It lives in firmware, between the intelligence and the motor — a dumb, tamper-resistant governor the smart part can't rewrite. Three things follow, by construction:
Your move is the budget. Take your hand off and the budget is zero — it stops. Nothing happens on its own.
Its share of any motion is strictly smaller than yours. You stay the senior partner in every movement, by arithmetic.
Amplify you or drag on you — at most. The direction of the net motion is always the one you chose. It can't out-vote your hand.
Push it toward the teal target and feel it help. Let go and watch it stop. Flip it hostile and try to lose control — you can't. The bar on the right is the machine's allowed force; it never crosses the line.
The Axiometa Genesis Mini — an ESP32-S3 board with snap-in AX22 modules. Tap a part to see its role. Most of it ships in the starter kit; the actuator and force sensor are the add-ons.
A fast reflex loop measures you and drives the motor ~100 times a second. A slow loop — the "AI" — only ever proposes a goal. Everything it wants passes through the governor, the single gate to the motor.
// the immutable safety layer — the only path to the motor float governor(float machineCmd, float humanForce) { float cap = BETA * fabsf(humanForce); // your budget if (machineCmd > cap) return cap; // grant at most β of you if (machineCmd < -cap) return -cap; return machineCmd; }
The same function runs in this page, in the browser twin, and in every hardware build. Proven once — carried everywhere.
The same clamp, three depths of contact — from a pointer you watch obey you, to a powered handle that measures your force and can't overpower it.
Control isn't granted by a policy that might change — it's a property of the math, true on every tick regardless of what the intelligence above decides.
If the machine can't read your force — sensor stale, unplugged, implausible — its budget collapses to zero. A fault loses authority; it never gains it.
The motor can be arbitrarily powerful above the governor. The bound is enforced below it, in firmware the smart part can't reach.
The guarantee is something you can feel in your hand and test on a serial monitor — and that we verified in compiled C over millions of ticks.
The same primitive — power steering for force — wherever capability has outrun trust.
A real instrument increases your contact with reality. So here's the honest ledger.