EFA-1

An energy-based, certified, deterministic, multi-body control model — one body-embedding-conditioned trunk that controls a family of bodies from a single weights file. Swap the body embedding, control a different body.

Charlot Lab · Institute for Physical AI @ Bailey Military Institute. Runtime: Ferric (pure-Rust, cross-fabric: Metal / WebGPU / Vulkan / browser).

Identity — measured in what matters for machines that act

This card refuses tokens and parameter-count-as-capability. In a post-transformer control model those numbers carry no meaning; the identity axes are:

axis	EFA-1 (gated, round-trip-verified; exact numbers in config.json)
capability	reach% per body at K=1 forward pass (flagship run: 100% on all three bodies)
verification	the model's own potential ranks good actions below bad, per body (97–99%)
energy	~39 kFLOP per decision — vs a discrete Gᵈ planner's 7× / 31× / 140× more as DOF grows
safety	certified closed loop: exponential stability at every measured attractor (ρ(A)<1) + a contraction core (Lyapunov P-metric) + a funnel basin certificate covering 100% of grid nodes over the full physical domain per body (limits disclosed below)
agency	energy-gated tool ladder (K=1 → K=4 → planner tool → seeded ES, all deterministic): escalates on ≤0.2% of in-distribution decisions, 17× more on out-of-band goals — the model's own energy detects difficulty and prices the extra compute (78→161 kFLOP/decision)
determinism	same (state, goal) ⇒ same action, bit-for-bit; Ferric extends this cross-fabric (Metal ⇄ WebGPU)
generality	3 bodies per weights file (1-, 2-, 3-joint coupled chains), one learned embedding row each
footprint	~39k params ≈ 160 KB — stated as footprint, never as capability

Architecture

The coordinated energy family on one latent (the corrected 2026 recipe, end-to-end):

• Shared trunk inputs: a body-agnostic 12-wide joint encoding (4 features per joint: cos(θ−g), sin(θ−g), ω, sinθ; inactive joints zero) ⊕ a learned body embedding (one row per body).
• Flow head (actuation): 3-wide velocity field, masked to the body's DOF, integrated at K=1 — no iterative energy descent over actions (the recipe the field's own evidence retired), no BPTT.
• Potential head (verify): a scalar energy over (state, action, body) — low = valid; trained contrastively; this is the model checking its own actions.

Inference (from config.json): u = clamp(flow(feat, a=0, t=0, emb[body])[:dof]); verify any candidate action by potential(feat, a, emb[body]).

The agency loop (in config.json → agency)

The model's own energy decides when to think harder and when to reach for tools — every path seeded, the full ladder bit-exact deterministic (measured): L1 flow K=1 → if E>τ L2 flow K=4 → L3 planner tool (discrete argmin over the model's own potential) → L4 seeded evolution search; execute the argmin-E candidate. τ per body ships in the config (95th percentile of validation energy — calibrated from the artifact alone). Measured behavior: in-distribution the energy is content (≤0.2% escalation, cost ≈ the K=1 baseline); on goals outside the training band escalation rises 17× on the 3-DOF body and mean cost prices honestly (78→161 kFLOP/decision). Stated plainly: at this scale the tools bought no additional reach — K=1 already generalizes to 93–100% out-of-band — so the ladder's demonstrated value is calibrated difficulty detection and compute pricing, not rescue; the L4 genetic tool never fired at natural τ.

Lineage & honesty (read before using)

• Built by the EFA program's gated release pipeline: train → gate (every body reach ≥95% AND verify ≥90% AND bit-exact) → save → reload from disk → re-verify — only verified weights ship. Provenance: experiments/ebm_efa1.rs; the 69-experiment validation ledger (negatives included), the 2026 frontier check that corrected the recipe, and the EFA-1 spec with the verified mid-2026 positioning.
• Simulated bodies (coupled-pendulum-chain family, dynamics in config.json), reachable-goal sets, distilled from per-body fitted-value demonstrators, one gated seed. The claim is the architecture identity — multi-body-per-weights + energy-verified + deterministic + joules-metered — not manipulation breadth.
• Certificates — computed on this artifact's closed loop (exact numbers in config.json): every (body, goal) loop converges to a true fixed point (‖f(x*)−x*‖ ≤ 1e-8) within 0.05–0.32 rad of the goal — inside the card's 0.35 criterion; local exponential stability certified at every attractor (ρ(A) = 0.89 / 0.95 / 0.96 < 1); a contraction core in the Lyapunov metric of the closed-loop linearization (certified ball r = 0.76 / 0.42 / 0.64 in P-norm; 100% empirical convergence from inside). Basin certificate (funnel composition, LQR-tree-style): 100.0% of grid nodes over the FULL physical domain (θ on the whole circle × ω in the measured transient envelope) provably enter that contraction core — 1,353 / 74,529 / 456,533 nodes per body, median entry 34 / 62 / 66 steps, zero no-entries, worst sampled funnel expansion σ_P(Φ) = 117.5 / 18.1 / 59.3. Multi-goal: ALL 12 (body, goal) pairs — every card goal on every body — certify at 100.0% of the full physical domain (per-goal attractors and cores in certificates_multigoal; core radii 0.25–1.20, goal-dependent). Limits stated plainly: grid-sampled and node-local — no claim between nodes (the measure-zero separatrix lies there); not an interval/SMT proof. The continuum gap is quantified, not hand-waved: scalar orbit-tube bounds were computed and fail honestly (certificates_tube — the norms-product bound loses the directional cancellation that the measured funnel expansion σ_P(Φ) = 18–117 enjoys; full-coverage grids would need infeasible node counts). The rigorous continuum route is named: matrix/ellipsoidal tubes, then interval/CROWN bound propagation with branch-and-bound — neural-verification tooling, a real project. The recorded negatives that shaped the method: identity-metric contraction fails; a full-circle one-step metric field must fail (topological obstruction); cell-granular region-growth stalls when the core is smaller than a grid cell. The harness was validated first: the certifying reconstruction reproduces the shipped card 100/100/100 before any number was trusted. Provenance: experiments/ebm_efa1cert{,2,3,4,5}.rs, experiments/ebm_efa1tube.rs.
• Underactuated bodies remain a measured open boundary (ledger). EFA-2 targets a standard external body (MuJoCo / SO-101-LeRobot) so comparisons become externally reproducible.

Positioning (verified mid-2026, cited in the spec)

Each of EFA-1's identity axes is unclaimed at product level by the current comparables: the leading edge lab measures tok/s + memory (no joules); the nearest energy-based neighbor verifies beneath AI stacks but does not control bodies; no physical-AI product ships bit-reproducibility; no surviving comparable ships multi-body-per-weights control. They verify beneath the stack; EFA-1 controls the body.

License: Apache-2.0.