Priver predicts the outcome of every interaction, then checks that prediction against live perception — on independent hardware — before a single actuator is allowed to fire.
Today's embodied agents commit to physical action on the strength of a world-model prediction — and verify it, if at all, inside the same process that produced it. Shared failure modes get rubber-stamped.
A neural world model spreads each prediction across millions of parameters. You can't inspect why it predicted an outcome, and you can't correct one error without risking every other prediction.
When the same process that made a prediction also checks it, a stale or mismatched view of the world confirms its own mistake. The check inherits the failure.
Between the moment a robot perceives and the moment it acts, the world moves. Acting on a prediction the environment no longer supports causes damage, injury, or irreversible change.
Priver pairs the breadth of a language-model-seeded world model with the fidelity of perception — and refuses to act until an independent structure confirms the prediction holds right now.
A language model writes the initial world model: object graphs, states, and interaction outcomes — broad coverage, no training data required.
Sensor data is extracted into a structured scene. Where reality diverges from a prediction, the result node is corrected and marked grounded.
The next event is read from an addressable result node — fast, low-power, offline-capable, and correctable one node at a time.
A separate circuit compares the prediction against live sensor data it receives over its own path. Contradiction = no authorization.
The actuator command reaches the motors only when authorization is affirmatively asserted. Otherwise it's withheld, and the miss is logged.
The gate sits in the command path between the planner and the motors. It runs on its own clock and its own power rail, so a crash, stall, or brown-out in the rest of the robot can't force a movement.
Try it → flip the live-perception state and watch the command get gated.
The same world model lets Priver reason about how risky an action is — and demand proportionally more proof before committing.
Every prediction is traceable to its origin — language-model guess or grounded observation — and the full history from one to the other is recorded for supervisory review.
An outcome that would push a value past a physical bound or break conservation is caught from its structure alone — before any action, even before the interaction is ever observed.
A single sensor glitch — an occlusion, a dropout — never rewrites a grounded model. Divergence must be confirmed across modalities before it's trusted.
Marginal confidence yields a slower, lighter, more reversible action — or a low-energy probe first. Irreversible actions face a higher bar before commitment.
Raw camera imagery never leaves a hardware-enforced privacy boundary. Only the abstracted structured scene crosses into the rest of the system.
When one robot grounds an interaction — a full container topples at the rim — that lesson propagates to the fleet, weighted by reliability, with no raw data shared.
The language model says "grasping and lifting raises the container." It doesn't know the container is full and gripped at the rim. Priver finds out the way it's designed to — once — then never repeats the mistake.
Initial result content predicts a RAISED pose. It doesn't depend on fill level — a gap in the model.
Live perception matches the predicted state, so the gate authorizes. The robot lifts — and the full container topples and empties.
A new rule is written: full + rim grip + high acceleration → TOPPLED. Marked observational origin, higher confidence.
The grounded lesson propagates to similar vessels and to other robots — none of which ever has to topple one to know.
Priver is built for manipulators, mobile robots, and autonomous platforms working in proximity to people, under safety-certification obligations, where a known error must be correctable without retraining.