Three proofs with dates, and what blocks the rest
Since 19 September 2026 the product’s roadmap is short on purpose: three proofs, each with a date it keeps or misses in public; everything else paused until those and a paid engagement exist; and a list that starts only when a customer needs it. Below them, what ships today and what is planned.
The checkpoint of 31 October 2026 promised a dated status line beside each proof: delivered, or missed and by how much. Proofs 1 and 3 carry one; proof 2, due 31 December 2026, does not yet.
Now: the three proofs
Each removes an objection that blocks every sale. Mirrored by hand from docs/roadmap.md in the product repo, at main, 4e75173, which is the authority; the product repo wins on any disagreement.
- Proof 1 , missed; new target , missed; new target
A calibrated predicate, and a second predicate a safety engineer recognises
Status as of : The 14 November date is missed, decided on 10 November. Report schema 9 (the policy’s identity, the scene each pair starts from, how each episode ended and the predicate it was scored against) ships in 0.48.0 (12 November 2026), so the fit and the pinned re-run can now record it; neither has run. What shipped before, in 0.47.0 (7 November 2026): a new run records the init state each episode’s reset loaded (report schema 8); provael calibrate --init-state-offset starts a fit past a chosen state; the GPU arm’s plan step refuses a fit on the published headline’s seeds or opening scene, and a scored stage whose pinned scenes meet the fit’s; and provael attack --pin-init-states takes each episode’s scene from its seed. Nothing has been re-run: the published headline is unchanged and still uncalibrated, and the scheduled campaign is still paused.
Removes: “your unsafe definition is arbitrary”
Fit the keep-out zone per task from the benign reachable bounds at a target false-positive rate of 1% or less with the face chosen from data; commit the ten calibration JSONs; make the calibrated predicate the libero default; re-run the headline (roleplay plus the four controls) and the π0.5 leg under it; publish whatever comes out, with an erratum, a README and a site change the same day if the headline moves. Beside it, a contact / force event from the simulator, reported as a second column next to the envelope exit, never in its place: the column has shipped, verified against its sources and not yet against a live simulator, and the re-run is what fills it. The scheduled GPU campaign is paused until this lands, because it would re-measure with the box.
- Proof 2
One real-arm run, published even if null
Removes: “zero hardware runs”
The protocol is pre-registered (sim-to-real, SO-ARM101). The two hardware blockers stand until the arm, an inline cut on the DC supply and a per-trial servo-bus voltage trace exist; then the n = 5 protocol with SmolVLA, then 30 trials, per-trial logs and video committed, the result published whichever way it comes out.
- Proof 3 , delivered
Peer review: the SPAIS@CoRL four-pager
Status as of : Submitted before the 1 October 2026 deadline; not accepted, notified 17 October 2026.
Removes: “no peer review”
A four-page submission around the measurement discipline — benign controls, Wilson and task-clustered intervals, published nulls, errata, the π0.5 null; arXiv in November regardless of the decision, the identifier into CITATION.cff and the README. After the calibrated predicate: the second architecture properly — the full π0.5 leg and OpenVLA-OFT or GR00T N1.7 through the allenai harness path, October to December, nulls published as nulls.
Limits in force since 20 September 2026
- Limit
No new attack families, crosswalks, output formats, recipes or suites until the three proofs and a paid engagement exist.
The registry holds 17 adversarial families and 8 have met a real policy; the compliance layer already outruns the measurement. A named prospect asking for a specific missing capability on a call is the one exception, recorded in the roadmap when it happens.
- Limit
The compliance layer is split into two tiers, carried on every emitted row.
Operative — the Machinery Regulation 2023/1230, ISO 10218:2025, ISO 13849, IEC 61508, IEC 62443 — is the route a machinery assessor reads this evidence through and the one the project develops. Reference — every other mapping — is kept, emitted and checked, not developed further. ISO 12100 and ISO/IEC TS 22440 are cited, not implemented.
- Limit
One minor release every two to four weeks; patch releases only for correctness.
Fifty-seven releases in fourteen weeks meant a version-drift risk on each of them and read as churn. Incident narratives go to the errata, not the changelog.
- Limit
Integration after the hardware run, not before.
The model-server proxy for the allenai harness, an Inspect task, a Trajectory-Level Redirection reimplementation and the Isaac Lab-Arena, ROS 2 and planner-level adapters start only once the calibrated predicate and the real-arm run exist; they are worth nothing on top of an uncalibrated predicate.
