Embodied.No Gaps.
No Exceptions.
No Motion Without Proof.

An embodied system that selects which sensor frames to record is not trustworthy. The value of a verifiable record depends entirely on its completeness. A record that contains only the moments the system chose to preserve is worthless as evidence.

Robots today produce narrative logs. Narrative can lie: a robot can log I stopped while physically accelerating. axm-embodied records the physics (Actus Reus) and the model's choices (Mens Rea) side by side, then seals both — and beyond the recorder, it acts on the sealed law in real time.

The flight recorder proves what happened after the fact. The Shadow Runtime acts on the proof while it still matters. The two share one chain of custody: every incident shard cites, by derived shard id, the exact signed envelope that was in force at the moment the motors died.

This is a real mission from this repo's simulator, run through the real Shadow Runtime: 100 frames, wheel slip injected at frame 50. Every number below — shard ids, bounds, latent norms, the timestamp — came out of the actual toolchain, and the incident shard verifies with axm-verify today. Toggle between what the robot's narrative log claims and what the sealed disk proves.

The embodied shard is structurally identical to every other AXM v1 shard. Same manifest.json. Same canonical JSONL core tables. Same Merkle tree. Same axm-hybrid1 signature (Ed25519 + ML-DSA-44 — both must verify). The embodied-specific additions are the binary streams in content/ and the stream index in ext/.

cam_latents.bin is a simple binary container: a 4-byte AXLF file magic, then a sequence of AXLR records in frame_id ascending order. No index. No random access. Scanned linearly by the verifier. cam_residuals.bin uses the same 13-byte header with AXRR magic and variable payloads, no file header. The layout is frozen in the kernel's profile document spec/profiles/embodied@1.md.

from axm_embodied.recorder import CapsuleRecorder
from axm_embodied.gate import LawGate
from axm_embodied.runtime import ShadowRuntime

# No proof, no motion: arming requires a governance clearance.
clearance = LawGate("governance/").authorize("bounds_shard/")
recorder  = CapsuleRecorder("flight/", robot_id="unit-7")
runtime   = ShadowRuntime(clearance, recorder)

for frame in sensor_loop():                    # your perception stack
    decision = runtime.guard(
        frame.latents,                          # 256 bytes, fsync'd
        frame.selected_action,                  # what the VLA chose
        frame.action_distribution,              # Mens Rea, every frame
        residual=frame.residual,                # cold-stream ring buffer
    )
    if not decision.permitted:
        motors.kill()                           # ESTOP — recording continues

# Breach? Seal the incident shard citing the envelope's sh1_ id.
incident = runtime.seal(shard_out="incident/", secret_key=key)

What began as this spoke's private REQ 5 is now a frozen kernel profile. A shard declares "embodied@1" in its manifest profiles array — covered by the signature — and every conforming verifier must run the hot-stream continuity check and report it in profiles_checked. Unchecked ≠ passed. Document shards without cam_latents.bin pass vacuously; the profile fires only when the file is present.

# spec/profiles/embodied@1.md §6 — the entire normative check set
expected_fid = 0
with latents_path.open("rb") as f:
    if f.read(4) != b"AXLF":
        return _err(errors, "invalid file magic")
    while True:
        header = f.read(13)
        if len(header) == 0: break       # clean EOF — check passes
        magic, ver, fid, dlen = struct.unpack("<4sBII", header)
        if magic != b"AXLR" or ver != 1:
            return _err(errors, "bad record magic/version")
        if fid != expected_fid:
            return _err(errors, f"frame gap: expected {expected_fid}")
        f.read(dlen)                        # truncated payload → error
        expected_fid += 1

def test_frame_gap_fails_profile_verification(tmp_path, robot_keys):
    """Cutting a frame out of the hot stream is spoliation: the sealed
    shard can never pass the embodied@1 continuity check."""
    cap = record_mission(tmp_path, fault_at=25)
    compile_capsule(cap, out, key)

    # Excise frame 10's record from the SEALED shard's hot stream
    raw = bytearray(sealed.read_bytes())
    del raw[start:start + LATENT_REC_LEN]
    sealed.write_bytes(bytes(raw))

    result = verify_shard(out, trusted_key_path=pub)
    assert result["status"] == "FAIL"

PASSED · test_frame_gap_fails_profile_verification
PASSED · test_corrupted_latents_kill_the_compile
PASSED · test_safe_run_keeps_cold_stream_empty

The gate answers one question: is this robot allowed to move under this envelope? Trust is decided by the robot's own governance directory, never by the shard. The shard's publisher.pub only names a publisher; verifying a shard against its own embedded key would merely prove the shard agrees with itself.

axm-verify (from the axm-genesis kernel) runs its frozen stage sequence; the embodied@1 profile check runs whenever the manifest declares it. A failure at any stage returns exit 1; a malformed shard returns exit 2. The machine-readable JSON result always lists profiles_checked and profiles_unchecked — unchecked is never passed.