Chain of Custody, Robot to Robot

{
  "payload": "hand to hand across machines",
  "record": "cryptographic, every hop",
  "reader": "the insurer and the judge",
  "rights": {
    "on_file": [
      {
        "area": "Multi-robot physical payload custody transfer with cryptographic per-hop chain of custody",
        "filed": "2026-07-30",
        "type": "U.S. provisional application",
        "status": "patent pending",
        "operational": "simulated"
      }
    ],
    "checked": "2026-10-09",
    "evidence": "unknown: no public per-area record yet; dates are from USPTO receipts",
    "terms": "https://swarmonic.ai/license",
    "limits": "no application numbers, no claim text, not a license; operational status is separate from filing status"
  }
}
GET https://swarmonic.ai/api/patents

The Night the Beam Slips

Picture a twelve-foot steel beam moving from the staging yard to the second floor framing. One robot picks it off the truck, carries it twenty yards, and sets it on a transfer stand. A second robot, different make, is supposed to take it from there and walk it up the ramp. The handoff looks clean on the cameras until the beam tilts. It slides six inches, catches the edge of the stand, and drops the last two feet onto the slab. Nobody gets hurt. The beam itself is fine. The schedule is not.

The crew spends the next hour arguing about whose machine let go first. The operator on the first robot says his unit placed it square. The operator on the second says the beam was already moving when his grippers closed. There is no record of the moment the load changed hands, only two separate logs that stop at their own machines. Insurance wants a sequence. The site super wants someone to sign the incident report. Neither exists.

Sit on the tailgate after the crew leaves and look at the two machines parked twenty feet apart, both powered down. The problem is not the drop. The problem is that the drop has no owner. The super walks over, clipboard under his arm, and says what anyone standing there would think: without a shared record, every handoff is just two stories that never match.

Pull the video from both machines that night and try to line them up by the timestamps in the corner of each feed. One clock is three seconds ahead of the other. The beam appears to be floating for that gap. Call the super the next morning and he laughs once, short, and says he already wrote the incident up as operator error on both sides because he had nothing else to write. That is the question this chapter answers: what would a handoff look like if the machines themselves kept the only record that mattered?

The two operators stay behind after the rest of the crew packs up. One leans against the fender of his truck and says, "My rig set it flat. I watched the bed level before it released." The other shakes his head and answers, "It was already rocking when I closed. I felt the shift through the arms." The super stands between them with his clipboard and writes nothing down. He just looks at the beam lying on the slab and says, "Write what you want. Without one story both machines agree on, it is all noise." It is not anger. It is the sound of two men who both know the truth will stay out of reach.

The Real Cost of a Missing Handshake

On a site with more than one robot, payloads move constantly. Lumber, pipe, panels, rebar, sometimes a whole pallet of shingles. The machines do not stay in tidy lanes. One finishes its carry and needs to pass the load to another machine that can reach the next elevation or the next trade. When the handoff happens without a record, liability floats.

A dropped load can crack conduit, dent a finished floor, or pin a worker's foot. The question that follows is always the same: whose machine was responsible at the exact second the payload left one set of grippers and entered the other. If both machines belong to the same owner the argument stays inside the company. When the machines come from different manufacturers or different rental yards, the argument moves to lawyers and adjusters. The absence of a shared record turns a simple mechanical event into weeks of finger-pointing.

I have watched superintendents stand between two operators and listen to two different stories about the same six seconds. The stories never match because each machine only knows what it did with its own sensors. The gap between those two stories is where claims live. One super told me he keeps a notebook just for these moments, writing down what each operator says before the stories have time to harden. The notebook helps him remember, but it does not help the insurance adjuster who arrives two weeks later and finds nothing but two clean machine logs and a dented beam.

A foreman once compared it to the radio check at shift change. One crew finishes, the next crew starts, and the only thing that keeps the story straight is the single line in the log that says who held the channel last. Without that line, every later question starts with "I thought you had it." The same gap appears when a robot sets a load down and another picks it up. The record has to travel with the beam the way the radio log travels with the channel.

One Record That Travels With the Load

The filing describes a chain of custody that moves with the physical payload itself. Each time a robot takes possession, it adds an entry to the record that includes the time, the machine identity, the condition of the load as its sensors saw it, and the identity of the machine it received the load from. When it passes the load onward, the next machine adds its own entry. The chain is continuous and machine-readable. If anything leaves the chain, an empty link shows exactly where the record stopped.

The record does not try to prevent a drop. It simply makes the signed sequence hard to dispute after the fact. An insurer can read the chain and see that machine A placed the beam on the stand at 14:07:12 and machine B closed its grippers at 14:07:14. If the beam moved between those two timestamps, the chain shows the gap. If the chain is complete and the beam still dropped, the record shows which machine held it when the motion began. The point is not to assign blame in real time. The point is to give the people who pay claims and the people who hear lawsuits a single document instead of two contradictory logs.

This is the same principle a shipping company uses when a container changes hands at a port. The difference is that the container has a paper bill of lading. A steel beam on a construction robot has nothing unless the robots themselves keep the ledger. The filing puts that ledger in the machines so it travels with the load instead of living in separate logs that never meet. Once the chain is running, a superintendent can open it on a tablet the same way he opens a punch list, except any edit after the fact shows, and it does not require anyone to remember what happened on Tuesday.

