BPS Eye: Governance Interface for Amputee Exoskeletal Rehabilitation Apparatus

Guardian Framework. The apparatus utilizes hardware-enforced mechatronic determinism to ensure patient safety, relying on physical constraints, a silicon privacy wall, and strict human authorization interlocks rather than autonomous agentic AI. Clinical and sensor inputs remain strictly advisory, with the system incapable of independently generating actuator trajectories or self-escalating therapy intensity. Any safety violation, watchdog failure, or lack of authorization immediately triggers a fail-safe mechanical safe-hold, supported by immutable WORM forensic logging for auditability. The Bio-Psycho-Social (BPS) governance interface (commercially designated as BPS Eye) integrates qualitative clinical evaluations with hardware safety by acting as a strict, non-agentic admission gate. It ensures clinical oversight without allowing subjective narrative data to directly command physical movement.Key Integration Mechanisms Clinical/Mechatronic Domain Separation: Clinical assessments evaluating biological, psychological, and social factors are conducted entirely outside the actuator-control domain. Qualitative interview narratives and diagnostic judgments are structurally isolated from the mechatronic feedback loop to prevent software faults, probabilistic overrides, or autonomous diagnostic drift from causing physical movement. Bounded Finite State Conversion: The BPS Eye Verification Gate converts the clinical assessment into a binary, bounded finite state—VERIFIED or NOT VERIFIED. This state carries no joint angles, torque limits, velocity values, or gait trajectories; it functions purely as an admission prerequisite. Triple-Condition Kinetic Permission Conditioning: Before kinetic eligibility is granted, the Kinetic-Permission Conditioner requires concurrent validation of three distinct signals: BPS Verification State: Confirmation that the BPS prerequisite is satisfied (VERIFIED). Local Human Authorization: Concurrent authorization from both the wearer and caregiver within a hardware timing window. Local Hardware-Safety State: Verification of zero-velocity buffers, safe-start logic, and safety envelope integrity. Subordination to Local Mechatronic Safety: BPS verification is necessary but never sufficient by itself to produce physical movement. The governance layer provides session admission ("if" motion is permitted), but local actuator authority remains strictly controlled by the host exoskeleton's Hardware Commit Gate, Hardware Pre-Actuation Safety Fabric, and Hardware Safety Envelope. The BPS Eye is structurally incapable of commanding actuators or enlarging hardware safety limits. Deterministic Inhibit & Safe-Hold Triggering: If BPS verification is lost, withdrawn, or absent, kinetic eligibility is instantly revoked. During active operation, any loss of verification causes the host device to terminate its active kinetic lease and transition to a deterministic Safe-Hold state, engaging mechanical brakes.Isolated Evidentiary Logging: All verification, eligibility, and safe-hold transitions are logged to an append-only/WORM (Write-Once, Read-Many) event register.