rosotacom-dev 2.5.dev58__tar.gz → 2.5.dev61__tar.gz

{rosotacom_dev-2.5.dev58 → rosotacom_dev-2.5.dev61}/.github/workflows/image-scan.yml

@@ -14,11 +14,19 @@ concurrency:
 
 jobs:
   trivy-image:
-    name: trivy-image
+    name: trivy-image-${{ matrix.variant }}
     runs-on: ubuntu-latest
     timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - variant: kilted
+            config: src/rosotacom/resources/ros2docker.json.example
+          - variant: lyrical
+            config: src/rosotacom/resources/ros2docker.lyrical.json.example
     env:
-      IMAGE_TAG: rosotacom:scan-${{ github.sha }}
+      IMAGE_TAG: rosotacom:scan-${{ matrix.variant }}-${{ github.sha }}
 
     steps:
       - name: Check out repository
@@ -41,10 +49,10 @@ jobs:
       - name: Show Docker environment
         run: docker info
 
-      - name: Build default rosotacom image
+      - name: Build rosotacom image
         run: |
           .venv/bin/ros2docker build \
-            -f src/rosotacom/resources/ros2docker.json.example \
+            -f "${{ matrix.config }}" \
             -o "{\"image_name\":\"${IMAGE_TAG}\"}"
 
       - name: Run Trivy vulnerability scanner
@@ -61,6 +69,6 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v7
         with:
-          name: trivy-image-report
+          name: trivy-image-report-${{ matrix.variant }}
           path: trivy-image-report.txt
           if-no-files-found: warn

{rosotacom_dev-2.5.dev58 → rosotacom_dev-2.5.dev61}/.github/workflows/nightly-e2e.yml

@@ -32,12 +32,13 @@ jobs:
     # nightly failed with nine "Timed out waiting for container readiness"
     # errors after 1h12m on one runner, while the same tests on the same commit
     # passed in the merge gate — where they were spread over six at the time.
-    name: smoke-e2e-${{ matrix.slice }}
+    name: smoke-e2e-${{ matrix.variant }}-${{ matrix.slice }}
     runs-on: ubuntu-latest
     timeout-minutes: 90
     strategy:
       fail-fast: false
       matrix:
+        variant: [kilted, lyrical]
         slice:
           - heartbeat
           - chatter
@@ -86,24 +87,27 @@ jobs:
         run: docker info
 
       - name: Run E2E slice
+        env:
+          ROSOTACOM_ROS2DOCKER_CONFIG: ${{ matrix.variant == 'lyrical' && format('{0}/src/rosotacom/resources/examples/ros2docker.lyrical.json', github.workspace) || '' }}
         run: just test-e2e-slice ${{ matrix.slice }}
 
       - name: Upload smoke session artifacts
         if: failure()
         uses: actions/upload-artifact@v7
         with:
-          name: session-instances-smoke-${{ matrix.slice }}
+          name: session-instances-smoke-${{ matrix.variant }}-${{ matrix.slice }}
           path: session-instances/
           if-no-files-found: ignore
 
   rmw-matrix:
-    name: rmw-${{ matrix.session }}
+    name: rmw-${{ matrix.variant }}-${{ matrix.session }}
     runs-on: ubuntu-latest
     timeout-minutes: 90
     if: github.event_name != 'schedule' || github.event.inputs.full-rmw-matrix != 'false'
     strategy:
       fail-fast: false
       matrix:
+        variant: [kilted, lyrical]
         session:
           - cyclone-local-zenoh-ros2dds-ota
           - cyclone-ota
@@ -139,12 +143,14 @@ jobs:
         run: docker info
 
       - name: Run generated RMW matrix session
+        env:
+          ROSOTACOM_ROS2DOCKER_CONFIG: ${{ matrix.variant == 'lyrical' && format('{0}/src/rosotacom/resources/examples/ros2docker.lyrical.json', github.workspace) || '' }}
         run: just test-e2e-rmw ${{ matrix.session }}
 
       - name: Upload RMW session artifacts
         if: failure()
         uses: actions/upload-artifact@v7
         with:
-          name: session-instances-rmw-${{ matrix.session }}
+          name: session-instances-rmw-${{ matrix.variant }}-${{ matrix.session }}
           path: session-instances/
           if-no-files-found: ignore

