{
  "schema_version": 1,
  "title": "Teleoperation command-integrity research proposal",
  "author": "Sergio Rodriguez",
  "created": "2026-10-21",
  "status": "proposed_external_study",
  "company_context": {
    "name": "Satyress",
    "source": "https://www.satyress.com/",
    "relationship": "Independent proposal; no affiliation or product assessment",
    "public_facts": [
      "Teleoperation-focused robot",
      "Quick-connect tool interface",
      "Replaceable and recalibrated limb assemblies",
      "Physical air brakes and pin locks"
    ]
  },
  "local_artifact": {
    "kind": "Original synthetic state-machine fixture",
    "source": "robotics-trust.js",
    "tests": "robotics-trust.test.mjs",
    "network": false,
    "hardware": false,
    "authentication": "Assumed upstream; not implemented",
    "timings": "500 ms command TTL and 1000 ms lease are illustrative fixture values"
  },
  "experiments": [
    {
      "id": "RT-01",
      "name": "Command freshness and session isolation",
      "hypothesis": "A delayed, duplicated, reordered or previous-session command must not produce a new accepted motion transition.",
      "controls": [
        "Fresh command under the current session",
        "Valid hold under the current session"
      ],
      "mutations": [
        "At expiry minus one and at expiry",
        "Duplicate sequence",
        "Lower sequence",
        "Reconnect followed by a queued prior-session command"
      ],
      "acceptance": [
        "Zero admitted stale/replayed/prior-session commands",
        "All current-session valid controls admitted",
        "Record decision reason and state before/after"
      ],
      "artifacts": [
        "Deterministic packet corpus",
        "Receiver decision trace",
        "Capture-to-receiver clock model"
      ]
    },
    {
      "id": "RT-02",
      "name": "Stop, loss and deliberate rearm",
      "hypothesis": "A latched stop or link-loss condition cannot be cleared by a queued remote motion command.",
      "controls": [
        "Explicit local rearm without motion",
        "Fresh post-rearm command"
      ],
      "mutations": [
        "Stop while packets are queued",
        "Lease loss",
        "Reconnect without rearm",
        "Old-session packet after rearm"
      ],
      "acceptance": [
        "Hold survives remote advance",
        "Rearm alone produces zero motion transition",
        "Pre-stop session remains invalid"
      ],
      "artifacts": [
        "State-transition diagram",
        "Sequence trace",
        "Watchdog and hardware-stop evidence in an approved bench"
      ]
    },
    {
      "id": "RT-03",
      "name": "Tool identity and calibration binding",
      "hypothesis": "A tool or limb replacement invalidates incompatible commands and calibration assumptions.",
      "controls": [
        "Matching fixture identity, capability and calibration revision"
      ],
      "mutations": [
        "Swap identity without updating calibration",
        "Replay older calibration revision",
        "Change units or unsupported tool capability"
      ],
      "acceptance": [
        "Mismatched combinations rejected before actuation",
        "Replacement event visible in audit record",
        "Valid matched configuration remains usable"
      ],
      "artifacts": [
        "Attachment capability schema",
        "Calibration revision manifest",
        "Hardware-in-loop trace when equipment is available"
      ]
    },
    {
      "id": "RT-04",
      "name": "Operator display versus acknowledged state",
      "hypothesis": "The operator display must distinguish intended command, accepted command and observed physical state.",
      "controls": [
        "Fresh acknowledgement and fresh telemetry"
      ],
      "mutations": [
        "Drop acknowledgement",
        "Freeze telemetry timestamp",
        "Delay stop acknowledgement",
        "Reconnect with stale cached status"
      ],
      "acceptance": [
        "Stale state is distinguishable from current state",
        "Unacknowledged command remains unconfirmed",
        "Recovery does not display motion readiness before handshake"
      ],
      "artifacts": [
        "UI state table",
        "Replay recording",
        "Timestamp and acknowledgement correlation"
      ]
    }
  ],
  "company_specific_unknowns": [
    "Transport and authentication design",
    "Controller and firmware versions",
    "Command rate and latency budgets",
    "Physical stop integration",
    "Tool and calibration identity format"
  ],
  "bench_requirements": [
    "First execute in a software-only simulator",
    "Any later equipment trial requires a dedicated de-energized or restrained bench and measured stop behavior",
    "Agree timing budgets from the actual controller and physical risk assessment"
  ],
  "deliverables": [
    "Threat model tied to actual architecture",
    "Minimal witness and valid control per finding",
    "Reproduction source and deterministic trace",
    "Patch or mitigation plus repeated test",
    "Integration prerequisites and unresolved hypotheses"
  ]
}