# External Command-Boundary Pilot

## Access Is Not Authority

A process may be able to publish a command without having authority to produce
the consequence.

RobotGov puts verification at the consequence boundary. The proposing agent,
workflow, or operator cannot grant itself authority merely by reaching a ROS
topic, API, queue, or controller interface.

## Select One Command

Good pilot commands have a clear identity, bounded parameters, and a harmless
sandbox consequence. Examples include:

- accept one warehouse mission in a digital twin;
- apply one route update in a mining simulator;
- change one industrial cell mode in a vendor sandbox;
- accept one drone mission plan in software-in-the-loop simulation;
- move one simulated asset into a preregistered state.

Do not begin with emergency stop, live actuation, payload release, production
dispatch, or human-proximity motion.

## Five Required Cases

| Case | Expected result |
| --- | --- |
| Exact command plus valid authority | One sandbox effect |
| Direct command without authority | Zero effects |
| One material command field changed | Zero effects |
| Authority artifact replayed | Zero additional effects |
| Receiver or simulator unavailable | No false completion receipt |

The partner may add wrong vehicle identity, geofence conflict, maintenance
evidence drift, sensor degradation, or human-presence uncertainty after the
five-case boundary is accepted.

## Deliverables

The pilot returns:

1. a command commitment specification;
2. a partner-specific adapter implementing the frozen receiver contract;
3. authority, receiver, application, and effect receipts;
4. a replay pack for every agreed case;
5. integration effort and latency measurements;
6. a findings report separating observed facts from blocked conclusions.

## Deployment Position

RobotGov runs inside the partner's approved environment.

```text
No external LLM calls
No robot data sent to model providers
No token-based processing fees
No model-version drift in the authority path
Deterministic replay from the same command, policy, and evidence
```

Local compute, infrastructure, integration, and support costs still apply.

## Exit Criteria

The pilot succeeds only if the exact case produces the agreed sandbox effect
once and every negative or unavailable path produces zero additional effects
without a false completion receipt.

Success does not establish robot safety, command feasibility, cybersecurity
certification, regulatory compliance, or production readiness.