Decisions › D05
Each black box reports what a failure means for it, and the host never overrides it
Context
A row can be a device, or a group of devices. Who decides how bad a group is? ROS's aggregator, Autoware and others decide in one central place. Zach set a different rule on 22 October.
The decision
A row shows its entity's own self-report, and the host never overrides it. A pure grouping node with no report of its own shows the worst below. The host's worst-below “rollup” is only a hint (like Redfish's HealthRollup beside Health), shown on a row when it is worse than the row's own level.
A problem below a failed ancestor counts once, as that ancestor, and the rest are listed as knock-ons. An error ancestor explains anything below it; a silent ancestor explains only silence, because a fresh warning or error from below proves the path works.
Why
“In black-box design it's up to each lower-level black box to self-report what it means in the context of THAT black box.”
Zach Yamaoka, 22 Oct 2026
“You can group those entities into larger entities and make your own diagnostics wrapper: say a robot with 8 legs, 1 leg says failure, the spider can still report warning.”
Zach Yamaoka, chat, 22 Oct 2026
In the spec's worked case the spider reports a warning while leg 3 is in error: the spider's row says warning with an error hint, and a grouping cell above it shows error.
Options considered
From the spec's first open question and its comparison with Autoware.
| Option | Verdict | Reason |
|---|---|---|
| A folder shows its children's headlines | Rejected | A self-only box could hide its children. The adapter (USB fine, OK) would hide its dead bus from everything above it. |
| One central graph decides, per operation mode | Rejected | Autoware's way. It puts the judgement far from the box that knows what a failure means. |
| Boxes self-report, a composite is a box like any leaf | Chosen | Closure under composition. Where you want a judgement at some level, write a wrapper there. |
Consequences
- The rollup is advisory everywhere: the top-bar chip reads the root's rollup (“does anything need me?”) and rows read their own report.
- Gaps showed up the next day, when a rig row counted one missing board twice; they were closed by caused_by and led to a proposal for who judges a rig.
Evidence
- Diagnostics rollups: five proposalsReport, 2026-10-23. Evidence for this decision.
- Diagnostics record v0Contract doc, 2026-10-22. ROS DiagnosticStatus kept whole, plus Entity, Event, Fault and Action. Eight lessons from the field, the rules, and the evidence re-checked.
Commits in the app's repository (private):
c9784d02026-10-22 Diagnostics record v0: the host rulesa4b78142026-10-22 IO diagnostics v1: the host with the black-box rule, derived STALE and a fault memory