chore(release): v0.4.0 - #83

0.4.0 (2026年09月10日)

⚠ BREAKING CHANGES

• scenes: this scene's head camera publishes on /openral/cameras/top/image, not /openral/cameras/context/image. A saved Foxglove layout pointed at the old topic needs re-importing; the layout the deploy generates is already correct.
• robots,launch: robots/openarm/openarm.urdf now spells joints and links as upstream does (openarm_left_joint1, openarm_left_base_link) instead of the stripped left_joint1 / left_base_link. Anything reading that file by link or joint name must use the new spelling. The manifest's logical joint names are unchanged.
• cli: OPENRAL_ALLOW_SHARED_GRAPH is removed. Its narrowed replacement OPENRAL_ALLOW_UNVERIFIED_GRAPH waives only the unreadable-graph refusal; nothing waives the occupied-graph one. Setting the old name now does nothing.
• safety: check panda_link5 / panda_link7 at hull fidelity instead of exempting it (#202)
• nav: the payload_footprint launch arg is renamed payload_scan_filter and no longer starts a footprint publisher; openral_nav2_bringup.payload_footprint_node is removed. Nav2's footprint is now the manifest's bare chassis, substituted statically at launch by RobotDescription.nav2_param_overrides().
• safety: CollisionHit gains advisory, and a payload contact inside a live place declaration within place_advisory_depth of the allowance no longer latches or asserts E-stop. Set place_advisory_max_consecutive: 0 to restore the previous behaviour exactly.
• collision: publish the world grid on the map's own lattice, not the base frame's
• sim: the two test_depth_camera_synth.py tests asserting that a visual-only countertop must be the reported surface are inverted deliberately. Their scene is kept because it is the adversarial one — the slab is built to fall outside its body's collision BVH — but its physical surface is the carcass at 0.890; 0.920 is paint, and an arm passes through it.
• msgs: return candidate masks from SegmentInView, select on geometry in the HAL

