Revise skills documentation to incorporate updated directory structure and terminology. Replace references to integration tests with blackbox tests in SKILL.md files and templates. Adjust paths in planning and deployment documentation to align with the new _docs/02_document/ structure, ensuring consistency and clarity throughout the documentation.

2026-04-22 03:56:37 +00:00 · 2026-03-25 06:35:41 +02:00
parent 1c6e8f47b1
commit 531a1301d5
12 changed files with 2190 additions and 0 deletions
@@ -0,0 +1,61 @@
+frame_index,image,expected_lat,expected_lon,max_error_m,threshold_50m_applies,threshold_20m_applies
+1,AD000001.jpg,48.275292,37.385220,100,yes,yes
+2,AD000002.jpg,48.275001,37.382922,100,yes,yes
+3,AD000003.jpg,48.274520,37.381657,100,yes,yes
+4,AD000004.jpg,48.274956,37.379004,100,yes,yes
+5,AD000005.jpg,48.273997,37.379828,100,yes,yes
+6,AD000006.jpg,48.272538,37.380294,100,yes,yes
+7,AD000007.jpg,48.272408,37.379153,100,yes,yes
+8,AD000008.jpg,48.271992,37.377572,100,yes,yes
+9,AD000009.jpg,48.271376,37.376671,100,yes,yes
+10,AD000010.jpg,48.271233,37.374806,100,yes,yes
+11,AD000011.jpg,48.270334,37.374442,100,yes,yes
+12,AD000012.jpg,48.269922,37.373284,100,yes,yes
+13,AD000013.jpg,48.269366,37.372134,100,yes,yes
+14,AD000014.jpg,48.268759,37.370940,100,yes,yes
+15,AD000015.jpg,48.268291,37.369815,100,yes,yes
+16,AD000016.jpg,48.267719,37.368469,100,yes,yes
+17,AD000017.jpg,48.267461,37.367255,100,yes,yes
+18,AD000018.jpg,48.266663,37.365888,100,yes,yes
+19,AD000019.jpg,48.266135,37.365460,100,yes,yes
+20,AD000020.jpg,48.265574,37.364211,100,yes,yes
+21,AD000021.jpg,48.264892,37.362998,100,yes,yes
+22,AD000022.jpg,48.264393,37.361086,100,yes,yes
+23,AD000023.jpg,48.263803,37.361028,100,yes,yes
+24,AD000024.jpg,48.263014,37.359878,100,yes,yes
+25,AD000025.jpg,48.262635,37.358277,100,yes,yes
+26,AD000026.jpg,48.261819,37.357116,100,yes,yes
+27,AD000027.jpg,48.261182,37.355907,100,yes,yes
+28,AD000028.jpg,48.260727,37.354723,100,yes,yes
+29,AD000029.jpg,48.260117,37.353469,100,yes,yes
+30,AD000030.jpg,48.259677,37.352165,100,yes,yes
+31,AD000031.jpg,48.258881,37.351376,100,yes,yes
+32,AD000032.jpg,48.258425,37.349964,100,yes,yes
+33,AD000033.jpg,48.258653,37.347004,100,yes,yes
+34,AD000034.jpg,48.257879,37.347711,100,yes,yes
+35,AD000035.jpg,48.256777,37.348444,100,yes,yes
+36,AD000036.jpg,48.255756,37.348098,100,yes,yes
+37,AD000037.jpg,48.255375,37.346549,100,yes,yes
+38,AD000038.jpg,48.254799,37.345603,100,yes,yes
+39,AD000039.jpg,48.254557,37.344566,100,yes,yes
+40,AD000040.jpg,48.254380,37.344375,100,yes,yes
+41,AD000041.jpg,48.253722,37.343093,100,yes,yes
+42,AD000042.jpg,48.254205,37.340532,100,yes,yes
+43,AD000043.jpg,48.252380,37.342112,100,yes,yes
+44,AD000044.jpg,48.251489,37.343079,100,yes,yes
+45,AD000045.jpg,48.251085,37.346128,100,yes,yes
+46,AD000046.jpg,48.250413,37.344034,100,yes,yes
+47,AD000047.jpg,48.249414,37.343296,100,yes,yes
+48,AD000048.jpg,48.249114,37.346895,100,yes,yes
+49,AD000049.jpg,48.250241,37.347741,100,yes,yes
+50,AD000050.jpg,48.250974,37.348379,100,yes,yes
+51,AD000051.jpg,48.251528,37.349468,100,yes,yes
+52,AD000052.jpg,48.251873,37.350485,100,yes,yes
+53,AD000053.jpg,48.252161,37.351491,100,yes,yes
+54,AD000054.jpg,48.252685,37.352343,100,yes,yes
+55,AD000055.jpg,48.253268,37.353119,100,yes,yes
+56,AD000056.jpg,48.253767,37.354246,100,yes,yes
+57,AD000057.jpg,48.254329,37.354946,100,yes,yes
+58,AD000058.jpg,48.254874,37.355765,100,yes,yes
+59,AD000059.jpg,48.255481,37.356501,100,yes,yes
+60,AD000060.jpg,48.256246,37.357485,100,yes,yes
@@ -0,0 +1,166 @@
+# Expected Results
+
+Maps every input data item to its quantifiable expected result.
+Tests use this mapping to compare actual system output against known-correct answers.
+
+## Result Format Legend
+
+| Result Type | When to Use | Example |
+|-------------|-------------|---------|
+| Exact value | Output must match precisely | `fix_type: 3`, `satellites_visible: 10` |
+| Tolerance range | Numeric output with acceptable variance | `lat: 48.275292 ± 50m` |
+| Threshold | Output must exceed or stay below a limit | `latency < 400ms`, `memory < 8GB` |
+| Pattern match | Output must match a string/regex pattern | `RELOC_REQ: last_lat=.* last_lon=.* uncertainty=.*m` |
+| File reference | Complex output compared against a reference file | `match expected_results/position_accuracy.csv` |
+| Set/count | Output must contain specific items or counts | `registered_frames / total_frames > 0.95` |
+
+## Comparison Methods
+
+| Method | Description | Tolerance Syntax |
+|--------|-------------|-----------------|
+| `numeric_tolerance` | abs(actual - expected) ≤ tolerance | `± <value>` |
+| `threshold_min` | actual ≥ threshold | `≥ <value>` |
+| `threshold_max` | actual ≤ threshold | `≤ <value>` |
+| `percentage` | percentage of items meeting criterion | `≥ N%` |
+| `exact` | actual == expected | N/A |
+| `regex` | actual matches regex pattern | regex string |
+| `file_reference` | compare against reference file | file path |
+
+## Input → Expected Result Mapping
+
+### Position Accuracy (60-image flight sequence)
+
+Ground truth GPS coordinates for each frame are in `coordinates.csv`. The system processes these frames sequentially (simulating a real flight) with corresponding IMU data (200Hz, from SITL ArduPilot or synthetic generation from trajectory) and satellite tile matches. The system outputs estimated GPS coordinates per frame. Expected results compare estimated positions against ground truth.
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 1 | `coordinates.csv` (all 60 frames) | Sequential flight images with ground truth GPS | ≥ 80% of frames have position error < 50m from ground truth | percentage | ≥ 80% of frames within 50m | `expected_results/position_accuracy.csv` |
+| 2 | `coordinates.csv` (all 60 frames) | Sequential flight images with ground truth GPS | ≥ 60% of frames have position error < 20m from ground truth | percentage | ≥ 60% of frames within 20m | `expected_results/position_accuracy.csv` |
+| 3 | `coordinates.csv` (all 60 frames) | Sequential flight images with ground truth GPS | Per-frame position output in WGS84 (lat, lon) | numeric_tolerance | each frame ± 100m max (no single frame exceeds 100m error) | `expected_results/position_accuracy.csv` |
+| 4 | `coordinates.csv` (all 60 frames) | Sequential flight images with ground truth GPS | Cumulative VO drift between satellite anchors < 100m | threshold_max | ≤ 100m drift between anchors | N/A |
+
+### GPS_INPUT Message Correctness
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 5 | Single frame + IMU data | Normal tracking frame with recent satellite match | `fix_type: 3`, `horiz_accuracy: 5-20m`, `satellites_visible: 10`, lat/lon populated | exact (fix_type, sat), numeric_tolerance (accuracy) | fix_type == 3, horiz_accuracy ∈ [1, 50] | N/A |
+| 6 | Frame sequence, no satellite match for >30s | VO-only tracking, no recent satellite anchor | `fix_type: 3`, `horiz_accuracy: 20-50m` | exact (fix_type), range (accuracy) | fix_type == 3, horiz_accuracy ∈ [20, 100] | N/A |
+| 7 | Frame sequence, VO lost + no satellite | IMU-only dead reckoning | `fix_type: 2`, `horiz_accuracy: 50-200m+` (growing over time) | exact (fix_type), threshold_min (accuracy) | fix_type == 2, horiz_accuracy ≥ 50 | N/A |
+| 8 | VO lost + 3 consecutive satellite failures | Total position failure | `fix_type: 0`, `horiz_accuracy: 999.0` | exact | fix_type == 0, horiz_accuracy == 999.0 | N/A |
+| 9 | Any valid frame | GPS_INPUT output rate | GPS_INPUT messages at 5-10Hz continuous | range | 5 ≤ rate_hz ≤ 10 | N/A |
+
+### Confidence Tier Transitions
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 10 | Frame with satellite match <30s ago, covariance <400m² | HIGH confidence conditions | Confidence tier: HIGH, SSE confidence: "HIGH" | exact | N/A | N/A |
+| 11 | Frame with cuVSLAM OK, no satellite match >30s | MEDIUM confidence conditions | Confidence tier: MEDIUM, SSE confidence: "MEDIUM" | exact | N/A | N/A |
+| 12 | Frame with cuVSLAM lost, IMU-only | LOW confidence conditions | Confidence tier: LOW, SSE confidence: "LOW" | exact | N/A | N/A |
+| 13 | 3+ consecutive total failures | FAILED conditions | Confidence tier: FAILED, SSE confidence: "FAILED", fix_type: 0 | exact | N/A | N/A |
+
+### Image Registration & Visual Odometry
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 14 | 60 sequential flight images | Normal flight (no sharp turns) | Image registration rate ≥ 95% (≥ 57 of 60 registered) | percentage | ≥ 95% | N/A |
+| 15 | 60 sequential flight images | Normal flight images | Mean reprojection error < 1.0 pixels | threshold_max | MRE < 1.0 px | N/A |
+
+### Disconnected Route Segments & Sharp Turns
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 16 | Frames 32-43 from coordinates.csv | Trajectory with direction change (turn area) | System continues producing position estimates through the turn | threshold_min | ≥ 1 position output per frame | N/A |
+| 17 | Simulated consecutive frames with 350m gap | Outlier between 2 consecutive photos due to tilt | System handles outlier, position estimate not corrupted (error < 100m for next valid frame) | threshold_max | ≤ 100m error after recovery | N/A |
+| 18 | Simulated sharp turn (no overlap, <5% overlap, <70° angle, <200m drift) | Sharp turn where VO fails | Satellite re-localization triggers, position recovered within 3 frames after turn | threshold_max | position error ≤ 50m after re-localization | N/A |
+| 19 | Simulated VO loss + satellite match success | Tracking loss → re-localization | cuVSLAM restarts, ESKF position corrected, tracking_state returns to NORMAL | exact | tracking_state == NORMAL after recovery | N/A |
+
+### 3-Consecutive-Failure Re-Localization
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 20 | Simulated VO loss + 3 satellite match failures | Cannot determine position by any means | Re-localization request sent: `RELOC_REQ: last_lat=.* last_lon=.* uncertainty=.*m` | regex | message matches pattern | N/A |
+| 21 | Re-localization request active | System waiting for operator | GPS_INPUT fix_type=0, system continues IMU prediction, continues satellite matching attempts | exact (fix_type) | fix_type == 0 | N/A |
+| 22 | Operator sends approximate coordinates (lat, lon) | Operator re-localization hint | System uses hint as ESKF measurement (high covariance ~500m), attempts satellite match in new area | threshold_max | position error ≤ 500m initially, ≤ 50m after satellite match | N/A |
+
+### Startup & Handoff
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 23 | System boot with GLOBAL_POSITION_INT available | Normal startup | System reads initial position, initializes ESKF, starts GPS_INPUT output | exact | GPS_INPUT output begins within 60s of boot | N/A |
+| 24 | System boot + first satellite match | Startup validation | First satellite match validates initial position, position error drops | threshold_max | position error ≤ 50m after first satellite match | N/A |
+
+### Mid-Flight Reboot Recovery
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 25 | System process killed mid-flight | Companion computer reboot | System recovers: reads FC position, inits ESKF with high uncertainty, loads TRT engines, starts cuVSLAM, performs satellite match | threshold_max | total recovery time ≤ 70s | N/A |
+| 26 | Post-reboot first satellite match | Recovery validation | Position accuracy restored after first satellite match | threshold_max | position error ≤ 50m after first satellite match | N/A |
+
+### Object Localization
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 27 | POST /objects/locate with pixel_x, pixel_y, gimbal angles, zoom, known UAV position | Object at known ground GPS | Response: `{ lat, lon, alt, accuracy_m, confidence }` with lat/lon matching ground truth | numeric_tolerance | lat/lon within accuracy_m of ground truth (consistent with frame-center accuracy) | N/A |
+| 28 | POST /objects/locate with invalid pixel coordinates | Out-of-frame pixel | HTTP 422 or error response indicating invalid input | exact | HTTP status 422 | N/A |
+
+### Coordinate Transform Chain
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 29 | Known GPS → NED → pixel → GPS round-trip | Coordinate transform validation | Round-trip error < 0.1m | threshold_max | ≤ 0.1m | N/A |
+
+### API & Communication
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 30 | GET /health | Health check endpoint | HTTP 200, JSON with memory_mb, gpu_temp_c, status fields | exact (status code), regex (body) | status == 200, body contains `"status"` | N/A |
+| 31 | POST /sessions | Start session | HTTP 200/201 with session ID | exact | status ∈ {200, 201} | N/A |
+| 32 | GET /sessions/{id}/stream | SSE position stream | SSE events at ~1Hz with fields: type, timestamp, lat, lon, alt, accuracy_h, confidence, vo_status | regex | each event matches SSE schema | N/A |
+| 33 | Unauthenticated request to /sessions | No JWT token | HTTP 401 Unauthorized | exact | status == 401 | N/A |
+
+### Performance Thresholds
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 34 | Single camera frame (6252x4168) | End-to-end processing time | Total pipeline latency < 400ms (capture → GPS coordinate output) | threshold_max | ≤ 400ms | N/A |
+| 35 | 30-minute sustained operation | Memory usage over time | Peak memory < 8GB, no memory leaks (growth < 50MB over 30min) | threshold_max | peak < 8192MB, growth ≤ 50MB | N/A |
+| 36 | 30-minute sustained operation | GPU thermal | SoC junction temperature stays below 80°C (no throttling) | threshold_max | ≤ 80°C | N/A |
+| 37 | cuVSLAM single frame | VO processing time | cuVSLAM inference ≤ 20ms per frame | threshold_max | ≤ 20ms | N/A |
+| 38 | Satellite matching single frame | Satellite matching time (async) | LiteSAM/XFeat inference ≤ 330ms | threshold_max | ≤ 330ms | N/A |
+| 39 | TRT engine load | Engine initialization time | All TRT engines loaded within 10s total | threshold_max | ≤ 10s | N/A |
+
+### Satellite Tile Management
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 40 | Mission area definition (200km path, ±2km buffer, zoom 18) | Tile storage calculation | Total storage 500-800MB for zoom 18 + zoom 19 flight path | range | [300MB, 1000MB] | N/A |
+| 41 | ESKF position ± 3σ search radius | Tile selection | Tiles covering search area loaded, mosaic assembled, covers at least 500m radius | threshold_min | coverage radius ≥ 500m | N/A |
+
+### TRT Engine Validation
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 42 | LiteSAM PyTorch model → ONNX → TRT FP16 | TRT engine conversion | Engine builds successfully on Jetson Orin Nano Super | exact | exit_code == 0 | N/A |
+| 43 | TRT engine output vs PyTorch reference (same input) | Inference correctness | Max L1 error between TRT and PyTorch output < 0.01 | threshold_max | L1_max < 0.01 | N/A |
+| 44 | LiteSAM MinGRU operations | TRT compatibility check | All MinGRU ops supported in TRT 10.3 (polygraphy inspect) | exact | unsupported_ops == 0 | N/A |
+
+### Telemetry
+
+| # | Input | Input Description | Expected Result | Comparison | Tolerance | Reference File |
+|---|-------|-------------------|-----------------|------------|-----------|---------------|
+| 45 | Normal operation | Telemetry output rate | NAMED_VALUE_FLOAT messages at 1Hz (gps_conf, gps_drift, gps_hacc) | numeric_tolerance | rate: 1Hz ± 0.2Hz | N/A |
+| 46 | VO tracking lost + 3 satellite failures | Re-localization telemetry | STATUSTEXT with RELOC_REQ sent to ground station | regex | message matches `RELOC_REQ:.*` | N/A |
+
+## Expected Result Reference Files
+
+### position_accuracy.csv
+
+Reference file: `expected_results/position_accuracy.csv`
+
+Contains the ground truth GPS coordinate for each frame in the 60-image test sequence (copied from `coordinates.csv`) plus the acceptance thresholds. Test harness computes haversine distance between estimated and ground truth positions, then applies aggregate criteria.
