# franken_drone_geometry_reconstruction — RULEBOOK v1.0 Assessment Packet v6

**Repository:** `Dicklesworthstone/franken_drone_geometry_reconstruction` · **Language:** Rust (edition 2024, pinned `nightly-2026-08-31`) [Code-verified, High] · **Pinned commit:** `90892e931cd7c8d0de179ccdc36569790ccc4030` (2026-09-04 15:50:57 +0000, [Git-observed, High]) · **Last push:** 2026-09-04T19:28:28Z — the pin is the latest push confirmed in this assessment; the tree has been static for 18 days [External, High] · **Scope:** the pinned commit only, not HEAD. No releases, no tags [External, High].

**Method (analyst):** shallow clone at the pin under `~/workspace/.scratch/fdg/repo`; read README.md, AGENTS.md, IMPLEMENTATION_STATUS.md, ARCHITECTURE.md, CHANGELOG.md, DJI_ADAPTER_RESEARCH.md, LICENSE (verbatim), `Cargo.toml`, `Cargo.lock`, `.github/workflows/ci.yml`, `scripts/qualify.sh` (existence + perms), `registries/*.toml` (counts), `.beads/issues.jsonl` (status field scan); counted `.rs`/`.inc` files and lines, `#[test]` attributes, unsafe sites/blocks, workspace members, dependency names; sampled `fdgr-relative-pose` and geometry crate headers; queried the GitHub repo API, Actions runs API, and releases API. **Not done:** the workspace was never compiled (no pinned-nightly toolchain fetch attempted), no test suite was run, no CLI command was executed, no E2E was reproduced, no fixture media was processed. All functionality findings are code-read + docs-corroborated, not execution-verified. Assessment date: 2026-09-22.

**Tier legend (Rulebook §1):** **[Verified]** direct inspection of the pinned clone or a live page read by the analyst — flavors **[Counted]** (I ran the count), **[Git-observed]** (git metadata), **[Code-verified]** (source read); **[CI-observed]** is Tier 2 (seen executing on live CI pages — attests the suite *runs*, not that it is green); **[Maintainer claim]** asserted in README/docs, not independently executed; **[External]** independent sources; **[Inference]** analyst judgment, always labeled. Confidence: **High** / **Medium** / **Low** as defined in §1.

---

## Hook

A 57,180-line [Counted, High], zero-third-party-dependency, all-`forbid(unsafe_code)` Rust workspace that set out to rebuild drone photogrammetry from scratch — and then did something almost unheard of: it stopped exactly where every SfM pipeline starts. There is no feature extractor, no five-point solver, no triangulation, no bundle adjustment, no mesh. What exists instead is an unusually disciplined *pre*-reconstruction substrate [the "unusually" is comparative over the FrankenSuite packets completed so far — Inference, Medium]: immutable media custody, fixed-point camera math, deterministic keyframes and correspondence gates, and a two-generation bundle-admission audit that will certify the *inputs* to an optimizer it refuses to run. The honesty machinery is the product: the README, an 18-clause non-claims list, and a maturity vocabulary that forbids the author from implying what the code has not earned. The open question is whether a project that will not emit meters can ever become what its name promises — geometry reconstruction — and whether the velocity stop on 2026-09-04 is a pause or a tombstone [last two clauses Inference, Medium].

---

## TL;DR

- **What it is:** A clean-room, safe-Rust reference stack (30 workspace members, ~57.2k first-party lines, zero external crates [Counted, High]) implementing the evidentiary *front half* of a drone photogrammetry pipeline: exact-byte media custody, ISO BMFF/sample evidence, canonical timelines, clock/calibration/scale semantics, deterministic keyframe and correspondence evidence, epipolar and relative-pose *adjudication of supplied candidates*, deterministic pose-graph machinery, component-relative camera-center initialization, translation-only refinement, and a structural bundle-problem compiler with a separate held-out-independence audit. It is not a reconstruction system: it triangulates nothing, optimizes nothing, and emits no metric poses or geometry [Code-verified + Maintainer claim, High].
- **Strongest evidence:** the honesty infrastructure — a maturity vocabulary (source-present → production-admitted) enforced in docs, a "does not yet claim" list spanning ~18 capabilities, README-vs-IMPLEMENTATION_STATUS cross-checks, `forbid(unsafe_code)` in every crate with zero unsafe blocks re-counted independently [Counted, High], and a dependency universe of literally nothing but `std` (Cargo.lock = 30 packages, all `fdgr-*`) [Counted, High].
- **Strongest doubts:** README/IMPLEMENTATION_STATUS both claim "28 members" while the workspace has 30 (drift in the project's auditability pitch, [Counted, High]); the sole CI workflow is self-hosted and all 324 runs ever observed are queued/cancelled — including the run at the pin — so nothing has ever been shown green anywhere [External, High]; the maintainer's asupersync doctrine is aspirational (zero references in code or lockfile) [Code-verified, High]; no release, no tag, 31 stars / 3 forks [External, High]; and development stopped 2026-09-04 with `WP-018` open [External, High].
- **NODUS ring: Explore** [Inference, Medium] (TRL 3 — see §4.9). Substantive-but-unproven is the textbook Explore case; the rider and the velocity stop are advancement blockers, not ring qualifiers. The *methodology* (claim inventory discipline, maturity vocabulary, admission auditing) is the trackable artifact.

---

## Quick Links

Pin-relative links (`blob/90892e931cd7c8d0de179ccdc36569790ccc4030`); resolution spot-verified 2026-09-22 [Verified, Medium] — repo page and LICENSE blob fetched live and rendering at the pin; remaining pin-relative blob paths confirmed present as files in the pinned tree, which is the resolution guarantee a shallow pin provides:

