A Safety-Governed Architecture for Adaptive Sequential Sensing in Robot-Assisted Rehabilitation

1. Introduction

Sensor-rich rehabilitation environments create an opportunity to turn uncertainty into an explicit sequence of measurements. A wearable device or rehabilitation robot can expose timing, force, kinematic, physiological, and interaction signals; unlike a static clinical record, it can also support a protocol in which the next measurement is selected after observing the previous one. This distinction is particularly relevant when a presentation is uncommon, heterogeneous, or insufficiently explained by the evidence already available. The appropriate role of such a system is not to autonomously declare a diagnosis, but to organize testable hypotheses, select bounded evidence-acquisition actions, and present a traceable record for expert review.

Existing rehabilitation datasets demonstrate that movement sensing can quantify clinically relevant structure. Bilateral foot-force records capture altered gait dynamics in Huntington’s disease and amyotrophic lateral sclerosis (ALS) [1,2]; RGB-D and motion-capture datasets support exercise assessment [3,4]; and wearable algorithms have profiled gait and balance in the rare neuromuscular disorder Charcot–Marie–Tooth disease type 1A [5]. These studies establish measurement feasibility, but they do not define how an autonomous system should decide which evidence to obtain next or how such a decision should be constrained before a robot can act.

In parallel, agentic systems have advanced from document retrieval toward tool-using rare-disease decision support [6,7] and iterative scientific workflows [8,9]. Minimal experiment loops can repeatedly modify and retain computational experiments [10], while population-based agent simulation can explore many interacting scenarios [11]. Closed-loop laboratories further show that automated hypothesis–experiment feedback can produce transferable knowledge in chemistry [12]. Embodied rehabilitation is a stricter setting: an agent proposal may eventually reach a physical actuator near a person, so provenance, execution authority, idempotency, and fail-closed behavior are not optional implementation details.

We present EARL, the Embodied Evidence Acquisition and Reasoning Loop, as a safety-governed architecture for sequential sensor evidence acquisition under these constraints. EARL separates proposal authority from execution authority. Role-specific critics may rank a typed probe, and a simulator may estimate its information value, but only deterministic validation and a versioned safety envelope can approve an adapter call. Every accepted or rejected action is written to a content-addressed evidence chain. The reference implementation is model-agnostic at the agent boundary: the present evaluation uses deterministic critics so that system behavior can be reproduced exactly, while the same validated score-card contract can contain future language-model agents without granting them actuator authority.

This study makes four contributions:

1.

a typed closed-loop architecture that keeps observed, derived, and simulated evidence distinct and makes the safety governor the sole execution authority;

2.

a five-critic hypothesis council combining informativeness, falsification, diversity, feasibility, and safety assessments with explicit veto semantics;

3.

a replayable implementation with strict contracts, idempotent adapter execution, deterministic safety challenges, and a parent-linked SHA-256 research ledger; and

4.

a leakage-controlled retrospective evaluation on 64 unique subjects, comprising 3520 subject-condition runs across comparators, ablations, and robustness scenarios.

The evaluation is deliberately bounded. Sequential probes disclose different feature bundles from already recorded gait sessions, and active responses are represented only by a transparent in-silico simulator and separate software safety challenges. No participant was recruited, no physical robot was commanded, and no clinical decision was made. Accordingly, the reported endpoints concern evidence-selection behavior and software conformance, not diagnostic validity, treatment efficacy, or patient safety.

2. Related Work

2.1. Rehabilitation and Rare-Disease Sensing

The PhysioNet Gait in Neurodegenerative Disease Database (GaitNDD) combines bilateral force-sensitive-resistor recordings and stride-derived series for ALS, Huntington’s disease, Parkinson’s disease, and control cohorts [13,14]. Its subject-level recordings make it suitable for evaluating sequential disclosure of gait evidence, provided that all learned quantities remain inside training folds. Other rehabilitation benchmarks broaden the sensing modalities: UI-PRMD combines optical motion capture and Kinect observations [3], while KIMORE links RGB-D exercise motion with clinical scores [4]. A recent therapist–exoskeleton–patient dataset includes encoders, interaction torque, electromyography, inertial measurements, and force signals during gait therapy [15]. These resources motivate a future multimodal adapter layer, but only GaitNDD is used in the present benchmark.

