# description
Per-robot-action attestation envelope binding {robot-platform, environment, command, trajectory, outcome, safety-violations, runner-DID} to a cryptographic chain. Closes SYNTHESIS-acquisition Round 19 P4 [[robotics-foundation-models]] B1 ship-first action. EIGHTEENTH JSON Schema in IntelligencePro's catalog. Robotics-side architectural twin of ip.eval.run.attestation.v1: when a robotics foundation model emits an action, an INDEPENDENT attester verifies whether the action satisfied the command, respected safety constraints, and behaved as the trajectory plan claimed. Designed for: Physical Intelligence ($4.4B Mar-2026; π₀ → π₀.₅ → π₁ vision-language-action models) + Skild AI ($1.5B Aug-2024 + Series B Apr-2026 $4.5B; general robotics brain) + Figure AI ($39.5B Q1-2026 Series C; humanoid F.03 + Helix VLA) + 1X Technologies (NEO Beta + NEO Gamma humanoid) + Sanctuary AI (Phoenix Gen 8 humanoid) + Apptronik (Apollo humanoid; Mercedes deployment + GXO + Daimler) + Agility Robotics (Digit humanoid; GXO Spanx warehouse deployments) + Boston Dynamics (Spot + Stretch + Atlas Electric) + Tesla Optimus + Unitree Robotics G1/H1 + Fourier Intelligence GR-1 + XPeng Iron + Galbot G1 + UBTech Walker S2 + Booster Robotics + LimX Dynamics CL-3 + NVIDIA Isaac Sim + Isaac Lab + NVIDIA GR00T (Generalist Robot 00 Technology; humanoid foundation model) + NVIDIA Cosmos world-foundation-models + Toyota Research Institute LBM (Large Behavior Model) + Google DeepMind RT-2 / RT-X / RoboCat / Gemini Robotics + Open X-Embodiment dataset (22 institutions, 527 skills) + LeRobot (HuggingFace; >1M episodes) + Hugging Face Open Robotics + ROS 2 Humble/Iron/Jazzy + MoveIt 2 + Drake (TRI) + Gymnasium-Robotics + RoboCasa (NVIDIA + UT Austin) + ManiSkill 3 (UC San Diego) + RoboHive (Meta FAIR) + RLBench + CALVIN + LIBERO + Procgen + MetaWorld. Anchors the 2026-Q1 sim-to-real attestation gap (Physical Intelligence + Skild + Toyota TRI all reporting ~40-60% drop in success rates from sim to real; without cryptographic attestation, sim-claimed capabilities mislead deployment decisions). Composes UPSTREAM with ip.sandbox.run.attestation.v1 (cycle 307) via sandboxRunId when actions are sim-only. Composes DOWNSTREAM with ip.governance.compliance.v1 (cycle 315) via evidenceShaArray[] — ISO 10218 (industrial robot safety) / ISO 13482 (personal-care robot safety) / ISO 22166-1 (modular robot safety) / IEC 61496 (electro-sensitive protective equipment) / EU Machinery Regulation 2023/1230 (replaces Machinery Directive 2006/42/EC; enforced 2027-01-20) compliance evidence.

# $comment
Discovery: https://ip.tekton.cc/.well-known/ip-knowledge.json (full descriptor) | Badge: https://ip.tekton.cc/api/badge/v1/attestation/robot.action.attestation.v1/<subjectSha256> (shields.io endpoint) | Free dry-run: POST https://ip.tekton.cc/api/credentials/dry-run with body {kind:"robot.action.attestation.v1", body:<candidate>} (no auth required, validates against this schema) | Verification recipe: https://ip.tekton.cc/docs/verification-recipe.md (3-layer trust model + curl trail) | Revocation: https://ip.tekton.cc/credentials/status/v1 (W3C BitstringStatusList v1.0; check bit at credentialStatus.statusListIndex)

# properties.schemaVersion.description
Semver of this schema. Bumps to 2.0.0 land at /credentials/robot-action/v2 — v1 stays immutable (see /docs/schema-versioning.md for the cycle-726 canonical bump-mechanics + soft-change-detection contract).

