The synthesis · one idea, every boundary

The Certificate Doctrine

What makes a body an agent and not a puppet is not how smart it is — it is that before it commits an action, it checks that action against a machine-checkable proof it will not breach a boundary it must hold. That proof is a certificate. This is the whole doctrine in one place: one idea, one shape, every boundary — and the discipline that makes it a doctrine and not a demo.

Charlot Lab, Institute for Physical AI @ BMI · the reading order for the certificate papers

Draft · 2026-07 · a map over One Energy, Both Roles · The Grasp Certificate · The No-Harm Certificate · The Agency Ladder

1 · The one idea

Draw the axis of intelligence — how well a system predicts, plans, reasons — and then draw a second axis, perpendicular to it: agency, how well a body maintains its own viability against disturbance, on its own power. A chess engine is far out on the first axis and at zero on the second; a thermostat has a little agency and no intelligence. They are independent. Physical AI is the project of the second axis, and its atom is this: an agent is a body that, before each action commits, checks the action against a guarantee it will not cross a line it must not cross. A puppet acts and hopes; an agent acts only through a gate. The certificate is that gate, and holding your own boundary through it is what agency means.

2 · The one shape

Every certificate in this body of work is the same object. Let $V$ be a natural non-negative safety function — the energy the body descends, a friction-cone margin, a stress below yield — that is zero or negative exactly on the safe side of the boundary. A fully-actuated body's own passive energy already obeys $\dot V = -\dot q^\top K_d\,\dot q \le 0$; the certificate turns that structural fact into a decision. At each step the body predicts the next state under a candidate action and admits it only if the safety function stays inside the safe set — otherwise it falls back to a shaping or damping action that provably does:

Three things make it a certificate and not a heuristic. It is checked on the predicted next state, before commit — not reacted to after. The buffer $c$ is sized so the safe set is control-invariant under the body's real torque limits (a trigger threshold strictly inside the true boundary). And the fallback is a provable retreat, so refusing is always available. State this once; it recurs unchanged for every boundary below.

3 · The boundaries: self, object, others

A physical body must hold more than one boundary at once, and the same shape certifies each — differing only in which safety function $V$ names.

The force certificate carries a lesson the others echo: sometimes the answer is not "try harder." A two-finger pinch collinear on the grip axis is not force closure at any grip strength — its grasp-wrench space is rank-5, $Q=0$ — so the certificate is a design-time verdict: change the grasp, add a contact. The no-harm certificate says the same to a fragile object: past a point you must change the geometry (spread the contact patch below the yield stress), not the force. A certificate that only ever says "push harder" is not a certificate.

4 · Holding them at once

A body does not meet these boundaries one at a time. Lifting an object, it must in the same instant not drop it (grip hard enough), not crush it (grip gently enough), and not destabilize its own arm (move within the energy bound) — and these pull against each other, because gripping harder to lift faster is exactly what crushes a fragile thing. So the agent's admissible action is the intersection of the safe sets, and an agent is precisely the thing that acts only there. On a lift task over a population of objects (mass 0.1–0.6 kg, yield stress 20–300 kPa):

Each single-boundary agent keeps its one promise and breaks the others — none is an agent; each is a controller for one variable. The joint arbiter acts only in the intersection: it grips in the window between slip and crush, lifts no faster than the tighter of the crush and energy limits allow, and when the small contact leaves no window it escalates the geometry (a wider pad raises the crush ceiling) before it gives up. What is genuinely infeasible — too heavy and too fragile on the widest pad — it refuses, and it names which boundary bound the decision (here the energy limit on 87% of lifts, the crush limit on 9%). That is the step from a pile of guarantees to one agent.

5 · A shield around any policy

Because the certificate is a gate and not a driver, it composes with whatever proposes the action — a hand-tuned law, a planner, or a half-trained neural policy exploring at random. Before an action commits, the shield checks it against the barrier and, if it would breach, substitutes the provable fallback. On a torque-limited reach toward a wall — the barrier is the braking distance $v \le \sqrt{2\,u_{\max}(x_{\text{wall}}-x)}$, the same barrier that keeps a real arm clear of a person:

Every policy, behind the shield, crashes zero times — that is safe deployment (drop any policy behind the certificate) and safe learning (explore at random and never breach). And the shield promises exactly one thing, and says so: it guarantees the safety boundary, not the task. The made-safe PD reaches the goal every time; the bang-bang policy stays safe but never settles; the random one stays safe but rarely finishes. Safety is orthogonal to skill, as agency is to intelligence — the certificate supplies the first and leaves the second to the policy. It is what makes the doctrine future-proof: however the field learns its controllers, they can be dropped behind the same gate.

