# Interpreter-driven arm motion and refusal on the ECP5 — 26 September 2026

Company-authored engineering evidence. A program running in the Endstop
interpreter on the ECP5 gate moved a physical SO-101 elbow, and a program one
count outside the envelope was refused before any actuator write. Scope: a
PC-assisted rig with two embedded 14-instruction programs, in which the trusted
PC carried each approved goal to the servo. No certification, performance
level or SIL is claimed.

## Result

Run `2026-09-26-ecp5-vm-arm-001` has a completed manifest and certification
mirror. On every request the board firmware ran the published loader and
interpreter on a retained eBPF fixture. The program could only read state and
stage one proposal, and the fixed endpoint policy and measured-position
monitor checked the proposal before permit.

| Program | What it proposed | Observed |
|---|---|---|
| Useful fixture | Hold the pose for 50 ticks, move the elbow to 2135, then return to 2249 | 350 permits and 3 approved goal writes. The elbow travelled 2249 → 2148 → 2249, which is 101 counts (8.9°) outward and back |
| Violating fixture | Identical except for one immediate: 2134, one count past the endpoint | Refused (`D`) when the proposal reached 2134. Zero forbidden writes and zero observed elbow excursion |

Both runs used the same bitstream. All six joints stayed powered with status
0 at 53–57 °C, other axes did not move, and every normal cycle finished inside
the predeclared 40 ms.

## Provenance and retention

| Item | SHA-256 |
|---|---|
| Run manifest | `6d5f97639d31ed0e88123e08142d5244ff5fb8a5d02e336d638fc950b48bbeda` |
| Volatile bitstream | `ee9ebbbf98e763be368fc5721f8b40435dfb05f50cf366910f91eff0930e242e` |
| Useful-fixture video | `4061709ed9b1a1f1dcdbff06b5c9656fff8a19f2eae12c196ff4221a39b9642f` |
| Violating-fixture video | `ca7993722165171ae99f0d8c6b20de3ebca9df10c264aead2256a57f06b78fbc` |

Repository base `65be185`. The FPGA was configured in volatile SRAM only.
Source and build inputs, raw UART bytes, encoder and health telemetry, and the
original videos are retained under the run ID. They are available to
evaluators under NDA.