Running the Machine
the warehouse mobile manipulator drives down an aisle, its navigation camera catches a person stepping out from the rack end ahead. The chunk policy’s next proposal still carries the base forward, and the permission path must decide whether the observation behind it is still fresh and whether the remaining clearance permits that motion or only a stop. The decision has a deadline, and no better proposal helps once the machine has crossed its braking margin. Running a physical AI machine means reconciling the timescales of sensing, planning, and actuation with that physical deadline. Human goals may change over seconds and trajectories over tens of milliseconds, while the permission loop, in one implementation, runs every millisecond. The required rates and response times come from the plant and its measured delays, not from the names of the levels.
Principle 1: Proposal is not permission
Implication: Every runtime stage serves one decision, whether this proposal can cross the causal boundary before the margin runs out. Stages ahead of the permission path deliver evidence with its age and uncertainty attached, the permission path runs on resources that learned workloads cannot delay, and any guarantee the path offers, such as a barrier filter’s, holds only while its model, state estimate, actuator authority, and deadline hold.
Part III follows the machine’s proposals, trusted no further than Part II’s evaluation record allows, through six stages. The base’s run to the rack end and the arm’s reach for the mug travel as one whole-body chunk stream under one chunk lease. Each proposal in that stream passes through four stages that build it, one that decides whether it may act, and one that keeps that decision on time.
- Sensor Perception (Sensor Perception): Decides whether a measurement is current and calibrated enough to use, and produces the observation contract, which dates each measurement in a clock the permission path can convert to its own.
- Spatial Memory (Spatial Memory): Decides how long an estimate may stand without fresh evidence, and produces the spatial belief record, which keeps the age of the evidence separate from the age of the estimate.
- Grounded Intent (Grounded Intent): Decides how a human goal becomes a bounded, expiring request, and produces the intent lease, which grants a target and effort ceilings but never a path.
- Trajectory Planning (Trajectory Planning): Decides when a trajectory may commit, and produces the trajectory record, which carries its deadlines and a matched stop suffix.
- Safety Enforcement (Safety Enforcement): Decides on every tick whether a proposal is admitted, projected, or refused (the first projection on the machine slows the arm’s fast latch approach to the guarded speed that Part II’s target ODD covers), and produces the enforcement record, where the two strands of records meet.
- Silicon Placement (Silicon Placement): Decides where the permission path runs so that learned workloads cannot delay it, and produces the placement record, which names the test that would support it.
Part III hands forward the runtime evidence that Part IV must judge. Observation contracts date every measurement, belief records expire, intent leases and trajectory records name their parents and their deadlines, and the enforcement record states the stopping envelope and the premises of each guarantee. Its finished stopping budget sets the speed at which the machine may run the aisle and leaves a spare of clear distance, the whole allowance for error in its inputs, for Part IV to spend (Stopping Envelopes). The placement record names the loaded test that would show learned workloads cannot delay the permission path (Testing the Separation), and on this machine its loaded field is still empty. Each record is a claim with conditions, and none is yet a license to operate.