+
+Thresholds applied to the full 60-frame sequence:
+- ≥ 80% of frames: error < 50m
+- ≥ 60% of frames: error < 20m
+- 0% of frames: error > 100m (no single frame exceeds 100m)
+- Cumulative VO drift between satellite anchors: < 100m
@@ -0,0 +1,622 @@
+# Solution Draft
+
+## Assessment Findings
+
+
+| Old Component Solution                                                               | Weak Point (functional/security/performance)                                                                                                                                                                            | New Solution                                                                                                                                                                                                                                                   |
+| ------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ESKF described as "16-state vector, ~10MB" with no mathematical specification        | **Functional**: No state vector, no process model (F,Q), no measurement models (H for VO, H for satellite), no noise parameters, no scale observability analysis. Impossible to implement or validate accuracy claims.  | **Define complete ESKF specification**: 15-state error vector, IMU-driven prediction, dual measurement models (VO relative pose, satellite absolute position), initial Q/R values, scale constraint via altitude + satellite corrections.                      |
+| GPS_INPUT at 5-10Hz via pymavlink — no field mapping                                 | **Functional**: GPS_INPUT requires 15+ fields (velocity, accuracy, hdop, fix_type, GPS time). No specification of how ESKF state maps to these fields. ArduPilot requires minimum 5Hz.                                  | **Define GPS_INPUT population spec**: velocity from ESKF, accuracy from covariance, fix_type from confidence tier, GPS time from system clock conversion, synthesized hdop/vdop.                                                                               |
+| Confidence scoring "unchanged from draft03" — not in draft05                         | **Functional**: Draft05 is supposed to be self-contained. Confidence scoring determines GPS_INPUT accuracy fields and fix_type — directly affects how ArduPilot EKF weights the position data.                          | **Define confidence scoring inline**: 3 tiers (satellite-anchored, VO-tracked, IMU-only) mapping to fix_type + accuracy values.                                                                                                                                |
+| Coordinate transformations not defined                                               | **Functional**: No pixel→camera→body→NED→WGS84 chain. Camera is not autostabilized, so body attitude matters. Satellite match → WGS84 conversion undefined. Object localization impossible without these transforms.    | **Define coordinate transformation chain**: camera intrinsics K, camera-to-body extrinsic T_cam_body, body-to-NED from ESKF attitude, NED origin at mission start point.                                                                                       |
+| Disconnected route segments — "satellite re-localization" mentioned but no algorithm | **Functional**: AC requires handling as "core to the system." Multiple disconnected segments expected. No tracking-loss detection, no re-localization trigger, no ESKF re-initialization, no cuVSLAM restart procedure. | **Define re-localization pipeline**: detect cuVSLAM tracking loss → IMU-only ESKF prediction → trigger satellite match on every frame → on match success: ESKF position reset + cuVSLAM restart → on 3 consecutive failures: operator re-localization request. |
+| No startup handoff from GPS to GPS-denied                                            | **Functional**: System reads GLOBAL_POSITION_INT at startup but no protocol for when GPS is lost/spoofed vs system start. No validation of initial position.                                                            | **Define handoff protocol**: system runs continuously, FC receives both real GPS and GPS_INPUT. GPS-denied system always provides its estimate; FC selects best source. Initial position validated against first satellite match.                              |
+| No mid-flight reboot recovery                                                        | **Functional**: AC requires: "re-initialize from flight controller's current IMU-extrapolated position." No procedure defined. Recovery time estimation missing.                                                        | **Define reboot recovery sequence**: read FC position → init ESKF with high uncertainty → load TRT engines → start cuVSLAM → immediate satellite match. Estimated recovery: ~35-70s. Document as known limitation.                                             |
+| 3-consecutive-failure re-localization request undefined                              | **Functional**: AC requires ground station re-localization request. No message format, no operator workflow, no system behavior while waiting.                                                                          | **Define re-localization protocol**: detect 3 failures → send custom MAVLink message with last known position + uncertainty → operator provides approximate coordinates → system uses as ESKF measurement with high covariance.                                |
+| Object localization — "trigonometric calculation" with no details                    | **Functional**: No math, no API, no Viewpro gimbal integration, no accuracy propagation. Other onboard systems cannot use this component as specified.                                                                  | **Define object localization**: pixel→ray using Viewpro intrinsics + gimbal angles → body frame → NED → ray-ground intersection → WGS84. FastAPI endpoint: POST /objects/locate. Accuracy propagated from UAV position + gimbal uncertainty.                   |
+| Satellite matching — GSD normalization and tile selection unspecified                | **Functional**: Camera GSD ~15.9 cm/px at 600m vs satellite ~0.3 m/px at zoom 19. The "pre-resize" step is mentioned but not specified. Tile selection radius based on ESKF uncertainty not defined.                    | **Define GSD handling**: downsample camera frame to match satellite GSD. Define tile selection: ESKF position ± 3σ_horizontal → select tiles covering that area. Assemble tile mosaic for matching.                                                            |
+| Satellite tile storage requirements not calculated                                   | **Functional**: "±2km" preload mentioned but no storage estimate. At zoom 19: a 200km path with ±2km buffer requires ~~130K tiles (~~2.5GB).                                                                            | **Calculate tile storage**: specify zoom level (18 preferred — 0.6m/px, 4× fewer tiles), estimate storage per mission profile, define maximum mission area by storage limit.                                                                                   |
+| FastAPI endpoints not in solution draft                                              | **Functional**: Endpoints only in security_analysis.md. No request/response schemas. No SSE event format. No object localization endpoint.                                                                              | **Consolidate API spec in solution**: define all endpoints, SSE event schema, object localization endpoint. Reference security_analysis.md for auth.                                                                                                           |
+| cuVSLAM configuration missing (calibration, IMU params, mode)                        | **Functional**: No camera calibration procedure, no IMU noise parameters, no T_imu_rig extrinsic, no mode selection (Mono vs Inertial).                                                                                 | **Define cuVSLAM configuration**: use Inertial mode, specify required calibration data (camera intrinsics, distortion, IMU noise params from datasheet, T_imu_rig from physical measurement), define calibration procedure.                                    |
+| tech_stack.md inconsistent with draft05                                              | **Functional**: tech_stack.md says 3fps (should be 0.7fps), LiteSAM at 480px (should be 1280px), missing EfficientLoFTR.                                                                                                | **Flag for update**: tech_stack.md must be synchronized with draft05 corrections. Not addressed in this draft — separate task.                                                                                                                                 |
+
+
+## Overall Maturity Assessment
+
+
+| Category                      | Maturity (1-5) | Assessment                                                                                                                              |
+| ----------------------------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
+| Hardware & Platform Selection | 3.5            | UAV airframe, cameras, Jetson, batteries — well-researched with specs, weight budget, endurance calculations. Ready for procurement.    |
+| Core Algorithm Selection      | 3.0            | cuVSLAM, LiteSAM/XFeat, ESKF — components selected with comparison tables, fallback chains, decision trees. Day-one benchmarks defined. |
+| AI Inference Runtime          | 3.5            | TRT Engine migration thoroughly analyzed. Conversion workflows, memory savings, performance estimates. Code wrapper provided.           |
+| Sensor Fusion (ESKF)          | 1.5            | Mentioned but not specified. No implementable detail. Blockerfor coding.                                                                |
+| System Integration            | 1.5            | GPS_INPUT, coordinate transforms, inter-component data flow — all under-specified.                                                      |
+| Edge Cases & Resilience       | 1.0            | Disconnected segments, reboot recovery, re-localization — acknowledged but no algorithms.                                               |
+| Operational Readiness         | 0.5            | No pre-flight procedures, no in-flight monitoring, no failure response.                                                                 |
+| Security                      | 3.0            | Comprehensive threat model, OP-TEE analysis, LUKS, secure boot. Well-researched.                                                        |
+| **Overall TRL**               | **~2.5**       | **Technology concept formulated + some component validation. Not implementation-ready.**                                                |
+
+
+The solution is at approximately **TRL 3** (proof of concept) for hardware/algorithm selection and **TRL 1-2** (basic concept) for system integration, ESKF, and operational procedures.
+
+## Product Solution Description
+
+A real-time GPS-denied visual navigation system for fixed-wing UAVs, running on a Jetson Orin Nano Super (8GB). All AI model inference uses native TensorRT Engine files. The system replaces the GPS module by sending MAVLink GPS_INPUT messages via pymavlink over UART at 5-10Hz.
+
+Position is determined by fusing: (1) CUDA-accelerated visual odometry (cuVSLAM in Inertial mode) from ADTI 20L V1 at 0.7 fps sustained, (2) absolute position corrections from satellite image matching (LiteSAM or XFeat — TRT Engine FP16) using keyframes from the same ADTI image stream, and (3) IMU data from the flight controller via ESKF. Viewpro A40 Pro is reserved for AI object detection only.
+
+The ESKF is the central state estimator with 15-state error vector. It fuses:
+
+- **IMU prediction** at 5-10Hz (high-frequency pose propagation)
+- **cuVSLAM VO measurement** at 0.7Hz (relative pose correction)
+- **Satellite matching measurement** at ~0.07-0.14Hz (absolute position correction)
+
+GPS_INPUT messages carry position, velocity, and accuracy derived from the ESKF state and covariance.
+
+**Hard constraint**: ADTI 20L V1 shoots at 0.7 fps sustained (1430ms interval). Full VO+ESKF pipeline within 400ms per frame. Satellite matching async on keyframes (every 5-10 camera frames). GPS_INPUT at 5-10Hz (ESKF IMU prediction fills gaps between camera frames).
+
+```
+┌─────────────────────────────────────────────────────────────────────┐
+│                    OFFLINE (Before Flight)                           │
+│  1. Satellite Tiles → Download & Validate → Pre-resize → Store      │
+│     (Google Maps)     (≥0.5m/px, <2yr)     (matcher res)  (GeoHash)│
+│  2. TRT Engine Build (one-time per model version):                  │
+│     PyTorch model → reparameterize → ONNX export → trtexec --fp16  │
+│     Output: litesam.engine, xfeat.engine                            │
+│  3. Camera + IMU calibration (one-time per hardware unit)           │
+│  4. Copy tiles + engines + calibration to Jetson storage            │
+└─────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌─────────────────────────────────────────────────────────────────────┐
+│                    ONLINE (During Flight)                            │
+│                                                                     │
+│  STARTUP:                                                           │
+│  1. pymavlink → read GLOBAL_POSITION_INT → init ESKF state         │
+│  2. Load TRT engines + allocate GPU buffers                         │
+│  3. Load camera calibration + IMU calibration                       │
+│  4. Start cuVSLAM (Inertial mode) with ADTI 20L V1                 │
+│  5. Preload satellite tiles ±2km into RAM                           │
+│  6. First satellite match → validate initial position               │
+│  7. Begin GPS_INPUT output loop at 5-10Hz                           │
+│                                                                     │
+│  EVERY CAMERA FRAME (0.7fps from ADTI 20L V1):                     │
+│  ┌──────────────────────────────────────┐                           │
+│  │ ADTI 20L V1 → Downsample (CUDA)     │                           │
+│  │             → cuVSLAM VO+IMU (~9ms)  │ ← CUDA Stream A          │
+│  │             → ESKF VO measurement    │                           │
+│  └──────────────────────────────────────┘                           │
+│                                                                     │
+│  5-10Hz CONTINUOUS (IMU-driven between camera frames):              │
+│  ┌──────────────────────────────────────┐                           │
+│  │ IMU data → ESKF prediction           │                           │
+│  │ ESKF state → GPS_INPUT fields        │                           │
+│  │ GPS_INPUT → Flight Controller (UART) │                           │
+│  └──────────────────────────────────────┘                           │
+│                                                                     │
+│  KEYFRAMES (every 5-10 camera frames, async):                       │
+│  ┌──────────────────────────────────────┐                           │
+│  │ Camera frame → GSD downsample        │                           │
+│  │ Select satellite tile (ESKF pos±3σ)  │                           │
+│  │ TRT inference (Stream B): LiteSAM/   │                           │
+│  │   XFeat → correspondences            │                           │
+│  │ RANSAC → homography → WGS84 position │                           │
+│  │ ESKF satellite measurement update    │──→ Position correction    │
+│  └──────────────────────────────────────┘                           │
+│                                                                     │
+│  TRACKING LOSS (cuVSLAM fails — sharp turn / featureless):         │
+│  ┌──────────────────────────────────────┐                           │
+│  │ ESKF → IMU-only prediction (growing  │                           │
+│  │   uncertainty)                        │                           │
+│  │ Satellite match on EVERY frame       │                           │
+│  │ On match success → ESKF reset +      │                           │
+│  │   cuVSLAM restart                    │                           │
+│  │ 3 consecutive failures → operator    │                           │
+│  │   re-localization request            │                           │
+│  └──────────────────────────────────────┘                           │
+│                                                                     │
+│  TELEMETRY (1Hz):                                                   │
+│  ┌──────────────────────────────────────┐                           │
+│  │ NAMED_VALUE_FLOAT: confidence, drift │──→ Ground Station         │
+│  └──────────────────────────────────────┘                           │
+└─────────────────────────────────────────────────────────────────────┘
+```
+
+## Architecture
+
+### Component: ESKF Sensor Fusion (NEW — previously unspecified)
+
+**Error-State Kalman Filter** fusing IMU, visual odometry, and satellite matching.
+
+**Nominal state vector** (propagated by IMU):
+
+
+| State      | Symbol | Size | Description                                      |
+| ---------- | ------ | ---- | ------------------------------------------------ |
+| Position   | p      | 3    | NED position relative to mission origin (meters) |
+| Velocity   | v      | 3    | NED velocity (m/s)                               |
+| Attitude   | q      | 4    | Unit quaternion (body-to-NED rotation)           |
+| Accel bias | b_a    | 3    | Accelerometer bias (m/s²)                        |
+| Gyro bias  | b_g    | 3    | Gyroscope bias (rad/s)                           |
+
+
+**Error-state vector** (estimated by ESKF): δx = [δp, δv, δθ, δb_a, δb_g]ᵀ ∈ ℝ¹⁵
+where δθ ∈ so(3) is the 3D rotation error.
+
+**Prediction step** (IMU at 5-10Hz from flight controller):
+
+- Input: accelerometer a_m, gyroscope ω_m, dt
+- Propagate nominal state: p += v·dt, v += (R(q)·(a_m - b_a) - g)·dt, q ⊗= Exp(ω_m - b_g)·dt
+- Propagate error covariance: P = F·P·Fᵀ + Q
+- F is the 15×15 error-state transition matrix (standard ESKF formulation)
+- Q: process noise diagonal, initial values from IMU datasheet noise densities
+
+**VO measurement update** (0.7Hz from cuVSLAM):
+
+- cuVSLAM outputs relative pose: ΔR, Δt (camera frame)
+- Transform to NED: Δp_ned = R_body_ned · T_cam_body · Δt
+- Innovation: z = Δp_ned_measured - Δp_ned_predicted
+- Observation matrix H_vo maps error state to relative position change
+- R_vo: measurement noise, initial ~0.1-0.5m (from cuVSLAM precision at 600m+ altitude)
+- Kalman update: K = P·Hᵀ·(H·P·Hᵀ + R)⁻¹, δx = K·z, P = (I - K·H)·P
+
+**Satellite measurement update** (0.07-0.14Hz, async):
+
+- Satellite matching outputs absolute position: lat_sat, lon_sat in WGS84
+- Convert to NED relative to mission origin
+- Innovation: z = p_satellite - p_predicted
+- H_sat = [I₃, 0, 0, 0, 0] (directly observes position)
+- R_sat: measurement noise, from matching confidence (~5-20m based on RANSAC inlier ratio)
+- Provides absolute position correction — bounds drift accumulation
+
+**Scale observability**:
+
+- Monocular cuVSLAM has scale ambiguity during constant-velocity flight
+- Scale is constrained by: (1) satellite matching absolute positions (primary), (2) known flight altitude from barometer + predefined mission altitude, (3) IMU accelerometer during maneuvers
+- During long straight segments without satellite correction, scale drift is possible. Satellite corrections every ~7-14s re-anchor scale.
+
+**Tuning approach**: Start with IMU datasheet noise values for Q. Start with conservative R values (high measurement noise). Tune on flight test data by comparing ESKF output to known GPS ground truth.
