A million humanoids a year are headed for factory floors, warehouses, and living rooms. The first serious incident will be decided by one question: what did the machine perceive, decide, and actuate — and when? The manufacturer's own telemetry is a document written by the defendant. Hive gives every machine an independent, signed, contemporaneous witness.
Sidecar to the control loop. Never in it.
AFiR-Stream anchors the session; each stage emits receipts asynchronously while the control loop runs untouched at full rate. When nothing goes wrong, the receipts are a compliance asset — verifiable offline against the Hive public key, same shape used across every vertical. When something does — press the red button.
The red button is not a kill switch — it is the evidence · export · escalate flow. It never touches the control loop.
The witness chain signs each hop. R3Pv™ teams those receipts into a single proof vector — verification depth, the honest recoverability window, and the permitted next actions in one object. Protected Flow is the action layer above it: one call turns a machine event into a signed decision — permit · permit_with_evidence · require_approval · hold · recover · reroute · escalate · block — plus a metered quote and an exportable evidence bundle. That is exactly what the red button fires.
A machine event assessed at the self_attested boundary honestly returns hold — the default pack requires relay_observed before it will permit, and once a physical incident is final the vector reports evidence_only_final: the receipt never over-claims that a finished action can be undone. Policy can only make a decision stricter. The meter is a quote, not a settlement. Both signed objects round-trip POST /v1/receipt/verify.
GET /v1/protected-flow/health and POST /v1/protected-flow/assess returned HTTP 200 (signed decision hold, meter quote 1.105); the assessment verified verified=true at /v1/receipt/verify, and /v1/protected-flow/evidence/{group_id}/export returned a 200 signed bundle. Observed round-trip 0.11–0.30s including network — measure receipt latency separately from control-loop or rail latency. Measured latency & runnable curl →
Home humanoids are trained and assisted by human teleoperators. That's fine — until nobody can prove when. Human-Origin Attestation stamps every session with who or what was in control, without exposing a single camera frame. Same primitive Hive uses to bind human-vs-agent origin across every AI-authored action. Flip it.
CLOAzK™ proves the behavior without exposing the home. Warden receipts the deletion. HiveSeal · Colony silicon roots ensure the receipt itself can be trusted.
Scroll — the checks land one by one.
Nobody writes coverage on a 10,000-unit humanoid fleet backed by self-kept logs. Set the fleet; watch the posture gauge move from "uninsurable narrative" to "provable machine." This dashboard is the conversation with the carrier.
Shipping thousands of units into other people's buildings. Every unit is a liability node until it can testify for itself. Provable-by-design becomes the spec line competitors don't have.
Warehouses and factories running mixed fleets they didn't build. When the incident review comes, "the vendor's logs say" is not a position. Independent receipts are the deployer's leverage over every vendor.
The de facto regulator of physical AI. Premiums price uncertainty; receipts remove it. A "provable machine" class of risk is a product a carrier can actually underwrite — and discount.
Shadow-receipt a single work cell or a ten-unit fleet. Zero changes to the control stack — the sidecar listens, anchors, signs. Ends with one Deployment Evidence Bundle: perception-to-actuation chains, teleop attestations, OTA lineage — every receipt verifiable offline against the Hive public key. The pilot's real product is the document your safety lead forwards.
The receipt shape that anchors a humanoid's control loop is the same one that anchors a sportsbook's intervention, a bank's dispute, or an AI agent's payment. One primitive set. Many verticals. All verifiable offline against the Hive public key.