1. [Repository](https://github.com/Dicklesworthstone/franken_drone_geometry_reconstruction) — 31 stars / 3 forks confirmed 2026-09-22
2. [README](https://github.com/Dicklesworthstone/franken_drone_geometry_reconstruction/blob/90892e931cd7c8d0de179ccdc36569790ccc4030/README.md)
3. [License (with AI-lab rider)](https://github.com/Dicklesworthstone/franken_drone_geometry_reconstruction/blob/90892e931cd7c8d0de179ccdc36569790ccc4030/LICENSE)
4. [Implementation status — the honesty document](https://github.com/Dicklesworthstone/franken_drone_geometry_reconstruction/blob/90892e931cd7c8d0de179ccdc36569790ccc4030/IMPLEMENTATION_STATUS.md)
5. [Changelog](https://github.com/Dicklesworthstone/franken_drone_geometry_reconstruction/blob/90892e931cd7c8d0de179ccdc36569790ccc4030/CHANGELOG.md)
6. [Local qualification contract (the only CI workflow)](https://github.com/Dicklesworthstone/franken_drone_geometry_reconstruction/actions/workflows/ci.yml) — 324 runs; latest (at the pin) cancelled
7. [Bundle problem reference](https://github.com/Dicklesworthstone/franken_drone_geometry_reconstruction/blob/90892e931cd7c8d0de179ccdc36569790ccc4030/architecture/BUNDLE_PROBLEM_REFERENCE.md)
8. [Bundle admission reference](https://github.com/Dicklesworthstone/franken_drone_geometry_reconstruction/blob/90892e931cd7c8d0de179ccdc36569790ccc4030/architecture/BUNDLE_ADMISSION_REFERENCE.md)
9. [Pose graph and global pose reference](https://github.com/Dicklesworthstone/franken_drone_geometry_reconstruction/blob/90892e931cd7c8d0de179ccdc36569790ccc4030/architecture/POSE_GRAPH_AND_GLOBAL_POSE_REFERENCE.md)
10. [DJI adapter research program](https://github.com/Dicklesworthstone/franken_drone_geometry_reconstruction/blob/90892e931cd7c8d0de179ccdc36569790ccc4030/DJI_ADAPTER_RESEARCH.md)
11. [Releases](https://github.com/Dicklesworthstone/franken_drone_geometry_reconstruction/releases) — resolves; "There aren't any releases here" (verified 2026-09-22). The empty page is itself evidence: no release artifact exists to evaluate or fork from.
12. [Qualification doctrine](https://github.com/Dicklesworthstone/franken_drone_geometry_reconstruction/blob/90892e931cd7c8d0de179ccdc36569790ccc4030/QUALIFICATION.md) — lists differential equivalence as a future obligation the audited input "cannot close"

---

## Did You Know

The entire 57,180-line stack — including its own streaming SHA-256 and its own bounded ISO BMFF container parser — compiles against **zero third-party crates**: `Cargo.lock` lists exactly 30 packages, one per workspace member, all named `fdgr-*` [Counted, High]. That makes it the most dependency-closed codebase assessed in this program so far [Inference, Medium] — and it is what makes the `#![forbid(unsafe_code)]` posture *auditable* rather than aspirational, since every line of code the binary can reach was written by the same hand [second clause Inference, Medium].

---

## Franken-worthy next steps

1. **Export the maturity vocabulary as a FrankenSuite-wide QA gate.** FDGR's five-label ladder (source-present → reference-implemented → publicly-invokable → locally-qualified → production-admitted) with its "no lower label implies a higher one" rule is a stronger anti-hype instrument than anything in the sibling repos. *Done when:* the ladder is written into the program's assessment protocol with one worked re-classification of an existing packet's claims. [Inference, High — process proposal]
2. **Wrap an incumbent pipeline with the bundle-admission audit and count the rejections.** Run OpenDroneMap or COLMAP end to end, convert their outputs into `fdgr.bundle_problem/1` + `fdgr.bundle_admission/1` inputs, and publish how many held-out observations fail the seed-provenance audit. That number is the first falsifiable measure of the audit's value — if it rejects nothing, the admission machinery is ceremony. *Done when:* a dated receipt names the pipeline, dataset, and rejection counts. [Inference, Medium]
3. **Make the packet's own drift finding a machine check.** This assessment found the docs' "28 members" vs. the workspace's 30; the repo already owns `scripts/validate_repo.py` and a `qualify.sh` static lane. *Done when:* a static-lane check fails the build when README/IMPLEMENTATION_STATUS member counts diverge from `Cargo.toml`. [Inference, High]
4. **Close the asupersync gap one way or the other.** The README and AGENTS.md mandate asupersync as the sole async runtime; the tree contains zero references to it. Either admit it as a dependency and use it in the first worker-execution crate, or downgrade the doctrine to a future gate in the registries. *Done when:* `Cargo.lock` names asupersync, or the doctrine files no longer present it as current policy. [Inference, Medium]
5. **Publish the first real reconstruction artifact as the kill-test milestone.** The core thesis ("evidence-grade substrate") only matters if geometry eventually flows through it; `WP-018` names joint optimization as the open frontier. *Done when:* a retained local-qualification receipt covers an end-to-end run from DJI Flip footage to a triangulated sparse map with held-out reprojection error. Until then the project is an audit harness in search of a pipeline. [Inference, Medium]

---

## 4.1 Why it exists — the market problem

**The problem, as the maintainer frames it:** drone-derived 3D evidence is increasingly used where the stakes are legal and operational — forensics, disaster response, surveying — but the pipelines that produce it (COLMAP, commercial suites, DJI's own tooling) are black boxes with respect to provenance: they cannot say which byte of which frame supported which 3D point, under what calibration, at what scale authority, or what was held out of the optimization. The maintainer's stated bet is that an *evidence-first* substrate — where every geometric claim carries a verifiable chain from immutable media bytes through deterministic adjudication to an audited bundle problem — is the missing layer, and that building it in safe Rust with zero dependencies makes the audit actually checkable [Maintainer claim, Medium].

**Who feels the pain:** forensic analysts who need chain-of-custody for drone imagery, disaster-response teams who need to know what a "digital twin" actually asserts, surveyors who need metric honesty (what is meters vs. what is an arbitrary gauge) [Inference, Medium].

