HEART Track 3: Advanced#
For products that act on their own, use an AI brain, run fleets, or are machines that move: what to read, what to skip, and when you are done
Status: Reading guide, November 2026. Part of the HEART Standards Family. It adds no requirements. Read first: Track 1: Basic and Track 2: Intermediate, all of both. This page lists only what Track 3 adds.
In one minute#
Track 3 is a HEART that acts. A rule, another system or an AI can start a change, and the HEART decides whether it may run. Risky changes wait for a person who is really there. One command stops all automatic action, at once.
- Feature Set:
full(card.level), with thecontrolmodule (API Standard, Section 2.1). - Autonomy Level: A3, A4 or A5.
- Claim when done: for example HEART Full · A3 (A4 for connectivity) · self-tested.
Track 3 has three stops. Stop as soon as your product is covered.
| Stop | You need it when | Autonomy | Extra reading |
|---|---|---|---|
| 3A. Acting, without a brain | The product suggests fixes for a person to approve, or runs rules a person adopted | A3, A4 | about 1 hour 20 minutes |
| 3B. With a brain | An AI model explains, plans or proposes fixes; or the product fixes new problems by itself; or it embeds a HEART Core | A3 to A5 with a model | about 1 hour 40 minutes more |
| 3C. Fleets and machines | One command goes to many systems; or the product is a robot, heavy machine, vehicle, drone, ship or spacecraft | any | 10 minutes, plus the roadmap. Most of this is planned, not yet in the standard. |
A3 is here, not in Track 2, because suggesting a fix and waiting for a yes needs the approval gate and the stop control, and both are part of HEART Full (Part 2, Section 8).
1. Who it is for#
| Stop | Examples |
|---|---|
| 3A | A thermostat that proposes a cheaper schedule and waits (A3); an online shop that restarts a stuck worker by a Playbook (A4); an air-conditioner controller that recalibrates a drifting sensor; a birdhouse camera whose zoom moves by adopted rules, inside limits |
| 3B | A greenhouse controller that asks a model for a better watering plan and runs it as a Trial; a photo editor with an AI assistant; any product that fixes problems nobody planned for (A5) |
| 3C | A Gateway rolling out an update to 2,000 systems; industrial and warehouse robots, excavators, haul trucks, cranes, autonomous tractors, drones, ships, rovers, landers and satellites |
Road vehicles: the roadmap decided that HEART does monitoring only for road vehicles, and sends no driving commands. Read Tracks 1 and 2, then the safety items of Stop 3C.
2. What you will build#
Stop 3A: acting, without a brain#
| Piece | What it does | Defined in |
|---|---|---|
| Capabilities and Actions | Things the product can be asked to do, invoked with POST /heart/v1/capabilities/{name}/invoke; each run is an Action you can follow | Part 3, Sections 3.5 and 3.6; API Standard, Sections 6.2 and 6.3 |
| The whole gate | Every change, from rule, ai, peer or human, checked against one table; the allowlist with envelopes | Part 6, Section 2.3 |
| Approvals | POST /heart/v1/actions/{id}/decision: a person, never an AI, never the initiator, with proof of presence bound to the Action's digest; Actions that expire | Part 6, Section 3; API Standard, Section 6.3 |
| No back doors | New Playbooks, a wider allowlist, higher autonomy, trusting a peer: all destructive | Part 6, Section 4 |
| Stop and the autonomy ceiling | POST /heart/v1/tending/stop, with no approval and no internet; the ceiling max (GET and PUT /heart/v1/tending/autonomy), and the mode that follows from the current level: observe, suggest, act | Part 6, Sections 6 and 6.1; API Standard, Section 13.4 |
| Playbooks (A4) | "When this happens, do that", adopted by a person, run as rule inside the allowlist | Part 2, "A4"; Part 6, Section 4.2 |
| Custom commands and guards | The product's own commands, mapped to Modbus, CAN, G-code and more, with interlocks checked at the moment they run | API Standard, Section 14; Part 6, Section 9.1 |
Stop 3B: with a brain#
| Piece | What it does | Defined in |
|---|---|---|
| Models suggest, systems decide | Nothing a model says runs directly; instructions and data kept apart; budgets | Part 6, Section 5 |
| The brain switch | A brain only through a Command Center, only while holding a signed lease; cut at once or when the lease runs out; every answer signed | Part 2, Rule 7; Part 6, Section 6.2; API Standard, Section 7.4; Command Center profile |
| HEART Core | The runtime inside the product: four tiers, grounded serving, Consultations, Proposals, envelopes, Trials with undo, learned Playbooks, the brainless state | Core Standard |
| Model changes | A new model passes the product's tests before use | Part 6, Section 7; API Standard, Section 11 |
Stop 3C: fleets and machines#
| Piece | What it does | Defined in | Status |
|---|---|---|---|
| Fleet commands | One command to many systems, in stages, paused on failures, approved at the Gateway | Part 6, Section 8; API Standard, Section 13.3 | In the standard and the reference Gateway |
| Lifecycle and running work | How, what and when for restarts; pause, resume and cancel at safe points | API Standard, Sections 6.3 (rule 5) and 13.2 (rule 3) | In the standard |
| The brain switch for machines | The Command Center, leases and auto mode for machines that are offline for days | Command Center profile | In the standard; the reference Command Center runs at heartcortex.ai |
| Control authority, missions, hazardous commands, machine modules, machine profiles | Who has control, link-loss rules, time-limited commands, arm-then-fire, two-person rules, ten modules, Part 8 profiles | Planned | Planned. Not in the standard yet. |
3. What to read, in order#
Read Track 1, Section 3, and Track 2, Section 3, first. Then read up to your stop.