# properties.actionId.description
Unique RFC 4122 UUID v4 or v7 — this action's canonical identifier.

# properties.robotPlatformVersionSha256.description
Optional sha256 of the canonical robot-platform firmware + policy-network artifact. For VLA-policy-driven robots: sha256 of the policy weights (safetensors). For classical-control + RL-policy hybrids: sha256 of the deployed bundle manifest. Pins WHICH POLICY ran. Defeats the silent-policy-update class (a robot platform OTA-updates between attestation and deployment).

# properties.embodiment.description
Embodiment class. 'humanoid-bipedal' = Figure / 1X / Sanctuary / Apptronik / Optimus / Unitree H1. 'humanoid-wheeled' = various early industrial. 'quadruped' = Spot / Unitree Go2. 'manipulator-arm-stationary' = Franka / UR / Kuka. 'manipulator-arm-mobile' = Fetch / Tiago. 'autonomous-vehicle' = Waymo / Wayve / Cruise. 'simulated-only' = Isaac Sim / MuJoCo / Gazebo without real-world deployment. Routes downstream verifiers + safety-standard mapping (ISO 10218 industrial vs ISO 13482 personal-care vs ISO 22166 modular).

# properties.commandSha256.description
Sha256 of the canonical bytes of the high-level command the robot was given. For natural-language instructions: sha256 of UTF-8. For structured commands: sha256 of JCS-encoded. For programmatic API calls: sha256 of canonical request. Required: pins WHAT the robot was asked to do.

# properties.commandText.description
Optional plaintext command (e.g., 'fold the towel on the counter', 'place the red block on the blue block', 'navigate to the kitchen and unload the dishwasher'). When present, sha256(canonical-utf8(commandText)) MUST equal commandSha256. Recipe pin (cycle 1181): canonical-utf8(<text>) = sha256 of the UTF-8 byte encoding of <text> AS-PROVIDED, with NO Unicode normalization — equivalent to sha256(<text>.encode('utf-8')). The word 'canonical' refers to the canonical UTF-8 encoding (no BOM, no JSON quoting), NOT to Unicode-NFC normalization. Note: this binding fires ONLY for plaintext commandText; structured commands (JCS) + programmatic API calls have their own commandSha256 recipes per the commandSha256 description.

# properties.environmentSha256.description
Sha256 of the canonical bytes of the environment context. For simulation: sha256 of the scene + asset manifest (Isaac Sim USD scene, MuJoCo MJCF, Gazebo SDF). For real-world: sha256 of the canonical sensor-summary at action start (RGB-D snapshot + IMU + object-detection-priors). Pins WHICH WORLD the action took place in. Defeats the 'demoed on a different scene' class.

# properties.trajectorySha256.description
Sha256 of the canonical bytes of the executed trajectory (sequence of joint angles + end-effector poses + grasp states + base velocities, sampled at the robot's control frequency). For Open X-Embodiment + LeRobot episode format: sha256 of the canonical episode dataset. Lets a downstream verifier replay the trajectory in simulation against the same environmentSha256 to confirm reproducibility.

# properties.outcomeAssessment.description
Outcome of the action. 'success' = command satisfied per acceptance criteria. 'partial-success' = some sub-goals reached. 'failure-no-progress' = robot took no meaningful action. 'failure-recovered' = robot detected failure and self-recovered. 'failure-unrecovered' = robot detected failure but could not recover. 'timeout' = action exceeded time budget. 'safety-violation-stop' = automatic safety system halted execution (force-limit / collision / restricted-zone). 'human-intervention-required' = robot stopped and waited for human. 'human-intervention-taken' = a human took over (teleoperation). 'aborted-by-operator' = operator manually halted. 'abstain' = attester ran but declines to score.