**Demand-side check (v2 round, 2026-09-22):** the forensic-drone-evidence demand is real and currently served by extraction tooling, not reconstruction attestation. Cellebrite markets enterprise drone forensics explicitly on "preserving chain-of-custody for court and regulator use" under Daubert/Frye standards (https://cellebrite.com/en/blog/a-drone-was-seized-at-your-facility-now-what/) [External, Medium — vendor page]; NIST/SWGDE published "Best Practices for Drone Forensics" (January 2022), cited in practitioner reporting (https://medium.com/@mathias.fuchs/from-prison-drops-to-battlefields-extracting-what-drones-leave-behind-1b36008a6b4b) [External, Medium]; and a 2025 Wiley forensic-science review notes that "data collection with UAS is not a validated method in forensic services" in the UK context (https://wires.onlinelibrary.wiley.com/doi/10.1002/wfs2.70022) [External, Medium]. SkyeBrowse, a videogrammetry platform, positions itself as "Daubert-ready" with quantified error tiers and cites NTSB/DHS/LA DA's Office endorsements (https://www.skyebrowse.com/news/posts/is-skyebrowse-daubert-ready-the-forensic-validity-behind-the-rapid-3-d-modeling-platform) [External, Medium — vendor claims]. The read: buyers already pay for *admissible drone-derived 3D* (SkyeBrowse) and for *custody tooling* (Cellebrite), but nobody sells the custody-to-geometry attestation chain FDGR proposes — the lane is real, adjacent products validate willingness to pay, and the specific attestation gap is unoccupied [Inference, Medium].

**Why now:** consumer drones (the DJI Flip is the motivating profile) put survey-grade-ish cameras in everyone's hands, and agents are about to start *operating* these pipelines — an agent that cannot distinguish "estimated scale" from "meters" will confidently emit false metric claims, so the typed `ScaleStatus` ladder is aimed at the agent era [Inference, Medium].

**Why a rewrite, not a wrapper:** stated in the architecture docs — wrapping COLMAP/OpenSfM would inherit their nondeterminism, C/C++ memory unsafety, and un-auditable internals; only a clean room lets every seam carry "an exact basis, a narrow authority ceiling, deterministic replay, and typed failure states" [Maintainer claim, Medium]. Whether the clean room can ever reach the solvers it wraps is the open question §4.7 takes up.

**Adjacent context:** one entry in the solo-maintainer FrankenSuite program. The repo was created 2026-08-31 and pushed daily until 2026-09-04 — a five-day burst that produced the entire assessed tree — then went silent for 18 days [External, High on the dates].

## 4.2 What it is — repo TL;DR

A 30-member Cargo workspace (Cargo.toml verified at the pin [Counted, High]) of safe-Rust reference crates implementing the evidentiary front half of a photogrammetry pipeline: exact-byte media custody (streaming SHA-256, content-addressed object store, root-last publication), bounded ISO BMFF/sample inspection, canonical media timelines, robust clock fitting, fixed-point calibration and scale-witness semantics, deterministic keyframe selection, bounded Hamming correspondence matching with collision-safe tracks, epipolar and relative-pose *adjudication of supplied candidates*, deterministic graph topology, component-local orientation, correlation-aware edge-scale reconciliation, component-relative camera-center initialization, translation-only robust refinement, structural bundle-problem compilation, and a separate image-domain/seed-provenance/held-out audit. The final positive authority the system can grant is `audited_relative_bundle_problem` — an optimizer input, not optimized geometry [Maintainer claim + Code-verified, High]. The geometry crates are organized around `include!`'d `.inc` modules; total first-party code is 57,180 lines across 184 files [Counted, High].

One-line verdict: **the most honest pre-reconstruction codebase in the program — a dependency-closed, unsafe-free evidence substrate that documents exactly what it cannot do, frozen mid-ascent at the hardest seam: the jump from audited bundle problems to actual optimized geometry.** (NODUS: Explore — see §4.9.)

## 4.3 Repo facts (claim inventory)

| # | Claim | Status | Evidence | Tier, Confidence |
|---|-------|--------|----------|------------------|
| 1 | 30 workspace members | demonstrated (docs say 28 — drift) | `Cargo.toml` members list enumerated; README + IMPLEMENTATION_STATUS both say "28-member" | [Counted, High] |
| 2 | ~57,180 first-party lines across 184 `.rs`/`.inc` files | demonstrated | `find crates \( -name '*.rs' -o -name '*.inc' \)`; geometry crates are thin `.rs` shims over `.inc` modules via `include!` | [Counted, High] |
| 3 | Zero unsafe blocks; `#![forbid(unsafe_code)]` in all 88 `.rs` files | demonstrated | `grep -E 'unsafe\s*(\{\|fn\|impl\|trait\|extern)'` → 0 hits; forbid-lint scan | [Counted, High] |
| 4 | Zero third-party dependencies (Cargo.lock = 30 packages, all `fdgr-*`) | demonstrated | `grep '^name = ' Cargo.lock`; no `[dev-dependencies]` externals either | [Counted, High] |
| 5 | 123 `#[test]` functions across the workspace | demonstrated | `grep -rh '#\[test\]'` count at the pin | [Counted, High] |
| 6 | Executable reference chain through bundle-admission audit is publicly invokable via `fdgr-cli` (24 documented commands) | aspirational (invokability asserted, never executed) | README command list (24 `cargo run -p fdgr-cli --` lines counted); `fdgr-cli` = 7,900-line adapter crate depending on 24 sibling crates; 19 `*_cli` modules present. Nothing compiled or executed in this assessment — "publicly invokable" is the project's maturity label, not an observed fact | [Maintainer claim, Medium] |
| 7 | Two-view geometry adjudicates *supplied* candidates only (no five-point/eight-point generation, no native feature extraction) | demonstrated | `fdgr-relative-pose` header: "does not generate pose candidates"; README two-view section; non-claims list | [Code-verified, High] |
| 8 | No triangulation, no bundle adjustment, no metric poses, no dense/sparse reconstruction, no mesh | demonstrated (as a non-claim) | IMPLEMENTATION_STATUS non-claims table + `WP-018` (work package 18, "Pose graph and bundle refinement") open boundary | [Maintainer claim, High] |
| 9 | asupersync is the mandated async runtime | aspirational (zero code presence) | README "Safe-Rust and dependency doctrine" + AGENTS.md rule 8 mandate it; `Cargo.lock` and source contain zero references | [Code-verified, High] |
| 10 | DJI acquisition path exists | aspirational (research only) | DJI_ADAPTER_RESEARCH.md is a "normative plan"; IMPLEMENTATION_STATUS: "Research only; no admitted adapter" | [Maintainer claim, High] |
| 11 | Local qualification is release authority; current head has no retained full receipt | demonstrated (the negative half) | README: "The current exact head has not yet earned a retained full local receipt"; CI run at pin = cancelled | [Maintainer claim + External, High] |
| 12 | Maturity vocabulary enforced (5 labels, no label implies a higher one) | demonstrated (as documentation) | IMPLEMENTATION_STATUS §"Maturity vocabulary" | [Code-verified, High] |
| 13 | 24 public reference commands listed | demonstrated | README command list counted (24 `cargo run -p fdgr-cli --` lines) | [Counted, High] |
| 14 | Single maintainer, no releases, no tags; 31 stars / 3 forks (2026-09-22) | demonstrated | GitHub API; `authors = ["Jeffrey Emanuel"]` | [External, High] |
| 15 | License rider bars OpenAI/Anthropic + affiliates + agents acting for them from use incl. benchmarking/analyzing/training | demonstrated | LICENSE read verbatim at pin | [Code-verified, High] |
| 16 | Three placeholder crates (fdgr-agent, fdgr-lab, fdgr-transfer) exist as README-only contracts, not workspace members | demonstrated | `crates/<name>/README.md` only, each stating "not yet a Cargo workspace member" | [Code-verified, High] |
| 17 | Fixed-point camera math (intrinsics, distortion, rolling shutter) with no float-geometry authority claims | demonstrated (as design) | `fdgr-calibration` (1,352 lines); README fixed-point bullets | [Code-verified, Medium] |
| 18 | Last push 2026-09-04; 18-day silence at assessment | demonstrated | GitHub API `pushed_at` | [External, High] |
| 19 | Work graph: 347 beads, all `open`, zero closed; `WP-018` ("Pose graph and bundle refinement") has registry status `planned` | demonstrated | `.beads/issues.jsonl` status scan at the pin; `registries/work_packages.toml` | [Counted, High] |
| 20 | Differential equivalence (scalar/reference vs. optimized) is a *stated future obligation*, not present practice | demonstrated (as documentation) | QUALIFICATION.md lists "scalar/reference versus optimized differential equivalence" among obligations "an audited input problem cannot close" | [Code-verified, High] |