Stop 3A: acting, without a brain#
| # | Document | Read these sections | Time | Why |
|---|---|---|---|---|
| 1 | Part 2: Autonomy Levels | In Section 4, "A3: Suggests" and "A4: Fixes known problems"; in Section 5, Rules 1, 3 and 5; Sections 6 and 10 | 10 min | What A3 and A4 demand, the stop rule, and areas such as "A4 for connectivity" |
| 2 | Part 6: Human Control and Safety | Section 2.3 again, every column this time; Sections 4 (4.1 to 4.3), 6 and 6.1; Section 9.1 | 18 min | The whole gate, the allowlist and its envelopes, no back doors to power, stop and modes, and guards. The heart of this track. |
| 3 | Part 3: Information Model | Sections 3.5, 3.6 and 6 | 6 min | Capabilities, Actions and the standard action names |
| 4 | API Standard | Sections 6.2, 6.3, 6.4, 13.2 (rule 10) and 13.4 | 12 min | Invoking, the approval flow, the digest, presence methods, cancelling at safe points, Trials' one exception, and autonomy control. Read 6.3 slowly. |
| 5 | Part 1: Basics | Section 9 | 2 min | The ladder of five steps, for commands the standard does not know |
| 6 | API Standard | Sections 1.3, 14 (14.1 to 14.7) and 15; Appendix D if you write custom definitions | 12 min | Custom commands, mapping to native protocols, guards, native passthrough, and physical systems |
| 7 | Security Advisory 2026-001 | C1 and C2 | 5 min | Why an AI holding a person's login cannot approve, and why standing orders count as power |
| 8 | Part 9: Testing and Certification | Sections 5.3, 6.1 and 6.5 | 17 min | Causing faults safely, the autonomy tests, and the gate, approval and stop tests |
| 9 | One guide close to your product | All | 30 min | Online shop server (A4 Playbooks), air-conditioner controller (HEART Full with heartd) or birdhouse camera (Playbooks inside an envelope) |
Stop 3A total: about 1 hour 20 minutes without the guide. Stop here if your product has no AI model and sends no fleet commands.
Stop 3B: with a brain#
| # | Document | Read these sections | Time | Why |
|---|---|---|---|---|
| 10 | Design Note 1: The Brain and the Heart | Sections 1 to 5 | 7 min | Why the brain is cut and the heart never is, with one worked example |
| 11 | Part 2: Autonomy Levels | In Section 4, "A5: Fixes new problems"; in Section 5, Rule 7 | 3 min | What A5 demands, and why A3 and above with a brain needs a switch |
| 12 | Part 6: Human Control and Safety | Sections 5 (5.1 to 5.4), 6.2 and 7 | 10 min | Models suggest, systems decide; cutting the brain; changing the model |
| 13 | API Standard | Sections 4.4, 7.2, 7.3, 7.4 (rules 1 to 13), 11 and 13.2 (rules 11 and 12) | 12 min | The Reason format, the brain lease, signed answers, signals that only lower risk, and the brain and evolving modules |
| 14 | HEART Command Center | "In one minute" and Sections 1 to 11 | 15 min | Joining, leases, cutting, tripwires, the public log and blessed models |
| 15 | Core Standard | Sections 1 to 9, 11 and 12. Read Section 7 (7.1 to 7.8) slowly. | 45 min | The Core inside the product: tiers, serving, Consultations, Proposals, envelopes, Trials, learned Playbooks, the brainless state, classes and robustness |
| 16 | Part 9: Testing and Certification | Section 6.6, and the P6-BRAIN-*, P6-TRIAL and P6-INJECT rows of Section 6.5 | 5 min | The Core tests and the brain switch tests |
| 17 | One guide close to your product | All | 30 min | Greenhouse irrigation (the brain proposes, a Trial with one approval and automatic undo) or photo editing software (the Core inside an app) |
Stop 3B total: about 1 hour 40 minutes without the guide. Stop here unless you send fleet commands or build a machine that moves.
