Build robot swarms with
cryptographic trust
Traditional robot swarms have no standard identity layer — unverifiable commands, no audit trail, and catastrophic failure modes when one node is compromised. RCAN fixes this.
Traditional swarms are security nightmares
Without a standard identity layer, any robot in a swarm can impersonate another, inject commands, and leave no forensic trail.
No standard identity
Robots have no universally verifiable ID. Robot B has no way to prove it is who it claims to be to Robot A.
Unverifiable commands
When Robot A receives a "move to zone 7" command, it cannot verify whether that command came from a trusted peer or an attacker.
No audit trail
When a swarm makes a catastrophic decision, there is no cryptographic record of who authorized what, when, and with what confidence.
The RCAN Swarm Safety Stack
Four protocol layers give each swarm member a registered identity, an address it can be found at on the LAN, a tamper-evident record of its decisions, and identity lookup that keeps working from cache when the registry is unreachable.
Identity Layer
— RRN + Verification TiersEvery robot receives a globally unique Robot Registration Number (RRN) registered at robotregistryfoundation.org. Verification tiers (community → verified → certified → accredited) record who vouched for a record and with what evidence; none of them is a safety certification, and the registry does not review the evidence. Before accepting a command, a robot can call castor node resolve <rrn> to read a peer's tier.
Communication Layer
— RURI Addressing + mDNS DiscoveryRCAN Robot URIs provide globally unique, routable addresses for every robot. mDNS local discovery lets swarm members find each other on the LAN without an internet connection or central broker — the swarm self-assembles.
Accountability Layer
— §16 Commitment Chain + Thought LogEvery action in the swarm is sealed into a tamper-evident HMAC commitment chain. The §16 AI Accountability layer records which model made each decision, at what confidence, with what reasoning. A hash chain detects altered, inserted or reordered records; it cannot show records removed from the end unless its latest hash is anchored somewhere the writer cannot rewrite.
Federation Layer
— §17 Distributed RegistryNo single point of failure. The §17 distributed registry protocol allows federated resolution — robots resolve each other's identity from any node in the network. Stale cache means the swarm keeps working even if the central registry is temporarily unreachable.
How swarm verification works
Every cross-robot interaction follows these steps.
Robot B sends an RCAN message addressed to Robot A's RURI. The message contains Robot B's RRN as the sender identity.
Robot A calls castor node resolve RRN-BD-000000000042. The NodeClient queries the distributed registry (or stale cache if offline) and returns B's full record.
Robot A accepts commands only from peers its operator has pinned (RRN and public key) and checks the message signature against that key. The verification_tier in the resolved record is shown as context, never used to authorize: an owner can raise it to verified with any evidence URL, and the registry does not review it.
For safety-critical swarm commands, Robot A's HITL gate may require human approval before proceeding. The request is queued at POST /api/hitl/authorize.
Robot A's own ConfidenceGate ensures its AI model is sufficiently certain before acting. Actions below the threshold are blocked regardless of who sent them.
The executed action, sender identity, confidence score, model identity, and timestamp are sealed into the HMAC commitment chain. Tamper-evident.
from rcan import NodeClient, ConfidenceGate, CommitmentRecord
from rcan.audit import AuditChain
# ─────────────────────────────────────────────
# Step 1: Verify the peer robot's identity
# ─────────────────────────────────────────────
client = NodeClient()
peer_status = client.resolve("RRN-BD-000000000042")
# Authorize against peers this robot's operator pinned, never against the registry tier:
# an owner can raise verification_tier to verified with any evidence URL, and the registry does not review it.
TRUSTED_PEERS = {"RRN-BD-000000000042": "<peer public key, pinned by the operator>"}
peer_rrn = peer_status['record']['rrn']
if peer_rrn not in TRUSTED_PEERS:
raise SecurityError(f"Peer {peer_rrn} is not on this robot's trust list")
# ...and verify the message signature against TRUSTED_PEERS[peer_rrn] before acting.
tier = peer_status['record'].get('verification_tier', 'community') # context only
print(f"Peer on trust list: {peer_status['robot_name']} (registry tier: {tier})")
# ─────────────────────────────────────────────
# Step 2: Gate on our own model's confidence
# ─────────────────────────────────────────────
gate = ConfidenceGate(threshold=0.80)
my_confidence = 0.91 # from your AI model
if not gate.allows(my_confidence):
raise RuntimeError(f"Confidence too low to act on peer command: {my_confidence}")
# ─────────────────────────────────────────────
# Step 3: Execute and log to commitment chain
# ─────────────────────────────────────────────
chain = AuditChain(secret="your-chain-secret")
record = chain.append(CommitmentRecord(
action="move_to_waypoint",
robot_uri="rcan://registry.rcan.dev/acme/rover/v1/unit-007",
confidence=my_confidence,
model_identity="claude-sonnet-4-6",
params={"waypoint": "zone-7", "authorized_by": "RRN-BD-000000000042"},
safety_approved=True,
))
print(f"📝 Logged to chain: {record.content_hash[:16]}...")RCAN-Swarm Safe requirements
A robot can claim the RCAN-Swarm Safe designation when it meets all five criteria below. Run rcan-validate config myrobot.rcan.yaml to check.
This is a self-run configuration check. It is not a certification, and meeting it does not show that a robot is safe.
Valid RRN
RCAN config present with a registered, globally unique Robot Registration Number.
robotregistryfoundation.org/registry Verification tier ≥ verified
The robot's registry record is at least at the verified tier, set with an evidence URL on the owner's API key or the registry admin token. The registry does not review the evidence.
verification_tier: verified Commitment chain enabled
All actions are sealed into the HMAC-chained audit log. Tamper detection active.
security.commitment.enabled: true HITL gate for swarm commands
Safety-critical commands received from swarm peers require human approval before execution.
hitl_gates: [swarm_commands] Confidence gate ≥ 0.7
At least one confidence gate configured. The robot will not act on peer commands when its own model is uncertain.
confidence_gate.threshold: 0.7 rcan-validate all config.yaml
OpenCastor is the productized
RCAN-Swarm Safe runtime
OpenCastor ships with peer verification, commitment chain audit, HITL gates, confidence gates, and mDNS swarm discovery — all configured and ready to run. It is the fastest path to a RCAN-Swarm Safe robot.
castor node resolve <rrn> castor commit verify castor discover