I build the reliability layer for learned robot systems.

M.S. Robotics Engineering @ Wayne State University · Runtime safety for learned policies · Sim-to-real on quadrupeds

Learned policies fail quietly. A locomotion network saturates, a perception model stops perceiving, a simulator's counterfactual stops being faithful, and nothing in the stack raises its hand. Most of what I build is the layer that notices: fault detection and recovery on a live robot, deploy-time parity gates, out-of-distribution monitoring on policy internals, and acceptance evidence you can re-verify a year later.

I work across the stack: C++ control loops, Python perception and RL, ROS 2 architecture, embedded firmware, CAD, and the GUIs on top. Most of it runs on a Unitree GO2. Every repo below states what has actually run on hardware and what has not, because that distinction is the whole job.

A self-healing runtime for ROS 2 robots, built as a four-tier loop. Sense: lifecycle nodes emit structured FaultEvents from a rolling Z-score detector, a heartbeat monitor, and a log parser. Diagnose: deterministic rules turn faults into RecoveryHints. Recover: a single cmd_vel publisher behind a strict allowlist and cooldown. Explain: an advisory local LLM that is never on the safety-critical path. Hot-path sensing nodes are being ported from Python to C++ so HELIX can share a Jetson with Nav2 and perception instead of competing with them.

Validated on a live Unitree GO2 and Jetson Orin NX across eight hardware lab sessions. The Session 8 bag runs the loop end to end: 30 anomalies into 14 recovery hints into 14 recovery actions.

Open limitation: /helix/cmd_vel currently has no downstream subscribers, so STOP_AND_HOLD is a void publish. Closing the recovery loop physically, through a twist_mux fallback, is the next hardware task.

ROS 2 Humble C++17 Lifecycle Nodes Jetson Orin NX Unitree GO2 Local LLM

Closed-loop sim-to-real learning for the GO2. A locomotion policy trains in Isaac Lab, exports to ONNX through a torch/onnxruntime parity gate that refuses to ship a checkpoint whose deploy-time numerics drift outside tolerance, then runs behind a fail-closed ROS 2 safety layer with a shared slew cap. Failures captured on hardware replay in simulation under randomized physics and feed a fine-tuning curriculum. The deploy stack has run end to end on the real robot, on the Jetson.

Where it stands: on-robot locomotion validation (Gate 7) is open. An export audit found pre-audit checkpoints silently dropped observation normalization, so every checkpoint owes a re-export and a fresh parity check before the retry. The adaptation loop has not yet closed once on real failure data. EVIDENCE.md is the verified / inferred / not-validated ledger.

Isaac Lab PPO ONNX ROS 2 Sim-to-Real Unitree GO2

Offline acceptance and evidence for simulator experiments. You declare what "unchanged behavior" means in a YAML file (which signals, which tolerances and units, which controls must hold, what the minimum sample is). IVF checks the experiment was even valid before letting any result decide a verdict, then seals the manifest, signals, reasoning, provenance, and per-file SHA-256 digests into one auditable bundle.

The flagship case is a real PhysX versus Newton/MJWarp cart-pole comparison whose recorded verdict is FAIL, with 22 validity checks (18 pass, 3 unverifiable, 1 not applicable, 0 failed). Anyone can re-verify the shipped bundle from its seal, CPU only, with no GPU and no simulator install. IVF is not a benchmark: it does not measure throughput and does not designate a reference engine.

Python Isaac Lab PhysX Newton / MJWarp SHA-256 provenance CLI

A distribution-shift teardown of the neural network that drives openpilot, an L2 driver-assistance system deployed on public roads. One question: presented with input outside its training distribution, does it fail conspicuously or silently?

Silently. The study rests on a parity-controlled reimplementation of v0.9.7 inference that agrees with comma's own reference output on 100% of 1159 real frames within ±0.5 m/s², so the negative result is attributable to the model and not the harness. Under shift, 8 of 10 tracked output readouts go near-constant, the recurrent state contracts to a point, and the exported uncertainty heads never leave their nominal real-driving range. An internal recurrent signal does encode the failure and is recoverable, but the model never exposes it. Writeup drafted, not submitted.

ONNX Runtime CARLA OOD Detection Recurrent State openpilot

A guide dog has to be summonable. If the handler puts the harness down, sits on a bench, and then wants the dog back, the dog finds them by voice, not by an app or a joystick. This repository closes the recall half of that interaction on real hardware: a four-channel mic array gives a GCC-PHAT bearing, Whisper parses the command, YOLOv8 plus depth back-projection gives 3D person poses, and a fused audio-visual score must hold across five consecutive frames before the target locks and publishes a Nav2 goal.

Scope, stated plainly: this recalls the robot, it does not guide the user anywhere. Safety alerts are advisory and do not hard-gate motion. 32 unit tests pass, and nothing here has a measured accuracy or latency result on the real robot yet. End-to-end recall on hardware is the open item.

ROS 2 Humble GCC-PHAT Whisper ASR YOLOv8 RealSense D435i Nav2 C++ Lifecycle Node

A connected body of work turning a stock quadruped into something that learns, navigates, and recovers on its own.

The layer that tells you when your robot is about to do something stupid and catches it on the way down.

Two projects exist because the idea did not survive contact with measurement. Both stay public with their full evidence trail, because the measurement is the contribution.

Where I started, and still the most satisfying when it physically moves.

yusuf.a.guenena@gmail.com