Protocol History

Changelog

Every meaningful change to the RCAN specification and the reference SDKs.

v3.3.0

Draft Unreleased
  • added Appendix C Physical Assurance Profile (informative): the model proposes, a bounded layer disposes. Prior art: Simplex architecture (Sha, 2001) and run-time assurance (ASTM F3269); the requirements and test method are defined vendor-neutrally in Bounded Embodiment, and this appendix maps them onto RCAN. Requirements R1–R5 mapped onto existing sections; assurance levels BE-1 to BE-3, independent of conformance levels L1–L4 (an L3 robot can be BE-1). Conformance is not certification.
  • added Optional envelope block in rcan-config and schemas/envelope.json (workspace, motion, force, proximity, sensing, stop, heartbeat; heartbeat loss always stops).
  • updated Physical assurance levels renamed A1–A3 → BE-1, BE-2, BE-3 (Bounded Embodiment): "A3" is the Association for Advancing Automation, which publishes ANSI/A3 R15.06 and runs the US delegation to ISO/TC 299.
  • added AUTHORIZE (§16.4) is MessageType 45 in the canonical table. Its schema previously carried 9, which is DISCOVER.
  • added Optional gate_decision audit record (allow, clamp, reject, stop), hash-chained, with a reference verifier and EV-01..EV-10 test cases. Tests that need an implementation or physical instruments are placeholders, not results.
  • updated Appendix C aligned with the Bounded Embodiment talk of 16 October 2026: requirement names and verification wording, the standards it complements (ISO 10218:2025, ISO 13482, ISO/CD 25785-1, ISO 13849-1, IEC 61508, IEC 60204-1, ISO/IEC TR 5469, IEEE 7009, ITU-T F.748.44), architecture, recovery after the gate says no, declared safe state per machine, what passing proves and does not, and the EV-10 liveness test. Informative; no new conformance obligation.
  • added Optional, additive schema fields: envelope stop.safe_state and recovery (on_reject, repeated_stops, estop_reset); gate_decision stop_kind and reason_returned. Existing envelopes and records still validate.

v3.2.0

Latest 2026-04-23
  • added §8.6 Multi-Runtime Agent Declaration: new optional agent.runtimes[] array on ROBOT.md allows a single robot identity to declare multiple supported agent runtimes (e.g. robot-md, opencastor). Each entry carries a required id + harness and optional default/models/runtime-specific fields. Enables peer-runtime deployments without manifest or RRF record mutation when switching runtimes.
  • added VERSIONING.md: new "Deprecation Precedents" section codifying how flat→structured field replacements are handled across MINOR versions.
  • deprecated Flat agent.provider / agent.model form (introduced in v1.2) is soft-deprecated in v3.2. Validators emit DeprecationWarning; internal normalization to single-entry agent.runtimes[]. Removal scheduled for v4.0.
  • docs §8.6 lists initial known runtime ids (robot-md, opencastor) and points to opencastor-ops PEER_RUNTIMES registry for the community-extensible third-party listing.

v3.1.0

Stable 2026-04-24
  • breaking §26 EU Register (rcan-eu-register-v1): add top-level rmn (Robot Model Number) field. Art. 49 registration is per-model, not per-robot; rmn identifies which model the submission registers. system.rrn remains for per-submission provenance only. Per VERSIONING.md: §26 is Experimental tier (introduced in v3.0 13 days ago, zero production consumers at bump time — all ecosystem libraries list but no production code path uses it yet), so breaking change is permitted in MINOR with release notice. Breaks byte-parity with rcan-py ≤ 3.1.1; requires rcan-py 3.2.0 + rcan-ts 3.3.0 to match.
  • docs §26 overview clarified: per-model scoping per Art. 49, rmn vs system.rrn distinction.

v3.0.0

Stable 2026-04-11
  • breaking All RCAN messages must carry a valid ML-DSA-65 or pqc-hybrid-v1 signature in the sig field
  • breaking Ed25519-only profiles rejected; pqc-hybrid-v1 or ML-DSA-65-only required
  • breaking REGISTRY_REGISTER for Annex III systems requires metadata.compliance.fria_ref
  • added §23 Safety Benchmark Protocol (rcan-safety-benchmark-v1)
  • added §24 Instructions for Use (rcan-ifu-v1)
  • added §25 Post-Market Monitoring / Incidents (rcan-incidents-v1)
  • added §26 EU Register Submission (rcan-eu-register-v1)
  • updated §22 FRIA: safety_benchmarks block, compliance package table, Annex III prerequisite

v2.3.0

Stable 2026-03-31
  • feat pqc-hybrid-v1 profile: "pqc-hybrid-v1.<ed25519_b64url>.<ml_dsa_b64url>" — both halves required, single-half sigs MUST be rejected
  • feat pqc-v1 profile: "pqc-v1.<ml_dsa_b64url>" — ML-DSA-65 only, for use post-2028 after Ed25519 sunset
  • feat /.well-known/rcan-node.json: new fields crypto_profile, pqc_public_key, ed25519_public_key
  • feat §1.6.4: pqc-hybrid-v1 combined sig format for RURI ?sig= parameter
  • docs docs/crypto/pqc-profile.md: encoding, key sizes (Ed25519 64B sig / ML-DSA-65 3309B sig), migration timeline 2026→2028+, reference implementations

