eSlider
10a18f1321
CI & Release / Verify documentation (push) Skipped
CI & Release / Verify simulator (push) Skipped
CI & Release / Trivy scan (push) Skipped
CI & Release / Semantic Release (push) Skipped
CI & Release / Verify documentation (pull_request) Successful in 6s
CI & Release / Verify simulator (pull_request) Failing after 10s
CI & Release / Trivy scan (pull_request) Skipped
CI & Release / Semantic Release (pull_request) Skipped
Restore docs/adr to main; add check_adrs.py CI gate so existing ADR-*.md files cannot be modified — supersede with a new numbered ADR instead.
39 lines
1.7 KiB
Markdown
39 lines
1.7 KiB
Markdown
# ADR-0001: No swarm-wide orchestrator; coordinate through data
|
|
|
|
## Status
|
|
|
|
Accepted (2026-07-08)
|
|
|
|
## Context
|
|
|
|
The fleet flies fully autonomously with no internet uplink and only
|
|
intermittent mesh connectivity between drones. A conventional control plane
|
|
(Kubernetes across the swarm, a leader election, a central scheduler) assumes
|
|
stable membership and low-latency links — exactly what a swarm does not have.
|
|
Partitions are the normal case, not the exception.
|
|
|
|
## Options
|
|
|
|
| Option | Pros | Cons |
|
|
| --- | --- | --- |
|
|
| A — Cluster orchestrator spanning the swarm | Familiar tooling | Assumes stable membership; a partition stalls coordination; single point of failure in the air |
|
|
| B — Each drone autonomous, coordinating through exchanged data | Survives partitions; no air-side control plane to fail | No global view; behaviour must be derivable from local state |
|
|
|
|
## Decision
|
|
|
|
Every drone is an autonomous node. There is **no orchestrator spanning the
|
|
swarm**. Coordination happens by exchanging derived state (see
|
|
[ADR-0003](ADR-0003-sync-derived-state-only.md)), and each drone makes its own
|
|
in-flight decisions against its local data window. Orchestration tooling
|
|
(Kubernetes, Flux) is confined to the **ground** segment
|
|
([ADR-0006](ADR-0006-iac-boundaries.md)).
|
|
|
|
## Consequences
|
|
|
|
- The platform degrades gracefully under partition: a drone that loses peers
|
|
keeps flying and recording.
|
|
- There is no single "fleet state" to query in the air; health questions are
|
|
answered from each drone's own store and reconciled on the ground.
|
|
- Design principle 1 in [`../../README.md`](../../README.md) and the on-board
|
|
model in [`../02-architecture.md`](../02-architecture.md) follow from this.
|