RLSOK

Release control for learned robot policies

Only approved robot policies reach real hardware.

RLSOK prevents the wrong learned-policy release from reaching the wrong robot.

A fail-closed reference execution path for content-bound releases, short-lived permits, local dispatch checks, and hash-linked evidence.

Request a Shadow AuditRead the architecture
  1. 01ExecSpec
  2. 02Check
  3. 03Approval
  4. 04Permit
  5. 05Execution Gate
  6. 06Evidence
EXAMPLE DECISIONreleasegate / check00:00:00.042
REFERENCE TRACEContent identity check
INPUT
release_id
rlsok-shadow-demo-001
approved_hash
sha256:8f4a2b9…d17e
received_hash
sha256:8f4a2c1…912a
device_id
ur5e-lab-03
controller_id
joint_trajectory_controller
REQUESTRELEASEGATEADAPTERNOT REACHEDINPUT MOVES SMOOTHLYDECISION RESOLVES IMMEDIATELY
decisionBLOCKED
reasonCONTENT_HASH_MISMATCH
hardwareSignalSentfalse

Example data only. This is not live production telemetry.

01 / RELEASE IDENTITY

A checkpoint is not a robot release.

You tested one combination. Your team deployed another.

LOOSE DEPLOYMENT DIRECTORYUNBOUND
  • ├── policy_weights.ptsha256: 8f4a2b9…
  • ├── normalizer.jsonversion: 17 ≠ tested: 16
  • ├── action_map.yamljoints: 6
  • └── controller.yamlros2_control

The model may be correct while its normalizer is not. That is a verifiable configuration mismatch.

EXECUTABLE RELEASECONTENT-BOUND
kind: ExecutablePolicy
metadata:
  releaseId: RSP-0x8A2C
robot:
  controllerConfigSha256: 54d3…77ab
deployment:
  allowedDeviceIds: [ROBOT-02]
contentHash: 8f4a2b9…d17e

ExecSpec binds policy content, controller configuration, action semantics, and target device identity into one release object.

02 / SYSTEM BOUNDARY

Control the release. Keep safety systems independent.

RLSOK / IS NOT×
  • Functional-safety software
  • An E-stop or safety PLC
  • A motion planner
  • A certified hard real-time controller
  • A direct cloud-to-robot control channel
RLSOK / IS01

A fail-closed reference execution path for release identity, approval, permit consumption, revocation, and evidence.

Final checks happen locally before ROS 2 controller dispatch. A blocked request does not reach the configured controller adapter.

03 / REFERENCE SHADOW RUN

Evaluate real policy proposals without controller dispatch.

Observe release identity, bindings, and decision outcomes without changing the controller execution path. Shadow Mode makes no claim of safe deployment.

hardwareSignalSent
false
controller goal count
0

EXAMPLE DECISION — recorded facts from a reference trace, not live production data.

PROPOSAL TRACE / EXAMPLESHADOW
  1. 001RSP-0x8A29ALLOWrecord only
  2. 002RSP-0x8A2ABLOCKdevice mismatch
  3. 003RSP-0x8A2BBLOCKpermit expired
  4. 004RSP-0x8A2CBLOCKhash mismatch
EVIDENCEGOAL COUNT 0

04 / DECISION EVIDENCE

Record what actually happened.

Each record includes the release, decision, device binding, and whether a hardware signal was sent. Hash-linked records provide a tamper-evident, verifiable engineering audit trail.

EXAMPLE RECORD00412
release_id
RSP-0x8A2C
decision
APPROVED
evidence_hash
8f4a2b9…d17e
previous_hash
91ab03c…7e20
EXAMPLE RECORD00413
release_id
RSP-0x8A2C
decision
BLOCKED
evidence_hash
19c0e72…a84b
previous_hash
8f4a2b9…d17e
EXAMPLE RECORD00414
release_id
RSP-0x8A31
decision
SHADOW
evidence_hash
a50c19d…082f
previous_hash
19c0e72…a84b

RELEASE-CONTROL BOUNDARYThe cloud governs eligibility. The local gateway retains final dispatch authority.

Request a Shadow Audit