Agentic safety is now measured the way capability is measured, by running a system against situations and scoring how it behaves: did it decline the unsafe instruction, did it notice the person nearby. That measurement is necessary and it is not the whole answer, because a pass rate is a statement about the episodes that were run. A certificate is a different kind of statement. It names the region of the world where the machine provably stays viable, the action that holds it there, and what holding it costs. The two answer different questions and a deployed system wants both.
Neither replaces the other. A benchmark covers situations nobody could formalise, including the ones that matter most in a home or a workplace. A certificate covers every state in a named region, including the ones nobody thought to test, and it fails loudly by shrinking the region rather than quietly by scoring well on the wrong sample.
Behaviour on a corpus of situations, scored consistently, comparable across systems and across time. It reaches the messy and the social, where no model of the world is available to prove anything against. It is how a field finds out that a class of failure exists at all.
A guarantee quantified over states rather than episodes, with the scope written down. It converts a good score into a claim with an edge on it, and it forces the awkward question a pass rate can leave alone: what exactly is the set of worlds this holds in, and what happens at the boundary.
If a system cannot state these, it has a demonstration rather than a guarantee.
Region
A certificate is stated over a named set of states, not over a sample of episodes. Outside that set it says nothing, and saying so is part of the result. The region is the honest scope of the machine.
Recover
A fence is only real if some action returns the system inward from it. The certificate carries that recover with it, and the recover is checked at the boundary, not assumed.
Worst case
The quantity is the worst outcome over every state in the region under the worst parameters allowed, because a single irreversible event is not averaged away by a good day.
Cost
Time and joules to return to the working set. A guarantee with no price attached cannot be compared against anything, and on a battery the price is the design constraint.
The work runs on the SO-101, a low-cost open arm, using its published CAD-derived model with real inertials, joint limits, servo torque ceilings and backlash, inside the Institute's open physics engine. The fault injected is the one that drops real machines: a corrupt command latched for a few hundred milliseconds. Each barrier is certified as a worst case over adversarial entry states, under the worst corner of a randomised envelope of mass, friction, latency and deadband.
The tool must not be driven through the table the arm is bolted to.
2.9 cm clear
Worst case over 480 adversarial entry states at descent speeds padded to 1.35x, under the worst corner of the reality envelope. Every state re-converges to the working set within 0.9 s and 6 J.
No link may approach a hand placed in the workspace.
5.0 cm clear
Worst case over 600 adversarial entries approaching at up to 1.30 m/s. Re-converges within 0.75 s and 5.1 J. The retreat curves around a person, so a one-dimensional braking bound is the wrong tool here and a geometry-faithful worst case is the right one.
The wrist and tool must not fold back onto the base and shoulder.
2.2 cm clear
Worst case over 320 adversarial fold-onto-self entries. This one certifies without a region restriction, because opening the arm increases clearance monotonically, so the local outward condition holds everywhere.
Against the same injected fault, executing the command as given drives the tool through the work surface in 93 of 140 one-shot episodes. With the barrier arbiter in place the same fault produces no strike in 140 of 140, and the arm recognises the excursion, retreats and resumes its task. With a person's hand added to the workspace, the unguarded arm strikes something in 57 of 112 episodes, including the person 16 times; the arbiter that arbitrates between the table, the person and the arm's own body produces no strike in 112 of 112.
The same pattern holds for refusal. Parked under a shelf, a reactive retreat strikes on every attempt. Certifying the deepest position the retreat can still escape from, and refusing any command that would go past it, turns 96 strikes out of 96 into none, with every episode recovered. The expensive analysis runs once, offline. What runs on the machine is one forward-kinematics evaluation and a comparison.
These transfer beyond the arm they were measured on.
The first fence we drew was provably too thin: the closed-form braking bound was 8.9 cm against a 3.5 cm margin. A body with momentum cannot stop at the line, so the fence moved out to the distance the machine actually needs. Refusal before the edge is the braking distance made physical.
Built as a contraction condition, always move toward the safe pose, the guard vetoed 386 of 400 steps and the robot did nothing. Safety that freezes is its own failure. Built as set invariance, veto only what leaves the region, the task runs free inside and the guard intervenes about 8 times in 400, only during the fault.
Standing up is the right answer to a falling torso and the wrong answer next to a person, because standing swings a limb outward. Constraints that point in different directions each need their own recover, and the arbiter has to recognise which one is binding.
We expected joint limits to be the danger and measured that they are not: a torque-limited, damped, position-controlled arm physically cannot slam its own stops during a glitch. The real irreversibility was the tool going through the table, which is invisible to a joint-limit checker. Instrument before choosing what to guard.
Parked deep in a slot under a shelf, the reactive retreat that certified the open table strikes the shelf every time, because home is on the far side of an obstacle. A safe motion exists, so the pocket is not inescapable, but reaching it needs a planner. Where free space stops being locally exitable, the honest move is to refuse to go there.
Clearance is Lipschitz and the outward condition at the boundary is velocity free, so both are sound given a spatial pad. What remains sampled is which states the fault can actually deliver the machine to. Characterising that reachable set is the one honest gap between this and a closed-form proof.
Naming this is part of the method.
The results above are for a bolted-down arm, whose own torque limits protect its joints. A walking machine has no passive safe state and its whole body is in contact with the world. Our engine resolves every contact on a free-floating body in one solve. That was the blocker until recently: the direct solve is exact for a body at rest but does not converge once several feet are driven by a gait, and an impulse that solves nothing cannot carry a guarantee. A sweep-based solver now handles those cases, staying bounded where the direct one reached a hundred metres per second. The physics a legged certificate needs is in place; the certificate itself is the next piece of work.
The remaining sampled ingredient is which states and approach speeds a fault can actually produce. Bounding that set is what would make the arm's table and pocket results closed form, as the self-collision result already is.
Everything here is computed against a CAD-faithful model, not a physical arm. System identification collapses the envelope onto a real machine when one is in the loop, and tightening the envelope both shrinks the fence and enlarges the workspace the machine may certifiably use.
The engine, the arm model, the barrier arbiters and the certifiers are open and installable, and the physics they rest on is public work. Anyone can re-run these numbers, disagree with the envelope, or point the method at their own machine.
The physics engine is ferromotion, a pure-Rust stack that also compiles to WebAssembly, so the same verified solvers run in a browser page on the device in front of you.