## 4.4 Codebase tour

**Workspace topology (30 members [Counted, High]):** `fdgr-types`, `fdgr-codec`, `fdgr-graph`, `fdgr-pose-graph`, `fdgr-edge-scale`, `fdgr-global-pose`, `fdgr-pose-refinement`, `fdgr-bundle-problem`, `fdgr-bundle-admission`, `fdgr-clock`, `fdgr-calibration`, `fdgr-projection`, `fdgr-reprojection`, `fdgr-scale`, `fdgr-keyframe`, `fdgr-correspondence`, `fdgr-epipolar`, `fdgr-relative-pose`, `fdgr-evidence`, `fdgr-ledger`, `fdgr-object-store`, `fdgr-media`, `fdgr-media-custody`, `fdgr-media-timeline`, `fdgr-media-worker`, `fdgr-recorded-media`, `fdgr-recorded-media-verify`, `fdgr-source-file`, `fdgr-core`, `fdgr-cli`.

**Structural quirk:** most logic lives in `.inc` files pulled in via `include!` (96 `.inc` files, 30,098 lines vs 88 `.rs` files at 27,082 lines) [Counted, High]. The `.rs` shims hold the crate attributes (`#![forbid(unsafe_code)]`, clippy allows) and module docs; the `.inc` files hold types, implementation, errors, and tests. This is unusual organization — likely a codegen-friendly convention — but it is consistently applied and does not affect the unsafe census or the forbid posture [Inference, Medium].

**Dependency posture:** there is none, externally. Cargo.lock names exactly the 30 workspace members — no tokio, no rayon, no serde, no image/video crates, no numeric crates, no asupersync [Counted, High]. DEPENDENCY_POLICY.md describes a "closed dependency universe," and the lockfile is the strongest possible corroboration: the universe is closed because it contains only the project itself. Consequences: SHA-256, ISO BMFF parsing, and all geometry are hand-rolled; every line is auditable; but the project also re-derives decades of hardened parsing and numerics alone, and there is no independent review of those re-derivations [Inference, Medium].

**Data flow, end to end:**

- **Custody — `fdgr-codec` → `fdgr-types` → `fdgr-object-store` → `fdgr-source-file`/`fdgr-recorded-media`:** streaming SHA-256 with domain separation, deterministic codecs with typed failures, staged writes with object-first/manifest-root-last visibility, collision refusal, readback verification. `fdgr-media` (4,372 lines, largest non-CLI crate [Counted, High]) does bounded ISO BMFF metadata + classic sample-table inspection — metadata only, no compressed-video decode [Maintainer claim, High].
- **Time/scale truth — `fdgr-clock`, `fdgr-calibration`, `fdgr-scale`:** robust correlation-aware affine clock fitting with exact epochs and no extrapolation; fixed-point pinhole intrinsics, Brown-Conrady distortion, rolling-shutter and crop/resize derivation; scale witnesses with explicit relative/estimated/witnessed/surveyed authority — "Estimated scale is not permission to emit meters" [Maintainer claim, High].
- **Two-view — `fdgr-keyframe` → `fdgr-correspondence` → `fdgr-epipolar` → `fdgr-relative-pose`:** deterministic keyframe selection with rejection ledgers; bounded 256-bit Hamming matching with tie/second-best/ratio/mutual/response/uncertainty/dynamic-mask/operation-budget gates and collision-safe tracks (a track component may not contain two observations from one frame); then *adjudication*. The design is visible in code, not just docs: `fdgr-epipolar` (1,954 lines across its `.inc` modules [Counted, High]) exposes `verify_epipolar_candidates(basis, policy, observations, candidates)` — it takes an exact *supplied* `Vec<EssentialCandidate>`, validates basis and policy, canonicalizes both sides, enforces an evaluation budget (`EvaluationBudgetExceeded` past `MAX_EPIPOLAR_EVALUATIONS`), sorts evaluations deterministically by `candidate_id`, and returns an admitted winner or `Ambiguous` when the inlier margin is too thin. Nothing in the chain *generates* candidates — the crate's own header states "does not generate pose candidates" [Code-verified, High].
- **Multi-view — `fdgr-graph` → `fdgr-pose-graph` → `fdgr-edge-scale` → `fdgr-global-pose` → `fdgr-pose-refinement`:** deterministic topology (components, forests, bridges, cycle witnesses — no geometric authority), component-local orientations with rotation-cycle conflict retention, correlation-aware relative baseline-ratio reconciliation, camera-center initialization in one zero-origin arbitrary gauge per component. The gauge unit `component_edge_scale_unit_nano` is a real code-level type/unit string, present in `fdgr-global-pose/src/implementation.inc` and `fdgr-pose-refinement/src/model.inc` — "neither meters nor a cross-component world frame" is enforced in the type vocabulary, not just the prose [Code-verified, High]. `fdgr-pose-refinement`'s largest module is 1,127 lines [Counted, High].
- **Admission — `fdgr-bundle-problem` → `fdgr-bundle-admission`:** the structural compiler authenticates identities and emits block/diagnostic/structural-admit; the admission audit binds exact image domains, enforces optimize-only seed provenance, rejects held-out seed leakage, and recomputes decisions. Positive authority granted: `audited_relative_bundle_problem` only [Maintainer claim, High].
- **CLI — `fdgr-cli` (7,900 lines [Counted, High]):** the adapter layer over 24 sibling crates; 24 documented commands. The CLI is the largest crate — the project has invested more lines in the *invocation surface* than in any geometry core [Inference, Medium].

