devagent-physical-engine 0.12.2__tar.gz → 0.12.3__tar.gz

{devagent_physical_engine-0.12.2/src/devagent_physical_engine.egg-info → devagent_physical_engine-0.12.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devagent-physical-engine
-Version: 0.12.2
+Version: 0.12.3
 Summary: Verification-first agentic engineering, simulation, and evidence runtime for robotics and industrial automation.
 Author: Tom Ha
 License: All Rights Reserved
@@ -193,6 +193,8 @@ v0.12.1 hardens the initial ROS joint-state snapshot by parsing `ros2 topic echo
 
 v0.12.2 additionally hardens Gazebo model-pose read-back across Harmonic CLI renderings. One shared parser now accepts both pipe-delimited and whitespace-delimited finite XYZ/RPY vectors and is used by initial world verification and dynamic workpiece pose read-back, so task simulation does not depend on a single human-readable `gz model --pose` delimiter style.
 
+v0.12.3 hardens MoveIt PlanningScene read-back when MoveIt serializes world collision objects in its own planning/root frame. A different observed frame is never trusted by label alone: DevAgent first proves the observed frame and canonical Twin frame are identity-equivalent through TF, then re-reads the scene and canonicalizes it back to the Twin planning frame before enforcing the exact geometry hash. Non-identity frames and geometry drift remain fail-closed.
+
 The packaged reference workcell is **not customer-site geometry**. Arbitrary plant layouts require an imported or user-declared physical Twin with trusted poses, collision geometry, tool/TCP information, and workpiece properties. DevAgent does not invent those site facts from a natural-language prompt.
 
 The v0.12 implementation remains evidence-gated: source/CI success does not prove the ROS target campaign has passed on a particular workstation. Use the executable qualification below before treating the task-specific path as qualified on that target.
@@ -420,7 +422,7 @@ Detailed engineering documentation lives in the repository:
 
 ## Project status
 
-**v0.12.2 — Beta software / evidence-gated task-specific physical simulation.**
+**v0.12.3 — Beta software / evidence-gated task-specific physical simulation.**
 
 The software and release pipeline are production-oriented, but physical readiness is scope-specific and evidence-driven. The UR5e task-specific reference-workcell path must pass the executable v0.12 ROS/Gazebo/MoveIt campaign on the target workstation before that scope is considered simulation-qualified there. Real robot execution remains locked. Functional-safety certification and site qualification are not claimed.
 

{devagent_physical_engine-0.12.2 → devagent_physical_engine-0.12.3}/README.md

@@ -152,6 +152,8 @@ v0.12.1 hardens the initial ROS joint-state snapshot by parsing `ros2 topic echo
 
 v0.12.2 additionally hardens Gazebo model-pose read-back across Harmonic CLI renderings. One shared parser now accepts both pipe-delimited and whitespace-delimited finite XYZ/RPY vectors and is used by initial world verification and dynamic workpiece pose read-back, so task simulation does not depend on a single human-readable `gz model --pose` delimiter style.
 
+v0.12.3 hardens MoveIt PlanningScene read-back when MoveIt serializes world collision objects in its own planning/root frame. A different observed frame is never trusted by label alone: DevAgent first proves the observed frame and canonical Twin frame are identity-equivalent through TF, then re-reads the scene and canonicalizes it back to the Twin planning frame before enforcing the exact geometry hash. Non-identity frames and geometry drift remain fail-closed.
+
 The packaged reference workcell is **not customer-site geometry**. Arbitrary plant layouts require an imported or user-declared physical Twin with trusted poses, collision geometry, tool/TCP information, and workpiece properties. DevAgent does not invent those site facts from a natural-language prompt.
 
 The v0.12 implementation remains evidence-gated: source/CI success does not prove the ROS target campaign has passed on a particular workstation. Use the executable qualification below before treating the task-specific path as qualified on that target.
@@ -379,7 +381,7 @@ Detailed engineering documentation lives in the repository:
 
 ## Project status
 
-**v0.12.2 — Beta software / evidence-gated task-specific physical simulation.**
+**v0.12.3 — Beta software / evidence-gated task-specific physical simulation.**
 
 The software and release pipeline are production-oriented, but physical readiness is scope-specific and evidence-driven. The UR5e task-specific reference-workcell path must pass the executable v0.12 ROS/Gazebo/MoveIt campaign on the target workstation before that scope is considered simulation-qualified there. Real robot execution remains locked. Functional-safety certification and site qualification are not claimed.
 

