Agents and hardware
What changes when the code moves a motor
A web app that is wrong shows a broken page. A robot that is wrong moves.
Everything in the earlier parts still applies. Hardware adds a few rules of its own, learned on a mobile manipulator whose calibration and test code is a day job, and on a fleet of machines where a slow network call once doubled the latency of every spoken word.
Simulate before you touch the real machine
The robot project keeps a simulator on a workstation as the default place to iterate. The agent’s contract says so plainly: the sim is where code goes first, not an afterthought. An agent that can run the sim can check its own work; an agent that can only run the robot has to ask you to stand next to it.
Hardware-dependent tests get a fallback, not a skip
Most of a robot codebase cannot run against real hardware in continuous integration. The rule is: if a test needs the device and the device is not there, write or run an offline test around everything except the transport. Parameter loading, state transitions, timeout and retry behaviour, command parsing. Keep device access behind a class so a fake can be swapped in. The untestable surface should be as small as you can make it, because that is the only way to get any regression coverage at all.
Never swallow a hardware failure
A broad exception handler that turns a failed motor command into a log line is a UX nicety on a website and a missing incident report on a robot. The contract is explicit: surface actionable diagnostics, clean up, and do not hide the failure. An agent adding error handling will reach for the broad catch by reflex, because it makes the tests pass. On hardware, that reflex has to be named and blocked in the instructions.
Never put a blocking remote call on a hot path
Not a robot, but the same physics. A voice-dictation router on this fleet gained a remote fallback tier on a server four thousand miles away. Its health probe ran in series on the transcribe path, and a state update was a synchronous write to the same server. Dictation latency doubled overnight. The fix ran the probes in parallel and made the write asynchronous, and the memory note ends with the rule: never put a blocking remote call on the transcribe path. Anything with a human waiting at the other end, whether a microphone or a gripper, has a latency budget the agent does not know about unless it is written down.
Confidential means confidential
Calibration procedures and test sequences for a commercial robot are treated with the same care as credentials. They are not pasted into external tools or public chats. The confidential repository’s agent notes are excluded from version control entirely, so they cannot leak into a public commit. An agent that helps with both stacks needs the line drawn for it, in the file it reads first.
Destructive actions ask first
The constitution’s rule for deleting branches, force-pushing and killing services is: ask. On hardware the list is longer and the asking is not optional. An agent should be able to plan a homing sequence; it should not run one on a machine it cannot see without a human saying go.
Sim first, fakes for the transport, diagnostics over silence, no blocking calls where a human is waiting, and confidential stays in its box. The agent is fast; the motor is real.