#6 · stacks/drone

What to build

Give an operator explicit control authority and predictable disarm, mode, RC-loss, estimator-loss, fence, battery, link-loss and watchdog behavior across the native simulator and board harness.

Acceptance criteria

Model authority as a versioned state machine and test all legal and illegal transitions. Version 1 has all 36 state/action pairs plus guard and priority tests.
Exercise RC override, stale commands, Pi termination, board reset, sensor faults and battery reserve in HIL.
Verify safe outputs for physical kill/disarm and document recovery requirements without relying on a final network command.
Capture parachute, rally/recovery, emergency landing and redundant-link requirements as explicit supported or deferred cases. These remain deferred with explicit follow-up gates in docs/authority.md.

Blocked by

#2 Native runtime: run a deterministic sensor-to-actuator bench loop
#4 Estimation: publish owned attitude and local-position estimates
#5 Multirotor control: stabilize the first simulated quadcopter

Scope and evidence

First simulation slice implemented in f3a2625 and pushed to main as Chris Breuer. Physical firmware remains neutral-only; there is no physical arming/actuator endpoint.

Original version 1 disarmed/armed-idle/autonomous/manual/failsafe/killed supervisor with explicit arm and engage, guard/fault priority and latched recovery.
Boot/session/epoch/sequence scope, issuance-based 20..100 ms command leases, replay/stale/future rejection, target/current-position fence and battery reserve checks.
Independent RC/link/runtime/interlock freshness, estimator health/reset/reference checks, modeled kill priority and manual takeover. Pending renewals cannot override independent transitions.
Timestamped controller output gate rejects stale/duplicate feedback, including disarm/rearm at one timestamp.
Independent modeled output watchdog, max 60 ms frame leases. Pi loss stops host sensor processing, estimator, supervisor and controller; board ticks alone expire thrust at 3040 ms, with last host check at 2996 ms. No final host command is fabricated.
Thirteen reproducible physics scenarios run on our sensor pipeline, estimator and multirotor controller. Native Stacks authority:simulate is shared by Buddy and the compiled CLI.
Local validation: 146 Bun tests, 16,781 assertions, 2 CTest contracts, 5 Python bridge tests, lint, application/runtime/view typechecks, roadmap check, both review axes, standalone CLI outside checkout and exact evidence regeneration. The previous isolated control report is unchanged.

CI passed, including standalone authority CLI and both neutral-only Pico 2 cross-builds.

Authority contract and remaining requirements, retained simulation evidence, tests.

Remaining before completion

Port authority/output supervision to the native board after measured #2/#3/#4/#5 prerequisites; verify bounded timing, memory, handshake and counter/clock/reset behavior.
Measure independent physical kill/disarm/RC wiring, output isolation, electrical neutral state and stopped-motor/ground interlocks on a disabled-load harness.
Execute HIL RC override/loss, stale UART commands, Pi SIGKILL and power removal, board reset, sensor/link faults and calibrated battery reserve/low-voltage campaigns.
Implement and independently validate vehicle-specific manual sticks, emergency landing/rally/recovery, parachute and redundant-link integrations in their linked roadmap areas (#5/#7/#8/#10/#11/#12/#25).

Zero modeled thrust is not a landing controller. Keep this issue open until physical and HIL criteria are met. Simulator, bench, HIL and vehicle evidence remain separate.