Stop 3C: fleets and machines#
| # | Document | Read these sections | Time | Why |
|---|---|---|---|---|
| 18 | Part 6: Human Control and Safety | Section 8, and Section 9 again | 5 min | One command to many systems, and physical safety, which takes priority over everything |
| 19 | API Standard | Section 13.3 | 2 min | Staged rollout, pause, resume with a new approval, cancel |
| 20 | Core Standard | Section 10 | 1 min | Where the Core sits in a control system: on the supervisory side, never in the loop |
| 21 | Part 2: Autonomy Levels | Section 6, "Profiles may set a ceiling" | 1 min | A machine profile may cap your Autonomy Level (Part 8 is not written yet) |
| 22 | Part 6: Human Control and Safety | Section 9 | 5 min | Where HEART sits beside a machine's safety system. Authority, missions, hazardous commands and machine profiles are planned, not in the standard: do not claim any of them. |
| 23 | One guide | All | 25 min | Water pump station: the pattern for machines today. The PLC and its interlocks run the plant; HEART watches, explains and tells a person. |
4. What you can skip, and why#
| Skip | Why |
|---|---|
| Stop 3B, if your product has no AI model | A3 and A4 need no model and no internet (Part 2, Section 8). Without a brain you need no Command Center (Part 2, Rule 7). |
| The Core Standard, if you do not embed a HEART Core | The Core is one way to build a Full HEART. If you build your own, the gate, Actions and stop come from Part 6 and the API Standard. Read Core Section 7 anyway if a brain proposes changes. |
| Stop 3C, if you send no fleet commands and nothing moves | Fleets are for Gateways with the fleet module. The machine extensions are planned only. |
| API Standard, Appendices A to C | Background: neighbouring standards, open items and references. |
| The roadmap's decisions for machines you do not build | Each decision says which machines need it. A warehouse robot does not need the space profile. |
5. Where to start: templates and simulators#
Templates and the reference implementation#
No template serves HEART Full yet. The planned rust-heart-core and browser-worker templates will. Today, start from the reference implementation:
| Start from | For |
|---|---|
HEART Core in Rust (heart-core-rs, the heartd daemon) | HEART Full on embedded Linux, a server or a Gateway: the gate, presence checks, Actions, Playbooks, Trials, custom commands, the Gateway and fleet commands. Download it from heartcortex.ai/downloads. |
| The Core as WebAssembly or a Rust library | HEART Full inside an app, as in the photo editor guide |
esp32-full | An ESP32 that asks a cloud model to explain its alerts through a Reasoning Gateway (F3) and takes physical commands only after a press of its own button (F4). It claims Basic. |
The brain switch is in the standard, the reference Core and heartd, the Python and ESP32 templates, and the Command Center at heartcortex.ai.
Simulators#
These three claim HEART Basic · A1 in their Card, because they are not rated Full implementations. They show Track 3 behaviour.
| Simulator | Stop | What it shows |
|---|---|---|
| Online shop server | 3A | Three Playbooks on the allowlist for rule, with daily limits and cooldowns: A4 behaviour. Destructive actions are never possible through HEART. |
| Birdhouse camera | 3A | Two adopted Playbooks move the zoom inside an envelope; the infrared light, which shines on living birds, needs a person at the box |
| Greenhouse irrigation | 3B | A clearly labelled mock brain proposes "water 20% less, in two steps"; one press of the button approves the whole Trial, which is watched and undone if it goes wrong |
The thermostat (Track 2) also previews A3: its mock AI only suggests, and every suggestion waits for a person.
6. The Part 9 tests that apply#
All the tests of Track 1 and Track 2, plus these. Weights: critical 5, must 3, should 1. One failed critical test caps the rating at 3.9, Unsafe.
