Hardware adapters: command and verify the first camera or payload

What to build

Trigger one camera/payload through an owned hardware adapter and correlate the acknowledgement and timestamp with the recorded vehicle pose.

Acceptance criteria

• Define SPI/I2C/UART/CAN/DroneCAN/Cyphal, GPIO/PWM/DShot and power-monitor adapter contracts with bounded timing.
• Validate a first real device end to end, including time sync, calibration, wiring and bus failure.
• Inventory gimbals, LiDAR/rangefinders, thermal/multispectral cameras, ESC telemetry, grippers, winches, relays, lights, transponders and sampling hardware.

Blocked by

• #2 Native runtime: run a deterministic sensor-to-actuator bench loop
• #3 Sensors: calibrate and replay time-aligned IMU, GNSS and pressure samples

Scope and evidence

The initial acquisition and fixture slice is implemented. Physical device acceptance and other payload drivers remain pending. Preserve explicit operator authority and report simulator, bench, HIL and vehicle evidence separately. The owned implementation must remain replaceable behind the shared driver and mission contracts.

Initial implementation

c407294 adds:

• Owned Pi AI Camera still adapter using the existing Picamera2 boundary, independent of ArduPilot/PX4.
• Versioned session/boot/sequence ACKs, per-capture clock synchronization, bounded image/deadline/queue checks, cancellation and process retirement. Ambiguous shutter outcomes are never retried.
• Capture-epoch association with the owned estimator, retaining component epochs/reset provenance. Missing pose is explicit; real images cannot use fixture pose evidence. No georeferencing claim.
• Native Stacks payloads:bench and payloads:capture commands, reused by the standalone compiled CLI. Private, exclusive local image/manifest exports include SHA-256.
• Configuration-only bounded bus contracts and an explicit remaining payload inventory.

Validation: 183 Bun tests, 13 Python SDK-boundary tests, lint, application/runtime/view types and roadmap checks passed locally. Compiled CLI ran outside the checkout. Fault coverage includes stale/wrong ACKs, resets, loss, cancellation, silent startup, timeout cleanup and a worker ignoring SIGTERM. Retained fixture evidence reproduces exactly.

Remaining acceptance

• Run the actual Pi 5/IMX500 and record OS/SDK/cable/power/device identities, images and disconnection/power/ownership failures.
• Measure clock/exposure/rolling-shutter, intrinsics, body mount and heading calibration against independent references.
• Connect a live hardware-backed owned-estimator feed and measure capture/pose timing and error. Standalone physical capture deliberately reports unavailable pose.
• Implement and electrically validate non-CSI bus drivers and each remaining payload family, including independent actuator authority/interlocks.

See the payload guide and hardware acceptance procedure. This issue stays open; SDK stubs and scripted child processes are not physical device, HIL or flight evidence.

CI: run 39152687837, passed for the published commit, including both firmware cross-builds and compiled CLI checks.

Owned selected-source gimbal runtime

2c7b495 adds createGimbalAuthority and the separate concrete-v2 simulateManagedCinema library API. One immutable in-process operator/autonomy writer owns a bounded angle lease. Foreign or unattributed packets cannot replace its angle or renew its original issuance expiry; replay, malformed selected commands and trusted stop conditions latch a closed cause. Normal retirement and fault retirement remain distinct. Source tags are not authentication.

The same owned mission, estimator, delayed encoder, PD, plant, renderer and shutter produce actual modeled exposures. In the source-loss scenario, a foreign packet is refused at the first exposure; original expiry wins over returning renewal and ACK 20 ms later. Run/shot/capture retain gimbal-source-expired, the image stays uncertain, native reason stays operator-abort, and the original residual-motion tail remains. Nominal confirms three qualified frames and actually lands. Pure manual/neutral tests establish directives and latches only.

Both independent source reviews found no actionable issue. Combined affected checks passed 48 tests with 331,856 assertions; all seven complete legacy results remain byte-exact. Eleven rebuilt standalone v1 Cinema command cases match complete prior stdout/stderr bytes. Types, Buddy/direct Pickier and roadmap/parity integrity passed. Published to origin/main. Local Bun 1.4.2 full suite: 1,093 passed, 24 skipped, zero failed and 407,723 assertions across 161 files. Exact-commit Linux/Bun 1.4.3 CI passed all five jobs: 1,078 passed, 39 skipped, zero failed and 407,657 assertions, plus 13 Python tests and compiled command checks. Skips are not executed evidence.

No managed CLI, physical gimbal, source transfer/resume, rate or firmware lock modes, electrical watchdog, host-death protection, authenticated writer or full upstream parity is established. Original acceptance criteria remain open. Payload semantics, Cinema semantics.