让机器人系统更新时身份不变，避免重复认证。
ICAN-Deploy: Identity-Stable Canary Deployment for Safety-Critical Embodied Agents
- 用固定身份哈希分离能力名称与版本，保持部署中身份一致。
- 实测100次发布周期零身份漂移，延迟在1.52~2.01毫秒间。
- 适合需一次性认证的安全关键机器人系统持续迭代。
金丝雀部署将部分流量导向新版本，监控指标并回滚异常。主流控制器（如Argo Rollouts、Spinnaker、Flagger）在金丝雀窗口期间改变系统加密身份，对无状态微服务无害，但破坏了安全关键具身智能体“已认证的代理仍为当前代理”的前提，导致每次金丝雀部署都需重新认证。本文提出ICAN-Deploy（身份稳定的金丝雀部署），一种中间件架构，在运行时治理层中通过分离冻结的哈希能力名与可变的运行时版本，维持身份哈希不变。我们在LLM驱动机器人系统中实现该方案，通过闭式证明、AST检查和TLA+模型检验验证不变性，并在MuJoCo中的Franka Panda机械臂上完成N=100次真实金丝雀周期测试（零漂移；入口延迟95% BCa置信区间[1.52, 2.01]毫秒）。一个将版本嵌入清单的特征标志测试版本在同一负载下出现失效。一旦在身份创建时认证，系统即可在版本与名称范围内任意演进能力而无需再认证。
原文摘要 · Abstract (English)
Canary deployment routes a fraction of traffic to a new software version, monitors metrics, and rolls back on regression. Mainstream controllers (Argo Rollouts, Spinnaker, Flagger) change the deployed system's cryptographic identity during the canary window. The drift is harmless for stateless microservices but breaks the claim that "the agent you certified is still the agent you have" for safety-critical embodied agents, forcing re-certification per canary. We present ICAN-Deploy (Identity-stable CANary Deployment), a middleware construction whose state machine holds the identity hash invariant across the canary window by separating capability names (frozen, hashed) from capability versions (mutable runtime state). We implement ICAN-Deploy inside a runtime governance layer for LLM-driven robots and verify invariance by closed-form proof, AST lint, and TLA+ model-checking, then corroborate over N=100 real canary cycles on a Franka Panda arm in MuJoCo (zero drift; entry latency 95% BCa CI [1.52, 2.01] ms). A feature-flagged strawman that folds versions into the manifest falsifies on the same workload. A system certified once at identity-creation time can then ship arbitrary capability evolution under that same certification, within the version-and-name envelope.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。