Open Embodied Intelligence Toolchain

Architectural Thesis架构主张

The replacement is a system of contracts, not a table of renamed products. Three.js renders a scene but does not supply MuJoCo's articulated dynamics. Ammo.js exposes Bullet physics but does not reproduce every PhysX solver behavior. Equivalence emerges only when rendering, dynamics, kinematics, sensor models, semantic assets, and validation are composed behind stable interfaces.

The practical target is task equivalence: a manipulation, locomotion, synthetic-data, or virtual-commissioning workflow should meet declared accuracy and throughput limits. Binary claims of platform equivalence are too coarse. A browser model may be sufficient for reach studies and operator review while a contact-rich reinforcement-learning workload needs a native parallel solver.

Important boundary. “RTX-native” removes the Omniverse dependency but still depends on NVIDIA hardware if it uses OptiX or CUDA. A hardware-neutral route uses Vulkan Ray Tracing, WebGPU, Embree, or a pluggable renderer. The architecture supports both profiles and records which one produced each result.

替换工作不能靠产品名称对照完成，工程基础是一组稳定契约。Three.js 负责场景渲染，却不提供 MuJoCo 的关节动力学；Ammo.js 暴露 Bullet 物理能力，也不会复现 PhysX 的全部求解器行为。只有把渲染、动力学、运动学、传感模型、语义资产和验证机制组合在稳定接口之后，才可能形成工程上的等效能力。

工程目标应当是任务等效：操作、行走、合成数据或虚拟调试流程需要达到事先声明的精度与吞吐限制。“整个平台是否等价”过于粗糙。浏览器模型足以完成可达性分析和工程评审，但接触密集的强化学习仍可能需要原生并行求解器。

边界说明。 “RTX 原生”可以摆脱 Omniverse，却仍可能依赖 NVIDIA 硬件，例如 OptiX 或 CUDA。真正的硬件中立路径应采用 Vulkan Ray Tracing、WebGPU、Embree 或可插拔渲染器。两种运行配置都可接入本架构，每次结果都会记录实际使用的后端。

Eight-Layer Reference Architecture八层参考架构

A canonical semantic model and deterministic clock sit at the center. Renderers, solvers, sensors, and policies become replaceable services around that core.

1. AuthoringBrowser workbench, Blender, CAD/BIM import, robot description editor, scenario DSL.

2. ISAM Semantic CoreIdentity, geometry references, joints, materials, sensors, capabilities, safety zones, provenance.

3. Runtime SceneEntity-component graph, deterministic clock, event queue, state snapshots, replay.

4. Geometry & RenderingThree.js/WebGL2 in-browser; WebGPU or Vulkan/RTX worker for higher fidelity.

5. Motion & PhysicsWASM kinematics, Ammo.js/Bullet, native dynamics plug-ins, contact and actuator extensions.

6. Virtual SensorsCamera, depth, LiDAR, IMU, force/torque, tactile, encoder, latency and noise models.

7. AutonomyROS 2, MoveIt 2, behavior trees, planners, ONNX policies, Gymnasium environments.

8. Evidence PlaneMCAP traces, differential tests, KPI gates, calibration lineage, signed run manifests.

系统中心是规范化语义模型与确定性时钟。渲染器、求解器、传感器和策略都围绕这个核心作为可替换服务运行。

1. 建模与编辑浏览器工作台、Blender、CAD/BIM 导入、机器人描述编辑器与场景 DSL。

2. ISAM 语义核心身份、几何引用、关节、材料、传感器、能力、安全区、来源与校准信息。

3. 运行时场景实体组件图、确定性时钟、事件队列、状态快照与回放。

4. 几何与渲染浏览器采用 Three.js/WebGL2；高保真任务使用 WebGPU 或 Vulkan/RTX 工作节点。

5. 运动与物理WASM 运动学、Ammo.js/Bullet、原生动力学插件、接触与执行器扩展。

6. 虚拟传感器相机、深度、LiDAR、IMU、力/力矩、触觉、编码器、延迟与噪声模型。

7. 自主系统ROS 2、MoveIt 2、行为树、规划器、ONNX 策略与 Gymnasium 环境。

8. 证据平面MCAP 轨迹、差分测试、KPI 门槛、校准谱系与带签名的运行清单。

Stable Contracts and ABI Boundaries稳定契约与 ABI 边界

ISAM.Scene.v1Scene contract

Typed entities, transforms, articulated bodies, geometry references, units, coordinate conventions, and semantic relations.

EI.Dynamics.Step.v1Dynamics ABI

State in, actuation and external wrench in, next state and contact manifold out. Solver details remain private.

EI.Sensor.Frame.v1Sensor ABI

Timestamped payload, frame ID, intrinsics, extrinsics, uncertainty, latency, calibration revision, and validity mask.

EI.Control.Command.v1Control ABI

Position, velocity, torque, impedance, or task command with limits, deadline, priority, and safety policy.

EI.Run.Manifest.v1Evidence contract

Git and asset hashes, solver version, step size, seeds, hardware, calibration, policy, scenario, and KPI output.

EI.Capability.v1Capability negotiation

Backends declare supported joints, sensors, contacts, precision, determinism, acceleration, and known approximations.

ISAM.Scene.v1场景契约

定义实体、变换、关节体、几何引用、单位、坐标约定与语义关系。

EI.Dynamics.Step.v1动力学 ABI

输入状态、驱动与外力，输出下一状态和接触流形；求解器内部实现保持封装。

EI.Sensor.Frame.v1传感器 ABI

包含时间戳、坐标系、内外参、不确定度、延迟、校准版本和有效掩码的数据帧。

EI.Control.Command.v1控制 ABI

位置、速度、力矩、阻抗或任务指令，并携带限值、截止时间、优先级和安全策略。

EI.Run.Manifest.v1证据契约

记录代码与资产哈希、求解器版本、步长、随机种子、硬件、校准、策略、场景与 KPI。

EI.Capability.v1能力协商

后端声明所支持的关节、传感器、接触、精度、确定性、加速能力与已知近似。

Deterministic Time, Scheduling, and Replay确定性时间、调度与回放

A robotics simulation cannot use render frames as its clock. The runtime advances an integer simulation epoch, while rendering samples state without mutating it. Every sensor, controller, network adapter, and fault injector declares its own period, phase, deadline, jitter model, and catch-up policy. Equal-time events are ordered by a stable priority and sequence number.

机器人仿真不能把渲染帧当作时钟。运行时推进整数仿真纪元，渲染器只采样状态而不能修改状态。每个传感器、控制器、网络适配器和故障注入器都声明周期、相位、截止时间、抖动模型和追赶策略。同一时刻的事件按稳定优先级与序号排序。

Clock domains时钟域

t_sim: signed 64-bit integer nanoseconds; never derived from wall time.t_sim：有符号 64 位整数纳秒，绝不从墙上时间推导。
t_acq: sensor exposure or acquisition midpoint.t_acq：传感器曝光或采集中心时刻。
t_pub: publication time after modeled processing and transport.t_pub：经过处理与传输模型后的发布时间。
t_wall: orchestration, timeout and cost only.t_wall：仅用于编排、超时和成本。

Fixed event phases固定事件阶段

Apply accepted commands and external disturbances.应用已接受指令与外部扰动。
Resolve actuation, constraints, contacts and dynamics.求解驱动、约束、接触与动力学。
Commit state, then sample sensors from that revision.提交状态，再从该版本采样传感器。
Run monitors, publish observations and record evidence.运行监视器、发布观测并记录证据。

Snapshot boundary快照边界

A resumable snapshot includes generalized state, warm-start/contact cache, controller memory, sensor bias state, random-generator state, event queue, asset revision and backend profile. Omitting hidden solver state produces a restart, not a replay.可恢复快照包含广义状态、预热/接触缓存、控制器记忆、传感器偏置状态、随机数状态、事件队列、资产版本和后端配置。缺少求解器隐藏状态只能算重新启动，不能算回放。

Late and missing data迟到与缺失数据

The contract declares drop, hold-last, interpolate, extrapolate or fail-safe behavior. Production tests inject packet loss, reordering, stale timestamps and clock steps. Silent wall-clock substitution is prohibited.契约明确丢弃、保持末值、插值、外推或故障安全行为。生产测试注入丢包、乱序、陈旧时间戳和时钟跳变，禁止静默改用墙上时间。

EI.Event.v1 { epoch_ns, phase, priority, sequence, producer_id, input_revision, payload_digest, deadline_ns, late_policy } EI.Snapshot.v1 { scene_revision, state_digest, solver_state_digest, controller_state_digest, sensor_state_digest, rng_state, event_queue_digest, backend_profile, precision_profile }

Replay classes. Bit-identical replay is required on one pinned CPU backend. Cross-CPU or accelerator replay is tolerance-equivalent with identical discrete event hashes. Statistical replay is permitted only for explicitly stochastic sensors and policies, with distribution-level gates.回放等级。固定 CPU 后端要求位级一致；跨 CPU 或加速器按数值容差等效，但离散事件哈希必须相同；只有显式随机传感器和策略可采用统计回放，并执行分布级门槛。

Physics Backend Qualification and Failure Containment物理后端资格确认与故障隔离

A backend is admitted by phenomenon and operating envelope, not by product reputation. Its profile states supported joint types, contact models, stiffness range, timestep regime, precision, determinism, gradients, acceleration path and known failure modes. The scheduler rejects a run when scenario demands exceed that profile.