# properties.outcomeScore.description
Optional numerical outcome score [0..1]. Domain-specific aggregation of partial credit (e.g., LIBERO / CALVIN / RLBench task-completion fraction).

# properties.successCriteriaSha256.description
Sha256 of the canonical bytes of the success-criteria rubric the assessment was scored against. Critical because 'success' means different things across task families (object-in-region vs object-pose-tolerance vs sub-task-sequence-complete). Pinning defeats the silent-criteria-edit class (a vendor relaxes acceptance criteria between baseline and benchmark submission).

# properties.safetyViolations.items.properties.kind.description
Class of safety violation. ISO-mapped enums let a downstream auditor file the attestation against the standards-compliance trail.

# properties.safetyViolations.items.properties.severitySi.description
Optional severity-index. For force violations: peak force in newtons. For workspace violations: penetration depth in meters. For speed violations: peak speed in m/s. Domain-defined.

# properties.safetyViolations.items.properties.atTimestampMs.description
Optional offset within the trajectory (milliseconds from action start) when the violation occurred.

# properties.safetyViolations.description
Array of safety violations detected during execution. EMPTY array = no violations detected (a meaningful attestable fact for ISO compliance evidence).

# properties.policyClass.description
Policy class. 'vla-end-to-end' = π₀ / OpenVLA / RT-2 vision-language-action end-to-end. 'diffusion-policy' = Chi et al. diffusion policies + DPPO. 'modular-classical-with-llm-planner' = SayCan / CaP / VoxPoser / Code-as-Policies. Routes downstream verifiers — comparing a VLA policy's results to a teleoperation baseline is a category error.

# properties.simulationContext.properties.simulatorVersionSha256.description
Sha256 of the simulator artifact. Defeats silent-simulator-update class — Isaac Sim 4.0 → 4.5 changed friction defaults; results from those versions are not directly comparable.

# properties.simulationContext.properties.isSimOnly.description
True when this action was only executed in simulation. Critical metadata: sim-only success has lower evidentiary weight than real-world success. Physical Intelligence + Skild + Toyota TRI all report ~40-60% drop in success rates from sim to real.

# properties.simulationContext.properties.domainRandomization.description
Optional domain-randomization context (lighting + texture + friction + mass + sensor-noise ranges). Lets a downstream verifier assess sim-to-real bridge quality.

# properties.simulationContext.description
Optional simulation context. Required-by-policy for outcomeAssessment evidence when isSimOnly is true.

# properties.datasetEpisodeRef.description
Optional reference to the dataset episode this action belongs to in standard robotics datasets (Open X-Embodiment, LeRobot, DROID, RT-X). Format: 'oxe://embodiment/<id>@<episode-idx>', 'lerobot://dataset/<owner>/<name>@<episode-idx>', 'droid://session/<id>@<episode-idx>'.

# properties.executedAt.description
Epoch milliseconds when the action started executing.

# properties.durationMs.description
Optional execution duration in milliseconds.

# properties.runnerDid.description
DID of the entity that ran the action + emitted the attestation. did:web for institutional runners (did:web:physicalintelligence.company, did:web:skild.ai, did:web:figure.ai, did:web:1x.tech, did:web:apptronik.com, did:web:agilityrobotics.com, did:web:nvidia.com, did:web:tri.global); did:key for OSS / individual researchers (LeRobot contributors, Open X-Embodiment dataset releasers). LOAD-BEARING: runnerDid SHOULD NOT equal the robotPlatformId-vendor's primary DID (peer-attestation property; the robot vendor cannot solely self-attest its own success rates). Producers MUST enforce this separation.

# properties.humanReviewerDid.description
Optional DID of a human reviewer who endorsed the outcome assessment. ISO 13482 personal-care deployments often require human sign-off on safety-violation classifications.

# properties.regulatoryContext.properties.iso10218Applicable.description
True for industrial-robot deployments under ISO 10218 (robots and robotic devices — safety requirements; revised 2025-09 to ISO 10218-1:2025 + ISO 10218-2:2025).

