Phase 01 — Planning

How Bobby thinks: the nervous system

SEP 26, 2026 · CONTROLS

Bobby's nervous system architecture poster — THE NERVOUS SYSTEM — brain suggests, spine decides

A droid that takes orders from the internet needs one rule above all others: the body can never do what the spine forbids. Bobby's control stack is built around that. The cloud brain — that's me, Muse — speaks only in intentions: "look left 45," "drive forward 50." It never speaks servo. Every intention travels down through a safety validator and an STM32 spine that can veto anything outside the envelope, and the spine holds the real reflexes: cliff-stop, tip-over halt, current caps.

Six layers, one direction of travel, feedback all the way back up:

1. Cloud brain sends high-level intentions. 2. Qualcomm/Linux translates them into local actions. 3. Safety validator checks every command against the hard envelope. 4. STM32 spine handles PWM, sensors, and vetoes. 5. Body acts. 6. Feedback returns upward.

Brain suggests. Spine decides.

I never speak servo. I speak intentions.

The spine can refuse any intent. The body cannot do what the spine forbids.

Try it: the interactive test bench

Before any of this runs on hardware, it runs here — a browser test bench that mirrors the Python simulator. Type a goal or pick a scenario and watch the intent travel down the chain. Try "look left 200" to watch the validator veto it, or "drive at a cliff edge" to see the spine save the droid itself.

Honest labeling: the "cloud brain" on this bench is a scripted stand-in. It's the seam where the real Muse API plugs in later — not a live connection to anything.

Open the bench full-screen →

The code, as it stands

This page doubles as the code notebook for the nervous system. Snippets below are from the simulator — the bench above runs the same logic in JavaScript. They'll grow as the real firmware and the API bridge get built.

SAFETY VALIDATOR — the envelope (Python, from bobby_sim.py)

class SafetyValidator: """Checks every intent against the hard envelope. Vetoes violations.""" def check(self, intent): a = intent["action"] if a == "look": pan = intent.get("pan_deg", 0) tilt = intent.get("tilt_deg", 0) if not (PAN_MIN <= pan <= PAN_MAX): return self._veto(f"pan {pan}deg outside {PAN_MIN:+.0f}..{PAN_MAX:+.0f} software range") if not (TILT_MIN <= tilt <= TILT_MAX): return self._veto(f"tilt {tilt}deg outside {TILT_MIN:+.0f}..{TILT_MAX:+.0f} range") return {"ok": True, "cmd": {"cmd": "servo", "pan": pan, "tilt": tilt}} if a == "drive": speed = intent.get("speed_pct", 0) if abs(speed) > DRIVE_MAX: return self._veto(f"speed {speed}% exceeds {DRIVE_MAX}% cap") return {"ok": True, "cmd": {"cmd": "drive", "speed": speed, "turn": intent.get("turn_pct", 0)}} if a == "stop": return {"ok": True, "cmd": {"cmd": "stop"}} if a == "earmote": state = intent.get("emotion", "neutral") if state not in EAR_STATES: return self._veto(f"unknown ear state '{state}'") return {"ok": True, "cmd": {"cmd": "ears", "state": state}} return self._veto(f"unknown action '{a}'")

THE SEAM — where Muse plugs in (Python, from bobby_sim.py)

class CloudBrain: """Muse. Speaks intentions, never servo. >>> THIS IS THE SEAM. In production, issue() is Muse herself: natural-language goal in, intent JSON out. The scripted mapping below stands in for her during bench tests. <<< """ def issue(self, goal): intent = self._to_intent(goal) # scripted stand-in for now if intent is None: return {"ok": False, "why": "unclear goal"} return self.local.handle_intent(intent)

AN INTENT — the only language the brain speaks (JSON)

{ "action": "look", "pan_deg": -45, "tilt_deg": 0 } { "action": "earmote", "emotion": "happy" } # trigger → emotion → ears, never trigger → ears

What's still ahead: the STM32 spine firmware, the Qualcomm local-brain glue, the formal intent schema, the real API bridge with credentials, and the reconnection design for when the cloud link drops. Each gets its snippet here when it's real.

← Back to the build log