后端按物理现象和运行包络准入，而不是按产品声誉准入。能力配置声明支持的关节类型、接触模型、刚度范围、时间步区间、精度、确定性、梯度、加速路径和已知失效模式。场景需求超出配置时，调度器直接拒绝运行。

Qualification domain资格域	Required evidence必需证据	Runtime monitor运行时监视	Containment action隔离动作
Free and constrained motion自由与约束运动	Analytical cases, inverse-dynamics residuals, joint drift and step-size study.解析案例、逆动力学残差、关节漂移和步长研究。	NaN, bound, residual and energy checks each committed step.每个提交步执行 NaN、边界、残差和能量检查。	Reject state, preserve previous snapshot, retry only with an approved profile.拒绝状态、保留前一快照，仅用获批配置重试。
Impact and sustained contact冲击与持续接触	Onset timing, impulse, penetration, friction transition and stacked stability.接触起始、冲量、穿透、摩擦转换和堆叠稳定性。	Penetration, iteration saturation, impulse spikes and contact churn.穿透、迭代饱和、冲量尖峰和接触抖动。	Mark evidence invalid; reduce step or escalate to a qualified native worker.标记证据无效；缩小步长或升级到合格原生工作节点。
Actuation and transmission驱动与传动	Torque-speed envelope, delay, saturation, friction, backlash, thermal derating and measured traces.力矩-转速包络、延迟、饱和、摩擦、齿隙、热降额和实测轨迹。	Command age, power, temperature state and envelope violation.指令年龄、功率、温度状态和包络违规。	Clamp through the safety model, flag the run and prohibit policy evidence reuse.经安全模型限幅、标记运行并禁止复用策略证据。
Differentiable or batched mode可微或批量模式	Gradient finite differences, batch independence, precision sensitivity and reduction determinism.梯度有限差分、批间独立、精度敏感性和归约确定性。	Gradient norm, invalid environments and divergence distribution.梯度范数、无效环境和发散分布。	Quarantine affected environments; never average failed samples into training data.隔离受影响环境，禁止把失败样本平均进训练数据。

State validity状态有效性valid_commits / attempted_stepsFailed solver steps never enter canonical traces.失败求解步绝不进入规范轨迹。

Contact stability接触稳定性p95 penetration, impulse error, churnReported by material pair and contact regime.按材料对和接触工况报告。

Escalation rate升级率native_fallbacks / admitted_runsShows whether the web profile is honestly scoped.反映 Web 配置的范围是否诚实。

Dual Runtime Instead of One Giant Simulator双运行时，而非单体大仿真器

Profile	Best use	Implementation	Boundary
Web engineering runtime	Authoring, reach studies, sequence review, lightweight virtual commissioning, remote collaboration.	Three.js/WebGL2, Ammo.js, WASM kinematics, Web Workers, IndexedDB/OPFS, ROS bridge.	Moderate scene scale and contact fidelity; browser scheduling is not a hard real-time controller.
Native fidelity worker	Dense contact, high-rate sensors, large synthetic datasets, parallel RL, RTX photorealism.	Rust/C++ services, Bullet/DART/Drake or custom solver, Vulkan RT/OptiX, ROS 2, Ray/Kubernetes.	Needs GPU/cluster capacity and explicit reproducibility controls.
Hardware-in-the-loop	Controller timing, fieldbus behavior, actuator saturation, fault injection, safety interlock tests.	Real controller or real-time target connected through EtherCAT/OPC UA/ROS 2 adapters.	Simulation never replaces physical risk assessment or safety certification.

Novel mechanism: fidelity contracts. Each scenario declares the phenomena it depends on, such as static friction, backlash, rolling contact, camera shot noise, or bus latency. The scheduler selects the cheapest backend whose capability declaration satisfies that contract. Results from an underqualified backend are rejected rather than silently accepted.

运行配置	适用任务	实现方式	边界
Web 工程运行时	建模、可达性分析、顺序评审、轻量虚拟调试和远程协作。	Three.js/WebGL2、Ammo.js、WASM 运动学、Web Workers、IndexedDB/OPFS 与 ROS 桥。	场景规模和接触精度有限；浏览器调度不能当作硬实时控制器。
原生高保真工作节点	密集接触、高频传感器、大规模合成数据、并行强化学习和 RTX 写实渲染。	Rust/C++ 服务、Bullet/DART/Drake 或自研求解器、Vulkan RT/OptiX、ROS 2、Ray/Kubernetes。	需要 GPU 或集群资源，也需要明确的可复现控制。
硬件在环	控制器时序、现场总线、执行器饱和、故障注入和安全联锁测试。	真实控制器或实时目标机通过 EtherCAT、OPC UA、ROS 2 适配器接入。	仿真不能代替物理风险评估和安全认证。

创新机制：保真度契约。 每个场景声明自己依赖的现象，例如静摩擦、齿隙、滚动接触、相机散粒噪声或总线延迟。调度器选择满足能力声明且成本最低的后端；能力不足的结果会被拒绝，不能悄悄流入后续流程。

Research Contributions Beyond Substitution超越替换本身的研究方向

Differential simulation

Run the same ISAM scenario against the open stack, a retained reference engine, and measured robot traces. Localize disagreement by state variable and event.

Semantic constraint compiler

Compile payload, safety-zone, joint-limit, tool, and process semantics into planner constraints, collision filters, and runtime monitors.

Physics receipts

Attach solver settings, residuals, contact statistics, energy drift, and capability declarations to every generated dataset or policy checkpoint.

Counterfactual sensor replay

Replay one physical trajectory through alternative noise, latency, calibration, and occlusion models without recomputing dynamics.

Uncertainty-carrying assets

Store mass, friction, inertia, and calibration as distributions with evidence, not unexplained constants.

Task-conditioned fidelity

Allocate simulation precision where the downstream decision is sensitive, rather than maximizing visual quality everywhere.

差分仿真

让开放工具链、保留的参考引擎与真实机器人轨迹运行同一个 ISAM 场景，按状态变量和事件定位分歧。

语义约束编译器

把负载、安全区、关节限位、工具和工艺语义编译成规划约束、碰撞过滤器与运行时监视器。

物理收据

为每个数据集和策略检查点附加求解器设置、残差、接触统计、能量漂移与能力声明。

反事实传感回放

让同一条物理轨迹经过不同噪声、延迟、校准和遮挡模型，无需重复计算动力学。

携带不确定度的资产

质量、摩擦、惯量和校准值应带分布与证据，不能只是来源不明的常数。

任务条件保真度

把计算精度分配给真正影响下游决策的现象，而不是在所有位置一味提高视觉质量。

Layer-by-Layer Equivalent Stack逐层等效工具栈

No row below should be read as a drop-in binary replacement. The third column names the composition needed to reproduce the engineering capability, while the last column states the residual gap.

Reference capability	Target architecture	Open/self-developed components	Maturity and residual gap
Omniverse Kit	Web engineering shell and plug-in runtime	TypeScript, Web Components, Three.js, Monaco, JupyterLite; optional Tauri/Electron native shell.	High Authoring and extension workflows are feasible; proprietary Kit extensions require redesign.
Omniverse Nucleus	Versioned asset and collaboration service	S3-compatible MinIO, OCI artifacts, Git LFS, PostgreSQL metadata, content hashes, WebSocket events.	High Live collaboration needs custom locking, merge, and presence semantics.
OpenUSD	Industrial Scene & Asset Model as source of truth	ISAM graph plus OpenUSD, glTF, URDF, SDF, IFC, AAS, and OPC UA adapters.	Medium OpenUSD remains a valuable exchange adapter; replacing its composition semantics outright is unnecessary risk.
RTX renderer	Pluggable browser and native render backends	Three.js/WebGL2, WebGPU; Vulkan RT or OptiX worker; Embree/OSPRay CPU fallback.	Medium WebGL is interactive but not sensor-grade path tracing. Native workers cover photorealistic workloads.
MuJoCo workflow	Three.js scene plus articulated simulation bundle	Three.js + Ammo.js/Bullet + WASM kinematics/dynamics; retain open-source MuJoCo as an optional validation oracle.	Medium Three.js alone is not a dynamics engine. Contact and actuator parity must be benchmarked per task.
PhysX	Physics service behind EI.Dynamics ABI	Ammo.js/Bullet for web; Bullet, DART, Drake, Project Chrono, or custom XPBD/MBD plug-ins natively.	Medium Rigid-body coverage is strong; GPU parallelism, deformables, and solver-specific contact differ.
Isaac Sim	Scenario runtime plus virtual sensor framework	ISAM runtime, deterministic clock, Three.js/native renderer, physics plug-ins, ROS 2 bridge, sensor ABI.	Medium Feasible as a composed platform; integration and validation become first-party responsibilities.
Isaac sensor models	Virtual Camera / Virtual Sensor SDK	OpenCV camera model, custom GLSL/WGSL passes, Embree ray queries, IMU/tactile/FT stochastic models.	Research Noise, rolling shutter, multipath LiDAR, event cameras, and tactile transfer need measured calibration.
Replicator	Synthetic-data and domain-randomization pipeline	BlenderProc, Kubric, Three.js render passes, JSON-LD labels, Parquet/Zarr datasets, deterministic seed service.	Medium Annotation generation is tractable; photorealistic material and sensor validation remains expensive.
Isaac Lab	Open task, environment, and training protocol	Gymnasium, Stable-Baselines3, RLlib, CleanRL, JAX/Brax, custom vectorized native workers.	Medium Training APIs are mature; matching GPU environment throughput requires specialized kernels.
Isaac ROS	Hardware-neutral perception graph	ROS 2, Cyclone DDS/Fast DDS, OpenCV, PCL, GStreamer, ONNX Runtime, OpenVINO/ROCm providers.	High Most functions are available; latency tuning and zero-copy transport vary by hardware.
cuMotion / cuRobo	Planning and optimization service	MoveIt 2, OMPL, Tesseract, Pinocchio, Drake, CasADi, OSQP/Ipopt.	High Functional coverage is strong; GPU batch planning throughput may be lower.
Articulation kinematics	WASM-based Kinematics Core	Rust or C++ compiled to WASM; Pinocchio/KDL-style FK, IK, Jacobian, collision-distance, and derivatives.	High Numerically mature if coordinate, unit, precision, and memory rules are fixed.
Robot dynamics	Extensible dynamics kernel	Featherstone ABA/RNEA, contact complementarity or XPBD, actuator/gear/friction plug-ins, native SIMD worker.	Research Core algorithms are known; robust humanoid contact and differentiability demand sustained engineering.
Policy deployment	Portable policy package	PyTorch/JAX training, ONNX export, ONNX Runtime/IREE/TVM execution, ROS 2 lifecycle wrapper.	High Operator support and numerical drift must be checked on each target.
Robot foundation-model workflow	Open VLA/data pipeline	LeRobot, OpenVLA-compatible interfaces, Hugging Face Datasets, MCAP conversion, policy evaluation harness.	Research Dataset rights, safety, latency, embodiment transfer, and reproducibility remain open problems.
Simulation farm	Backend-neutral job scheduler	Ray, Kubernetes, Slurm, OCI containers, artifact cache, run manifests, OpenTelemetry.	High Infrastructure is mature; deterministic heterogeneous execution needs policy controls.
Telemetry and replay	Evidence plane	ROSbag2/MCAP, Arrow/Parquet, Zarr, OpenTelemetry, Prometheus, Grafana, provenance graph.	High Schema discipline and synchronized clocks matter more than tool availability.

