ADR-0002: How much control UNIVIP standardizesLink to the section ADR-0002: How much control UNIVIP standardizes#

Status: Accepted 2026-10-14 — sponsor confirmed the default ("keep all") Date: 2026-10-14 Profiles affected: C, N

ContextLink to the section Context#

A VMS integration could stop at viewing and camera control, or extend to moving the vehicle. Vehicle control carries safety, regulatory and liability weight that camera control does not. At the same time, "click on map to reposition" is one of the most compelling VMS features and the one vendor APIs (DJI DRC, Skydio) already expose.

Options consideredLink to the section Options considered#

1. Video, telemetry and camera controls only. Lowest risk; easiest vendor buy-in; leaves the most valuable feature undefined so vendors fill the gap proprietarily.
2. Full vehicle control as an optional profile. Standardizes the vocabulary, authorization model and safety rules; lets conservative vendors and operators stop at Profile C.
3. Vehicle control as a core requirement. Maximizes capability; makes Profile S impossible for devices or operators unwilling to accept remote tasking; likely blocks adoption.

DecisionLink to the section Decision#

Option 2. Vehicle control is Profile N, optional and separately enabled. Camera/payload control is Profile C. The two are never the same permission: distinct command families (camera.* vs vehicle.*), distinct lease scopes, distinct capability flags, distinct audit requirements.

Profile N standardizes a deliberately small command set (hold, return-home, go-to, relative move, mission start/pause/resume/abort, land, take-off) plus the control-lease model. It does not standardize manual stick control, launch/recovery sequencing beyond take-off/land, or payload release.

ConsequencesLink to the section Consequences#

• spec/11-vehicle-control.md carries the safety requirements: operator authority, vehicle-controller enforcement, lease expiry with heartbeats, geofence and altitude limits reported in capabilities, command audit records.
• Acceptance of a command is never completion; a command lifecycle with status updates is mandatory.
• Governance requires an additional safety reviewer for Profile N changes.

Open questionsLink to the section Open questions#

• Whether vehicle.takeoff belongs in Profile N v1 or in a later "dock operations" profile. Current draft: included, gated by capability flag.

Implementation clarification — 2026-10-16Link to the section Implementation clarification — 2026-10-16#

A valid lease authorizes an attempt; it cannot make an underlying operation physically cancellable. The DJI emulator exposed a false cancellation report during dock preparation. The working draft now requires explicit refusal or failure when a stop cannot be confirmed and preserves the original movement on a rejected stop. This keeps controller authority and truthful command status within the existing decision. A capability declaration for non-cancellable takeoff remains an open 0.3 finding (J15).