General intelligence exists. Persistent embodied intelligence does not.
Cole, our deployed neural OS, already gives Cereal the reasoning, memory, and agent substrate, running in production today. The work is grounding that intelligence in persistent physical environments, executing safely through different bodies, and learning from every deployment.
Most teams build the mind. We give it a body.
Cole already perceives, remembers, runs modular skills, and acts under human supervision. Cereal drops in a mind that works today, and gives it the eyes, hands, and legs to act in the physical world.
The hard part of embodied AI is not the body alone. It is a mind that can be trusted to use one.
The mind became software. The body is still hardware welded to it.
Cole is form-factor agnostic, a neural OS that can reason over a chat, a checkout, or a pair of hands. But every robot still ships its mind fused to one skeleton. Move the brain to a new body and it goes blind: it doesn't know its joints, its reach, its grip, or what it must never do.
The bottleneck isn't the mind, and it isn't the hardware. It's the missing contract between them.
The mind should never have to learn the body.
Cole speaks intent, "go get a coke," not joints, poses, or how many arms are in play. The embodiment layer absorbs the morphology: reach, grasp, navigation, recovery. The same intent runs a humanoid, a mobile manipulator, or a partner's body.
Write the intelligence once; run it on any compliant body. Swap the robot underneath, and Cole never gets retrained.
Store the mind. Re-bind the muscle.
Memory transfers if, and only if, none of it is stored in body-specific terms. We never store trajectories or joint angles. We store semantic, world-anchored facts, and tasks as graphs of intent, keyed to your home and to you, never to a robot.
Switching robots should not mean re-teaching your life.
A new body loads the mind, re-localizes into the same map of your home, negotiates its own capabilities against the stored tasks, and resumes where the last one left off. The mind of your home persists across hardware generations, vendors, and morphologies.
The concrete version: an 88-year-old who misplaces his keys does not ask a robot. He asks the house: when did any part of the system last see them? The answer belongs to the home's mind, which every body contributes to and no single body owns.
Every ingredient exists. Nobody has fused them.
The robotics world has built each piece in isolation. What's missing is a single, agent-facing layer that lets any mind drive any body. The state of the art, early 2026.
A description, not a contract.
The modern scene format, from Pixar to Apple and NVIDIA. It models geometry, not live intent.
Plumbing, not a passport.
Powerful middleware, but per-robot integration, not a portable intent interface a foreign mind can call.
Sim and assets.
The substrate to build on, not the agent-facing intent layer itself.
The mind, not the contract.
Agents piloting robots may beat end-to-end policies. Either way, the body-to-mind boundary is still missing.
Secures the wire, not the meaning.
A signature and a secure channel, but no intent contract a mind can read to know what the body can do.
Factory assets, not agents.
Industrial fleet bookkeeping, not a real-time interface for a mind to take over a body.
The layer in between.
Intent flows down, the world flows up, and the body stays hidden from the mind.
Speaks intent. Never sees morphology. Authoritative for intent and confirmation.
Intent in, plan preview out, confirm before execute. Rich failure signals so Cole replans or asks a human.
Absorbs the body: grounding, planning, base navigation, grasp, recovery. Intent becomes motor commands.
An always-on, authoritative model of the space. Authoritative for state and feasibility.
Off-the-shelf or partner hardware. Swappable. The brain doesn't change when the body does.
At the heart of the stack is the embodiment contract: a robot advertises what it is, a skill declares what it needs, and the runtime negotiates the binding, or refuses safely.
# A body advertises what it is
manifest unitree_g1:
morphology: bipedal_humanoid end_effectors: [ two_finger_L, two_finger_R ]
reach_m: 0.72 payload_kg: 3.0 dof: 29
sensors: [ rgbd_head, force_wrist, imu ]
control_api: "vendor.locomotion.v2" # write intent, not raw motors
safety_envelope: { max_speed_mps: 0.9, forbidden_zones: [ stairs_unrailed ] }
# A skill declares what it needs, and how it verifies success
skill place(object, surface):
requires: [ grasp, reach ]
precond: holding(object) and known(surface)
postcond: on(object, surface) and not holding(object)
on_low_confidence: escalate_to_human
# The runtime negotiates the binding, or refuses
bind place -> unitree_g1 => OK (maps to arm_R, vendor.grasp)
bind place -> franka_panda => OK (fixed arm, navigation scoped out)
bind climb_ladder -> unitree_g1 => REFUSED (violates safety_envelope)Illustrative shape · v0.1 of the runtime negotiates and enforces this contract in simulation today
One interface. The same call drives any body.
Brain, eyes, hands, and the layer software never needed.
The persistent home-context graph.
