#9 · stacks/drone

What to build

Record a mission with enough timestamped telemetry, commands and configuration provenance to reproduce a failure and inspect it in the Stacks UI.

Acceptance criteria

Implement bounded black-box logs, loss accounting, replay and export without leaking operator tokens or private imagery by default. Initial runtime-only host slice; full mission correlation remains below.
Record firmware/config/model/calibration versions, performance deadlines, health events and reset causes.
Cover crash capture, diagnostics, signed update/rollback, storage exhaustion and commissioning checks.

Blocked by

#2 Native runtime: run a deterministic sensor-to-actuator bench loop
#3 Sensors: calibrate and replay time-aligned IMU, GNSS and pressure samples

Scope and evidence

The initial runtime-only host diagnostics slice is implemented. Full mission capture, physical acceptance and signed updates remain pending. Preserve explicit operator authority and report simulator, bench, HIL and vehicle evidence separately. The owned implementation must remain replaceable behind the shared driver and mission contracts.

Initial implementation

33f3d63 adds:

A strict v1 runtime journal with a bounded writer queue, file/event budgets, reserved completion accounting and explicit queue/capacity/storage drops.
SHA-256 record chaining, provenance digests, verified-prefix crash recovery and schema-verified private exports. Missing completion always reports an unknown tail. Hashes detect corruption but do not authenticate a producer.
Native host runtime command-attempt/status capture, performance and reset diagnostics, and pure replay with epoch controls, sequence high-water marks and health checks.
Native Stacks diagnostics:record, diagnostics:replay, diagnostics:inspect and diagnostics:export, shared with the compiled standalone CLI.
A stx viewer at /diagnostics that verifies selected files locally without upload, plus a retained native deadline example. Runtime-only fields exclude tokens, imagery, location and arbitrary context.

Host tests cover interruption/SIGKILL, tampering, private malformed input, loss, queue/file/event bounds, short writes, ENOSPC/EDQUOT/EIO, zero progress, partial records, fsync failures, descriptor cleanup and FIFO/device rejection. Browser QA covers example/local-file loading, beginning/end replay, clear/reopen, malformed input, console errors and 320/375px layouts. The retained host example shows no fault at 20 ms and deadline-miss at 22 ms.

Remaining acceptance

Full live runtime/sensor/estimator/authority/mission/payload correlation and measured clock relationships.
Actual board firmware/config/model/calibration provenance and measured reset causes. The host calibration digest explicitly means not applicable to synthetic samples.
Physical full-medium, electrical removal, power-loss, storage latency, logging deadline and long-mission retention/rotation campaigns.
Signed manifests, trust/key lifecycle, anti-rollback, verified image staging, interrupted-update recovery and a known-good rollback slot.
Commissioning backed by independent measured neutral outputs, wiring, watchdog, calibration, RC override/kill and recovery evidence from dependency issues.

inspect --check passing only means the recording's diagnostic checks passed. commissioningReady remains false, including for a clean host recording. A completion footer describes logical completion and cannot attest that a subsequent fsync succeeded.

See the diagnostics guide and retained runtime example. This issue stays open.

Local validation: 199 Bun tests and 13 Python tests passed, plus lint, application/runtime/view types and roadmap checks. Compiled record/replay/inspect/export commands passed outside the checkout.

CI: run 39156852068, passed for the published commit, including firmware cross-builds and standalone diagnostics CLI checks.

Signed image verification published

PR #41 adds offline TUF verification/staging and fresh independent candidate inspection through native Buddy and the portable CLI. The explicit root pin, selected target/platform/protocol and caller-supplied release floor are verified; no firmware is installed or selected. Independent review found and corrected an asynchronous policy-capture race using a public RED/GREEN regression. Focused host tests, types/lint, compiled external-checkout commands, docs build/link audit and roadmap/parity checks pass. Original broader timing failures remain retained. Exact source 0a354d6378c674a0d3d29d44c120d6e8658b1c12 passed all five jobs in CI 39641949569, including the full native suite with 1,395 passes, 39 skips, zero failures and 488,273 assertions. It is published to origin/main as Chris with no coauthors, through a normal fast-forward; GitHub records #41 merged. This qualifies offline staging/inspection only, not the full update coordinator.

https://github.com/stacksjs/drone/issues/42 tracks the required persistent coordinator: protected role/release high-water state, partial-refresh advancement, trust/key operations, known-good slots, identity-bound confirmation and interruption-safe recovery. The current module reports trustStatePersisted false and physicalDeploymentAllowed false. It does not satisfy full anti-rollback, boot recovery, commissioning or this issue's remaining acceptance. Physical and full mission-correlation requirements above stay open.