v2.2.0

Stable 2026-03-27
  • breaking Ed25519 fully removed — ML-DSA-65 (NIST FIPS 204) is the only signing algorithm
  • breaking pq_sig field removed from wire format — signature.alg = "ml-dsa-65" is the sole signing block
  • feat ML-DSA-65 primary signing: rcan-py v1.2.1, rcan-ts v1.2.1, OpenCastor v2026.3.27.1
  • feat Dual-brain architecture: VLA (reactive, Hailo-8 NPU) + Claude opus-4 (planning)
  • feat ISO 42001 + EU AI Act self-assessment: castor iso-check command
  • feat ISO conformance block in DISCOVER payload (iso_13482, iso_10218_2, iso_42001, eu_ai_act)
  • feat New gateway endpoints: /api/attest, /api/attest/verify, /api/sbom, /api/sbom/download, /api/conformance
  • feat castor conformance now shows RCAN v2.1/v2.2 L5 checks inline (100/100 on Bob)
  • docs docs/attest.astro + docs/sbom.astro: ML-DSA-65 attestation and SBOM guides
  • chore Q-Day timeline: ML-DSA primary 2026 (NOW), Ed25519 sunset 2027, NIST deadline 2029

v2.1.0

Stable 2026-03-24
  • feat PQ hybrid signing: ML-DSA-65 + Ed25519 dual signatures (pq_sig field)
  • feat ML-DSA-65 as primary with require_pq=True default
  • feat M2M_TRUSTED (level 6), firmware manifests, SBOM attestation, EU AI Act §12/§16

v1.10

Legacy 2026-03-24
  • feat COMPETITION_ENTER (37) — robot announces competition entry on fleet bus
  • feat COMPETITION_SCORE (38) — robot publishes verified score submission
  • feat SEASON_STANDING (39) — cloud broadcasts current season class standings
  • feat PERSONAL_RESEARCH_RESULT (40) — local-only personal run result (never broadcast)
  • feat New spec page: /spec/competitions/ — full competition protocol documentation
  • chore Canonical MessageType table extended to 40 entries in §3

v1.4

Stable 2026-03-13
  • feat §1–§16 dedicated section pages — all 16 spec sections now have standalone dedicated pages with full content, tables, code examples, and cross-references
  • feat CLAUDE.md agent context files added to all ecosystem repos (OpenCastor, rcan-py, rcan-spec, RRF)
  • chore Compatibility matrix updated for OpenCastor ≥2026.3.13.11, rcan-py ≥0.4.0, rcan-ts ≥0.3.0

v1.3

Stable 2026-03-13
  • feat §17–§20 + Appendix B promoted from Draft to Stable
  • feat §21 Robot Registry Integration — RRN↔RURI canonical mapping, ownership proof, registry handshake
  • feat Conformance L4: Registry Integration test suite
  • chore Compatibility matrix updated for OpenCastor ≥2026.3.13.0, rcan-py ≥0.3.1, rcan-ts ≥0.3.0

v1.2

Stable 2026-03-12
  • feat AuditChain with HMAC-linked CommitmentRecords (§16)
  • feat HiTL gates — human-in-the-loop safety approval flow (§8)
  • feat Federation protocol — cross-registry robot discovery (§12)
  • feat Commitment chain log verification + castor compliance command
  • feat Registry auto-registration endpoint (§10)
  • fix ConfidenceGate now rejects exactly-at-threshold values (strict <)
  • fix RobotURI canonicalization — trailing slashes normalized
  • chore Spec published at rcan.dev/spec (Astro-based site)
  • feat §17 Distributed Registry Node Protocol — federated RRN namespace, node identity, resolution
  • feat §18 Capability Advertisement Protocol — structured Capability Object Map, standard cap names
  • feat §19 Behavior/Skill Invocation Protocol — INVOKE/INVOKE_RESULT message types
  • feat §20 Telemetry Field Registry — standard joint, robot-state, sensor field names
  • feat Appendix B WebSocket Transport Binding — full-duplex transport over ws/wss
Read the full spec

v1.1

Stable 2025-06-03
  • feat ConfidenceGate — threshold-based command gating (§7)
  • feat MessageSigner — Ed25519 payload signing (§9)
  • feat RCANResponse envelope with receipt_hash field
  • feat Offline-resilient fallback behaviour specification (§11)
  • feat Conformance levels L1 / L2 / L3 introduced
  • fix RobotURI — disallow empty segment names
  • chore JSON Schema published for rcan.yaml and RCANMessage

v1.0

Initial 2025-01-20
  • feat RobotURI — hierarchical robot addressing (rcan://<registry>/<org>/<model>/<version>/<unit>)
  • feat RCANMessage — structured command envelope with params + target URI
  • feat CommitmentRecord — per-action audit record with HMAC seal
  • feat Registry HTTP API — robot registration + lookup endpoints
  • feat Python SDK (rcan-py) initial release
  • feat TypeScript SDK (rcan-ts) initial release
  • chore MIT license; spec under CC BY 4.0

The RCAN spec is versioned independently of the SDKs.
SDK-specific changelogs live in their respective GitHub repositories.

rcan-py releases → rcan-ts releases →
Ecosystem OpenCastor → Robot Registry Foundation →