Skip to content
R2Kernel™ Runtime Kernel for Robotics 1.0.0rc10
R2Kernel™ Runtime Kernel for Robotics 1.0.0rc10

    R2Kernel™ 1.0.0rc10

    RC10 is a prerelease for internal evaluation, not general operating or hard-real-time approval. It adds runtime federation peer administration, live federation key rotation, a fixed default federation data port and instance-selected link-layer adapters, and it collects the maintenance fixes made since RC9. RC9 remains an immutable historical prerelease. Upgrade the runtime and SDKs together, and upgrade the hosts of a federation together. Local Control remains protocol v5 without mixed-version fallback or automatic replay.

    Control and Console cleanup

    • Control reuses unchanged data-plane topology instead of rebuilding source and sink state on every fast tick. Periodic forwarding, deferred processing, and transport flushing continue.
    • Local heartbeat updates avoid redundant status copies and identity-registry rebuilds while preserving peer expiry, binding selection, and admission retirement.
    • Runtime graph movement, resizing, and collapse reuse the topology model. Standalone Terminal no longer loads Console-only panel styles.
    • Linux service setup uses a bundled isolated resource-authority helper. Existing policy, ownership, and key-preservation rules are unchanged.

    Build and deployment tooling

    • C++ fixture source and installed modes consume SDK-owned CMake targets. The installed package now exports the canonical r2kernel::cpp target and its r2kernel::core dependency. CMake consumers using the older generated r2kernel::r2kernel_cpp name must switch to r2kernel::cpp.
    • Core source builds delegate dependency freshness to Cargo, including generated standard schemas and build-script inputs.
    • Runtime tools, service units and native-installer upgrade coordination consume one declared deployment artifact closure. Installed command names, service ordering, ownership and rollback rules are unchanged.
    • Release configuration updates select YAML values instead of matching comments.
    • Verification records live outside disposable build bundles. Staged root QA requires an explicit durable --out; development state lives in .runtime/control-dev and is preserved by default cleanup.
    • Validation containers use the same Rust 1.98.1 toolchain as the release builder.

    Runtime federation peers

    • Scoped, revisioned federation peers can be queried and replaced at runtime through authenticated-admin routes. Removal or replacement retires affected Event and Timed Exchange work before reporting applied completion; durable state and generation tombstones survive Control restart. See Runtime Federation Peers.
    • Admission generations and authenticated registry changes publish together, avoiding a second authority write-lock acquisition per update.

    Federation key rotation

    • The broker's protected federation key file may hold a keyring: one active key and up to seven accept keys. Inbound handshakes select a key by id; Timed Exchange Control envelopes and registration snapshots are signed with the active key and verified with any listed key. A single-key file works as before.
    • POST /api/v1/control/federation/security/reload re-reads the key file without a restart and reports key ids only; GET on the same path shows the active and accepted ids and the last reload. Invalid material changes nothing, and a reload never changes federation.security.mode.
    • Rotate in three steps (stage, switch, retire), finishing each on every host. Removing a key closes only the Event sessions derived from it; their peers reconnect with the active key. See Federation Key Rotation.
    • Wire formats are unchanged.
    • A resources.link_layer interface may be named {{params.NAME}}, a declared string parameter, so one published gateway package runs on any host's adapter. The instance names it with --set NAME=<adapter> or the REST start params. Reservation, the root link_layer_grants approval and the capability grant use the actual adapter; a missing or invalid value refuses the launch before anything is reserved. Literal names are unchanged. See Select the adapter per instance.
    • Package instance status lists each declared link-layer interface with its parameter, the admitted adapter and the granted capabilities.

    Maintenance fixes

    • Managed launch and restart recovery retain exact request and lease ownership across publication failures, prevalidate a replacement before stopping the old instance, and preserve typed mutation errors through broker, CLI and HTTP.
    • Console mutation guards survive session replacement; malformed JSON is an error, stale polling responses cannot replace newer state, and pending actions disable both graph and list controls. Idle cookie-authenticated management WebSockets close at session expiry without waiting for another HTTP request.
    • SHM geometry is validated before create, open and attach; safe Rust preserves the real OS errno and distinguishes opaque C ABI statuses. Rust provider completion is reclaimed on unwind as well as on normal return.
    • Uninstall records account ownership rather than deleting fixed account names; Doctor preserves nested overrides, privileged Python helpers are isolated, and skipped service setup does not invoke package-manager prerequisites.
    • Public spec checks reject unresolved references and invalid fixed arrays; Python utility conversions use the current datatypes.
    • Qualification refuses missing blocks, profiles and raw samples, and separates hard real-time guards from relative performance comparison. These checks do not themselves establish RT qualification.

    Upgrade notes

    • Federation data port. federation.bind_port now defaults to 42001 instead of an allocated port. Each host's port remains configurable; a port in use fails Control startup with a bind error instead of moving. Set bind_port: 0 to keep the RC9 allocated-port behavior. Two Controls with default settings on one host now conflict on this port, as they already did on control.tcp_port and timed_exchange.relay_port.
    • Package mutation errors. Package install, start and stop keep their policy, missing-target, conflict, transport, not-dispatched, store-I/O and internal error codes instead of answering 400 for every store failure. A transport failure can leave an effectful outcome unknown; inspect retained exact-lease recovery before another mutation rather than replaying it.
    • Uninstall account removal. --remove-users removes only accounts this installation recorded as created. Accounts from an RC9 or earlier installation carry no such record and are kept.
    • Foreground launches under another UID. Attaching an ordinary foreground operator that runs under another UID needs CAP_SYS_RESOURCE in the broker (cross-UID prlimit). Container deployments that use this path must grant it.
    • Federation. Upgrade all hosts of a federation together. Key rotation requires every host to run RC10 before a keyring with more than one key is installed.

    Known limitations

    The RC9 known limitations still apply unless a section above says otherwise. In addition:

    • RC10 has no real-time qualification. The latency non-regression comparison of this maintenance line against RC9 did not pass, and repeated measurements on the available non-isolated host did not meet the hard 1 ms guards for either build. Do not use RC10 for hard-real-time operation.
    • Retiring a federation key closes the Event sessions derived from it; their Event traffic pauses until the peer reconnects on a later control tick.
    • An approved link-layer CAP_NET_RAW or CAP_NET_ADMIN grant remains ambient and host-wide in the package process. Selecting the adapter per instance does not confine the capability to that adapter.
    • The Web Console does not show the new instance link-layer status yet; read it from the package instance API.