{devagent_physical_engine-0.12.2 → devagent_physical_engine-0.12.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "devagent-physical-engine"
-version = "0.12.2"
+version = "0.12.3"
 description = "Verification-first agentic engineering, simulation, and evidence runtime for robotics and industrial automation."
 readme = { file = "README.md", content-type = "text/markdown" }
 requires-python = ">=3.11"

{devagent_physical_engine-0.12.2 → devagent_physical_engine-0.12.3}/src/devagent_physical_engine/__init__.py

@@ -41,4 +41,4 @@ __all__ = [
     "TwinValidator",
 ]
 
-__version__ = "0.12.2"
+__version__ = "0.12.3"

{devagent_physical_engine-0.12.2 → devagent_physical_engine-0.12.3}/src/devagent_physical_engine/ros2/moveit_scene.py

@@ -2,12 +2,14 @@ from __future__ import annotations
 
 from dataclasses import asdict, dataclass
 import json
+from math import isfinite
 from pathlib import Path
 from typing import Any
 
 from ..simulation_platform import SimulationPlatformError
 from ..twin_materialization import CanonicalTwinMaterialization
 from .commands import RosCommandRunner
+from .frame_alignment import FrameAlignmentReceipt, FrameAlignmentVerifier
 
 
 @dataclass(frozen=True, slots=True)
@@ -21,6 +23,8 @@ class MoveItSceneReceipt:
     planning_frame: str
     expected_object_count: int
     observed_object_count: int | None
+    observed_planning_frames: tuple[str, ...] = ()
+    equivalent_planning_frames: tuple[str, ...] = ()
 
     def __post_init__(self) -> None:
         if not self.code.strip():
@@ -37,11 +41,44 @@ class MoveItSceneReceipt:
             raise ValueError("moveit_scene_receipt_object_count_invalid")
         if self.observed_object_count is not None and self.observed_object_count < 0:
             raise ValueError("moveit_scene_receipt_object_count_invalid")
+        if any(not value.strip() for value in self.observed_planning_frames):
+            raise ValueError("moveit_scene_receipt_observed_frame_invalid")
+        if any(not value.strip() for value in self.equivalent_planning_frames):
+            raise ValueError("moveit_scene_receipt_equivalent_frame_invalid")
 
     def to_dict(self) -> dict[str, Any]:
         return asdict(self)
 
 
+def _equivalent_frames_from_receipt(
+    planning_frame: str,
+    frame_alignment: FrameAlignmentReceipt | None,
+) -> tuple[str, ...]:
+    """Return only frames already proven identity-equivalent to the canonical frame."""
+
+    if frame_alignment is None:
+        return ()
+    if (
+        not frame_alignment.verified
+        or not isfinite(frame_alignment.translation_error_m)
+        or not isfinite(frame_alignment.rotation_error_rad)
+        or frame_alignment.translation_error_m < 0.0
+        or frame_alignment.rotation_error_rad < 0.0
+    ):
+        raise SimulationPlatformError("moveit_scene_frame_receipt_invalid")
+
+    parent = frame_alignment.parent_frame.strip()
+    child = frame_alignment.child_frame.strip()
+    expected = planning_frame.strip()
+    if not parent or not child or not expected:
+        raise SimulationPlatformError("moveit_scene_frame_receipt_invalid")
+    if child == expected:
+        return () if parent == expected else (parent,)
+    if parent == expected:
+        return () if child == expected else (child,)
+    raise SimulationPlatformError("moveit_scene_frame_receipt_unbound")
+
+
 class MoveItSceneBridge:
     """Apply canonical Twin collision geometry to MoveIt and read it back."""
 