下表没有任何一行表示“二进制直接替换”。第三列说明复现工程能力所需的组件组合，最后一列则明确尚未消除的差距。

参考能力	目标架构	开源 / 自研组件	成熟度与剩余差距
Omniverse Kit	Web 工程外壳与插件运行时	TypeScript、Web Components、Three.js、Monaco、JupyterLite；可选 Tauri/Electron 原生外壳。	高建模与扩展流程可实现；专有 Kit 扩展需要重新设计。
Omniverse Nucleus	版本化资产与协作服务	S3 兼容 MinIO、OCI 资产、Git LFS、PostgreSQL 元数据、内容哈希与 WebSocket 事件。	高实时协作仍需自研锁、合并和在线状态语义。
OpenUSD	以工业场景与资产模型作为事实源	ISAM 图模型，加 OpenUSD、glTF、URDF、SDF、IFC、AAS 与 OPC UA 适配器。	中 OpenUSD 仍适合做交换适配器；完全重做其组合语义没有必要。
RTX 渲染器	可插拔浏览器与原生渲染后端	Three.js/WebGL2、WebGPU；Vulkan RT 或 OptiX 工作节点；Embree/OSPRay CPU 备用路径。	中 WebGL 适合交互，但不是传感器级路径追踪；原生节点负责写实任务。
MuJoCo 工作流	Three.js 场景加关节仿真组件组	Three.js + Ammo.js/Bullet + WASM 运动学/动力学；开源 MuJoCo 可保留为验证基准。	中 Three.js 本身不是动力学引擎，接触和执行器一致性必须按任务测试。
PhysX	位于 EI.Dynamics ABI 后的物理服务	Web 端用 Ammo.js/Bullet；原生端可用 Bullet、DART、Drake、Project Chrono 或自研 XPBD/MBD 插件。	中刚体能力较完整，但 GPU 并行、可变形体和接触行为会有差异。
Isaac Sim	场景运行时加虚拟传感器框架	ISAM 运行时、确定性时钟、Three.js/原生渲染、物理插件、ROS 2 桥与传感器 ABI。	中组合平台可行，但集成与验证责任转移到自研团队。
Isaac 传感模型	Virtual Camera / Virtual Sensor SDK	OpenCV 相机模型、自研 GLSL/WGSL 通道、Embree 射线查询、IMU/触觉/力矩随机模型。	研究级噪声、卷帘快门、LiDAR 多径、事件相机与触觉迁移需要实测标定。
Replicator	合成数据与域随机化流水线	BlenderProc、Kubric、Three.js 渲染通道、JSON-LD 标签、Parquet/Zarr 数据集和确定性种子服务。	中标注生成可实现；写实材质和传感器验证仍然昂贵。
Isaac Lab	开放任务、环境与训练协议	Gymnasium、Stable-Baselines3、RLlib、CleanRL、JAX/Brax 与自研向量化原生节点。	中训练 API 成熟；匹配 GPU 环境吞吐需要专用内核。
Isaac ROS	硬件中立感知图	ROS 2、Cyclone DDS/Fast DDS、OpenCV、PCL、GStreamer、ONNX Runtime、OpenVINO/ROCm 后端。	高功能大多齐备；低延迟与零拷贝效果依赖硬件。
cuMotion / cuRobo	规划与优化服务	MoveIt 2、OMPL、Tesseract、Pinocchio、Drake、CasADi、OSQP/Ipopt。	高功能覆盖较强，但 GPU 批量规划吞吐可能较低。
关节运动学	WASM-based Kinematics Core	Rust 或 C++ 编译到 WASM，实现 FK、IK、Jacobian、碰撞距离与导数，接口参考 Pinocchio/KDL。	高只要固定坐标、单位、精度和内存规则，数值实现已经成熟。
机器人动力学	可扩展动力学内核	Featherstone ABA/RNEA、接触互补或 XPBD、执行器/减速器/摩擦插件、原生 SIMD 节点。	研究级基础算法明确，但稳健的人形接触和可微分能力需要长期投入。
策略部署	可移植策略包	PyTorch/JAX 训练、ONNX 导出、ONNX Runtime/IREE/TVM 执行、ROS 2 生命周期封装。	高每个目标平台都要检查算子支持和数值漂移。
机器人基础模型流程	开放 VLA 与数据流水线	LeRobot、兼容 OpenVLA 的接口、Hugging Face Datasets、MCAP 转换和策略评估工具。	研究级数据权利、安全、延迟、跨本体迁移和可复现性仍未解决。
仿真集群	后端中立任务调度器	Ray、Kubernetes、Slurm、OCI 容器、资产缓存、运行清单与 OpenTelemetry。	高基础设施成熟；异构环境确定性仍需策略控制。
遥测与回放	证据平面	ROSbag2/MCAP、Arrow/Parquet、Zarr、OpenTelemetry、Prometheus、Grafana 与来源图。	高真正难点是模式纪律和时钟同步，不是缺少工具。

Industrial Scene & Asset Model (ISAM)工业场景与资产模型（ISAM）

ISAM is the canonical graph, not another render-file format. Geometry remains in glTF, OpenUSD, mesh, CAD, or point-cloud payloads. ISAM binds those payloads to industrial identity, physical parameters, behavior, sensor calibration, and lifecycle evidence.

Required semantic domains

Stable asset identity, class, role, owner, and lifecycle revision.
Coordinate frames, units, transforms, joints, limits, collision and visual geometry.
Mass, center of mass, inertia tensor, friction, restitution, compliance, and evidence quality.
Actuators, transmissions, controllers, capabilities, tools, payloads, and safety zones.
Sensors, intrinsics, extrinsics, timing, noise, calibration, and data rights.

Interchange policy

URDF/SDF import for robot and simulation descriptions.
glTF for efficient web delivery and PBR materials.
OpenUSD adapter for composition, variants, and ecosystem exchange.
IFC/CAD adapters for factory context.
AAS, OPC UA, ISA-95, and DPP bindings for industrial semantics.

Round-trip conversion is accepted only when every safety-critical joint, limit, frame, mass property, sensor calibration, and semantic identifier survives. Visual equivalence alone does not pass the asset gate.

ISAM 是规范化关系图，不是又一种渲染文件格式。几何仍保存在 glTF、OpenUSD、网格、CAD 或点云载荷中；ISAM 负责把这些载荷绑定到工业身份、物理参数、行为、传感器校准和生命周期证据。

必须覆盖的语义域

稳定资产身份、类别、角色、所有者和生命周期版本。
坐标系、单位、变换、关节、限位、碰撞与可视几何。
质量、质心、惯量张量、摩擦、恢复、顺应性和证据质量。
执行器、传动、控制器、能力、工具、负载和安全区域。
传感器、内外参、时序、噪声、校准和数据权利。

交换策略

用 URDF/SDF 导入机器人与仿真描述。
用 glTF 完成高效 Web 分发和 PBR 材质表达。
保留 OpenUSD 适配器，承接组合、变体和生态交换。
用 IFC/CAD 适配器接入工厂环境。
绑定 AAS、OPC UA、ISA-95 与 DPP 工业语义。

只有当所有安全相关关节、限位、坐标系、质量属性、传感器校准和语义标识都能往返保留时，格式转换才算通过。仅仅“看起来一样”不能通过资产门槛。

Adopt, Build, and Keep as an Oracle直接采用、自研与保留基准

Adopt

Three.js Bullet Ammo.js ROS 2 MoveIt 2 Pinocchio OpenCV ONNX Runtime MCAP Blender MinIO PostgreSQL

Build

ISAM schema, deterministic scheduler, simulation/sensor ABI, asset compiler, capability registry, differential evaluator, evidence manifest, browser workbench.

Keep as oracle

Open-source MuJoCo or another validated engine, selected NVIDIA baselines during transition, and measured hardware traces. Oracles detect regressions; they do not own the canonical model.

直接采用

Three.js Bullet Ammo.js ROS 2 MoveIt 2 Pinocchio OpenCV ONNX Runtime MCAP Blender MinIO PostgreSQL

自研

ISAM 模式、确定性调度器、仿真/传感 ABI、资产编译器、能力注册表、差分评估器、证据清单与浏览器工作台。

保留为基准

开源 MuJoCo 或其他已验证引擎、迁移期内选定的 NVIDIA 基线，以及真实硬件轨迹。基准用于发现回归，但不再拥有规范模型。

Primary Open Tools主要开放工具

Three.jsWebGL/WebGPU scene and rendering layer.WebGL/WebGPU 场景与渲染层。

Ammo.jsBullet compiled to JavaScript/WASM.编译到 JavaScript/WASM 的 Bullet。

MuJoCoOpen-source dynamics oracle or native backend.开源动力学基准或原生后端。

PinocchioRigid-body algorithms and derivatives.刚体算法与导数计算。

ROS 2Robot middleware, messages, lifecycle, and tooling.机器人中间件、消息、生命周期与工具。

MoveIt 2Motion planning and manipulation integration.运动规划与操作集成。

GazeboNative simulation and sensor ecosystem.原生仿真与传感器生态。

ONNX RuntimePortable inference across CPU and accelerators.跨 CPU 与加速器的可移植推理。

Complete Open Component Catalog完整开放组件目录

The catalog links each upstream project or open specification used in the reference architecture. Inclusion means “candidate behind a foundry-owned contract,” not blanket qualification. Licenses, supported versions, numerical profiles and security status are recorded separately.

本目录链接参考架构采用的每个上游项目或开放规范。列入目录只表示“可放在自研契约之后的候选实现”，并不代表无条件通过资格确认。许可证、支持版本、数值配置和安全状态需另行记录。

Key Open Library Integration Profiles关键开源库集成档案

SCENE INTERCHANGE

OpenUSD

ISAM.Asset.Adapter

Use OpenUSD for composition, variants, references, instancing and ecosystem exchange while ISAM retains industrial identity and runtime evidence.

Boundary: stage and layer stack in; typed ISAM patch, payload digests and unresolved-field report out.
Strength: mature scene composition and large digital-content ecosystem.
Constraint: physical semantics, control timing and safety authority are outside its scope.
Own: stable identity mapping, unit/frame policy, semantic round-trip tests and quarantine rules.

OpenUSD 用于组合、变体、引用、实例化和生态交换；工业身份与运行证据仍由 ISAM 掌握。

边界：输入舞台和图层栈，输出类型化 ISAM 补丁、载荷摘要和未解析字段报告。
优势：场景组合成熟，数字内容生态广。
限制：物理语义、控制时序和安全权限不在其范围内。
自研：稳定身份映射、单位/坐标策略、语义往返测试和隔离规则。

WEB RENDERING

Three.js

EI.Render.View

Use Three.js for interactive scene inspection, engineering overlays, robot-state visualization and browser sensor previews. Rendering samples committed state and never advances physics.

Boundary: immutable scene/state snapshot in; color, depth approximation, picking and render metrics out.
Strength: broad WebGL/WebGPU ecosystem and rapid browser delivery.
Constraint: it is neither an articulated dynamics engine nor a sensor-qualified path tracer.
Own: ISAM binding, level-of-detail policy, coordinate tests and render/sensor separation.

