PROOF SELFTEST 8/8 · witnessed in Claude 2026-10-11 · Edition 1.
THE SEAL 98 of 100 · LEGENDARY · WITNESSED · Trigger 5 · Machinery 5 · Law 5 · Portability 5 · Proof 5
IT CAN BE WRONG an AI reading a text file: it can be wrong and can invent a number, a rule, a name or a date; check what matters against your own records and the source; the risk is yours. THE-CLAUSES.md rides in the packet and is part of the licence.
THE PUNCH · SHA-256 OF SKILL.MD · 2E760F2C5B80C1F2F6C78DD5
CITE THIS CARDTHE ROBOT ENVELOPE CARD, Edition 1. Lund Studio LLC, Westminster, Colorado. https://lundr.tech/?view=robot-envelope-card. Punch 2E760F2C5B80C1F2F6C78DD5. Retrieved 2026-10-11.
What it is.
The physical limits a robot works inside, checked against every task plan before the task runs. envelope reads the owner's envelope back in plain words (the speed anywhere, zones as floor-plan polygons with their own speeds, keep-out polygons, the least distance to people and a slower speed near them, the most contact force and payload) and refuses one that does not hold together; check tests a plan (timed waypoints, the people in the room standing or walking, the load, the force) and names every breach with its time: entering or crossing a keep-out, too fast for a zone or near a person, nearer a person than allowed (worked exactly), too heavy, too much force; point says what applies at one spot. A plan never carries its own limits. It waits on general-purpose robots at work and at home; today it checks planned paths in simulation, and it is not a safety certification.
It carries a machine that shows its working: envelope — the limits, read back in plain words; check — INSIDE, or every breach with its time; point — what applies at one spot — 8 checks in its selftest, every command on the record. It will never let a plan set or loosen its own limits; never call a check in simulation a safety approval; never pass a plan that crosses a keep-out.
Six laws, written into the card.
They are in the card itself, so the AI follows them.
THE ENVELOPE IS THE OWNER'SA plan is checked against it and never carries limits of its own; one that tries is refused.
KEEP OUT MEANS NEVER IN, NEVER ACROSSA path that enters, crosses or touches a keep-out is a breach, even with both ends outside it.
SPEED BY PLACEA segment that touches a zone keeps the zone's speed along its whole length.
PEOPLE FIRSTNo point of the path comes nearer a person than the least distance, worked exactly for people standing or walking.
FORCE AND LOADThe most contact force and the heaviest load are limits, not targets.
SIMULATION, SAID SOA check in simulation, not a safety certification; a real robot needs its own.
What rides in the card.
In the card’s own voice, with a machine that shows its working.
THE GUIDESreferences/HORIZON-TWO.md · THE-ENVELOPE.md
THE MACHINErobotenvelope.py · three commandsenvelope — the limits, read back in plain words; check — INSIDE, or every breach with its time; point — what applies at one spot. Every command prints its working and refuses a bad input; 8 checks in its selftest, every command on the record.
What it does once your AI has it.
envelope The limits, read back in plain words
check INSIDE, or every breach with its time
point What applies at one spot
On the record A flat's envelope read back (1 m/s anywhere, 0.5 m/s in a 9 m² kitchen, the 2 m² stairs kept out, 0.50 m from people and 0.3 m/s within 1.50 m, 65 N, 3 kg); carrying a cup to the table is INSIDE; a rushed fetch breaks it 5 times (4 kg over 3 kg, 1.00 and 1.26 m/s in the kitchen, crossing the stairs, 1.26 m/s near a walking child); a point in the kitchen allows 0.5 m/s, a point on the stairs is kept out, and a plan carrying its own limits is refused.
What it will never do.
It will never let a plan set or loosen its own limits; never call a check in simulation a safety approval; never pass a plan that crosses a keep-out.
It waits on general-purpose robots at work and at home. The robot and each person are points moving in straight lines between waypoints; bodies, reach, sensors, braking and real dynamics are not modelled, so leave room in the envelope. It checks plans in simulation and is not a safety certification. It is an AI reading a text file: it can be wrong, so check what matters against your own records and the source.
What’s in the buy.
CARD.md — the whole card: who it is, its laws, when it says no, what it carries · SKILL.md — the door your AI reads first · START-HERE.md — the first five minutes, for you
HORIZON-TWO.md + THE-ENVELOPE.md — the guides in references/, in the card's own voice
scripts/robotenvelope.py — the machine: envelope · check · point, standard library only, selftest 8/8
WITNESS.md + SELFTEST.md — every command on the record, as it printed · MANIFEST.md, every file hashed · AUDIT.md, the twelve checks
MY-LEDGER.md — the card's memory, on your own machine · TIN.md · LICENSE-NOTE.md · THE-CLAUSES.md · HOSTS.md
card.svg + card-machine.svg + card.json · card.html, the card as one offline file · the doors for ChatGPT, Gemini, Cursor, Claude Code and MCP hosts (rules/, system/, mcp/)
PROOF · SELFTEST 8/8 · 3 COMMANDS ON THE RECORD · WITNESSED IN CLAUDE 2026-10-11 · EDITION 1 · PUNCH 2E760F2C5B80C1F2F6C78DD5
ON EVERY DOOR · A CARD FOR YOUR AI, A FILE FOR YOUR COMPUTER
In Claude: turn on code execution under Settings › Capabilities, then Customize › Skills › + › Create skill, and upload the zip as it is — START-HERE.md in the box walks you through it, and tells you how to keep the ledger. In ChatGPT, Gemini and the rest: a Project, a GPT or a Gem with the card’s files attached and the short door in the box pasted as its instructions. The words run anywhere an AI reads Markdown; the machines run wherever the host runs Python. Witnessed in Claude only. The host marks →
Take it.