And the gate composes not just with a finished policy but with the act of learning one. Train a genuinely learned controller — a network optimised by reinforcement from reward alone, with nothing about safety in the reward — and reward-only training explores into the boundary tens of thousands of times (here 30,886 wall strikes), the failures a sim-trained policy is simply assumed to absorb. Run the same training behind the shield and it commits zero, from the first generation, while reaching the goal exactly as often. That is safe reinforcement learning as a proof, not a reward hack — the frontier's own headline artifact, a learned policy that does the task, carrying the one guarantee the scaling play cannot put on it: no violations, from the very first step of learning.

The same gate wraps a world-model planner, the field's other headline — imagine rollouts in a learned model, score them, commit the best. But a score is not a certificate. Model error compounds over the imagined horizon, and keeping the best of many imagined plans is an optimizer's curse — it selects the plan the model's errors happened to flatter. So score-only planning drives into the wall at a rate that rises with how far it dreams: 0% at short horizons, 7.6% at horizon 40, 35.6% at horizon 80. The certificate does not care how the plan was scored or how far the dream ran; it checks the committed action against the barrier before it commits, and hits the wall zero times at every horizon. Certify the commitment, not the imagination — the only way a learned model can be trusted to act. (Explore this one live in the certificate-gated imagination sim.)

If the shield is to wrap a policy of any size, the shield itself must stay small — so the question is how small it can get before the guarantee quietly goes, and the answer splits along a line worth knowing. Where the certificate is learned, it behaves like any other network and the stakes are worse. A trained energy that certifies the whole domain, then squeezed afterwards by truncating its weights, falls to a median in the low sixties — which is about what the trivial certificate $V=|x|^2$ scores on the same plant without any training at all. Compression did not degrade the learned certificate; it erased it. Train the same parameter budget in factored form from the start and it certifies 100% of the domain at every rank tested, identically across five seeds, at 16× fewer parameters in the compressed layer. The rule is the one the compression literature reports for policies, inherited here with sharper consequences: train compact, never squeeze — because a certificate that has silently lost coverage still answers, and now answers wrong in the direction that hurts.

Where the guarantee is structural, none of that applies, and a single experiment isolates why. Take one learned residual and wire it into the closed loop two ways. Placed inside the skew coupling — the energy-shaping form where $\dot V = -\nabla V^\top\!D\,\nabla V$ regardless of what the residual says — it cancels out of the derivative identically: the worst $\dot V$ across the domain is −2.8 whether the residual keeps 64 units or is crushed to 1, unchanged to the digit, because the algebra never let it matter. Wire the same residual into the damping instead and the guarantee breaks at every compression level, worst $\dot V$ positive — a body accelerating away from safety. Same network, same compression, opposite outcome, decided entirely by where it was attached. That is the practical dividend of preferring structure over proof, and it reduces to a rule a designer can apply without a theorem: compress whatever the guarantee does not depend on as hard as you like, and treat anything it does depend on as something to train small rather than shrink later. Knowing which of the two you are holding is the whole design decision — and it is what lets the seatbelt stay light while the policy it wraps grows without limit.

6 · From action to task

A certificate on each action keeps the body in the safe set at every step — invariance. But a task is a sequence, and a chain of individually-safe steps need not reach the goal: an agent that only ever takes the locally-safe step toward the goal walks into a concave trap and stalls, safe and unfinished. Safety is invariance; finishing is liveness, and liveness does not follow from step-wise safety. So the certificate rises an altitude — certify a whole plan, a sequence of certified transitions that provably reaches the goal, before committing, or refuse the task when no safe plan exists. On a transport task through clutter where 76% of layouts admit a safe path:

Both are never unsafe — but the reactive navigator completes only ~7% of the solvable layouts, trapped in local minima; the plan-certified agent completes every solvable one and refuses the rest by name. This is the certificate lifted from the action to the plan, and it is what lets an agent promise not just "I will not breach" but "I will finish, or tell you now that I cannot."

