Paper deep dive
Toward Evidence-Driven Human-Agent-Robot Teaming for Earth-Independent Anomaly Triage
Ignacio G Lopez-Francos, Alexis Gallagher, Samira Shalal
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 95%
Last extracted: 10/8/2026, 6:31:45 AM
Summary
The paper presents an evidence-driven architecture for human-agent-robot teaming designed for Earth-independent anomaly triage in deep-space missions. The system uses an agentic AI orchestrator to coordinate crew interactions and mobile robot inspections to gather discriminating evidence, maintaining a closed evidence loop with explicit state management and authority boundaries. The architecture is validated through a hardware-in-the-loop prototype using Reachy Mini and Innate MARS robots, demonstrated via scenarios involving an ISS ammonia leak and a lunar base power interface fault.
Entities (10)
Relation Signals (9)
Evidence-Driven Architecture → appliedto → ISS Ammonia Leak
confidence 95% · a crewed deep-space mission based on an actual ISS ammonia false alarm
Evidence-Driven Architecture → appliedto → Lunar Base Power-Interface Anomaly
confidence 95% · a power-interface anomaly at a crewed lunar base
Innate MARS → communicatesvia → ROS2
confidence 95% · Innate MARS through a ROS2 robot-tasking service
Evidence-Driven Architecture → demonstratedwith → Innate MARS
confidence 95% · exercised in a hardware-in-the-loop integration prototype using ... an Innate MARS mobile robot
Evidence-Driven Architecture → demonstratedwith → Reachy Mini
confidence 95% · exercised in a hardware-in-the-loop integration prototype using Reachy Mini
Agentic Orchestrator → implementedusing → OpenClaw
confidence 95% · An OpenClaw-based orchestrator routes high-level workflow messages
Agentic Orchestrator → runson → NVIDIA DGX Spark
confidence 95% · We implemented the Section II architecture on an NVIDIA DGX Spark
Evidence-Driven Architecture → uses → Triage State Manager
confidence 95% · A triage state manager maintains hypotheses, evidence provenance, uncertainty, operational context, and tool status
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Deep-space crews cannot rely on real-time ground support for urgent off-nominal events. Initial alerts may underdetermine cause, while discriminating evidence may reside in crew observations or at locations that are unsafe, costly, or unavailable for crew inspection. We present an evidence-driven architecture for human-agent-robot teaming in Earth-independent anomaly triage. Agentic AI is treated as a stateful coordinator over bounded, inspectable services rather than as a fully autonomous vehicle controller. A triage state manager maintains hypotheses, evidence provenance, uncertainty, operational context, and tool status; a crew-facing embodied agent elicits observations and explains assessment changes; and a mobile robot acquires targeted, localized evidence. Typed interfaces separate dialogue and orchestration from monitoring, robot command, context retrieval, and safety-critical control. Two scenarios illustrate the architecture: a crewed deep-space mission based on an actual ISS ammonia false alarm, where suspected contamination restricts crew access, and a power-interface anomaly at a crewed lunar base, where robotic inspection distinguishes a local connector fault from other causes ambiguous in remote telemetry. Our main contribution is an authority-bounded closed evidence-loop architecture, exercised in a hardware-in-the-loop integration prototype using Reachy Mini and an Innate MARS mobile robot.
Tags
Links
- Source: https://arxiv.org/abs/2610.08933v1
- Canonical: https://arxiv.org/abs/2610.08933v1
Trouble viewing inline? Open PDF directly →
Full Text
21,878 characters extracted from source content.