Rooms and spatial relationships. Objects and where they belong. Routines and preferences. People, roles, and permissions. Prior tasks, corrections, and outcomes. Keyed to the household, never to a body.
Continuous environmental understanding.
People, objects, and activity. Deviations from the expected household state. Uncertainty it can recognize and act on. Verification that a task actually completed.
The embodiment contract.
A capability manifest per body, intent translated into that body's actions, and safe refusal when a body cannot do the job. Cereal does not build the actuation: the body's own control stack executes, and the contract decides what it may be asked to do.
The fourth component.
Software minds get three components. A physical mind needs a fourth: named permissions, an attested audit trail, human supervision and escalation, bounded actions, and versioned, reversible memory updates.
In software, a wrong action is an undo. In a home, trust has to be architecture.
The simulator isn't a training ground. It's the live world.
Real sim-to-real robotics runs the world loop as the always-on, authoritative model of the space, like a video game. Learned world models predict the outcome; the digital twin verifies the plan before the body moves; the physical robot executes against it. The game state is canonical; the hardware renders it into the world.
Continuous sim↔real sync.
State stays mirrored between the twin and the robot, in real time, forever.
It isn't in the prior.
The world loop doesn't generalize from a quick read. It's the hard problem most teams skip.
Founder-authored IP.
Our founders are named inventors on the sim-to-real patents, including US11938638B2: simulation-driven control of real robots.
We don't solve general autonomy. We make competence declared and bounded.
A reasoning agent composing verified, bounded skills, with a human on the uncertain edge, reaches everyday usefulness before any single end-to-end policy does.
Intent over a contract.
query_world / plan / execute exposes only known-feasible skills. 'Solve robotics' becomes 'orchestrate bounded primitives.'
Sim validates first.
Plans are checked and replayed against the authoritative twin before the body moves, so learning doesn't need a million real robots.
A human holds the edge.
Confirm-before-execute and a rich failure taxonomy turn the long tail into replan-or-ask, not silent failure.
What we're not claiming: general-purpose autonomy is not solved. Even APIVOT, a new Stanford-led planner designed for long-horizon geometric reasoning, reports 41.9% average task success in a simulated kitchen benchmark. That is exactly why bounded, verified, and supervised reaches a home first, and why we bet on the architecture that makes the solved part useful now.
Daily use becomes better robots.
Every routine interaction generates data, corrections, and trust. More trust returns more tasks: a moat that deepens with every interaction.
The durable asset is a continuously improving, permissioned model of how one particular environment works, and the verified history of how different bodies operated in it.
The humanoid stack is finally buildable.
NVIDIA Isaac, Cosmos & Jetson.
Open-source robotics models.
Cheaper actuators and sensors.
Local inference is practical.
Conversational AI feels natural.
Capital is flowing in.
Useful before fully autonomous.
Show up
Be in the room, where it matters.
Understand
See, hear, and read the environment.
Relate
Talk, advise, remember, check in.
Act
Take action under human guidance.
Compound
Each task makes the next easier to build.
Earn trust
Consistently meets the owner's expectations.
Start supervised. Earn autonomy.
Cereal begins with human-in-the-loop control and clear safety boundaries. Useful before fully autonomous. That is the trust model.
If no human approval channel is configured, a consequential action is denied, not waved through. Reach, payload, and forbidden zones are checked against the body's manifest before anything moves. A failed action retries a bounded number of times, then gives up honestly instead of pretending.
Every action and memory write is signed by the body that performed it, into one continuous chain that travels with the mind. Tampered records, forged keys, and unknown devices fail verification. You can prove what a robot did, and on whose instruction: exactly what a family, an insurer, and a regulator will ask. Our founders are named inventors on granted patents in secure interoperability and device attestation.
Eight questions a household gets to ask.
Adoption in the home is won on trust before it is won on capability. These are answered in the product, where a family can see them, not in a policy document.
Who can see through its cameras?
No one, by default. Perception runs in configured spaces; a human sees through them only inside an escalation, scoped to the task and logged.
What does it remember?
What the household approves. Memory writes are gated, versioned, and reversible.
Who controls that memory?
The household: inspectable, editable, deletable, and portable across bodies.
What leaves the home?
De-identified patterns only. Raw home data stays home.
Who can ask it to act?
Named people with named permissions. Consequential actions require approval.
How is it audited?
Every action and memory write lands in an attested, tamper-evident trail.
When do humans step in?
Escalation-only: when a task trips its envelope, on request, and on anything consequential. Never a free look around the home.
What can it never do?
Act outside its safety envelope: reach, speed, force, and forbidden zones enforced per body.
What the mind knows about this home. Inspect, edit, or delete any of it.
Every action, signed by the body that performed it. Verifiable by the household.
Trust is a feature you can inspect.