**Evidence/ledger machinery:** `fdgr-evidence` (1,270 lines) and `fdgr-ledger` (1,022 lines) implement append-only evidence events with deterministic replay and optimistic anchors [Maintainer claim, Medium — read at header level only].

## 4.5 Benchmark and conformance audit

**Maintainer numbers:** none. The repository publishes zero performance claims, zero accuracy numbers, zero reprojection-error figures. What it publishes instead is *populated* normative scaffolding: `registries/slos.toml` (102 lines, 20 SLOs) defines e.g. SLO-002 "Online feedback": "On a qualified workstation profile, p95 source-frame-to-quality/coverage update is under 2 seconds and progress heartbeat under 500 ms" — and `registries/operation_costs.toml` (97 lines), `tests.toml` (178 lines, 44 test families), and `gates.toml` (127 lines, 25 gates with terminal predicates like "no implementation claim exceeds evidence") are all versioned, substantive policy documents [Counted, High]. They are targets and gates, not results: no qualified workstation profile exists, no SLO has a measured receipt, and AGENTS.md's benchmark discipline ("Benchmark with one binary and runtime-selected arms… Retain input roots, source commit, toolchain… and statistical receipt") is specified, never executed [Maintainer claim, High]. The honesty finding stands — but so does the gap: this is the most thoroughly *specified* unmeasured system in the program.

| Source | Numbers | Methodology doc | Verdict |
|---|---|---|---|
| Maintainer | (none published) | `docs/` benchmark discipline specified, not executed | Nothing to audit — unusual honesty, and a gap |
| Independent | (none found) | — | No third-party coverage [External, High within recall caveats] |

**Reproduction cost:** reproducing the *qualification* claim (not a benchmark) requires the pinned `nightly-2026-08-31` toolchain, `./scripts/qualify.sh --mode full`, and a host able to run the deterministic public-path E2Es through bundle admission. The README states the current head "has not yet earned a retained full local receipt in this execution environment," so even the maintainer's own bar is currently unmet at the pin [Maintainer claim, High]. No independent rerun of anything is known [External, High within recall caveats].

**The load-bearing non-number:** the entire thesis rests on *determinism* (stable ordering as contract, seeded/deterministic algorithms, exact replay) — asserted pervasively in docs and code headers but never demonstrated by an executed receipt in any observable venue [Maintainer claim, Medium — the assertions are everywhere; execution evidence is nowhere observable].

## 4.6 Comparison: who owns the lane

The incumbent wins on solvers, scale, and users; FDGR's only uncontested edge is its evidence-governance machinery — which no competitor bothers with because no buyer currently requires it [Inference, Medium].

- **COLMAP (ETH Zurich, BSD):** the research SfM incumbent — incremental SfM with real bundle adjustment, dense MVS, and a decade of papers citing it [External, High on identity]. Owns the "actually reconstructs" lane completely. Has no chain-of-custody, no typed scale authority, no held-out audit [Inference, Medium].
- **OpenDroneMap / WebODM (AGPL/GPL):** the *drone-specific* open incumbent — DJI imagery in, orthomosaics/point clouds/DEMs out, with real users in surveying and disaster response [External, High on identity]. This is the lane FDGR's name claims, and ODM occupies it end to end [Inference, Medium].
- **AliceVision/Meshroom, OpenMVG, OpenSfM:** the other open SfM frameworks; all perform actual optimization and emit real geometry [External, High on identity]. Same verdict as COLMAP relative to FDGR.
- **Commercial — Pix4D, DJI Terra, Agisoft Metashape, RealityCapture:** own the surveying/forensics buyer lane with calibrated workflows, support contracts, and courtroom-familiar outputs [External, High on identity; Inference, Medium on the forensic-familiarity claim].
- **SkyeBrowse (videogrammetry, commercial):** the closest thing to an incumbent in the *forensic-admissibility* sub-lane — drone video in, courtroom-positioned 3D out, with tiered accuracy claims (≤0.25" survey-grade at the premium tier) and agency endorsements [External, Medium — vendor claims]. It validates that buyers pay for admissible drone 3D; it does not provide custody-to-geometry attestation, which is FDGR's claimed wedge [Inference, Medium].
**Why the incumbent wins today, in one paragraph:** OpenDroneMap wins the drone lane because it is a complete pipeline — DJI imagery in, orthomosaics, point clouds, and DEMs out — with real surveying and disaster-response users, GPU-accelerated dense reconstruction, and a community that has already absorbed a decade of calibration, rolling-shutter, and GPS-prior edge cases; COLMAP wins the research lane on solver quality and citations; Pix4D/DJI Terra win the commercial-forensic lane on calibrated workflows, support contracts, and courtroom familiarity. Against all of them FDGR offers no reconstruction at all — only the promise that *when* reconstruction exists, its inputs will be audited. A buyer choosing today buys geometry that exists over attestation that might [Inference, Medium].

- **Unoccupied lane:** a *forensically admissible, deterministic, agent-operable* evidence substrate for drone geometry — typed custody from media bytes, fixed-point math, deterministic replay, held-out independence audits — has no direct occupant. COLMAP et al. optimize; none of them attest [Inference, Medium]. Whether any buyer (or court) will pay for attestation over geometry is the unproven bet the project rests on.