Rare-disease sensing and rare-disease reasoning should not be conflated. Disease-specific wearable models can characterize activity within a defined rare cohort [5]; conversely, recent agentic systems coordinate medical roles, tools, and traceable evidence for differential diagnosis [6,7]. Earlier clinical-computing work combined intelligent agents with complex event processing for patient monitoring, used entity linking to improve graph embeddings from Italian clinical notes, and detected expected activities from medical-simulator data stored in scientific databases [16,17,18]. EARL occupies the interface between these directions: it asks how a reasoning workflow could request the next bounded sensor observation. Its four cohort labels are an evaluation surrogate for uncertainty reduction, not claims that gait alone can diagnose these diseases.

2.2. Active Perception and Autonomous Science

Active perception frames sensing as an action chosen to improve task-relevant information [19]. EARL instantiates that principle with explicit probes, costs, risk classes, and posterior updates. Expected information gain (EIG) supplies one acquisition objective, but an embodied research action may also need to discriminate the leading alternatives, avoid redundant evidence, respect sensor availability, and satisfy a safety protocol. The council therefore treats information gain as one criterion rather than the entire objective.

Autonomous-science systems have implemented recurring cycles of hypothesis generation, experiment execution, analysis, and manuscript production [8,9]. The autoresearch software pattern emphasizes a simple measurable objective and a keep-or-discard loop [10]; MiroFish illustrates large-scale multi-agent scenario simulation [11]. EARL borrows the general principles of repeated measurable experiments and plural agent perspectives, but neither project is a software dependency and neither supplies biomedical safety evidence. Performance metrics and explicit autonomy levels are essential when evaluating self-driving laboratories [20], while human oversight remains a deliberate part of emerging closed-loop laboratory practice [21]. Controlled evidence also cautions that generative systems may fail at scientific hypothesis and experimental reasoning without grounded feedback [22]. These observations motivate EARL’s typed outputs, deterministic validation, evidence replay, and preserved human approval boundary.

2.3. Research Gap

Prior work separately demonstrates sensor-based rehabilitation assessment, agentic clinical reasoning, and automated scientific loops. The missing systems layer is a reproducible contract between hypothesis generation and embodied evidence acquisition. A useful framework must answer: what exactly is being proposed; which sensor channels and features it requires; what evidence class the response belongs to; who can veto or approve it; whether repeated execution is safe; and whether an independent process can reconstruct the posterior from the record. EARL is designed around these questions.

3. Materials and Methods

3.1. Study Design and Evidence Boundary

This was a retrospective computational methods study. The empirical component used a public, de-identified gait dataset. The sequential process was a replay experiment: each probe revealed a predeclared bundle of features derived from one held-out subject’s existing recording. Robustness perturbations and active-response experiments were simulated and marked as such. Figure 1 shows the authority boundary.

Every boundary object is an immutable, strict schema. Hypotheses contain a label, description, and prior. A probe declares its family, required sensor channels, feature names, estimated cost, rationale, risk class, and optional typed actuation. Observations carry a timestamp, source reference, evidence origin, and—for simulated values only—a seed. Unknown fields, non-finite numbers, inconsistent probability distributions, duplicate identifiers, and missing provenance fail validation. Agent outputs are constrained to score cards with a score in $[-1,1]$, a rationale, and an optional veto.

Three evidence origins are used throughout: observed for source measurements or their replayed values, derived for deterministic features, posterior states, statistics, and safety decisions, and simulated for robustness perturbations or digital-twin responses. These origins appear in contracts, ledger events, figures, captions, and release artifacts.

3.2. Dataset, Acquisition, and Cohorts

GaitNDD version 1.0.0 (DOI: 10.13026/C27G6C) was acquired from the authoritative PhysioNet repository [13]. The dataset contains 64 subjects: 13 with ALS, 20 with Huntington’s disease, 15 with Parkinson’s disease, and 16 controls. Each selected record comprises a metadata header, left- and right-foot force-derived series, and a 13-column stride-time file. The acquisition script downloads to temporary paths, verifies every file against the publisher’s SHA-256 manifest, and atomically renames successful downloads. The repository excludes raw data but retains the source version, DOI, license, selected-file list, sizes, and checksums in a machine-readable manifest.

The analysis unit was the subject. Subject identifiers were unique, and all files belonging to a subject remained in the same outer fold. Demographic variables were parsed for integrity checks but were not used as predictors. All learned means, variances, feature scales, and simulator ranges were fitted only on training subjects.

3.3. Feature Extraction and Probe Construction

The stride table contains time; left and right stride, swing, and stance durations; swing and stance percentages; and double-support duration and percentage. Twenty-five finite subject-level features were derived without using cohort-external data. They were grouped into six evidence families and exposed through eight probes (Table 1). Repeated probes within stance–swing and variability families permit the diversity critic to distinguish a new family from a second bundle in an already used family.