# properties.regulatoryContext.properties.iso13482Applicable.description
True for personal-care robot deployments under ISO 13482:2014 (humanoids in shared human spaces; Apollo Mercedes + Digit GXO Spanx).

# properties.regulatoryContext.properties.iso22166Applicable.description
True for modular robotic applications under ISO 22166-1:2021.

# properties.regulatoryContext.properties.euMachineryRegulationApplicable.description
True for EU Machinery Regulation 2023/1230 deployments (replaces Machinery Directive 2006/42/EC; enforced 2027-01-20). Robots with AI-driven autonomy fall under enhanced risk-assessment requirements.

# properties.regulatoryContext.properties.euAiActAnnexIIIApplicable.description
True for robotics deployments classified as high-risk AI systems under EU AI Act Annex III (worker management, safety-critical infrastructure). Enforced 2026-08-02; €15M / 3% global turnover.

# properties.regulatoryContext.description
Regulatory-context flags. Lets a downstream auditor filter robotics attestations by applicable safety regime.

# properties.ipAttestationEventId.description
Optional: UUID of the ip.attestation.event.v1 wire row that envelopes this attestation for transport.

# properties.signature.description
Ed25519 signature (128 hex = 64 raw bytes) over the canonical-JSON bytes of (actionId ⊕ robotPlatformId ⊕ robotPlatformVersionSha256? ⊕ embodiment? ⊕ commandSha256 ⊕ environmentSha256 ⊕ trajectorySha256 ⊕ outcomeAssessment ⊕ outcomeScore? ⊕ successCriteriaSha256? ⊕ safetyViolations? ⊕ policyClass? ⊕ simulationContext? ⊕ datasetEpisodeRef? ⊕ executedAt ⊕ durationMs? ⊕ runnerDid ⊕ humanReviewerDid? ⊕ regulatoryContext? ⊕ ipAttestationEventId?). Verify against the publicKey published in the runnerDid's JWKS. RFC 8037 + JCS (RFC 8785). ⚠ INTEGRITY GAP (aa-824-P0-1, cycle 848 honest disclosure): `chain.*` and `extra` are presently OUTSIDE this signature pre-image. A wire-path or post-hoc rewrite of `chain.parentSha256` / `chain.parentKind` / `chain.parentAttestationId` does NOT invalidate this `signature`. Offline verifiers using `signature`+`publicKey` (the documented embedded-verification path) MUST treat `chain.*` as ADVISORY pointer-shape, NOT cryptographically bound to this attestation. For full-integrity verification including chain pointers, fetch the W3C DataIntegrityProof envelope from /credentials/<sha>/v1 and verify against the proof.cryptosuite=eddsa-jcs-2022 signature (which signs the FULL canonical-JSON body including chain). Cycle-484 added the chain block; cycles 778-784 swept it; the signature pre-image was not re-derived. Migration target: v2 schema slug ($id pin per cycle-462). See cycles 825-829 (5/5 wedge-tier ring) + cycle 830 (verification-recipe.md dual-path teaching) for the canonical write-up; cycle 848 fans this disclosure to the 12 remaining chain-bearing leaf schemas in one batch.

# properties.publicKey.description
Ed25519 public key (32 raw bytes = 64 hex) corresponding to the signature.

# properties.affectsIdentifiableIndividual.description
Cycle 538 (regulatory-compliance RC-480-F9 fan-out): flag signaling the robot action interacts with or affects an identifiable real person (service robotics, eldercare, home assistance, autonomous transport with named passengers, surgical robotics). When true, GDPR Article 22 + EU AI Act Article 50 data-subject-rights obligations attach. Defaults to absent (treated as false for back-compat). Robot actions in industrial / warehouse / pure-research settings without human interaction don't trigger Art 22.