+
+
+| Solution                   | Tools           | Advantages                                                    | Limitations                            | Performance   | Fit         |
+| -------------------------- | --------------- | ------------------------------------------------------------- | -------------------------------------- | ------------- | ----------- |
+| Custom ESKF (Python/NumPy) | NumPy, SciPy    | Full control, minimal dependencies, well-understood algorithm | Implementation effort, tuning required | <1ms per step | ✅ Selected  |
+| FilterPy ESKF              | FilterPy v1.4.5 | Reference implementation, less code                           | Less flexible for multi-rate fusion    | <1ms per step | ⚠️ Fallback |
+
+
+### Component: Coordinate System & Transformations (NEW — previously undefined)
+
+**Reference frames**:
+
+- **Camera frame (C)**: origin at camera optical center, Z forward, X right, Y down (OpenCV convention)
+- **Body frame (B)**: origin at UAV CG, X forward (nose), Y right (starboard), Z down
+- **NED frame (N)**: North-East-Down, origin at mission start point
+- **WGS84**: latitude, longitude, altitude (output format)
+
+**Transformation chain**:
+
+1. **Pixel → Camera ray**: p_cam = K⁻¹ · [u, v, 1]ᵀ where K = camera intrinsic matrix (ADTI 20L V1: fx, fy from 16mm lens + APS-C sensor)
+2. **Camera → Body**: p_body = T_cam_body · p_cam where T_cam_body is the fixed mounting rotation (camera points nadir: 90° pitch rotation from body X-forward to camera Z-down)
+3. **Body → NED**: p_ned = R_body_ned(q) · p_body where q is the ESKF quaternion attitude estimate
+4. **NED → WGS84**: lat = lat_origin + p_north / R_earth, lon = lon_origin + p_east / (R_earth · cos(lat_origin)) where (lat_origin, lon_origin) is the mission start GPS position
+
+**Camera intrinsic matrix K** (ADTI 20L V1 + 16mm lens):
+
+- Sensor: 23.2 × 15.4 mm, Resolution: 5456 × 3632
+- fx = fy = focal_mm × width_px / sensor_width_mm = 16 × 5456 / 23.2 = 3763 pixels
+- cx = 2728, cy = 1816 (sensor center)
+- Distortion: Brown model (k1, k2, p1, p2 from calibration)
+
+**T_cam_body** (camera mount):
+
+- Navigation camera is fixed, pointing nadir (downward), not autostabilized
+- R_cam_body = R_x(180°) · R_z(0°) (camera Z-axis aligned with body -Z, camera X with body X)
+- Translation: offset from CG to camera mount (measured during assembly, typically <0.3m)
+
+**Satellite match → WGS84**:
+
+- Feature correspondences between camera frame and geo-referenced satellite tile
+- Homography H maps camera pixels to satellite tile pixels
+- Satellite tile pixel → WGS84 via tile's known georeference (zoom level + tile x,y → lat,lon)
+- Camera center projects to satellite pixel (cx_sat, cy_sat) via H
+- Convert (cx_sat, cy_sat) to WGS84 using tile georeference
+
+### Component: GPS_INPUT Message Population (NEW — previously undefined)
+
+
+| GPS_INPUT Field         | Source                                         | Computation                                                                                             |
+| ----------------------- | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
+| lat, lon                | ESKF position (NED)                            | NED → WGS84 conversion using mission origin                                                             |
+| alt                     | ESKF position (Down) + mission origin altitude | alt = alt_origin - p_down                                                                               |
+| vn, ve, vd              | ESKF velocity state                            | Direct from ESKF v[0], v[1], v[2]                                                                       |
+| fix_type                | Confidence tier                                | 3 (3D fix) when satellite-anchored (last match <30s). 2 (2D) when VO-only. 0 (no fix) when IMU-only >5s |
+| hdop                    | ESKF horizontal covariance                     | hdop = sqrt(P[0,0] + P[1,1]) / 5.0 (approximate CEP→HDOP mapping)                                       |
+| vdop                    | ESKF vertical covariance                       | vdop = sqrt(P[2,2]) / 5.0                                                                               |
+| horiz_accuracy          | ESKF horizontal covariance                     | horiz_accuracy = sqrt(P[0,0] + P[1,1]) meters                                                           |
+| vert_accuracy           | ESKF vertical covariance                       | vert_accuracy = sqrt(P[2,2]) meters                                                                     |
+| speed_accuracy          | ESKF velocity covariance                       | speed_accuracy = sqrt(P[3,3] + P[4,4]) m/s                                                              |
+| time_week, time_week_ms | System time                                    | Convert Unix time to GPS epoch (GPS epoch = 1980-01-06, subtract leap seconds)                          |
+| satellites_visible      | Constant                                       | 10 (synthetic — prevents satellite-count failsafes in ArduPilot)                                        |
+| gps_id                  | Constant                                       | 0                                                                                                       |
+| ignore_flags            | Constant                                       | 0 (provide all fields)                                                                                  |
+
+
+**Confidence tiers** mapping to GPS_INPUT:
+
+
+| Tier   | Condition                                         | fix_type   | horiz_accuracy                  | Rationale                              |
+| ------ | ------------------------------------------------- | ---------- | ------------------------------- | -------------------------------------- |
+| HIGH   | Satellite match <30s ago, ESKF covariance < 400m² | 3 (3D fix) | From ESKF P (typically 5-20m)   | Absolute position anchor recent        |
+| MEDIUM | cuVSLAM tracking OK, no recent satellite match    | 3 (3D fix) | From ESKF P (typically 20-50m)  | Relative tracking valid, drift growing |
+| LOW    | cuVSLAM lost, IMU-only                            | 2 (2D fix) | From ESKF P (50-200m+, growing) | Only IMU dead reckoning, rapid drift   |
+| FAILED | 3+ consecutive total failures                     | 0 (no fix) | 999.0                           | System cannot determine position       |
+
+
+### Component: Disconnected Route Segment Handling (NEW — previously undefined)
+
+**Trigger**: cuVSLAM reports tracking_lost OR tracking confidence drops below threshold
+
+**Algorithm**:
+
+```
+STATE: TRACKING_NORMAL
+  cuVSLAM provides relative pose
+  ESKF VO measurement updates at 0.7Hz
+  Satellite matching on keyframes (every 5-10 frames)
+
+STATE: TRACKING_LOST (enter when cuVSLAM reports loss)
+  1. ESKF continues with IMU-only prediction (no VO updates)
+     → uncertainty grows rapidly (~1-5 m/s drift with consumer IMU)
+  2. Switch satellite matching to EVERY frame (not just keyframes)
+     → maximize chances of getting absolute correction
+  3. For each camera frame:
+     a. Attempt satellite match using ESKF predicted position ± 3σ for tile selection
+     b. If match succeeds (RANSAC inlier ratio > 30%):
+        → ESKF measurement update with satellite position
+        → Restart cuVSLAM with current frame as new origin
+        → Transition to TRACKING_NORMAL
+        → Reset failure counter
+     c. If match fails:
+        → Increment failure_counter
+        → Continue IMU-only ESKF prediction
+  4. If failure_counter >= 3:
+     → Send re-localization request to ground station
+     → GPS_INPUT fix_type = 0 (no fix), horiz_accuracy = 999.0
+     → Continue attempting satellite matching on each frame
+  5. If operator sends re-localization hint (approximate lat,lon):
+     → Use as ESKF measurement with high covariance (~500m)
+     → Attempt satellite match in that area
+     → On success: transition to TRACKING_NORMAL
+
+STATE: SEGMENT_DISCONNECT
+  After re-localization following tracking loss:
+  → New cuVSLAM track is independent of previous track
+  → ESKF maintains global NED position continuity via satellite anchor
+  → No need to "connect" segments at the cuVSLAM level
+  → ESKF already handles this: satellite corrections keep global position consistent
+```
+
+### Component: Satellite Image Matching Pipeline (UPDATED — added GSD + tile selection details)
+
+**GSD normalization**:
+
+- Camera GSD at 600m: ~15.9 cm/pixel (ADTI 20L V1 + 16mm)
+- Satellite tile GSD at zoom 18: ~0.6 m/pixel
+- Scale ratio: ~3.8:1
+- Downsample camera image to satellite GSD before matching: resize from 5456×3632 to ~1440×960 (matching zoom 18 GSD)
+- This is close to LiteSAM's 1280px input — use 1280px with minor GSD mismatch acceptable for matching
+
+**Tile selection**:
+
+- Input: ESKF position estimate (lat, lon) + horizontal covariance σ_h
+- Search radius: max(3·σ_h, 500m) — at least 500m to handle initial uncertainty
+- Compute geohash for center position → load tiles covering the search area
+- Assemble tile mosaic if needed (typically 2×2 to 4×4 tiles for adequate coverage)
+- If ESKF uncertainty > 2km: tile selection unreliable, fall back to wider search or request operator input
+
+**Tile storage calculation** (zoom 18 — 0.6 m/pixel):
+
+- Each 256×256 tile covers ~153m × 153m
+- Flight path 200km with ±2km buffer: area ≈ 200km × 4km = 800 km²
+- Tiles needed: 800,000,000 / (153 × 153) ≈ 34,200 tiles
+- Storage: ~10-15KB per JPEG tile → ~340-510 MB
+- With zoom 19 overlap tiles for higher precision: ×4 = ~1.4-2.0 GB
+- Recommended: zoom 18 primary + zoom 19 for ±500m along flight path → ~500-800 MB total
+
+
+| Solution                               | Tools                     | Advantages                                                               | Limitations                                            | Performance (est. Orin Nano Super TRT FP16) | Params | Fit                             |
+| -------------------------------------- | ------------------------- | ------------------------------------------------------------------------ | ------------------------------------------------------ | ------------------------------------------- | ------ | ------------------------------- |
+| LiteSAM (opt) TRT Engine FP16 @ 1280px | trtexec + tensorrt Python | Best satellite-aerial accuracy (RMSE@30=17.86m UAV-VisLoc), 6.31M params | MinGRU TRT export needs verification (LOW-MEDIUM risk) | Est. ~165-330ms                             | 6.31M  | ✅ Primary                       |
+| EfficientLoFTR TRT Engine FP16         | trtexec + tensorrt Python | Proven TRT path (Coarse_LoFTR_TRT). Semi-dense. CVPR 2024.               | 2.4x more params than LiteSAM.                         | Est. ~200-400ms                             | 15.05M | ✅ Fallback if LiteSAM TRT fails |
+| XFeat TRT Engine FP16                  | trtexec + tensorrt Python | Fastest. Proven TRT implementation.                                      | General-purpose, not designed for cross-view gap.      | Est. ~50-100ms                              | <5M    | ✅ Speed fallback                |
+
+
+### Component: cuVSLAM Configuration (NEW — previously undefined)
+
+**Mode**: Inertial (mono camera + IMU)
+
+**Camera configuration** (ADTI 20L V1 + 16mm lens):
+
+- Model: Brown distortion
+- fx = fy = 3763 px (16mm on 23.2mm sensor at 5456px width)
+- cx = 2728 px, cy = 1816 px
+- Distortion coefficients: from calibration (k1, k2, p1, p2)
+- Border: 50px (ignore lens edge distortion)
+
+**IMU configuration** (Pixhawk 6x IMU — ICM-42688-P):
+
+- Gyroscope noise density: 3.0 × 10⁻³ °/s/√Hz
+- Gyroscope random walk: 5.0 × 10⁻⁵ °/s²/√Hz
+- Accelerometer noise density: 70 µg/√Hz
+- Accelerometer random walk: ~2.0 × 10⁻³ m/s³/√Hz
+- IMU frequency: 200 Hz (from flight controller via MAVLink)
+- T_imu_rig: measured transformation from Pixhawk IMU to camera center (translation + rotation)
+
+**cuVSLAM settings**:
+
+- OdometryMode: INERTIAL
+- MulticameraMode: PRECISION (favor accuracy over speed — we have 1430ms budget)
+- Input resolution: downsample to 1280×852 (or 720p) for processing speed
+- async_bundle_adjustment: True
+
+**Initialization**:
+
+- cuVSLAM initializes automatically when it receives the first camera frame + IMU data
+- First few frames used for feature initialization and scale estimation
+- First satellite match validates and corrects the initial position
+
+**Calibration procedure** (one-time per hardware unit):
+
+1. Camera intrinsics: checkerboard calibration with OpenCV (or use manufacturer data if available)
+2. Camera-IMU extrinsic (T_imu_rig): Kalibr tool with checkerboard + IMU data
+3. IMU noise parameters: Allan variance analysis or use datasheet values
+4. Store calibration files on Jetson storage
+
+### Component: AI Model Inference Runtime (UNCHANGED)
+
+Native TRT Engine — optimal performance and memory on fixed NVIDIA hardware. See draft05 for full comparison table and conversion workflow.
+
+### Component: Visual Odometry (UNCHANGED)
+
+cuVSLAM in Inertial mode, fed by ADTI 20L V1 at 0.7 fps sustained. See draft05 for feasibility analysis at 0.7fps.
+
+### Component: Flight Controller Integration (UPDATED — added GPS_INPUT field spec)
+
+pymavlink over UART at 5-10Hz. GPS_INPUT field population defined above.
+
+ArduPilot configuration:
+
+- GPS1_TYPE = 14 (MAVLink)
+- GPS_RATE = 5 (minimum, matching our 5-10Hz output)
+- EK3_SRC1_POSXY = 1 (GPS), EK3_SRC1_VELXY = 1 (GPS) — EKF uses GPS_INPUT as position/velocity source
+
+### Component: Object Localization (NEW — previously undefined)
+
+**Input**: pixel coordinates (u, v) in Viewpro A40 Pro image, current gimbal angles (pan_deg, tilt_deg), zoom factor, UAV position from GPS-denied system, UAV altitude
+
+**Process**:
+
+1. Pixel → camera ray: ray_cam = K_viewpro⁻¹(zoom) · [u, v, 1]ᵀ
+2. Camera → gimbal frame: ray_gimbal = R_gimbal(pan, tilt) · ray_cam
+3. Gimbal → body: ray_body = T_gimbal_body · ray_gimbal
+4. Body → NED: ray_ned = R_body_ned(q) · ray_body
+5. Ray-ground intersection: assuming flat terrain at UAV altitude h: t = -h / ray_ned[2], p_ground_ned = p_uav_ned + t · ray_ned
+6. NED → WGS84: convert to lat, lon
+
+**Output**: { lat, lon, accuracy_m, confidence }
+
+- accuracy_m propagated from: UAV position accuracy (from ESKF) + gimbal angle uncertainty + altitude uncertainty
+
+**API endpoint**: POST /objects/locate
+
+- Request: { pixel_x, pixel_y, gimbal_pan_deg, gimbal_tilt_deg, zoom_factor }
+- Response: { lat, lon, alt, accuracy_m, confidence, uav_position: {lat, lon, alt}, timestamp }
+
+### Component: Startup, Handoff & Failsafe (UPDATED — added handoff + reboot + re-localization)
+
+**GPS-denied handoff protocol**:
+
+- GPS-denied system runs continuously from companion computer boot
+- Reads initial position from FC (GLOBAL_POSITION_INT) — this may be real GPS or last known
+- First satellite match validates the initial position
+- FC receives both real GPS (if available) and GPS_INPUT; FC EKF selects best source based on accuracy
+- No explicit "switch" — the GPS-denied system is a secondary GPS source
+
+**Startup sequence** (expanded from draft05):
+
+1. Boot Jetson → start GPS-Denied service (systemd)
+2. Connect to flight controller via pymavlink on UART
+3. Wait for heartbeat
+4. Initialize PyCUDA context
+5. Load TRT engines: litesam.engine + xfeat.engine (~1-3s each)
+6. Allocate GPU I/O buffers
+7. Create CUDA streams: Stream A (cuVSLAM), Stream B (satellite matching)
+8. Load camera calibration + IMU calibration files
+9. Read GLOBAL_POSITION_INT → set mission origin (NED reference point) → init ESKF
+10. Start cuVSLAM (Inertial mode) with ADTI 20L V1 camera stream
+11. Preload satellite tiles within ±2km into RAM
+12. Trigger first satellite match → validate initial position
+13. Begin GPS_INPUT output loop at 5-10Hz
+14. System ready
+
+**Mid-flight reboot recovery**:
+
+1. Jetson boots (~30-60s)
+2. GPS-Denied service starts, connects to FC
+3. Read GLOBAL_POSITION_INT (FC's current IMU-extrapolated position)
+4. Init ESKF with this position + HIGH uncertainty covariance (σ = 200m)
+5. Load TRT engines (~2-6s total)
+6. Start cuVSLAM (fresh, no prior map)
+7. Immediate satellite matching on first camera frame
+8. On satellite match success: ESKF corrected, uncertainty drops
+9. Estimated total recovery: ~35-70s
+10. During recovery: FC uses IMU-only dead reckoning (at 70 km/h: ~700-1400m uncontrolled drift)
+11. **Known limitation**: recovery time is dominated by Jetson boot time
+
+**3-consecutive-failure re-localization**:
+
+- Trigger: VO lost + satellite match failed × 3 consecutive camera frames
+- Action: send re-localization request via MAVLink STATUSTEXT or custom message
+- Message content: "RELOC_REQ: last_lat={lat} last_lon={lon} uncertainty={σ}m"
+- Operator response: MAVLink COMMAND_LONG with approximate lat/lon
+- System: use operator position as ESKF measurement with R = diag(500², 500², 100²) meters²
+- System continues satellite matching with updated search area
+- While waiting: GPS_INPUT fix_type=0, IMU-only ESKF prediction continues
+
+### Component: Ground Station Telemetry (UPDATED — added re-localization)
+
+MAVLink messages to ground station:
+
+
+| Message                       | Rate     | Content                                             |
+| ----------------------------- | -------- | --------------------------------------------------- |
+| NAMED_VALUE_FLOAT "gps_conf"  | 1Hz      | Confidence score (0.0-1.0)                          |
+| NAMED_VALUE_FLOAT "gps_drift" | 1Hz      | Estimated drift from last satellite anchor (meters) |
+| NAMED_VALUE_FLOAT "gps_hacc"  | 1Hz      | Horizontal accuracy (meters, from ESKF)             |
+| STATUSTEXT                    | On event | "RELOC_REQ: ..." for re-localization request        |
+| STATUSTEXT                    | On event | Tracking loss / recovery notifications              |
+
+
+### Component: Thermal Management (UNCHANGED)
+
+Same adaptive pipeline from draft05. Active cooling required at 25W. Throttling at 80°C SoC junction.
