Coordinator agents
Decompose missions into tasks and propose them into the pool with suggested priorities. Their opinion is an input, never a verdict.
Humans & reactive triggers
Ad-hoc requests through chat, plus standing rules — battery < 15% → dock —
that inject tasks with no reasoning loop involved.
w₁·priority + w₂·urgency + w₃·age − w₄·travel − w₅·resource_risk.
Hard preemption for safety classes, an aging bound so nothing starves, and physical
affinity — pose, battery, payload — as a first-class term.
Intake queue — warm context
A fresh, task-scoped agent is instantiated and subscribes to the robot's read-only state-delta stream — payload format is the resync digest. It plans speculatively while it waits. Reads never require the lease.
Ready queue — mise en place
Entry requires a concrete, pre-validated goal candidate. Nobody touches the stove until prep is done. Grant order may weight context freshness, bounded by aging so slow thinkers still get served.
Lease authority — one robot, one owner, one epoch
Whole-robot lease with two-phase semantics: deliberation heartbeats, goal-progress renewal.
Every grant increments a fencing epoch; stale writes are rejected with LEASE_LOST.
Reclaim window for the slow, queue service for the dead, anti-squat forfeiture after
K reclaims.
Grant-time re-validation of the candidate goal; a bounce returns the agent to intake with its context still warm. The first write after any epoch change is rejected until the state digest has been consumed.
Validation gate
Every write is checked against the capability manifest: kinematic limits, safe zones, force ceilings, and enforced perception freshness — advisory poses expire.
Execution stack
Nav2, MoveIt2, controllers, drivers. The safe-idle controller owns the robot whenever no valid lease-holder does. Safety sensors are truth; agents are opinion.
Fleet router — the scale-out seam
Discovery, auth, lease brokering, and command routing across N robots, generated from the same capability manifests as robot #1. Deterministic travel-cost auctions run between robots for spatial tasks, never between agents. Multi-robot transactions — two-lease atomicity — unlock here.
One episode_id threads every MCP call, ROS2 goal, rosbag window, validation
verdict, and lease event. Mining proposes; the graduation gate — human review
plus shadow evaluation — decides. Rules never self-deploy into the safety layer. The same
trace tables feed the matchmaker, so the platform gets measurably better at hiring the longer
it runs.
| Component | Trigger that fired | State |
|---|---|---|
| Lease queue & contention | conflicts > 1/day, second task source live | Graduated |
| Intake / ready split | idle-while-leased > 25%, deliberation-attributed | Graduated |
| Scheduler + task pool | pending depth > 3 sustained | Graduated |
| Matchmaker | ≥ 2 templates, divergent trace metrics | Graduated |
| Fleet router | robot #2 physically on order | Graduated |
| Rules mining | ≥ 500 episodes of a recurring task type | Graduated |
| Multi-robot transactions | concrete two-robot task specified | Graduated |