Governing the Machine

a physical AI model in a controlled laboratory is a milestone. Outside the workbench, dust obscures lenses, lighting changes, wireless networks drop packets, gearboxes wear, and human coworkers share the machine’s path. Each change can invalidate a premise used to permit motion. Part III’s runtime records rest on premises of that kind: a stopping budget that holds only while its spare survives, a crossing rule whose basis is still open (Belief Through Occlusion), and a placement record whose loaded field is empty.

Principle 1: Evidence bounds authority

Invariant: Authority to operate is granted per operating condition by evidence whose age, provenance, and limits are recorded, and it expires when that evidence does. Zero failures in \(n\) independent, stationary trials bound the failure rate near \(3/n\) at 95 percent confidence (Physical Trial Limits).

Implication: Who may command the machine, what the tests challenged, and which conditions it may enter are decided on the record, not on a demonstration. A premise that evidence cannot settle restricts operation through a reduced envelope, a passive limit, or refusal, and it stays open until a declared test closes it.

• Supervisory Intervention (Supervisory Intervention): Decides who holds authority over each actuator at each instant when a person and a learned proposer share the machine, and produces the authority record.
• Adversarial Verification (Adversarial Verification): Decides which fault tests challenge each claim and how their outcomes count, and produces the fault record.
• Deployment Release (Deployment Release): Decides whether the machine may operate and under which standing conditions, and produces the release manifest.

Part IV hands forward a release manifest and the premises it could not close. The manifest binds the evaluation record, the fault records, the placement record, and the authority record into claims with a verdict (unconditional operation, conditional operation, or refusal) and standing conditions that revoke it. What the evidence could not settle passes to The Epistemic Frontier, where each open premise enters a residual-claims register with its missing observable, its restriction, its owner, and the test that would close it.