Three.js 用于交互场景检查、工程叠加、机器人状态可视化和浏览器传感预览。渲染器只采样已提交状态，绝不能推进物理。

边界：输入不可变场景/状态快照，输出颜色、近似深度、拾取和渲染指标。
优势：WebGL/WebGPU 生态广，浏览器交付快。
限制：既不是关节动力学引擎，也不是合格的传感器路径追踪器。
自研：ISAM 绑定、LOD 策略、坐标测试和渲染/传感隔离。

DYNAMICS ORACLE

MuJoCo

EI.Dynamics.Step

Use MuJoCo as a native articulated-dynamics backend and differential oracle for contact-rich control workloads. Keep model translation explicit rather than treating MJCF as canonical truth.

Boundary: compiled body, joint, actuator and contact model in; state transition, contacts and solver statistics out.
Strength: efficient robotics dynamics, actuators and optimization-friendly APIs.
Constraint: contact and actuator semantics differ from other engines and real hardware.
Own: ISAM-to-MJCF compiler, parameter evidence, residual extraction and golden differential cases.

MuJoCo 可作为原生关节动力学后端和接触密集控制任务的差分基准。模型转换必须显式，不能把 MJCF 当作规范事实源。

边界：输入编译后的本体、关节、执行器和接触模型，输出状态迁移、接触与求解统计。
优势：机器人动力学高效，执行器与优化接口成熟。
限制：接触和执行器语义与其他引擎及真实硬件存在差异。
自研：ISAM 到 MJCF 编译器、参数证据、残差提取和黄金差分案例。

KINEMATICS

Pinocchio

EI.Kinematics.v1

Use Pinocchio for rigid-body kinematics, Jacobians, centroidal quantities, inverse dynamics and derivatives. A WASM-compatible subset can serve browser analysis while native builds provide full throughput.

Boundary: compiled articulated model and batch state in; transforms, derivatives and dynamics quantities out.
Strength: efficient algorithms with strong robotics and optimization integration.
Constraint: collision geometry, contact resolution and actuator behavior require separate services.
Own: ABI, memory layout, float64 profile, frame naming and native/WASM conformance suite.

Pinocchio 用于刚体运动学、Jacobian、质心量、逆动力学和导数。兼容 WASM 的子集服务浏览器分析，原生构建提供完整吞吐。

边界：输入编译关节模型和批量状态，输出变换、导数及动力学量。
优势：算法高效，与机器人和优化生态集成良好。
限制：碰撞几何、接触求解和执行器行为需要独立服务。
自研：ABI、内存布局、float64 配置、坐标命名和原生/WASM 一致性测试。

ROBOT MIDDLEWARE

ROS 2

EI.Transport.Adapter

Use ROS 2 for typed messages, lifecycle nodes, discovery, parameterization and robot-edge integration. The simulation clock and canonical scene remain outside the middleware graph.

Boundary: EI sensor/control contracts map to ROS interfaces with explicit QoS, frame and clock policy.
Strength: extensive hardware drivers, tooling and robotics interoperability.
Constraint: default discovery and QoS choices do not guarantee deadlines, determinism or safety.
Own: message mapping, QoS profiles, clock bridge, deadline monitors and network threat model.

ROS 2 用于类型化消息、生命周期节点、发现、参数化和机器人边缘集成。仿真时钟与规范场景仍位于中间件图之外。

边界：EI 传感/控制契约按显式 QoS、坐标和时钟策略映射为 ROS 接口。
优势：硬件驱动、工具和机器人互操作生态广。
限制：默认发现与 QoS 不能保证截止时间、确定性或安全。
自研：消息映射、QoS 配置、时钟桥、截止时间监视和网络威胁模型。

MOTION PLANNING

MoveIt 2

EI.Plan.Request

Use MoveIt 2 as the integration layer for planning scenes, collision checking, kinematics, trajectory processing and manipulation workflows.

Boundary: task and semantic constraints in; candidate trajectory, planner provenance and failure class out.
Strength: mature plugin architecture and broad support for planning and manipulation.
Constraint: a collision-free trajectory is not proof of dynamic feasibility, control stability or human safety.
Own: semantic constraint compiler, planner selection policy, dynamics verification and execution gate.

MoveIt 2 作为规划场景、碰撞检查、运动学、轨迹处理和操作流程的集成层。

边界：输入任务与语义约束，输出候选轨迹、规划器谱系和失败类别。
优势：插件架构成熟，规划与操作覆盖广。
限制：无碰轨迹不能证明动力学可行、控制稳定或人身安全。
自研：语义约束编译器、规划器选择策略、动力学验证和执行门。

SENSOR VISION

OpenCV

EI.Sensor.Camera

Use OpenCV for camera calibration, distortion, image formation checks, geometric vision and perception baselines. The virtual sensor model must preserve exposure timing and uncertainty.

Boundary: rendered or hardware frame plus calibration in; corrected image, measurements and quality flags out.
Strength: mature calibration and image-processing primitives across platforms.
Constraint: generic image algorithms do not establish sensor realism or measurement qualification.
Own: calibration registry, rolling-shutter timing, noise model, uncertainty and hardware correlation.

OpenCV 用于相机标定、畸变、成像检查、几何视觉和感知基线。虚拟传感器模型必须保留曝光时序与不确定性。

边界：输入渲染或硬件图像和标定，输出校正图像、测量和质量标志。
优势：跨平台标定与图像处理基础算法成熟。
限制：通用图像算法不能证明传感真实性或测量资格。
自研：标定注册表、卷帘时序、噪声模型、不确定性和硬件相关。

PORTABLE INFERENCE

ONNX Runtime

EI.Policy.Package

Use ONNX Runtime to execute versioned policies and perception models across CPU and accelerator providers. Deployment qualification is per model, operator set, precision and target.

Boundary: signed model, preprocessing, state schema and provider profile in; outputs, latency and provider trace out.
Strength: portable graph execution and multiple hardware execution providers.
Constraint: operator conversion, quantization and provider kernels can change numerical behavior.
Own: policy manifest, golden tensors, state reset, timeout, fallback and target conformance tests.

ONNX Runtime 用于在 CPU 和加速器后端执行版本化策略与感知模型。部署资格必须按模型、算子集、精度和目标平台分别确认。

边界：输入签名模型、预处理、状态模式和后端配置，输出结果、时延和后端轨迹。
优势：图执行可移植，支持多类硬件执行后端。
限制：算子转换、量化和后端内核可能改变数值行为。
自研：策略清单、黄金张量、状态复位、超时、回退和目标一致性测试。

PARALLEL LEARNING

Brax / Gymnasium

EI.Environment.v1

Gymnasium defines the portable environment surface; Brax provides accelerator-oriented batched physics for suitable learning workloads. Keep task semantics independent of either implementation.

Boundary: scenario, observation/action schemas and randomization evidence in; trajectories and validity masks out.
Strength: standard training integration and high-throughput vectorized execution.
Constraint: simplified or smooth contact can train policies that fail on hardware.
Own: environment contract, valid-step accounting, randomization registry and real-robot holdout tests.

Gymnasium 定义可移植环境接口，Brax 为适合的学习任务提供加速器批量物理。任务语义必须独立于两种实现。

边界：输入场景、观测/动作模式和随机化证据，输出轨迹和有效掩码。
优势：训练集成标准化，向量化执行吞吐高。
限制：简化或平滑接触可能训练出实机失效策略。
自研：环境契约、有效步计数、随机化注册表和实机保留测试。

ROBOTICS LOG

MCAP

EI.Trace.v1

Use MCAP as the chunked robotics log container for observations, commands, events and metadata. Keep semantic identity and release lineage in the manifest and ISAM graph.

Boundary: typed timestamped channels in; indexed immutable log and statistics out.
Strength: efficient multimodal storage, indexing and broad robotics tooling.
Constraint: a container cannot fix inconsistent clocks, schemas or calibration.
Own: channel schema registry, clock mapping, retention, redaction and trace-to-evidence links.

MCAP 作为分块机器人日志容器，保存观测、指令、事件和元数据。语义身份与发布谱系仍在运行清单和 ISAM 图中维护。

边界：输入带类型与时间戳的通道，输出可索引不可变日志和统计。
优势：多模态存储高效，索引与机器人工具支持广。
限制：容器无法修复不一致时钟、模式或标定。
自研：通道模式注册、时钟映射、保留、脱敏和轨迹到证据链接。

DISTRIBUTED COMPUTE

Ray / Kubernetes

EI.Run.Job

Ray provides Python-oriented distributed tasks and actors; Kubernetes provides workload isolation, placement and lifecycle. They schedule simulation workers but do not decide engineering validity.

Boundary: signed run manifest and capability request in; status, artifacts, cost and worker identity out.
Strength: scalable fan-out for scenarios, seeds, optimization and training.
Constraint: retries can duplicate side effects and heterogeneous hardware can break determinism.
Own: idempotency, capability matching, quotas, artifact commit and evidence admission callback.

Ray 提供面向 Python 的分布式任务与 Actor，Kubernetes 提供工作负载隔离、放置和生命周期。它们调度仿真工作节点，但不判断工程有效性。

边界：输入签名运行清单和能力请求，输出状态、资产、成本和工作节点身份。
优势：场景、种子、优化和训练可大规模扇出。
限制：重试可能重复副作用，异构硬件可能破坏确定性。
自研：幂等、能力匹配、配额、资产提交和证据准入回调。

OBSERVABILITY

OpenTelemetry

EI.Run.Telemetry

Use OpenTelemetry for cross-service traces, metrics and logs that connect a user action to scheduler, solver, model and artifact operations.

Boundary: trace context and bounded engineering attributes in; sampled telemetry and export status out.
Strength: vendor-neutral instrumentation across languages and services.
Constraint: observability data is operational evidence, not proof that physics or policy is correct.
Own: semantic conventions, sensitive-data policy, artifact correlation and evidence-retention rules.

OpenTelemetry 用于跨服务追踪、指标和日志，把用户操作连接到调度器、求解器、模型和资产操作。

边界：输入追踪上下文和受限工程属性，输出采样遥测和导出状态。
优势：跨语言与服务的厂商中立插桩。
限制：可观测数据属于运行证据，不能证明物理或策略正确。
自研：语义约定、敏感数据策略、资产关联和证据保留规则。

Feasibility by Workload按工作负载判断可行性

The program is technically feasible if it is scoped as a modular replacement with measured exit gates. It is not feasible as a short project that promises identical behavior for every Omniverse or Isaac feature. The strongest near-term case is web-based engineering, semantic assets, kinematics, planning, ROS integration, and virtual commissioning. High-rate photorealistic sensing and massively parallel contact simulation require native workers and a longer validation program.