Added

• cli,schemas: let a deploy scene name the octomap cloud topic (#240) (ff72713)
• cli: expose foxglove on real deploys (02af111)
• cli: make the occupied-graph refusal unwaivable (ebd93fa)
• collision: publish the world grid on the map's own lattice, not the base frame's (b376dd1), closes #173
• core: add attached collision object state (56f481d)
• core: promote homogeneous_from_quat_xyz into openral_core.geometry (57aa571)
• core: support multi-primitive attached payloads (c6c4b1a)
• detect,hal,rskill: detect and drive the OpenArm, and package its restocking policy (#152) (fcf7f01)
• docker: build the deploy image on aarch64 — openral:l4t (#168) (5949591)
• foxglove: rebuild the layout around the robot scene and widen the read-only allowlist (9086748)
• foxglove: rebuild the layout around the robot scene and widen the read-only allowlist (91f211f)
• hal,perception: SAM 2.1 vision attachment evidence (4934080)
• hal,schemas: address slot-dispatched joints by name (ADR-0102) (78827c4)
• hal,schemas: address slot-dispatched joints by name (ADR-0102) + cosmos3-edge on aarch64 (d176b7a)
• hal: call SegmentInView inside the deferred-ack barrier (1782a07)
• hal: carry the payload's own OBB slop, so a self stop is adjudicable (#147) (d826643)
• hal: debounced gripper-effort grasp trigger (bbd2737)
• hal: declare each controller's wire format, and prove the path in sim (a50f731)
• hal: emit e-stop ground truth for unattached stops, not just carried payloads (65e1a1b)
• hal: gate the ros2_control transport on shape, not ancestry (7665648)
• hal: make attached payloads transparent to depth rays and gate action_applied on perception settling (aa2a956)
• hal: make OpenRAL drive a real ros2_control robot end to end (#246) (d033726)
• hal: mask attached sim payload bodies (8466df1)
• hal: name a kernel stop that fires before the first applied chunk (ae35fd1)
• hal: report what backs a world-voxel stop, and the budget to judge it by (#144) (ea1b7e8)
• hal: vision attachment evidence with geometric fail-closed gates (9c80b24)
• launch,hal: start the robot's ros2_control graph from deploy run (fd50efb)
• msgs,perception,observability: a diagnostic mask topic for the dashboard overlay (69fcbdf)
• msgs: add a typed failure_kind to the ExecuteRskill dispatch result (0b3b322)
• msgs: add a typed failure_kind to the ExecuteRskill result (09fd95d)
• msgs: add openral_msgs/SafetyStatus for the latched safety topic (720e89c)
• msgs: add SegmentInView.srv — geometric prompt in, raw mono8 mask out (3aef5c1)
• msgs: carry a typed place-phase declaration from dispatch (ADR-0097) (e1a6a40)
• msgs: carry the support-contact witness on AttachedCollisionObject (2061a7d)
• msgs: return candidate masks from SegmentInView, select on geometry in the HAL (ed0e383)
• nav: dynamic payload footprint + robot self-filter for Nav2, and the explicit Nav2/kernel boundary (#108) (#143) (87dcda1)
• nav: make Nav2 base-only and turn CostCritic.consider_footprint on (#186) (d3b6262)
• observability: draw detector boxes and segmenter masks on the camera tiles (770b4a2)
• observability: draw detector boxes and segmenter masks on the camera tiles (07c802a)
• observability: show current safety state on the dashboard (c4a9a58)
• perception: serve SegmentInView from a SAM 2.1 lifecycle node (1d90335)
• reasoner: classify dispatch failures on failure_kind, not prose (89a63e0)
• reasoner: split LLM-call time out of the tick wall-clock (#95) (4b12310)
• rskill: package SAM 2.1 as rskill-sam2_1-any-grasped_object_mask-bf16 (2e70a72)
• runner: implement the ros2_image sensor backend (3c1f24d)
• runner: in-process SAM 2.1 segmenter backend and manifest dispatch (e5c83b6)
• safety,world-state: one voxel more headroom, on the cap and on the envelope (a031f3b)
• safety: add attached-payload collision to C++ kernel (ea3a70c)
• safety: allow bounded non-deepening contact for attached payloads against world voxels (6cfc24a)
• safety: check arm links against world voxels with a staged 26-DOP then exact convex hull (#166) (2e3b947)
• safety: declaration-scoped approach allowance for enclosed place targets (9657b1c)
• safety: declaration-scoped contact-force gate (survey Path C) (#210) (bf55a94)
• safety: exempt attested support contact, retire the index-keyed baseline (41e01f6)
• safety: latched SafetyStatus topic for every safety stop and fail-closed drop (ADR-0096) (03aca02)
• safety: publish the latched SafetyStatus from both safety paths (307b081)
• safety: refuse a declared place's own contact instead of latching an E-stop (da48918), closes #176
• safety: ship the declared place target's geometry to the kernel (survey Path B) (#200) (b085f8a)
• safety: ship tight geometry for panda_link3, link4 and link6 (#239) (78fa614)
• safety: support multiple collision primitives per attached object (262da46)
• scenes: bind the OpenArm cell's top camera slot to the ZED (06710e7)
• scenes: declare ADR-0097 place targets for the RoboCasa scenes, and stop a dispatch-supplied region reaching the kernel (cec09b7)
• scenes: declare the place target for the RoboCasa place scenes (e53fd92)
• scenes: land the carry-while-navigating scene #108 was blocked on, and time the MPPI loop (#185) (32f9653)
• schemas,launch: let a deploy scene bring up its own sensor drivers (14c4fef)
• schemas: add kind:segmenter, SegmenterContract and VISION_SEGMENTATION evidence (31bb726)
• schemas: add QuantizationDtype.FP8 + trt_fp8 preset (#105) (35fb2a4)
• schemas: name the distance-probe basis for support-contact evidence (79e03ab)
• schemas: type the place-phase declaration and its liveness rule (1b0d53b)
• sim,reasoner: reach the scene VLM and let resolve_place ask the detector (#98) (0dfbb37)
• sim: apply attachment state to depth masking (7028dc5)
• sim: derive attached-object evidence from MuJoCo (89346b6)
• sim: filter intangible geometry out of the depth cast (#180) (423044a)
• sim: let any backend declare its own pre-launch provisioning (0ba675a)
• sim: register the two drawer-target RoboCasa scenes (b30dc19)
• sim: surface the sim backend's task-success predicate into deploy logs (f18d751)
• skill: name the actual fault in the runner's safety abort reason (e7c14b4)
• skill: scope the place declaration to the goal that justified it (c00019a)
• skill: stamp the typed failure_kind on every ExecuteRskill result (6e1ee56)
• tools: land the 4-scene validation matrix as one versioned command (#145) (d55a7ca)
• world-state: attest bounded support contact at attach time (02a59c5)
• world-state: attest place-phase support contact under a declaration (c0dec44)

Changed

• launch: rename sim_e2e.launch.py to deploy_e2e.launch.py (0bcfdf3)
• perception: one camera-id to topic resolver for every node (d4b4849)
• sim: refuse the batched mj_multiRay swap — it walks through countertops (65fe0a4)