+
+### Component: API & Inter-System Communication (NEW — consolidated)
+
+FastAPI (Uvicorn) running locally on Jetson for inter-process communication with other onboard systems.
+
+
+| Endpoint              | Method    | Purpose                                | Auth |
+| --------------------- | --------- | -------------------------------------- | ---- |
+| /sessions             | POST      | Start GPS-denied session               | JWT  |
+| /sessions/{id}/stream | GET (SSE) | Real-time position + confidence stream | JWT  |
+| /sessions/{id}/anchor | POST      | Operator re-localization hint          | JWT  |
+| /sessions/{id}        | DELETE    | End session                            | JWT  |
+| /objects/locate       | POST      | Object GPS from pixel coordinates      | JWT  |
+| /health               | GET       | System health + memory + thermal       | None |
+
+
+**SSE event schema** (1Hz):
+
+```json
+{
+  "type": "position",
+  "timestamp": "2026-03-17T12:00:00.000Z",
+  "lat": 48.123456,
+  "lon": 37.654321,
+  "alt": 600.0,
+  "accuracy_h": 15.2,
+  "accuracy_v": 8.1,
+  "confidence": "HIGH",
+  "drift_from_anchor": 12.5,
+  "vo_status": "tracking",
+  "last_satellite_match_age_s": 8.3
+}
+```
+
+## UAV Platform
+
+Unchanged from draft05. See draft05 for: airframe configuration (3.5m S-2 composite, 12.5kg AUW), flight performance (3.4h endurance at 50 km/h), camera specifications (ADTI 20L V1 + 16mm, Viewpro A40 Pro), ground coverage calculations.
+
+## Speed Optimization Techniques
+
+Unchanged from draft05. Key points: cuVSLAM ~9ms/frame, native TRT Engine (no ONNX RT), dual CUDA streams, 5-10Hz GPS_INPUT from ESKF IMU prediction.
+
+## Processing Time Budget
+
+Unchanged from draft05. VO frame: ~17-22ms. Satellite matching: ≤210ms async. Well within 1430ms frame interval.
+
+## Memory Budget (Jetson Orin Nano Super, 8GB shared)
+
+
+| Component                 | Memory         | Notes                                       |
+| ------------------------- | -------------- | ------------------------------------------- |
+| OS + runtime              | ~1.5GB         | JetPack 6.2 + Python                        |
+| cuVSLAM                   | ~200-500MB     | CUDA library + map                          |
+| LiteSAM TRT engine        | ~50-80MB       | If LiteSAM fails: EfficientLoFTR ~100-150MB |
+| XFeat TRT engine          | ~30-50MB       |                                             |
+| Preloaded satellite tiles | ~200MB         | ±2km of flight plan                         |
+| pymavlink + MAVLink       | ~20MB          |                                             |
+| FastAPI (local IPC)       | ~50MB          |                                             |
+| ESKF + buffers            | ~10MB          |                                             |
+| **Total**                 | **~2.1-2.9GB** | **26-36% of 8GB**                           |
+
+
+## Key Risks and Mitigations
+
+
+| Risk                                                    | Likelihood | Impact                                                | Mitigation                                                                                                                                                                |
+| ------------------------------------------------------- | ---------- | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| LiteSAM MinGRU ops unsupported in TRT 10.3              | LOW-MEDIUM | LiteSAM TRT export fails                              | Day-one verification. Fallback: EfficientLoFTR TRT → XFeat TRT.                                                                                                           |
+| cuVSLAM fails on low-texture terrain at 0.7fps          | HIGH       | Frequent tracking loss                                | Satellite matching corrections bound drift. Re-localization pipeline handles tracking loss. IMU bridges short gaps.                                                       |
+| Google Maps satellite quality in conflict zone          | HIGH       | Satellite matching fails, outdated imagery            | Pre-flight tile validation. Consider alternative providers (Bing, Mapbox). Robust to seasonal appearance changes via feature-based matching.                              |
+| ESKF scale drift during long constant-velocity segments | MEDIUM     | Position error exceeds 100m between satellite anchors | Satellite corrections every 7-14s re-anchor. Altitude constraint from barometer. Monitor drift rate — if >50m between corrections, increase satellite matching frequency. |
+| Monocular scale ambiguity                               | MEDIUM     | Metric scale lost during constant-velocity flight     | Satellite absolute corrections provide scale. Known altitude constrains vertical scale. IMU acceleration during turns provides observability.                             |
+| AUW exceeds AT4125 recommended range                    | MEDIUM     | Reduced endurance, motor thermal stress               | 12.5 kg vs 8-10 kg recommended. Monitor motor temps. Weight optimization.                                                                                                 |
+| ADTI mechanical shutter lifespan                        | MEDIUM     | Replacement needed periodically                       | ~8,800 actuations/flight at 0.7fps. Estimated 11-57 flights before replacement. Budget as consumable.                                                                     |
+| Mid-flight companion computer failure                   | LOW        | ~35-70s position gap                                  | Reboot recovery procedure defined. FC uses IMU dead reckoning during gap. Known limitation.                                                                               |
+| Thermal throttling on Jetson                            | MEDIUM     | Satellite matching latency increases                  | Active cooling required. Monitor SoC temp. Throttling at 80°C. Our workload ~8-15W typical — well under 25W TDP.                                                          |
+| Engine incompatibility after JetPack update             | MEDIUM     | Must rebuild engines                                  | Include engine rebuild in update procedure.                                                                                                                               |
+| TRT engine build OOM on 8GB                             | LOW        | Cannot build on target                                | Models small (6.31M, <5M). Reduce --memPoolSize if needed.                                                                                                                |
+
+
+## Testing Strategy
+
+### Integration / Functional Tests
+
+- **ESKF correctness**: Feed recorded IMU + synthetic VO/satellite data → verify output matches reference ESKF implementation
+- **GPS_INPUT field validation**: Send GPS_INPUT to SITL ArduPilot → verify EKF accepts and uses the data correctly
+- **Coordinate transform chain**: Known GPS → NED → pixel → back to GPS — verify round-trip error <0.1m
+- **Disconnected segment handling**: Simulate tracking loss → verify satellite re-localization triggers → verify cuVSLAM restarts → verify ESKF position continuity
+- **3-consecutive-failure**: Simulate VO + satellite failures → verify re-localization request sent → verify operator hint accepted
+- **Object localization**: Known object at known GPS → verify computed GPS matches within camera accuracy
+- **Mid-flight reboot**: Kill GPS-denied process → restart → verify recovery within expected time → verify position accuracy after recovery
+- **TRT engine load test**: Verify engines load successfully on Jetson
+- **TRT inference correctness**: Compare TRT output vs PyTorch reference (max L1 error < 0.01)
+- **CUDA Stream pipelining**: Verify Stream B satellite matching does not block Stream A VO
+- **ADTI sustained capture rate**: Verify 0.7fps sustained >30 min without buffer overflow
+- **Confidence tier transitions**: Verify fix_type and accuracy change correctly across HIGH → MEDIUM → LOW → FAILED transitions
+
+### Non-Functional Tests
+
+- **End-to-end accuracy** (primary validation): Fly with real GPS recording → run GPS-denied system in parallel → compare estimated vs real positions → verify 80% within 50m, 60% within 20m
+- **VO drift rate**: Measure cuVSLAM drift over 1km straight segment without satellite correction
+- **Satellite matching accuracy**: Compare satellite-matched position vs real GPS at known locations
+- **Processing time**: Verify end-to-end per-frame <400ms
+- **Memory usage**: Monitor over 30-min session → verify <8GB, no leaks
+- **Thermal**: Sustained 30-min run → verify no throttling
+- **GPS_INPUT rate**: Verify consistent 5-10Hz delivery to FC
+- **Tile storage**: Validate calculated storage matches actual for test mission area
+- **MinGRU TRT compatibility** (day-one blocker): Clone LiteSAM → ONNX export → polygraphy → trtexec
+- **Flight endurance**: Ground-test full system power draw against 267W estimate
+
+## References
+
+- ArduPilot GPS_RATE parameter: [https://github.com/ArduPilot/ardupilot/pull/15980](https://github.com/ArduPilot/ardupilot/pull/15980)
+- MAVLink GPS_INPUT message: [https://ardupilot.org/mavproxy/docs/modules/GPSInput.html](https://ardupilot.org/mavproxy/docs/modules/GPSInput.html)
+- pymavlink GPS_INPUT example: [https://webperso.ensta.fr/lebars/Share/GPS_INPUT_pymavlink.py](https://webperso.ensta.fr/lebars/Share/GPS_INPUT_pymavlink.py)
+- ESKF reference (fixed-wing UAV): [https://github.com/ludvigls/ESKF](https://github.com/ludvigls/ESKF)
+- ROS ESKF multi-sensor: [https://github.com/EliaTarasov/ESKF](https://github.com/EliaTarasov/ESKF)
+- Range-VIO scale observability: [https://arxiv.org/abs/2103.15215](https://arxiv.org/abs/2103.15215)
+- NaviLoc trajectory-level localization: [https://www.mdpi.com/2504-446X/10/2/97](https://www.mdpi.com/2504-446X/10/2/97)
+- SatLoc-Fusion hierarchical framework: [https://www.scilit.com/publications/e5cafaf875a49297a62b298a89d5572f](https://www.scilit.com/publications/e5cafaf875a49297a62b298a89d5572f)
+- Auterion GPS-denied workflow: [https://docs.auterion.com/vehicle-operation/auterion-mission-control/useful-resources/operations/gps-denied-workflow](https://docs.auterion.com/vehicle-operation/auterion-mission-control/useful-resources/operations/gps-denied-workflow)
+- PX4 GNSS-denied flight: [https://docs.px4.io/main/en/advanced_config/gnss_degraded_or_denied_flight.html](https://docs.px4.io/main/en/advanced_config/gnss_degraded_or_denied_flight.html)
+- ArduPilot GPS_INPUT advanced usage: [https://discuss.ardupilot.org/t/advanced-usage-of-gps-type-mav-14/99406](https://discuss.ardupilot.org/t/advanced-usage-of-gps-type-mav-14/99406)
+- Google Maps Ukraine imagery: [https://newsukraine.rbc.ua/news/google-maps-has-surprise-for-satellite-imagery-1727182380.html](https://newsukraine.rbc.ua/news/google-maps-has-surprise-for-satellite-imagery-1727182380.html)
+- Jetson Orin Nano Super thermal: [https://edgeaistack.app/blog/jetson-orin-nano-power-consumption/](https://edgeaistack.app/blog/jetson-orin-nano-power-consumption/)
+- GSD matching research: [https://www.kjrs.org/journal/view.html?pn=related&uid=756&vmd=Full](https://www.kjrs.org/journal/view.html?pn=related&uid=756&vmd=Full)
+- VO+satellite matching pipeline: [https://polen.itu.edu.tr/items/1fe1e872-7cea-44d8-a8de-339e4587bee6](https://polen.itu.edu.tr/items/1fe1e872-7cea-44d8-a8de-339e4587bee6)
+- PyCuVSLAM docs: [https://wiki.seeedstudio.com/pycuvslam_recomputer_robotics/](https://wiki.seeedstudio.com/pycuvslam_recomputer_robotics/)
+- Pixhawk 6x IMU (ICM-42688-P) datasheet: [https://invensense.tdk.com/products/motion-tracking/6-axis/icm-42688-p/](https://invensense.tdk.com/products/motion-tracking/6-axis/icm-42688-p/)
+- All references from solution_draft05.md
+
+## Related Artifacts
+
+- AC Assessment: `_docs/00_research/gps_denied_nav/00_ac_assessment.md`
+- Completeness assessment research: `_docs/00_research/solution_completeness_assessment/`
+- Previous research: `_docs/00_research/trt_engine_migration/`
+- Tech stack evaluation: `_docs/01_solution/tech_stack.md` (needs sync with draft05 corrections)
+- Security analysis: `_docs/01_solution/security_analysis.md`
+- Previous draft: `_docs/01_solution/solution_draft05.md`
+
@@ -0,0 +1,503 @@
+# Blackbox Tests
+
+## Positive Scenarios
+
+### FT-P-01: End-to-End Position Accuracy — 50m Threshold
+
+**Summary**: Validate that ≥80% of frame positions are within 50m of ground truth GPS across a full 60-frame flight sequence.
+**Traces to**: AC-01 (80% within 50m)
+**Category**: Position Accuracy
+
+**Preconditions**:
+- System running with SITL ArduPilot (GPS_TYPE=14)
+- Camera replay serving flight-sequence-60 at 0.7fps
+- Satellite tiles for test area loaded
+- System has completed startup (first satellite match done)
+
+**Input data**: flight-sequence-60 (60 frames), coordinates.csv (ground truth), position_accuracy.csv (thresholds)
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Start session via POST /sessions | HTTP 201 with session ID |
+| 2 | Subscribe to SSE stream GET /sessions/{id}/stream | SSE events begin at ~1Hz |
+| 3 | Wait for camera-replay to complete all 60 frames (~86s at 0.7fps) | Position events for each processed frame |
+| 4 | Collect all position events with lat/lon | 60 position estimates (some frames may have multiple updates) |
+| 5 | For each frame: compute haversine distance between estimated and ground truth position | Distance array |
+| 6 | Count frames where distance < 50m, compute percentage | ≥80% |
+
+**Expected outcome**: ≥48 of 60 frames have position error < 50m from ground truth in coordinates.csv
+**Max execution time**: 120s
+
+---
+
+### FT-P-02: End-to-End Position Accuracy — 20m Threshold
+
+**Summary**: Validate that ≥60% of frame positions are within 20m of ground truth GPS.
+**Traces to**: AC-02 (60% within 20m)
+**Category**: Position Accuracy
+
+**Preconditions**: Same as FT-P-01
+
+**Input data**: flight-sequence-60, coordinates.csv, position_accuracy.csv
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Reuse position data from FT-P-01 run (or re-run) | 60 position estimates |
+| 2 | Count frames where distance < 20m, compute percentage | ≥60% |
+
+**Expected outcome**: ≥36 of 60 frames have position error < 20m
+**Max execution time**: 120s (shared with FT-P-01)
+
+---
+
+### FT-P-03: No Single Frame Exceeds Maximum Error
+
+**Summary**: Validate that no individual frame position estimate exceeds 100m error.
+**Traces to**: AC-01, AC-02 (implicit: no catastrophic outliers)
+**Category**: Position Accuracy
+
+**Preconditions**: Same as FT-P-01
+
+**Input data**: flight-sequence-60, coordinates.csv, position_accuracy.csv
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Reuse position data from FT-P-01 | 60 position estimates |
+| 2 | Find max error across all frames | max(distances) ≤ 100m |
+
+**Expected outcome**: Maximum position error across all 60 frames ≤ 100m
+**Max execution time**: 120s (shared with FT-P-01)
+
+---
+
+### FT-P-04: VO Drift Between Satellite Anchors
+
+**Summary**: Validate cumulative VO drift stays below 100m between consecutive satellite correction events.
+**Traces to**: AC-03 (drift < 100m between anchors)
+**Category**: Position Accuracy
+
+**Preconditions**: Same as FT-P-01; satellite matching active on keyframes
+
+**Input data**: flight-sequence-60 SSE stream (includes drift_from_anchor field)
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Subscribe to SSE stream | Events with drift_from_anchor field |
+| 2 | Record drift_from_anchor values over the full sequence | Array of drift values |
+| 3 | Find maximum drift_from_anchor value | max(drift) < 100m |
+
+**Expected outcome**: drift_from_anchor never exceeds 100m during the 60-frame sequence
+**Max execution time**: 120s
+
+---
+
+### FT-P-05: GPS_INPUT Message Correctness — Normal Tracking
+
+**Summary**: Validate GPS_INPUT message fields are correctly populated during normal satellite-anchored tracking.