Workload	Feasibility	Condition for adoption	Decision evidence
Scene authoring and review	High	ISAM/glTF pipeline, asset versioning, browser performance budget.	Round-trip tests, frame-time distribution, visual and semantic diffs.
Kinematics and motion planning	High	WASM float64 core, fixed frame convention, MoveIt 2/Pinocchio comparison.	Pose/Jacobian error, collision-distance error, plan success and latency.
Rigid-body and articulated dynamics	Medium-high	Task-calibrated contacts, actuator models, native fallback for hard cases.	Trajectory, torque, contact-event, impulse, and energy-drift metrics.
Virtual commissioning	High	Deterministic scheduler, controller adapters, signal and fault models.	Sequence equivalence, I/O timing, interlock coverage, recovery tests.
Camera and basic depth sensing	Medium-high	Measured calibration, lens/noise models, native ray backend when needed.	Reprojection, depth error, latency/jitter, detection retention.
LiDAR, tactile, event sensors	Medium	Device-specific stochastic model and hardware dataset.	Distribution distance, task-level perception effect, calibration stability.
Massively parallel RL	Medium	Vectorized native solver, batched policy execution, cluster scheduler.	Environment steps/s, cost per billion steps, policy quality retention.
Safety evidence	Process-dependent	Independent hazards process, requirements traceability, HIL and physical tests.	Safety requirements coverage and signed evidence; simulator output alone is insufficient.

只要把目标限定为带量化退出门槛的模块化替换，这个项目在技术上可行。若希望短期内完整复刻 Omniverse 或 Isaac 的所有特性，则不可行。近期最成熟的范围包括 Web 工程、语义资产、运动学、规划、ROS 集成和虚拟调试。高频写实传感器与大规模并行接触仿真需要原生工作节点，也需要更长的验证周期。

工作负载	可行性	采用条件	决策证据
场景编辑与评审	高	ISAM/glTF 流水线、资产版本管理和浏览器性能预算。	往返测试、帧时分布、视觉与语义差分。
运动学与运动规划	高	WASM float64 内核、固定坐标约定、与 MoveIt 2/Pinocchio 对比。	位姿/Jacobian 误差、碰撞距离误差、规划成功率与时延。
刚体与关节动力学	中高	按任务标定接触、执行器模型，困难场景允许原生后端接管。	轨迹、力矩、接触事件、冲量与能量漂移指标。
虚拟调试	高	确定性调度器、控制器适配器、信号与故障模型。	顺序一致性、I/O 时序、联锁覆盖率和恢复测试。
相机与基础深度传感	中高	实测校准、镜头/噪声模型，必要时使用原生射线后端。	重投影、深度误差、延迟/抖动与检测能力保持率。
LiDAR、触觉、事件传感器	中	设备专用随机模型与真实硬件数据集。	分布距离、对下游感知任务的影响与校准稳定性。
大规模并行强化学习	中	向量化原生求解器、批量策略执行与集群调度。	环境步/秒、每十亿步成本与策略质量保持率。
安全证据	取决于流程	独立危险分析、需求可追踪、硬件在环与物理测试。	安全需求覆盖和签名证据；仅靠仿真输出不充分。

Eight-Phase Migration with Exit Gates带退出门槛的八阶段迁移

Phase 0 · Baseline inventory and legal mapCatalog scenes, extensions, APIs, data, models, licenses, GPU assumptions, and operational dependencies. Freeze representative workloads before redesign begins.Exit: every retained feature has an owner, baseline trace, acceptance metric, and migration disposition.

Phase 1 · Contracts and coordinate disciplineDefine ISAM, dynamics, sensor, control, time, and evidence contracts. Fix SI units, handedness, frame naming, quaternion order, and timestamp semantics.Exit: contract tests run against adapters without loading a renderer or physics engine.

Phase 2 · Asset compiler and semantic round tripImport OpenUSD, URDF/SDF, glTF, CAD/IFC, AAS, and OPC UA references into ISAM, then export required exchange formats.Exit: zero loss of safety-critical joints, frames, limits, mass properties, sensor calibration, and identity.

Phase 3 · Browser engineering runtimeDeliver Three.js rendering, scene inspection, timeline, state replay, simple Ammo.js physics, and WASM kinematics.Exit: target scenes meet frame-time, memory, pose-accuracy, and usability budgets on reference browsers.

Phase 4 · Native dynamics and planning workersImplement the dynamics ABI, actuator/contact extensions, MoveIt 2 planning bridge, native SIMD/GPU workers, and backend capability registry.Exit: canonical physics suites and task trajectories pass differential tolerances.

Phase 5 · Virtual sensor and data factoryAdd calibrated camera, depth, LiDAR, IMU, force/torque, encoder, tactile, domain randomization, and typed annotations.Exit: sensor distributions and downstream perception KPIs meet hardware-derived limits.

Phase 6 · Policy, control, and HILConnect ROS 2, behavior runtime, planner, policy packages, real controllers, fieldbus timing, and safety monitors.Exit: shadow and HIL runs preserve control deadlines, interlocks, fault response, and task success.

Phase 7 · Parallel operation and selective retirementRun incumbent and open stacks on the same scenario set, sign evidence manifests, migrate teams and CI, then retire only capabilities that pass.Exit: two release cycles without a severity-one regression and with approved rollback evidence.

阶段 0 · 基线盘点与法律边界清点场景、扩展、API、数据、模型、许可证、GPU 假设和生产依赖。在重构前冻结代表性工作负载。退出：每项保留能力都有负责人、基线轨迹、验收指标和迁移处置。

阶段 1 · 契约与坐标纪律定义 ISAM、动力学、传感器、控制、时间和证据契约，固定 SI 单位、手性、坐标命名、四元数顺序和时间戳语义。退出：无需加载渲染器或物理引擎即可对适配器执行契约测试。

阶段 2 · 资产编译器与语义往返把 OpenUSD、URDF/SDF、glTF、CAD/IFC、AAS 和 OPC UA 引用导入 ISAM，再导出所需交换格式。退出：安全相关关节、坐标、限位、质量属性、传感器校准和身份零丢失。

阶段 3 · 浏览器工程运行时交付 Three.js 渲染、场景检查、时间线、状态回放、基础 Ammo.js 物理和 WASM 运动学。退出：目标场景在参考浏览器达到帧时、内存、位姿精度和可用性预算。

阶段 4 · 原生动力学与规划节点实现动力学 ABI、执行器/接触扩展、MoveIt 2 规划桥、原生 SIMD/GPU 节点和后端能力注册表。退出：规范物理测试集和任务轨迹通过差分容差。

阶段 5 · 虚拟传感器与数据工厂加入已标定相机、深度、LiDAR、IMU、力/力矩、编码器、触觉、域随机化和类型化标注。退出：传感器分布和下游感知 KPI 达到真实硬件推导的限制。

阶段 6 · 策略、控制与硬件在环接入 ROS 2、行为运行时、规划器、策略包、真实控制器、现场总线时序和安全监视器。退出：影子与 HIL 运行保持控制截止时间、联锁、故障响应和任务成功率。

阶段 7 · 并行运行与选择性退役让现有栈与开放栈运行相同场景，签署证据清单，迁移团队与 CI，只退役已经通过验收的能力。退出：连续两个发布周期无一级回归，并具有获批的回滚证据。

Differential Validation Pyramid差分验证金字塔

1. Analytical tests

Closed-form pendulum, projectile, FK chain, Jacobian finite difference, conservation, and camera projection cases.

2. Property tests

Frame composition, unit conversion, import/export invariants, collision symmetry, bounded state, and repeatable seeds.

3. Engine differential

Replay identical initial states and commands in the open backend and a trusted oracle. Compare states, contacts, events, and residuals.

4. Task benchmark

Walking, recovery, reaching, insertion, grasping, tool use, and human-aware motion with confidence intervals across seeds.

5. HIL and physical correlation

Measure timing, actuator response, friction, sensor distributions, safety reactions, and task outcomes on the real platform.

6. Production shadow

Observe real commands and state without actuation, calculate counterfactual outputs, and investigate every gate violation.

1. 解析测试

单摆、抛体、FK 链、Jacobian 有限差分、守恒和相机投影等有闭式解的场景。

2. 属性测试

坐标组合、单位转换、导入导出不变量、碰撞对称、有界状态和可重复随机种子。

3. 引擎差分

开放后端与可信基准使用相同初态和指令，比较状态、接触、事件与残差。

4. 任务基准

行走、恢复、伸手、插装、抓取、工具使用和人机共处运动，多随机种子并报告置信区间。

5. HIL 与实机相关

在真实平台测量时序、执行器响应、摩擦、传感分布、安全反应和任务结果。

6. 生产影子运行

观察真实指令和状态但不驱动执行器，计算反事实输出，并调查每个门槛违规。

Open-Source, Model, and Data Governance开源、模型与数据治理

License and distribution map许可证与分发地图

Record license, version, linking mode, modifications, deployment boundary, redistribution path and notice obligations for every component. Strong-copyleft code may need a process or network boundary. Legal review, not an agent, owns the conclusion.记录每个组件的许可证、版本、链接方式、修改、部署边界、再分发路径和声明义务。强 Copyleft 代码可能需要进程或网络隔离。结论由法律评审负责，而不是智能体。

SBOM and provenanceSBOM 与谱系

Generate SPDX or CycloneDX inventories for services, browser bundles, containers and robot-edge packages. Sign OCI images and run manifests with Sigstore; describe required build steps with in-toto.为服务、浏览器包、容器和机器人边缘包生成 SPDX 或 CycloneDX 清单。使用 Sigstore 签名 OCI 镜像与运行清单，并用 in-toto 描述必需构建步骤。

Model registry模型注册表

Pin weight digest, architecture, tokenizer, runtime, quantization, operator profile, license, training-data disclosure, evaluation set and permitted robot/data classes. A model upgrade is a controlled engineering change.固定权重摘要、架构、分词器、运行时、量化、算子配置、许可证、训练数据披露、评估集和允许的机器人/数据等级。模型升级属于受控工程变更。

Dataset rights and consent数据集权利与同意

Dataset manifests identify collection purpose, people and facilities represented, consent, privacy transformations, geographic/export limits, retention, labels, calibration and allowed training or evaluation uses.数据集清单标识采集目的、涉及人员与设施、同意、隐私转换、地域/出口限制、保留、标签、标定及允许的训练或评估用途。

