The runtime.
A planner — learned, scripted or human — proposes. The floor decides what may execute. That boundary is the entire product, and it is one contract that has not changed across four domains.
The contract
pixels / telemetry → facts → ADMISSIBLE SET → objective → projection → memory → action
▲ │
└────────── a refusal, with its evidence ───┘
Only the leftmost stage is domain-specific. Swapping Atari pixels for CARLA vehicle state, Doom frames, case law or genomic variants changes the fact extractor and nothing else — and we can show that with a dependency edge rather than a diagram: freeway-floor imports invaders_floor.failure_memory unchanged.
The admissible set is the mechanism
Most safety layers sit after the planner and veto its output. This one sits before: the planner never sees the full action space, only what the floor has already declared admissible in the current state.
Post-hoc veto
The planner commits to an action, a checker rejects it, the planner tries again. Latency is unbounded, the planner can be steered into a corner, and the rejection carries no reason the planner can use.
Prior restriction
The option is gone before selection. One pass, bounded latency, and when the floor removes something it names the hazard it is answering and cites the events that earned the rule.
A rule that cannot name a hazard is refused at construction. A signature describing the absence of danger can correlate with death arbitrarily well and still be a superstition — refusing those is cheaper than explaining them away after an incident.
No model in the loop
The runtime holds no weights and makes no inference call. It runs on the platform, offline, with no network and no inference budget — so there is no vendor that can rate-limit, reprice or deprecate the layer your platform depends on, and no dependency that behaves differently next quarter.
Same state in, same decision out, every time. That is what makes the log in chapter 5 worth anything: a non-deterministic safety layer cannot be replayed, and a layer that cannot be replayed cannot be certified.
The executor is 303 lines of standard-library Python and downloadable →
Next
Chapter 2 — what we have actually measured, including where it fails →