↳ Layer 1 · the capability manifest
What a robot declares.
A URML-compatible robot ships one capability manifest: a small, machine-readable document that says what it can do. The validator reads it to decide, before a single actuator moves, whether a program is within reach. The manifest is additive and opt-in, every block below is optional, and a bare v0.1 manifest still validates unchanged.
The bar
A primitive that uses a capability the manifest does not declare is rejected at Pass 2, with a
structured error naming the primitive, the missing field, and the suggested addition. No capability,
no motion.
Motion
How the robot moves through space, and the geometry it moves in.
mobility RFC-0009 · 0291 · 0518
Drive type, velocity and acceleration bounds, traversable slope, and an operational clearance volume for cross-robot deconfliction.
frames RFC-0290
Declared coordinate frames and their SE(3) transforms, so a pose in any frame resolves into any other.
whole_body RFC-0384
Kinematic chains and static-stability limits (center of mass within the support polygon) for legged and humanoid platforms.
Manipulation
Grippers, arms, and the objects they can act on.
manipulation RFC-0010
Grippers with force ranges and accepted object classes, plus optional arms for whole-body and bimanual work.
dexterous RFC-0586
Multi-fingered hands: degrees of freedom, finger count, and the grasp types a program may request.
Perception & world model
What the robot can sense, and the finite set of places and things it knows.
perception RFC-0039 · 0615
Cameras and sensors with capability fields (beam count, channels, timestamp methods, rate) and which sensor detects which object class.
declared_locations / areas RFC-0615
Named places and regions a primitive may target by name, resolved against declared frames.
declared_events RFC-0006
Event identifiers that wait_for and link-loss rules may name.
Safety & compliance
The provenance, connectivity, and licensing the policy pass checks before anything runs.
provenance RFC-0004
Hardware bill of materials and attestation, checked against the active compliance policy (US-federal by default).
connectivity RFC-0006
Abstract link roles and the link-loss safety contract, validated against the deployment envelope.
licensing / deployment RFC-0262 · 0268
Per-component licenses and integration boundaries, plus a commercial-use gate that refuses a CC-BY-NC component in a commercial deployment.
evidence RFC-0631
How each capability claim was established (declared, derived, verified, inferred), with an opt-in policy hook.
Substrate & timing
The layers beneath the language: outputs, programs, real-time timing, and the runtime substrate.
outputs / programs RFC-0015 · 0017
Digital and analog output lines for set_output, and substrate-declared programs for call_program.
realtime RFC-0016 · 0469
A cyclic timing contract (period, watchdog, guarantee) with an acyclic sub-block for the SDO / mailbox regime.
substrate RFC-0385 · 0477 · 0478
Zero-copy IPC (iceoryx generation), the clock-synchronization regime, and ordered bring-up and recovery.
minimal_node / firmware RFC-0018 · 0669
Non-mobile sensor and actuator nodes, and a firmware declaration.
Language, learning & simulation
Speech and translation, learned controllers, and simulation fidelity.
language RFC-0260 · 0304
Speech-to-text, text-to-speech, and translation engine classes, with a permissive commercial-eligible translation alternative.
learned_policy RFC-0383 · 0617
The training envelope of a learned controller (command ranges, terrain, payload); a program is refused outside it. Multiple named per-domain policies are supported.
validation / av RFC-0020 · 0381
Simulation-fidelity hints, and an autonomous-vehicle block (HD map, operational design domain, minimal-risk maneuver).
Fleet
Several robots, addressed and validated as one.
roster RFC-0286 · 0290 · 0291
Binds N per-robot manifests by handle, with a shared world frame and per-member anchors, so validate_fleet can catch cross-robot collisions statically.
One manifest, every substrate
Declare it once. Validate everywhere.
The same manifest describes a robot running ROS 2, PX4, a vendor SDK, or a simulator. The validator checks the program against it before the runtime ever sees a command.