within one 16 KiB JSON line and exits 0/2/1. The API/roadmap/cargo summaries now consistently describe implemented handover versus remaining work; original acceptance criteria and partial status are preserved.
Final local qualification: 220 tests passed, zero failed and 25,569 assertions across 19 files. Eleven copied fleet fault cases, four copied operator cases and all 31 older copied cargo cases passed outside the checkout. All eleven prior fleet and 31 older cargo outputs remain byte-identical to the qualified Mac baseline. A genuine nested-result mutation regression failed after early close and natural completion; complete result detachment fixed both. Independent Spec and Standards reviews are clean on all 19 final source/index pins. Native Pickier lint, app/runtime types, CLI/docs builds, roadmap and parity checks passed; 99 rendered docs pages have no missing targets among 7,779 local links and 99 assets.
Exact-source CI is running. This commit is on the PR branch, not main. General vehicle abort/replan, uncertain-intake reconciliation, durable whole-world recovery, richer rendezvous/collision planning, electrical/measured endurance and physical/operational evidence remain open. Physical outputs remain inhibited and identity unauthenticated. The original acceptance boxes stay unchecked.
Published two-carrier checkpoint
The finite station, receiving task and six-case actual two-carrier world from #101, #102 and #103 are now published to origin/main at 287103d, integrating the marketing/docs changes through a normal fast-forward as Chris without coauthors. These PRs are merged. This supersedes their earlier publication-pending status above; #104/#105 remain separate pending checkpoints.
Exact-source CI passed all five jobs: 2,133 native tests passed, 41 skipped, zero failed and 518,904 assertions across 242 files in 4,760.94 seconds, plus 13 Python bridge tests, 31 copied cargo cases and six copied fleet cases. The original workflow ZIP was retained once, SHA-256 ece766bec022c8f8c9e013b7e3904c482f82db46c4f1cdaadccd6f6459dc9336. Cargo and fleet artifacts were each downloaded once; all actual report hashes/outcomes/scopes/inhibited outputs were inspected. All 31 older cargo hashes match the qualified Linux baseline. All 18 reviewed source pins, author/committer identity, no-coauthor messages and fresh main ancestry were verified before publication.
Automatic post-main CI is a separate queued follow-up. The wider acceptance work and original unchecked boxes remain. This software evidence does not establish physical delivery, measured energy, authenticated identity or BVLOS operation.
Published phase-bound fleet failures
PR #104 is merged. Its reviewed source 6aa4b19 is now on origin/main through a normal fast-forward as Chris without coauthors. The eleven fleet cases include native receiver navigation loss, source/receiver kill at captured transfer phases, pad-motion interlocks and loaded fence-breach supervision. This supersedes #104's publication-pending status above. Operator #105 remains a separate pending checkpoint.
Exact-source CI passed all five jobs: 2,139 native tests passed, 41 skipped, zero failed and 519,010 assertions across 242 files in 3,901.28 seconds, plus 13 Python bridge tests, 31 copied cargo cases and eleven copied fleet cases. Original workflow ZIP retained once, SHA-256 22d8130dd57d47f20586eddaf87fd29e6683d7e2b1c1d39a0ce6540c59c97a18. Both cargo/fleet artifacts were downloaded once and their actual hashes, outcomes, live source scopes, retained mass and inhibited outputs verified. All 31 older cargo and original six fleet output bytes match the qualified Linux 287 baseline. All eight reviewed source pins, Chris author/committer, no-coauthor messages and fresh main ancestry were verified before publication.
Automatic post-main CI is separate follow-up evidence, currently in_progress. The original acceptance boxes stay unchecked. General recovery, durable world state, broader planning, measured/electrical endurance and physical/operational evidence remain open. Neutral outputs do not establish physical containment or a safe aircraft landing.
Published retained fleet cancellation and recovery
PR #105 is merged. Reviewed source c6f5114 reached origin/main through a normal fast-forward as Chris without coauthors. Native cargo:fleet-control retains the actual world, station point, source/receiver sessions, custody and authority while explicitly cancelling, braking, waiting and resuming. It refuses retry after an intake grant or unresolved uncertainty and does not restore failed authority. Closing observes actual neutral board outputs and preserves terminal result ownership. This supersedes #105's publication-pending status above.
Exact-source CI passed all five jobs: 2,153 native tests passed, 41 skipped, zero failed and 522,803 assertions across 244 files in 3,947.45 seconds, plus 13 Python bridge tests, 31 copied cargo cases, eleven fleet fault cases and four operator cases. Original workflow ZIP retained once, SHA-256 c5380079e7cc3286ee8e6538edf3dbcfc36112b37766a6115643fa9948dff693. Actual cargo/fleet artifacts were downloaded once; their hashes, complete raw outputs, outcomes, separate sessions, retained mass/custody, operator event ordering and inhibited outputs were checked. All 31 older cargo and eleven fleet outputs match the previously qualified Linux 6aa baseline byte for byte. All 19 reviewed committed source pins, Chris author/committer, no-coauthor message and fresh main ancestry were verified before publication.
The original acceptance boxes stay unchecked. General fleet recovery and durable world reconciliation, wider planning, measured electrical/energy behavior and physical/operational evidence remain open. A neutral output or retained simulated parcel is not proof of physical containment or a safe landing.