The Repair List

The essay before this one ends with a defect list. A list of defects with no plan under it is a confession, not engineering. This is the plan.

It covers 62 items across the registry, the protocol, the robot runtime, the gateway, the phone and pendant apps, PlatAtlas, PlatChat, the governance documents and the session recorder. Every item was checked against the code before it went on this list: the file exists and the function does what the item says. Most carry a test that fails today and passes after. A handful are documents or a fact to settle, and those say so in their own row rather than pretending to a test. Thirty-eight of the 62 are things the essay already told you about. The rest turned up while checking those.

One rule governs the whole thing. The essay does not get edited until the fix is deployed and re-tested against the live system. When a sentence in the essay stops being true, it gets a dated correction, not a quiet rewrite. The status log at the bottom of this page is where that happens.

How to read this

Each item has a priority. I am using four, in plain words.

• P0 means a door is open or a stop lies. An endpoint that hands out a credential to anyone who asks, a local service that starts an agent turn without a credential, or a stop button that reports success without stopping anything. Thirteen items.
• P1 means a record or a public claim that the code contradicts. Thirty-five items.
• P2 means documents, labels and dead code. Eight items.
• P3 means longer builds, or things that need someone other than me. Six items, three of which are phase six.

Each item also has a check you can run from outside. For a live service that means a status code or a published document. For code that runs only on my own hardware, there is nothing to poll, so the check is a dated line in the log and a link to the public commit. I would rather say “nothing observable, here is the commit” than pretend a private fix is a public one.

The order

Six phases. The first is a week. The last cannot be finished by me.

Phase one: close the doors, then make the stop real. Every P0, in one week. First I settle whether pushing to the registry’s repository actually publishes it, because a credential fix that silently fails to deploy is worse than no fix. Then the registry’s agent credential endpoints refuse callers with no valid credential, the keyless token signer is deleted, the open registration endpoint for signing authorities gets a cap, and the compliance record endpoints check who is asking before they answer or accept. On the evidence platform, only an administrator can mint an administrator key, and the granted scopes go into the audit record. On the robot side, the runtime’s fleet endpoints require the caller’s own credential instead of supplying one, an unconfigured robot refuses privileged commands instead of trusting everyone (on the hand-started path that the setup command never produces), and the benchmark helper that can start an agent turn gets a front door and a ceiling on how many children it can start. Then the stops. Every deployed robot exposes a stop, and the gateway logs a named error at start when a motion allowlist has no stop in it. The handheld pendant says stop-not-confirmed when it cannot stop, and reconnecting no longer clears a latched stop. The robot’s own safety stop reaches the motors and survives a restart. It is a best-effort software hold, not a hardware cut, and the tool that exposes it says so. And the cloud stop, the fleet stop and the phone stop only say acknowledged once the robot has actually received the command. The cross-registry safety exemption narrows to the stopping verbs, so a remote safety message can still stop a robot but can no longer resume one. Phone commands that change a robot’s settings travel through the server path that checks the owner and the pace. An unconfigured robot refuses investigator requests instead of accepting all of them, and files its own incidents from safety events instead of waiting for a hand. Last in this phase, each installation seals its own log with a key created at install time.

Phase two: make the evidence say only what it can prove. This is PlatAtlas and PlatChat, in a strict order. The write key that pushes evidence loses the ability to delete it (that one is in phase one, because it has to land before anything below). Both chat orchestrators run their model child with a short, explicit tool list and treat the channel transcript as data rather than as instructions (also phase one). Then the evidence chain publishes a head, so that truncating the newest entries contradicts something a reader already holds, and the offline checker learns to demand that head. The two compliance controls the code cannot back, anomaly detection and incident response, come out of the crosswalk. The label vocabulary that producers were choosing for themselves closes. An action’s own approval stops reading as a human approval, refusals get recorded and signed the way approvals are, and the checker recomputes a pack’s summary numbers instead of trusting them. A paused chat hub stops spending on its scheduled work instead of only refusing to post, and creating a channel becomes a gated, audited act. Pausing still tells no robot to stop, and the essay’s paragraph about it narrows rather than disappears.

Phase three: make the register countable, custodied and singular. The counting test the essay ran on its own register, closed. This is about whether the register can be inspected, not about anyone outside having done it. The register can count and page through its whole corpus. A facts page states what the register actually holds, with numbers that match the public interface, and the line telling regulators and insurers they can rely on the record comes down. A weekly signed snapshot goes off the account with a publicly pinned head, and the root signing key moves out of the storage namespace that a bulk delete empties. The transparency log gets real digests, a link from each entry to the one before, and a signed head. The root node publishes its keys or stops advertising what it cannot do. The older registry stops auto-granting a verification tier for any string that parses as a URL, and one identifier stops having two authoritative answers.

Phase four: records that can be contradicted, and keys the agent cannot read. Gateway receipts carry the caller’s identity and record a refusal as a refusal. The gateway writes what it is about to do before it does it, which is the protocol’s strongest sentence, finally implemented. The gateway’s records get a sequence number and a link to the previous record, and a copy leaves the robot. A published revocation reaches the robot inside the interval the registry advertises. The one request cap that actually runs fails closed and covers the arm. Unknown tools are denied by default. And one privileged command, run after setup rather than during it, moves the signing keys and the device out of the reach of the account the agent runs as. Setup itself stays inside its time budget and prints the one command that remains.

Phase five: formats other people’s tools can read, then the subtraction pass. A declared safety flag in a robot description reads as a declaration, not a verified fact. The protocol names which robot-to-robot channels are sanctioned, so that “unsanctioned” means something. A stop receipt gets published as a format with a verifier in both SDKs, so a third party could check a claimed stop without me. That one needs merge authority on a specification I do not own, and until a gateway emits one the schema will say plainly that nothing ships it yet. Evidence packs count stops ordered and stops confirmed separately. Then the honesty pass on my own documents: the gateway readme stops promising an enforcement guarantee, the canonical disclaimer gets reworded everywhere it appears, and the dead code that documents a relay gets deleted. This runs last on purpose, after the code has changed what is true.

Phase six: what one operator cannot close. Three items ship their half now and publish the gap plainly. A revocation procedure with notice, appeal and an error register, with the separation-of-duties role marked vacant until a second person holds it. A published monthly cost, a plain statement that no company has committed funding, and one real public deposit of a signed snapshot. And a chain head signed on a schedule by a key the platform does not hold, labeled producer-signed until a second custodian signs it.

Rules I am holding myself to

A few of the ordering rules came out of the review, and these are the ones a reader can hold me to.

1. The registry’s deploy path is confirmed before any registry commit is pushed.
2. The evidence delete path is closed before a chain head is published. A head that a deleter can still walk back is theater.
3. The gateway’s records are not copied off the robot until the place they land cannot be emptied by the same class of credential that wrote them.
4. The closed label vocabulary is agreed with every producer before the storage constraint that enforces it is applied, or the constraint rejects their records.
5. The essay is edited per item, after that item is deployed and re-tested live, never before.
6. One app release per app per working session. The phone work goes out as two builds, not a stream of them: the stop and command-routing fixes in one, the receipt and approval fixes in the other. The pendant is not an app and ships on its own.

What I cannot do alone

The essay asked for three things. The review turned them into eight, and I would rather list all eight than pretend the plan closes them.

1. A second person to hold a key that is not mine. Until then, key custody is one person on separate hardware, and every page that touches it will say exactly that.
2. A second operator willing to register one robot and run the setup on their own hardware, then tell me where the verification ladder and the ten-minute setup break.
3. Someone in a regulator’s office or a standards body willing to run the open checker against one bundle or one evidence pack and report what it does not answer.
4. An escrow agent, or any independent party, willing to hold signed snapshots under an agreement.
5. A legal entity that can be served, with governance that is more than one seat.
6. Merge authority on the normative protocol sections, which live in a repository I do not merge into. Every affected item ships its local half regardless and files the upstream proposal.
7. Agreement from the other producers on the closed label set before the storage constraint goes in.
8. Apple’s review queue, for the two app releases in this plan.

What will and will not change in the essay

Most of the defects the essay names will get a dated correction as their item ships. A few will not change from this plan alone, and I want to say which.

“No third party has ever registered a robot” and “nothing in my records shows a bundle verified by anyone other than the party that produced it” stay true until one of the people above acts. The plan makes both possible. It cannot make them happen.

“That enforcement is off by default,” about the roster gate that refuses unregistered agents, stays true on purpose. The fix arms it for my own organizations and leaves the shipped default alone, because a default that refuses strangers’ agents is a decision for the person deploying it, not for me.

“Sole custody of the root log-signing key, the administrative revocation token and the credential signing key” narrows but does not go away. After phase four the keys are out of the agent’s reach on any installation where that command has been run. They are still in one person’s custody, and no sentence here will be rewritten to imply two.

How to hold me to this

The table below has one row per item, in the order above. When an item ships, its row gets a date and a link to the commit or the public artifact, and the check column says what you can look at. If a date slips, the row will say so. If I learn that an item was wrong, it comes off the list with a note, not silently.

If you want to run any of the checks yourself and something does not match what this page says, email me. That is the third-party verification this whole thing is missing, and I will take it from anyone.