Expand or collapse full text
Toward Evidence-Driven Human-Agent-Robot Teaming for Earth-Independent Anomaly Triage Ignacio G. Lopez-Francos 1,2,3 , Samira Shalal 1,4 , and Alexis Gallagher 5 Abstract— Deep-space crews cannot rely on real-time ground support for urgent off-nominal events. Initial alerts may un- derdetermine cause, while discriminating evidence may reside in crew observations or at locations that are unsafe, costly, or unavailable for crew inspection. We present an evidence- driven architecture for human-agent-robot teaming in Earth- independent anomaly triage. Agentic AI is treated as a coor- dinator over explicit state and bounded, inspectable services rather than as a fully autonomous vehicle controller. A triage state manager maintains hypotheses, evidence provenance, un- certainty, operational context, and tool status; a crew-facing embodied agent elicits observations and explains assessment changes; and a mobile robot acquires targeted, localized ev- idence. Typed interfaces separate dialogue and orchestration from monitoring, robot command, context retrieval, and safety- critical control. Two scenarios illustrate the architecture: a crewed deep-space mission based on an actual ISS ammonia false alarm, where suspected contamination restricts crew access, and a power-interface anomaly at a crewed lunar base, where robotic inspection distinguishes a local connec- tor fault from other causes ambiguous in remote telemetry. Our contribution is an authority-bounded closed evidence-loop architecture, exercised in a hardware-in-the-loop integration prototype using Reachy Mini and an Innate MARS mobile robot. I. INTRODUCTION As human missions extend beyond low-Earth orbit, crews will increasingly conduct time-critical operations without real-time Mission Control support. Mars missions can experi- ence one-way communication delays of up to 22 minutes and extended disruptions, precluding synchronous troubleshoot- ing [1], [2]. Earth-independent operations therefore require onboard support for time-critical anomaly response, not merely onboard copies of ground displays [3]. An initial alert may indicate a serious condition without resolving its cause or safest response. The next step may therefore be a targeted observation from vehicle telemetry, the crew, a deployable sensor, or a mobile robot rather than an immediate repair attempt. Treating the robot as a relocatable sensing resource follows active perception, in which sensing actions are selected to reduce uncertainty [4], and extends targeted off-world fault investigation [7] by closing the loop from an unresolved distinction to robot tasking, structured evidence return, hypothesis revision, and crew review. 1 NASA Ames Research Center, Moffett Field, CA, USA 2 SETI Institute, Mountain View, CA, USA 3 The University of Texas at Austin, Austin, TX, USA 4 University of Michigan, Ann Arbor, MI, USA 5 Repertory Robotics, San Francisco, CA, USA Tool-using language agents can interleave reasoning and external action [5] and ground instructions in finite robot skill sets [6], but safety-critical operations require explicit state, provenance, tool preconditions, and authority boundaries. We ask: How can an onboard agent coordinate crew and robot sensing to reduce diagnostic uncertainty while keeping evidence traceable and the crew in control? We contribute (1) an architecture linking anomaly events, crew interaction, robot inspection, hypothesis refinement, and crew-authorized action; (2) a bounded tool-use pattern separating information gathering from operational action; and (3) two scenarios showing the same evidence loop in a Mars-transit spacecraft and a lunar surface habitat. Here, triage denotes decision sup- port under unresolved uncertainty, not autonomous anomaly detection or emergency management. I. EVIDENCE-DRIVEN AGENTIC ARCHITECTURE A. Operational Scope and Explicit State The architecture continuously receives structured events from caution-and-warning systems, conventional fault de- tection, isolation, and recovery (FDIR), anomaly detectors, and crew reports. An off-nominal event initiates triage; independently designed automated safing may act in parallel when delay is unacceptable. The architecture then supports situation assessment and early response, when additional evidence can distinguish plausible causes and guide the next safe action. Here, agentic denotes high-level coordina- tion among finite, evidence-acquisition, context-retrieval, and communication capabilities exposed through typed interfaces and governed by explicit authority constraints, rather than unconstrained direct control of vehicle behavior. The triage state manager owns a time-indexed record containing the initiating event, ranked hypotheses and uncer- tainty, evidence, operational context, robot and task status, applicable procedure context, and an append-only decision trace. Each evidence item records its source, modality, time, location, quality, provenance, and underlying artifact. Miss- ing evidence, failed acquisition, and a measured-negative result remain distinct; dialogue history is not authoritative vehicle state. B. Fixed Roles and Typed Interfaces The architecture follows a hub-and-spoke workflow. A central agentic orchestrator receives structured anomaly notifications, manages dialogue through the crew-facing em- bodied agent, queries triage state, and routes typed requests and results among bounded services. It