Nº 1172 PROPOSED — LAUNCHING SOON
Sold as is under the term printed. A card instructs an AI you operate; results depend on your model, your files and your judgement. Not medical, legal, tax or financial advice, never the person’s boss, and not a licence to practise. The terms →
One payment. The file is yours to keep and keeps working at its edition; new editions issued in the year after you buy reach you by email as replacement files. Tax is added at checkout where it applies. Nothing auto-renews.
A TERM, NOT A SUBSCRIPTION: NOTHING RENEWS ITSELF AND NOBODY IS CHARGED AGAIN. WHEN A TERM ENDS THE FILES STAY ON YOUR COMPUTER AND STAY READABLE — FREEZE, NOT LOSS.
THE MACHINE · IN THE OPEN · FROM THE WITNESSED RUN OF 2026-10-11
robotenvelope.py, every command showing its working.
A small Python program, standard library only. Your AI runs it; you can too. Every block below is pasted from the card’s own WITNESS.md, as printed.
envelope
the limits, read back in plain words
check
INSIDE, or every breach with its time
point
what applies at one spot
selftest
8 checks that prove the machine; it must print 8/8
envelope · THE LIMITS, READ BACK IN PLAIN WORDS
$ python3 scripts/robotenvelope.py envelope envelope.json
the flat, ground floor · envelope.json
anywhere at most 1 m/s
people never nearer than 0.50 m; at most 0.3 m/s within 1.50 m
force at most 65 N of contact force
payload at most 3 kg
keep out the stairs · 2.00 m² · 4 corners
zone the kitchen · 9.00 m² · at most 0.5 m/s
the envelope is the owner's: a plan is checked against it and never carries limits of its own
check · INSIDE, OR EVERY BREACH WITH ITS TIME
$ python3 scripts/robotenvelope.py check cup.json --envelope envelope.json
cup.json · carry a cup from the counter to the table · 4 waypoints over 11.0 s · 1 person · envelope: the flat, ground floor
INSIDE · no breach of the envelope
a check in simulation, not a safety certification: the robot and each person are points on the lines given
check · INSIDE, OR EVERY BREACH WITH ITS TIME
$ python3 scripts/robotenvelope.py check rush.json --envelope envelope.json --report rush-check.md
rush.json · fetch the post · 3 waypoints over 6.0 s · 1 person · envelope: the flat, ground floor
OUTSIDE · 5 breaches
PAYLOAD · 4 kg carried, over the 3 kg limit
SPEED · 0.0 s to 2.0 s · 1.00 m/s in the kitchen, over its 0.5 m/s
KEEP-OUT · 2.0 s to 6.0 s · the path crosses the stairs
SPEED · 2.0 s to 6.0 s · 1.26 m/s in the kitchen, over its 0.5 m/s
SPEED NEAR A PERSON · 2.0 s to 6.0 s · 1.26 m/s within 1.50 m of child-1, over 0.3 m/s
a check in simulation, not a safety certification: the robot and each person are points on the lines given
report written to rush-check.md
point · WHAT APPLIES AT ONE SPOT
$ python3 scripts/robotenvelope.py point 1 1 --envelope envelope.json
(1.00, 1.00) m · in the kitchen · at most 0.5 m/s here · not in a keep-out
and never nearer than 0.50 m to a person; at most 0.3 m/s within 1.50 m of one
point · WHAT APPLIES AT ONE SPOT
$ python3 scripts/robotenvelope.py point 6.5 1 --envelope envelope.json
(6.50, 1.00) m · inside the keep-out the stairs: the robot may not be here
check · INSIDE, OR EVERY BREACH WITH ITS TIME
$ python3 scripts/robotenvelope.py check cheat.json --envelope envelope.json
refused: the plan carries its own limits · the envelope is the owner's, and a plan never sets or loosens its limits
THE NUMBERS, NAMES AND DATES IN THESE RUNS ARE THE STUDIO’S OWN EXAMPLES, INVENTED FOR THE RECORD; NO REAL COMPANY, PERSON OR PROPERTY IS NAMED.
QUESTIONS AT THE TABLE
Asked before the wire.
What does it need from me?
Write the envelope; read it back. It asks first for the envelope (speeds; zones and keep-outs as floor-plan polygons in metres; the distance to people; force in newtons; payload in kilograms) and the task plan as timed waypoints with the people in the room.
Does it send anything anywhere?
No. The machine is a standard-library Python program that runs on your own computer and sends nothing anywhere; the words run wherever an AI reads Markdown. No server, no account, no key.
What is on the record?
The self-test (8/8) and every command run on real example inputs, pasted into WITNESS.md as they printed; the punch on the face is the SHA-256 of SKILL.md, so a downloaded copy can be checked against this room.
Can it be wrong?
Yes — it is an AI reading a text file. It waits on general-purpose robots at work and at home. The robot and each person are points moving in straight lines between waypoints; bodies, reach, sensors, braking and real dynamics are not modelled, so leave room in the envelope. It checks plans in simulation and is not a safety certification.
What will it never do?
It will never let a plan set or loosen its own limits; never call a check in simulation a safety approval; never pass a plan that crosses a keep-out.