Fixed

• aarch64: route torch to cu130 — cu128 cannot run on Jetson Thor at all (#167) (c0e6523)
• build: make mypy install-state-independent for accelerate + transformers (281e765)
• ceiling: the early-exit record was dropping the fields #256 added (81e70f6)
• ci: stop the DCO hook duplicating trailers and splitting bodies on --- (#120) (be9cf99)
• ci: two independent ways select-and-test reported success over failure (#164) (a0f3d58)
• cli: let OPENRAL_REPO_ROOT override the launcher's baked-in checkout (#116) (264f183)
• cli: provision sim assets before launch, not inside on_configure (5e828a3)
• cli: run the deploy launch parser under the venv interpreter (5cd77bd)
• cli: run the deploy launch parser under the venv interpreter (b2df408)
• cli: say what to install when a deploy needs just and it is absent (ef7da7d)
• collision: settle self-occupancy (it is not the base), and stop a re-lower from silently loosening panda_mobile (#160) (e6ee309)
• core: accept the kernel's -1 reactive sentinel in CollisionEvidence.horizon_step (ff51dbf)
• core: accept the kernel's -1 reactive sentinel in CollisionEvidence.horizon_step (f14066e)
• deps: resolve CUDA torch on aarch64 so in-process policies use the GPU (c906303)
• deps: stop torch 2.9's PYTORCH_CUDA_ALLOC_CONF deprecation warning (9d5a2cb)
• docker: build openral_nav2_bringup, so the live Nav2 tests test something (#183) (677e790)
• docs: correct the 2-D laser synth's stale mj_multiRay claim (46382c0)
• docs: name mj_ray in the last two stale 2-D laser references (1889c64)
• docs: name the GPU probe the CLI actually has in the methods index (2995a93)
• docs: refresh drifted docs/methods line markers (3c329ee)
• docs: refresh stale (LNN) markers in 07-eval-sim.md (9441646)
• docs: refresh stale (LNN) markers in 07-eval-sim.md (8fee040)
• docs: refresh stale (LNN) markers in 07-eval-sim.md (aac358b)
• docs: the sim laser-height defect is fixed, stop calling it open (ad2edeb)
• docs: voxel_backing_record's signature is missing grid_orientation_xyzw (cfadee3)
• evidence: measure each tight hull's overhang past its source mesh (#226) (a14e503)
• evidence: probe the link-vs-link pair a self stop names, and budget it (#220) (d1d39d7)
• evidence: record the adjudicated configuration in every collision E-stop (#197) (a2970ba)
• evidence: score a payload-vs-link stop against the link, not the world (cf6365a)
• evidence: score a stop against the bodies it names — two adjudication defects (a0671b5)
• evidence: stop scoring a link-vs-link self stop against world geometry (#208) (44decc9)
• foxglove: follow the robot's own base frame, not base_link (39d77ab)
• foxglove: guard the ServiceCall panel, and record what the SDK settles (11df003)
• foxglove: let the viewer fetch URDF meshes, and name the real camera slots (98897c6)
• hal,tools: replace mj_geomDistance on the evidence path with a certified instrument (#170) (90bfedb)
• hal: advertise a sim camera topic only once the backend renders it (d61ea85)
• hal: cast the sim depth rays once per frame, not twice (66865d7)
• hal: compose the vision barrier holder with the evidence_ref-keyed release (454e7bd)
• hal: derive the HAL lifecycle budget from the scene's boot timeout (aa8a85f)
• hal: emit the terminal task-success verdict on a signal teardown (8832f58)
• hal: release the attachment barrier on an attestation-only revision (4bb6710)
• hal: scope the e-stop near-miss probe to kernel-checked links and probe payload pairs (8353834)
• hal: stop publishing world->base_link for mobile robots (eb90ad6)
• hal: stop publishing world->base_link for mobile robots (045b0b6)
• hal: stop scene planes from starving the e-stop near-miss probe (101db49)
• hal: stop the e-stop probe measuring against non-collidable markers (86d17c4)
• hal: stop the real HAL publishing zeros onto the global /joint_states (a85ce77)
• hal: the late voxel-backing probe dropped the grid's rotation (10ff989), closes #108
• harness: a graph that never came up is not a policy outcome either (bb1a691), closes #256
• harness: the monitor received nothing, an aborted launch read as a deadline, and a visual mesh made a real-contact (#149) (7685313)
• launch,foxglove: spawn the Bucket-2 converter and match camera slots to the deploy (7e6c180)
• launch,robots: stop assuming a mobile-base frame convention for the octomap leg (#241) (b5bf326)
• launch: align kernel attachment clock (ebb4305)
