CHECKPOINT
model checkpointtrained model stateTHE DISPATCH THRESHOLD
Only approved robot policies reach real hardware.
Shadow-first release control for learned robot policies in ROS 2.
RLSOK binds the exact release content, controller configuration, approval identity, time-bounded Permit, runtime policy, and test evidence before the configured local ROS 2 controller path.
Requests that fail release checks do not reach the configured controller adapter.
An accessible spatial model of a content-bound release assembled from artifact, transform, contract, target, and authority layers. The default example contains a received content hash mismatch. The RLSOK Dispatch Threshold closes and the configured controller adapter remains unreached.
RELEASE ASSEMBLY
RLSOK DISPATCH THRESHOLD
CONFIGURED CONTROLLER ADAPTERNOT REACHED
EXAMPLE DATANOT PRODUCTION TELEMETRYBLOCKED
- release_id
- rlsok-shadow-demo-001
- approved_hash
- sha256:8f4a2b9…d17e
- received_hash
- sha256:8f4a2c1…912a
- device_id
- ur5e-lab-03
- controller_id
- joint_trajectory_controller
- decision
- BLOCKED
- reason
- CONTENT_HASH_MISMATCH
- configured_adapter
- NOT_REACHED
- hardwareSignalSent
- false
INITIAL USER
For robotics teams moving learned policies from simulation into ROS 2 deployment workflows.
The initial fit is a team with learned or autonomous policies, multiple artifacts or configurations, and a need to reproduce release identity, approval, revocation, or expiry decisions before hardware connection. Not every ROS 2 project needs this boundary.SIMULATION-TO-REAL WORKFLOW
REPRODUCIBLE RELEASE IDENTITY
DECISIONS INSPECTED BEFORE HARDWARE
CONTENT-BOUND RELEASE
A checkpoint is not a robot release.
A checkpoint contains trained model state. An executable release also depends on the artifacts, transformations, target identity, approval, Permit, and runtime policy required for local execution.EXECUTABLE RELEASE
- model checkpoint
- content hash
- normalizer
- preprocessing
- postprocessing
- joint mapping
- device identity
- controller configuration
- approval record
- execution Permit
- runtime policy
ONE CONTROLLED PATH
One release identity. One continuous decision path.
RLSOK provides a fail-closed reference execution path.ExecSpec
Binds the content and configuration that define an executable release.
REFERENCE SHADOW MODE
Evaluate the proposal. Leave the controller path untouched.
Reference Shadow Mode evaluates policy proposals using the state inputs available to the local Gateway, without controller dispatch.
- result
- POLICY PROPOSAL EVALUATED
- controller_dispatch
- NOT ATTEMPTED
- evidence
- RECORDED
- hardwareSignalSent
- false
EVIDENCE
Record what actually happened.
RLSOK Evidence is hash-linked, verifiable, and tamper-evident. It records the release decision and the execution facts observed by the reference path.EXAMPLE DATANOT PRODUCTION TELEMETRY
DECISION BLOCKEDThe mismatch resolved immediately to a blocked release decision.
- release_id
- rlsok-shadow-demo-001
- approved_hash
- sha256:8f4a2b9…d17e
- received_hash
- sha256:8f4a2c1…912a
- Permit
- permit-shadow-0042
- device_id
- ur5e-lab-03
- controller_id
- joint_trajectory_controller
- decision
- BLOCKED
- reason
- CONTENT_HASH_MISMATCH
- hardwareSignalSent
- false
- previous_hash
- sha256:10d9ab7…44c0
- evidence_hash
- sha256:d3c229e…a701
RESPONSIBILITY BOUNDARY
Release control is not functional safety.
RLSOK determines whether a specific release is eligible for the configured controller path. RLSOK does not determine whether the resulting physical motion is safe.RLSOK CONTROLS
- release identity
- content binding
- approval state
- Permit validity
- target device and controller checks
- local dispatch checks
- execution Evidence
REMAINS INDEPENDENT
- E-stop
- safety PLC
- motion planner
- certified controller
- controller limits
- mechanical safeguards
- site operating procedures
- independent hazard analysis
SHADOW EVALUATION