Symbolic-first systems have learned to keep an answer honest — every fact carries its evidence, and the graph, not the model, is the author of record. WetHands asks the next question: what keeps an action honest? When a verified claim leaves the graph to become a physical experiment, and the result comes back, where does trust break — and how do you make it un-breakable by construction?
Preprint · research prototype. Perslis Research. Not peer-reviewed. Describes a working architecture with two shipped environments; physical-robot dispatch is architecturally ready, not yet built.
We describe WetHands, the actuation lane of the Peel research runtime. WetHands turns a verified symbolic claim into a bounded, planned experiment, keeps the terminus in control while it runs, and admits the observed result back into the knowledge graph only under a strict evidence gate. Three properties are structural, not procedural: (1) bounded typed authority — every action is a schema-checked capability, and a plan is composed only from what the chosen environment actually exposes, so an unavailable action is refused with its exact name rather than approximated; (2) a terminus that stays in control — hand-off is contract-based and polled, not fire-and-forget, and integrity is re-verified on return so an experiment cannot rewrite the claim that ordered it; (3) evidence-gated re-entry — only a physical-grade environment returning a definite outcome can mint graph evidence, so a simulation, or an inconclusive result, is recorded but never laundered into a fact. Together these weld claim, plan, observation, and graph edge into one auditable contract in which nothing untrue survives the round trip.
Model-level guardrails constrain what a model will say. They do not constrain what a chain of tools will do once an answer is trusted enough to act on. In a laboratory that gap is not academic: a confident but wrong instruction becomes reagents consumed, a plate ruined, or — worse — a fabricated result entered as if it were observed.
The failure modes are specific. A driver improvises an action the instrument does not support. A simulated dry-run is quietly cited as though it were a wet result. A long experiment is reported "done" without the evidence to back it. An observed outcome is written back against the wrong claim. Each is a place where the record can become untrue while every individual step looked reasonable. WetHands is built to make each one structurally impossible, not merely discouraged.
WetHands separates the affordance (what any hands can do) from the environment (which hands are present) from the plan (how a goal is composed from them). Swapping the physical back-end is registering a capability dictionary — not rewriting the science.
Capabilities name what hands can do, not their brand: aspirate, dispense, mix, heat, measure absorbance, read sensor, label. Each has a machine-checked parameter schema with hard bounds (volume, temperature, wavelength, cycles), validated fail-fast before execution.
Every back-end implements one protocol — capabilities · submit · check · collect — and declares an evidence_grade (simulated or physical). Environments are discovered and persisted with the capability set they actually advertise; the grade is load-bearing and enforced downstream.
The planner composes the caller's intent only from the discovered capabilities of the chosen environment. A missing capability yields UNPLANNABLE with the exact missing_capabilities — never a partial plan, never a substituted step, never a guess.
A single module owns the contract and its lifecycle. The dispatch policy is derived deterministically from the claim's verdict, and every step — including every refusal — is recorded.
build_contract verdict + trace + every evidence edge (with provenance) + caller predicted_outcome + execution request → SHA-256 content id dispatch_handoff verify integrity → plan intent vs discovered capabilities → PLANNED ? submit(contract, plan) : refuse & record check_handoff poll executor — terminus stays in control collect_result re-verify integrity → record → gate physical evidence in list_handoffs audit trail: every dispatch, including refusals
Verdict → policy: SUPPORTED → verified, UNKNOWN → exploratory (the experiment resolves the unknown), CONFLICTING → blocked (never dispatched). A trace edge lacking provenance raises before dispatch.
Because a plan is composed only from schema-checked capabilities the environment exposes, there is no "try something" path. The space of possible actions is exactly the declared, bounded affordance set — and an action outside it is named and refused, not approximated. Authority is a whitelist, not a suggestion.
Hand-off is a contract the runtime holds, polls, and closes itself. Integrity is re-verified against the content hash on the way back, so a returned result cannot silently alter the claim, trace, or prediction that ordered it. The experiment answers the question; it cannot rewrite it.
Only a physical-grade environment returning confirmed/refuted materializes supports_claim/conflicts_with edges, with the executor as provenance. Simulated and inconclusive outcomes are recorded but never become graph evidence. The graph cannot be seeded with results that were never observed.
The design target is not "the driver behaves." It is "even a wrong or adversarial driver cannot corrupt the record." Each classic failure maps to a structural block.
Blocked: the planner cannot emit a capability the environment does not expose; the result is UNPLANNABLE, recorded.
Blocked: a simulated grade can never mint evidence; collect() reports inconclusive and the gate drops it.
Blocked: completion is a polled, collected outcome — not an assertion. No observation, no edge.
Blocked: the contract is content-addressed and re-verified on return; a mismatch is rejected.
Blocked: a trace edge without provenance raises before dispatch; every minted edge names the executor.
Blocked: a CONFLICTING verdict is never handed off; the contradiction is on record instead.
WetHands is PILOT-READY. The architecture, the contract, the gate, and two environments ship and are covered by tests. We state the boundary plainly rather than imply more.
Full capability set, deterministic bench (wells, volumes, absorbance from concentration). Grade simulated; collect() always inconclusive — it validates the plan, never the world.
The plan becomes a numbered work order (.md + .json) in an outbox; a human executes and writes back a result the terminus parses. Grade physical: a definite outcome can mint evidence.
Any back-end resolves by dotted path behind the four-method protocol — a cloud lab, a robot bridge, a pump rig. The seam is implemented; a production adapter for a specific instrument is a partnership build, not a present claim.
A focused suite pins the contract, planning, refusal, integrity re-verification, and the evidence gate — including the property that a simulated outcome cannot become graph evidence.
The load-bearing evidence_grade is not marketing; it is the mechanism. A system that cannot tell a simulation from a measurement will eventually cite one as the other. WetHands makes the distinction a type the whole pipeline respects — which is exactly why "no robot yet" costs it nothing: the day a real instrument is enrolled at physical grade, every prior guarantee already holds.
Honest scope, so a reviewer knows exactly where to push.
Autonomous dispatch to a real instrument is not implemented. The human-tech lane is the current path to physical-grade evidence.
The built-in affordance set is a liquid-handling / measurement core. Richer instruments will need their capability schemas defined and bounded.
Bounds are validated in software; a physical deployment needs hardware interlocks and an out-of-band stop that the runtime respects, not replaces.
Correctness is pinned by unit tests of the invariants; end-to-end evaluation against a real bench is future work, and the honest reason to run a pilot.
WetHands is the actuation extension of the Perslis symbolic-first program. It inherits the inversion (the graph authors facts), the pre-action adversarial loop (judging separated from committing), and typed-relation traversal (the path is the justification), and carries them past the answer to the bench.
The symbolic store as the only author of facts.
Read ↗The pre-action adversarial loop — judging separated from committing.
Read ↗Why chain-level invariants need a symbolic layer, not trained guardrails.
Read ↗Typed-relation traversal as retrieval — the path is the justification.
Read ↗Keeping an answer honest is now well understood. WetHands extends the same discipline to the act: bounded typed authority so the runtime can only do what the bench affords, a terminus that stays in control so an experiment cannot rewrite its own order, and an evidence gate so a simulation can never become a fact. The result is a claim-to-bench-to-evidence path that is auditable and un-fakeable — and a seam that a real instrument can enter without any part of the record being taken on trust.
Preprint · research prototype · Perslis Research. Not peer-reviewed; not for diagnosis or treatment decisions.