+**Traces to**: AC-08 (GPS_INPUT to FC via MAVLink), AC-04 (confidence score)
+**Category**: Flight Controller Integration
+
+**Preconditions**: System tracking normally with recent satellite match (<30s)
+
+**Input data**: Normal frame + satellite match; MAVLink capture from mavlink-inspector
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Read captured GPS_INPUT messages from mavlink-inspector | GPS_INPUT messages at 5-10Hz |
+| 2 | Verify field: fix_type | fix_type == 3 |
+| 3 | Verify field: horiz_accuracy | 1.0 ≤ horiz_accuracy ≤ 50.0 |
+| 4 | Verify field: satellites_visible | satellites_visible == 10 |
+| 5 | Verify fields: lat, lon | Non-zero, within operational area bounds |
+| 6 | Verify fields: vn, ve, vd | Populated (non-NaN), magnitude consistent with ~50-70 km/h flight |
+
+**Expected outcome**: All GPS_INPUT fields populated correctly per specification
+**Max execution time**: 30s
+
+---
+
+### FT-P-06: Image Registration Rate
+
+**Summary**: Validate that ≥95% of frames in a normal flight are successfully registered by the VO pipeline.
+**Traces to**: AC-05 (registration > 95%)
+**Category**: Image Processing Quality
+
+**Preconditions**: System running with full 60-frame sequence
+
+**Input data**: flight-sequence-60 SSE stream (vo_status field)
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Subscribe to SSE stream | Events with vo_status field |
+| 2 | Count frames where vo_status == "tracking" | ≥57 of 60 |
+| 3 | Compute registration rate | ≥95% |
+
+**Expected outcome**: ≥57 of 60 frames report vo_status "tracking"
+**Max execution time**: 120s
+
+---
+
+### FT-P-07: Confidence Tier — HIGH
+
+**Summary**: Validate HIGH confidence tier when satellite match is recent and covariance is low.
+**Traces to**: AC-04 (confidence score per estimate)
+**Category**: Confidence Scoring
+
+**Preconditions**: System running, satellite match completed <30s ago
+
+**Input data**: SSE stream during normal tracking
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Read SSE event immediately after satellite match | confidence field |
+| 2 | Verify confidence == "HIGH" | "HIGH" |
+| 3 | Read GPS_INPUT fix_type from mavlink-inspector | fix_type == 3 |
+
+**Expected outcome**: Confidence tier is HIGH, fix_type is 3
+**Max execution time**: 30s
+
+---
+
+### FT-P-08: Confidence Tier — MEDIUM (VO-only, No Recent Satellite Match)
+
+**Summary**: Validate MEDIUM confidence tier when VO is tracking but no satellite match in >30s.
+**Traces to**: AC-04
+**Category**: Confidence Scoring
+
+**Preconditions**: System running; satellite tile server paused (returns 503) to prevent new matches; >30s since last match
+
+**Input data**: SSE stream during VO-only tracking
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Pause satellite-tile-server (Docker pause) | No new satellite matches possible |
+| 2 | Wait >30s after last satellite match | Confidence should transition |
+| 3 | Read SSE event | confidence == "MEDIUM" |
+| 4 | Read GPS_INPUT fix_type | fix_type == 3 |
+
+**Expected outcome**: Confidence transitions to MEDIUM; fix_type remains 3
+**Max execution time**: 60s
+
+---
+
+### FT-P-09: GPS_INPUT Output Rate
+
+**Summary**: Validate GPS_INPUT messages are sent at 5-10Hz continuously.
+**Traces to**: AC-08 (GPS_INPUT via MAVLink), AC-09 (frame-by-frame streaming)
+**Category**: Flight Controller Integration
+
+**Preconditions**: System running and producing position estimates
+
+**Input data**: MAVLink capture from mavlink-inspector (10s window)
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Capture GPS_INPUT messages for 10 seconds | N messages |
+| 2 | Compute rate: N / 10 | 5 ≤ rate ≤ 10 |
+| 3 | Verify no gaps > 300ms between consecutive messages | max gap ≤ 300ms |
+
+**Expected outcome**: Rate is 5-10Hz, no gap exceeds 300ms
+**Max execution time**: 15s
+
+---
+
+### FT-P-10: Object Localization
+
+**Summary**: Validate object GPS localization from pixel coordinates via the FastAPI endpoint.
+**Traces to**: AC-16 (object localization), AC-17 (trigonometric calculation)
+**Category**: Object Localization
+
+**Preconditions**: System running with known UAV position (from GPS-denied estimate); known object ground truth GPS
+
+**Input data**: pixel_x, pixel_y (center of frame = nadir), gimbal_pan_deg=0, gimbal_tilt_deg=-90, zoom_factor=1.0
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | POST /objects/locate with pixel at frame center, gimbal pointing straight down | JSON: { lat, lon, alt, accuracy_m, confidence } |
+| 2 | Compute haversine distance between response lat/lon and current UAV position | Should be < accuracy_m (nadir point ≈ UAV position) |
+| 3 | Verify accuracy_m is consistent with current system accuracy | accuracy_m > 0, accuracy_m < 100m |
+
+**Expected outcome**: Object location at nadir matches UAV position within accuracy_m
+**Max execution time**: 5s
+
+---
+
+### FT-P-11: Coordinate Transform Round-Trip
+
+**Summary**: Validate GPS→NED→pixel→GPS round-trip error is <0.1m.
+**Traces to**: AC-18 (WGS84 output)
+**Category**: Coordinate Transforms
+
+**Preconditions**: System running, position known
+
+**Input data**: Known GPS coordinate within operational area
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Query system for current position via SSE | lat, lon |
+| 2 | POST /objects/locate with frame center pixel, straight-down gimbal | Returned lat, lon |
+| 3 | Compute haversine distance between original UAV lat/lon and round-trip result | distance < 0.1m |
+
+**Expected outcome**: Round-trip error < 0.1m
+**Max execution time**: 5s
+
+---
+
+### FT-P-12: Startup — GPS_INPUT Within 60 Seconds
+
+**Summary**: Validate the system begins outputting GPS_INPUT messages within 60s of boot.
+**Traces to**: AC-11 (startup from last GPS)
+**Category**: Startup & Failsafe
+
+**Preconditions**: Fresh system start; SITL ArduPilot running with GLOBAL_POSITION_INT available
+
+**Input data**: MAVLink capture from mavlink-inspector
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Start gps-denied-system container | System boots |
+| 2 | Monitor mavlink-inspector for first GPS_INPUT message | Timestamp of first GPS_INPUT |
+| 3 | Compute elapsed time from container start to first GPS_INPUT | ≤ 60s |
+
+**Expected outcome**: First GPS_INPUT message arrives within 60s of system start
+**Max execution time**: 90s
+
+---
+
+### FT-P-13: Telemetry Output Rate
+
+**Summary**: Validate telemetry NAMED_VALUE_FLOAT messages are sent at 1Hz.
+**Traces to**: AC-14 (telemetry to ground station)
+**Category**: Telemetry
+
+**Preconditions**: System running normally
+
+**Input data**: MAVLink capture from mavlink-inspector (10s window)
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Capture NAMED_VALUE_FLOAT messages for "gps_conf", "gps_drift", "gps_hacc" over 10s | N messages per name |
+| 2 | Verify rate: ~1Hz per metric (8-12 messages per name in 10s) | 0.8-1.2 Hz |
+
+**Expected outcome**: Each telemetry metric sent at ~1Hz
+**Max execution time**: 15s
+
+---
+
+### FT-P-14: SSE Stream Schema
+
+**Summary**: Validate SSE position events contain all required fields with correct types.
+**Traces to**: AC-14 (streaming to ground station)
+**Category**: API & Communication
+
+**Preconditions**: Active session with SSE stream
+
+**Input data**: SSE events from /sessions/{id}/stream
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Subscribe to SSE stream | Events at ~1Hz |
+| 2 | Parse event JSON | Valid JSON |
+| 3 | Verify fields: type (string), timestamp (ISO8601), lat (float), lon (float), alt (float), accuracy_h (float), confidence (string), drift_from_anchor (float), vo_status (string), last_satellite_match_age_s (float) | All present with correct types |
+
+**Expected outcome**: Every SSE event conforms to the specified schema
+**Max execution time**: 10s
+
+---
+
+## Negative Scenarios
+
+### FT-N-01: Trajectory Direction Change (Frames 32-43)
+
+**Summary**: Validate system continues producing position estimates through a trajectory direction change.
+**Traces to**: AC-07 (disconnected segments core to system)
+**Category**: Resilience & Edge Cases
+
+**Preconditions**: System running; camera-replay set to serve frames 32-43 (direction change area)
+
+**Input data**: Frames AD000032-043.jpg, coordinates for frames 32-43
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Camera-replay serves frames 32-43 at 0.7fps | System processes frames |
+| 2 | Collect SSE position events for each frame | ≥12 position estimates (one per frame minimum) |
+| 3 | Verify no gap >5s without a position update | Continuous output |
+
+**Expected outcome**: System produces position estimates for all frames in the direction-change segment; no prolonged output gap
+**Max execution time**: 30s
+
+---
+
+### FT-N-02: Outlier Frame Handling (350m Gap)
+
+**Summary**: Validate system handles a 350m outlier between consecutive photos without position corruption.
+**Traces to**: AC-06 (350m outlier tolerance)
+**Category**: Resilience & Edge Cases
+
+**Preconditions**: System running with normal tracking established; fault injection: camera-replay skips frames to simulate 350m gap
+
+**Input data**: Normal frames followed by a frame 350m away (simulated by frame skip in camera-replay)
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Normal tracking for 10 frames | Position estimates with <50m error |
+| 2 | Camera-replay jumps forward ~350m (skips multiple frames) | System detects discontinuity |
+| 3 | Collect position estimates for next 5 frames after the gap | Recovery within 3-5 frames |
+| 4 | Verify position error of recovered frames | Error < 100m for first valid frame after recovery |
+
+**Expected outcome**: System recovers from 350m outlier; post-recovery position error < 100m
+**Max execution time**: 30s
+
+---
+
+### FT-N-03: Invalid Object Localization Request
+
+**Summary**: Validate API rejects invalid pixel coordinates with HTTP 422.
+**Traces to**: AC-16 (object localization)
+**Category**: API Error Handling
+
+**Preconditions**: System running with active session
+
+**Input data**: POST /objects/locate with pixel_x=-100, pixel_y=-100
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | POST /objects/locate with negative pixel coordinates | HTTP 422 |
+| 2 | Verify response body contains error description | JSON with "error" or "detail" field |
+
+**Expected outcome**: HTTP 422 with validation error
+**Max execution time**: 2s
+
+---
+
+### FT-N-04: Unauthenticated API Access
+
+**Summary**: Validate API rejects unauthenticated requests with HTTP 401.
+**Traces to**: AC-14 (security — JWT auth)
+**Category**: API Security
+
+**Preconditions**: System running
+
+**Input data**: POST /sessions with no Authorization header
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | POST /sessions without JWT token | HTTP 401 |
+| 2 | GET /sessions/{id}/stream without JWT | HTTP 401 |
+| 3 | POST /objects/locate without JWT | HTTP 401 |
+| 4 | GET /health (no auth required) | HTTP 200 |
+
+**Expected outcome**: Protected endpoints return 401; /health remains accessible
+**Max execution time**: 5s
+
+---
+
+### FT-N-05: 3-Consecutive-Failure Re-Localization Request
+
+**Summary**: Validate that after VO loss + 3 consecutive satellite match failures, the system sends a re-localization request to the ground station.
+**Traces to**: AC-08 (3 consecutive failures → re-localization request)
+**Category**: Resilience & Edge Cases
+
+**Preconditions**: System running; camera-replay set to serve featureless frames (VO will fail); satellite-tile-server returning 404 (tile not found)
+
+**Input data**: Featureless frames (e.g., blank/uniform images), satellite tile server offline
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Camera-replay serves featureless frames | VO tracking lost |
+| 2 | Satellite-tile-server returns 404 | Satellite matching fails |
+| 3 | Wait for 3 camera frames (3 × 1.43s ≈ 4.3s) | 3 consecutive failures |
+| 4 | Check mavlink-inspector for STATUSTEXT | Message matches `RELOC_REQ: last_lat=.* last_lon=.* uncertainty=.*m` |
+| 5 | Verify GPS_INPUT fix_type | fix_type == 0 |
+| 6 | Verify GPS_INPUT horiz_accuracy | horiz_accuracy == 999.0 |
+
+**Expected outcome**: RELOC_REQ sent via STATUSTEXT; GPS_INPUT reports no-fix with 999.0 accuracy
+**Max execution time**: 15s
+
+---
+
+### FT-N-06: IMU-Only Dead Reckoning (VO Lost, No Satellite)
+
+**Summary**: Validate system degrades gracefully to IMU-only ESKF prediction when VO and satellite matching both fail.
+**Traces to**: AC-06 (VO lost behavior), AC-04 (confidence score reflects state)
+**Category**: Resilience & Edge Cases
+
+**Preconditions**: System running; camera-replay paused (no frames); satellite-tile-server paused
+
+**Input data**: No camera frames, no satellite tiles; only IMU from SITL
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Pause camera-replay and satellite-tile-server | System loses VO and satellite inputs |
+| 2 | Read SSE events over 5s | confidence transitions from HIGH/MEDIUM to LOW |
+| 3 | Read GPS_INPUT from mavlink-inspector | fix_type == 2 |
+| 4 | Read horiz_accuracy over time | horiz_accuracy ≥ 50m and increasing |
+| 5 | Verify GPS_INPUT continues at 5-10Hz | Messages continue (IMU-driven ESKF prediction) |
+
+**Expected outcome**: System continues GPS_INPUT at 5-10Hz via IMU; confidence drops; accuracy degrades but output never stops
+**Max execution time**: 15s
+
+---
+
+### FT-N-07: Operator Re-Localization Hint Accepted
+
+**Summary**: Validate the system accepts an operator re-localization hint and recovers position.
+**Traces to**: AC-08 (re-localization), AC-15 (ground station commands)
+**Category**: Ground Station Integration
+
+**Preconditions**: System in FAILED confidence state (3 consecutive failures); satellite-tile-server restored
+
+**Input data**: Operator hint: approximate lat/lon (from coordinates.csv ground truth ± 200m offset)
+
+**Steps**:
+
+| Step | Consumer Action | Expected System Response |
+|------|----------------|------------------------|
+| 1 | Trigger 3-consecutive-failure state (FT-N-05 preconditions) | RELOC_REQ sent |
+| 2 | Restore satellite-tile-server | Tiles available again |
+| 3 | POST /sessions/{id}/anchor with approximate lat/lon | HTTP 200 |
+| 4 | Wait for satellite match attempt (~3-5s) | System searches in new area |
+| 5 | Read SSE events | confidence transitions back to HIGH/MEDIUM |
+| 6 | Read GPS_INPUT fix_type | fix_type == 3 |
+
+**Expected outcome**: System accepts operator hint, searches satellite tiles in new area, recovers position, confidence returns to HIGH/MEDIUM
+**Max execution time**: 30s
@@ -0,0 +1,149 @@
+# Test Environment
+
+## Overview
+
+**System under test**: GPS-Denied Visual Navigation System — a real-time position estimation service running on Jetson Orin Nano Super. Public interfaces: FastAPI REST/SSE endpoints (port 8000), MAVLink GPS_INPUT messages over serial/UDP, MAVLink telemetry messages.
+
+**Consumer app purpose**: Standalone Python test runner (pytest) that exercises the GPS-denied system through its public interfaces (HTTP API, MAVLink message inspection, SSE stream consumption) without access to internal modules, ESKF state, or GPU buffers.
+
+## Test Modes
+
+This is embedded robotics software targeting Jetson Orin Nano Super. A pure Docker environment cannot exercise GPU-dependent paths (TRT inference, cuVSLAM, CUDA streams). The test environment supports two modes:
+
+**Mode 1 — Docker SITL (CI/dev)**: Full system in Docker containers with ArduPilot SITL providing MAVLink + IMU at 200Hz. Camera images replayed from input_data/. Satellite tiles served from a mock HTTP server. GPS-denied system runs in CPU-mode with stubbed TRT/cuVSLAM inference (functionally equivalent but slower). Tests all integration paths, API, MAVLink, resilience, and security.
+
+**Mode 2 — Jetson Hardware (nightly/pre-deploy)**: GPS-denied system runs natively on Jetson Orin Nano Super with real CUDA/TRT/cuVSLAM. ArduPilot SITL runs on the Jetson or a companion x86 host, connected via UART or UDP. Camera frames injected via USB camera emulator or replay service. Tests real-time performance, GPU memory, thermal, TRT correctness, and CUDA stream isolation.