Upgrade qualification升级资格确认

Backend, compiler, browser, driver, model or dependency changes trigger semantic impact analysis. Re-run only affected golden assets, numerical benchmarks, policy tests and hardware correlations, but never waive critical gates due to patch urgency.后端、编译器、浏览器、驱动、模型或依赖变化触发语义影响分析。仅重跑受影响的黄金资产、数值基准、策略测试和硬件相关，但不能因补丁紧急而豁免关键门。

Upstream sustainability上游可持续性

Maintain supported-version profiles and backend conformance suites, contribute fixes upstream, fund critical maintainers, avoid private forks and keep an exit adapter for abandoned projects.维护受支持版本配置和后端一致性测试，向上游贡献修复，资助关键维护者，避免私有分叉，并为停止维护的项目保留退出适配器。

Control-to-Robot Security Boundary控制到机器人安全边界

Zone区域	Permitted work允许工作	Prohibited authority禁止权限	Required gate必需门
Authoring and model zone建模与模型区	Propose scenes, tasks, policies, parameters and test plans through typed APIs.通过类型化 API 提出场景、任务、策略、参数和测试计划。	No robot credentials, fieldbus route, arbitrary shell or direct command publication.无机器人凭据、现场总线路由、任意 shell 或直接指令发布。	Schema, access, license, provenance and static safety checks.模式、访问、许可证、谱系和静态安全检查。
Simulation worker zone仿真工作区	Run pinned render, physics, sensor, planning and policy containers with immutable inputs.用不可变输入运行固定的渲染、物理、传感、规划和策略容器。	No canonical-state mutation or plant-network egress.不能修改规范状态，也不能外连工厂网络。	Resource quota, capability profile, signed outputs and evidence admission.资源配额、能力配置、签名输出和证据准入。
Release zone发布区	Compile an approved task, policy and configuration into a robot-edge package.把获批任务、策略和配置编译为机器人边缘包。	No self-approval by the proposer, training job or generative model.提案者、训练任务或生成模型不能自我批准。	Four-eyes approval, benchmark evidence, signature and rollback image.双人批准、基准证据、签名和回滚镜像。
Robot edge机器人边缘	Verify, stage, shadow, dry run and execute within local capability and safety envelopes.在本地能力与安全包络内验证、暂存、影子运行、空运行和执行。	No remote bypass of local interlocks, watchdog, emergency stop or safe-state controller.远程端不能绕过本地联锁、看门狗、急停或安全状态控制器。	Signature, robot identity, calibration freshness, mode, operator and health check.签名、机器人身份、标定时效、模式、操作员和健康检查。

No model-to-motion path. A generated policy or trajectory remains an untrusted artifact until syntax, dimensions, frame semantics, limits, collision, timing, HIL/shadow behavior and named human release all pass. Independent safety controllers enforce hard stops even after release.模型不能直达运动。生成策略或轨迹在通过语法、维度、坐标语义、限位、碰撞、时序、HIL/影子行为和具名人工发布前，始终是不可信资产。发布后仍由独立安全控制器执行硬停止。

Risk Register and Controls风险登记与控制

Semantic loss during conversion

Use ISAM as canonical state, typed adapters, round-trip invariants, and a quarantine queue for unresolved fields.

Solver drift masked by plausible animation

Separate visual state from physics state; require residuals, energy/contact KPIs, and oracle comparison.

Sensor domain gap

Fit parameters to hardware data, retain uncertainty, test downstream perception, and refresh calibration by device revision.

Browser timing and memory limits

Use Web Workers, SharedArrayBuffer where permitted, level of detail, native workers, and explicit frame/control budgets.

Open-source maintenance burden

Pin versions, maintain a software bill of materials, fund critical upstreams, and own thin adapters instead of forks.

False safety confidence

Keep safety monitors independent, trace hazards to tests, perform HIL/physical tests, and prohibit simulation-only certification claims.

转换过程丢失语义

以 ISAM 为规范状态，采用类型化适配器和往返不变量，未解析字段进入隔离队列。

动画合理但求解器已经漂移

分离视觉状态和物理状态，强制报告残差、能量/接触 KPI，并与基准引擎比较。

传感器域差距

用硬件数据拟合参数，保留不确定度，测试下游感知任务，并按设备版本刷新校准。

浏览器时序与内存限制

采用 Web Workers、允许时启用 SharedArrayBuffer、使用 LOD、原生节点和明确的帧/控制预算。

开源维护负担

锁定版本、维护软件物料清单、资助关键上游，尽量拥有薄适配器而非长期分叉。

错误的安全信心

安全监视器保持独立，危险项追踪到测试，执行 HIL/物理试验，禁止仅凭仿真宣称认证。

Deployment Topology and Ownership部署拓扑与职责边界

Browser clientAuthoring, review, lightweight simulation, KPI explorer, WebRTC view of native render workers.

Control planeAsset registry, capability matching, scenario scheduler, policy and access control, run manifests.

Simulation workersCPU/GPU-native physics, sensor rendering, parallel environments, synthetic-data generation.

Robot edgeROS 2 graph, policy runtime, real-time control, independent safety monitor, local logging and rollback.

Ownership rule: platform teams own contracts, clocks, observability, packaging, and compatibility. Robotics teams own models, calibration, control, tasks, and acceptance thresholds. Safety authority remains independent from both. This split prevents the platform team from making unreviewed physical assumptions.

浏览器客户端建模、评审、轻量仿真、KPI 浏览器，以及通过 WebRTC 查看原生渲染节点。

控制平面资产注册、能力匹配、场景调度、策略与访问控制、运行清单。

仿真工作节点CPU/GPU 原生物理、传感渲染、并行环境与合成数据生成。

机器人边缘侧ROS 2 图、策略运行时、实时控制、独立安全监视器、本地记录与回滚。

职责原则：平台团队负责契约、时钟、可观测、打包和兼容性；机器人团队负责模型、校准、控制、任务与验收阈值；安全职能独立于两者。这样可以避免平台团队在未经评审的情况下写入物理假设。

Notation, State, and Reproducibility Contract符号、状态与可复现契约

All comparisons use SI units, named coordinate frames, monotonic simulation time, and an explicit quaternion convention. A run is defined by the state and its evidence, not by a video.

\[X_t = \{q_t,\dot q_t,T_t,V_t,C_t,S_t,B_t\}, \qquad X_{t+1}=F_\theta(X_t,u_t,w_t,\Delta t)\]

Here, \(q\) and \(\dot q\) are generalized position and velocity, \(T\) is the frame graph, \(V\) is geometry state, \(C\) is the contact set, \(S\) is sensor state, and \(B\) is behavior/runtime state. Parameters \(\theta\), disturbance \(w_t\), time step, seeds, backend version, asset hashes, and precision mode belong in the run manifest.

所有比较统一使用 SI 单位、具名坐标系、单调仿真时间和明确的四元数约定。一次运行由状态及其证据定义，而不是由一段视频定义。

\[X_t = \{q_t,\dot q_t,T_t,V_t,C_t,S_t,B_t\}, \qquad X_{t+1}=F_\theta(X_t,u_t,w_t,\Delta t)\]

其中 \(q\) 与 \(\dot q\) 是广义位置和速度，\(T\) 是坐标图，\(V\) 是几何状态，\(C\) 是接触集合，\(S\) 是传感状态，\(B\) 是行为/运行时状态。参数 \(\theta\)、扰动 \(w_t\)、时间步、随机种子、后端版本、资产哈希和精度模式都必须写入运行清单。

Kinematics and Planning Formulae运动学与规划公式

Forward kinematics

\[T_0^n(q)=\prod_{i=1}^{n} T_{i-1}^{i}(q_i)\]

The WASM and native implementations must agree on frame order, joint axis, home transform, units, and floating-point precision. Compare translation and geodesic rotation error.

Velocity and Jacobian

\[\nu = J(q)\dot q, \qquad J_i^{FD}=\frac{f(q+\epsilon e_i)-f(q-\epsilon e_i)}{2\epsilon}\]

Analytic or algorithmic Jacobians are checked against a central finite difference over a scale-aware \(\epsilon\).

Pose error in \(SE(3)\)

\[e_T=\begin{bmatrix}p_s-p_r\\ \operatorname{Log}(R_r^\top R_s)^\vee\end{bmatrix}\]

Separate translational and rotational errors. Euler-angle subtraction is not an acceptable orientation metric.

Constrained inverse kinematics

\[q^*=\arg\min_q \|\operatorname{Log}(T_d^{-1}T(q))\|_W^2+\lambda\|q-q_0\|^2\]

Subject to joint, velocity, collision-distance, balance, and task constraints.
Report convergence, residual, iterations, and failure class.

Trajectory smoothness

\[J_{traj}=\int_0^T \left(w_e\|e(t)\|^2+w_a\|\ddot q(t)\|^2+w_j\|\dddot q(t)\|^2\right)dt\]

Planning quality must include tracking feasibility, acceleration, jerk, clearance, and controller limits.

Center of mass and support margin

\[p_{CoM}=\frac{\sum_i m_i p_i}{\sum_i m_i}, \qquad m_s=\min_{e\in\partial\mathcal P} d(p_{ZMP},e)\]

For quasi-static tests, the projected CoM or ZMP should remain inside the support polygon \(\mathcal P\) with declared margin.

正运动学

\[T_0^n(q)=\prod_{i=1}^{n} T_{i-1}^{i}(q_i)\]

WASM 与原生实现必须统一坐标顺序、关节轴、初始变换、单位和浮点精度，分别比较平移误差和旋转测地误差。

速度与 Jacobian

\[\nu = J(q)\dot q, \qquad J_i^{FD}=\frac{f(q+\epsilon e_i)-f(q-\epsilon e_i)}{2\epsilon}\]

解析或算法 Jacobian 需要与中心有限差分比较，\(\epsilon\) 应根据变量尺度选择。

\(SE(3)\) 位姿误差

\[e_T=\begin{bmatrix}p_s-p_r\\ \operatorname{Log}(R_r^\top R_s)^\vee\end{bmatrix}\]

平移与旋转误差分开报告，不能直接相减欧拉角来衡量姿态误差。

约束逆运动学

\[q^*=\arg\min_q \|\operatorname{Log}(T_d^{-1}T(q))\|_W^2+\lambda\|q-q_0\|^2\]

约束包括关节、速度、碰撞距离、平衡和任务条件。
报告收敛、残差、迭代次数和失败类别。

轨迹平滑性

\[J_{traj}=\int_0^T \left(w_e\|e(t)\|^2+w_a\|\ddot q(t)\|^2+w_j\|\dddot q(t)\|^2\right)dt\]

规划质量需要同时考虑跟踪可行性、加速度、jerk、间隙和控制器限制。

质心与支撑裕量

\[p_{CoM}=\frac{\sum_i m_i p_i}{\sum_i m_i}, \qquad m_s=\min_{e\in\partial\mathcal P} d(p_{ZMP},e)\]

准静态测试中，投影质心或 ZMP 应留在支撑多边形 \(\mathcal P\) 内，并满足规定裕量。

Dynamics, Contact, and Actuation动力学、接触与驱动

Constrained rigid-body dynamics

\[M(q)\ddot q+C(q,\dot q)\dot q+g(q)+\tau_f=\tau+J_c(q)^\top\lambda\]

Compare generalized acceleration, torque residual, constraint drift, and contact wrench. Animation similarity is not enough.

