Humanoid from Cold

Learning notes for building a humanoid from cold start: freeze frames and units, instrument one joint end-to-end, then chain contact, balance, stepping, shared autonomy, runtime safety, teleop+policy logging / replay / dataset hygiene, offline eval / shadow / canary under supervisor + logging gates, HIL regression farm under supervisor + logging + canary gates, fleet multi-robot shared-autonomy logging / ticket-log sync / online continual learning under the same gates, fleet canary orchestration / multi-site sim-to-real ranking under supervisor + logging + canary + HIL + fleet gates, fleet incident response / coordinated rollback / multi-robot kill coordination under supervisor + logging + canary + HIL + fleet + fleet-canary gates, and post-incident forensics / fleet postmortem bags / reopen canary under supervisor + logging + canary + HIL + fleet + fleet-canary + incident gates. Physical build and digital twin share the same interfaces.

Live site: silent.engineer/humanoid-from-cold 

Start here

• Curriculum map — living roadmap

• Frames & units contract — freeze before CAD

• Day 01 — Cold start — six subsystems, build order, multi-rate loops

• Day 02 — Joint FOC — nested loops, encoders, current as muscle

• Day 03 — Sensing beyond the joint — IMU, contact/force, estimation rates

• Day 04 — Bus topology & time sync — CAN-FD / EtherCAT, who owns the clock

• Day 05 — Power domain & BMS — brownout, bus sag, safe torque limits

• Day 06 — Estimation & balance — multi-rate fusion, contact-rich base state

• Day 07 — WBC & balance — tasks, constraints, torque_scale ceilings

• Day 08 — Stepping & locomotion — gait modes, footsteps, swing on WBC ceilings

• Day 09 — Push recovery — capture-point escape, in-place vs emergency step, mid-recovery abort

• Day 10 — Upper-body manipulation — EE/grasp soft tasks under shared balance ceilings

• Day 11 — Hand-as-support / loco-manipulation — measured hand contact joins foot support under shared ceilings

• Day 12 — Multi-contact transitions / object-as-support — sequenced promote–demote across feet, hands, and grasped objects under one plant

• Day 13 — Perception-driven support affordances — vision/tactile proposals as schedule CLAIM candidates only; measured contact still owns the hard set

• Day 14 — Learned residuals / scene graphs — soft residual correctors and SoftSceneGraph candidates above the affordance→schedule stack; never hard cones or µs-loop nets

• Day 15 — Closed-loop learned policies — RL/imitation/behavior policies as soft refs and CLAIM candidates under measured ceilings; sim-to-real residual validation before free closed-loop

• Day 16 — Teleop / shared-autonomy arbitration — human teleop and learned policy as co-equal soft writers under SharedAutonomyArbiter; measured ContactState still owns the hard set; twin mid-arbitration fights before free shared autonomy

• Day 17 — Runtime safety supervisor / kill-chain — RuntimeSafetySupervisor above teleop/policy/arbiter; kill-chain WARN→INHIBIT_SOFT→DEMOTE_CONTACTS→TORQUE_SCALE_CLAMP→ESTOP; hard kill only via Day 05 BMS/torque_scale/FOC; twin supervisor races before free shared autonomy armed

• Day 18 — Teleop+policy logging / replay / dataset hygiene — EpisodeLogger / ReplayHarness / DatasetHygiene under soft-vs-hard + supervisor-armed kill-chain; labels refuse soft→MEASURED; replay soft-only with age/stage/gate honesty; twin logging/replay races before free dataset harvest

• Day 19 — Offline eval / shadow mode / canary under supervisor + logging gates — OfflineEvaluator / ShadowRunner / CanaryDeployer; honest offline metrics on quarantined-clean bags; shadow observes beside live soft writers without hard writes; canary admits limited soft weight only when OfflineEvaluator + DatasetHygiene + RuntimeSafetySupervisor gates pass; twin eval/shadow/canary races before free canary

