Product
Robot Flight Recorder
Three layers. A read-only collector on the robot. A neutral registry that witnesses what the collector commits. A free verifier that lets anyone — an adjuster, an investigator, opposing counsel — check the record without trusting us or you.
What the record says — and what it refuses to say
This system produces a tamper-evident, independently verifiable record of the robot's decision process — bounded by what the machine's software emits, explicit about what it does not capture, and never "a record of what happened." The record does not say a person was at 2.1 m. It says perception reported a person at 2.1 m, confidence 0.87, LiDAR nominal. The first is a claim about the world no machine is entitled to make. The second is a fact about the machine — the only thing it can honestly attest to, and precisely what an investigation needs.
Every measured value carries its provenance: source, confidence, sensor health. This is enforced in our type system and in code review, like the compliance rule it is.
Today's schema records the Machinery-Regulation set — what was running, who was in control, what changed, and continuity. The decision-process record the example above describes is the next schema version; the claim discipline is the rule it is written under, and its event slots are already reserved.
The three layers
| Layer | Where it runs | What it does |
|---|---|---|
| Collector | On the robot | Subscribes, only. Records software provenance (including weights hashes), every intervention in safety-relevant software, control authority, lifecycle, and continuity — hash-chained and signed as it is written. Publishes to zero command, actuation, or parameter interfaces — a CI guard fails any build containing one — and runs within published resource budgets, so the interference question has an engineering answer. Recording is local-first and durable: losing the network queues commitments, it does not stop the record. ROS 2 fleets install in a day; other stacks connect through the open capture protocol. It arrives with published resource budgets and a threat model your safety assessment can work from. |
| Registry | Independent service | The neutral witness. Validates and countersigns each chain commitment, so a record cannot be quietly rewritten after the fact — by anyone, including us. A collector's own signature proves only that a key on that machine signed something; the registry's countersignature is what makes the record evidence a third party can accept. Merkle roots are anchored to independent RFC 3161 timestamp authorities, so backdating is detectable even by an attacker holding the robot's own keys. |
| Verifier | Anyone's machine | A standalone tool that checks a record or an incident pack from a cold start — no account, no network, no contact with us. It is free to any relying party, because evidence only counts when the adversary can check it themselves. A conformant verifier retains every historical schema version and signature algorithm, forever: dropping support for an old format would destroy every record written in it. |
Not a blockchain
Worth saying plainly, because "hash chain, Merkle root, tamper-evident" invites the association. There is no consensus, ledger, token, or distributed agreement anywhere in this design. A Merkle tree is a 1979 data structure used by git, ZFS, and Certificate Transparency; ours provides inclusion proofs so one incident can be disclosed without revealing the rest. Timestamps come from independent RFC 3161 authorities — the same mechanism courts and auditors have accepted for decades of electronic records.
No raw media, ever
No video, audio, or point clouds enter the log under any configuration. Media is referenced by content hash into the operator's own retention, so footage can later be proven unaltered without this system ever holding it. In homes and shared workplaces, that is the only politically survivable design — and it turns a privacy liability into a privacy asset. Vehicle event-recorder law took the same path: rich event capture with identity and location structurally excluded.
Honest limits — stated here and in every export
- A gap is a first-class signed event, never an absence — and it carries its reason: connectivity, power, fault, or suppression suspected. A network dead zone is not a gap in the record; a battery swap is a signed power gap; even crash recovery discards a torn tail as a signed event. What a rooted robot can still do is force silence — that is not preventable in software. "The recorder went dark for eleven minutes before the incident, with no shutdown event and no recovery record" is itself evidence.
- A rooted robot cannot undetectably rewrite anchored history. The interval between write and anchor is the residual exposure, bounded by the anchoring cadence. Detection, not prevention, is the product.
- The record attests only to what the machine's software emits — a decision made in a code path that publishes nothing is invisible, which is why everything captured carries provenance.
- Canonical encoding guarantees byte-determinism, not truth. A robot reporting a false distance produces a perfectly canonical record of a false report — which is why provenance is mandatory on every measured value.
A reviewer who discovers a limit we concealed stops believing everything else. So we publish them first.