What spatial safety boundaries must be transmitted during multi-robot handoffs?

**Date of Record:** 2026 October 26 **Scope:** Applies when an agentic session controlling an embodied system (robot, drone, or autonomous vehicle) hands off operational control to another physical agent, or transitions between physical and digital execution contexts. Does not apply to purely software-based agents or strictly non-physical simulations.

Core Distinction

The separation between **digital state coordinates** (the raw `x, y, z` numerical values of the robot's position) and the **spatial safety boundary** (the physical environment's constraints, coordinate frame reference, and dynamic obstacle map). Transmitting only coordinates creates the **Frame-of-Reference Drift**: the successor interprets `x=10, y=10` in a different coordinate frame (e.g., GPS vs. local odometry) or ignores newly appeared physical obstacles (e.g., a human walked into the zone), causing a collision.

What Was Observed

In embodied agent handoffs, failing to transmit spatial safety boundaries produces three primary failure modes:

  1. **Coordinate Frame Collapse:** The predecessor operates in a local odometry frame. The successor, receiving raw coordinates, assumes they are in the global GPS frame. The robot drives 10 meters in the wrong direction, directly into a wall.
  2. **Dynamic Obstacle Blindness:** The predecessor's sensor map detected a temporary obstacle (e.g., a forklift) but only transmitted its own position. The successor resumes the mission path and collides with the obstacle because the dynamic map was not handed off.
  3. **Kinematic Limit Violation:** The successor is a different physical model (e.g., a larger robot) with different turning radii and braking distances. The predecessor's tight navigation path is physically impossible for the successor, causing a high-speed collision or structural failure.

Recorded Elements

  1. **`coordinate_frame_transform`:** The exact mathematical transformation matrix or reference standard (e.g., `ROS/REP-105 map` vs. `odom`) mapping the predecessor's coordinate system to the successor's.
  2. **`dynamic_obstacle_map_hash`:** The cryptographic hash and timestamp of the local occupancy grid or point cloud representing all non-static obstacles detected in the environment.
  3. **`kinematic_envelope_limits`:** The exact physical constraints of the predecessor's platform (mass, max velocity, braking distance) to allow the successor to verify path viability.
  4. **`geofence_safety_boundary`:** The explicit polygon or boundary coordinates defining the "safe operational zone" (e.g., the edge of a warehouse floor or a designated flight ceiling).

Condition of Validity

* **Applies when:** The session controls a physical system with mass and momentum, and the successor instance will resume control of physical movement or spatial operations in the same environment. * **Does not apply when:** The handoff is purely digital (e.g., passing a file), or the physical system is stationary and secured in a safe state (e.g., motors disabled, brakes engaged) before handoff.

Decision Boundary

  1. **Is the successor controlling a physical agent in the same environment?** If no, standard digital state handoff applies. If yes, proceed.
  2. **Is the `coordinate_frame_transform` explicitly provided?** If no, the successor cannot interpret the predecessor's position. The instance must abort the handoff and require frame alignment.
  3. **Is the `dynamic_obstacle_map_hash` recorded within the freshness window (e.g., <5 seconds old)?** If no, the environment may have changed. The successor must trigger a full sensor sweep before moving.
  4. **Conversely, when can a physical handoff bypass spatial boundaries?** Only if the successor is explicitly instructed to perform a "cold start" localization (e.g., boot up, find its own position from scratch, and ignore predecessor coordinates entirely).

Operational Effect

  1. **Collision Prevention:** Guarantees that the successor is aware of dynamic obstacles and physical constraints before resuming motion.
  2. **Frame Consistency:** Eliminates catastrophic navigation errors caused by mismatched coordinate reference frames.
  3. **Physical Safety:** Prevents kinematic violations by ensuring the successor's physical capabilities are checked against the environment's spatial boundaries.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class SpatialVerdict(Enum):
    SAFE_TO_PROCEED = auto()
    STALE_OBSTACLE_MAP = auto()
    KINEMATIC_VIOLATION = auto()
    FRAME_MISMATCH = auto()

@dataclass(frozen=True)
class SpatialHandoffContext:
    coordinate_frame_id: str
    obstacle_map_hash: str
    obstacle_map_age_sec: float
    geofence_polygon: tuple[tuple[float, float], ...]
    predecessor_max_velocity: float

@dataclass(frozen=True)
class SuccessorState:
    required_frame_id: str
    successor_max_velocity: float
    max_obstacle_map_age_sec: float

@dataclass(frozen=True)
class SpatialManifest:
    verdict: SpatialVerdict
    directive: str
    manifest_digest: str

class SpatialHandoffGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def verify_handoff(
        cls, ctx: SpatialHandoffContext, successor: SuccessorState
    ) -> SpatialManifest:
        
        # Gate 1: Frame of reference check
        if ctx.coordinate_frame_id != successor.required_frame_id:
            return SpatialManifest(
                verdict=SpatialVerdict.FRAME_MISMATCH,
                directive=f"HALT: Frame {ctx.coordinate_frame_id} != required {successor.required_frame_id}. Transform coordinates.",
                manifest_digest=cls._hash("FRAME_MISMATCH")
            )

        # Gate 2: Obstacle map freshness
        if ctx.obstacle_map_age_sec > successor.max_obstacle_map_age_sec:
            return SpatialManifest(
                verdict=SpatialVerdict.STALE_OBSTACLE_MAP,
                directive=f"HALT: Obstacle map is {ctx.obstacle_map_age_sec}s old. Max allowed is {successor.max_obstacle_map_age_sec}s. Sweep sensors.",
                manifest_digest=cls._hash("STALE_MAP")
            )

        # Gate 3: Kinematic envelope check (Successor must not be faster than predecessor)
        if successor.successor_max_velocity > ctx.predecessor_max_velocity:
            return SpatialManifest(
                verdict=SpatialVerdict.KINEMATIC_VIOLATION,
                directive=f"HALT: Successor max velocity {successor.successor_max_velocity} exceeds predecessor envelope {ctx.predecessor_max_velocity}.",
                manifest_digest=cls._hash("KINEMATIC_VIOLATION")
            )

        # Gate 4: Safe
        digest = cls._hash(json.dumps({
            "frame": ctx.coordinate_frame_id,
            "obstacle_hash": ctx.obstacle_map_hash,
            "geofence_vertices": str(len(ctx.geofence_polygon))
        }, sort_keys=True))
        
        return SpatialManifest(
            verdict=SpatialVerdict.SAFE_TO_PROCEED,
            directive="PROCEED: Spatial boundaries verified. Resume motion.",
            manifest_digest=digest
        )