#7 · stacks/drone

What to build

Extend the current explicit ArduPilot and PX4 adapters behind one capability-negotiated contract; support a complete acknowledged command, parameter and mission round trip with each simulator.

Acceptance criteria

Implement target discovery, message-rate negotiation, COMMAND_ACK/retries, mission upload/download/resume and parameter read/write with cancellation and bounds.
Add signing verification, replay handling, source routing, transport loss, serial/UDP/TCP and version compatibility tests.
Track FTP/log download, events, RTC/time sync, RTCM, payload/gimbal protocols, DDS/ROS 2 and CAN gateways as explicit sub-capabilities. Each is explicitly deferred in docs/driver-protocols.md with linked roadmap owners.
Keep physical write capability disabled until separate HIL/flight evidence exists; publish driver-specific support rather than assuming MAVLink implies parity. Every protocol API is tested receive-only in physical mode; negotiated capabilities and encoding fallbacks are explicit.

Blocked by

None. This work can start independently.

Scope and evidence

First software slice implemented in 68f564e and pushed to main as Chris Breuer. This is scripted protocol-peer conformance, not actual autopilot firmware SITL, flight or HIL validation.

Shared driver.protocol interface behind both ArduPilot/PX4 factories, with pinned loopback/source identity, matching heartbeat and AUTOPILOT_VERSION plus accepted discovery ACK.
MAVLink 2 COMMAND_LONG, ACK/recipient matching, incrementing retry confirmations, bounded progress waits, message-rate requests, AbortSignal cancellation and ambiguous-outcome quarantine. Accepted requests do not claim observed execution.
Named parameter reads and metadata-checked writes with explicit readback. PX4 bytewise and ArduPilot C-cast encoding, advertised/profile evidence, integer precision/type/name guards, including NaN-shaped uint32 raw bits.
Bounded mission type0/global NAV_WAYPOINT INT upload/download and acknowledged current-item selection/continue requests. Duplicate/order/count/cancel handling; completed downloads re-ACK final-item/empty-plan retries for up to 10 seconds if the final ACK was lost.
Optional strict MAVLink 2 signing, keyed SHA-256 verification, per-stream in-session timestamp replay checks and unsigned downgrade refusal. Raw 8-bit sequence wrap does not suppress fresh responses. Key lifecycle/persistent replay state remain deferred.
Native Stacks drivers:bench shared by Buddy and compiled CLI; both public factories complete signed/unsigned UDP round trips with a deliberately dropped command ACK. No physical arming or actuator endpoint exists.
Local validation: 166 Bun tests, 17,002 assertions, 2 native CTest contracts, 5 Python bridge tests, lint, application/runtime/view typechecks, roadmap validation and both review axes. Standalone binary ran outside checkout; retained conformance report regenerates exactly. Independent pymavlink 2.4.50 vectors establish wire/signature layout.

CI passed, including both standalone driver conformance commands and neutral-only Pico 2 cross-builds.

Contract and explicit sub-capabilities, retained report, tests.

Remaining before completion

Run pinned ArduPilot and PX4 firmware SITL campaigns for actual command support, parameter metadata, mission variants/resume state and measured message rates. The scripted peer is not firmware compatibility evidence.
Finish serial transport, automatic reconnect policy and actual firmware transport failure campaigns. The bounded loopback TCP software slice is published through #71; actual firmware transport campaigns remain open.
Complete COMMAND_INT, remote command cancellation, command-specific state validation and complete mission/parameter variants, plan ownership/opaque IDs and table/persistence behavior.
Implement secure signing-key lifecycle, deployed time initialization and persistent/cross-restart replay handling.
Implement explicit FTP/log/event/time/RTCM, payload/gimbal and DDS/ROS 2/CAN gateway services in their linked roadmap areas (#4/#8/#9/#10/#11/#26).
Keep physical writes disabled until independently validated authority, hardware, HIL and vehicle evidence exists.

Keep this issue open. These services remain optional external drivers, separate from our owned runtime and mission engine.

Published TCP software slice

#71 is merged. Commit b18e1d63d344452cf45719cf3b4072a752b71bce reached main through a normal fast-forward push as Chris, without coauthors. Both factories support explicit bounded literal-loopback TCP, shared acknowledged protocols and PX4 priming, CRC/signing framing, fresh-session reconnection, detached diagnostics and terminal cleanup. Physical operation remains receive-only.

Native deadline regressions and their demonstrated fixture correction are retained in #73, now complete. The two original Linux passive failures were reproduced through actual public factories and an OS peer; valid native progress before 500 ms invalidated their initial continuous-stall assumptions. Corrected bounded phase fixtures retain the original deadlines and fail on sustained stalls or late/ambiguous transitions. Disabling either actual production expiry branch made its regression fail; exact bytes were restored.

Final local Buddy suite: 1,555 pass, 27 skip, zero fail and 489,808 assertions, with unchanged source/HEAD/Bun. Exact-head Linux CI passed all five jobs; its full suite recorded 1,541 pass, 41 skip, zero fail and 489,785 assertions. All four copied standalone UDP/TCP driver campaigns passed outside the checkout, including signed PX4 and a deliberately dropped ACK. Both independent review axes and native lint/types/docs/roadmap/parity gates passed. Original failed campaigns are retained, without passing reruns replacing them.

Keep #7 open. Actual firmware SITL, serial, complete mission/command/parameter variants, persistent signing key/replay lifecycle, deeper services and hardware/HIL acceptance are still required. The distinct previous browser-startup cause remains #72. No research-only CI/startup mode was merged.