+
+## Docker Environment (Mode 1)
+
+### Services
+
+| Service | Image / Build | Purpose | Ports |
+|---------|--------------|---------|-------|
+| gps-denied-system | `./Dockerfile` (build context: project root) | GPS-denied navigation system in CPU-mode (TRT stubs, cuVSLAM stub returning synthetic VO poses derived from ground truth trajectory) | 8000 (FastAPI), 14550/udp (MAVLink) |
+| ardupilot-sitl | `ardupilot/sitl:plane-4.5` (fixed-wing) | ArduPilot SITL: flies waypoint mission following coordinates.csv trajectory, generates IMU at 200Hz via MAVLink, GPS_TYPE=14 accepts GPS_INPUT, provides GLOBAL_POSITION_INT at startup | 5760 (MAVLink TCP), 14551/udp |
+| camera-replay | `./tests/docker/camera-replay/Dockerfile` | Replays AD000001-060.jpg from input_data/ at configurable FPS (default 0.7fps) with timestamps synchronized to SITL clock. Supports fault injection: frame skip, corrupted JPEG, pause. | 8001 (frame server) |
+| satellite-tile-server | `./tests/docker/tile-server/Dockerfile` | HTTP server for pre-cached satellite tiles (zoom 18, ~50-100 tiles covering test area). Supports fault injection: 404 for specific tiles, 503 for full outage, slow responses. | 8002 |
+| mavlink-inspector | `./tests/docker/mavlink-inspector/Dockerfile` | Passively captures all MAVLink traffic (GPS_INPUT, NAMED_VALUE_FLOAT, STATUSTEXT, COMMAND_LONG) for post-test assertion. Can inject operator re-localization hints. | 14552/udp |
+| e2e-consumer | `./tests/e2e/Dockerfile` | Black-box test runner (pytest). Communicates only via HTTP API + MAVLink inspector. | — |
+
+### Networks
+
+| Network | Services | Purpose |
+|---------|----------|---------|
+| e2e-net | all | Isolated test network; MAVLink UDP multicast between gps-denied-system, ardupilot-sitl, mavlink-inspector |
+
+### Volumes
+
+| Volume | Mounted to | Purpose |
+|--------|-----------|---------|
+| input-data | camera-replay:/data, e2e-consumer:/test-data | Camera frames (AD000001-060.jpg), coordinates.csv, data_parameters.md, gmaps reference images |
+| satellite-tiles | satellite-tile-server:/tiles, gps-denied-system:/tiles | Pre-processed satellite tiles for test area (zoom 18, 48.249-48.276°N, 37.340-37.386°E) |
+| sitl-mission | ardupilot-sitl:/mission | Waypoint mission file derived from coordinates.csv (SITL flies this trajectory, generating physically consistent 200Hz IMU data) |
+| test-results | e2e-consumer:/results | Test result CSV output |
+| mavlink-capture | mavlink-inspector:/capture | Recorded MAVLink messages for post-test assertions |
+
+### IMU Data Flow
+
+ArduPilot SITL is the primary source of IMU data. It flies a waypoint mission derived from coordinates.csv and internally generates physically consistent accelerometer + gyroscope readings at 200Hz, delivered to the GPS-denied system via MAVLink (RAW_IMU, SCALED_IMU2). This eliminates the need for pre-recorded IMU data files and ensures IMU/trajectory consistency.
+
+```
+coordinates.csv → mission_generator script → ArduPilot waypoint file
+                                              ↓
+                          ArduPilot SITL flies trajectory
+                                              ↓
+                          IMU @ 200Hz + heartbeat + GLOBAL_POSITION_INT
+                                              ↓ (MAVLink UDP)
+                          gps-denied-system receives IMU for ESKF
+```
+
+### docker-compose structure
+
+```yaml
+services:
+  ardupilot-sitl:
+    # ArduPilot SITL fixed-wing, outputs IMU at 200Hz via MAVLink
+    # GPS_TYPE=14 (MAVLink), pre-configured for GPS_INPUT acceptance
+  satellite-tile-server:
+    # HTTP tile server with tiles for test area (48.249-48.276°N, 37.340-37.386°E)
+  camera-replay:
+    # Replays AD000001-060.jpg at 0.7fps, serves via HTTP or shared volume
+    depends_on:
+      - satellite-tile-server
+  gps-denied-system:
+    # The system under test
+    depends_on:
+      - ardupilot-sitl
+      - satellite-tile-server
+      - camera-replay
+  mavlink-inspector:
+    # Captures GPS_INPUT, NAMED_VALUE_FLOAT, STATUSTEXT messages
+    depends_on:
+      - ardupilot-sitl
+  e2e-consumer:
+    # pytest runner — executes after system reaches steady state
+    depends_on:
+      - gps-denied-system
+      - mavlink-inspector
+```
+
+## Consumer Application
+
+**Tech stack**: Python 3.11, pytest, httpx (HTTP client), pymavlink (MAVLink inspection), sseclient-py (SSE stream)
+**Entry point**: `pytest tests/e2e/ --tb=short --csv=results/report.csv`
+
+### Communication with system under test
+
+| Interface | Protocol | Endpoint / Topic | Authentication |
+|-----------|----------|-----------------|----------------|
+| Position API | HTTP REST | http://gps-denied-system:8000/sessions | JWT token |
+| Position stream | HTTP SSE | http://gps-denied-system:8000/sessions/{id}/stream | JWT token |
+| Object localization | HTTP REST | http://gps-denied-system:8000/objects/locate | JWT token |
+| Health check | HTTP REST | http://gps-denied-system:8000/health | None |
+| GPS_INPUT inspection | MAVLink UDP | mavlink-inspector:14552 (recorded messages) | None |
+| Telemetry inspection | MAVLink UDP | mavlink-inspector:14552 (NAMED_VALUE_FLOAT, STATUSTEXT) | None |
+
+### What the consumer does NOT have access to
+
+- No direct access to ESKF internal state, covariance matrices, or error vectors
+- No direct access to cuVSLAM tracking state or feature maps
+- No direct access to GPU memory, CUDA streams, or TRT engine internals
+- No direct access to the system's file system or configuration files
+- No direct database or state store access
+
+## Jetson Hardware Environment (Mode 2)
+
+Tests tagged `@pytest.mark.jetson` require actual Jetson Orin Nano Super hardware. These run natively (no Docker for the GPS-denied system) to exercise real GPU paths.
+
+**Hardware setup**:
+- Jetson Orin Nano Super (JetPack 6.2, CUDA 12.x, TensorRT 10.3)
+- ArduPilot SITL on same Jetson (or x86 companion connected via UART/UDP)
+- Camera frames injected via: USB camera emulator (v4l2loopback feeding frames from input_data/) or HTTP replay service
+- Satellite tiles on local SSD (same path as production deployment)
+- Active cooling attached (required for sustained load tests)
+
+**Tests in this mode**:
+- NFT-PERF-01 through NFT-PERF-06 (real GPU latency, throughput)
+- NFT-RES-LIM-01 (GPU+CPU shared memory monitoring via tegrastats)
+- NFT-RES-LIM-02 (thermal monitoring via thermal_zone sysfs)
+- NFT-RES-LIM-05 (CUDA stream isolation with real concurrent GPU work)
+- TRT engine build and inference correctness (expected_results #42-44)
+
+**Jetson CI runner**: Self-hosted GitHub Actions runner on a dedicated Jetson Orin Nano Super, triggered for nightly builds and pre-deploy gates.
+
+## CI/CD Integration
+
+**When to run**: On every PR to `dev`, nightly full suite, before production deploy
+**Pipeline stages**:
+1. Unit tests (no Docker, no hardware) — on every commit
+2. Docker blackbox tests (SITL + CPU mode) — on PR merge to dev
+3. Hardware tests (Jetson runner) — nightly + pre-deploy
+
+**Gate behavior**: Docker tests block merge; hardware tests are advisory (nightly) or blocking (pre-deploy)
+**Timeout**: Docker suite: 15 minutes; Hardware suite: 30 minutes
+
+## Reporting
+
+**Format**: CSV
+**Columns**: Test ID, Test Name, Execution Time (ms), Result (PASS/FAIL/SKIP), Error Message (if FAIL)
+**Output path**: `./tests/e2e-results/report.csv`
@@ -0,0 +1,138 @@
+# Performance Tests
+
+### NFT-PERF-01: End-to-End Per-Frame Latency
+
+**Summary**: Validate total pipeline latency from camera capture to GPS_INPUT output is <400ms.
+**Traces to**: AC-07 (< 400ms end-to-end per frame)
+**Metric**: End-to-end latency (camera frame timestamp → GPS_INPUT message timestamp)
+
+**Preconditions**:
+- System running on Jetson Orin Nano Super (GPU-mode)
+- Camera-replay serving frames at 0.7fps
+- System in steady state (warm-up: ≥10 frames processed)
+
+**Steps**:
+
+| Step | Consumer Action | Measurement |
+|------|----------------|-------------|
+| 1 | Camera-replay sends frame with known timestamp | Record t_capture |
+| 2 | Monitor GPS_INPUT messages at mavlink-inspector | Record t_gps_input for first GPS_INPUT update after t_capture |
+| 3 | Compute latency = t_gps_input - t_capture | Per-frame latency |
+| 4 | Repeat for 30 consecutive frames | Array of 30 latency values |
+
+**Pass criteria**: p95 latency < 400ms; max latency < 500ms
+**Duration**: 50s (~30 frames at 0.7fps + warm-up)
+
+---
+
+### NFT-PERF-02: GPS_INPUT Output Rate Consistency
+
+**Summary**: Validate GPS_INPUT messages are delivered at a sustained 5-10Hz with no gaps.
+**Traces to**: AC-08 (GPS_INPUT via MAVLink at 5-10Hz)
+**Metric**: Message rate (Hz), maximum inter-message gap (ms)
+
+**Preconditions**:
+- System in steady state
+- Camera-replay active
+
+**Steps**:
+
+| Step | Consumer Action | Measurement |
+|------|----------------|-------------|
+| 1 | Capture GPS_INPUT messages for 60 seconds | Count messages, record timestamps |
+| 2 | Compute rate: count / 60 | 5 ≤ rate ≤ 10 Hz |
+| 3 | Compute max gap between consecutive messages | max_gap ≤ 250ms |
+| 4 | Compute jitter: std_dev of inter-message intervals | jitter < 50ms |
+
+**Pass criteria**: Rate 5-10Hz; max gap ≤ 250ms; jitter < 50ms
+**Duration**: 60s
+
+---
+
+### NFT-PERF-03: cuVSLAM Visual Odometry Processing Time
+
+**Summary**: Validate cuVSLAM processes each frame within 20ms.
+**Traces to**: AC-07 (real-time processing budget)
+**Metric**: Per-frame cuVSLAM inference time (ms)
+
+**Preconditions**:
+- System running on Jetson Orin Nano Super
+- Steady state (≥10 frames processed)
+
+**Steps**:
+
+| Step | Consumer Action | Measurement |
+|------|----------------|-------------|
+| 1 | Replay 30 frames, read processing time from SSE events or health endpoint metrics | Per-frame VO time |
+| 2 | Compute p95 of VO time | p95 ≤ 20ms |
+
+**Pass criteria**: p95 cuVSLAM inference time ≤ 20ms
+**Duration**: 50s
+
+---
+
+### NFT-PERF-04: Satellite Matching Latency (Async)
+
+**Summary**: Validate satellite matching completes within 330ms per keyframe (async, does not block VO).
+**Traces to**: AC-07 (within frame budget), solution processing time budget
+**Metric**: Per-keyframe satellite matching latency (ms)
+
+**Preconditions**:
+- System running on Jetson Orin Nano Super
+- Satellite tiles loaded
+
+**Steps**:
+
+| Step | Consumer Action | Measurement |
+|------|----------------|-------------|
+| 1 | Monitor satellite match events over 60s (expect ~4-8 matches at 0.07-0.14Hz) | Per-match latency from health/metrics endpoint |
+| 2 | Verify no VO frame was blocked during satellite matching | VO timestamps maintain 0.7fps cadence |
+
+**Pass criteria**: p95 satellite matching ≤ 330ms; VO cadence unaffected
+**Duration**: 60s
+
+---
+
+### NFT-PERF-05: TRT Engine Load Time
+
+**Summary**: Validate all TensorRT engines load within 10 seconds total.
+**Traces to**: AC-11 (startup), solution startup sequence
+**Metric**: Engine load time (seconds)
+
+**Preconditions**:
+- Cold start on Jetson Orin Nano Super
+- Engines pre-built and available on storage
+
+**Steps**:
+
+| Step | Consumer Action | Measurement |
+|------|----------------|-------------|
+| 1 | Start system, monitor startup log for engine load timestamps | t_start_load, t_end_load per engine |
+| 2 | Compute total: sum of all engine load times | ≤ 10s total |
+
+**Pass criteria**: Total TRT engine load time ≤ 10s
+**Duration**: 30s (includes boot time)
+
+---
+
+### NFT-PERF-06: Sustained 30-Minute Processing
+
+**Summary**: Validate the system maintains consistent performance over a 30-minute continuous session without degradation.
+**Traces to**: AC-07 (real-time), AC-08 (memory < 8GB)
+**Metric**: Per-frame latency, GPS_INPUT rate, position accuracy over time
+
+**Preconditions**:
+- System running on Jetson Orin Nano Super
+- Camera-replay looping flight-sequence-60 (re-starts after frame 60)
+- Satellite tiles available
+
+**Steps**:
+
+| Step | Consumer Action | Measurement |
+|------|----------------|-------------|
+| 1 | Run for 30 minutes, collect per-minute stats | Latency, rate, accuracy |
+| 2 | Compare first-5-min stats vs last-5-min stats | No degradation >10% |
+| 3 | Monitor for any position output gaps > 1s | Count gaps |
+
+**Pass criteria**: No latency degradation >10% over 30 min; GPS_INPUT rate remains 5-10Hz; no output gaps >1s
+**Duration**: 30 minutes
@@ -0,0 +1,169 @@
+# Resilience Tests
+
+### NFT-RES-01: Mid-Flight Reboot Recovery
+
+**Summary**: Validate the system recovers from a companion computer reboot within 70 seconds and restores position accuracy.
+**Traces to**: AC-12 (mid-flight reboot recovery)
+
+**Preconditions**:
+- System running in steady state with good position accuracy
+- SITL ArduPilot continues running (FC stays up during companion computer reboot)
+
+**Fault injection**:
+- Kill gps-denied-system process (docker stop or SIGKILL)
+- Restart after 5s delay (simulates Jetson reboot time)
+
+**Steps**:
+
+| Step | Action | Expected Behavior |
+|------|--------|------------------|
+| 1 | Record current position accuracy and confidence | Baseline metrics |
+| 2 | Kill gps-denied-system container | GPS_INPUT messages stop |
+| 3 | Verify SITL continues running (heartbeat present) | FC still alive, using IMU dead reckoning |
+| 4 | Restart gps-denied-system container after 5s | System starts recovery sequence |
+| 5 | Monitor time from restart to first GPS_INPUT | ≤ 70s |
+| 6 | Wait for first satellite match | Position accuracy restored |
+| 7 | Verify position error after recovery | Error ≤ 50m after first satellite match |
+
+**Pass criteria**: Recovery time ≤ 70s; post-recovery position error ≤ 50m after satellite match
+**Duration**: 120s
+
+---
+
+### NFT-RES-02: Tracking Loss and Satellite Re-Localization
+
+**Summary**: Validate the system recovers from cuVSLAM tracking loss via satellite-based re-localization.
+**Traces to**: AC-07 (disconnected segments), AC-06 (sharp turn handling)
+
+**Preconditions**:
+- System in normal tracking (HIGH confidence)
+- Satellite tiles available
+
+**Fault injection**:
+- Camera-replay sends featureless/blurred frames (simulates VO tracking loss from sharp turn)
+- Then resumes normal frames
+
+**Steps**:
+
+| Step | Action | Expected Behavior |
+|------|--------|------------------|
+| 1 | Normal tracking established | confidence: HIGH, vo_status: tracking |
+| 2 | Camera-replay serves 3 featureless frames | cuVSLAM reports tracking_lost |
+| 3 | System enters TRACKING_LOST state | Satellite matching switches to every frame |
+| 4 | Camera-replay resumes normal frames | Satellite match succeeds |
+| 5 | Monitor SSE: vo_status returns to "tracking" | cuVSLAM restarted |
+| 6 | Monitor SSE: confidence returns to HIGH | Position re-anchored |
+| 7 | Verify position accuracy after recovery | Error ≤ 50m |
+
+**Pass criteria**: Recovery within 5 frames after normal frames resume; position error ≤ 50m post-recovery
+**Duration**: 30s
+
+---
+
+### NFT-RES-03: Sustained IMU-Only Operation
+
+**Summary**: Validate the system continues producing position estimates during extended IMU-only periods without crashing.