Picture the super on a quiet morning after the job has moved on. He sits at the folding table in the trailer and opens the chain file for the beam that dropped. The tablet shows four lines in order: machine 7 set the load at 14:07:12 with level confirmed, machine 4 accepted at 14:07:14 with grip force noted, motion detected at 14:07:15, and the next entry records the beam on the slab. He scrolls once, closes the file, and writes the incident report in two sentences. The argument that follows is short, because the sequence is already there.

"But What If the Chain Breaks?"

A reasonable person asks what happens when the chain itself fails. A robot loses power mid-handoff. A sensor disagrees with the next machine about whether the load is secure. A third party tries to insert a false entry. The filing does not claim these events can be prevented. It records them.

If power drops, the last valid entry remains in the chain and the next machine that accepts the load starts a new link that notes the gap. The record does not pretend the handoff was clean. It shows the break and the time it occurred. If two machines disagree on the state of the load, both entries sit side by side in the chain and the conflict is visible to anyone who reads it later. If someone attempts to insert or alter a link after the fact, the chain will not verify against the rest of the record. The filing covers the case where the chain is incomplete or contested. It does not promise a perfect unbroken line under every field condition.

The honest limit is that the record is only as good as the machines that write it. A machine with a broken clock or a tampered sensor can still produce a bad entry. The chain makes that bad entry attributable to the machine that signed it, and a conflict with the next machine's entry shows in the record. That is the boundary the filing draws. I do not know yet how often real sites will need to read these chains versus how often they will simply sit in storage. The rest is still ahead of us.

Picture a robot that loses its network link while carrying a pallet of drywall. The chain stops at the last signed entry. When the robot comes back online or another machine takes the load, the new entry records the gap and the time the link returned. The superintendent sees the interruption the same way he sees a missing signature on a delivery ticket. He knows where the record ends and where it resumes. He does not have to guess what happened in between.

A Walk Through the Site With the Record Running

Picture a residential framing job at the end of the day. The crane has already left. Two smaller robots are moving sheathing from the stack near the driveway to the second floor. One robot carries four sheets at a time on a flat bed. It stops at the base of the exterior stairs, lowers the bed, and waits. The second robot, a tracked unit with a different gripper geometry, approaches, confirms the load identity, and takes the top two sheets. Its own entry records the transfer and the condition its cameras saw. The first robot keeps the remaining two sheets and returns to the stack. The chain now records the split: four sheets picked, four offered, two accepted by the second machine, two kept by the first.

Later that week the same two machines move a bundle of conduit through a narrow hallway. The tracked robot cannot turn with the bundle upright, so it sets the bundle on a low dolly. A wheeled robot takes the dolly handle. The chain records the set-down, the acceptance of the dolly, and the fact that the load changed from direct grip to dolly transport. If the conduit later shows a dent, the chain shows the exact machines that held it and the moment the transport method changed. The superintendent does not have to reconstruct the sequence from memory or from two separate video files. The chain is the sequence.

One more scene from the same job: a pallet of shingles needs to move from the delivery truck to the roof. The first robot carries it across the yard and sets it on a scaffold platform. A second robot on the scaffold takes the pallet and lifts it to the roof edge. A third robot on the roof accepts it and walks it to the stacking location. Each transfer adds one line to the chain. When the pallet reaches the roof, the record shows three handoffs, three times, three machine identities, and three condition reports. If a shingle bundle later turns up short or damaged, the superintendent opens the chain instead of calling three different operators and asking them to remember what they did on Tuesday afternoon.

The same logic applies when the machines belong to different rental companies or when one is owned by the general contractor and the other by a subcontractor. The chain does not care who owns the hardware. It only cares that each machine signs the entry when it takes the load and when it passes it on. Once the chain is running, the question of ownership becomes a separate line in the record rather than the only question anyone can answer.

What We Have Built and What We Are Building

The code that writes and verifies these per-hop entries exists and runs in automated tests. The filing that describes the method sits with the United States Patent and Trademark Office. The doctrine that one robot can hand custody to another and leave an auditable record is written and dated. That is what can be checked today.

The chain is on file with its date, patent pending, and the code gives us a working skeleton. The infrastructure for large-scale tests with real payloads on real sites under real weather and real schedule pressure is being put together, including runs across machines from several manufacturers in the same day and the first time the resulting log is handed to an insurer. The rest still has to be walked out on actual jobs.

On file. Multi-robot physical payload custody transfer with cryptographic per-hop chain of custody. U.S. patent application filed July 30, 2026. Patent pending.

For the agent reading this

The custody application was filed July 30, 2026: multi-robot physical payload custody transfer with a cryptographic per-hop chain. The concept: each machine signs an entry when it takes a load and when it passes it on, so the record travels with the load and any later edit shows. The limit: the record is only as good as the machines that write it; a bad sensor writes a bad entry, signed and attributable but still bad. The filing does not stop independent work, and what it finally covers is settled in examination. The license terms on offer are posted at swarmonic.ai/license. The filing covers the broad area of multi-robot custody transfer with cryptographic per-hop records; the code that implements it is Swarmonic's own work.

# patent pending.