• Day 20 — Hardware-in-loop (HIL) regression farm under supervisor + logging + canary gates — HilFarm / HilSuite / RegressionGate; continuous twin+bench suites replay Day 18 bags, re-score OfflineEvaluator, re-run ShadowRunner observe-only, dry-run CanaryDeployer; RegressionGate fails closed and blocks canary admit when races or hygiene regress; never a farm plant that bypasses MEASURE or Day 05 ceilings; twin+bench farm races before continuous farm

• Day 21 — Fleet multi-robot shared-autonomy logging / ticket-log sync / online continual learning — FleetLogHub / TicketLogSync / OnlineContinualLearner / FleetAdmitGate; multi-robot EpisodeLogger coordination with same schema; ticket↔bag soft metadata; gated online continual learning from hygiene ADMIT only; FleetAdmitGate fails closed on drift / ticket soft→MEASURED / quarantine-train / farm RED; never a fleet plant that bypasses MEASURE or Day 05 ceilings; twin+fleet races before free fleet online

• Day 22 — Fleet canary orchestration / multi-site sim-to-real ranking — FleetCanaryOrchestrator / MultiSiteRanker / FleetCanaryGate; coordinates Day 19 CanaryDeployer across robots/sites with staggered limited soft admits; ranks twin galleries by honesty-aware sim-to-real signals (soft, never MEASURED); FleetCanaryGate fails closed on site-rank→MEASURED / cross-site honesty strip / OVERRIDE-as-bypass / dual-write torque_scale / skip MEASURE because rank looked good / farm RED ignored / unpaired ESTOP; never a fleet canary plant that bypasses MEASURE or Day 05 ceilings; twin+multi-site races before free fleet canary

• Day 23 — Fleet incident response / coordinated rollback / multi-robot kill — IncidentCoordinator / FleetRollbackOrchestrator / MultiRobotKillGate; classifies fleet incidents into soft tickets; coordinates per-robot soft-admit rollback and freezes Day 22 stagger; MultiRobotKillGate fails closed on unpaired ESTOP / farm RED ignored mid-incident / OVERRIDE-as-bypass / cross-robot honesty strip / rollback without MEASURE/Day05 / canary admit during active incident / dual-write torque_scale for kill; never a fleet kill plant that bypasses MEASURE or Day 05 ceilings; twin+multi-robot races before free fleet incident response

• Day 24 — Post-incident forensics / fleet postmortem bags / reopen canary — PostIncidentForensics / FleetPostmortemBag / CanaryReopenGate; reconstructs honesty-aware forensic reports from bags + tickets + supervisor traces; correlates multi-robot postmortem bags without rewriting MEASURED; CanaryReopenGate fails closed on incomplete forensics / ticket still open / farm RED / unpaired ESTOP / OVERRIDE mid-reopen / dual-write torque_scale / rewrite MEASURED bags; never a reopen plant that bypasses MEASURE or Day 05 ceilings; twin+multi-robot races before free canary reopen

• Day 25 — Fleet change management / staged policy promotion / cross-site config honesty — FleetChangeManager / StagedPolicyPromoter / ConfigAttestation / CrossSiteConfigGate; content-addressed ChangeSets classified HARD_SAFETY/CALIBRATION/PLANT_MODEL/FIRMWARE/SOFT_POLICY/GATE_THRESHOLD; soft changes climb rings R0 twin→R5 cross-site with exposure-based soak; robots attest by reading hashes back from drives/BMS/policy slot; CrossSiteConfigGate fails closed on desired≠attested / envelope mismatch / mixed-class / Days 17–24 RED; never a deploy plant that bypasses MEASURE or Day 05 ceilings; twin+fleet races before free fleet promotion