+**Traces to**: AC-08 (system continues during failure), AC-12 (failsafe)
+
+**Preconditions**:
+- System in normal tracking
+
+**Fault injection**:
+- Pause both camera-replay (no VO) and satellite-tile-server (no satellite matching)
+- Duration: 30s
+
+**Steps**:
+
+| Step | Action | Expected Behavior |
+|------|--------|------------------|
+| 1 | Establish normal tracking baseline | GPS_INPUT at 5-10Hz, confidence HIGH |
+| 2 | Pause camera-replay and satellite-tile-server | VO and satellite inputs stop |
+| 3 | Monitor GPS_INPUT for 30s | Messages continue at 5-10Hz (IMU-driven ESKF prediction) |
+| 4 | Verify horiz_accuracy grows over time | accuracy increases monotonically |
+| 5 | Verify fix_type transitions to 2 | Degraded but present |
+| 6 | Verify confidence transitions to LOW | Reflects IMU-only state |
+| 7 | Resume camera-replay and satellite-tile-server | System recovers to normal tracking |
+| 8 | Verify recovery to HIGH confidence | Satellite match re-anchors position |
+
+**Pass criteria**: GPS_INPUT never stops during 30s IMU-only period; system recovers when inputs resume
+**Duration**: 60s
+
+---
+
+### NFT-RES-04: Satellite Tile Server Failure
+
+**Summary**: Validate the system continues operating when satellite tile server becomes unavailable, with graceful accuracy degradation.
+**Traces to**: AC-07 (resilience), solution risk: Google Maps quality
+
+**Preconditions**:
+- System in normal tracking
+
+**Fault injection**:
+- Stop satellite-tile-server container (simulates tile unavailability)
+
+**Steps**:
+
+| Step | Action | Expected Behavior |
+|------|--------|------------------|
+| 1 | Normal tracking with satellite corrections | confidence: HIGH |
+| 2 | Stop satellite-tile-server | Satellite matching returns errors |
+| 3 | Monitor for 60s | System falls back to VO-only; confidence drops to MEDIUM after 30s |
+| 4 | Verify GPS_INPUT continues | Messages at 5-10Hz, fix_type remains 3 (VO tracking OK) |
+| 5 | Restart satellite-tile-server | Satellite matching resumes |
+| 6 | Verify confidence returns to HIGH | Position re-anchored |
+
+**Pass criteria**: No crash or hang; GPS_INPUT continues; confidence degrades gracefully and recovers when tiles return
+**Duration**: 90s
+
+---
+
+### NFT-RES-05: Corrupted Camera Frame
+
+**Summary**: Validate the system handles a corrupted camera frame without crashing.
+**Traces to**: AC-06 (outlier tolerance)
+
+**Preconditions**:
+- System in normal tracking
+
+**Fault injection**:
+- Camera-replay injects a truncated/corrupted JPEG between normal frames
+
+**Steps**:
+
+| Step | Action | Expected Behavior |
+|------|--------|------------------|
+| 1 | Normal tracking for 5 frames | Baseline established |
+| 2 | Camera-replay sends corrupted JPEG | System logs warning, skips frame |
+| 3 | Camera-replay sends next normal frame | VO continues processing |
+| 4 | Verify no crash, no hang | GPS_INPUT continues at 5-10Hz |
+| 5 | Verify position accuracy on next valid frame | Error < 50m |
+
+**Pass criteria**: System skips corrupted frame gracefully; no crash; next frame processed normally
+**Duration**: 15s
+
+---
+
+### NFT-RES-06: Camera Feed Interruption (No Frames for 10s)
+
+**Summary**: Validate the system survives a 10-second camera feed interruption.
+**Traces to**: AC-12 (failsafe — N seconds no estimate), AC-08 (continued operation)
+
+**Preconditions**:
+- System in normal tracking
+
+**Fault injection**:
+- Camera-replay pauses for 10s (no frames delivered)
+
+**Steps**:
+
+| Step | Action | Expected Behavior |
+|------|--------|------------------|
+| 1 | Normal tracking baseline | GPS_INPUT at 5-10Hz |
+| 2 | Pause camera-replay for 10s | No new camera frames |
+| 3 | Monitor GPS_INPUT | Messages continue via IMU prediction |
+| 4 | Monitor confidence | Transitions to LOW after VO timeout |
+| 5 | Resume camera-replay | VO restarts, satellite matching resumes |
+| 6 | Verify recovery | confidence returns to HIGH within 10 frames |
+
+**Pass criteria**: GPS_INPUT never stops; recovery within 10 frames after camera feed resumes
+**Duration**: 30s
@@ -0,0 +1,90 @@
+# Resource Limit Tests
+
+### NFT-RES-LIM-01: Memory Usage Under 8GB
+
+**Summary**: Validate system memory usage stays below 8GB shared memory (CPU + GPU) during sustained operation.
+**Traces to**: AC-08 (memory < 8GB), RESTRICT-09 (8GB shared LPDDR5)
+
+**Preconditions**:
+- System running on Jetson Orin Nano Super (8GB shared memory)
+- Full pipeline active: cuVSLAM + satellite matching + ESKF + GPS_INPUT + FastAPI
+
+**Monitoring**:
+- Total system memory (RSS + GPU allocated) via `tegrastats` or `/sys/devices/platform/host1x/*/memory`
+- Poll every 5s via GET /health (memory_mb field)
+
+**Duration**: 30 minutes
+**Pass criteria**: Peak memory < 8192MB; no memory leak (growth < 50MB over 30 minutes after first 2 minutes warm-up)
+
+---
+
+### NFT-RES-LIM-02: GPU Thermal Envelope
+
+**Summary**: Validate SoC junction temperature stays below 80°C under sustained processing load.
+**Traces to**: AC-08 (thermal), RESTRICT-10 (25W TDP, thermal throttling at 80°C)
+
+**Preconditions**:
+- System running on Jetson Orin Nano Super with active cooling
+- Full pipeline active
+
+**Monitoring**:
+- SoC junction temperature via `tegrastats` or `/sys/devices/virtual/thermal/thermal_zone*/temp`
+- Poll every 10s via GET /health (gpu_temp_c field)
+
+**Duration**: 30 minutes
+**Pass criteria**: SoC junction temperature < 80°C throughout; no thermal throttling events
+
+---
+
+### NFT-RES-LIM-03: Satellite Tile Storage
+
+**Summary**: Validate pre-loaded satellite tile storage stays within calculated budget for a test mission area.
+**Traces to**: AC-19 (satellite imagery pre-loaded), RESTRICT-08 (onboard storage limited)
+
+**Preconditions**:
+- Satellite tiles pre-processed for the test flight area (48.249-48.276°N, 37.340-37.386°E)
+- Zoom 18 primary + zoom 19 for ±500m along flight path
+
+**Monitoring**:
+- Total tile storage size on disk
+- RAM usage for preloaded tiles (±2km buffer)
+
+**Duration**: Static check
+**Pass criteria**: Total tile storage ≤ 1000MB on disk; RAM usage for preloaded tiles ≤ 200MB
+
+---
+
+### NFT-RES-LIM-04: Long Flight Simulation (3000 Frames)
+
+**Summary**: Validate the system handles a maximum-length flight of 3000 frames without resource exhaustion.
+**Traces to**: RESTRICT-04 (up to 3000 photos per flight)
+
+**Preconditions**:
+- System running on Jetson (or Docker with CPU-mode for functional test)
+- Camera-replay looping flight-sequence-60 to generate 3000 frames (50 loops)
+
+**Monitoring**:
+- Memory usage every 60s
+- GPS_INPUT rate every 60s
+- Position accuracy sampled every 100 frames
+
+**Duration**: ~71 minutes (3000 frames at 0.7fps)
+**Pass criteria**: Memory stays < 8GB; GPS_INPUT rate stays 5-10Hz; no crash or hang over full 3000-frame sequence
+
+---
+
+### NFT-RES-LIM-05: CUDA Stream Isolation
+
+**Summary**: Validate that Stream B (satellite matching) does not block Stream A (cuVSLAM) under concurrent load.
+**Traces to**: AC-07 (< 400ms per frame), solution CUDA stream pipelining
+
+**Preconditions**:
+- System running on Jetson Orin Nano Super
+- Satellite matching triggered on a keyframe while VO is processing the next frame
+
+**Monitoring**:
+- VO frame-to-frame timing during satellite matching
+- Satellite matching does not extend VO latency
+
+**Duration**: 30s (capture ~5 satellite matching events concurrent with VO)
+**Pass criteria**: VO per-frame time ≤ 20ms even when satellite matching is running concurrently; no frame drops
@@ -0,0 +1,88 @@
+# Security Tests
+
+### NFT-SEC-01: JWT Authentication Required on Protected Endpoints
+
+**Summary**: Validate all protected endpoints reject requests without a valid JWT token.
+**Traces to**: AC-14 (security — JWT auth on API)
+
+**Steps**:
+
+| Step | Consumer Action | Expected Response |
+|------|----------------|------------------|
+| 1 | POST /sessions with no Authorization header | HTTP 401 |
+| 2 | GET /sessions/{id}/stream with no Authorization header | HTTP 401 |
+| 3 | POST /sessions/{id}/anchor with no Authorization header | HTTP 401 |
+| 4 | DELETE /sessions/{id} with no Authorization header | HTTP 401 |
+| 5 | POST /objects/locate with no Authorization header | HTTP 401 |
+| 6 | GET /health with no Authorization header | HTTP 200 (health is public) |
+
+**Pass criteria**: All protected endpoints return 401; /health returns 200 without auth
+
+---
+
+### NFT-SEC-02: Expired JWT Token Rejection
+
+**Summary**: Validate the system rejects expired JWT tokens.
+**Traces to**: AC-14 (security)
+
+**Steps**:
+
+| Step | Consumer Action | Expected Response |
+|------|----------------|------------------|
+| 1 | Generate a JWT token with exp set to 1 hour ago | Expired token |
+| 2 | POST /sessions with expired token in Authorization header | HTTP 401 |
+| 3 | POST /objects/locate with expired token | HTTP 401 |
+
+**Pass criteria**: Expired tokens are rejected with 401
+
+---
+
+### NFT-SEC-03: Invalid JWT Signature Rejection
+
+**Summary**: Validate the system rejects JWT tokens signed with the wrong key.
+**Traces to**: AC-14 (security)
+
+**Steps**:
+
+| Step | Consumer Action | Expected Response |
+|------|----------------|------------------|
+| 1 | Generate a JWT token with a different signing key | Invalid signature token |
+| 2 | POST /sessions with invalid-signature token | HTTP 401 |
+
+**Pass criteria**: Invalid-signature tokens are rejected with 401
+
+---
+
+### NFT-SEC-04: Malformed API Request Handling
+
+**Summary**: Validate the system handles malformed API payloads without crashing or leaking internal details.
+**Traces to**: AC-14 (security), AC-16 (API robustness)
+
+**Steps**:
+
+| Step | Consumer Action | Expected Response |
+|------|----------------|------------------|
+| 1 | POST /objects/locate with empty body | HTTP 422 with generic error (no stack trace) |
+| 2 | POST /objects/locate with body `{"pixel_x": "not_a_number"}` | HTTP 422 with validation error |
+| 3 | POST /sessions with body exceeding 1MB | HTTP 413 or 422 (no crash) |
+| 4 | POST /sessions/{id}/anchor with body `{"lat": 999, "lon": 999}` | HTTP 422 (invalid coordinates) |
+| 5 | Verify system continues operating after all malformed requests | GET /health returns 200 |
+
+**Pass criteria**: All malformed requests return 4xx errors with safe error messages (no stack traces, no internal paths); system remains operational
+
+---
+
+### NFT-SEC-05: MAVLink Injection Resistance
+
+**Summary**: Validate the system ignores unexpected or malformed MAVLink messages on the MAVLink channel.
+**Traces to**: AC-15 (ground station commands), solution security analysis
+
+**Steps**:
+
+| Step | Consumer Action | Expected Response |
+|------|----------------|------------------|
+| 1 | Send unexpected MAVLink message types to the system's MAVLink port | System ignores (no crash, no state corruption) |
+| 2 | Send malformed COMMAND_LONG with invalid lat/lon in re-localization hint | System rejects or ignores invalid coordinates |
+| 3 | Verify GPS_INPUT output continues normally | No disruption |
+
+**Pass criteria**: System ignores unexpected messages; continues normal operation; does not process invalid re-localization coordinates
@@ -0,0 +1,95 @@
+# Test Data Management
+
+## Seed Data Sets
+
+| Data Set | Description | Used by Tests | How Loaded | Cleanup |
+|----------|-------------|---------------|-----------|---------|
+| flight-sequence-60 | 60 aerial images (AD000001-060.jpg) with ground truth GPS from coordinates.csv, captured at ~1 photo per 2-3s from a fixed-wing UAV at 400m altitude | FT-P-01 through FT-P-06, FT-N-01, FT-N-02, NFT-PERF-01, NFT-RES-01 | Volume mount to camera-replay service; coordinates.csv loaded by e2e-consumer for ground truth comparison | Container restart between test groups |
+| camera-params | Camera parameters: ADTi Surveyor Lite 26S v2, 26MP (6252x4168), 25mm focal length, 23.5mm sensor width | All position accuracy tests, object localization tests | Volume mount; read by gps-denied-system at startup | N/A (read-only) |
+| satellite-tiles-test | Pre-processed satellite tiles (zoom 18) covering test flight area: 48.249-48.276°N, 37.340-37.386°E | All tests requiring satellite matching | Volume mount to satellite-tile-server and gps-denied-system | Container restart |
+| ardupilot-params | ArduPilot SITL parameters: GPS1_TYPE=14, GPS_RATE=5, EK3_SRC1_POSXY=1, EK3_SRC1_VELXY=1, fixed-wing frame | All tests requiring flight controller interaction | Baked into ardupilot-sitl Docker image | Container restart |
+| imu-replay-data | Synthetic IMU data (accelerometer + gyroscope at 200Hz) matching the flight-sequence-60 trajectory. Generated from coordinates.csv ground truth positions by computing velocities/accelerations between frames, interpolating to 200Hz, adding noise consistent with ICM-42688-P datasheet (gyro: 3.0e-3 °/s/√Hz, accel: 70 µg/√Hz). Stored as `input_data/imu_synthetic_200hz.csv` with columns: timestamp_us, accel_x, accel_y, accel_z, gyro_x, gyro_y, gyro_z. Alternative: SITL ArduPilot flies a waypoint mission following the coordinates.csv trajectory and internally generates physically consistent IMU data at 200Hz. | FT-P-01 through FT-P-06, NFT-PERF-01, NFT-RES-01 through NFT-RES-05 | Primary: SITL ArduPilot flies the trajectory and generates IMU internally via MAVLink. Fallback: pre-generated CSV replayed via MAVLink injector | Container restart |
+| invalid-inputs | Malformed images (truncated JPEG, wrong resolution), invalid API payloads, corrupted IMU streams | FT-N-03 through FT-N-06, NFT-SEC-01 through NFT-SEC-04 | Volume mount to e2e-consumer; injected via API calls | Container restart |
+
+## Data Isolation Strategy
+
+Each test group runs against a fresh container restart of the gps-denied-system and ardupilot-sitl services. The camera-replay service is restarted and configured per test group (different frame subsets, different replay speeds, or different fault injection modes). MAVLink capture logs are isolated per test run via timestamped directories.
+
+## Input Data Mapping
+
+| Input Data File | Source Location | Description | Covers Scenarios |
+|-----------------|----------------|-------------|-----------------|
+| AD000001-060.jpg | `_docs/00_problem/input_data/` | 60 aerial images (6252x4168, 26MP) from a fixed-wing UAV at 400m altitude. Images taken at ~1 photo/2-3s (wider spacing than real 0.7fps but usable for functional tests) | FT-P-01 to FT-P-06, FT-N-01, FT-N-02, NFT-PERF-01, NFT-RES-01, NFT-RES-LIM-01 |
+| AD000001_gmaps.png, AD000002_gmaps.png | `_docs/00_problem/input_data/` | Google Maps satellite reference images for frames 1-2 (used as sample satellite tile data for satellite matching validation) | FT-P-01, NFT-RES-02, NFT-RES-04 |
+| coordinates.csv | `_docs/00_problem/input_data/coordinates.csv` | Ground truth GPS (lat, lon) for each of the 60 images | FT-P-01, FT-P-02, FT-P-03, FT-P-04 (comparison baseline) |
+| data_parameters.md | `_docs/00_problem/input_data/data_parameters.md` | Camera specs: 400m altitude, ADTi Surveyor Lite 26S v2, 26MP, 25mm focal length, 23.5mm sensor | Test environment configuration |
+| position_accuracy.csv | `_docs/00_problem/input_data/expected_results/position_accuracy.csv` | Per-frame ground truth with acceptance thresholds | FT-P-01, FT-P-02 (expected result comparison) |
+| imu_synthetic_200hz.csv | `_docs/00_problem/input_data/` (TO BE GENERATED) | Synthetic 200Hz IMU data (accel + gyro) derived from coordinates.csv trajectory. Matches ICM-42688-P noise characteristics. Required for ESKF sensor fusion testing outside SITL. | FT-P-01 to FT-P-06, NFT-PERF-01, NFT-RES-01 to NFT-RES-06 |
+
+### IMU Data Generation
+
+No real IMU recordings exist for the 60-image flight sequence. Two approaches for providing IMU data during tests:
+
+**Approach A — SITL-generated (primary)**: ArduPilot SITL flies a waypoint mission following the coordinates.csv trajectory. SITL's internal physics engine generates physically consistent IMU data at 200Hz, delivered via MAVLink to the GPS-denied system. This is the most realistic approach and requires no pre-generated files.