For a sequence $z_1,\dots ,z_n$, the coefficient of variation was the sample standard deviation divided by the absolute mean. Bilateral asymmetry was the mean absolute left–right difference divided by their pointwise mean magnitude. Long-range features included lag-one correlation and a compact detrended-fluctuation-analysis slope over feasible scales in $\{4,8,16,32,64\}$. The outlier fraction used a median-absolute-deviation robust z-score threshold of 4. Records with fewer than eight rows, a non-13-column shape, or non-finite values were rejected.

3.4. Probabilistic Evidence Model

The transparent reference model represents each class $y\in \mathcal{Y}$ and evidence family f by a diagonal Gaussian estimated inside the training fold. For features ${\mathbf{x}}_f$ selected by a probe,

$$p({\mathbf{x}}_f\mid y)=\prod _{j\in f}\mathcal{N}(x_j;{\mu }_{yfj},{\sigma }_{yfj}^2).$$

(1)

Class-specific variances were floored by the maximum of ${10}^{-3}$ times the global training variance and ${10}^{-8}$. Starting from a uniform prior, posterior updates were performed in log space:

$$p_t\left(y\right)={\displaystyle \frac{p_{t-1}\left(y\right)p({\mathbf{x}}_{f_t}\mid y)}{{\sum }_{y^{\prime }\in \mathcal{Y}}{p}_{t-1}\left(y^{\prime }\right)p({\mathbf{x}}_{f_t}\mid y^{\prime })}}.$$

(2)

Uncertainty was Shannon entropy in bits, $H\left(p_t\right)=-{\sum }_y{p}_t\left(y\right){log}_2{p}_t\left(y\right)$. The expected information gain of candidate probe a was

$$EIG\left(a\right)=H\left(p_t\right)-{\mathbb{E}}_{{\mathbf{x}}_a\sim p({\mathbf{x}}_a\mid p_t)}\left[H\left(p_{t+1}\right)\right].$$

(3)

The expectation was approximated deterministically with $2d$ class-conditional sigma points for a d-feature probe, displaced by $\sqrt{d}$ standard deviations along each axis. EIG was clipped to $[0,H\left(p_t\right)]$. This model favors auditability over representational capacity; it is not proposed as a clinical classifier.

3.5. Hypothesis Council and Probe Planner

Five stateless critics independently produce validated score cards for every candidate (Table 2). Independence here means that critics share no mutable state and cannot read one another’s output; it does not imply statistical independence. A malformed or missing score card aborts planning.

Non-vetoed scores $s_i\left(a\right)$ are aggregated with explicit positive weights $w_i$:

$$S\left(a\right)={\displaystyle \frac{{\sum }_i{w}_i{s}_i\left(a\right)}{{\sum }_i{w}_i}}.$$

(4)

The complete EARL configuration used equal weights. Deterministic tie-breaking used aggregate score, EIG, acquisition cost, and probe identifier, in that order. The agent layer has proposal authority only.

3.6. Safety Governor, Simulator, and Adapter Boundary

The deterministic safety governor revalidates a probe independently of council scoring and binds its decision to a SHA-256 hash of the complete safety envelope. The envelope covers cadence scaling, assistance level, and resistance level; it declares ranges, units, maximum duration, maximum step change, cumulative exposure, prerequisites, forbidden combinations, and risk classes that require explicit human approval. An emergency stop, missing prerequisite, unsupported actuation, invalid unit or range, excessive duration, rate violation, cumulative violation, or forbidden combination produces a rejection. Moderate and high risk require approval. No generative output can override the result.

An approved probe and its matching safety decision are wrapped in a typed object before they reach an adapter. The replay adapter returns only features declared by the approved probe. The simulator adapter can instead apply a declared in-silico response model fitted on training subjects: active effects are sampled from predeclared sensitivity ranges, additive noise is bounded by training variance, and every value is clipped to at most 25% relative perturbation from baseline. Simulated observations require a seed and cannot be mislabeled as observed. The active-response simulator was implemented and tested as an architectural boundary; the primary benchmark used passive replay and never issued an actuation.

The frozen safety envelope permitted cadence ratios 0.90–1.10, assistance fractions 0–0.40, and resistance fractions 0–0.30 under clinician-supervision prerequisites, with additional duration and transition limits. These are software-test bounds, not a clinical protocol, device certification, or assertion of safe exposure.