Stop 3A#
| Test | Weight | Applies to you when |
|---|---|---|
P2-AUTONOMY-CURRENT | must | Full |
P2-ALL-1 | critical | Full |
P2-A3-1, P2-A3-2, P2-A3-3, P2-A3-4 | must | You claim A3 or higher |
P2-A3-5 | must | You claim exactly A3 |
P2-A4-1, P2-A4-2, P2-A4-3 | must | You claim A4 or higher |
P2-A4-4 | must | You claim exactly A4 |
P4-AUTH-SCOPE, P4-IDEMPOTENCY | must | Full |
P6-GATE, P6-APPROVER, P6-PRESENCE, P6-PRESENCE-ONE-CALL, P6-AUTHORITY, P6-PHYSICAL | critical | Full |
P6-PRESENCE-ENROL | critical | You offer the presence module |
P6-MODE, P6-ALLOWLIST, P6-EXPIRE, P6-PLAYBOOK-ADOPT, P6-CANCEL-SAFE | must | Full |
P6-STOP, P6-STOP-ONE | must | A3 or higher |
P6-HALT | must | You offer the core module and a halt capability |
P6-GUARD | must | Your commands have guards |
SEC-05-AGENT-NOT-HUMAN, SEC-06-AUTHORITY-CHANGE, SEC-07-PRESENCE-REQUIRED | critical | Full |
Stop 3B#
| Test | Weight | Applies to you when |
|---|---|---|
P2-A5-1, P2-A5-2, P2-A5-3 | must | You claim A5 |
P2-A5-4 | should | You claim A5 |
P5-AI | must | It calls AI models |
P6-INJECT | critical | It uses AI or /serve |
P6-TRIAL | must | It has the core module, or runs Trials |
P6-BRAIN-LEASE, P6-BRAIN-SIGNED, P6-BRAIN-LOWER, P6-BRAIN-NOKEYS | critical | It has the brain module |
P6-BRAIN-SAFE, P6-BRAIN-SELFCUT | must | It has the brain module |
P6-BRAIN-RESTORE | critical | It has brain.restoreNeedsOwner |
P6-BRAIN-OFFLINE-CAP, P6-BRAIN-RECONNECT | critical | It has brain.offline (auto mode) |
P6-BRAIN-STEPDOWN | must | It has brain.offline |
P7-UNDERSTAND, P7-NO-MODEL, P7-LIMITS, P7-RESTART | must | You claim a Core class (Core-S, Core-M or Core-L) |
Stop 3C#
| Test | Weight | Applies to you when |
|---|---|---|
P6-FLEET | must | A Gateway with the fleet module |
P6-FLEET-RESUME | critical | A Gateway with the fleet module |
P6-FLEET-ONE-APPROVAL | critical | A Gateway with the fleet module, or a system that pins a Gateway key |
There are no Part 9 tests yet for the planned machine extensions, and no Part 8 profile tests (Part 9, Section 6.8). Nothing in them can be claimed until they exist.
7. You are done when#
Stop 3A#
- Everything on the Track 1 and Track 2 finish lines is still true.
- Every combination of risk and initiator, on and off the allowlist, in every mode, gives exactly the result in Part 6, Section 2.3.
- An AI, another program, the Action's own initiator and a person without proof of presence all fail to approve. The person an AI acted for, with valid proof, succeeds.
- As the AI, adding a Playbook, widening the allowlist or raising
maxis held for a person or refused. - Stop works at once, degraded and offline, with no approval, by
POST /heart/v1/tending/stopand byPUT /heart/v1/tending/autonomywithmax2: waiting Actions are cancelled, and new automatic Actions get409 autonomy-stopped. - If you claim A4: a Playbook fault is fixed without asking, also offline, and a fault no Playbook covers gets a suggestion that waits.
Stop 3B#
- With every message to the Command Center blocked, the brain is cut when the lease ends; nothing is consulted, and Proposals are refused. The heart keeps working.
- No model provider key is anywhere on the product.
- Unsigned, wrongly signed, old and replayed answers and signals are rejected, and no signal can ever raise anything.
- A Trial runs on one approval, undoes itself when a guard fails, and ends
stoppedwith its values restored when stop is pressed. - If you claim A5: with the model disconnected,
autonomy.currentdrops to 4 withlimitedBy: no-model.
Stop 3C#
- A fleet command that is not
readwaits for a person at the Gateway, starts with a small first stage, and pauses at its first failure; resuming needs a new approval. - Your machine's safety functions work with the HEART absent, stopped or hacked, and HEART sits only on the supervisory side.
- You claim nothing from the roadmap until it is in the standard and tested.
When every test in Section 6 that applies passes, you can say, for example: HEART Full · A4 (A3 for actuators) · self-tested. You have read everything the standard asks of your product. The rest of the standard is reference.