Robot Hygiene Protocol (RHP-OS)

The question is older than the robots.

Embodied autonomous systems are entering kitchens, wards, and food lines — environments where hygiene failure is not a degraded output but a physical event with a patient or a customer on the other end. The instinctive framing is capability: will the robot be intelligent enough to handle hygiene? This page argues that the framing is wrong. The question is whether hygiene assurance should depend on intelligence at all — and clinical practice answered that question, for humans, long before the first service robot shipped. The answer was no.

Why the assurance layer must be independent of intelligence.

Five reasons, none of which weaken as models improve.

• The assured property is a physical fact, not a judgment. Whether a surface or an instrument is contaminated is a state of the world. Intelligence improves judgments about the world; it does not change the world's state. Better reasoning and hygiene assurance lie on different axes — and properties on different axes belong to different layers.
• Probabilistic systems cannot produce binary assurance. Model outputs are, by construction, distributions. Infection control does not accept confidence intervals: at fleet scale, a 99.9%-accurate hygiene judgment is a schedule of contamination events, not a safety property.
• The adversary does not read arguments. An intelligence layer can be moved by its inputs — spoofed sensors, injected instructions, distorted objectives. A pathogen cannot be persuaded, distracted, or prompted. A layer that can be manipulated must not be the sole bearer of assurance against an adversary that cannot be.
• Models are replaced; the assurance must survive. If the safety property lives inside the model, every update, fine-tune, and vendor swap silently resets it, and certification chases a moving target. A separate layer's guarantee is invariant across model versions — which is the property that procurement, audit, and regulation actually depend on.
• After an incident, “the model judged it clean” is not evidence. Accountability requires a reconstructible chain: what evidence existed, when it was checked, what the verdict was, and what was therefore permitted to happen. A reasoning trace is an explanation. A signed evidence record is proof. Only one of them survives a dispute.

Humans never solved this with intelligence either.

The most skilled surgeon in the world cannot begin a procedure with an instrument that lacks a sterilization indicator. Not because the surgeon's judgment is doubted — because the operating regime deliberately placed sterility assurance in a layer that judgment cannot override. The autoclave indicator does not advise the procedure; it is a precondition for the procedure existing. No sterile evidence, and the procedure path does not form.

That regime was not a failure of trust in clinicians. It was the recognition, paid for over more than a century, that competence and contamination are independent variables. RHP-OS is not the invention of a new principle. It is the transplant of that regime — evidence as a structural precondition, not an input to judgment — from human procedure to machine actuation. A layer that intelligence was never allowed to waive for humans is not one a robot should be the first to be excused from.

The clinical genealogy of this principle is the subject of the origin essay.

Four stages, one direction.

The chain reads left to right and never backward. Hygiene-readiness evidence is generated by trusted instrumentation and presented first. A deterministic gate — no model in the loop — checks the evidence against the readiness policy. Only a passing verdict commits, and only a commit permits the actuation path to assemble. Absent or failed evidence produces non-action by default: fail-closed is the resting state, not an alarm condition.

The physical domain makes one property of this ordering non-negotiable. In software, a bad write can at least pretend to be undone. An actuation that must be recalled has already happened — there is no rollback for contact. Which is why the check must precede formation: after is too late by definition, not by degree.

One further element completes the structure: the protocol is built so that its integrity can be confirmed by an independent verifier — a third party can check that the evidence chain is intact and untampered without receiving the implementation itself.

One layer, complementary by design.

RHP-OS occupies a single position: between the generation of readiness evidence and the commit that permits actuation. It does not replace the robot's perception or planning stack, its safety-rated motion control, or the hygiene certification regimes a facility already operates under — HACCP-style programs in food service, infection-control protocols in clinical environments. Those regimes define what counts as ready; RHP-OS makes the proof of readiness a structural precondition of action and leaves a machine-checkable record behind. Evidence automation alongside certification, not a substitute for it. The environments where this cut matters first are the ones already deploying: food-service robots operating under hygiene programs, and delivery and service robots working hospital corridors.

What RHP-OS does not claim.

• It does not, by itself, claim microbiological outcomes. It assures the presence and integrity of the readiness-evidence chain, given trusted instrumentation; what the evidence measures is defined by the applicable hygiene regime.
• It is not a medical device and not a substitute for regulatory certification or facility hygiene programs.
• It requires trusted sensing and instrumentation for evidence generation — evidence labels come from instrumentation, not from the model.
• It is not presented here as a completed runtime product. See Status.

Specification sealed.

The same chain, in memory and in the world.

Evidence → deterministic gate → commit → path formation is the same sequence Certum applies to an agent's persistent memory in MWP and to action authorization in CCA. The physical domain is where the principle was learned, and it is the domain where its consequences are least negotiable — a poisoned memory can be studied; a contaminated contact has occurred. That the identical structure holds across substrates is the strongest evidence we can offer that non-formation is a paradigm, not a product feature.

Status.

Filed with KIPO (Korean Intellectual Property Office).

Evaluation · collaboration.

For technical evaluation or collaboration on embodied-systems readiness: