A Million Compiles. One Robot Hour.
Four motion segments ran on observations that were 600 ms old. Repair the Rust gate, rebuild in a fresh workspace, and check what the robot actually does.
A software-in-the-loop demonstration. Recorded evidence, inspectable source, no physical robot.
The same 600 ms observation age produces two different decisions. The contract requires zero task dispatches when the observation is too old.
The missing freshness check permits all four segments. The cube lifts, even though the decision violates the policy.
age 600 ms PERMIT × 4
approach / descend / grasp / lift
cube_height 0.9985 m
Inspect the seeded episode
The repaired gate rejects the first stale proposal at tick 12. No task segment is dispatched.
age 600 ms REJECT reason StalePerception dispatches 0Inspect the patched episode
With fresh observations, the same patched executable permits the motion and lifts the cube. Replay the fresh case
These are observations from the recorded Linux run, not live results from this browser.
Every candidate needs fresh validation. The architecture keeps the temporary workspace separate from the compilation service and retained evidence.
Execution today: EC2-backed Linux workspaces on the Incredibuild grid. Target runner provider: islo. The checked-in workflow does not call islo or destroy EC2 instances.
Observation age is simulation time minus capture time. The bridge advances at 20 Hz and requests authorization before each motion segment. A segment can contain several physics control steps. Build duration and protocol timeouts use wall time. This is not continuous control-step supervision.
The conference path keeps policy and proof in Rust. The simulator boundary stays narrow and explicit.
EC2 proof command:
scripts/robot-demo/ec2-agentic-physical-ai.sh <run-id>
The complete rehearsal retains the failure, applies a bounded candidate patch, rebuilds, and executes the checks on the resulting binary.
Workspace A builds the seeded gate and records the wrongly permitted stale episode.
Export the work order and base revision. Restrict the candidate patch to the gate implementation.
Remove A’s workspace. Apply the patch to the recorded base in B with fresh Cargo outputs.
Run the contract tests and full scenario matrix. Export the executable and verify its evidence.
The automated rehearsal uses the reviewed fallback patch by default. An externally produced agent patch can be supplied explicitly; the script does not run an LLM.
The same loop serves systems research, agent research, and physical-AI work. A behavioral claim is worth exactly as much as the run that reproduces it.
Five cube placements and three observation ages, plus simulated stop and protocol timeout. The table is generated from the committed scenario results.
Recorded Linux run: ec2-e2e-20260923-160725
| Cube placement | 0 ms | 50 ms | 600 ms |
|---|---|---|---|
| Center | Lifted54 ticks | Lifted56 ticks | Rejected12 ticks |
| Left | Lifted52 ticks | Lifted53 ticks | Rejected12 ticks |
| Right | Lifted56 ticks | Lifted59 ticks | Rejected12 ticks |
| Near | Lifted55 ticks | Lifted57 ticks | Rejected12 ticks |
| Far | Lifted55 ticks | Lifted55 ticks | Rejected12 ticks |
Additional cases: simulated stop → emergency_stop; bridge stall → timeout. Total: 10 lifts, 5 stale rejections, 1 stop, 1 timeout.
Empty workspace · plain cargo
11,515 msa fork, a CI runner, an agent loop — the cold build you pay per candidate
Empty workspace · Build Cache
3,706 ms3.13× faster · 52 of 52 compilations served from cache
Five samples per mode, rotating order, one machine, zero helpers — cache only, no distribution. The counterweight: when the target directory is KEPT, plain cargo takes 939 ms and the Build Cache 4,048 ms, so cargo wins by 4.3×. The cache does not make your build faster; it makes throwing your workspace away cheap. Both rows are in the evidence.
The historical run reported 10/10 Rust gate tests, which is still current. Its 88-of-88 verifier count is not: today's protected verifier reports 17 scenarios. The archived 21.426 s / 21.948 s pair was never a cache benchmark and is not presented as one.
This demonstrates Rust contract checks and simulated robot behavior. Cube positions come from simulator state. The 250 ms threshold is an illustrative policy. Physical robots, hardware-in-the-loop, trained vision, continuous emergency-stop supervision, and cross-machine cache sharing remain outside the demonstrated scope.
Every figure below was measured on one machine and the evidence is committed, so a clone can re-derive it. Three numbers here replaced numbers we withdrew; the corrections ship with the measurements that forced them.
The distribution result was negative and is published beside the cache result. Cross-machine cache sharing is not demonstrated.