Inverse-dynamics residual

\[r_\tau=\tau-\left(M\ddot q+C\dot q+g+\tau_f-J_c^\top\lambda\right)\]

Use normalized \(\|r_\tau\|_2\) and per-joint residuals to locate model, actuator, or contact mismatch.

Unilateral contact

\[0\le \lambda_n\ \perp\ \phi(q)\ge0, \qquad \|\lambda_t\|_2\le\mu\lambda_n\]

The complementarity relation prevents attraction through a contact surface; the friction cone limits tangential force.

Impulse update

\[M(q)(\dot q^+-\dot q^-)=J_c^\top\Lambda, \qquad J_c\dot q^+\ge -eJ_c\dot q^-\]

Track contact onset time, normal impulse, restitution, penetration, and solver iteration count.

Actuator and transmission

\[\tau=G\,\eta\,\tau_m-\tau_{fric}(\dot q)-\tau_{backlash}(q)\]

Humanoid fidelity depends on gear ratio, efficiency, torque-speed envelope, dead band, thermal limit, delay, and saturation.

Energy consistency

\[\Delta E=E(T)-E(0)-\int_0^T(\tau^\top\dot q+P_{ext}-P_{diss})dt\]

Evaluate drift only for a declared energy model. Dissipation and controller work must not be mistaken for numerical error.

带约束刚体动力学

\[M(q)\ddot q+C(q,\dot q)\dot q+g(q)+\tau_f=\tau+J_c(q)^\top\lambda\]

比较广义加速度、力矩残差、约束漂移和接触力；动画看起来接近远远不够。

逆动力学残差

\[r_\tau=\tau-\left(M\ddot q+C\dot q+g+\tau_f-J_c^\top\lambda\right)\]

使用归一化 \(\|r_\tau\|_2\) 和逐关节残差定位模型、执行器或接触差异。

单边接触

\[0\le \lambda_n\ \perp\ \phi(q)\ge0, \qquad \|\lambda_t\|_2\le\mu\lambda_n\]

互补关系避免物体被接触面吸引，摩擦锥限制切向力。

冲量更新

\[M(q)(\dot q^+-\dot q^-)=J_c^\top\Lambda, \qquad J_c\dot q^+\ge -eJ_c\dot q^-\]

记录接触开始时间、法向冲量、恢复系数、穿透量和求解器迭代次数。

执行器与传动

\[\tau=G\,\eta\,\tau_m-\tau_{fric}(\dot q)-\tau_{backlash}(q)\]

人形机器人保真度取决于减速比、效率、力矩-转速包络、死区、热限制、延迟和饱和。

能量一致性

\[\Delta E=E(T)-E(0)-\int_0^T(\tau^\top\dot q+P_{ext}-P_{diss})dt\]

只有在明确能量模型后才能评估漂移，耗散和控制器做功不能被误判为数值误差。

Virtual Camera and Sensor Models虚拟相机与传感器模型

Camera projection

\[s\begin{bmatrix}u\\v\\1\end{bmatrix}=K\,[R\mid t]X, \qquad (u_d,v_d)=D(u,v;k_1,k_2,p_1,p_2,\ldots)\]

Virtual Camera stores intrinsics, extrinsics, distortion, exposure, rolling-shutter timing, color response, and calibration revision.

Depth and LiDAR observation

\[\hat z=z+b(z,\rho,\theta)+\epsilon,\quad \epsilon\sim\mathcal N(0,\sigma_z^2);\qquad \hat r=r+n_r\]

Bias and variance depend on range, incidence angle, reflectance, material, weather, and return policy. IID Gaussian noise alone is rarely sufficient.

IMU model

\[\omega_m=\omega+b_g+n_g,\quad \dot b_g=n_{wg};\qquad a_m=R^\top(a-g)+b_a+n_a\]

Fit white noise, random walk, bias instability, scale, misalignment, saturation, sampling jitter, and timestamp offset.

Latency and synchronization

\[t_{obs}=t_{sim}+\delta_{clock}+\delta_{transport}+\delta_{processing}\]

Report the full latency distribution and cross-sensor skew. Closed-loop behavior is often more sensitive to tails than to the mean.

Distribution distance

\[D_{MMD}^2(P,Q)=\mathbb E k(x,x')+\mathbb E k(y,y')-2\mathbb E k(x,y)\]

Compare simulated and hardware sensor distributions using MMD, Wasserstein distance, spectral density, and task-level perception metrics.

Counterfactual sensor replay

\[y_t^{(m)}=h_m(X_t,\theta_m,\xi_t),\qquad m\in\mathcal M_{sensor}\]

One saved physical trajectory can generate multiple calibrated sensor hypotheses while preserving identical motion and contacts.

相机投影

\[s\begin{bmatrix}u\\v\\1\end{bmatrix}=K\,[R\mid t]X, \qquad (u_d,v_d)=D(u,v;k_1,k_2,p_1,p_2,\ldots)\]

Virtual Camera 保存内参、外参、畸变、曝光、卷帘快门时序、颜色响应和校准版本。

深度与 LiDAR 观测

\[\hat z=z+b(z,\rho,\theta)+\epsilon,\quad \epsilon\sim\mathcal N(0,\sigma_z^2);\qquad \hat r=r+n_r\]

偏差和方差取决于距离、入射角、反射率、材质、天气和回波策略；单纯 IID 高斯噪声通常不够。

IMU 模型

\[\omega_m=\omega+b_g+n_g,\quad \dot b_g=n_{wg};\qquad a_m=R^\top(a-g)+b_a+n_a\]

需要拟合白噪声、随机游走、偏置不稳定、比例、错位、饱和、采样抖动和时间戳偏移。

延迟与同步

\[t_{obs}=t_{sim}+\delta_{clock}+\delta_{transport}+\delta_{processing}\]

报告延迟分布和跨传感器偏差，不能只看平均值。闭环行为往往对尾部延迟更敏感。

分布距离

\[D_{MMD}^2(P,Q)=\mathbb E k(x,x')+\mathbb E k(y,y')-2\mathbb E k(x,y)\]

通过 MMD、Wasserstein 距离、功率谱密度和下游感知指标比较仿真与硬件传感分布。

反事实传感回放

\[y_t^{(m)}=h_m(X_t,\theta_m,\xi_t),\qquad m\in\mathcal M_{sensor}\]

一条保存的物理轨迹可以生成多种已标定传感器假设，同时保持运动和接触完全一致。

Control, Learning, and Sim-to-Real控制、学习与 Sim-to-Real

Impedance control

\[F=K_p(x_d-x)+K_d(\dot x_d-\dot x)+F_{ff}\]

Compare closed-loop stiffness, damping ratio, overshoot, settling time, contact force, and passivity under uncertain geometry.

Policy objective

\[J(\pi)=\mathbb E_{\theta\sim p(\theta),\,\tau\sim\pi}\left[\sum_{t=0}^{T}\gamma^t r(s_t,a_t;\theta)\right]\]

Domain randomization distribution \(p(\theta)\) is versioned evidence. It includes physics, sensing, delay, terrain, payload, and disturbance.

Policy retention

\[R_{policy}=\frac{P_{success}^{open}}{P_{success}^{baseline}},\qquad G_{S2R}=P_{success}^{sim}-P_{success}^{real}\]

Use confidence intervals across seeds and scenarios. A faster simulator that produces a weaker transferred policy is not equivalent.

Model calibration

\[\theta^*=\arg\min_\theta\sum_k\|y_k^{real}-y_k^{sim}(\theta)\|_{W_k}^2+\lambda\Omega(\theta)\]

Report identifiability and posterior uncertainty. A fitted parameter without excitation or evidence should not become a fixed asset value.

阻抗控制

\[F=K_p(x_d-x)+K_d(\dot x_d-\dot x)+F_{ff}\]

在几何不确定条件下比较闭环刚度、阻尼比、超调、稳定时间、接触力和无源性。

策略目标

\[J(\pi)=\mathbb E_{\theta\sim p(\theta),\,\tau\sim\pi}\left[\sum_{t=0}^{T}\gamma^t r(s_t,a_t;\theta)\right]\]

域随机化分布 \(p(\theta)\) 是版本化证据，覆盖物理、传感、延迟、地形、负载和扰动。

策略保持率

\[R_{policy}=\frac{P_{success}^{open}}{P_{success}^{baseline}},\qquad G_{S2R}=P_{success}^{sim}-P_{success}^{real}\]

跨随机种子和场景报告置信区间。仿真速度更快却训练出迁移更差的策略，不能算等效。

模型标定

\[\theta^*=\arg\min_\theta\sum_k\|y_k^{real}-y_k^{sim}(\theta)\|_{W_k}^2+\lambda\Omega(\theta)\]

报告可辨识性和后验不确定度。缺少激励或证据的拟合参数不能直接固化为资产常数。

Performance and Determinism Metrics性能与确定性指标

Real-time factor

\[RTF=\frac{T_{simulated}}{T_{wall}},\qquad Throughput=N_{env}\cdot\frac{steps}{T_{wall}}\]

Report warm-up, scene, hardware, environment count, sensor load, precision, and p50/p95/p99 step time.

Deterministic replay

\[E_{replay}=\max_t\|X_t^{(1)}-X_t^{(2)}\|_W,\qquad H_{event}^{(1)}=H_{event}^{(2)}\]

Require identical event hashes on one fixed backend. Cross-hardware floating-point runs use declared numerical tolerances.

Cost-normalized throughput

\[\eta_{cost}=\frac{valid\ environment\ steps}{compute\ cost+license\ cost+operator\ cost}\]

Only steps from runs that pass physics and sensor gates count as valid. Cheap invalid data has zero value.

Availability and recovery

\[A=\frac{MTBF}{MTBF+MTTR},\qquad R_{recovery}=\Pr(T_{restore}\le T_{budget})\]

Measure worker loss, asset-cache failure, network partition, policy rollback, and controller reconnect scenarios.