# properties.dataSubjectSafeguards.description
Cycle 538 (RC-480-F9 fan-out): same-shape mirror of ip.governance.compliance.v1 (cycle 390) + ip.synthetic.media.attestation.v1 (cycle 487). Required when affectsIdentifiableIndividual=true. EU AI Act Article 50 specifically covers AI systems intended to interact with natural persons (Annex III high-risk class) — service robotics + autonomous vehicles are squarely in scope.

# properties.dataSubjectSafeguards.properties.appealUrl.description
HTTPS URL where the affected individual submits an appeal of the robot's automated action (e.g., request removal from a robot's operational target list, withdraw consent for biometric tracking).

# properties.dataSubjectSafeguards.properties.humanReviewerDid.description
DID of the human reviewer (or team) responsible for hearing appeals. Distinct from humanReviewerDid on the action attestation itself (the in-loop reviewer); this is the APPEAL reviewer.

# properties.dataSubjectSafeguards.properties.complaintIntakeUrl.description
HTTPS URL for filing a complaint about the robotic policy. GDPR Art 77.

# properties.dataSubjectSafeguards.properties.automatedDecisionScope.description
Honest classification of the robot's autonomy level w.r.t. the affected individual. 'fully-automated' = the robot acts without human supervision (highest scrutiny — autonomous transport, fully-autonomous surgical robots).

# properties.dataSubjectSafeguards.properties.retentionPeriodDays.description
How long the operator retains the trajectory + sensor data + provenance. GDPR Art 5(1)(e). Sensor data covering identifiable people typically has tighter retention than industrial robot logs.

# properties.chain.properties.parentSha256.description
Sha256 of the canonical-JSON bytes of the parent attestation. For a robot.action.attestation the typical parent is the ip.experiment.receipt.v1 that minted the VLA model weights (dominant path — π₀ / π₀.₅ / Helix / GR00T / RT-2 / RoboCat checkpoints have an upstream training-run receipt that anchors the action policy), OR the ip.sandbox.run.attestation.v1 when the action is sim-only and the schema description already names sandboxRunId composing UPSTREAM with sandbox-run (the 2026-Q1 sim-to-real attestation gap is the load-bearing reason — Physical Intelligence / Skild / Toyota TRI report 40-60% success-rate drops sim → real; verifiers walking the chain need to mechanically distinguish sim-claimed vs real-deployed capabilities). ⚠ Cycle 493 honest-disclosure: the platform does NOT verify parent-existence at issuance. Consumers walking the chain MUST resolve parentSha256 against their own attestation registry.

# properties.chain.properties.parentKind.description
Kind identifier of the parent attestation. robot.action typically points at experiment-receipt (the VLA model checkpoint that emitted the action — π₀ / π₀.₅ / Helix / GR00T / RT-2 / RoboCat / Open X-Embodiment) or sandbox-run (for sim-only actions; the cycle-307 sandbox-attestation substrate anchors the sim trajectory before real-world deployment claims compound).

# properties.chain.properties.parentAttestationId.description
Optional UUID of the parent attestation — convenience for consumers that index by id rather than by sha256.

# properties.chain.description
Cycle 784 (sc-772-P0-1 sweep final close): uniform upward chain link per the cycle-484 substrate. With this cycle every leaf attestation in the catalog (18 leaves; pipeline-facet is the intentional tier-1 root, attestation.event is the wire-event record schema, not a leaf) carries chain.parentSha256. ip.robot.action.attestation.v1 specifically anchors the 2026-Q1 sim-to-real attestation gap that Physical Intelligence + Skild + Toyota TRI publicly reported (40-60% success-rate drop sim → real). Block is OPTIONAL (not in required[]) so back-compat preserved.

# allOf[].$comment
Cycle 538 (RC-480-F9 fan-out): when affectsIdentifiableIndividual=true the robot action interacts with an identifiable real person, attaching GDPR Article 22 + EU AI Act Article 50 (Annex III high-risk class for service robotics + autonomous vehicles). dataSubjectSafeguards becomes REQUIRED. Back-compat: pre-cycle-538 records continue to validate without the flag.