{rosotacom_dev-2.5.dev58 → rosotacom_dev-2.5.dev61}/.github/workflows/pr-merge-gate.yml

@@ -159,7 +159,8 @@ jobs:
   quick-gate:
     # Everything `e2e` waits for that is not the image, and deliberately no
     # more. It exists to answer one question — is the tree obviously broken,
-    # such that seventeen slices would burn roughly 73 runner-minutes to say so.
+    # such that two variants across seventeen slices would burn roughly 146
+    # runner-minutes to say so.
     #
     # It replaced a `needs: preflight-success` edge that made e2e wait for the
     # whole five-version matrix. That barrier cost 2.15 min of every gate run
@@ -204,7 +205,8 @@ jobs:
     # ROS base from Docker Hub, 40s exporting layers, 47s of apt and pip. A pull
     # from GHCR — co-located with the runners, no Hub rate limit, one transfer
     # instead of a transfer plus a build — replaces all of it. The benefit
-    # grows with the diagnostic matrix; seventeen jobs still build only once.
+    # grows with the diagnostic matrix; both distribution variants still build
+    # only once each.
     #
     # The tag is a hash of everything that decides the image (base digest,
     # package lists, Dockerfile, entrypoint, ros2docker version, build UID):
@@ -255,18 +257,32 @@ jobs:
           # artifacts that live beside the checkout in the private harness, so it
           # does not resolve here.
           project="$(.venv/bin/rosotacom resources path examples)/rosotacom.yaml"
-          .venv/bin/rosotacom image references --project "$project" --repository "$repository" > references.txt
-          cat references.txt
-
-          while read -r reference; do
-            if docker manifest inspect "$reference" >/dev/null 2>&1; then
-              echo "present: $reference"
-              continue
+          lyrical_config="$(.venv/bin/rosotacom resources path ros2docker-lyrical)"
+          for variant in kilted lyrical; do
+            config=""
+            if [[ "$variant" == "lyrical" ]]; then
+              config="$lyrical_config"
             fi
-            echo "missing, building: $reference"
-            .venv/bin/rosotacom image build --project "$project" --reference "$reference"
-            docker push "$reference" || echo "::warning::could not push $reference"
-          done < references.txt
+            variant_references="references-${variant}.txt"
+            ROSOTACOM_ROS2DOCKER_CONFIG="$config" \
+              .venv/bin/rosotacom image references \
+              --project "$project" \
+              --repository "$repository" > "$variant_references"
+
+            while read -r reference; do
+              if docker manifest inspect "$reference" >/dev/null 2>&1; then
+                echo "present ($variant): $reference"
+                continue
+              fi
+              echo "missing ($variant), building: $reference"
+              ROSOTACOM_ROS2DOCKER_CONFIG="$config" \
+                .venv/bin/rosotacom image build --project "$project" --reference "$reference"
+              docker push "$reference" || echo "::warning::could not push $reference"
+            done < "$variant_references"
+          done
+
+          sort -u references-kilted.txt references-lyrical.txt > references.txt
+          cat references.txt
 
           # Report the repository only when every reference resolves. A
           # read-only GITHUB_TOKEN (a fork PR, Dependabot) can log in and pull
@@ -301,7 +317,7 @@ jobs:
     # reaches the measured floor: #253 split the four overloaded themes along
     # transport, stream, or concurrency semantics. Which tests a slice owns and
     # what each costs is E2E_SLICES in tests/e2e/conftest.py.
-    name: e2e-${{ matrix.slice }}
+    name: e2e-${{ matrix.variant }}-${{ matrix.slice }}
     runs-on: ubuntu-latest
     timeout-minutes: 90
     needs: [quick-gate, image]
@@ -312,6 +328,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        variant: [kilted, lyrical]
         slice:
           - heartbeat
           - chatter
@@ -371,13 +388,14 @@ jobs:
           # that tag itself and never accepts one, so it cannot be pointed at an
           # image built from something else.
           ROSOTACOM_IMAGE_CACHE: ${{ needs.image.outputs.repository }}
+          ROSOTACOM_ROS2DOCKER_CONFIG: ${{ matrix.variant == 'lyrical' && format('{0}/src/rosotacom/resources/examples/ros2docker.lyrical.json', github.workspace) || '' }}
         run: just test-e2e-slice ${{ matrix.slice }}
 