## 4.7 Technical merit and adversarial review

**Strengths:**

1. **The honesty machinery is best-in-class for the FrankenSuite among packets assessed so far [Inference, Medium].** A five-label maturity vocabulary with "no lower label implies a higher one," an 18-item non-claims list, README sections titled "What FDGR does not yet claim," and the explicit statement that the head has no retained qualification receipt [Code-verified, High on the documented facts]. The project cannot be accused of overselling because it pre-emptively convicts itself [Inference, Medium].
2. **The dependency closure is total and verified.** Zero third-party crates in the lockfile — the `#![forbid(unsafe_code)]` posture is therefore checkable by reading one author's code, and the supply-chain attack surface is the empty set. No sibling repo achieves this [Counted, High].
3. **The authority-ladder design is a real intellectual contribution.** The insistence that *graph ≠ orientation ≠ scale gauge ≠ centers ≠ refined centers ≠ bundle-adjusted trajectory ≠ metric pose* — with a distinct named unit (`component_edge_scale_unit_nano`) that is neither meters nor a world frame — is exactly the kind of typed epistemic discipline that agent-operated pipelines need and that no incumbent provides [Inference, Medium].
4. **Adjudication-before-generation is a defensible inversion.** By building the *verifiers* (epipolar proposal adjudication, relative-pose candidate verification, bundle-admission audit) before any *generators*, the project front-loads the acceptance criteria. If the generators ever land, they land into pre-built gates [Inference, Medium].

**Weaknesses:**

1. **[FATAL] The core thesis is untested because the geometry half does not exist.** Everything downstream of `audited_relative_bundle_problem` — the optimizer, triangulation, dense reconstruction, metric poses, any mesh or map — is `WP-018` open scope. A substrate whose value proposition is "evidence-grade geometry" that has never produced geometry is a hypothesis with scaffolding, not a system [Inference, High].
2. **[FATAL] Velocity stopped 2026-09-04.** Five days of furious construction (repo created 2026-08-31), then 18 days of silence, no release, no tag, `WP-018` open, CI cancelled. The FrankenSuite pattern is bursts followed by abandonment; the dates fit the pattern exactly [External, High on the dates; the pattern reading is Inference, Medium].
3. **[HIGH] Nothing has ever been shown green.** The sole CI workflow is a self-hosted "local-qualification-contract"; all 324 observed runs are cancelled (no qualified runner), including the run at the pin. The maintainer is honest about this ("has not yet earned a retained full local receipt"), but honesty about never having run the qualifier is not qualification [External + Maintainer claim, High].
4. **[MEDIUM] The docs drift on the project's own auditability pitch.** "28-member" in README and IMPLEMENTATION_STATUS vs. 30 members in `Cargo.toml` (plus 3 README-only placeholder crates in `crates/`). For a project whose differentiator is exact evidence, the member count is the one number the docs should not get wrong [Counted, High].
5. **[MEDIUM] The asupersync doctrine is fiction at the pin.** Mandated as "the sole admitted in-process async runtime" by README and AGENTS.md; zero occurrences in code, manifests, or lockfile. The worker-execution future the doctrine governs is also unimplemented (media-worker does plans, not process spawn) [Code-verified, High].
6. **[MEDIUM] The hand-rolled everything is unaudited.** SHA-256, ISO BMFF parsing, fixed-point geometry, Hamming matching — all re-derived alone, with no independent review. "Fuzz" appears only in plan/research docs, never in executable code or CI; differential equivalence is explicitly listed in QUALIFICATION.md as a *future obligation* the audited input "cannot close." The dependency closure buys auditability in principle; in practice the audit has one reader (the author) and no adversarial test machinery [Code-verified, High on the doc/code scan; the last clause is Inference, Medium].
7. **[HIGH] The adjudicators have never met a real candidate.** The celebrated verifiers — `verify_epipolar_candidates`, the relative-pose adjudicator, the bundle-admission audit — have only ever run against synthetic fixtures in the repo's own test modules. No five-point solver exists to feed them, no real DJI footage has passed through them, and no essential matrix estimated from actual images has ever been admitted or rejected. Verifiers without generators cannot be validated either: the `Ambiguous` branch, the inlier-margin thresholds, the budget gates are all tuned against invented inputs. The packet's strength 4 ("adjudication-before-generation") therefore has an unacknowledged mirror — generation-before-adjudication is how every verifier in history got its thresholds [Inference, Medium].

**Bear-case steelman:** FDGR is a five-day burst of world-building that mistook scaffolding for a system. It has 31 stars, zero releases, a CI pipeline that has never executed, and a geometry pipeline that adjudicates candidates nobody generates — the five-point solver, the feature extractor, and the optimizer are all somebody else's future work. The "evidence-grade" pitch is aimed at forensic and surveying buyers who currently buy Pix4D and DJI Terra, neither of which will ever adopt a dependency-closed Rust audit harness that cannot emit a single metric pose. The most likely end state is abandonment at the 2026-09-04 commit, leaving 57k lines of beautifully scoped, never-executed reference code whose license forbids the AI labs most likely to mine it for ideas from even analyzing it. The rational response is to extract the maturity vocabulary and the admission-audit pattern and let the repo freeze [Inference, Medium — deliberately uncharitable; the counter-evidence is that the scaffolding is unusually well-designed for a five-day burst, which cuts both ways].

## 4.8 License and governance

**License text (verbatim, pin):** "MIT License (with OpenAI/Anthropic Rider)", copyright 2026 Jeffrey Emanuel. The rider defines "Restricted Parties" as "OpenAI, L.L.C.; Anthropic, PBC; any of their respective Affiliates; and any person or entity acting directly or indirectly on behalf of, for the benefit of, or under the direction of any of the foregoing (including any officer, director, employee, contractor, agent, consultant, service provider, or representative)." It grants *no rights* to any Restricted Party — "Any purported license, sublicense, assignment, transfer, or other permission to any Restricted Party is null and void absent the express prior written permission of Jeffrey Emanuel" — and forbids providing or making available the Software or Derivative Works to or for any Restricted Party. "Use" is defined to include "copying, modifying, merging, publishing, distributing, sublicensing, selling, transferring, making available, hosting, deploying, executing, benchmarking, testing, analyzing, indexing, or incorporating the Software or any Derivative Works into any dataset, training corpus, evaluation harness, or pipeline for machine learning or other automated systems." Breach "automatically and immediately terminates" the license; the rider "controls" in any conflict and must be included "unmodified" in distributions [Code-verified (license text), High].