@@ -58,15 +95,19 @@ class MoveItSceneBridge:
         self.work_dir = Path(work_dir).expanduser().resolve()
         self.timeout_s = float(timeout_s)
 
-    def apply_and_verify(
-        self, materialization: CanonicalTwinMaterialization
-    ) -> MoveItSceneReceipt:
-        self.work_dir.mkdir(parents=True, exist_ok=True)
+    def _run_probe(
+        self,
+        *,
+        materialization: CanonicalTwinMaterialization,
+        equivalent_frames: tuple[str, ...],
+    ) -> tuple[dict[str, Any], bool]:
+        payload = materialization.moveit_scene_payload()
+        payload["equivalent_planning_frames"] = list(equivalent_frames)
         payload_path = self.work_dir / f"{materialization.fingerprint}.moveit-scene.json"
         temporary = payload_path.with_suffix(payload_path.suffix + ".tmp")
         temporary.write_text(
             json.dumps(
-                materialization.moveit_scene_payload(),
+                payload,
                 sort_keys=True,
                 separators=(",", ":"),
                 allow_nan=False,
@@ -93,8 +134,73 @@ class MoveItSceneBridge:
             raise SimulationPlatformError("moveit_scene_probe_output_invalid") from exc
         if not isinstance(output, dict):
             raise SimulationPlatformError("moveit_scene_probe_output_invalid")
+        return output, result.ok
+
+    def apply_and_verify(
+        self,
+        materialization: CanonicalTwinMaterialization,
+        *,
+        frame_alignment: FrameAlignmentReceipt | None = None,
+    ) -> MoveItSceneReceipt:
+        self.work_dir.mkdir(parents=True, exist_ok=True)
+        equivalent_frames = _equivalent_frames_from_receipt(
+            materialization.planning_frame,
+            frame_alignment,
+        )
+        output, command_ok = self._run_probe(
+            materialization=materialization,
+            equivalent_frames=equivalent_frames,
+        )
         code = str(output.get("code") or "moveit_scene_probe_failed")
-        verified = bool(output.get("success")) and result.ok
+
+        # MoveIt serializes world collision objects in its own planning/root frame.
+        # If that label differs from the canonical Twin frame, do not trust it by
+        # convention.  Prove the observed frame is identity-equivalent via TF, then
+        # repeat the read-back with that exact frame admitted for canonical hashing.
+        if (
+            frame_alignment is None
+            and not equivalent_frames
+            and not bool(output.get("success"))
+            and code.startswith("scene_planning_frame_mismatch:")
+        ):
+            observed_frames = tuple(
+                sorted(
+                    {
+                        str(value).strip()
+                        for value in output.get("observed_planning_frames") or ()
+                        if str(value).strip()
+                    }
+                )
+            )
+            if len(observed_frames) != 1:
+                raise SimulationPlatformError(
+                    "moveit_scene_observed_frame_ambiguous"
+                )
+            observed_frame = observed_frames[0]
+            receipt = FrameAlignmentVerifier(self.runner).verify_identity(
+                parent_frame=observed_frame,
+                child_frame=materialization.planning_frame,
+            )
+            equivalent_frames = _equivalent_frames_from_receipt(
+                materialization.planning_frame,
+                receipt,
+            )
+            output, command_ok = self._run_probe(
+                materialization=materialization,
+                equivalent_frames=equivalent_frames,
+            )
+            code = str(output.get("code") or "moveit_scene_probe_failed")
+
+        verified = bool(output.get("success")) and command_ok
+        observed_frames = tuple(
+            sorted(
+                {
+                    str(value).strip()
+                    for value in output.get("observed_planning_frames") or ()
+                    if str(value).strip()
+                }
+            )
+        )
         receipt = MoveItSceneReceipt(
             verified=verified,
             code=code,
@@ -113,6 +219,8 @@ class MoveItSceneBridge:
                 if output.get("observed_object_count") is not None
                 else None
             ),
+            observed_planning_frames=observed_frames,
+            equivalent_planning_frames=equivalent_frames,
         )
         if not receipt.verified:
             raise SimulationPlatformError(f"moveit_scene_verification_failed:{receipt.code}")

{devagent_physical_engine-0.12.2 → devagent_physical_engine-0.12.3}/src/devagent_physical_engine/ros2/scene_probe.py

@@ -35,6 +35,71 @@ def _canonical_scene(planning_frame: str, objects: list[dict[str, Any]]) -> dict
     }
 