实时因子

\[RTF=\frac{T_{simulated}}{T_{wall}},\qquad Throughput=N_{env}\cdot\frac{steps}{T_{wall}}\]

报告预热方式、场景、硬件、环境数、传感负载、精度和 p50/p95/p99 步时。

确定性回放

\[E_{replay}=\max_t\|X_t^{(1)}-X_t^{(2)}\|_W,\qquad H_{event}^{(1)}=H_{event}^{(2)}\]

同一固定后端要求事件哈希一致；跨硬件浮点运行使用明确的数值容差。

成本归一化吞吐

\[\eta_{cost}=\frac{valid\ environment\ steps}{compute\ cost+license\ cost+operator\ cost}\]

只有通过物理与传感门槛的运行步才算有效，廉价但无效的数据价值为零。

可用性与恢复

\[A=\frac{MTBF}{MTBF+MTTR},\qquad R_{recovery}=\Pr(T_{restore}\le T_{budget})\]

测量工作节点丢失、资产缓存故障、网络分区、策略回滚和控制器重连场景。

KPI Acceptance GatesKPI 验收门槛

Thresholds below are starting values for a reference humanoid program. Each deployment must tighten or relax them through hazard analysis, hardware accuracy, controller period, and task sensitivity. A threshold without test conditions is not portable.

Dimension	Metric	Initial gate	Protocol
Semantic round trip	L_critical	0 lost critical fields; 100% stable IDs	Import/export all golden assets and compare typed semantic paths.
FK implementation	RMSE_p, RMSE_R	≤ 0.1 mm and ≤ 0.01° against float64 oracle	At least 10,000 valid configurations including joint-limit neighborhoods.
Calibrated tool pose	RMSE_tool	≤ 2 mm and ≤ 0.2° for precision manipulation profile	Independent metrology over workspace; report p95 and spatial bias map.
Jacobian	e_J	Relative Frobenius error ≤ 1e-5	Compare analytic/WASM result to scale-aware central finite differences.
Free dynamics	NRMSE_q, r_tau	≤ 2% trajectory NRMSE; normalized torque residual ≤ 3%	Pendulum, free fall, floating base, and driven chain across step sizes.
Contact dynamics	F1_contact, e_impulse	F1 ≥ 0.95; median impulse error ≤ 10%	Drop, incline, stack, foot-ground, grasp, and insertion against oracle/hardware.
Constraint stability	e_constraint	p95 joint/contact drift ≤ task tolerance; no unbounded growth	Long-horizon standing, closed chains, load holding, and repeated impact.
Camera calibration	e_reprojection	Median ≤ 0.5 px; p95 ≤ 1.0 px	Real and virtual calibration targets across depth, field of view, and exposure.
Depth sensing	AbsRel, invalid rate	AbsRel ≤ 2% in calibrated range; invalid-rate delta ≤ 2 pp	Stratify by range, angle, reflectance, edge, and material.
IMU statistics	PSD / Allan error	Noise-density and bias terms within 10% of fitted hardware model	Static and dynamic logs across temperature and device revisions.
Interactive runtime	frame_p95	≤ 33.3 ms at declared reference scene	Fixed browser, device, viewport, robot count, sensors, and quality profile.
Control timing	step_p99, deadline miss	p99 below control budget; zero unsafe deadline misses	Load, network jitter, worker failure, and recovery stress tests.
Replay	E_replay, event hash	Identical event hash and E_replay ≤ 1e-9 on fixed CPU backend	Repeat from manifest; cross-hardware tolerance reported separately.
Policy quality	R_policy	Lower 95% CI ≥ 0.95 of incumbent success	Paired scenarios, at least 10 seeds, identical evaluation disturbances.
Sim-to-real	G_S2R	No more than 5 percentage points worse than approved baseline	Held-out physical tasks and hardware revisions; no tuning on test set.
Safety monitor	recall_unsafe	100% on mandatory hazard suite; zero prohibited actuation	Fault injection, stale data, limit violation, timing loss, and corrupted policy.
Cost efficiency	eta_cost	≥ baseline valid steps per total cost by release 2	Include compute, storage, engineering, maintenance, and commercial licenses.

下列阈值是人形机器人参考项目的初始值。每个部署都要根据危险分析、硬件精度、控制周期和任务敏感度收紧或放宽。脱离测试条件的阈值无法移植。

维度	指标	初始门槛	测试协议
语义往返	L_critical	关键字段丢失为 0；稳定 ID 保持率 100%	导入导出全部黄金资产，比较类型化语义路径。
FK 实现	RMSE_p, RMSE_R	相对 float64 基准 ≤ 0.1 mm 且 ≤ 0.01°	至少 10,000 个有效构型，包括关节限位附近。
已标定工具位姿	RMSE_tool	精密操作配置 ≤ 2 mm 且 ≤ 0.2°	全工作空间独立计量，报告 p95 和空间偏差图。
Jacobian	e_J	相对 Frobenius 误差 ≤ 1e-5	解析/WASM 结果与尺度自适应中心有限差分比较。
自由动力学	NRMSE_q, r_tau	轨迹 NRMSE ≤ 2%；归一化力矩残差 ≤ 3%	单摆、自由落体、浮动基座和驱动链，覆盖多种步长。
接触动力学	F1_contact, e_impulse	F1 ≥ 0.95；冲量中位误差 ≤ 10%	跌落、斜面、堆叠、足地、抓取和插装，对比基准/硬件。
约束稳定	e_constraint	p95 关节/接触漂移不超过任务容差；不得无界增长	长时站立、闭链、负载保持和反复冲击。
相机校准	e_reprojection	中位 ≤ 0.5 px；p95 ≤ 1.0 px	真实与虚拟标定板，覆盖深度、视场和曝光。
深度传感	AbsRel, invalid rate	标定范围内 AbsRel ≤ 2%；无效率差值 ≤ 2 个百分点	按距离、角度、反射率、边缘和材质分层。
IMU 统计	PSD / Allan error	噪声密度和偏置项与硬件拟合模型相差 ≤ 10%	跨温度和设备版本的静态、动态记录。
交互运行时	frame_p95	声明参考场景下 ≤ 33.3 ms	固定浏览器、设备、视口、机器人数量、传感器和质量配置。
控制时序	step_p99, deadline miss	p99 低于控制预算；不允许不安全的截止时间遗漏	负载、网络抖动、节点故障和恢复压力测试。
回放	E_replay, event hash	固定 CPU 后端事件哈希相同，E_replay ≤ 1e-9	依据运行清单重复；跨硬件容差单独报告。
策略质量	R_policy	成功率相对现有栈的 95% CI 下界 ≥ 0.95	配对场景、至少 10 个种子、相同评估扰动。
Sim-to-real	G_S2R	比批准基线最多差 5 个百分点	保留的物理任务与硬件版本，禁止在测试集上调参。
安全监视器	recall_unsafe	强制危险测试集召回率 100%；禁止动作输出为 0	故障注入、陈旧数据、越限、时序丢失和策略损坏。
成本效率	eta_cost	第二个版本起，每总成本有效步数不低于基线	计入计算、存储、工程、维护和商业许可证。

Composite Score with Hard Gates带硬门槛的综合评分

Score only after all mandatory gates pass:

\[S=100\exp\left(\sum_{i=1}^{m} w_i\ln\left(\max\left(\epsilon,\frac{s_i}{100}\right)\right)\right),\qquad \sum_i w_i=1\]

Use a weighted geometric mean so one weak dimension cannot be hidden by several strong ones. If semantic integrity, safety, deterministic evidence, or the task-critical physics gate fails, the release score is “not admissible” rather than a number.

Weights are workload-specific. A synthetic-vision project assigns more weight to sensor realism and throughput; whole-body control assigns more to contact, latency, and policy retention. Publish each raw KPI, confidence interval, gate result, weight, and score transformation. The composite score is a decision aid, never the evidence itself.

只有全部强制门槛通过后才计算得分：

\[S=100\exp\left(\sum_{i=1}^{m} w_i\ln\left(\max\left(\epsilon,\frac{s_i}{100}\right)\right)\right),\qquad \sum_i w_i=1\]

使用加权几何平均，使一个薄弱维度无法被多个高分维度掩盖。语义完整性、安全、确定性证据或任务关键物理门槛只要失败，发布结果就是“不准入”，而不是一个分数。

权重随工作负载变化。合成视觉项目提高传感器真实性和吞吐权重；全身控制提高接触、时延和策略保持率权重。每个原始 KPI、置信区间、门槛结果、权重和得分变换都应公开。综合分只辅助决策，不能代替原始证据。

Canonical Benchmark Suite规范基准测试集

K-01Frame and chainFK, IK, Jacobian, singularity, limit, and collision-distance cases.

D-01Analytical dynamicsPendulum, free fall, double pendulum, floating body, driven chain.

C-01Contact ladderIncline, bounce, stack, rolling, foot-ground, grasp, insertion.

H-01Humanoid bodyStanding, squat, push recovery, walking, stair, payload carry.

S-01Sensor laboratoryCalibration board, depth/material rig, LiDAR target, IMU motion table.

P-01Perception and policyDetection, pose, grasp, locomotion, disturbance and held-out transfer.

I-01InteroperabilityISAM, OpenUSD, glTF, URDF/SDF, AAS and OPC UA round trip.

R-01Runtime stressScale, network jitter, worker loss, cache miss, replay and rollback.

F-01Fault and safetyStale sensor, corrupted policy, limit breach, timing loss, unsafe command.

K-01坐标与运动链FK、IK、Jacobian、奇异、限位和碰撞距离。

D-01解析动力学单摆、自由落体、双摆、浮动物体和驱动链。

C-01接触阶梯斜面、弹跳、堆叠、滚动、足地、抓取和插装。

H-01人形本体站立、深蹲、推扰恢复、行走、楼梯和负载搬运。

S-01传感实验室标定板、深度/材质台、LiDAR 靶标和 IMU 运动台。

P-01感知与策略检测、位姿、抓取、行走、扰动和保留集迁移。

I-01互操作ISAM、OpenUSD、glTF、URDF/SDF、AAS 与 OPC UA 往返。

R-01运行时压力规模、网络抖动、节点丢失、缓存未命中、回放和回滚。

F-01故障与安全陈旧传感器、损坏策略、越限、时序丢失和不安全指令。

Every benchmark report includes median and tail statistics, bootstrap 95% confidence intervals, seed count, failure taxonomy, hardware/software bill of materials, and the signed run manifest. Averages without failures and tails are rejected.

每份基准报告都包含中位与尾部统计、bootstrap 95% 置信区间、种子数量、失败分类、软硬件物料清单和签名运行清单。只给平均值、不报告失败与尾部的结果不予接受。

Open Embodied Intelligence Toolchain开放具身智能工具链