Repository navigation
feat(examples): demonstrate humanoid task authority beyond motion safety - #4327
Carlos Hernandez (carloshvp) wants to merge 1 commit into
Conversation
Compare the same misdirected tray-transfer request through a simulated motion-only gate and the real AGT policy engine. Add an offline terminal walkthrough with action-bound approval, parameter-substitution and replay rejection, signed software evidence, an independent verifier and tests. Prepared with Codex under my direction. I reviewed the specific changes and explicitly authorized submission after reviewing the patch. I take responsibility for this contribution, its behavior and its evidence limits. Signed-off-by: Carlos Hernandez <carloshvp@gmail.com>
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
github-actions
Bot
added
documentation
PR Review Summary
Verdict: AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims. |
MohammadHaroonAbuomar
left a comment
MohammadHaroonAbuomar
left a comment
There was a problem hiding this comment.
- Thank you, this is a solid example: I ran the demo, the verifier and a tampered-receipt check, 23 tests pass, and the probes (forged and empty signatures, digest substitution, replay, a two-thread race, stale clock, policy change, truncated and reordered journal, untrusted key) all fail closed. Template, DCO and CLA complete. A few small items before approval.
| @@ -0,0 +1,36 @@ | |||
| --- | |||
There was a problem hiding this comment.
examples/humanoid-action-governed/TALK.md:1 This is a timed speaker script for an external conference talk. Is presenter material something the repository wants to maintain? The README already covers setup and the walkthrough; I would drop it or fold the two or three framing paragraphs into the README. Maintainers can overrule.
| @@ -0,0 +1,169 @@ | |||
| --- | |||
There was a problem hiding this comment.
examples/humanoid-action-governed/README.md:1 Please drop the docs-style front-matter block; no other example README carries one and GitHub renders it as a bare table.
| @@ -0,0 +1,13 @@ | |||
| # Direct dependencies for the AGT modules exercised by this source-checkout demo. | |||
There was a problem hiding this comment.
examples/humanoid-action-governed/requirements.in:1 Of the twelve direct dependencies, only pydantic, PyYAML, cryptography, httpx and python-dateutil are imported by the modules this example uses. Please trim the list or reword the README's "minimal dependency profile" claim. Also note pydantic 2.14.1 and pydantic-core 2.50.1 were published on 2026-10-11, inside the repository's seven-day cooling window; pinning the previous releases avoids a Supply Chain Check failure.
| @@ -0,0 +1,95 @@ | |||
| # This file was autogenerated by uv via the following command: | |||
| # cspell:words certifi dnspython httpcore mdurl pycparser pynacl rpds | |||
There was a problem hiding this comment.
examples/humanoid-action-governed/requirements.txt:2 The cspell:words comment sits inside the uv autogenerated header and is lost on the next regenerate; please move the words to .cspell-repo-terms.txt.
| not valid_signature(receipt, self.controller_key) | ||
| or receipt["body"]["action_digest"] != binding.digest() | ||
| ): | ||
| self._record( |
There was a problem hiding this comment.
examples/humanoid-action-governed/demo.py:445 The controller_evidence_invalid event omits approval_request_id and action_digest, unlike the sibling dispatch events, so an offline reader cannot tie it to the request. Please add them for parity.
MohammadHaroonAbuomar
left a comment
MohammadHaroonAbuomar
left a comment
There was a problem hiding this comment.
- Follow-up after the gated CI ran (four red jobs; the earlier items stand):
- For the maintainers: Dependency Review fails on licence metadata for two transitive pins,
cffi2.1.1 (MIT-0) andtyping-extensions4.16.0 (a compound PSF/BSD/0BSD expression). Neither is restrictive; adding MIT-0 toallow-licensesandpkg:pypi/typing-extensionstoallow-dependencies-licensesin the dependency-review workflow would clear it. Not something the author can fix from this PR.
| @@ -0,0 +1,608 @@ | |||
| #!/usr/bin/env python3 | |||
There was a problem hiding this comment.
examples/humanoid-action-governed/demo.py:1 The No Unauthorized Crypto gate rejects direct use of hashlib and cryptography.hazmat ed25519 outside the designated security modules. Please sign and verify through the SDK's public crypto API (the agentmesh signing helpers) instead of raw primitives, or, if the example must show the primitives, explain why and let the maintainers decide on an exemption.
