Stand up a production-target test runner on jetson-e2e and run the
deferred cargo test --workspace for batch 19.
Infra:
- Dockerfile.test: ubuntu:22.04 + libopencv-dev + libav*-dev +
libclang-dev + protobuf-compiler + rust 1.82.0 (rustfmt, clippy).
Sets LIBCLANG_PATH so clang-sys can dlopen libclang under the
opencv-rust clang-runtime path.
- scripts/jetson-test.sh: rsync source to jetson-e2e, docker build,
docker run cargo test --workspace --no-fail-fast.
Workspace fix exposed by the gate:
- Cargo.toml: enable opencv "clang-runtime" feature. Without it the
workspace fails to build because clang-sys is shared between
opencv-binding-generator and bindgen (via ffmpeg-sys-next) and the
opencv generator panics with "a `libclang` shared library is not
loaded on this thread" (opencv-rust GH issue #635).
Batch-19 code bugs exposed by the gate (6 compile errors + 1 algo bug):
- movement_detector::optical_flow: min_max_loc signature (opencv 0.98
expects Option<&mut f64> / Option<&mut Point>); data_mut() returns
*mut u8 directly, not Result. RANSAC residual now filters by the
inlier mask returned by find_homography (matches the docstring; was
systematically over-reporting motion magnitude on synthetic
pure-pan input).
- semantic_analyzer::scoring::freshness: same data_mut() fix;
stddev_f32 now takes &impl core::ToInputArray so it accepts the
BoxedRef<Mat> that Mat::roi returns in opencv 0.98.
Result: 391 tests passed across 58 binaries, 0 in-scope failures.
Two pre-existing failures in frame_ingest (batch 16-18 scope) are
NOT addressed here and are recorded as leftovers:
- frame_ingest_cuvid_segv: HIGH severity production bug; libavcodec58
advertises h264_cuvid but libnvcuvid.so.1 is missing at runtime, the
software fallback never fires, first send_packet SEGVs.
- frame_ingest_publisher_timing_flake: LOW severity; Jetson-specific
timing budget too tight for ac1_three_consumers_at_rate_lose_no_frames.
Neither blocks batch 20 (movement_detector / semantic_analyzer next).
Co-authored-by: Cursor <cursoragent@cursor.com>
Batch 19 (movement_detector ego-motion + semantic_analyzer primitive
graph) is committed at db844db. This archival commit:
- Writes _docs/03_implementation/batch_19_cycle1_report.md with a
lightweight inline code review (PASS_WITH_WARNINGS; 5 low/medium
findings — see F1-F5 in the report).
- Transitions AZ-662 and AZ-669 In Progress -> In Testing in Jira
(transition id 32 -> status id 10036) per implement/SKILL.md Step 12.
- Logs _docs/_process_leftovers/2026-05-20_batch19_opencv_test_gate.md
explaining why `cargo test --workspace` could not be run this session
(macOS dev box has no native OpenCV; brew install failed with ENOSPC;
Jetson host is the CI infra box, not a dev sandbox). Replay options
documented in the leftover.
- Updates _docs/_autodev_state.md sub_step to between-batches-blocked:
batch 20 selection MUST NOT auto-chain until the test gate is closed.
Cargo.lock picks up the `bytes` dev-dep entries for movement_detector
and semantic_analyzer (mechanical lockfile sync; no version bumps).
Co-authored-by: Cursor <cursoragent@cursor.com>
Add the operator-command dispatcher behind a typed CommandAck:
60 s per-command-id idempotency cache, surfaced-POI registry with
unknown_poi_id + expired gates, BIT-degraded ack severity check, and
SafetyOverride forwarding to mission_executor with structured audit
log (redacts signature + session_token).
Cross-layer wiring goes through three new traits in shared::contracts
(ScanCommandRouter, MissionSafetyRouter, BitReportSeverityLookup) so
operator_bridge stays free of direct scan_controller / mission_executor
imports. scan_controller::ScanControllerHandle implements the scan
router; a new mission_executor::SafetyDispatchHandle wraps the BIT
ack channel + battery monitor handle and implements the safety router;
BitControllerHandle gains a bounded (16-entry) report-severity cache
for the lookup trait.
scan_controller also picks up ConfirmPoi handling: PoiQueue::confirm
removes the entry and SubmitOutcome::Confirmed carries the typed
(target_mgrs, target_class) hint for AZ-684/AZ-686 downstream.