may sequence can- didate evidence-acquisition actions and explanations, but it arXiv:2610.08933v1 [cs.RO] 6 Oct 2026 does not own authoritative state, assign diagnostic confi- dence, validate its own authority, execute critical actions, or issue low-level robot commands. Event and monitoring ser- vices emit structured anomaly events and immutable observa- tions. The triage state manager owns the authoritative state, admits validated evidence, checks freshness and conflict, and enforces state transitions. The crew-facing embodied agent renders alerts and questions, confirms crew reports by readback, and explains assessment changes. Diagnostic, evidence, context/procedure, perception, and robot-tasking services expose bounded functions through typed interfaces. A mobile inspection robot receives a typed task contract specifying the target, sensing objective, permitted modalities, completion and stop conditions, and timeout, then returns status, localized observations, and quality flags. An author- ity and safety layer validates schemas, permissions, opera- tional constraints, and confirmation requirements for every request. During crewed operations, consequential actions require crew authorization; during uncrewed periods, only pre-authorized, reversible actions within verified constraints may execute automatically. Delayed ground may review the trace and provide advisory analysis when communications permit. C. Closed Evidence Loop and Authority Boundaries When an event arrives, the orchestrator asks the state manager to instantiate or retrieve the corresponding state and requests an initial diagnostic update. From the unre- solved distinctions, it proposes a bounded evidence action: a crew question, data or context request, or robot inspection. The authority layer validates the request and obtains any required confirmation. The selected service executes it, the evidence service checks the result for schema, provenance, freshness, and quality, and the state manager admits it to the authoritative record. A diagnostic service revises the hypothesis ranking, and the crew-facing interface explains the supporting evidence, remaining uncertainty, and response options. The crew may accept, modify, decline, or defer; the trace remains available to delayed ground. The architecture distinguishes epistemic actions, which gather information, from operational actions, which alter vehicle configuration or commit the crew to a consequential response. The orchestrator selects epistemic actions only from a bounded catalog with typed preconditions and out- puts. Operational actions use a deterministic execution path and require crew authorization except for pre-approved saf- ing. Capability access therefore does not confer operational authority, and the orchestrator cannot declare resolution with- out an appropriate validated measurement and operational approval. I. ILLUSTRATIVE USE CASES A. Suspected Ammonia Leak During Mars Transit This scenario uses an actual ISS event to examine how a similar anomaly could be handled aboard a crewed vehicle in transit to Mars, where communication delay prevents real- time support from Mission Control. On January 14, 2015, the ISS annunciated TOXIC ATMOSPHERE Node 2 LTL IFHX NH3 Leak Detected, indicating possible ammonia ingress through the Node 2 Low Temperature Loop Interface Heat Exchanger (IFHX). Software inhibited ventilation, and the crew isolated in the Russian Segment. Because expected confirming cues were absent, controllers traced the alarm to an erroneous Node 2-2 multiplexer/demultiplexer (MDM) indication. Power-cycling the unit cleared the anomaly, and atmosphere measurements detected no ammonia [8], [9]. We use the event only as an operational anchor, and the adaptation does not reproduce an official procedure. 1) Alarm and safing. A toxic-atmosphere indication re- ports possible ammonia ingress through an IFHX in a crew module. Pre-approved logic isolates the affected ventilation paths. Through the crew-facing interface, the orchestrator informs the crew: “Possible ammonia ingress detected. Ventilation has been isolated. Move to the designated safe area and confirm when all crew are clear.” 2) Crew evidence. After the crew confirms its location and isolation status, the orchestrator asks whether any- one observed irritation, haze, droplets, unusual noise, or abnormal equipment behavior before leaving. The original responses and their structured interpretation are recorded as evidence without requiring crew re- entry. 3) Preliminary assessment. The diagnostic service ranks three hypotheses: genuine ammonia ingress through the IFHX, an erroneous sensing or data-handling in- dication, and another thermal-control anomaly. The absence of crew-observed cues weakens, but does not eliminate, the genuine-leak hypothesis. Because its consequence remains severe, isolation stays in effect. 4) Robot inspection. The diagnostic service requests a localized environmental evidence to further discrim- inate the hypothesis. After authority validation, the orchestrator dispatches a bounded task to an intrave- hicular free-flyer stationed in the isolated module. The task specifies the IFHX region, requested measure- ments, success and failure conditions, and timeout. An RGB camera, thermal imager, and payload-mounted NH 3 /air-quality sensor collect time- and location- tagged evidence. 