 
+def _verify_observed_scene(
+    *,
+    planning_frame: str,
+    expected_hash: str,
+    expected_objects: list[dict[str, Any]],
+    observed_objects: list[dict[str, Any]],
+    equivalent_planning_frames: tuple[str, ...] = (),
+) -> dict[str, Any]:
+    """Verify read-back without confusing an identity-equivalent frame label for drift.
+
+    ``equivalent_planning_frames`` is not discovered here.  It must be supplied by the
+    caller from an independently verified identity transform receipt.  Geometry is
+    always canonicalized back to ``planning_frame`` before hashing.
+    """
+
+    planning_frame = planning_frame.strip()
+    if not planning_frame:
+        raise ValueError("scene_planning_frame_required")
+    equivalent = tuple(value.strip() for value in equivalent_planning_frames)
+    if any(not value for value in equivalent):
+        raise ValueError("scene_equivalent_planning_frame_invalid")
+    accepted_frames = {planning_frame, *equivalent}
+    expected_ids = {str(item["id"]) for item in expected_objects}
+    relevant = [item for item in observed_objects if str(item["id"]) in expected_ids]
+    observed_frames = sorted({str(item.get("frame_id") or "").strip() for item in relevant})
+
+    for item in relevant:
+        frame_id = str(item.get("frame_id") or "").strip()
+        if frame_id not in accepted_frames:
+            return {
+                "success": False,
+                "code": f"scene_planning_frame_mismatch:{item['id']}:{frame_id or '<empty>'}",
+                "observed_object_count": len(relevant),
+                "observed_planning_frames": observed_frames,
+            }
+
+    canonical_objects = [
+        {
+            "id": item["id"],
+            "geometry_kind": item["geometry_kind"],
+            "dimensions_m": item["dimensions_m"],
+            "position_m": item["position_m"],
+            "quaternion_xyzw": item["quaternion_xyzw"],
+        }
+        for item in relevant
+    ]
+    observed_scene = _canonical_scene(planning_frame, canonical_objects)
+    observed_hash = _hash(observed_scene)
+    observed_ids = {str(item["id"]) for item in relevant}
+    missing = sorted(expected_ids - observed_ids)
+    success = (
+        not missing
+        and len(relevant) == len(expected_objects)
+        and observed_hash == expected_hash
+    )
+    return {
+        "success": success,
+        "code": "moveit_scene_readback_verified" if success else "moveit_scene_readback_mismatch",
+        "observed_scene_hash": observed_hash,
+        "observed_object_count": len(relevant),
+        "observed_planning_frames": observed_frames,
+        "missing_object_ids": missing,
+    }
+
+
 def _qmul(first, second):
     ax, ay, az, aw = first
     bx, by, bz, bw = second
@@ -78,6 +143,9 @@ def apply_verify(path: Path, timeout_s: float) -> dict[str, Any]:
     planning_frame = str(payload["planning_frame"])
     expected_hash = str(payload["scene_hash"])
     expected_objects = list(payload["objects"])
+    equivalent_planning_frames = tuple(
+        str(value) for value in payload.get("equivalent_planning_frames") or ()
+    )
 