• launch: name the remedy when a scene's driver package is not found (216a5e3)
• launch: resolve the repo root from the installed launch copy (4c6169c)
• methods: refresh 10-tools.md markers after the hooks reformatted (947c476), closes #256
• nav2,harness: a 4 s Nav2 bond timeout was scoring dead graphs as policy failures (7739109)
• nav2,harness: stop a 4 s bond timeout from scoring as a policy failure (65adbc9), closes #256
• nav: count placed payloads per object, and measure the payload half (c4b1fc4), closes #108
• nav: count placed payloads per object, and measure the payload half on a scene (9afcc32)
• nav: make the silhouette sweep measure the steady state, and record why it has to (4cf0fb4)
• nav: prove the Nav2 costmaps carry no cell inside the robot silhouette (8422f29)
• nav: record the Nav2↔kernel boundary and prove the costmaps clean of the robot (d7e77ac)
• nav: turn the global costmap's height gate off instead of tuning it (4a5b969)
• nav: turn the global costmap's height gate off instead of tuning it (6fd5c14), closes #211
• nav: unblock master — payload footprint + scan-filter nodes were committed non-executable (#148) (02dad13)
• nav: withhold the scan until the self-filter can place the chassis (b5cf10a)
• nav: withhold the scan until the self-filter can place the chassis (ffc8808)
• observability: mirror KIND_COLLISION, and pin the failure_bus IDL mirror with a contract test (#141) (0bcff4a)
• plan,evidence: the 18.9 mm over-approximation is bimodal, not "the cell" (7fba4ea)
• plan,evidence: the 18.9 mm over-approximation is bimodal, not "the cell" (e7c0307)
• reasoner: make the cosmos3-edge sidecar work on aarch64 (b308fde)
• reasoner: stop retrying unavailable rskills (#100) (498e7f7)
• release: fail the job when a release stalls between merge and tag (#77) (104cb8f)
• release: stop the version bump stopping at pyproject.toml (uv.lock + version) (#81) (98e9676)
• reward: build the NF4 shells on meta — a 3.2 GB checkpoint was taking 14.3 GB of RAM (#184) (e205523)
• robot: align PandaMobile voxel collision model (#103) (0884101)
• robots,launch: standardise OpenArm on one wire naming convention (159d4fe)
• robots: lower base_scan range_min_m to the sensor minimum, and stop calling it a self-filter (#201) (84f61e1), closes #194
• robots: make the vendored OpenArm URDF loadable by ros2_control (812b005)
• rskill: declare the octomap_server the sim launch actually spawns (51c1fdb)
• rskill: say which joints the robot publishes when a state layout cannot bind one (10ba4c2)
• rskill: the BEHAVIOR-1K manifest name the publisher would refuse (#79) (03252ad)
• runner: negotiate BGRx through nvvidconv on plain-L4T Jetsons (#156) (4cd2e43)
• runner: report the deploy dataset recording instead of failing silently (#97) (ff907e5)
• safety: check panda_link5 / panda_link7 at hull fidelity instead of exempting it (#202) (ed850ac)
• safety: convert the support-contact witness probe off mj_geomDistance (#204) (1ebe71a)
• safety: keep a dispatch-supplied place region out of the kernel's path (08cad09)
• safety: make collision evidence describe one cell, not two (1b248c9)
• safety: order attachment masking after kernel ack (b86b988)
• safety: preserve attachment producer freshness (01869db)
• safety: prove "always-colliding" instead of sampling it (#169) (cf9bc8d)
• safety: refuse a disconnected collision graph instead of calling every orphan a base (#153) (85144d0)
• safety: say when a hull-adjudicated depth is really the box's bound (#213) (de9346c)
• safety: scale normalized Cartesian predictions (#101) (9fb5a9a)
• safety: tell the truth about a refused place region, once (7270f0b)
• scenes: make the ZED override hold, and fit it in the cell's USB budget (c901c7d)
• schemas,safety: make CollisionShape a real discriminated union, and close the last two fail-open shape branches (#165) (d5ff301)
• schemas: regenerate the exported schemas and (LNN) markers after the rebase (6d73522)
• sensors: read the ZED's bgra8 colour stream instead of refusing it (feb87f4)
• seven bugs blocking a fresh-machine RoboCasa deploy sim (#82) (36cf937)
• sim,collision: re-pin the fridge kitchen against the kernel criterion, and measure the live world map (#171) (10b6f53)
• sim,hal,evidence: repair the four instruments the collision programme measures with (#238) (1b20d3c)
• sim,hal: keep the depth self-filter's clearing rays on the octomap path (2a729d8)