3.7. Closed-Loop Execution and Evidence Ledger

Figure 2 summarizes the state machine. A run registers priors and candidates, ranks remaining probes, applies stopping rules, records the selected proposal, evaluates safety, executes an approved adapter call exactly once, records the observation, updates the posterior, and repeats. Terminal reasons are confidence, marginal information, maximum probes, cost, safety stop, or absence of a valid probe.

Adapter calls are protected by an idempotency key derived from run identifier, step index, and canonical probe content. A repeated call with the same key returns the cached observation; the same key with different probe content raises an error. Ledger events use canonical JSON, timezone-aware timestamps, a parent event identifier, and a SHA-256 content identifier. Replay verifies each parent link and hash, then recomputes every posterior from recorded observations. A run is accepted for analysis only if the replayed posterior path equals the original path.

3.8. Evaluation Design

Repeated stratified four-fold cross-validation with five repeats produced 20 outer splits (Figure 3). In each split, the likelihood model, variance floors, perturbation scales, and randomized-feedback model were fitted only on training subjects. Each held-out subject was evaluated under 11 predeclared method–scenario conditions, yielding 3520 subject-condition rows. Every condition accepted exactly five unit-cost probes, so entropy trajectories had a common baseline and five post-probe states.

The five clean comparators were: (i) fixed family order; (ii) a seeded random order; (iii) EIG, containing only the informativeness critic; (iv) complete EARL; and (v) a non-deployable oracle. The oracle had access to each held-out subject’s realized feature values and used exact dynamic programming over the remaining probes to maximize the final trapezoidal entropy-reduction area. It is therefore an upper reference, not a usable policy.

Three clean ablations removed the falsification critic, diversity critic, or simulator-informed informativeness critic. Three robustness conditions retained complete EARL while introducing: Gaussian feature noise with standard deviation 10% of the training-fold feature standard deviation; independent 20% feature missingness with at least one retained feature per probe; or a training-fold cohort-label permutation as a random-feedback negative control. Perturbed observations were labeled simulated and stored with their deterministic seeds.

3.9. Outcomes and Statistical Analysis

The primary endpoint was area under cumulative entropy reduction (AUC) across the five probes:

$$A={\displaystyle \sum _{t=1}^5}{\displaystyle \frac{[H\left(p_0\right)-H\left(p_{t-1}\right)]+[H\left(p_0\right)-H\left(p_t\right)]}{2}}.$$

(5)

Higher values indicate earlier and larger reduction in model uncertainty. Secondary endpoints were final macro accuracy, unscaled multiclass Brier score, top-label expected calibration error (ECE) over 10 equal-width bins, the fraction of subjects whose true-label posterior reached 0.8 at any step, and median probes to that threshold among subjects that reached it. These endpoints characterize the surrogate cohort-identification task and do not measure clinical diagnostic utility.

The five repeated observations for each subject and condition were aggregated within subject before descriptive or inferential statistics. Mean AUC and paired AUC differences used percentile subject bootstrap intervals with 10000 replicates. Each complete-EARL comparison used a two-sided paired sign-flip permutation test with 100000 Monte Carlo replicates and the plus-one correction. Holm adjustment controlled the family-wise error rate across all ten comparisons. Standardized paired effects divided the mean within-subject difference by its sample standard deviation. No post hoc condition was added after inspection of results.

3.10. Implementation and Reproducibility

The reference implementation uses Python 3.12, NumPy, SciPy, scikit-learn, Pydantic, and Matplotlib. Configuration parsing is strict and rejects unknown fields. The benchmark digest includes the complete evaluation configuration, safety-envelope content, and source bytes of the evaluation, agent, loop, model, planner, safety, and statistics modules. Checkpoint rows are atomically replaced and can be resumed only when their digest matches. Figure values and manuscript macros are generated from frozen JSON/CSV artifacts rather than transcribed manually.

The released workflow provides commands for checksum-verified data acquisition, tests, benchmark replay, figure generation, manuscript compilation, claim audit, and release packaging. Raw source data remain outside version control; the manifest and DOI permit independent reacquisition.