     import rclpy
     from geometry_msgs.msg import Pose
@@ -155,13 +223,12 @@ def apply_verify(path: Path, timeout_s: float) -> dict[str, Any]:
         for collision in response.scene.world.collision_objects:
             if collision.id not in expected_ids:
                 continue
-            if collision.header.frame_id != planning_frame:
+            if len(collision.primitives) != 1 or len(collision.primitive_poses) != 1:
                 return {
                     "success": False,
-                    "code": f"scene_planning_frame_mismatch:{collision.id}:{collision.header.frame_id}",
+                    "code": f"scene_shape_invalid:{collision.id}",
+                    "observed_planning_frames": [collision.header.frame_id],
                 }
-            if len(collision.primitives) != 1 or len(collision.primitive_poses) != 1:
-                return {"success": False, "code": f"scene_shape_invalid:{collision.id}"}
             primitive = collision.primitives[0]
             primitive_pose = collision.primitive_poses[0]
             position, quaternion = _combine_pose(collision.pose, primitive_pose)
@@ -175,26 +242,29 @@ def apply_verify(path: Path, timeout_s: float) -> dict[str, Any]:
                     primitive.dimensions[SolidPrimitive.CYLINDER_HEIGHT],
                 ]
             else:
-                return {"success": False, "code": f"scene_shape_unsupported:{collision.id}"}
-            observed.append({
-                "id": collision.id,
-                "geometry_kind": kind,
-                "dimensions_m": dimensions,
-                "position_m": list(position),
-                "quaternion_xyzw": list(quaternion),
-            })
-
-        observed_scene = _canonical_scene(planning_frame, observed)
-        observed_hash = _hash(observed_scene)
-        missing = sorted(expected_ids - {item["id"] for item in observed})
-        success = not missing and len(observed) == len(expected_objects) and observed_hash == expected_hash
-        return {
-            "success": success,
-            "code": "moveit_scene_readback_verified" if success else "moveit_scene_readback_mismatch",
-            "observed_scene_hash": observed_hash,
-            "observed_object_count": len(observed),
-            "missing_object_ids": missing,
-        }
+                return {
+                    "success": False,
+                    "code": f"scene_shape_unsupported:{collision.id}",
+                    "observed_planning_frames": [collision.header.frame_id],
+                }
+            observed.append(
+                {
+                    "id": collision.id,
+                    "frame_id": collision.header.frame_id,
+                    "geometry_kind": kind,
+                    "dimensions_m": dimensions,
+                    "position_m": list(position),
+                    "quaternion_xyzw": list(quaternion),
+                }
+            )
+
+        return _verify_observed_scene(
+            planning_frame=planning_frame,
+            expected_hash=expected_hash,
+            expected_objects=expected_objects,
+            observed_objects=observed,
+            equivalent_planning_frames=equivalent_planning_frames,
+        )
     finally:
         node.destroy_node()
         rclpy.shutdown()

{devagent_physical_engine-0.12.2 → devagent_physical_engine-0.12.3/src/devagent_physical_engine.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devagent-physical-engine
-Version: 0.12.2
+Version: 0.12.3
 Summary: Verification-first agentic engineering, simulation, and evidence runtime for robotics and industrial automation.
 Author: Tom Ha
 License: All Rights Reserved
@@ -193,6 +193,8 @@ v0.12.1 hardens the initial ROS joint-state snapshot by parsing `ros2 topic echo
 
 v0.12.2 additionally hardens Gazebo model-pose read-back across Harmonic CLI renderings. One shared parser now accepts both pipe-delimited and whitespace-delimited finite XYZ/RPY vectors and is used by initial world verification and dynamic workpiece pose read-back, so task simulation does not depend on a single human-readable `gz model --pose` delimiter style.
 
+v0.12.3 hardens MoveIt PlanningScene read-back when MoveIt serializes world collision objects in its own planning/root frame. A different observed frame is never trusted by label alone: DevAgent first proves the observed frame and canonical Twin frame are identity-equivalent through TF, then re-reads the scene and canonicalizes it back to the Twin planning frame before enforcing the exact geometry hash. Non-identity frames and geometry drift remain fail-closed.
+
 The packaged reference workcell is **not customer-site geometry**. Arbitrary plant layouts require an imported or user-declared physical Twin with trusted poses, collision geometry, tool/TCP information, and workpiece properties. DevAgent does not invent those site facts from a natural-language prompt.
 
 The v0.12 implementation remains evidence-gated: source/CI success does not prove the ROS target campaign has passed on a particular workstation. Use the executable qualification below before treating the task-specific path as qualified on that target.
@@ -420,7 +422,7 @@ Detailed engineering documentation lives in the repository:
 
 ## Project status
 
-**v0.12.2 — Beta software / evidence-gated task-specific physical simulation.**
+**v0.12.3 — Beta software / evidence-gated task-specific physical simulation.**
 
 The software and release pipeline are production-oriented, but physical readiness is scope-specific and evidence-driven. The UR5e task-specific reference-workcell path must pass the executable v0.12 ROS/Gazebo/MoveIt campaign on the target workstation before that scope is considered simulation-qualified there. Real robot execution remains locked. Functional-safety certification and site qualification are not claimed.
 

