A Skill Is Not a Capability: Hardware-Measured Robotic Capability Envelopes, Independent Safety Evaluation, and Capability Downgrade During Actuation

Abstract As robotic systems increasingly execute skills produced by AI planners, skill libraries, and agentic orchestrators, a structural gap opens between what a skill declares and what a specific robot, in its current physical condition, can actually and safely do. A skill description may specify payload, reach, rate, precision, force, and stopping behavior, yet none of these declarations proves that a given manipulator, with its present calibration, wear, thermal state, tooling, load, and environment, can meet them. Treating a machine-readable skill as if it were a physical capability, or treating capability evidence as if it were permission to move, creates a class of failure in which correct software produces unsafe or non-conforming physical motion. This disclosure describes a non-certified reference model, organized as a 48-stage common workflow across six phases, for translating declared robotic skills into physically measured, calibrated, and context-qualified capability envelopes, which are independently assessed for safety and temporal validity and continuously monitored for capability downgrade during actuation. The governing invariant is that evidence of skill eligibility never replaces a separately validated safety function or actuation authorization. Hardware attestation, measured performance, and safety certification are treated as three distinct forms of evidence that may not substitute for one another. Phase I (Skill Intent and Evidence Identity) receives the skill declaration, qualifies robot and component provenance, parses the declared capability vector, binds the task to its physical and hazard context, and resolves attestations without inferring physical proof from them. Unknown or unsupported requirements are classified explicitly, and the result is registered only as a non-actuating candidate. Phase II (Physical Translation and Calibration) acquires measured joint and Cartesian envelopes, verifies calibration provenance and scope, qualifies operating conditions, translates the skill into device commands across kinematics, units, and reference frames, and propagates measurement, estimator, transform, and drift uncertainty. Required and effective bounds are compared with confidence and coverage conditions, distinguishing false, unknown, and conditional compliance. The output is a version-qualified executable envelope that is expressly not authority in itself. Phase III (Independent Safety Evaluation) obtains the safety controller’s context, maps hazard constraints such as protective fields and speed, force, and space limits to the skill, checks safety-channel freshness, and evaluates interlocks, enabling devices, emergency stops, and protective stops. Where planner and safety controller disagree, an optimistic planner view cannot override the safety controller. Phase IV (Temporal Admission and Physical Execution) binds command generation to skill, device, effective envelope, target, and epoch; establishes a deadline contract spanning release, dispatch, application, and physical response; accounts for worst-case execution time, interference, priority inversion, and queue ceilings; and admits a command only when end-to-end demand fits the available budget under validated assumptions. Commands are applied solely through a separately authorized control path, and dispatch, acceptance, actuation, and observed effect are recorded as distinct events. Phase V (Runtime Monitoring and Downgrade) monitors the live capability envelope, detects invalidating changes such as calibration expiry, sensor failure, wear, tool swap, or drift, and recomputes the effective capability level using monotone restriction under safety-critical uncertainty. Remaining trajectory and task obligations are requalified against the new bounds, the independent safety controller is notified and remains decisive, and specified degrade or stop transitions are applied under validated stopping and energy models. Already-executed physical effects are reconciled rather than erased or presumed reversible. Phase VI (Skill Transfer and Final Outcome) governs reassignment of a skill to a different robot without reusing unverified robot-specific calibration, rechecks the target’s safety functions and timing guarantees, maps completed effects against residual work, and computes a scoped three-valued verdict (CONSISTENT, INCONSISTENT, UNRESOLVED), exporting a non-acting evidence report in which any next motion remains separately authorized. Every stage applies a conservative three-valued decision rule: all mandatory predicates true advances; any predicate proven false inhibits or raises an exception; any unknown predicate holds. The model further defines a five-lane control map separating the skill planner, capability verifier, independent safety controller, time-budget evaluator, and device-and-effect observer, together with a runtime state machine (DECLARED, MEASURED, QUALIFIED, EXECUTING, DEGRADED, HELD/STOPPING, RECONCILED). It states explicitly that downgrade does not guarantee instantaneous zero motion, since braking distance, residual kinetic energy, controller reaction time, and protective-stop category remain equipment-dependent. Six embodiments are traced to workflow stages: attested skill-capability declaration, calibration-sensitive authorization, independent safety-controller evaluation, deterministic command deadlines under congestion, multi-robot skill transfer, and device capability downgrade during actuation. This is a technical reference model, not a safety certificate. It does not establish compliance with industrial-robot safety standards, nor any Safety Integrity Level or Performance Level claim, and is intended to inform system architects, integrators, standards contributors, and regulators concerned with the boundary between AI-generated robotic intent and physically safe actuation. Keywords: robotic capability verification; skill-to-actuation translation; calibration provenance; independent safety controller; capability downgrade; temporal admission; WCET; three-valued decision logic; multi-robot skill transfer; cyber-physical AI governance; embodied AI safety; execution finality