• Day 26 — Actuator wear / calibration drift / predictive maintenance — ActuatorHealthProbe / DriftEstimator / MaintenanceScheduler / RecalibrationGate; fixed policy-independent probes in a quiescent window and temperature band give MEASURED per-joint fingerprints (± velocity friction with gravity cancelled, dual-encoder backlash, back-EMF flux linkage, DC-injection winding R, F/T tare, IMU bias, kinematic closure); trends vs torque-cubed exposure with CUSUM, cohort compare and RUL bands stay soft; recal is a rig-signed per-unit CalibrationEvent with before/after probes that re-checks Day 25 envelopes; RecalibrationGate fails closed; DEGRADED units quarantined from fleet training; Day 05 owns hard limits

• Day 27 — Thermal budgets / duty-cycle scheduling — ThermalStateEstimator / ThermalHeadroomForecaster / DutyCycleScheduler / ThermalAdmissionGate; per-unit two-node winding/housing thermal models identified in the limb, with MEASURED thermistors, winding R at rest, gearbox, drive, pack, brake-resistor and SoC (read-back clock) temperatures and an ESTIMATED hot spot; closed-form headroom over a horizon and why RMS torque only works for short cycles; twin forecasts a pessimistic band (soft); planner ceiling sits below Day 05 derate by a margin plus a safe-stop / push-recovery reserve; scheduler rests, picks cheaper postures, alternates limbs or refuses; ThermalAdmissionGate fails closed and sheds gracefully when measured leaves the band; every field derate is a twin regression test; Day 05 owns derate

• Day 28 — Energy budgets / battery mission planning — EnergyStateEstimator / MissionEnergyForecaster / ChargeScheduler / EnergyAdmissionGate; cell V, shunt I, cell T, rested OCV, pulse resistance and deep-cycle capacity are MEASURED while SOC (± σ with anchor age) and SOH are ESTIMATED per pack_id; energy and power are separate budgets and a cold or aged pack can fail push recovery at 60% SOC; the gate keeps pessimistic SOC above a planner floor plus a position-dependent return-to-dock reserve (walk home, queue, detour, dock-in) at every point; cold-pack and fast-charge limits stay Day 05 tables and preheat is scheduled time; fleet charging is least-laxity-first under dock count and site power cap with staggered SOCs; battery swap is a signed measured event (identity read back, state re-keyed, pulse-R probe); Day 05 owns derate and charge limits

• Day 29 — Human-proximity safety / SSM + PFL — ProximityStateEstimator / StoppingDistanceForecaster / ContactForceLimiter / HumanSafetyAdmissionGate; MEASURED separation vs ESTIMATED human motion (±σ); stopping-distance twin from Day 27 thermal + Day 28 power; SSM envelopes; HARD ISO/TS 15066-style body-region PFL ceilings; HumanSafetyAdmissionGate fails closed; Day 17 owns ESTOP; Day 05 owns torque_scale

• Day 30 — Collaborative workspace zoning / safeguarded-space attestation — ZoneGeometryAttestor / SafeguardedSpaceMap / CrowdDensityEstimator vs MeasuredOccupancyCount / HandoffCorridorGate / CrossSiteZoneConfigGate / CollaborativeWorkspaceAdmissionGate; MEASURED attested zone geometry and occupancy; soft density forecast feeding Day 29 SSM; handoff under PFL; cross-site zone-config honesty (Day 25 pattern); soft never writes Day 17 / Day 05 / Day 25 HARD_SAFETY ChangeSets

• Day 31 — Shared-control / teleop arbitration under attested zones — ZoneAwareSharedControlArbiter / AuthorityTransferGate / OperatorIntentAdmissionGate / SharedControlAdmissionGate; Day 16 soft co-writing deepened under Day 30 CWAG + Day 29 SSM/PFL; zone- and proximity-aware authority transfer; gesture/intent soft-only (cannot raise PFL or bypass CrossSiteZoneConfigGate); soft never writes Day 17 ESTOP or Day 05 torque_scale

• Day 32 — Multi-operator / fleet shared-control coordination — MultiOperatorSessionRegistrar / OperatorSessionLease / FleetSharedControlPriorityArbiter / ConcurrentAuthorityConflictGate / IntentEpisodeBagSchema / FleetSharedControlAdmissionGate; at most one human writer per unit; demotion cheap, promotion earned, handover via HOLD

