S61 · DUM-E / Hugh - physical operations and house custody

Declared state: built 2026-10-17 - the interlock is first and pure: an E-Stop reachable from every state, ceilings enforced AT THE INTERLOCK even against a valid authorisation, process identity protected inside the kill branch, and no software path that can clear a trip. The house is read as a fifth source in the existing sitrep through the one existing HA client. Printer, CUPS, glasses and workshop thermals remain deferred for want of the hardware.

This is the repository plan and evidence, not a live health reading. A task marked done may still depend on credentials, devices, deployment or a newer acceptance test.

Dependencies

S58, S52, S28, D-13

Tasks and gates

61.F1 · Hardware safety FSM: idle -> armed -> active -> emergency_stop, with trip_estop legal from ANY state. Pure - no hardware, no network.

Tier F · done · Verification: hermetic-test

Gate: - `test_dume_interlock.py` - E-Stop is reachable from every state, which is the whole property; a state machine that can only be stopped from one state cannot be relied on in an emergency.

  • hermetic-green · 2026-10-17 · bench/test_dume_interlock.py

61.F2 · Declared ceilings (thermal, current) are checked by the interlock before any actuation is permitted.

Tier F · done · Verification: hermetic-test

Gate: - `test_dume_interlock.py` - a request above the ceiling is refused BY THE INTERLOCK, not only by the policy layer above it (D-100).

  • hermetic-green · 2026-10-17 · bench/test_dume_interlock.py

61.F3 · Protected-PROCESS rule for termination, extending system.py's protected paths to process identity.

Tier F · done · Verification: hermetic-test

Gate: - `test_dume_interlock.py` - PID <= 1 and the security agents are never killable by any caller, including the fleet itself.

  • hermetic-green · 2026-10-17 · bench/test_dume_interlock.py

61.F4 · HA actuation routed through the S58 policy against the owner's real entities, confirm-gated for climate, water heater and covers.

Tier F · done · Verification: hermetic-test

Gate: - `test_dume_interlock.py` + `test_blast_radius_refusal.py` - doors stay refused per D-13; S28's built-and-dark state ends here, because the token now exists.

  • hermetic-green · 2026-10-17 · bench/test_dume_interlock.py

61.F5 · One typed read of the live house, reusing S56's sitrep rather than inventing a second telemetry shape.

Tier F · done · Verification: hermetic-test

Gate: - `test_dume_interlock.py` - the house is read one way only.

  • hermetic-green · 2026-10-17 · bench/test_dume_interlock.py

61.R1 · A tripped E-Stop blocks EVERY actuation until a physical reset, and no AI path clears it.

Tier R · done · Verification: hermetic-test

Gate: - `test_dume_interlock.py` - asserted in the negative as well: clearing is not reachable from any caller, policy layer or prompt.

  • hermetic-green · 2026-10-17 · bench/test_dume_interlock.py

61.R2 · Every physical action has a decision line in the existing audit trail, attributed to the actor.

Tier R · done · Verification: hermetic-test

Gate: - `test_dume_interlock.py` - `audit.py` already carries actor and decision; this task makes sure a physical action is one of the rows that lands there.

  • hermetic-green · 2026-10-17 · bench/test_dume_interlock.py

61.R3 · The FSM is exercised against a simulated device layer with no Home Assistant and no network.

Tier R · done · Verification: hermetic-test

Gate: - `test_dume_interlock.py` - the safety gate must be testable on a host with no house attached, or it will only ever be tested by accident.

  • hermetic-green · 2026-10-17 · bench/test_dume_interlock.py

61.F6 · Moonraker/Klipper 3D printing with M112 as an emergency stop.

Tier F · deferred · Verification: planned-test

Gate: new `test_dume_interlock.py` - new `test_dume_interlock.py` - deferred; no 3D printer on this host (owner-confirmed 2026-10-17), so the interface has never been run and a driver for absent hardware is a statement of intent, not a route

  • owner-decision · 2026-10-17 · owner request 2026-10-17, grounded in docs/FLEET-PLAN.md (fleet brief for U, E.D.I.T.H., DUM-E, FRIDAY)

61.F7 · CUPS/IPP paper printing.

Tier F · deferred · Verification: planned-test

Gate: new `test_dume_interlock.py` - new `test_dume_interlock.py` - deferred; no CUPS daemon on this host, and it is a POSIX spooler on a Windows machine (owner-confirmed 2026-10-17)

  • owner-decision · 2026-10-17 · owner request 2026-10-17, grounded in docs/FLEET-PLAN.md (fleet brief for U, E.D.I.T.H., DUM-E, FRIDAY)

61.F8 · Mentra OS glasses over ADB/BLE.

Tier F · deferred · Verification: planned-test

Gate: new `test_dume_interlock.py` - new `test_dume_interlock.py` - deferred; no device paired (owner-confirmed 2026-10-17); no paired device, no measured transport, no driver

  • owner-decision · 2026-10-17 · owner request 2026-10-17, grounded in docs/FLEET-PLAN.md (fleet brief for U, E.D.I.T.H., DUM-E, FRIDAY)

61.F9 · Workshop thermal tripwires.

Tier F · deferred · Verification: planned-test

Gate: new `test_dume_interlock.py` - new `test_dume_interlock.py` - deferred; depends on 61.F6, which is itself deferred for want of a printer - an interlock for a heat source that does not exist has nothing to guard

  • owner-decision · 2026-10-17 · owner request 2026-10-17, grounded in docs/FLEET-PLAN.md (fleet brief for U, E.D.I.T.H., DUM-E, FRIDAY)

HUD screen contracts

All subsystems · Source: docs/systems-plan.json.