       - name: Upload session artifacts
         if: failure()
         uses: actions/upload-artifact@v7
         with:
-          name: session-instances-e2e-${{ matrix.slice }}
+          name: session-instances-e2e-${{ matrix.variant }}-${{ matrix.slice }}
           path: session-instances/
           if-no-files-found: ignore
 

{rosotacom_dev-2.5.dev58 → rosotacom_dev-2.5.dev61}/.github/workflows/release.yml

@@ -115,12 +115,13 @@ jobs:
     # identical to nightly-e2e.yml's smoke-e2e job, so the release used to be
     # the third sequential run of the same tests against the same tree; it
     # dominated release wall-clock at roughly an hour. See issue #196.
-    name: e2e-${{ matrix.slice }}
+    name: e2e-${{ matrix.variant }}-${{ matrix.slice }}
     runs-on: ubuntu-latest
     timeout-minutes: 90
     strategy:
       fail-fast: false
       matrix:
+        variant: [kilted, lyrical]
         slice:
           - heartbeat
           - chatter
@@ -169,13 +170,15 @@ jobs:
         run: docker info
 
       - name: Run E2E slice
+        env:
+          ROSOTACOM_ROS2DOCKER_CONFIG: ${{ matrix.variant == 'lyrical' && format('{0}/src/rosotacom/resources/examples/ros2docker.lyrical.json', github.workspace) || '' }}
         run: just test-e2e-slice ${{ matrix.slice }}
 
       - name: Upload session artifacts
         if: failure()
         uses: actions/upload-artifact@v7
         with:
-          name: session-instances-e2e-${{ matrix.slice }}
+          name: session-instances-e2e-${{ matrix.variant }}-${{ matrix.slice }}
           path: session-instances/
           if-no-files-found: ignore
 

{rosotacom_dev-2.5.dev58 → rosotacom_dev-2.5.dev61}/.pre-commit-config.yaml

@@ -7,7 +7,7 @@ repos:
       - id: check-yaml
       - id: check-toml
       - id: check-json
-        exclude: ^src/rosotacom/resources/(examples/ros2docker\.json|ros2docker\.json\.example)$
+        exclude: ^src/rosotacom/resources/(examples/ros2docker(?:\.lyrical)?\.json|ros2docker(?:\.lyrical)?\.json\.example)$
       - id: check-merge-conflict
       - id: debug-statements
 