Started only when a customer needs it
Each starts when a qualified engagement needs it, not before.
- More attack families and adapters, when a customer’s configuration needs the specific missing capability.
- A hosted, multi-tenant operated surface with billing, when repeated buyers require hosted operation and will pay for its controls; the in-repo server stays an experimental reference.
- Hardware and sim-to-real beyond the one pre-registered run — a funded partner and a facility.
- A certification- or insurer-shaped product — a named relying party that specifies and accepts a scoped evidence use.
- A full calibration platform — repeated engagements showing the narrow corrected workflow is insufficient.
Shipped
No capability in this list is typed by hand: it is derived at build time from the same artifacts /results and /defenses render from, pinned to v0.48.0 (4e75173) — release 0.48.0. What each release changed is on the changelog.
- Attacks
8 families measured on a real policy; 1 separates from the benign floor; 17 registered, mapped to the Embodied AI Security Top 10. The registry holds 39 adversarial attacks across 17 adversarial families (counting the benign baseline and the harmless-variation controls, 45 registered attacks in 19 families).
Registered means implemented and unit-tested. 8 of 17 have been exercised against a real policy in a real simulator; 9 have never met a real model.
- Coverage
8 of 10 Embodied AI Security Top 10 risks have at least one registered attack family.
The 2 without one are scope decisions rather than gaps — the per-risk pages say which, and an untested surface is not rendered the same as a surface with no attack.
- Defenses
two defenses measured end to end under a pre/post protocol with confidence intervals: instruction canonicalization and action envelope.
Both are CPU-fixture studies and both open by stating how much of their own credit is circular. No real-model transfer is claimed for either.
- Evidence
SARIF, OSCAL, AVID, a CycloneDX ML-BOM, a compliance crosswalk and a pre-deployment scorecard.
Checkpoint-integrity verification ships; model signing via Sigstore does not — it is in the planned column below.
- Leaderboard
Ed25519-signed, verifiable offline against a published key, with the submission path documented and shipped.
Zero external submissions have arrived. That is a fact about adoption, and it is published as zero rather than omitted.
How current is any of this: the board’s rows were measured with 0.41.2 — which is not the release 0.48.0 these counts come from, and is not meant to be: a release re-pins artifacts without re-measuring anything. The product’s own freshness signal reads last measured — stale. When that goes stale it stays stale until a real measurement runs, which is the point of it.
Planned, which means not built, and every item conditional
Mirrored by hand from docs/roadmap.md in the product repo, at main, 4e75173. No build check compares that file with this list, so if the two disagree the product repo wins. Contributions are welcome on any row.
- Calibration
Real-policy calibration validity: a fresh supported real-policy calibration run under the three-way calibration path. The path itself has shipped; the run is what has not happened.
Blocked on: Conditional on the 15 December 2026 re-run. Until it lands every real-policy number is measured under the uncalibrated default box, no real-policy calibration validity is claimed, and the honest offer stays the explicitly uncalibrated robustness diagnostic.
- Suites
RoboCasa, CALVIN, SimplerEnv, and the AI2 vla-evaluation-harness bridge as a model-server proxy.
Blocked on: Conditional on a customer needing one, and on the calibrated predicate and the hardware run for the harness proxy. The ai2_bridge suite is registered scaffolding — no benchmark ever run — written against a reading of the harness its maintainer corrected in allenai/vla-evaluation-harness#127.
- Attacks
Gradient-based adversarial suffixes (GCG-style) and a real-model transfer of the `optimized` family beyond the stub.
Blocked on: Conditional on a customer or a funded study. The white-box patch half shipped in 0.39.0; `weight_integrity` and `gradient_patch` have met a real policy (SmolVLA, one task, three seeds, 0/3 each, 14 September 2026) and the powered arm is priced but has not run. No rate is stated before its result is committed.
- Supply chain
Model signing via Sigstore.
Blocked on: Checkpoint-integrity verification and the CycloneDX ML-BOM ship today; signing is the piece that is not built.
- Standards
A MITRE ATLAS case study and an OWASP Agentic embodied annex.
Blocked on: Submissions and proposals until a body accepts them; drafts exist in docs/standards. The ATLAS case study sent on 8 August 2026 was withdrawn on 27 September 2026 after erratum E-2026-12. The OECD.AI listing is live, so it is no longer planned.
Planned means not shipped. Nothing in the planned list has been built, measured or half-built, and no number anywhere on this site depends on any of it.