{devagent_physical_engine-0.12.2 → devagent_physical_engine-0.12.3}/src/devagent_physical_engine.egg-info/SOURCES.txt

@@ -117,6 +117,7 @@ tests/test_gazebo_cli_v0122.py
 tests/test_interpreter_profiles_v08.py
 tests/test_live_provider_qualification.py
 tests/test_measured_motion_v10.py
+tests/test_moveit_scene_v0123.py
 tests/test_natural_language_agent_v07.py
 tests/test_openai_strict_schema_v0113.py
 tests/test_optimization_v05.py

devagent_physical_engine-0.12.3/tests/test_moveit_scene_v0123.py

@@ -0,0 +1,213 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from tempfile import TemporaryDirectory
+import unittest
+
+from devagent_physical_engine.ros2.commands import CommandResult
+from devagent_physical_engine.ros2.frame_alignment import FrameAlignmentReceipt
+from devagent_physical_engine.ros2.moveit_scene import (
+    MoveItSceneBridge,
+    _equivalent_frames_from_receipt,
+)
+from devagent_physical_engine.ros2.scene_probe import (
+    _canonical_scene,
+    _hash,
+    _verify_observed_scene,
+)
+from devagent_physical_engine.simulation_platform import SimulationPlatformError
+from devagent_physical_engine.twin_materialization import (
+    CanonicalTwinMaterialization,
+    MaterializedObject,
+)
+
+
+def _expected_objects():
+    return [
+        {
+            "id": "devagent_box",
+            "geometry_kind": "box",
+            "dimensions_m": [0.1, 0.08, 0.06],
+            "position_m": [0.4, -0.2, 0.3],
+            "quaternion_xyzw": [0.0, 0.0, 0.0, 1.0],
+        }
+    ]
+
+
+def _expected_hash() -> str:
+    return _hash(_canonical_scene("base_link", _expected_objects()))
+
+
+def _observed(*, frame_id="world", dimensions=None):
+    item = dict(_expected_objects()[0])
+    item["frame_id"] = frame_id
+    if dimensions is not None:
+        item["dimensions_m"] = list(dimensions)
+    return [item]
+
+
+def _materialization() -> CanonicalTwinMaterialization:
+    return CanonicalTwinMaterialization(
+        twin_id="TWIN-v0123-test",
+        twin_hash="a" * 64,
+        robot_profile_key="ur5e",
+        planning_frame="base_link",
+        objects=(
+            MaterializedObject(
+                entity_id="BOX_101",
+                backend_id="devagent_box",
+                kind="box",
+                dimensions_m=(0.1, 0.08, 0.06),
+                position_m=(0.4, -0.2, 0.3),
+                quaternion_xyzw=(0.0, 0.0, 0.0, 1.0),
+                static=True,
+            ),
+        ),
+    )
+
+
+class EquivalentPlanningFrameTests(unittest.TestCase):
+    def test_identity_equivalent_world_frame_is_canonicalized_before_hash(self):
+        result = _verify_observed_scene(
+            planning_frame="base_link",
+            expected_hash=_expected_hash(),
+            expected_objects=_expected_objects(),
+            observed_objects=_observed(frame_id="world"),
+            equivalent_planning_frames=("world",),
+        )
+        self.assertTrue(result["success"])
+        self.assertEqual(result["observed_scene_hash"], _expected_hash())
+        self.assertEqual(result["observed_planning_frames"], ["world"])
+
+    def test_unproved_world_frame_stays_fail_closed(self):
+        result = _verify_observed_scene(
+            planning_frame="base_link",
+            expected_hash=_expected_hash(),
+            expected_objects=_expected_objects(),
+            observed_objects=_observed(frame_id="world"),
+        )
+        self.assertFalse(result["success"])
+        self.assertEqual(
+            result["code"],
+            "scene_planning_frame_mismatch:devagent_box:world",
+        )
+
+    def test_equivalent_frame_does_not_bypass_geometry_hash(self):
+        result = _verify_observed_scene(
+            planning_frame="base_link",
+            expected_hash=_expected_hash(),
+            expected_objects=_expected_objects(),
+            observed_objects=_observed(
+                frame_id="world",
+                dimensions=(0.2, 0.08, 0.06),
+            ),
+            equivalent_planning_frames=("world",),
+        )
+        self.assertFalse(result["success"])
