ExplorRobo
ros2physical-aisafetyrobot-softwarellm-agentsreliabilityhri

The Model Proposes, the Gate Disposes

By ExplorRobo Editorial · · 12 min read

Figures attributed to companies, projects and papers are their published claims. The synthesis, comparisons and judgements below are this author’s analysis. I read the projects’ own documentation and code; I have not run any of them.

Between 6 and 11 October, four separate releases appeared in the ROS developer ecosystem, and they agree on a rule that demo reels do not advertise: the learned model may propose, but it must not hold the state, the parameters or the motors.

The sharpest phrasing comes from the smallest project. QERRA-v2 Classical, a ROS 2 safety middleware, published its seventh Webots demo on 11 October and calls its high-level planner an untrusted proposer: a Python process on localhost UDP that holds zero actuator handles and has no path to the wheels. DialoStack, an MIT-licensed dialogue stack from 6 October, names its principle in one line: deterministic control, probabilistic understanding. Robot Brain, posted the same day, puts it in a boundaries section: it does not trigger motor actions, and perception, control, policy, execution permissions and the e-stop stay with the integrator. knoblog, from 10 October, targets the part of the deterministic layer that changes without anyone touching a model: parameter defaults.

None of this is novel as safety engineering. Simplex architectures and doer-checker designs have drawn that line for decades, and the QERRA author says so. What is new is that the untrusted component is now a language model, and the surrounding machinery is being rebuilt in public by four teams in one week.

What each of them shipped

DialoStack is a ROS 2 dialogue stack for service robots, built for Jazzy from source, MIT licensed, code in a public repository. The flow is plain Python: states, phases, turn limits, confirmation, cancellation, with three pluggable strategies (slot filling, explanation, quiz) and a registry for new ones. The LLM does two jobs only, interpreting the user and phrasing the reply, through an /llm/inference action behind either Gemini or Ollama. Speech runs on faster-whisper with Silero VAD and Piper for streaming synthesis, with the microphone muted while the robot speaks so it cannot transcribe itself. One /dialog/execute_task action carries a task description and returns the filled slot frame as JSON; if you pass no schema, the engine generates one. A BehaviorTree.CPP leaf node wraps the same action. The author’s reason is a field report rather than a preference: wiring an LLM straight into the speech loop was hard to rely on, he writes, because it drifted off task, re-asked things it already had, and never decided the conversation was over. The deterministic core carries 173 unit tests that run under plain pytest with no ROS installed.

Robot Brain is a memory runtime for task experience. It stores episodes with the source of every fact and returns what is relevant when a later task asks under its current conditions. The interfaces are a loopback HTTP API and a Python SDK (register_robot, ingest, recall, recall_memory, feedback), plus a ROS 2 bridge over task-level DDS services. The boundaries are the point: perception, control, policy, execution permissions and the e-stop stay with the integrator, there is no weight training, and missing memory or an unavailable service needs an application-defined fallback. Its best design decision is the feedback call, which records whether the planner used what came back, because recall alone proves nothing about behaviour. Two limits matter: the core is closed, with the repository holding docs, examples and issues while the runtime ships as a compiled package under an evaluation license, and model-assisted steps call Google with your own key.

QERRA Demo 7 tests an authority split that goes beyond the usual command multiplexing. The standard ROS 2 pattern routes planner output through twist_mux or nav2_collision_monitor with watchdog timeouts on cmd_vel, as the author notes; his gate instead runs the proposer in a separate OS process and keeps the actuator handles itself, with every cycle starting from zero velocity. It computes a stopping envelope each tick, d_stop = ceil(v^2 / (2 * a_design)) + margin, which at 2.0 rad/s, an a_design of 0.5 m/s^2 and a 300 mm margin comes to 339 mm. In the recorded run the clearance breach arrived at 337 mm and the gate cut velocity to zero within one 32 ms tick. After a trip it latches, requires a continuous one second dwell of clear readings, and rejects an operator reset while the obstacle is still there, logging the rejection. Every cycle is appended to a JSONL audit log hash chained with SHA-256, 1,485 cycles in that run. The non-claims are as informative as the claims: placeholder deceleration and margin, a single run on a non-RTOS host, an unexplained nine second window where the wheel encoders turned and the base did not translate, and no SIL or PL certification. The code is public, reflex layer under Apache 2.0 and framework under AGPL 3.0 or commercial terms.

knoblog walks a repository’s git history, extracts parameter, gain, threshold and flag defaults from each commit, and publishes what changed with the commit link as a static site, an Atom feed and a changes.json file. Values are quoted from the diff rather than generated, and the optional LLM summary is off unless configured. The worked example is one commit in the Nav2 bringup parameters, and I checked it in the navigation2 repository at commit 04c6ca5 and its parent: inflation_radius moved from 0.55 to 0.7 in the global costmap and 0.7 in the local one, and collision_monitor FootprintApproach.time_before_collision fell from 2.0 to 1.2. The commit is dated 13 December 2023 and its message is “improving collision behavior in MPPI (#4009)”. One commit left the default robot keeping further from obstacles with less reaction lead time, and no changelog says so.