And a fourth axis, the one the field is moving into: many bodies at once. $N$ agents crossing to antipodal goals collide at every $N$ when uncertified; when each runs the same braking barrier against its neighbours — decentralized, no central planner, only sensed relative state — they collide zero times at every $N$ tested (up to 12), the closest pair-gap staying positive throughout. Safety is a property each body holds locally, and the local guarantees compose into a safe collective. Throughput is the cost in dense traffic — reach falls from 100% at $N\!=\!6$ to 25% at $N\!=\!12$ as agents slow and yield — bought back by a right-of-way rule. With §4 and §5 this completes the picture: the one certificate composes across boundaries (hold them all at once), across policies (shield any controller), across time (certify the whole task), and across agents (a fleet that never collides). Watch the fleet hold its boundary, live →

7 · Making it survive reality

A guarantee proven against a perfect model is not yet a guarantee in the world. The same certificate is hardened along seven axes, each measured, each with a named cost.

Two rules recur across these. Only bias leaks — zero-mean noise a margin absorbs for free, but a systematic error must be removed, not padded. And a certificate must be verified against the worst case, not the average: a guarantee that holds on ten-thousand random rollouts can still be defeated by one adversarial disturbance, so the barrier is sized to the worst braking authority an attacker can leave it — and then it holds under a full adversarial attack right up to the actuator's own strength, a robustness margin found by attack and by formula, agreeing. And the same self-monitoring reaches inward, to the body itself: an actuator that wears or faults leaves a certificate planning braking it can no longer deliver, so the agent watches how much force each command actually produced, re-certifies against its live authority, and carries a reserve for a sudden loss — holding where a static certificate drives into the wall on nearly any fault. Above it, a certificate must know when it is no longer valid: it monitors its own realized errors and, when the world drifts out from under it, either recalibrates and keeps working or stands down. That is the mature shape of a guarantee — not issued once and trusted forever, but continuously re-earned against the world it meets. And the oldest reality gap of all — that the sim it was certified on is not the body it runs on — the certificate closes by bounding, not matching: certify against the worst body inside a measured model-error envelope and the sim guarantee holds on the real fleet with no real-world data, the margin cost shrinking as the model tightens. Where the field spends data to make the sim match the world, the certificate spends a margin to stay valid across the gap — so the lever is cheap system identification, not mountains of policy rollouts.

The last axis is the one that reaches furthest back, because it questions the input every other guarantee assumes. A certificate is a claim about the world, computed from a state the body did not observe directly but estimated — and sensors do not only get noisier, they get captured. Evaluated on a spoofed state, a barrier does not degrade gracefully; it becomes confidently wrong, reporting safe while the body is already in violation, which is worse than having no certificate at all because the action commits believing it was cleared. Against scattered faults the fix is the familiar shape: give each sensor a soft trust weight from an energy model, then certify the whole plausible set rather than a point estimate, which drives the false-safe rate to essentially zero for a deliberate 20% conservatism. Against a coordinated spoof — one transmitter, so the captured sensors agree with each other — that fix breaks, ours included: the fuser locks onto a self-consistent lie and scores worse than the naive average it was built to repair (36% false-safe against 28%), and the plausible-set margin cannot help because the margin is computed from sensors that all agree. Confidence is not evidence. What survives is refusal — detecting that a rival, internally consistent explanation of the readings exists, and declining to certify at all, which cuts false-safe to under 2% at the price of abstaining most of the time. And the limit past that is named rather than hidden: once the captured sensors are a clear majority the truthful ones look like scattered noise, every pipeline including refusal sits near 34%, and no amount of inference recovers a truth the data no longer contains — that regime needs an anchor the adversary cannot forge, such as sensing on different physics or an attestation, not a better estimator. The doctrinal conclusion is short: a certificate inherits the credibility of the observation it was computed from, and one that cannot say I have no grounds will eventually say safe when it is not. Refusal is not a failure mode of the certificate; it is part of it. None of this is new ground — measurement-robust and fault-tolerant barrier certificates, secure safety filters under spoofing, and perception-based safety under out-of-distribution measurements are an established line2 — what is offered here is the open, readable, on-device version, measured end to end with its own defeat reported. (Watch the failure happen in the certificate under spoofing — capture five of nine sensors with the coordinated adversary and the trust-gated pipeline's false-safe count climbs past the naive one it was built to replace.)