5) Hypothesis update. The robot reports no NH 3 de- tection and no visible or thermal abnormality, while separately retrieved diagnostics show an inconsistent state in the local MDM or data-handling unit. The diagnostic service consequently ranks an erroneous instrumentation indication as the leading hypothesis. The orchestrator explains which observations produced the change while emphasizing that a measured negative at the inspection location does not establish cabin safety. 6) Crew-authorized verification. The procedure service retrieves a validated MDM power-cycle sequence. Af- ter explicit crew authorization, a deterministic execu- Fig. 1. Human–Agent–Robot architecture and proof-of-concept components. The Agentic Orchestrator coordinates the crew interface and mobile inspection robot with authoritative triage state and bounded services, while system-governed checks and crew authorization constrain operational actions. tion path performs the reset and monitoring confirms that the anomalous telemetry has cleared. The orches- trator reports that the evidence supports an instru- mentation fault but does not declare the module safe; recovery requires an independent cabin-atmosphere measurement and crew confirmation. B. Lunar Surface Power-Interface Anomaly NASA’s Phase Three Moon Base concept envisions sus- tained human presence supported by habitats, power and communications infrastructure, logistics, and surface robotic assets [10], [11]. Because power is shared across habitation, mobility, science, and in situ resource utilization (ISRU), local interface faults are operationally important and may be difficult to distinguish using remote telemetry alone. 1) Detection and context. A surface power manager reports unstable voltage or current and abnormal inter- face temperature. The interface communicates the af- fected node and safing state, then obtains recent context such as connector mating, power switching, robotic work, cable deployment, or regolith disturbance. 2) Initial assessment. The diagnostic service ranks a source- or load-side fault, a connector or contact fault, and cable damage or mechanical displacement. 3) Robot inspection. After authority validation, an avail- able surface robot receives a bounded task to collect close-range RGB and thermal imagery of the connec- tor and adjacent cable, with validated local electrical measurements when available. 4) Evidence update and response. A partially seated, regolith-contaminated connector with localized heating and a nominal adjacent cable makes an interface fault the leading hypothesis. The state manager records the update, and the interface presents bounded options: isolate the node, reroute the load, execute approved robotic remediation, or schedule crew servicing. Dur- ing uncrewed operation, only pre-authorized reversible actions may execute. 5) Verification. Power telemetry and robot reinspection determine whether transfer has stabilized and tem- perature is decreasing. Otherwise, the node remains isolated and the evidence loop continues. IV. PROOF-OF-CONCEPT IMPLEMENTATION AND DEMONSTRATION We implemented the Section I architecture on an NVIDIA DGX Spark for the Section I-A ammonia scenario. An OpenClaw-based orchestrator routes high-level workflow messages among Reachy Mini as the crew-facing interface, an authoritative triage state manager and bounded back- end services, and Innate MARS through a ROS2 robot- tasking service [12], [13]. Local models provide dialogue and tool use (Gemma-4-26B-A4B-it), speech recognition and synthesis (Parakeet-TDT-0.6B-v2, Kokoro-82M), and visual interpretation (Qwen3-VL-8B-Instruct). Inter-component coordination uses structured state and typed messages; free-form language is exposed only at the crew interface. A. Implemented System The orchestrator manages dialogue, proposes capability calls, and generates evidence-grounded explanations, while deterministic services own state, compute hypothesis rank- ings, validate requests, retrieve procedures, and execute con- sequential actions. Reachy provides speech, alerts, readback, and explanation. MARS autonomously navigates to a mock IFHX/rack target and returns physical imagery together with a simulated NH 3 reading. The flight scenario assumes an intravehicular free-flyer; MARS serves as a morphology- independent surrogate for exercising the same task, status, and evidence interfaces, not for validating free-flight mobil- ity. Source images remain primary evidence, while schema- constrained visual interpretations are stored as derived ob- servations with model and artifact metadata. B. End-to-End Demonstration 1) Trigger and initial assessment. Synthetic space- craft telemetry generates an AnomalyEvent contain- ing the affected subsystem, triggering measurements, severity, timestamp, and vehicle state. The orchestrator routes it to the diagnostic service, which ranks a gen- uine ammonia release, an erroneous instrumentation indication, and a non-toxic thermal-control transient. The resulting HypothesisState is stored by the triage state manager. 2) Crew interaction. Through Reachy Mini, the orches- trator alerts the crew, confirms isolation, and explains that the alarm remains diagnostically ambiguous. It then requests observations such as irritation, haze, droplets, or unusual equipment behavior. Local speech processing captures the response, and both the origi- nal utterance and structured CrewObservation are stored with provenance. The diagnostic service updates the ranking but retains the release hypothesis because the crew observations alone cannot clear the hazard. 