Why the boundary moved

The pressure behind all four is the gap between a demonstration and a shift. Nicolas Sauvage of TDK Ventures made the arithmetic explicit in a contributed piece for The Robot Report on 10 October: at 99 percent success per action, a 100 action workflow completes on the first attempt 36.6 percent of the time, rising to 90.5 percent at 99.9 percent per action and 99.0 percent at 99.99 percent. He flags the assumption himself, that the rates are equal and independent, so this is an illustration rather than a measurement. The direction still holds, and it sits badly with a field that reports per task success.

Two other pieces that week argue the same case in a different vocabulary. In the Robot Report podcast episode of 9 October, Appen’s Jeanine Sinanan-Singh notes that impressive demonstrations do not establish that behaviour generalizes. On 11 October, a workflow-first column by Ron Zukerman, an innovation director at Vishay Precision Group, argues for designing backwards from the task. His own figures for a connector insertion line put a contact force held at plus or minus 0.2 N against scrap falling from 1.2 percent to 0.5 percent, an estimated $450,000 a year per line.

If per action reliability compounds that way, leverage sits in the layer that decides what runs, not in the model that suggests it. Hence a dialogue FSM with 173 tests, a memory service forbidden from touching motors, a gate that owns the wheel handles, and a changelog for defaults.

The seams still open

Capability discovery is unsolved. DialoStack generates a schema from free text when you supply none, which weakens the guarantee: the flow still owns phases, turn limits and confirmation, but the shape of the task now comes from the model. Passing your own schema is the stricter option, and the project leaves that choice to you.

Deterministic layers drift too. Two costmap defaults and a collision monitor’s lead time moved under a commit about MPPI, which is the counterargument to any claim that deterministic equals trustworthy. If behaviour is a function of inherited defaults, provenance matters as much as the gate. QoS policies set behaviour the same way, through configuration rather than code.

The fallback contract stays application-defined. Robot Brain says so outright, and the gate’s answer is an operator reset with a dwell requirement. No shared convention exists for the two cases that will happen in production: the proposer returns nothing, or it returns something outside its contract. That is the guard layer problem asked from the other side.

Auditability has a licence dimension. A compiled core under an evaluation licence, inside an application that must also be reviewed, puts the boundary where your compliance process may not accept it, however clean the API is.

If you are building this

  • Write the contract before the model call. A typed action with a target, an expected result and a failure reason is what makes the rest testable. DialoStack’s single action and Robot Brain’s recall plus feedback pair are two workable shapes.
  • Start at zero. Require a positive proposal that clears a stopping envelope before motion, as the QERRA gate does.
  • Count steps, not averages. A per action rate says little about a workflow. If a task takes 100 actions, report workflow completion.
  • Record parameters next to model versions. Pin the defaults you depend on, and treat an upstream default change as a behaviour change.
  • Decide where recall sits, then measure it. Before the planner, inside a recovery behaviour tree, or offline only. A memory that never changes a decision is decoration.
  • Treat timing as part of the boundary. Executors and callback groups decide determinism as much as architecture does, and the Intrinsic Core release of 13 October open sourced a real-time control framework that is one plausible home for gates like these.

What to watch next

Whether the deterministic cores hold their test coverage as these projects age, since DialoStack has no binary release yet and Robot Brain’s core cannot be reviewed by anyone outside its author. Whether default parameter provenance reaches the distribution process itself, because a silent default change in a released stack is indistinguishable from a regression downstream. Whether anyone publishes a fallback contract for an unavailable model or an empty recall, the missing piece in all four projects and in the watchdog pattern built into other agent stacks. And whether the proposer pattern survives contact with capability research, given that the policies described this month in world action models are trained to act directly rather than to hand off. The two trends pull in opposite directions, and nobody has designed the reconciliation yet.

Sources

Frequently asked questions

What is the proposer pattern in robot software?
It is an authority split rather than a model choice. A learned component may only suggest an action, while a deterministic component owns the actuators, the state and the permission to move. QERRA-v2 Classical describes its planner as an untrusted proposer that holds no actuator handles, and DialoStack applies the same split to spoken dialogue, where an FSM owns the turn state and the model only interprets and phrases.
Why can a 99 percent success rate still fail a whole workflow?
If a workflow needs 100 independent actions that each succeed 99 percent of the time, the probability that all 100 succeed on the first attempt is 36.6 percent. At 99.9 percent per action the figure rises to 90.5 percent, and at 99.99 percent to 99.0 percent. That illustration comes from Nicolas Sauvage of TDK Ventures in a contributed piece for The Robot Report, and he states the assumption himself: equal and independent rates. It is a reminder, not a measurement.
Is the Robot Brain memory runtime open source?
No. Its developer posted on the Open Robotics forums with a ROS 2 reference bridge and a public GitHub repository, but the repository holds documentation, examples and the issue tracker while the core ships as a compiled package under an evaluation license. Model-assisted steps call Google directly with your own API key.

Related reading

The Robot Stack Is Going Modular, and the Guard Layer Has No Home

HomeBody deletes the learned policy, FLUX 3 Action shrinks it to a checkpoint, and RoboHarm shows the frontier model that takes over refuses almost nothing.

NVIDIA's OpenShell watchdog for robot agents

NVIDIA ships an open runtime and a hardware watchdog for robot agents, NASA traces its space arm trouble to the transporter, and ScaFi scales a swimming robot.

Robot imports become a security question

Washington opens trade talks on imported robots, Agility starts trading as AGLT, and two open-weight models rebuild manipulation data from force and gloves.