8 · One scoreboard

If agency is a real quantity, it needs a real unit. The Institute scores it in one currency: joules per viability-second — the energy a body spends to hold itself viable for a second under disturbance. It is where the certificate meets thermodynamics, and it separates an agent from a puppet in numbers, not adjectives: on the same task a certified agent held full viability at 57 W where an open-loop puppet bought only 26% of it at 347 W; on a real SO-101 arm, 0 crashes at 0.25 W against a puppet's 36 crashes at 7.47 W. Cheaper and safer is the signature of holding your own boundary rather than being forced to it. The full ladder — from a tree that spends almost nothing to a robot that spends to stay upright — is The Agency Ladder.

And the scoreboard is not only a measure — it is a constraint the certificate enforces. A body runs on a finite charge, and finishing a task means getting to the goal, or back to a charger, before the tank is empty; running dry in the field is stranding, an unpowered and uncontrolled body. So the same shape appears once more, now in the scoreboard's own currency: a barrier on energy-to-safety. At every step the body may go further only while its remaining charge still covers a worst-case trip home; at the point of no return it turns back. A naive agent that drives for the goal and only then heads home strands on 36% of long or into-the-wind excursions; the energy-budget certificate strands zero, completing every task inside the round-trip budget and returning safely with partial progress on the ones beyond it. This makes efficiency capability: the certifiable reach is the battery divided by the worst-case joules per metre, so a body with a better J/VT can promise a larger mission on the same charge — with the familiar catch that an optimistic energy model strands the tail, so the return must be budgeted against the worst terrain, headwind, and charge-estimate error it may meet.

9 · What makes it a doctrine

The difference between a doctrine and a pile of demonstrations is a discipline, held whether or not it flatters the result. Every guarantee here is measured against an ungated or naive baseline on a real or physically-grounded model — MuJoCo bodies, a real SO-101 arm, exact grasp-wrench computations, standard plasticity and viscoelastic models. Every limit is priced: the friction reserve a reactive grip must hold, the throughput a self-repairing certificate gives up, the detection delay before a shift can be felt. And every frontier is named, not hidden — curved and rolling contact, true fracture, a learned fragility estimate on real sensed objects. When a rig produced a number that was an artifact rather than physics, the number was thrown out, not tuned into looking clean. And when a defence of ours turned out to be worse than the naive baseline it was built to repair — the trust-weighted fuser against a coordinated spoof — that result was published as the headline of its own section rather than quietly dropped, and negative results are kept on the same terms as positive ones. A certificate you cannot audit is not a certificate.

10 · Where this sits in the field

None of this is claimed as new ground, and it would be dishonest to imply it. Certificate-based safety for learned control is an active, surveyed area: learned control-barrier and Lyapunov certificates, runtime monitoring and certificate repair, conformal methods for safety, and closest to the energy certificate here, co-learned port-Hamiltonian models with passivity-based safety guarantees (arXiv 2604.26172, 2512.24493) and physics-driven port-Hamiltonian world models (PH-Dreamer, 2605.18303). Around foundation-model policies specifically, preemptive runtime verification and backup-reflex layers are being built right now (SafeVLA, Pre-VLA, AEGIS). What this doctrine offers is not primacy but synthesis and access: one shape shown to run across every boundary a body must hold, measured and priced, and implemented openly and on-device in pure Rust you can read and run in a browser. It is a teaching account of a real and active field, meant to make that field usable, not a claim to have founded it.

Reading order & lineage

1. Start here, then: One Energy, Both Roles and Energy Is the Certificate — the energy certificate (won't diverge) and the before-commit gate all the others reuse.
2. The Grasp Certificate — the force certificate (won't drop), nine slices from rigid friction cones through rolling contact to a deformable body's viscoelastic material.
3. The No-Harm Certificate — the damage certificate (won't harm the object), seven slices from a yield barrier through calibrated perception to a self-monitoring, self-repairing guarantee.
4. The Agency Ladder — the scoreboard: joules per viability-second, the one currency of agency.
5. 1 The human keep-out (no-harm-to-others) certificate is granted on the real SO-101 arm in the Institute's ferromotion research record — the multi-vector arbiter sizing a keep-out fence to worst-case braking distance.
6. 2 Certificates under untrusted observation are an established line, and no primacy is claimed over it: fault-tolerant neural control barrier functions under sensor faults and attacks; secure safety filters under sensor attacks; ATOM-CBF (safe perception-based control under out-of-distribution measurements); formal synthesis of certifiably robust neural Lyapunov-barrier certificates; and measurement-robust control barrier functions. The Institute's bench for this axis is cert_under_untrusted_observation.rs — four pipelines against scattered and coordinated adversaries, 60,000 trials per row.