{rosotacom_dev-2.5.dev58 → rosotacom_dev-2.5.dev61}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rosotacom-dev
-Version: 2.5.dev58
+Version: 2.5.dev61
 Summary: Host CLI for ROS OTA communication sessions.
 Author: develNor
 License-Expression: BSD-3-Clause
@@ -27,7 +27,7 @@ Requires-Dist: argcomplete<4,>=3.6
 Requires-Dist: mcap<2,>=1.4
 Requires-Dist: Pillow<13,>=10
 Requires-Dist: PyYAML>=6
-Requires-Dist: ros2docker<0.2,>=0.1.5.dev8
+Requires-Dist: ros2docker<0.2,>=0.1.5.dev10
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == "dev"
 Requires-Dist: check-wheel-contents>=0.6; extra == "dev"
@@ -73,7 +73,7 @@ The ROS Communication DevContainer is a Docker-based solution designed to stream
 - Git for configuration management
 - Python 3 with virtual environment support (`python3-venv` on Debian/Ubuntu;
   for versioned Python packages this may be named like `python3.14-venv`)
-- `ros2docker` v0.1.4 or newer. The local installer below installs the pinned
+- `ros2docker` v0.1.5.dev10 or newer (below v0.2). The local installer below installs the pinned
   supported range into this checkout's virtual environment.
 - `tmux` for the optional `rosotacom scenario` orchestration commands
 - Machines connected to the same network (VPN or local WLAN)
@@ -216,6 +216,7 @@ The copied packaged example project uses this layout:
 ```text
 rosotacom.yaml
 ros2docker.json
+ros2docker.lyrical.json
 deployment.example.yaml
 sessions/
 scenarios/
@@ -246,6 +247,7 @@ composes directly in a shell:
 ```bash
 rosotacom resources path com_msgs   # the ROS 2 message package
 rosotacom resources path ws         # the packaged runtime workspace
+rosotacom resources path ros2docker-lyrical  # the opt-in ROS 2 Lyrical image config
 ```
 
 Use this wherever another project needs rosotacom's files on the host, for
@@ -253,6 +255,44 @@ example to bake `com_msgs` into its own container image. Ask for the resource by
 name rather than reconstructing a path: the names are part of the CLI contract,
 the layout behind them is not.
 
+### ROS 2 distribution variants
+
+ROS 2 Kilted remains the default. The packaged Lyrical/Ubuntu Resolute image is
+an explicit opt-in and uses a separate image name, so trying it does not replace
+the default image. To select it for one command, including the built-in example:
+
+```bash
+ROSOTACOM_ROS2DOCKER_CONFIG="$(rosotacom resources path ros2docker-lyrical)" \
+  rosotacom smoke
+```
+
+An example project copied with `rosotacom examples create` also contains
+`ros2docker.lyrical.json`. To opt that project in persistently, select it in
+`rosotacom.yaml`:
+
+```yaml
+ros2docker_config: ros2docker.lyrical.json
+```
+
+The Lyrical config keeps every available ROS dependency on the official binary
+packages. `domain_bridge` is the current exception: because no Lyrical binary
+package exists, ros2docker's `domain-bridge` profile builds a pinned upstream
+commit with a pinned compatibility patch. The build fails closed outside
+Lyrical or if that patch no longer applies. Replace this fallback with
+`ros-lyrical-domain-bridge` once the official package is released.
+
+The communication container and any scenario application with a matching
+`ros2docker_config_by_distro` entry follow this variant selection together.
+The packaged chatter scenario supplies Lyrical application configs, because
+[ROS 2 does not guarantee cross-distribution communication](https://docs.ros.org/en/ros2_documentation/rolling/Releases.html#cross-distribution-communications).
+Applications without a matching entry retain their explicit default config.
+
+The default switch is intentionally not part of this change. Before promoting
+Lyrical, keep the two-variant E2E and RMW matrices green, point the packaged
+default and example project at the Lyrical configs, and recalibrate the
+distribution-specific performance budgets. Existing copied projects continue
+to name their own config and do not change when the package default changes.
+
 ### Reusing an image instead of rebuilding it
 
 Somewhere that starts many rosotacom sessions from the same tree — CI above all
@@ -362,9 +402,13 @@ applications:
   a:
     - name: native_application
       ros2docker_config: ../../scripts/2_native_chatter/machine_a/external.ros2docker.json
+      ros2docker_config_by_distro:
+        lyrical: ../../scripts/2_native_chatter/machine_a/external.lyrical.ros2docker.json
   b:
     - name: native_application
       ros2docker_config: ../../scripts/2_native_chatter/machine_b/external.ros2docker.json
+      ros2docker_config_by_distro:
+        lyrical: ../../scripts/2_native_chatter/machine_b/external.lyrical.ros2docker.json
 ```
 
 Start one identity's communication and local application together:
@@ -379,7 +423,11 @@ rosotacom scenario stop
 `scenario list` shows both configured scenarios and currently active
 scenario/identity pairs. `attach` and `stop` infer omitted values when exactly
 one active choice exists; otherwise their completions and error messages show
-the eligible active choices.
+the eligible active choices. `ros2docker_config` is always the fallback;
+`ros2docker_config_by_distro` selects a matching application image from the
+communication config's `BASE_IMAGE` distro, so changing the project between
+Kilted and Lyrical changes the complete scenario rather than creating an
+unsupported mixed-distro data path.
 
