メニュー
Use when: touching the supervised two-way command path (Initiative C) — meshsa.command.*, flightctl/run_commander.py, arm/disarm/RTL/set_mode, COMMAND_INT/ACK, force-disarm, operator confirmation, command audit log, or arm preconditions.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | meshsa-commanding-safety |
| description | Use when: touching the supervised two-way command path (Initiative C) — meshsa.command.*, flightctl/run_commander.py, arm/disarm/RTL/set_mode, COMMAND_INT/ACK, force-disarm, operator confirmation, command audit log, or arm preconditions. |
| argument-hint | The command-path change and which safety control it affects |
This is the highest-risk subsystem in the repo: a write path to a vehicle. The MAVLink plumbing is easy; the safety/auth/audit layer is the point. Never relax it to land a change.
packages/meshsa/src/meshsa/command/ or flightctl/run_commander.py.command/safety.py ConfirmationGate: stage → explicit
confirm → transmit. No implicit batching, no "confirm once, fire many." An unconfirmed command
is never emitted.run_commander.py binds loopback by default, requires
MESHSA_CMD_TOKEN (constant-time compare) and fails closed on a non-loopback bind without a
token. Do not weaken this; do not document an off-loopback bind without the M2 TLS/auth layer.command/audit.py JsonlAuditLog is fsync-durable, single-writer,
never drops a record (write error propagates → fail-closed). Every stage/confirm/attempt/
ack/retry/failure is recorded. The record shape (AUDIT_RECORD_FIELDS = ("t","event","data"))
is a wire contract — changing it is a breaking change.command/safety.py arm_allowed() + command/health.py
HeartbeatHealth: an arm command is only offered when the health report is fresh and OK
(fail-closed). Mirrors the FPV ArmGuard predicate.MAV_CMD_COMPONENT_ARM_DISARM param2 = FORCE_DISARM_MAGIC (21196)
bypasses interlocks incl. in-flight disarm. It is off by default (allow_force_disarm),
behind a separate force_ack=True confirmation — a normal confirm must never release it.allowed = {"set_mode", "rtl"}; arm/disarm/goto are opt-in.
build_command() enforces it. LLM stays read-only — no model-initiated commands, ever.Router (design §10).LoggerOverflowError).
Fakes only — scripted fake connection, no autopilot (see tests/test_command_*.py).packages/meshsa: python -m pytest, mypy src, ruff check .,
ruff format --check .. Keep the safety files at 100% coverage.packages/meshsa/src/meshsa/command/ (safety, audit, health, lifecycle, service, commands)flightctl/run_commander.pypackages/meshsa/tests/test_command_*.pydocs/specs/initiative-c-commanding-design.md (§4 safety layer, §5 force gate, §10 amendment)Use when: working in packages/jetson_yolo_gcs — adding a detector backend (YOLO/Hailo/ONNX/TensorRT), a tracker backend (Norfair/SORT), GStreamer camera/egress pipeline, the MAVLink LANDING_TARGET bridge, precision-landing safety, or the perception pipeline failure policy.
Use when: running pre-PR checks, performing regression testing, validating ruff linting/formatting, verifying mypy type safety, and checking test coverage before pushing.
Use when: working on the optional NVIDIA Nemotron inference bridge — meshsa.inference, NemotronClient/InferenceService/NemotronConfig, MESHSA_INFERENCE_* env vars, aiohttp session reuse, [AI Insight] feedback-loop filter, or the aioresponses test mocks.
Use when: adding or changing metrics/health export — RouterMetrics, render_prometheus, per-transport counters, the /metrics or /healthz route, HealthConfig fields, or a Grafana golden-signal dashboard.
Use when: starting a roadmap/initiative feature, new milestone work, a transport/codec/backend that adds behavior, or any change big enough to need a design. Author or update a spec under docs/specs first; code cites the spec by section.
Use when: adding a meshsa codec, changing JSON/Compact/CoT encoding, wire format, codec registry, Envelope serialization, per-transport codec bridge, or decode compatibility.