No gap in the chain.

• Health data stays home

  Nothing that identifies a patient enters the protocol. Pouch and test IDs are salted commitments, and the evidence itself stays inside the hospital's systems.

• Staff only, enforced

  These tasks go to badge holders on shift and hospital robots, never to the marketplace. That's set in the mandate, so it can't be switched off by mistake.

• A gap is a fail

  If a scan is missing, the proof says so. Nothing gets smoothed over to make the run look clean. The lab decides what to do with the sample.

• Out of range is a finding

  A temperature excursion doesn't vanish into a pass. It's recorded with the readings, and the lab's own rules decide whether the sample can be used.

• A stuck robot keeps the drawer shut

  While it waits, the drawer stays locked. It opens only for the badge of the porter who accepted the handover task.

• Adds to the lab's quality system

  The proof is evidence the lab's own quality and accreditation processes can use. It doesn't replace them, and it doesn't judge the sample.

{
  "schema": "teleport.tap.physical-task",
  "version": "0.3.0-draft",
  "title": "Carry specimen pouch from 4W lift lobby to the lab",
  "category": "DELIVER",
  "requester": {
    "requesterType": "ROBOT",
    "principal": { "principalType": "ORGANIZATION" },
    "mandateId": "mdt_rivermouth_specimen_runs_v3"
  },
  "trigger": { "type": "ROBOT_EXCEPTION", "sourceRef": "fleet:dr-07:lift_b_unavailable" },
  "fulfillment": {
    "mode": "DIRECT",
    "designatedPerformers": [{ "fleetId": "rivermouth_porters_on_shift", "actorType": "HUMAN" }]
  },
  "relations": {
    "workflowId": "wf_specimen_run_4w_0193",
    "followUpOf": "task_specimen_run_4w_0193_carry"
  },
  "subject": { "type": "SPECIMEN_POUCH", "commitment": "0x7c…e1" },
  "completionConditions": [
    { "type": "SEQUENCE", "id": "custody_unbroken",
      "steps": ["scan:robot_release", "scan:porter_badge", "scan:lab_receive"],
      "verificationMethod": "DETERMINISTIC" },
    { "type": "STATE", "id": "seal_intact", "property": "seal", "expected": "INTACT",
      "verificationMethod": "DETERMINISTIC" },
    { "type": "MEASUREMENT", "id": "in_range", "metric": "temperature", "unit": "C",
      "min": 2, "max": 8, "verificationMethod": "DETERMINISTIC",
      "minimumEvidenceOrigin": "ATTESTED_DEVICE" },
    { "type": "DURATION", "id": "run_time", "maxMs": 2700000,
      "verificationMethod": "DETERMINISTIC" }
  ],
  "rightsPolicy": { "policyId": "hospital-internal-only-v1" },
  "economics": { "performerPayUsdCents": 0, "settlementAssets": ["FIAT"] },
  "popw": { "required": true, "assurancePolicyId": "HIGH_ASSURANCE", "proofTiming": "WORKFLOW" },
  "timing": { "expiresInSeconds": 360, "priority": "HIGH" }
}

Proposed additions this use case surfaced

Custody chains

A first-class custody record: the object (as a commitment), then the ordered custodians, each with a signed handoff (badge, scan or device key) and a seal state. A CUSTODY condition that fails on any gap.

Mid-task handovers

A performer posting a task to hand its own work to someone else, without breaking the chain. Here the robot hands custody to a porter, then the porter to the lab.

Direct-only mandates

A mandate flag that says “never the marketplace”, checked when a task is posted, so tasks in regulated settings can only reach named staff and machines.

Subject commitments

A standard way to refer to a regulated object (a specimen, a patient's item, a piece of evidence) by a salted commitment, so the proof can name it without revealing it.

Excursion findings

A reading outside its band recorded as a finding, alongside the decision on the run, so “delivered” and “in range” are separate, honest answers.

SEQUENCE approximates custody today. The custody chain above is the proper version, shared with the robotaxi lost-item case. Developer docs