+
+**Approach B — Synthetic CSV (fallback/replay)**: Generate `imu_synthetic_200hz.csv` offline from coordinates.csv:
+1. Compute inter-frame velocities from GPS positions and timestamps
+2. Interpolate position/velocity to 200Hz using cubic splines
+3. Compute accelerations (body frame) accounting for gravity + flight dynamics
+4. Add sensor noise matching ICM-42688-P specs (gyro: 3.0e-3 °/s/√Hz, accel: 70 µg/√Hz)
+5. Add bias random walks (gyro: 5.0e-5 °/s²/√Hz, accel: 2.0e-3 m/s³/√Hz)
+6. Replay via MAVLink injector service at 200Hz
+
+Approach A is recommended for integration tests. Approach B is useful for deterministic unit-level ESKF tests where reproducible IMU streams are needed.
+
+### Satellite Tile Data
+
+Only 2 Google Maps screenshots exist (AD000001_gmaps.png, AD000002_gmaps.png). Full satellite tile coverage for the test area must be prepared:
+1. Download Google Maps tiles at zoom 18 for the bounding box: 48.249-48.276°N, 37.340-37.386°E
+2. Store as 256x256 JPEG tiles with geohash-based naming
+3. Load into satellite-tile-server Docker service
+4. Estimated: ~50-100 tiles for the test area (~1-2MB total)
+
+## Expected Results Mapping
+
+| Test Scenario ID | Input Data | Expected Result | Comparison Method | Tolerance | Expected Result Source |
+|-----------------|------------|-----------------|-------------------|-----------|----------------------|
+| FT-P-01 | flight-sequence-60 (60 frames) | ≥80% of frames within 50m of ground truth | percentage | ≥80% | `expected_results/position_accuracy.csv` |
+| FT-P-02 | flight-sequence-60 (60 frames) | ≥60% of frames within 20m of ground truth | percentage | ≥60% | `expected_results/position_accuracy.csv` |
+| FT-P-03 | flight-sequence-60 (60 frames) | No single frame exceeds 100m error | threshold_max | ≤100m | `expected_results/position_accuracy.csv` |
+| FT-P-04 | flight-sequence-60 (selected satellite anchor pairs) | VO drift between satellite anchors <100m | threshold_max | ≤100m | inline |
+| FT-P-05 | Single frame + satellite match | GPS_INPUT: fix_type=3, horiz_accuracy 5-20m, satellites_visible=10 | exact + range | fix_type==3, accuracy∈[1,50] | `expected_results/results_report.md` #5 |
+| FT-P-06 | flight-sequence-60 | ≥57 of 60 frames registered (≥95%) | percentage | ≥95% | inline |
+| FT-P-07 | Normal operation, satellite match <30s | Confidence tier: HIGH | exact | N/A | inline |
+| FT-P-08 | VO tracking, no satellite >30s | Confidence tier: MEDIUM | exact | N/A | inline |
+| FT-P-09 | GPS_INPUT stream | Messages at 5-10Hz | range | [5,10] Hz | inline |
+| FT-P-10 | POST /objects/locate (known pixel, gimbal, zoom, UAV position) | lat/lon within accuracy_m of ground truth | numeric_tolerance | within accuracy_m | `expected_results/results_report.md` #27 |
+| FT-P-11 | Known GPS → NED → pixel → GPS | Round-trip error <0.1m | threshold_max | ≤0.1m | inline |
+| FT-P-12 | System boot + GLOBAL_POSITION_INT | GPS_INPUT output within 60s | threshold_max | ≤60s | inline |
+| FT-N-01 | Frames 32-43 (direction change area) | System continues producing estimates | threshold_min | ≥1 output per frame | inline |
+| FT-N-02 | Simulated 350m gap between frames | System handles outlier, next valid frame <100m error | threshold_max | ≤100m | inline |
+| FT-N-03 | POST /objects/locate with invalid pixels | HTTP 422 | exact | status==422 | inline |
+| FT-N-04 | Unauthenticated request to /sessions | HTTP 401 | exact | status==401 | inline |
+| FT-N-05 | VO lost + 3 satellite failures | fix_type=0, horiz_accuracy=999.0, RELOC_REQ sent | exact + regex | fix_type==0, matches `RELOC_REQ:.*` | inline |
+| FT-N-06 | VO lost + IMU-only | fix_type=2, horiz_accuracy≥50m growing | exact + threshold_min | fix_type==2, accuracy≥50 | inline |
+
+## External Dependency Mocks
+
+| External Service | Mock/Stub | How Provided | Behavior |
+|-----------------|-----------|-------------|----------|
+| Flight Controller (ArduPilot) | ArduPilot SITL | Docker service (ardupilot-sitl) | Full MAVLink protocol: heartbeat, GLOBAL_POSITION_INT, IMU data at 200Hz, accepts GPS_INPUT, responds to COMMAND_LONG |
+| Camera hardware (ADTI 20L V1) | Frame replay server | Docker service (camera-replay) | Serves frames from input_data/ at configurable rate (0.7fps default); supports fault injection (frame drop, delayed frame, corrupted JPEG) |
+| Satellite imagery (Google Maps) | Static tile server | Docker service (satellite-tile-server) | Serves pre-cached tiles via HTTP; supports fault injection (404 for missing tiles, slow response) |
+| Ground station | MAVLink inspector | Docker service (mavlink-inspector) | Captures STATUSTEXT and NAMED_VALUE_FLOAT; can inject COMMAND_LONG (operator re-localization hint) |
+| GPU (CUDA/TensorRT) | CPU fallback or Jetson hardware | Conditional | Docker: CPU-mode stubs for TRT inference (slower but functionally equivalent). Jetson: real GPU |
+
+## Data Validation Rules
+
+| Data Type | Validation | Invalid Examples | Expected System Behavior |
+|-----------|-----------|-----------------|------------------------|
+| Camera frame (JPEG) | Valid JPEG, resolution ≥ 1280x720 | Truncated JPEG, 0-byte file, BMP format | Log warning, skip frame, continue with IMU-only ESKF prediction |
+| GPS coordinate | lat ∈ [-90, 90], lon ∈ [-180, 180] | lat=999, lon=NaN | Reject, use last valid position |
+| IMU data | Acceleration ∈ [-160, 160] m/s², gyro ∈ [-35, 35] rad/s | All zeros, NaN values, extreme spikes | Filter outliers via ESKF process noise, log warning |
+| Satellite tile | Valid JPEG/PNG, 256x256 px | Missing tile (404), corrupted image | Skip tile, expand search radius, fall back to wider area |
+| API request body | Valid JSON, required fields present | Missing pixel_x, non-numeric zoom_factor | HTTP 422 with validation error details |
+| JWT token | Valid signature, not expired | Expired token, invalid signature, missing token | HTTP 401 Unauthorized |
@@ -0,0 +1,69 @@
+# Traceability Matrix
+
+## Acceptance Criteria Coverage
+
+| AC ID | Acceptance Criterion | Test IDs | Coverage |
+|-------|---------------------|----------|----------|
+| AC-01 | 80% of frames within 50m of real GPS | FT-P-01, FT-P-03 | Covered |
+| AC-02 | 60% of frames within 20m of real GPS | FT-P-02 | Covered |
+| AC-03 | Cumulative VO drift between satellite anchors < 100m | FT-P-04 | Covered |
+| AC-04 | Confidence score per position estimate (high/low) | FT-P-07, FT-P-08, FT-N-06 | Covered |
+| AC-05 | Image registration rate > 95% | FT-P-06 | Covered |
+| AC-06 | System handles 350m outlier between consecutive photos | FT-N-02 | Covered |
+| AC-07 | System handles sharp turns with <5% overlap, <200m drift, <70° angle via satellite re-localization | FT-N-01, NFT-RES-02 | Covered |
+| AC-08 | System handles disconnected route segments (core feature) | FT-N-01, NFT-RES-02, NFT-RES-03 | Covered |
+| AC-09 | 3 consecutive failures → re-localization request to ground station | FT-N-05, FT-N-07 | Covered |
+| AC-10 | < 400ms end-to-end per frame | NFT-PERF-01 | Covered |
+| AC-11 | Memory < 8GB shared | NFT-RES-LIM-01, NFT-RES-LIM-04 | Covered |
+| AC-12 | GPS_INPUT via MAVLink (MAVSDK) to flight controller | FT-P-05, FT-P-09 | Covered |
+| AC-13 | Frame-by-frame streaming, no batch/delay | FT-P-09, NFT-PERF-02 | Covered |
+| AC-14 | System initializes from last known GPS position | FT-P-12 | Covered |
+| AC-15 | Complete failure for N seconds → FC falls back to IMU, system logs | NFT-RES-03, FT-N-06 | Covered |
+| AC-16 | Mid-flight reboot → re-initialize from FC's IMU-extrapolated position | NFT-RES-01 | Covered |
+| AC-17 | Position + confidence streamed to ground station via telemetry | FT-P-13, FT-P-14 | Covered |
+| AC-18 | Ground station can send commands (re-localization hint) | FT-N-07 | Covered |
+| AC-19 | Output coordinates in WGS84 | FT-P-05, FT-P-11 | Covered |
+| AC-20 | Other onboard AI can request object GPS coordinates | FT-P-10 | Covered |
+| AC-21 | Object coordinates via trigonometric calculation (gimbal, zoom, altitude) | FT-P-10, FT-P-11 | Covered |
+| AC-22 | Object accuracy consistent with frame-center accuracy | FT-P-10 | Covered |
+| AC-23 | Satellite imagery ≥ 0.5 m/pixel | NFT-RES-LIM-03 | Covered (tile storage validation uses zoom 18 = 0.6m/px) |
+| AC-24 | Satellite imagery pre-loaded before flight | NFT-RES-LIM-03 | Covered |
+| AC-25 | MRE < 1.0 pixels | — | NOT COVERED — requires cuVSLAM internal reprojection metric; not observable via black-box interfaces. Covered at component test level (Step 5). |
+| AC-26 | Satellite imagery < 2 years old | — | NOT COVERED — operational procurement constraint; not runtime-testable. Validated during offline tile preparation. |
+
+## Restrictions Coverage
+
+| Restriction ID | Restriction | Test IDs | Coverage |
+|---------------|-------------|----------|----------|
+| RESTRICT-01 | Fixed-wing UAV only | FT-P-01 through FT-P-06 (test data from fixed-wing flight) | Covered |
+| RESTRICT-02 | Camera pointing downwards, not autostabilized | FT-P-10, FT-P-11 (coordinate transforms account for non-stabilized mount) | Covered |
+| RESTRICT-03 | Eastern/southern Ukraine operational area | FT-P-01 (test coordinates at 48.25-48.28°N, 37.34-37.39°E) | Covered |
+| RESTRICT-04 | Altitude ≤ 1km, terrain height negligible | FT-P-01, FT-P-10 (test data at 400m altitude, flat terrain assumed) | Covered |
+| RESTRICT-05 | Mostly sunny weather | — | NOT COVERED — environmental condition; cannot be tested in Docker. Mitigated by feature-based matching robustness. |
+| RESTRICT-06 | Sharp turns (no common points possible, exceptional) | FT-N-01, FT-N-02, NFT-RES-02 | Covered |
+| RESTRICT-07 | Up to 3000 photos per flight | NFT-RES-LIM-04 | Covered |
+| RESTRICT-08 | Two cameras: navigation (fixed nadir) + AI (configurable) | FT-P-10 (object localization uses AI camera angles) | Covered |
+| RESTRICT-09 | Navigation camera: FullHD to 6252x4168, known parameters | FT-P-01 (test data at 6252x4168) | Covered |
+| RESTRICT-10 | Jetson Orin Nano Super: 67 TOPS, 8GB, 25W TDP | NFT-RES-LIM-01, NFT-RES-LIM-02, NFT-PERF-01 | Covered |
+| RESTRICT-11 | Thermal throttling at sustained GPU load | NFT-RES-LIM-02 | Covered |
+| RESTRICT-12 | IMU data via flight controller (MAVLink) | FT-P-05, FT-P-12 (SITL provides IMU via MAVLink) | Covered |
+| RESTRICT-13 | GPS_INPUT message to flight controller | FT-P-05, FT-P-09 | Covered |
+| RESTRICT-14 | Telemetry link bandwidth-limited | FT-P-13 (1Hz telemetry rate is bandwidth-appropriate) | Covered |
+| RESTRICT-15 | Google Maps satellite (potentially outdated) | NFT-RES-04 (tile server failure resilience) | Covered |
+| RESTRICT-16 | Onboard storage limited for satellite tiles | NFT-RES-LIM-03 | Covered |
+
+## Coverage Summary
+
+| Category | Total Items | Covered | Not Covered | Coverage % |
+|----------|-----------|---------|-------------|-----------|
+| Acceptance Criteria | 26 | 24 | 2 | 92% |
+| Restrictions | 16 | 15 | 1 | 94% |
+| **Total** | **42** | **39** | **3** | **93%** |
+
+## Uncovered Items Analysis
+
+| Item | Reason Not Covered | Risk | Mitigation |
+|------|-------------------|------|-----------|
+| AC-25 (MRE < 1.0 pixels) | cuVSLAM reprojection error is an internal metric not exposed via public API or MAVLink; cannot be observed at black-box level | LOW — MRE is a proxy for VO quality; position accuracy tests (FT-P-01/02) validate the end result | Covered at component test level (Step 5) with cuVSLAM-specific unit tests |
+| AC-26 (Satellite imagery < 2 years old) | Operational procurement constraint validated during offline tile preparation, not at runtime | LOW — outdated imagery degrades matching but is caught by satellite matching accuracy tests | Validated during pre-flight tile download workflow; documented in operational procedures |
+| RESTRICT-05 (Sunny weather) | Environmental condition that cannot be reproduced in Docker or controlled test environment | LOW — system uses feature-based matching (LiteSAM/XFeat) robust to lighting variation; not a software test | Validated during real-world flight tests; feature-based matching provides robustness |
@@ -0,0 +1,40 @@
+# Autopilot State
+
+## Current Step
+flow: greenfield
+step: 3
+name: Plan
+status: in_progress
+sub_step: 1 — Blackbox Tests (test-spec skill), Phase 2 complete, Phase 3 next
+retry_count: 0
+
+## Completed Steps
+
+| Step | Name | Completed | Key Outcome |
+|------|------|-----------|-------------|
+| 1 | Problem | 2026-03-25 (detected) | Problem, restrictions, acceptance criteria, and input data defined |
+| 2 | Research | 2026-03-25 (detected) | 8 research rounds, 6 solution drafts, tech_stack.md, security_analysis.md |
+
+## Key Decisions
+- Research Decision: Proceed to planning with current draft (6 drafts, 8 rounds sufficient)
+- GPS-denied visual navigation system for UAV onboard Jetson Orin Nano Super
+- Core algorithms: cuVSLAM, LiteSAM/XFeat, ESKF sensor fusion
+- TRT engine migration for AI inference
+- Latest draft (06) at TRL ~2.5-3; hardware/algorithms well-researched, system integration under-specified
+- solution_draft06.md renamed to solution.md as finalized solution
+- Test environment: dual-mode (Docker SITL for CI + Jetson hardware for nightly/pre-deploy)
+- IMU data: ArduPilot SITL flies waypoint mission from coordinates.csv, generates 200Hz IMU via MAVLink
+- Test coverage: 43 scenarios, 93% AC+restriction coverage (39/42)
+
+## Last Session
+date: 2026-03-25
+ended_at: Step 3 Plan — SubStep 1 Blackbox Tests (test-spec Phase 2 complete)
+reason: user paused — context break before Phase 3
+notes: Test-spec Phase 1 (input data analysis) and Phase 2 (test scenario specification) complete. 8 artifacts written to _docs/02_document/tests/. Expected results created at _docs/00_problem/input_data/expected_results/. Phase 3 (test data validation gate) is next — scan all test scenarios, verify each has concrete test data + quantifiable expected result, ask user to provide missing items or remove tests, final coverage check ≥70%. Then Phase 4 (test runner scripts).
+
+## Retry Log
+| Attempt | Step | Name | SubStep | Failure Reason | Timestamp |
+|---------|------|------|---------|----------------|-----------|
+
+## Blockers
+- none