# External Pilot Reviewer Worksheet

## Reviewer Context

- Role:
- Command or system reviewed:
- Experience with the simulator, controller, or ROS graph:
- Date:

## Technical Classification

For each material finding or conclusion:

- **A** useful and non-obvious
- **B** useful but obvious
- **C** technically valid but low-value
- **D** misleading or unsupported
- **E** impossible to assess from available evidence

| Finding or conclusion | A-E | Reason | Evidence needed |
| --- | --- | --- | --- |
| Exact command commitment is complete |  |  |  |
| Receiver independently verifies authority |  |  |  |
| Replay is prevented across restart |  |  |  |
| Application and observed effect are separated |  |  |  |
| Outage handling avoids false completion |  |  |  |

## Questions

1. Is the selected command genuinely consequential in this workflow?
2. Does the commitment include every field that should invalidate authority?
3. Can any semantically different command share the same commitment?
4. Is the receiver verification independent of the proposing process?
5. Is nonce consumption atomic and durable enough for the sandbox?
6. Does the observed-effect source independently confirm the consequence?
7. Did the receipt chain change where you inspected first?
8. Which finding is misleading, unsupported, or operationally irrelevant?
9. What important negative case is missing?
10. What latency or integration burden would make this unacceptable?

## Decision

- [ ] Advance to a partner sandbox pilot.
- [ ] Revise the command commitment.
- [ ] Revise the receiver contract.
- [ ] Stop because the boundary has insufficient operational value.

No endorsement or safety approval is implied by completing this worksheet.