 The outer view uses an isolated host tmux server with one full window for
 communication and one full window per local application. Its prefix remains

{rosotacom_dev-2.5.dev58 → rosotacom_dev-2.5.dev61}/README.md

@@ -28,7 +28,7 @@ The ROS Communication DevContainer is a Docker-based solution designed to stream
 - Git for configuration management
 - Python 3 with virtual environment support (`python3-venv` on Debian/Ubuntu;
   for versioned Python packages this may be named like `python3.14-venv`)
-- `ros2docker` v0.1.4 or newer. The local installer below installs the pinned
+- `ros2docker` v0.1.5.dev10 or newer (below v0.2). The local installer below installs the pinned
   supported range into this checkout's virtual environment.
 - `tmux` for the optional `rosotacom scenario` orchestration commands
 - Machines connected to the same network (VPN or local WLAN)
@@ -171,6 +171,7 @@ The copied packaged example project uses this layout:
 ```text
 rosotacom.yaml
 ros2docker.json
+ros2docker.lyrical.json
 deployment.example.yaml
 sessions/
 scenarios/
@@ -201,6 +202,7 @@ composes directly in a shell:
 ```bash
 rosotacom resources path com_msgs   # the ROS 2 message package
 rosotacom resources path ws         # the packaged runtime workspace
+rosotacom resources path ros2docker-lyrical  # the opt-in ROS 2 Lyrical image config
 ```
 
 Use this wherever another project needs rosotacom's files on the host, for
@@ -208,6 +210,44 @@ example to bake `com_msgs` into its own container image. Ask for the resource by
 name rather than reconstructing a path: the names are part of the CLI contract,
 the layout behind them is not.
 
+### ROS 2 distribution variants
+
+ROS 2 Kilted remains the default. The packaged Lyrical/Ubuntu Resolute image is
+an explicit opt-in and uses a separate image name, so trying it does not replace
+the default image. To select it for one command, including the built-in example:
+
+```bash
+ROSOTACOM_ROS2DOCKER_CONFIG="$(rosotacom resources path ros2docker-lyrical)" \
+  rosotacom smoke
+```
+
+An example project copied with `rosotacom examples create` also contains
+`ros2docker.lyrical.json`. To opt that project in persistently, select it in
+`rosotacom.yaml`:
+
+```yaml
+ros2docker_config: ros2docker.lyrical.json
+```
+
+The Lyrical config keeps every available ROS dependency on the official binary
+packages. `domain_bridge` is the current exception: because no Lyrical binary
+package exists, ros2docker's `domain-bridge` profile builds a pinned upstream
+commit with a pinned compatibility patch. The build fails closed outside
+Lyrical or if that patch no longer applies. Replace this fallback with
+`ros-lyrical-domain-bridge` once the official package is released.
+
+The communication container and any scenario application with a matching
+`ros2docker_config_by_distro` entry follow this variant selection together.
+The packaged chatter scenario supplies Lyrical application configs, because
+[ROS 2 does not guarantee cross-distribution communication](https://docs.ros.org/en/ros2_documentation/rolling/Releases.html#cross-distribution-communications).
+Applications without a matching entry retain their explicit default config.
+
+The default switch is intentionally not part of this change. Before promoting
+Lyrical, keep the two-variant E2E and RMW matrices green, point the packaged
+default and example project at the Lyrical configs, and recalibrate the
+distribution-specific performance budgets. Existing copied projects continue
+to name their own config and do not change when the package default changes.
+
 ### Reusing an image instead of rebuilding it
 
 Somewhere that starts many rosotacom sessions from the same tree — CI above all
@@ -317,9 +357,13 @@ applications:
   a:
     - name: native_application
       ros2docker_config: ../../scripts/2_native_chatter/machine_a/external.ros2docker.json
+      ros2docker_config_by_distro:
+        lyrical: ../../scripts/2_native_chatter/machine_a/external.lyrical.ros2docker.json
   b:
     - name: native_application
       ros2docker_config: ../../scripts/2_native_chatter/machine_b/external.ros2docker.json
+      ros2docker_config_by_distro:
+        lyrical: ../../scripts/2_native_chatter/machine_b/external.lyrical.ros2docker.json
 ```
 
 Start one identity's communication and local application together:
@@ -334,7 +378,11 @@ rosotacom scenario stop
 `scenario list` shows both configured scenarios and currently active
 scenario/identity pairs. `attach` and `stop` infer omitted values when exactly
 one active choice exists; otherwise their completions and error messages show
-the eligible active choices.
+the eligible active choices. `ros2docker_config` is always the fallback;
+`ros2docker_config_by_distro` selects a matching application image from the
+communication config's `BASE_IMAGE` distro, so changing the project between
+Kilted and Lyrical changes the complete scenario rather than creating an
+unsupported mixed-distro data path.
 