3) Evidence-driven inspection. The diagnostic service identifies a localized environmental observation as the next discriminator, while action validation re- jects direct crew entry. The orchestrator issues a bounded InspectionRequest containing the se- mantic IFHX/rack target, requested observations, diag- nostic objective, and termination conditions. The robot- tasking service resolves the target to a predefined map pose, and MARS navigates autonomously while the orchestrator remains available to the crew. 4) Structured evidence return. At the target, MARS captures an image and obtains a simulated local- ized NH 3 measurement. The perception service uses the vision-language model only to produce a con- strained visual observation; the raw image remains the primary evidence artifact. MARS returns task status, target, image reference, structured observa- tion, NH 3 result, timestamp, and quality flags as an InspectionResult. The evidence service distin- guishes this measured negative result from missing data or a failed acquisition. 5) Refinement and crew-gated verification. The diag- nostic service integrates telemetry, crew reports, and robot evidence, shifting the leading hypothesis toward an instrumentation fault. Reachy explains the evidence responsible for the update while maintaining isola- tion. The procedure service then returns a predefined verification sequence. After explicit crew approval, a deterministic tool resets the mock instrumentation component; monitoring independently confirms that the telemetry has cleared, and a separate verification input reports no NH 3 . The crew retains authority over the recovery transition. In the demonstrated run, the complete sequence executes end to end. The append-only trace records each state transi- tion, tool request, authority check, robot result, explanation, and crew confirmation. This demonstrates integration of the closed evidence loop and its authority boundaries. V. DISCUSSION AND CONCLUSION Our contribution is an integrated, traceable, authority- bounded evidence loop for onboard anomaly triage. It con- nects an unresolved diagnostic question to targeted crew or robot sensing, hypothesis revision, and a crew-authorized response while keeping observations, inferences, and actions explicit. The two scenarios illustrate how a mobile sensing platform can extend onboard anomaly triage by gathering evidence from a suspected hazardous volume or inspecting a physical interface not directly observable through telemetry. The hardware-in-the-loop prototype demonstrates end-to- end system integration, not improvement in diagnostic or human-performance outcomes; quantitative evaluation re- mains future work. Future work will focus on connecting validated diagnostic and procedure services, expanding mul- timodal sensing, and testing missing, delayed, and conflicting evidence. Habitat-analog studies, including NASA’s Crew Health and Performance Exploration Analog (CHAPEA), could measure diagnostic accuracy, workload, trust, and decision quality under reduced ground support [14]. REFERENCES [1] M. B. Chappell, P. R. Chai, and M. A. Rucker, “Mars Communications Disruption and Delay,” NASA Technical Reports Server, Document 20230012950, 2024. [2] K. T. McBrayer, P. R. Chai, and E. L. Judd, “Communication Delays, Disruptions, and Blackouts for Crewed Mars Missions,” in AIAA ASCEND 2022, 2022, doi: 10.2514/6.2022-4239. [3] I. D. Maddox, A. Vera, and A. Martinez, “Earth Independent Op- erations Development for NASA’s Mars Campaign Office,” in AIAA ASCEND 2024, 2024, NASA NTRS 20240007807. [4] R. Bajcsy, “Active Perception,” Proceedings of the IEEE, vol. 76, no. 8, p. 996–1005, 1988, doi: 10.1109/5.5968. [5] S. Yao, J. Zhao, D. Yu, et al., “ReAct: Synergizing Reasoning and Acting in Language Models,” in International Conference on Learning Representations, 2023. [6] B. Ichter, A. Brohan, Y. Chebotar, et al., “Do As I Can, Not As I Say: Grounding Language in Robotic Affordances,” in Proceedings of the 6th Conference on Robot Learning, PMLR, vol. 205, 2023. [7] G. E. Gorospe, J. K. Kam, and C. Teubert, “A Novel Fault Investigation Toolkit for System Health Management and Crew Autonomy in Off- World Habitats,” in AIAA SciTech Forum, 2026, doi: 10.2514/6.2026- 0380, NASA NTRS 20250005326. [8] NationalAeronauticsandSpaceAdministration,“ISS DailySummaryReport–01/14/15,”Jan.14,2015. https: //w.nasa.gov/blogs/stationreport/2015/01/ 14/iss-daily-summary-report-01-14-15/ [9] National Aeronautics and Space Administration, The International Space Station: Operating an Outpost in the New Frontier, R. C. Dempsey, executive ed., 2017, ch. 10, p. 174–175. [10] National Aeronautics and Space Administration, Moon Base Systems, 2026. https://w.nasa.gov/moonbase-systems/. [11] NationalAeronauticsandSpaceAdministration, Moon Base User’s Guide,2026. https://w. nasa.gov/wp-content/uploads/2026/04/ moon-base-architecture-users-guide.pdf. [12] Pollen Robotics and Hugging Face, “Reachy Mini Hardware Datasheet,” Reachy Mini Documentation, ver. 1.7.2. https: //huggingface.co/docs/reachy_mini/v1.7.2/en/ platforms/reachy_mini/hardware. [13] Innate, “MARS: Overview and Hardware,” Innate Documentation. https://docs.innate.bot/robots/mars. [14] National Aeronautics and Space Administration, “Crew Health and Performance Exploration Analog,” 2026. https://w.nasa. gov/humans-in-space/chapea/.