| @@ -0,0 +1,95 @@ | |||
| # This file was autogenerated by uv via the following command: | |||
There was a problem hiding this comment.
examples/humanoid-action-governed/requirements.txt:1 The Dependency Audit Trail gate requires a docs/dependency-audits/2026-10-15-<description>.md entry whenever a lockfile is added or changed; the job log prints the template. Please add one covering the new pins (and the two pydantic pins once moved back inside the cooling window).
| @@ -1,6 +1,6 @@ | |||
| --- | |||
There was a problem hiding this comment.
docs/index.md:1 The new row links to the absolute tree/main/examples/humanoid-action-governed URL, which 404s until the PR merges and fails the link check. Please use a relative path like the other example rows.
Related Issue
Related to #787 and the physical-system control mapping merged in #2916.
Problem & Solution
A motion-safety check can admit an action that exceeds an agent's assigned task.
The existing physical-attestation example evaluates simulated sensor readings;
it does not demonstrate task authorization through an approval-to-execution path.
Add a terminal walkthrough under
examples/humanoid-action-governed/. A simulatedmotion-only baseline completes a delivery to unauthorized visitor pickup. The
identical action through the real AGT policy engine is denied before dispatch.
The legitimate inspection delivery requires action-bound approval, rejects a
post-approval destination substitution, executes once, and rejects approval replay.
Controller and journal signatures let an offline verifier inspect recorded
software evidence using separately retained trust material.
The planner output and controller are simulated. The example calls AGT's shipped
policy engine, identity signing API and approval coordinator. It adds no core
package, robotics middleware, CI change or public API. Browser visuals are outside
this PR's scope.
Impact on Your Work
Provides an offline, presenter-controlled walkthrough for explaining runtime
authority, trusted identity, human approval and verifiable evidence for embodied
agents. The included six-advance script fits a 2 minute 45 second demonstration
prepared for Humanoid Europe. It is also runnable independently of the talk.
Timeline
No requested merge deadline.
Alternatives Considered
reproduce and would introduce claims beyond the code exercised here.
the example explicitly connects existing AGT APIs instead.
Type of Change
Package(s) Affected
docs/index.mdTesting
agent-governance-toolkit-coreeditable distribution successfully.demo.py --all --export ...rehearsal and separateverify.py --trust ...invocation pass.
unknown tools, pending/expired approvals, parameter substitution, policy changes,
replay and concurrent consumption, stale state, independent controller veto,
missing/forged controller replies, and corrupted/deleted/reordered/truncated
signed evidence. Ed25519 signatures are also checked directly through the
cryptography API, separately from the demo verification helper.
files, no findings. Explicit changed-page checks and strict frontmatter pass.
git diff --cached --checkpasses.Evidence Limits
The motion-only baseline is a teaching model, not a characterization of every
traditional safety product. AGT adds task authority and approval enforcement;
physical safety controls remain independent. Signatures prove what trusted
software keys recorded, not sensor authenticity or a real physical outcome.
The operator identity is local demo provisioning, and authorization storage and
keys are in memory. Missing controller replies remain unknown and are not retried
automatically. The example's evidence schema is not a new AGT or TRACE protocol.
Attribution & Prior Art
Uses this repository's Physical Agent Systems Profile (#2916), ADR-0030
action-bound approval protocol,
PolicyEngine,AgentIdentity,ApprovalCoordinator, and physical-attestation example. The simulated controllerand scripted walkthrough are illustrative example code. Ed25519 uses the existing
cryptography dependency; canonical evidence uses RFC 8785 through the already
transitive
rfc8785dependency, now explicit in the example's dependency profile.AI Assistance
Codex prepared the example, tests, documentation and this description under
Carlos Hernandez's direction. I reviewed the specific changes and explicitly
authorized submission after reviewing the patch. I take responsibility for this
contribution and its scope, behavior, validation and stated evidence limits.
IP, Patents, and Licensing
MIT-licensed example code with the repository's existing copyright headers.
No proprietary controller, real device access, credentials, NDA-gated integration
or patent claim is introduced. Dependencies and internal prior work are identified
above.