Source: docs/superpowers/specs/2026-08-12-v7-mapanything-certified-observation-design.md · Plain text

V7 MapAnything-Certified Observation Audit Design

Decision and scope

V7 replaces only the sealed LoFTR observation inlet. It preserves the project backbone:

context RGB + calibrated OpenCV cameras
-> target-independent typed metric state
-> fixed zero-parameter measurement program
-> RGB / depth / normal / point / visibility / risk

The candidate inlet is:

context RGB + known intrinsics/cam2world
-> frozen MapAnything metric posed-MVS inference
-> project-owned known-camera consistency certification
-> conditional free/surface/unknown/conflict/provenance/risk observations

This stage is a supplier qualification audit only. It does not modify the production typed state, completion network, training loop, renderer, V5/V6 results, diagnostic-test partition, or final holdout. Training remains blocked unless every frozen audit gate passes.

Claim boundary

MapAnything, metric depth prediction, camera-conditioned MVS, reprojection, depth consistency, free-space intervals, occupancy semantics, and confidence are not project contributions. The supplier is an external frozen prior. A successful audit would establish only that it is a viable source of observations for a later project-owned write-protection experiment.

The provisional paper contribution remains the combined contract: an external predictor may propose geometry; known-camera checks decide write authority; certified geometry is immutable; completion may write only unknown regions; one fixed renderer reads all measurements. This audit cannot establish that contribution or CVPR readiness by itself.

Frozen supplier identity

MapAnything's pinned _from_pretrained path forces the UniCeption DINOv2 encoder to use torch_hub_pretrained=False. DINOv2 therefore supplies architecture code only: there is no separate DINOv2 checkpoint in this audit, and all encoder parameters are restored from the pinned MapAnything model.safetensors (SHA-256 981f060c64664dff3272b5f5a823d350abe71a2f144444db4cfc325f3ed5a3a0). The adapter verifies a clean local DINOv2 checkout at the frozen revision and source hash, reroutes UniCeption's hard-coded hub call to that local checkout, and rejects remote hub repositories, independent DINOv2 pretrained weights, and URL weight downloads while the model is constructed.

Frame IDs are sorted canonically before inference. Model-predicted camera poses, intrinsics, and world points are ignored. The project reconstructs world points from depth_along_ray and the known cameras passed through the official preprocessing path.

Atomic cache and label isolation

Each frozen window produces two structured, overwrite-refusing caches:

  1. supplier cache: JSON metadata plus NPZ arrays for depth, raw confidence, mask, processed known intrinsics, and known cam2world;
  2. certificate cache: JSON metadata plus NPZ arrays for typed intervals, support/conflict counts, provenance, risk, and certified masks.

Both are built in a temporary sibling directory, hashed, and atomically renamed. Metadata records the model and code revisions, frame IDs, input RGB/camera hashes, exact inference configuration, array schema, and artifact hash. Pickle is forbidden. Existing cache destinations are never overwritten.

Only after both caches are sealed may the evaluator open context depth. Access timestamps and paths are recorded. The evaluator has no path back into supplier inference or certification.

Known-camera certification

For every sampled source ray, the project reconstructs a world point from predicted along-ray depth. It projects that point into each other known camera and samples the other predicted depth. A target view supports the source observation only when all of these frozen conditions hold:

If the target prediction is materially nearer, it is recorded as an occlusion. Other inconsistent visible predictions are conflicts. Certification requires at least one supporting view and zero conflicting views. Samples are evaluated on a fixed four-pixel grid. These values are frozen before context depth is opened and are not tuned after audit results are known.

Every certified sample carries:

This is a conditional ray certificate, not direct free-space measurement. Its validity depends on the supplier prediction, known camera calibration, visibility assumptions, and frozen consistency checks.

Frozen windows and endpoints

The audit reuses the exact 32 scene-balanced, seed-17 Hypersim development-train windows in outputs/geometry_certificate_audit_v1/frozen_windows.json. Diagnostic-test and the 26-scene final holdout are forbidden. Four context views are used. No favorable-window reselection is allowed.

Primary endpoints are macro certified grid coverage, nonzero-scene fraction, and source-ray 3D error against context depth opened after sealing. Supporting endpoints are raw-valid coverage, support/conflict/occlusion distributions, same-coverage raw-confidence error, risk-error Spearman correlation, camera/correspondence shuffles, and canonical view-order invariance.

Frozen decision rule

The branch receives GO_TO_STATE_INTEGRATION only if all gates pass:

Missing endpoints yield INCONCLUSIVE. Any completed failed gate yields STOP_MAPANYTHING_SUPPLIER. A STOP cannot be rescued by threshold adjustment, scene selection, longer training, or a stronger completion model. A different supplier or threshold set is a new pre-registered branch.

Provenance and limitations

The final report must include code/model hashes, model-card license, disk usage, GPU/runtime, pretraining-data disclosure available from the official paper/model card, every accessed label path, and artifact hashes. The official repository does not list Hypersim among its 13 training dataset integrations, but absence of direct overlap is not claimed without a complete training data audit. Formal Research Institute and Evaluation Council status must be reported honestly.