4. Results

4.1. Run Integrity and Primary Endpoint

All 3520 configured rows were present, all ledger chains verified, and all test subjects were absent from their training-subject lists. Complete EARL achieved a mean entropy-reduction AUC of 7.689 (95% CI 7.535–7.840). It exceeded fixed ordering by 0.459 (95% CI 0.255–0.660; Holm-adjusted $p=0.00010$) and random ordering by 0.763 (95% CI 0.609–0.919; adjusted $p=0.00010$). It was lower than EIG by -0.321 (95% CI -0.426—0.217; adjusted $p=0.00010$) and lower than the oracle by -1.052 (95% CI -1.180—0.930; adjusted $p=0.00010$). The negative differences indicate that the comparator had higher AUC.

Although EIG reduced entropy faster, complete EARL had higher macro accuracy (55.8% versus 49.5%), lower Brier score (0.781 versus 0.813), and lower ECE (0.364 versus 0.398). Thus the multi-agent policy did not dominate EIG on the predeclared primary endpoint; rather, it traded some entropy efficiency for better values on the reported classification and calibration summaries.

Figure 4. Primary endpoint. The left panel shows cumulative entropy reduction across five probes; the right panel shows subject-aggregated AUC with 95% bootstrap intervals. Numeric content is generated from the frozen benchmark summary. Higher is better.

Figure 4. Primary endpoint. The left panel shows cumulative entropy reduction across five probes; the right panel shows subject-aggregated AUC with 95% bootstrap intervals. Numeric content is generated from the frozen benchmark summary. Higher is better.

Table 3. Clean-condition outcomes. AUC is the primary endpoint (higher is better); Brier score and ECE are lower when better calibrated. Intervals are 95% subject-bootstrap intervals.

Policy	AUC (95% CI)	Macro accuracy (%)	Brier	ECE
EARL	7.689 (7.535–7.840)	55.8	0.781	0.364
EIG	8.010 (7.826–8.186)	49.5	0.813	0.398
Fixed	7.230 (6.994–7.467)	53.6	0.827	0.387
Random	6.926 (6.713–7.134)	49.5	0.789	0.312
Oracle	8.741 (8.657–8.820)	56.3	0.765	0.347

Table 3. Clean-condition outcomes. AUC is the primary endpoint (higher is better); Brier score and ECE are lower when better calibrated. Intervals are 95% subject-bootstrap intervals.

Policy	AUC (95% CI)	Macro accuracy (%)	Brier	ECE
EARL	7.689 (7.535–7.840)	55.8	0.781	0.364
EIG	8.010 (7.826–8.186)	49.5	0.813	0.398
Fixed	7.230 (6.994–7.467)	53.6	0.827	0.387
Random	6.926 (6.713–7.134)	49.5	0.789	0.312
Oracle	8.741 (8.657–8.820)	56.3	0.765	0.347

4.2. Ablation Results

Removing the simulator-informed informativeness critic reduced AUC by 0.475 in the EARL-minus-ablation contrast (95% CI 0.288–0.663; adjusted $p=0.00010$). Removing the diversity critic produced a negligible primary-endpoint difference of -0.004 (95% CI -0.023–0.014; adjusted $p=0.66317$), although the complete policy’s macro accuracy was 55.8% compared with 48.3% for the ablation. Removing the falsification critic increased AUC: the complete-minus-ablation difference was -0.316 (95% CI -0.423—0.210; adjusted $p=0.00010$). The no-falsification policy nevertheless had a higher Brier score (0.810 versus 0.781). These results reject a simple claim that every added critic improves every metric.

4.3. Robustness and Random-Feedback Control

Feature missingness reduced complete-EARL AUC from 7.689 to 7.343, a paired difference of 0.346 (95% CI 0.237–0.461; adjusted $p=0.00010$). Added feature noise reduced AUC to 7.284, a difference of 0.405 (95% CI 0.254–0.553; adjusted $p=0.00010$), and macro accuracy fell to 45.8%.

The randomized-training-label control produced AUC 7.022 and macro accuracy 25.1%, approximately the 25% level expected for four balanced evaluation classes. This control shows that the pipeline can still reduce the entropy of a mis-specified model while losing meaningful correspondence with the held-out labels. Entropy reduction must therefore be interpreted together with predictive and calibration endpoints.

Figure 5. Secondary clean-condition metrics and robustness AUC. Points are subject-aggregated estimates; AUC intervals are 95% subject-bootstrap intervals. Lower is better for Brier score and ECE; higher is better for accuracy and AUC. Perturbed conditions are simulated.

Figure 5. Secondary clean-condition metrics and robustness AUC. Points are subject-aggregated estimates; AUC intervals are 95% subject-bootstrap intervals. Lower is better for Brier score and ECE; higher is better for accuracy and AUC. Perturbed conditions are simulated.

