Frames & units contract

Freeze this before CAD, firmware zeroing, or sim. Everything downstream trusts these names.

Conventions (fill in as the design locks)

Item	Decision
World / gravity frame	TBD (e.g. Z-up, right-hand)
Base / pelvis frame	TBD
Joint axis sense	Right-hand rule; positive = TBD
Encoder zero	Mechanical stop / mid-range / calibrated home — TBD per joint
IMU mount link / extrinsic	TBD (Day 03); units $m/s^2$ , $rad/s$
Contact frames (feet/hands)	TBD (Day 03); wrench N, N·m
Lengths	meters
Angles	radians in software; degrees only in human docs
Mass / inertia	kg, kg·m² about link CoM
Torque / force	N·m, N
Time	seconds; loop rates in Hz; declare bus timebase
Voltage / current	V, A on named rails; publish bus and logic domains separately

Named links & joints

Link	Parent	Joint	Axis	Limits (rad)	Notes
—	—	—	—	—	Add first limb here

Message / bus rates (targets)

Loop	Rate	Owner
Current / FOC	10–20 kHz	MCU
Joint torque / impedance	1–2 kHz	MCU
Contact / FT sample	0.5–2 kHz	MCU
IMU raw	200–1000 Hz	MCU
State estimation	100–500 Hz	mid compute
Behavior / planning	≤50 Hz	mid / high compute
Power / BMS publish	10–100 Hz (faster under fault)	BMS / mid MCU

Clock domain & bus (Day 04)

Item	Decision
Spine	TBD (CAN-FD / EtherCAT / hybrid)
Time master / `clock_domain` name	TBD (e.g. `ec_dc`, `host_mono`)
Cycle time $T_c$	TBD
Node ID map	TBD (link from bus config)
`age_budget_ms` by message class	TBD — JointState / ImuSample / ContactState / PowerState / EstimatorState
Sync mechanism	TBD (DC / heartbeat / host-stamp early only)

Power domain & voltage (Day 05)

Item	Decision
Pack nominal / series count	TBD
High-power DC bus rail	TBD (e.g. pack-direct ~48 V class)
Logic / sensor rails	TBD (e.g. isolated 5 V / 3.3 V)
Soft-sag / soft-UV / UVLO thresholds	TBD — label measured vs illustrative
`torque_scale` / `max_iq_abs` consumer	Day 02 joint command path
STO / safe-torque-cut owner	TBD (hardware gate-power kill)

Estimation & contact modes (Day 06)

Item	Decision
Estimator owner / output rate	TBD (target 100–500 Hz; one writer of `EstimatorState`)
Process model class	TBD (EKF / complementary / hybrid)
Stale policy	TBD — hold last + `stale` vs process-model propagate
Contact mode list	TBD (e.g. FLIGHT / SS / DS) and how `contact_set` is derived
Power-aware residual rule	TBD — downweight / gate on `torque_scale` or `PowerFault`
Twin delay / dropout / sag hooks	TBD — must match hardware `age_budget_ms` and Day 05 derate

Upper-body / EE frames (Day 10)

Item	Decision
EE / wrist frames (L/R)	TBD — named links aligned with `EstimatorState`
Hand / grasp frames	TBD — aperture units; wrench N, N·m if instrumented
`ManipulationCommand` owner / rate	TBD (mid-rate; one writer of manip intent)
Hand role tags	FREE / CLAIM_SUPPORT / MEASURED_SUPPORT — measured `contact_set` owns truth
Mid-reach abort signals	stale / `POWER_GATED` / low `torque_scale` → abort/soften EE tasks
Twin reach / sag hooks	TBD — matched arm-load peaks and contact delay as hardware

Soft learned / teleop / arbiter contracts (Days 14–16)

Soft writers only. Measured ContactState still owns hard support membership into one WBC/QP. never_hard binds residual, scene, policy, teleop, and arbiter alike. Mid / host rate with age_ms — never µs / EtherCAT cyclic until jitter is measured.

Item	Decision
`LearnedResidual` / `ResidualCorrection` owner / rate	TBD (Day 14) — soft additive on estimate features / soft task refs / AffordanceProposal ranking only
`SoftSceneGraph` / Object / Support / Relation nodes	TBD (Day 14) — enrich AffordanceProposal CLAIM candidates only
`LearnedPolicy` / `PolicyAction` / `PolicyCommand` owner / rate	TBD (Day 15) — mid / host; soft refs / AffordanceProposal ranking / CLAIM admit only; `closed_loop: true`; `never_hard: true`
`SimToRealGate` status / checks	TBD (Day 15–16) — RED/YELLOW/GREEN; block free closed-loop / shared autonomy until GREEN
`TeleopCommand` / `OperatorIntent` source / rate	TBD (Day 16) — STICK / VR / EE_DELTA / BUTTON; mid / host; soft refs / CLAIM admit only; `never_hard: true`
`SharedAutonomyArbiter` modes	TELEOP_ONLY \| POLICY_ONLY \| BLEND / SHARED \| OPERATOR_OVERRIDE \| ABORT — all still soft; OVERRIDE ≠ hard ownership / MEASURE skip
Soft vs hard ownership	Teleop / policy / arbiter / residual / scene / affordance = soft; measured FOOT\|HAND\|OBJECT = hard cones + $F_z \ge 0$ ; one WBC/QP; yield to Day 08 gait / Day 09 recovery / Day 05 power
Mid-arbitration abort signals	stale / `POWER_GATED` / flicker / residual disagree / operator dropout / reward-hack / SimToReal fail → abort/demote
Twin mid-arbitration hooks	teleop vs policy vs MEASURE vs gait vs recovery fights; operator latency/dropout; false CLAIM from intent; reward-hack to hard write — must match hardware
Rate / jitter rule	No neural net or human stick path inside µs / EtherCAT cyclic until jitter measured