+        self.assertEqual(result["code"], "moveit_scene_readback_mismatch")
+        self.assertNotEqual(result["observed_scene_hash"], _expected_hash())
+
+    def test_only_bound_verified_receipt_can_add_equivalent_frame(self):
+        receipt = FrameAlignmentReceipt(
+            True,
+            "frame_alignment_verified",
+            "world",
+            "base_link",
+            0.0,
+            0.0,
+        )
+        self.assertEqual(
+            _equivalent_frames_from_receipt("base_link", receipt),
+            ("world",),
+        )
+        with self.assertRaisesRegex(
+            SimulationPlatformError,
+            "moveit_scene_frame_receipt_unbound",
+        ):
+            _equivalent_frames_from_receipt(
+                "base_link",
+                FrameAlignmentReceipt(
+                    True,
+                    "frame_alignment_verified",
+                    "map",
+                    "odom",
+                    0.0,
+                    0.0,
+                ),
+            )
+
+
+class _RetryRunner:
+    def __init__(self, expected_scene_hash: str):
+        self.expected_scene_hash = expected_scene_hash
+        self.scene_calls = 0
+        self.tf_calls = 0
+        self.payloads: list[dict[str, object]] = []
+
+    def run(self, command, *, timeout_s):
+        command = tuple(command)
+        helper = Path(command[1]).name if len(command) > 1 else ""
+        if helper == "scene_probe.py":
+            self.scene_calls += 1
+            input_path = Path(command[command.index("--input") + 1])
+            payload = json.loads(input_path.read_text(encoding="utf-8"))
+            self.payloads.append(payload)
+            if self.scene_calls == 1:
+                output = {
+                    "success": False,
+                    "code": "scene_planning_frame_mismatch:devagent_box:world",
+                    "observed_object_count": 1,
+                    "observed_planning_frames": ["world"],
+                }
+                return CommandResult(command, 2, json.dumps(output) + "\n", "", 0.01)
+            output = {
+                "success": True,
+                "code": "moveit_scene_readback_verified",
+                "observed_scene_hash": self.expected_scene_hash,
+                "observed_object_count": 1,
+                "observed_planning_frames": ["world"],
+                "missing_object_ids": [],
+            }
+            return CommandResult(command, 0, json.dumps(output) + "\n", "", 0.01)
+        if helper == "tf_probe.py":
+            self.tf_calls += 1
+            output = {
+                "success": True,
+                "code": "tf_lookup_ok",
+                "translation_m": [0.0, 0.0, 0.0],
+                "quaternion_xyzw": [0.0, 0.0, 0.0, 1.0],
+            }
+            return CommandResult(command, 0, json.dumps(output) + "\n", "", 0.01)
+        raise AssertionError(f"unexpected command: {command}")
+
+
+class MoveItSceneBridgeRetryTests(unittest.TestCase):
+    def test_bridge_retries_only_after_observed_frame_identity_proof(self):
+        materialization = _materialization()
+        runner = _RetryRunner(materialization.scene_hash)
+        with TemporaryDirectory() as tmp:
+            receipt = MoveItSceneBridge(
+                runner,
+                work_dir=tmp,
+                timeout_s=1.0,
+            ).apply_and_verify(materialization)
+
+        self.assertTrue(receipt.verified)
+        self.assertEqual(runner.scene_calls, 2)
+        self.assertEqual(runner.tf_calls, 1)
+        self.assertEqual(
+            runner.payloads[0]["equivalent_planning_frames"],
+            [],
+        )
+        self.assertEqual(
+            runner.payloads[1]["equivalent_planning_frames"],
+            ["world"],
+        )
+        self.assertEqual(receipt.observed_planning_frames, ("world",))
+        self.assertEqual(receipt.equivalent_planning_frames, ("world",))
+        self.assertEqual(receipt.observed_scene_hash, materialization.scene_hash)
+
+
+if __name__ == "__main__":
+    unittest.main()