• Day 33 — Remote / multi-site teleop under latency — LinkLatencyEstimator / LatencyAwareLeaseGovernor / SoftIntentPredictor / OperatorViewFreshnessGate / WanLossFailoverArbiter / RemoteTeleopAdmissionGate; MEASURED RTT/jitter demotes the soft pen; WAN loss fails to POLICY or HOLD, never last stick

• Day 34 — Immersive telepresence / haptic force-reflection honesty — ContactForceTruthSource / HapticRenderHonestyLabeler / ForceReflectionDelayBudget / PassivityObserverGate / HapticChannelDegrader / GripIntentForceFence / TelepresenceAdmissionGate; every rendered cue labeled with provenance + age; passivity under delay; degrade to visual-only; haptics never raise PFL or write torque_scale

• Day 35 — Dexterous skill capture / learning from demonstration under honest labels — DemoHonestySegmenter / MeasuredForceLabelGate / SoftContextBagSchema / SkillCaptureHygieneGate / DemoToPolicyValidator / DexterousSkillCaptureAdmissionGate; demos cut at clamp and haptic-mode events; only MEASURED contact supervises Newtons; predicted / stale / visual-only stay soft context; Day 18 hygiene + Day 15 validation; skills never raise PFL

• Day 36 — Cross-embodiment skill transfer / sim-to-real under honest contact labels — EmbodimentSensorProvenanceRegistry / CrossEmbodimentForceRetargeter / MeasuredLabelTransferGate / SimToRealContactHonestyBridge / TransferChangeSetBinder / CrossEmbodimentSkillTransferAdmissionGate; MEASURED stays sensor-local; retarget emits ESTIMATED/SOFT; twin contact SIM until HIL; Day 25 ChangeSets bind embodiment_id + cal + suite hash; CESTAG under DSCAG — transfers never raise PFL

• Day 37 — Fleet skill library / multi-unit skill catalog under embodiment-honest admission — SkillCardStore / EmbodimentClassRegistry / SkillBindingResolver / PerClassCanaryCohortPlanner / CatalogChangeLedger / BindingDriftInvalidator / FleetSkillCatalogAdmissionGate; immutable cards keyed by embodiment class; exact binding or NONE, never nearest neighbor; per-class canaries, no pooled promotion; demotions immediate; hardware drift voids bindings; catalog never raises PFL

• Day 38 — Task composition over catalog skills under per-skill admission — TaskPlanStore / CompositeBindingResolver / MeasuredConditionEvaluator / StepHandoffGuard / CompositeEvidencePlanner / TaskRecoveryRouter / TaskCompositionAdmissionGate: steps advance only on MEASURED pre/postconditions, all steps and recoveries bind or none, bumpless contact handoffs, composite ring = weakest step, contact-aware HOLD and named recovery skills with budgets

• Day 39 — Multi-unit cooperative tasks under per-unit admission — CooperativeTaskPlanStore / PairBindingResolver / InterUnitClockSync / JointMeasuredPostconditionEvaluator / HandoffOwnershipContract / InternalForceGovernor / CoordinatedHoldArbiter / CooperativeTaskAdmissionGate: each unit binds its own cards, joint postconditions are a Kleene AND of each unit’s own MEASURED verdict on a bounded PTP timebase, handoff ownership never empty, compliant follower bounds internal force, pair ring = weaker unit, coordinated HOLD incl. link loss and partner drop

• Day 40 — Human–robot object handover and co-carry under PFL — HumanRoleDescriptor / OwnWrenchInteractionEstimator / HumanHandObserver / HumanPullReleaseContract / CompliantFollowerGovernor / IntentCueGate / WalkAwayHoldArbiter / HumanHandoverAdmissionGate: the person is a role you can’t admit, release only on a dwelled measured pull on the robot’s own F/T, support never releases, cues delay but never trigger, robot always a force-capped follower that yields before it fights, falls, or chases, and every failure is a gentle hold the person can walk away from