Runtime safety supervisor (Day 17) + logging / replay / hygiene (Day 18) + offline / shadow / canary (Day 19) + HIL regression farm (Day 20)

Supervisor sits above soft teleop / policy / arbiter. Logging tags soft vs measured vs power vs stage without promoting scores to MEASURED. Replay is soft-only. Hygiene quarantines dishonest episodes and keeps late-kill / demote / ESTOP as negatives. Offline eval / shadow / canary score and admit under the same gates — still soft; MEASURE and Day 05 still bind. HIL farm schedules twin+bench suites that re-score / re-run / dry-run those paths; RegressionGate fails closed on canary admit when races or hygiene regress — still soft; never a farm plant.

Item	Decision
`RuntimeSafetySupervisor` stage / monitors	TBD (Day 17) — GREEN \| WARN \| INHIBIT_SOFT \| DEMOTE_CONTACTS \| TORQUE_SCALE_CLAMP \| ESTOP; mid / host; soft intents `never_hard`; hard kill via Day 05 only
Kill-chain hard ownership	Day 05 BMS / `torque_scale` / FOC / physical+digital ESTOP — supervisor requests, never dual-writes
`OPERATOR_OVERRIDE` vs kill-chain	OVERRIDE still soft; cannot bypass BMS / gait / recovery / hard stages (live or replay)
`EpisodeLogger` schema / labels	TBD (Day 18) — LABEL_SOFT_INTENT \| LABEL_SUPERVISOR_STAGE \| LABEL_MEASURED_CONTACT \| LABEL_POWER \| LABEL_ESTIMATE \| LABEL_GATE \| LABEL_NEGATIVE_KILL; preserve age_ms / stage / gate / POWER_GATED / residual disagree
`ReplayHarness` mode	SOFT_ONLY — feeds teleop / policy / arbiter only; forbid cones / JointCommand-as-measured / dual-write torque_scale / ContactState writes
`DatasetHygiene` decisions	ADMIT \| QUARANTINE \| KEEP_NEGATIVE — quarantine reward-hack / OVERRIDE fight / missed POWER / promote-w/o-measure / dual-write / false-green / soft→MEASURED / stripped honesty; keep late-kill / demote / ESTOP
Soft vs MEASURED on export	Teleop score / policy reward / blend / supervisor stage ≠ MEASURED; strip_honesty refused on free-export path
Twin logging/replay races	Stale age stripped; WARN relabeled MEASURED; replay writing cones; clock skew dropping stage; OVERRIDE-as-GT; pretty-bag cleaning — SimToRealGate blocks free harvest until GREEN
Rate / jitter rule	Logger / replay / hygiene mid / host only — no µs / EtherCAT cyclic until jitter measured; no nets reconstructing cones in µs loops
`OfflineEvaluator` metrics	TBD (Day 19) — soft metrics on SOFT_INTENT only; measured on MEASURED only; supervisor-aware negatives; age_ms / SimToRealGate / POWER_GATED / residual honesty; refuse green on reward alone
`ShadowRunner` mode	OBSERVE_ONLY — ShadowAction / ShadowScore; forbid JointCommand / cones / dual-write torque_scale / clear stage; first-class dropout / live disagree / residual / stage↑
`CanaryDeployer` admit	POLICY_ONLY \| BLEND (small α) only when OfflineEvaluator + DatasetHygiene + RuntimeSafetySupervisor + SimToRealGate green; still soft; MEASURE before PROMOTE; abort/rollback on escalate / stale / POWER_GATED / gate fail / residual / hygiene spike
OVERRIDE vs canary	OVERRIDE still soft; cannot force canary past Day 05 hard path / BMS / gait / recovery
Twin eval/shadow/canary races	False-green offline; shadow hard-write; canary skips MEASURE; dual-write torque_scale; OVERRIDE-as-bypass; clock skew in canary window; reward-hacked bags green offline — SimToRealGate blocks free canary until GREEN
Rate / jitter rule (Day 19)	Offline / shadow / canary mid / host only — no µs / EtherCAT cyclic until jitter measured; no nets in µs loops
`HilFarm` schedule	TBD (Day 20) — continuous twin+bench host; same schema phys↔twin; mid/host; never second plant; forbid JointCommand / cones / dual-write torque_scale / clear stage / skip-MEASURE; require ESTOP pairing
`HilSuite` scenarios	BAG_REPLAY \| RACE_INJECT \| OFFLINE_RESCORE \| SHADOW_OBSERVE \| CANARY_DRY_RUN — supervisor-aware negatives / age_ms / POWER_GATED / gate / residual / hygiene spike required; refuse soft→MEASURED / strip honesty
`RegressionGate`	Fail-closed soft-admit blocker — RED on suite regression / hygiene spike / false-green offline / shadow hard-write / measure-skip / dual-write / OVERRIDE-bypass / clock skew / unpaired ESTOP; never hard writes
OVERRIDE vs farm	OVERRIDE still soft; cannot force farm green or canary past Day 05 hard path / BMS / gait / recovery
Twin+bench farm races	Honesty-stripped suite green; replay without age/stage; dual-write for bench; OVERRIDE-as-bypass; skip MEASURE because suite busy; unpaired ESTOP; false-green Offline re-score; shadow hard-write under schedule; canary dry-run as free admit — SimToRealGate blocks continuous farm / free canary until GREEN
Rate / jitter rule (Day 20)	Farm / suite / gate mid / host only — no µs / EtherCAT cyclic until jitter measured; no nets in µs loops