Frozen integration requirements

flightops contracts validate CONTRACT.json validates the bounded contract and prints its canonical digest. Freeze that digest through an independent review. Then evaluate selected saved evidence without running commands or connecting ROS:

flightops contracts evaluate CONTRACT.json --expect-digest FROZEN_SHA256 \
  --snapshot configuration-snapshot.json --evidence selected-evidence.json \
  -o result.json

Contracts use flightops.integration-contract/1, an ID/revision, optional exact project/robot/asset/unit/installation scope, explicit assumptions and 1–32 requirements. Each requirement names an ID, kind, selected evidence ID and exact expected values. Supported kinds are:

• qos: topic plus exact publisher/subscriber IDs; observed DDS offer/request profiles are checked by the existing onscope compatibility implementation.
• topic_presence: exact topic and half-open start_ns/end_ns log-time window.
• topic_rate: the same frozen selector plus min_hz/max_hz.
• numeric_range: the same selector plus field, reduction (min, max, mean, last), unit, minimum and maximum. MCAP numeric units remain caller-declared; a bounds pass under that assumption does not verify a physical unit or encoding.
• frame: exact source/target frames and a frozen ROS message stamp {sec,nanosec}, evaluated from a saved message-TF result.
• clock_relation: exact source/target clock IDs, required interval and maximum uncertainty. Labels alone are insufficient. The selected relation must be covered by a resolved evidence receipt and selected canonical JSON clock-measurement bytes whose clock IDs, offset, uncertainty and validity match it.

The evidence envelope is flightops.contract-evidence/1 with an items list. Each item contains id, snapshot_id and record. Existing bounded MCAP windows, Standard recording selections and message-TF observations are reused directly. The narrow QoS adapter uses flightops.qos-observation/1, provenance: observed, exact endpoint IDs/topic, and publisher/subscriber profile objects. Clock adapters use flightops.clock-relation/1 and flightops.clock-measurement/1; receipt support is explicitly selected alongside them. These are caller-provided saved observations, not producer authentication or permission grants.

Every result binds contract, selected evidence and installed evaluator digests, the exact configuration snapshot, requirement outcomes and assumptions. Empty, truncated, malformed, missing, differently scoped or unsupported evidence cannot pass. Equal clock labels do not align streams. Output preserves separate pass, fail, unknown and unsupported requirement states. Contract files stay proposed until an independent release policy explicitly selects them. This command does not establish current hardware safety, causal diagnosis or end-to-end latency, and never grants permission to execute a procedure.