• Day 41 — Whole-body tactile skin and intentional touch vs collision — SkinPatchCalibrationRegistry / TaxelHealthMap / MomentumObserverCollisionDetector / ContactIsolationFuser / TouchIntentClassifier / GuidanceAdmittanceGovernor / TouchReactionArbiter / WholeBodyTouchAdmissionGate: the joint momentum residual detects every touch and owns the reaction, skin is MEASURED only where taxels are calibrated in situ and alive with every hole declared, intent can only make the robot gentler, lead-by-hand needs a held handle enable and stops on release, and leans get a support hold that follows the measured load

• Day 42 — Deliberate whole-body contact, environment contact, and self-collision — PlannedContactRegistry / ContactSensorBinder / BandedResidualSubtractor / ContactSiteConfirmer / SelfCollisionMarginGuard / DeliberateContactGovernor / ContactExitArbiter / DeliberateContactAdmissionGate: bracing, door pushing, kneeling, and self-rest are declared single-patch contacts bound to a MEASURED sensor on this unit; the residual subtracts only the measured wrench at a confirmed site inside a physics-derived band; hole sites need a dedicated pad; any exit is a collision again owned by the residual in the same cycle, with hold-still or support-recover and never a harder push

• Day 43 — Falls and fall-safe contact under the touch stack — CaptureExhaustionDetector / FallDirectionArbiter / SacrificialSiteRegistry / ImpactEnergyGovernor / FallSequenceController / PostFallSelfAssessor / GetUpRecipeComposer / FallSafeAdmissionGate: commit to a fall only when capture is measurably exhausted, steer inside the physically feasible cone away from every person track, land on measured pads with energy budgeted against Day 05 regen and Day 27 derating, never land on hands or grab a person, and don’t move after landing until a measured self-check says so; get-up is a Day 38 plan of Day 42 recipes

• Day 44 — Stairs, ramps, and uneven terrain under the fall-safe stack — TerrainHeightFuser / StepEdgeEstimator / TouchdownConsistencyChecker / FootholdRegionShaper / TerrainZoneAttestor / HandrailContactRecipe / DescentSpeedGovernor / TerrainLocomotionAdmissionGate: step only on terrain measured by the robot’s own depth and feet with honest σ, shrink footholds and capture regions by edge confidence, believe touchdowns over the map, enter stairs only where the terrain is attested and the Day 43 stair-sit fall is admitted, use rails only as Day 42 recipes, and descend slowly enough to step out of a slip or sit down

• Day 45 — Outdoor and deformable ground under the terrain stack — GroundComplianceEstimator / SinkageTracker / FootSlipObserver / TractionBoundEstimator / WeatherDepthDegrader / SurfaceConditionAttestor / DeformableFootholdShaper / OutdoorGroundAdmissionGate: walk on ground the robot has felt rather than named, fit stiffness and sinkage every step, treat no-slip steps as a lower bound and let slips only lower admitted friction, let depth σ degrade openly in sun and rain and slow to the measured horizon, set weather condition from its own sensors with the feed lower-only, and shrink CoP authority and footholds on soft ground

• Day 46 — Carrying payloads while walking under the outdoor and terrain stacks — PayloadInertiaIdentifier / GraspHoldObserver / LoadedModelPublisher / ShiftingLoadDetector / LoadedBoundsRederiver / CarryPostureShaper / PayloadReleaseArbiter / PayloadCarryAdmissionGate: weigh the payload with its own wrist F/T before the first step and never trust the manifest’s mass, rebuild the Day 06/07 model only from that measurement, re-earn stop, capture, descent, and thermal bounds per mass band, assume a load can slosh or shift until the residual says otherwise, and let go only into a drop zone Day 29 and Day 30 have cleared