**OSI status: non-OSI.** The rider discriminates against named persons/groups (violating OSD §5) and against fields of endeavor (benchmarking/analysis/training restrictions, OSD §6). This is not an open-source license by the Open Source Definition, whatever the "MIT" prefix suggests. The README badge reads "License: MIT+Rider" and links the LICENSE — disclosed, not concealed [Code-verified, High].

**As strategy:** the rider excludes exactly the actors most likely to (a) evaluate the code at scale, (b) integrate it into agent pipelines, and (c) fund or fork it. For a project whose stated user is "an agent [that] helps decide what to observe," barring the two leading agent builders from even *analyzing* the code is self-sabotage of the mission [Inference, Medium]. Note the assessment irony the Rulebook demands be recorded: this packet's analysis of the code is itself within the rider's "analyzing" definition — the packet exists under the analyst's non-restricted-party status, not under a license grant that covers everyone [Inference, High].

**Governance:** bus factor 1 (sole author Jeffrey Emanuel; 31 stars, 3 forks, 0 open issues, no second committer, no foundation) [External, High]. The bead work graph tells the same story in machine-readable form: 347 beads, every one `open`, zero closed at the pin — the project tracks 347 units of planned work and has marked none of them done [Counted, High]. `WP-018` ("Pose graph and bundle refinement," the work package covering the missing geometry half) carries registry status `planned` [Code-verified, High]. Commit velocity: the entire tree was built 2026-08-31 → 2026-09-04, then zero pushes for 18 days [External, High]. A `SECURITY.md` threat model exists (six trust domains, capability classes, "security and privacy are architectural correctness properties") — as design documentation, unaudited and unexercised [Code-verified, High]. If the maintainer stops, the project freezes at the pin — there is no release artifact to fork from, only the tree [Inference, High].

## 4.9 NODUS factsheet

| Criterion | Scale | Score + one-line justification |
|---|---|---|
| Technology readiness | TRL 1–9 | **3** — analytical/experimental proof of concept: reference algorithms exist as code but no executed qualification receipt, no independent run, no geometry ever produced [Inference, Medium] |
| Strategic relevance | 1–5 | **3** — forensic/admissible drone evidence is a real emerging need, and the agent-era typed-epistemics angle is well-aimed [Inference, Medium] |
| Impact potential | 1–5 | **2** — capped by the rider (excludes the likeliest adopters/evaluators) and by the missing geometry half [Inference, Medium] |
| Implementation feasibility | 1–5 | **4** — the front half demonstrably got built in five days; the back half (solvers, optimization) is standard textbook material, not research [Inference, Medium] |
| Time to mainstream | 1–5 (higher = sooner) | **2** — the project is pre-geometry with an 18-day velocity stop, so mainstream is distant even in the upside case [Inference, Low] |
| Collaboration potential | 1–5 | **2** — single maintainer, no governance path, rider poisons institutional/AI-lab collaboration [Inference, Medium] |

**Ring: Explore** [Inference, Medium]. Substantive-but-unproven is the textbook Explore case per the Rulebook. Not Monitor (this is far past plan-stage: 57k lines of real reference code), not Pilot (no release artifact, no bounded real workload demonstrated — nothing has ever executed observably). The rider is an advancement blocker, not a ring qualifier.

## 4.10 Wardley placement

- **Commodity surface (industrialized):** media containers (ISO BMFF), SHA-256 hashing, content-addressed storage, TSV/JSON machine interfaces — the project *re-derives* these by hand rather than consuming them. That is an anti-Wardley move (rebuilding commodities instead of consuming them), paid deliberately for auditability: every byte the binary can reach is one author's safe Rust. The cost is that the project re-assumes all the edge-case risk the commodity implementations already absorbed [Inference, Medium].
- **Custom-built reimplementation (product stage):** the evidence custody chain, fixed-point camera math, deterministic keyframe/correspondence gates, pose-graph machinery, bundle-problem compiler and admission audit — built, documented, never observably executed [Inference, Medium].
- **Genesis-stage novel elements:** the maturity vocabulary as executable doctrine, the `audited_relative_bundle_problem` admission split (structural vs. seed-provenance generations), typed scale authority (`component_edge_scale_unit_nano`) — genuinely novel governance primitives with no incumbent equivalent [Inference, Medium].
- **What would move each:** the commodity re-derivations move toward "consumed" if the project ever admits dependencies; the reimplementation moves toward product with the first retained qualification receipt; the genesis elements move toward product if an external pipeline (ODM/COLMAP wrapper) adopts the admission audit and publishes rejection counts.

**The decoupling lens (Rulebook §6):** FDGR represents the decoupling of *attestation from computation* — the evidence/custody/audit substrate separated from the solvers that produce geometry. Every incumbent couples them: COLMAP's output is trusted because COLMAP is trusted; there is no independent artifact saying which bytes supported which point. FDGR's bet is that attestation becomes its own layer with its own authority ladder (the `audited_relative_bundle_problem` is meaningful even though no FDGR code can optimize it), and that agents — which cannot inspect a solver's internals — will need exactly such a layer. Whether attestation-without-computation is a viable standalone layer, or whether (as in every prior system) the audit must live inside the solver to be trusted, is the project's load-bearing architectural gamble [Inference, Medium].

## 4.11 Trajectory (12 / 24 / 60 months) **[Inference]**

**12 months:** the tree is either still frozen at the pin (the base case — the 18-day silence extends, the nightly ages, attention moves on) or the maintainer returns for a second burst. The discriminating observable is any push: a return burst most plausibly targets the generator gap (five-point/eight-point candidates feeding the existing adjudicators) or the first retained `qualify.sh --mode full` receipt.

**24 months:** bifurcation. *Upside:* the geometry half lands behind the admission gate — a reference bundle adjuster, then triangulation — and FDGR becomes the only deterministic, custody-chained SfM reference in the open, opening the forensic lane (this requires the maintainer's return plus either a license softening or a non-AI-lab adopter such as a surveying/forensics shop). *Decay:* bit-rot — `nightly-2026-08-31` is two years stale, the self-hosted runner never materialized, and the repo is a well-documented fossil that other packets mine for methodology.