• sim,safety: measure the sim camera TF against base_link's own body and revert the collision FK root (c5f3dd3)
• sim: correct the sink and fridge place targets against the live env (#146) (63d63a2)
• sim: derive the RoboCasa head camera from the rSkill palette (e3b13b0)
• sim: derive the RoboCasa head camera from the rSkill palette (84fc282), closes #91
• sim: diagnose the fridge-scene initial-pose E-stop, and name it in the artifacts (e391241)
• sim: emit the map-side backing when the collision evidence arrives late (b761a44)
• sim: keep a simulation and a real robot off each other's ROS graph (9ca834e)
• sim: keep a simulation and a real robot off each other's ROS graph (63fadb5)
• sim: let the graph guard skip a host with no ROS, and honour run_preflight (761034d)
• sim: make synthetic depth rays hit visual-only geoms (6b1aa5c)
• sim: make synthetic depth rays hit visual-only geoms (ff4d4df)
• sim: make the #195 gate actually gate — it was comparing two local casters (aceeca6)
• sim: narrow the scan result with isinstance so mypy --strict passes (5186c78)
• sim: pin every sim test to its own DDS domain (cdc0229)
• sim: quote the failing install step's own output in the raised error (12824b5)
• sim: record the carried object's orientation, not just its position (ba31961)
• sim: repair sidecar venvs whose pins moved, and stop hiding the reason (#94) (3693c9a), closes #89
• sim: size #217's bisect before running it, and test the shortcut (85d9953)
• sim: size #217's bisect before running it, and test the shortcut (375b908)
• sim: stop the obs refresh stepping physics and erasing the base twist (c40a7e1)
• sim: the depth cast's deploy load is 16 384 rays, not the 4 096 the docstring budgets (1ec6f62)
• sim: wire π0.5's TensorRT attach hook — it was never called (#106) (543a1d9)
• skill: name the safety stop that a blocked apply-wait was hiding (4f9b65f)
• skill: name the safety stop that a blocked apply-wait was hiding (29f66f0)
• skill: surface a latched safety stop from every dispatch wait, not just the apply-wait (414029d)
• skill: surface a latched safety stop from every dispatch wait, not just the apply-wait (4cb0e46)
• slam: measure a box's own z-extent for the nvblox height band (#150) (88cda6b)
• slam: refuse an unplaceable collision volume instead of guessing the height band (#151) (d16f859)
• test: keep a sourced ROS overlay out of the lane-report subprocess (164c59c)
• test: kill the node's process GROUP — leaked costmaps were failing the sweep (b277b5b)
• test: make the /joint_states regression harness runnable (c9f6c42)
• tests: give the idle-stepper spy the signature the bridge calls (6e7af1d)
• test: skip the tight-geometry check when trimesh is absent, don't error (#229) (8df1e77)
• tests: make the opt-in robosuite lane actually run — and stop it prescribing a command it cannot run (#162) (5238d88)
• tests: skip the OmDet-Turbo e2e test on a stale CPU-only torchvision (#109) (b999138)
• tests: stop the OmDet-Turbo nms probe aborting collection on pre-sm_70 GPUs (#113) (5838e1b)
• test: stop ROS 2 launch severing the openral logging namespace (855fe1b)
• test: stop the octomap fixture depending on the scene's own posture (0337547)
• tools: bind the logger name LingBot's MoE fallback handler never defines (849b230)
• tools: keep Qwen scene-VLM thinking mode on — non-thinking was less accurate (9f65126)
• tools: make the RLDX-1 sidecar run on aarch64 — the issue #88 verdict was wrong (5a6a0ce)
• tools: make the sidecars actually run on aarch64 GB10, not just resolve (2650b07)
• tools: move sidecar torch pins to 2.9.1 so aarch64 CUDA hosts provision (61c3b9b)
• tools: put the InternVLA-N1 sidecar on the GPU on aarch64 — was CPU-only (eb8ed2e)
• tools: run the sidecars on aarch64 GB10 — torch 2.9.1 + the sm_121 compiler ceiling (7bb066c)
• tools: stop the Qwen scene-VLM returning a reasoning trace as its answer (c0e18f7)
• world-state,safety: clear the attached payload out of world occupancy (a9b6918)
• world-state,safety: partition the payload clearing against the support witness (f7585e3)
• world-state: measure support contact by distance, not by contact list (384c366)
• world-state: rasterize the octree by cube overlap, not centre sampling (2edcf67)
• world-state: rasterize the octree by cube overlap, not centre sampling (4209f8c)
• world-state: widen the payload clearing for the attach-transition window (847d264)