Cereal OS v0.1: one mind, two bodies

In June we wrote that Cereal is building the portable AI mind for robots. Today there is a running version of that claim. v0.1 of the Cereal runtime exists as working code: the same mind, carrying the same memory, completing the same household task on two materially different robot bodies, in simulation.

What v0.1 does

A humanoid starts across the room, navigates into reach, and begins clearing a table. A grasp slips and is retried. An occluded object is not guessed at: the robot escalates to a human for approval. Then the mind (the world model, episodic memory, task graphs, and preferences, never joint angles or controller gains) is serialized and loaded onto a fixed single-arm robot. The arm finishes the same task from the inherited memory alone, with navigation scoped out automatically, because the embodiment contract knows a bolted-down arm cannot walk.

SESSION 1 · Unitree G1 humanoid · fresh mind · starts across the room
  - navigate   OK      (moves into reach)
  - grasp      attempt 1 failed: grasp slipped on mug_1 (right_hand); retrying
  - grasp      OK      attempts=2
  - place      human-in-the-loop: confirm-before-execute; approved
  - grasp      human-in-the-loop: escalated at confidence 0.35 (occluded); approved
=> completed [navigate, locate, grasp, place, locate, grasp, place]

TRANSFER · serialized mind: intent + world + memory + prefs; NO joint angles

SESSION 2 · Franka Panda arm · mind LOADED from the G1 · fixed at table
  - navigate   CONTRACT MISSING_CAPABILITY (scoped out)
=> completed [locate, grasp, place, locate, grasp, place]

ATTESTATION · events across 2 devices, signature chain verified: True

Honest failure, by design

This is not a happy-path demo. Reach is a real geometric check against each body's capability manifest, so out-of-reach targets are refused, not attempted. Grasps fail and retry a bounded number of times, then give up honestly. Consequential actions are safe by default: if no human approval channel is configured, the action is denied, not waved through.

And every action on both bodies is signed by the device that performed it, into one continuous chain that travels with the mind. Tampered records, forged keys, and unknown devices all fail verification. You can prove what a robot did, and on whose instruction.

In simulation, on purpose

v0.1 runs in simulation because that is where architecture is proven or broken. It is design conviction made testable: the embodiment contract, the portable-memory boundary, and the attested safety layer, exercised by a 40-test suite. It is presented as exactly that, not as physical traction. Next: the same stack on high-fidelity physics with our two reference bodies, then closed-loop on a real one. We publish as the work lands. This is the first landing.