RLSOK Cloud keeps robot dispatch local.

The cloud control plane stores release identity, approval, revocation, short-lived permits and evidence. It never connects to DDS and never commands a robot directly.

Control path

ExecSpec
→ Check
→ Approval bound to content hash
→ Permit bound to release + action + device + controller
→ Local Execution Gate
→ Evidence
→ Revoke / inspect

Fail-closed rules

• Unknown, changed, unapproved or revoked releases cannot issue permits.
• Permits expire within 60 seconds and can be consumed once.
• Every binding must match at consume time.
• Database and API errors deny the operation.
• The local gateway performs the final pre-dispatch check.

Evidence

Evidence records the release, permit, decision and whether a hardware signal was sent. Entries form an organization-scoped SHA-256 chain. Cloud storage does not constitute functional-safety certification.

Deployment boundary

• Vercel hosts the public Web and authenticated server-side proxy.
• The VPS hosts Fastify, PostgreSQL, Caddy and daily local backups.
• PostgreSQL and the API have no direct public port.
• Caddy is the only public entry point to the VPS API.