**60 months:** in the upside case, either absorption (an ODM/COLMAP-class project adopts the admission-audit pattern, collapsing the unoccupied lane) or a durable niche as the reference implementation behind forensic drone-evidence standards work. In the base case, the tree is archaeology — but the maturity vocabulary and the `audited_relative_bundle_problem` split survive as exported process, which is the methodology-export lens's predicted outcome.

**Revisit triggers:** (1) any push after 2026-09-04; (2) a retained full local-qualification receipt published; (3) `WP-018` closed or narrowed; (4) asupersync actually admitted as a dependency; (5) an independent party wraps ODM/COLMAP with the admission audit and publishes rejection counts; (6) any release tag.

## 4.12 Limitations and open questions

**Not done:** never compiled the workspace (pinned nightly not fetched); never executed any test, CLI command, or E2E; never processed fixture media; never reproduced any number (there are none to reproduce); never ran `scripts/qualify.sh`; never inspected the self-hosted runner's existence; CI conclusions come from the Actions API only (status/cancelled), not from log reads; line counts include comments/blanks and `.inc` test modules; commit-history analysis was impossible (shallow clone) — the "28 vs 30 members" drift cannot be dated to a specific crate addition. *Cold-reader glossary: `WP-018` = work package 18 ("Pose graph and bundle refinement"), the registry unit covering the unimplemented optimization half; a "bead" is the repo's issue-tracker unit.*

**Open questions that would most change the verdict:**
1. Does `cargo test` pass at the pin on the pinned toolchain? (123 test fns exist; greenness is unknown and unobservable.)
2. Is the 18-day silence a pause or abandonment? A single push would change the trajectory section.
3. Would the maintainer soften the rider for evaluation/analysis use? That single change would unlock the likeliest adopters.
4. Can the admission audit actually reject real pipeline outputs? (Next step 2 is the experiment.)
5. Who is the second committer, and does one exist? Bus factor is currently 1 by all observable evidence.

---

## The eight deepening questions

1. **Provenance.** Every artifact carries domain-separated SHA-256 identities, object-first/manifest-root-last publication, append-only evidence events with deterministic replay, and typed custody receipts from original media bytes through the admission audit — the provenance chain is the project's central artifact [Maintainer claim, High]. Making it portable would require serializing the evidence events and identities into a self-describing, signed envelope (e.g., a DSSE-style wrapper over the existing digest domains) that a third party could verify without the FDGR toolchain; the registries and `fdgr-ledger` already define the vocabulary, but no export format or signature scheme is implemented, so portability is designed-for, not delivered [second half Inference, Medium].
2. **The embeddable unit.** The smallest useful piece is `fdgr-bundle-admission` (+ its `fdgr-types`/`fdgr-codec` base): the held-out seed-provenance audit as a gate in front of any existing optimizer. Adoption cost is the TSV/schema translation layer — the bundle-problem and admission inputs are versioned schemas (`fdgr.bundle_problem/1`, `fdgr.bundle_admission/1`) consumed as bounded TSV tables (`nodes.tsv`, `pose-edges.tsv`, `camera-bindings.tsv`, `landmark-seeds.tsv`, `bundle-observations.tsv`, `camera-domains.tsv`, `seed-provenance.tsv`), so a COLMAP/ODM adapter is a format bridge emitting those seven tables, not a rewrite [Inference, Medium]. This is next step 2's experiment.
3. **Unexercised option value.** The architecture holds: deterministic replay + content addressing (a verifiable build/cache substrate), the four-ledger/agent-operating-model schemas (an agent control plane awaiting `fdgr-agent`, currently a README-only placeholder), the media-worker plan/receipt protocol (process execution is the unimplemented unlock), and the registry system (`slos.toml`, `operation_costs.toml`, `gates.toml`) as a machine-readable policy engine. What unlocks them is, respectively: a retained qualification receipt, the agent crate's implementation, asupersync-backed worker spawning, and a second adopter writing policies [Inference, Medium].
4. **Benchmark honesty.** There are no numbers to audit — the maintainer publishes zero performance or accuracy claims, which is itself the honesty finding. The load-bearing assertion is *determinism* (stable ordering, fixed-point math, exact replay), and it would survive an independent rerun only if the qualifier ever runs observably; until then it is a documented design property, not a result [Maintainer claim, Medium].
5. **The governance path.** There is no credible route from one maintainer to an institution visible in the tree: no foundation, no second committer, no release artifact, no adopters, an 18-day-old velocity stop, and a license rider that bars the institutions most likely to institutionalize it. What breaks first if velocity decays is already broken — velocity *has* decayed to zero, and the project's survival now depends entirely on the maintainer's return [Inference, Medium].
6. **The license as strategy.** The rider excludes OpenAI, Anthropic, their affiliates, and anyone acting for them from use, benchmarking, testing, analyzing, indexing, and training-data incorporation, with automatic termination on breach [Code-verified, High]. For a mission framed around *agents* operating drone-evidence pipelines, excluding the two leading agent builders sabotages the stated mission — it selects for adopters who are simultaneously the least equipped to evaluate or extend the work. The exclusion serves only a defensive IP posture, and a weak one: ideas are not copyrightable, so the rider taxes adoption without buying protection [Inference, Medium].
7. **Agent-era fit.** The concrete workload is a forensic or surveying agent that must refuse to emit metric claims it cannot support: FDGR's typed scale authority (`relative`/`estimated`/`witnessed`/`surveyed`, with "estimated scale is not permission to emit meters" as a documented invariant) and admission gates are exactly the guardrails such an agent needs, and no incumbent (COLMAP, ODM, Pix4D, SkyeBrowse) provides them. What has to become true first: the geometry half must exist (an agent cannot use an audit harness with no pipeline behind it), and the agent's builder must not be a Restricted Party — which, today, rules out the two most likely builders [Inference, Medium].
8. **The kill test.** Run the next-step-2 experiment: wrap COLMAP's or OpenDroneMap's outputs in `fdgr.bundle_problem/1` + `fdgr.bundle_admission/1` on a real DJI dataset. If the audit admits everything (no seed leakage, no domain violations ever found in the wild), the admission machinery is ceremony and the project's central novel artifact has no bite. Conversely, if it rejects real outputs at a meaningful rate, the thesis survives its first contact with reality. A competitor move that also kills it: COLMAP or ODM shipping a provenance/custody mode — unlikely, but it would collapse the unoccupied lane [Inference, Medium].