 The outer view uses an isolated host tmux server with one full window for
 communication and one full window per local application. Its prefix remains

{rosotacom_dev-2.5.dev58 → rosotacom_dev-2.5.dev61}/docs/ci.md

@@ -43,22 +43,28 @@ check is:
 ci-success
 ```
 
-The merge gate runs workflow lint, dependency/security review, runtime/build asset lint, Python 3.10 through 3.14 non-Docker checks, package validation, and the Docker single-machine smoke matrix (one matrix job per slice, seventeen in parallel):
+The merge gate runs workflow lint, dependency/security review, runtime/build
+asset lint, Python 3.10 through 3.14 non-Docker checks, package validation, and
+the Docker single-machine smoke matrix: seventeen diagnostic slices for each of
+the `kilted` and `lyrical` variants, 34 jobs in parallel. Scenario application
+images follow the selected communication distro through
+`ros2docker_config_by_distro`, so each variant is end-to-end rather than a
+cross-distro combination.
 
 Python 3.10–3.14 are supported for the host CLI; Python 3.12 is the reference
 interpreter for packaging and Docker E2E jobs.
 
 ### What the e2e slices wait for
 
-The only explicit barriers before the seventeen slices are their `needs`. They
-wait for exactly two jobs:
+The only explicit barriers before the 34 variant/slice jobs are their `needs`.
+They wait for exactly two jobs:
 
 - **`image`**, because a slice adopts the published image rather than building
   it, so it cannot start before that image is known to exist. On a hit this is
   two manifest inspections, and it is what sets the floor.
 - **`quick-gate`**, `just lint && just typecheck` on one interpreter: the
-  cheapest signal that the tree is not obviously broken, so seventeen runners
-  do not spend roughly 73 minutes discovering a syntax error. Four seconds of work,
+  cheapest signal that the tree is not obviously broken, so 34 runners do not
+  spend roughly 146 minutes discovering a syntax error. Four seconds of work,
   sized to finish inside `image` and therefore free.
 
 They used to wait for `preflight-success`, which meant the whole five-version
@@ -105,19 +111,23 @@ Docker E2E is not collected for coverage.
 
 ## Docker E2E
 
-`just test-e2e-smoke` runs the entire local single-machine smoke matrix through Docker. In the CI merge gate, the same collection runs as seventeen parallel
-jobs, one per slice, named `e2e-<slice>`. Each smoke run writes generated
-config, catmux pane logs, Docker logs when available, and the smoke verification
-log under `session-instances/`; collect that directory as the first debugging
-artifact when an E2E job fails.
+`just test-e2e-smoke` runs the entire local single-machine smoke matrix through
+Docker using the selected config (Kilted by default). In the CI merge gate, the
+same collection runs for both Kilted and Lyrical as 34 parallel jobs, one per
+variant/slice pair, named `e2e-<variant>-<slice>`. Each smoke run writes
+generated config, catmux pane logs, Docker logs when available, and the smoke
+verification log under `session-instances/`; collect that directory as the
+first debugging artifact when an E2E job fails.
 
 ### The e2e image is published once, not rebuilt per job
 
 Every e2e job used to build the project image from scratch. #236 measured that
 at 154s per job — 57s pulling the multi-GB ROS base from Docker Hub, 40s
 exporting layers, 47s of apt and pip — which was 33 minutes of runner time and
-thirteen Hub pulls with the matrix at that time. The image is still published
-only once now that the diagnostic matrix has seventeen jobs.
+thirteen Hub pulls with the matrix at that time. Each distribution-specific
+communication image is now published once, despite the 17 consumers per
+variant; scenario application images common to both variants are deduplicated
+by their content-addressed references.
 
 The `image` job now publishes those images to
 `ghcr.io/<owner>/rosotacom-e2e` and each slice pulls instead of building. GHCR
@@ -161,6 +171,9 @@ Two properties are worth keeping in mind when changing this:
   image from a different package list, so `rosotacom image references` walks the
   project config *and* every scenario application. Publishing only the project