Tests: 9 new integration tests in operator_bridge/tests/dispatcher.rs
cover AZ-680 AC-1..AC-5 + AZ-681 AC-1..AC-4. scan_controller adds 2
ConfirmPoi tests. All modified-crate suites green; one pre-existing
mission_executor state-machine test flake (already documented in
_docs/_process_leftovers) updated to note ac1 also affected.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pins operator-link transport to gRPC server-streaming (closes
architecture Q2 in favour of gRPC). Adds first-time tonic / prost /
tonic-build infrastructure to the workspace; uses
protoc-bin-vendored so neither dev machines nor CI need system
protoc installed.
Design — back-pressure lives in the per-topic tokio::sync::broadcast
ring, drained directly by the tonic-streamed response via
BroadcastStream + StreamMap. No intermediate mpsc buffer that could
absorb back-pressure invisibly. Slow client overrun -> Lagged(n)
event -> per-(client_id, topic) drop counter incremented; healthy
clients on the same topic are unaffected.
Service surface — Subscribe(SubscribeRequest) -> stream
TelemetryMessage; five topics (TelemetrySample, GimbalState,
DetectionEvent, MovementCandidate, MapObjectsBundle); empty topics
list defaults to subscribe-all; empty client_id rejected; stream
drop decrements subscribed_clients via StreamGuard. TelemetrySink
push_detections is now real; push_frame still NotImplemented(AZ-676
video path).
Tests — 6 unit + 5 integration (AC-1..AC-3 via in-process gRPC
client, plus subscribe-all default + empty-client_id rejection).
Clippy on telemetry_stream clean.
Pre-existing mission_executor ac3 test polling race surfaces more
reliably under the new tonic build pressure; documented as
_docs/_process_leftovers/2026-05-20_mission_executor_ac3_flake.md
and unchanged by this batch.
Co-authored-by: Cursor <cursoragent@cursor.com>
AZ-657 (frame_ingest): RTSP session lifecycle FSM with bounded
exponential backoff (1 s → 30 s cap), AI-lock plumb through
watch::Sender that stamps every emitted Frame, and SPS/PPS
hard-fail via OpenError::UnsupportedProfile. The actual RTSP wire
client is abstracted behind an RtspTransport trait so AZ-658 can
pin retina/FFmpeg alongside the decoder; the lifecycle FSM itself
is production code today. tokio::select! around every transport
call so a hung open/read cannot wedge graceful shutdown. 10 unit +
5 integration tests cover happy path, bounded reconnect, stream-
drop reopen, hard-fail no-retry, and AI-lock toggle.
AZ-682 (scan_controller): typed ScanState (ZoomedOut / ZoomedIn /
TargetFollow) with a complete pure transition catalogue, every
(state, trigger) → next_state from description.md §1/§4/§5 covered;
spec-disallowed combos return TransitionOutcome.accepted = false
with RejectReason::UnsupportedTransition (loud, not silent). Frame-
rate floor monitor with hysteresis suppresses ZoomedOut → ZoomedIn
while sustained FPS < 10 fps per description.md §5/§6. Rolling
100-sample tick-latency window surfaces p99; health goes yellow
above the 10 ms budget. 18 unit + 5 integration tests cover the
catalogue, fps-floor activate/clear, and tick-latency budget.
Cumulative review (batches 10-12): all OPEN findings carried
forward without regressions. See
_docs/03_implementation/batch_12_cycle1_report.md §6.
Notes: pre-existing dead-code error in autopilot::Runtime::
vlm_provider_name (origin batch 4) blocks workspace -D warnings
clippy. Recorded in _docs/_process_leftovers/ — not in batch 12
scope.
Co-authored-by: Cursor <cursoragent@cursor.com>
Oleksandr Bezdieniezhnykh