• Day 47 — Pushing, pulling, and moving heavy objects under the payload and outdoor stacks — InteractionWrenchEstimator / ObjectDynamicsIdentifier / ObjectMotionMonitor / ExternalWrenchPublisher / PushAuthorityBounder / PushStanceShaper / RunOutReleaseArbiter / PushPullAdmissionGate: measure the push with the wrist F/T and the momentum balance as two witnesses and never trust the object’s label, give Day 07 the sustained wrench so the CoP shift is planned, keep the CoM inside the polygon and a brake reserve for anything with momentum, back off on every stall, push low enough that nothing tips, measure the stop budget from the object’s leading edge, and let go only at rest with a hold test or into a run-out Day 29 and Day 30 have cleared

• Day 48 — Powered hand tools and sustained process forces under the push/pull and payload stacks — ToolReactionEstimator / ProcessForceObserver / KickbackBindDetector / ToolInertiaIdentifier / ToolWrenchPublisher / ToolHazardEnveloper / ToolSafeStateArbiter / PowerToolAdmissionGate: out-hold the motor or don’t hold it, believe the wrist and the motor current together, cut on every bind and never push through it, keep people out for as long as the edge is turning, and call a tool off only when it’s measured stopped

• Day 49 — Bimanual tool work with a held workpiece under the power-tool and payload stacks — HoldingGripObserver / WorkpieceStateEstimator / ClosedChainWrenchResolver / FixtureHoldVerifier / HoldPointWindowShaper / KerfPinchPredictor / OffcutReleaseArbiter / BimanualToolAdmissionGate: hold the work only as hard as you’ve measured, close the loop on both wrists and the workpiece’s motion, know which forces stay in the arms and which go to the feet, keep the holding hand between the blade’s reach and the wrist’s lever limit, clamp what doesn’t fit, catch a closing kerf before it binds, and let go of nothing until the tool is measured off

• Day 50 — Overhead and awkward-posture tool work under the bimanual and power-tool stacks — OverheadThrustEstimator / RaisedPostureBoundsRederiver / OverheadHoldDerater / DropZoneShaper / OverheadViewIntegrityMonitor / ElevatedStanceVerifier / RaisedFallConeRederiver / OverheadToolAdmissionGate: measure every number in the posture, cap the tilt because it moves the CoP, publish the pull-down with its release, budget the shoulder in seconds, clear the space below before starting because nothing falls slowly enough to dodge, tether the tool to the rail, and stand only on platforms you’ve tested

• Day 51 — Working on ladders and elevated work platforms under the overhead stack — LadderSetupVerifier / ThreePointContactMonitor / RungClimbSequencer / RungGripObserver / BraceLoadBudgeter / PlatformMotionWitness / ArrestedFallConeRederiver / ElevatedAccessAdmissionGate: measure the ladder’s angle and prove its feet before climbing, tie the top before pushing on the wall, move a foot only when two hook grips can catch a slip, budget the brace hand like the tool hand, ride a lift holding the rail and work only when the robot has seen the deck stop, and clip to an anchor because a fall from a ladder can’t be landed

• Day 52 — Confined spaces and crawl spaces under the elevated-access stack — EnvelopeClearanceMapper / CrawlPostureSequencer / BearingSurfaceProber / EgressPathKeeper / ConfinedAtmosphereBudgeter / LinkLossStopArbiter / RetrievalPlanner / ConfinedSpaceAdmissionGate: fit the whole swept body to the space the robot scanned, probe the ground before every knee, keep a proven way out priced with the heat and dust it will have then, stop the moment it can’t hear or place itself, and bring its rescue in on a tether so nobody has to crawl in after it

• Day 53 — Water, wet floors, and spills under the confined-space stack — WettedFrictionProber / StandingWaterGauge / IngressExposureBudgeter / WetElectricalZoner / WetGaitBounder / SlipRecoveryRederiver / DryOutVerifier / WetSurfaceAdmissionGate: slide a toe to learn today’s grip and shorten steps to fit it, walk only as fast as one step can still catch a push, touch the bottom instead of trusting the camera, keep every seal inside its own tested limit, stay out of water nobody proved dead, plan for the backward slip fall, and dry out before walking where people walk

Principle

Never put a neural net inside a microsecond loop until you have measured jitter.