[KARTHIKEYAN124]

Current update ? 28 October 2026

Head: 7e2d172. Adds the requested CI parity gate against openAMRobot/openamrobot-manifest main's releases/v2.0.0-rc.1.repos. The complete path/type/URL/SHA mapping must match; only governance/.github is exempt. Missing reference files and missing driver entries fail closed. No 19 October source pins or source checksums changed.

Local validation: python -m unittest discover -s tests -v passes 35/35; git diff --check passes. The comparison matches all 13 entries in manifest PR #18 and correctly rejects PR #17 alone for missing sllidar_ros2 and micro_ros_agent. Hosted pinned-release run reaches the new parity check and fails because manifest main does not yet contain releases/v2.0.0-rc.1.repos. This is the intended fail-closed behavior; the gate cannot pass until manifest #17 and #18 merge to main. Repository quality, DCO and CLA pass; navigation validation was still running at the last check. The fresh source-build steps follow the parity guard and did not run on this head.

The maintainer adopted aa69c80 in the linked comment; the evidence below remains historical validation of that head. This additional requested guard changes the head and needs fresh validation/review. The PR is already ready for review. Contributor agreement and authorization declarations below remain for the contributor to answer personally.

Pin refresh remains separate until full Gate A (6 November) and upperbody #14 complete. Interfaces repinning remains separate.

---

Work package

Addresses OA-05: add an exact-SHA v2.0.0-rc.1 candidate source configuration alongside the merged navigation-install gate and legacy v0.0.1 builder. The release-local manifest pins 14 sources and the reviewed lock verifies SHA-256 for the manifest and every canonical source archive. The candidate snapshot remains dated 2026-10-19; final component acceptance is not claimed.

The existing build and validation commands dispatch to pinned packaging for the new configuration. Fetches target full SHAs and verify the resolved commits. Deterministic bundles record source provenance, an exhaustive file checksum inventory and an external SHA-256. Mutable refs, missing hashes, changed source bytes and checksum mismatches fail.

Integration Gate

Rebased onto main after #9 and #8 merged. Main's navigation manifest, navigation-only test config, verifier scripts/workflow, compact evidence and archive ignores are preserved. The navigation rejection checks remain in the archive-input builder; the rc.1 dispatch is added alongside them. Main's evidence byte-preservation attributes remain in place. README and RELEASE_PROCESS retain the merged release-model documentation with short pointers to RC1_RELEASE.md.

The rebase rewrote the two original PR commits, with a local backup retained. The remote update used force-with-lease guarded by the previously verified remote head 58ce4a2. Follow-up commits record combined validation and fix the fresh-fetch portability issue below. No concurrent remote changes were overwritten.

No source repository SHA, package version or contract selection was changed. The accepted interfaces contract/package-version repin and final rc.1 component selection remain separate release work. The release-local candidate includes 13 workspace repositories plus governance; final alignment with the workspace release manifest still requires review. No inaccessible work or owner adoption is asserted.

Tests

Base SHA: c39eda7
Head SHA: aa69c80

Local: 28 tests, zero failures (11 merged navigation/config/provenance tests and 17 pinned-release tests).

python -m unittest discover -s tests -v
python scripts/lock_release_sources.py --manifest manifests/v2.0.0-rc.1.repos --output release-config.rc1.lf.json --cache-dir input/rc1 --version 2.0.0-rc.1
python scripts/build_release.py --config release-config.rc1.json --input-dir input/rc1 --output-dir dist/rebase-20261024-lf
python scripts/validate_release.py dist/rebase-20261024-lf/OpenAMRobot-v2.0.0-rc.1-source.zip

The lock command fetched all 14 existing SHAs afresh. Verified all configuration fields except the source checksums were unchanged, then replaced the candidate lock. The rebuilt source bundle verifies 1,841 files. Its SHA-256 is:

2c494b1d090a3c525379d32585f483d9c685d606943657c1b64991190c11d227

git diff --check passes. Detailed historical and current evidence is in RC1_EVIDENCE.md.

Portability regression found by fresh Linux CI

The initial rebased navigation gate passed, but the pinned-release fresh-fetch run failed on the interfaces source checksum. Investigation reproduced Windows core.autocrlf changing text bytes during git archive: 59 interfaces files differed only by CRLF versus LF. The old cached Linux packaging check did not test fresh exports.

Export now explicitly sets core.autocrlf=false and core.eol=lf. Checksum enforcement remains strict. The source lock was intentionally regenerated from the same SHAs; no published release was modified. A regression using opposite host autocrlf defaults fails before the fix (one test) and passes afterward; the full 28-test suite then passes. Error output now reports expected and actual source hashes.

Hosted verification on the final head

• Pinned rc.1 release: two independent fetch/builds and checksum comparison
• Navigation pinned install: isolated producer/consumer pairs
• Repository quality

Both final-head workflows succeeded. Linux ran all 28 tests; two independent fresh fetch/builds each verified 1,841 files and produced the same 2c494b1d090a3c525379d32585f483d9c685d606943657c1b64991190c11d227 bundle hash as Windows. The navigation producer/consumer gate also passed. Repository quality, DCO and CLA pass. The shared optional quality/test job is skipped and is not counted as validation. Hosted source and navigation evidence artifacts are available in the linked runs; no GitHub Release is published.

Dependencies

Tooling adds PyYAML 6.0.3 (MIT), https://github.com/yaml/pyyaml. The source snapshot references SLAMTEC sllidar_ros2 (upstream package declares BSD; original licence retained) and micro-ROS-Agent (Apache-2.0 and upstream third-party notices) by exact SHA. No upstream code is vendored or modified. Other component provenance/licences remain in their original exports. No LICENSE, LICENSING.md, NOTICE or CODEOWNERS change.

Safety impact

Source selection, packaging, validation and documentation only. No safety implementation changes or physical hardware access. Packaging checks do not establish component or physical safety acceptance.

STATE.md

Updated with main integration, retained navigation safeguards, the line-ending correction and remaining source-selection/acceptance work.

Not verified

Final-head hosted packaging and navigation gate checks pass. Full Jazzy workspace compilation, physical driver operation, hardware/firmware acceptance, upstream build-time downloads and reproducible compiled binaries are not validated. The interfaces contract/package-version repin and final rc.1 readiness remain pending. No merge, tag or GitHub Release is performed. The PR is ready for review and was adopted by the maintainer at aa69c80; contributor agreement coverage is not asserted by the agent.

AI disclosure

OpenAI Codex prepared the original candidate implementation and this rebase, conflict resolution, regression fix, regenerated checksum lock, tests and evidence. The contributor identity matches the authenticated user's existing signed-off contributions.

Intellectual property and provenance

• Every commit is signed off under the OpenAMRobot DCO.
• I am covered by an accepted Individual or Corporate Contributor Agreement.
• I have all required employer, university, client, sponsor, co-author, or institutional authorization.
• Third-party and material AI-assisted content is identified with source, licence, modifications, and notices.
• No unauthorized confidential, personal, proprietary, credential, or export-controlled information is included.

[BotshareAI]

Adopt. Maintainer re-run at aa69c80: 28/28 tests, two fresh fetch builds give the identical bundle. Merge as the rc.1 candidate builder. Pins are the 19 Oct candidate snapshot and get refreshed in one PR after Gate A.