   image would leave that slice adopting something nobody published.
+- **Both ROS variants are published.** The publisher resolves the project once
+  with the default Kilted config and once with the opt-in Lyrical config. A
+  variant's reference is built under the same selection that derived it.
 - **The release and nightly lanes still build from scratch**, as does the
   nightly `image-scan`. That is deliberate: they are what would notice if a
   published image and a fresh build ever stopped agreeing.
@@ -256,10 +269,12 @@ The deterministic benchmark rows gate against committed two-sided bands
 ## Nightly And Maintenance Checks
 
 `.github/workflows/nightly-e2e.yml` runs the local smoke slice plus the generated
-RMW matrix nightly on GitHub-hosted infrastructure and also supports manual
-dispatch. It is not the private OTA promotion gate.
-`.github/workflows/image-scan.yml` builds the default communication image and
-uploads an advisory Trivy report.
+RMW matrix for both Kilted and Lyrical nightly on GitHub-hosted infrastructure
+and also supports manual dispatch. It is not the private OTA promotion gate.
+`.github/workflows/image-scan.yml` builds both communication variants and
+uploads one advisory Trivy report per image. The dedicated performance gate
+remains on the default Kilted config because its committed budgets are
+distribution-specific; switching the default requires a fresh calibration.
 
 Dependabot is configured for weekly grouped GitHub Actions and Python dependency
 updates.

{rosotacom_dev-2.5.dev58 → rosotacom_dev-2.5.dev61}/docs/findings/README.md

@@ -32,6 +32,8 @@ living verification hook.
 - [A bridge that learns types from the graph cannot use a transport that does not carry the graph](graph-derived-types-block-a-non-graph-transport.md) - over `zenoh_ros2dds` the payload topic never arrived in either run: the bridge routes a topic once a local reader exists and the reader waited for the bridge, leaving only `Pending=1` in a log.
 - [A Fast DDS datagram cap stops every message larger than it](fastdds-datagram-cap-drops-large-samples.md) - copying CycloneDDS's 1200 B fragment size into the Fast DDS OTA profile makes every sample above the cap never arrive, at 1200 B and at 8192 B, sync and async — while the 84 B heartbeat keeps flowing at 10 Hz.
 - [A lost keyframe silences exactly the next gop_size−2 deltas](keyframe-loss-kills-the-next-deltas.md) - libavcodec emits nothing for them, the last delta decodes with artifacts, the next keyframe restores clean decode; a lost delta never blocks decode — so the display hole is gop_size × frame period, deterministically.
+- [Any transport element in a Fast DDS profile doubles every sample on the wire](a-transport-element-doubles-every-fastdds-sample.md) - 366 datagrams for 180 samples against 183 without it; `<builtinTransports>DEFAULT` is a no-op selection and doubles too, so the trigger is the element's presence — removing it takes the shipped OTA profile from 2.10x the payload to 1.04x at identical delivery.
+- [Lifespan is enforced by one DDS reader and not the other](lifespan-is-enforced-by-one-reader-and-not-the-other.md) - under the same 20% oversubscription both stacks queue alike (472 and 433 delivered at ~1.1-1.2 s); with `lifespan: 0.7` CycloneDDS is unchanged and delivers 9.1% inside the bound, while Fast DDS drops to 4 delivered and never exceeds 570 ms — the policy decides shown-vs-suppressed, not how long the wait is.
 - [Oversubscription queues — it does not lose until the queue itself dies](oversubscription-queues-not-losses.md) - 16% over an emulated cap climbed one-way delay 340 → 3250 ms across twelve bins with zero loss in every one; the losses arrived only when the queue died, all at once.
 - [Best-effort reordering becomes reader-side loss, independent of history depth](reorder-becomes-reader-loss.md) - under pure delay jitter a Cyclone best-effort reader discards every overtaken sample (57% at 100 Hz under 50+-45 ms), delivery stays strictly monotonic, and depth 50 loses the same as depth 1.
 - [Jitter causes loss while bandwidth shortage builds latency](jitter-loss-bandwidth-latency.md) - 18 KB at 20 Hz separates jitter-induced loss from bandwidth-induced queueing.