4.4. Safety Challenge Conformance

All 10 of 10 predeclared safety cases returned their expected outcome. The valid cadence proposal was approved. Out-of-range value, excessive duration, unit mismatch, rate change, cumulative exposure, forbidden assistance–resistance combination, missing supervision prerequisite, and emergency-stop cases were rejected; the moderate-risk unapproved case returned requires approval. Figure 6 shows expected versus observed outcomes.

5. Discussion

5.1. Principal Findings

EARL provides a concrete architecture for adaptive evidence acquisition: a research loop can propose the next measurement, estimate its value, execute only within a deterministic envelope, update uncertainty, and preserve enough evidence to replay the result. The implementation completed 3520 sequential runs without subject leakage or ledger mismatch. The complete policy improved the primary endpoint over fixed and random acquisition, while its failure to exceed pure EIG prevents an inflated claim of multi-agent superiority.

The contrast with EIG is informative. EIG optimizes the primary endpoint directly and therefore achieved faster entropy reduction. EARL’s additional critics can favor separation of the two leading hypotheses, evidence-family coverage, feasibility, and safety. In this benchmark those criteria were associated with higher macro accuracy and better Brier/ECE values than EIG, but the experiment was not designed to estimate clinical utility and secondary metrics were not subjected to the same multiplicity-controlled pairwise testing. The appropriate conclusion is a measurable multi-objective trade-off, not that one policy is universally better.

The ablations further show that agent roles require empirical justification. The simulator-informed critic contributed substantially to entropy efficiency. Diversity had little effect on AUC but coincided with better macro accuracy, which may reflect reduced repeated-family evidence. Falsification lowered primary AUC relative to its ablation but improved Brier score. A future system should therefore treat council composition and weights as registered, testable design choices rather than intuitive necessities.

5.2. Implications for Robotic Rehabilitation Research

The same contract can represent a passive sensor request or an active, bounded robotic experiment. In a clinical research setting, a candidate might request synchronized force, inertial, electromyographic, or interaction-torque evidence under a clinician-defined task. The proposal layer could simulate multiple responses and score the value of competing probes. Crucially, the generative or multi-agent layer would still be unable to issue a device command: protocol validation, current state, prerequisites, explicit approval, idempotency, and emergency-stop state would be checked by deterministic code at execution time.

This arrangement does not remove the need for clinician judgment. Instead, it makes the handoff inspectable. A reviewer can see which hypotheses were active, why each critic scored a probe, whether any critic vetoed it, which envelope version governed the decision, what the adapter returned, and how that observation changed the posterior. Rejected probes remain evidence rather than disappearing from the record.

The path to prospective use is staged in Figure 7. The current evidence supports only retrospective replay and in-silico boundaries. Hardware shadow mode would next test vendor adapters, timing, disconnects, stale state, and fault injection without actuation. A supervised feasibility study would require a registered protocol, independently reviewed envelope, explicit approval at each step, and prospective endpoints. Clinical utility and patient safety would require separate adequately powered evaluation and monitoring.

5.3. Limitations

First, GaitNDD is a small historical dataset. Cohort labels, acquisition procedures, and population composition limit external validity. The four-way cohort task is not a differential diagnosis and cannot represent the breadth of rare or unexplained presentations. Second, sequential acquisition was emulated by revealing feature bundles from one existing recording. It does not measure within-person repeatability, sensor repositioning, participant fatigue, adaptive task effects, or closed-loop latency.

Third, the model assumes diagonal class-conditional Gaussians and conditional independence across sequential updates. This transparent baseline may be miscalibrated and cannot capture complex temporal structure. ECE estimates from 64 subject aggregates are themselves uncertain; we report them descriptively. Fourth, the deterministic council demonstrates the contract and evaluation method but not language-model reasoning quality. Replacing a critic with a generative agent would require output validation, model/version logging, adversarial testing, timeout handling, and repeated stochastic evaluation.

Fifth, the active-response simulator uses declared sensitivity ranges rather than causal estimates. It is a bounded scenario generator, not a digital patient and not evidence of treatment response. Sixth, the safety suite verifies code paths against one illustrative envelope. It does not address hardware faults, biomechanical hazards, cybersecurity, human factors, regulatory requirements, or prospective adverse events. Finally, the study uses one dataset and one primary acquisition objective. Independent datasets, modalities, institutions, and prospective protocols are needed before considering clinical translation.

6. Conclusions

EARL turns an autonomous-research concept into a typed, replayable framework for sequential sensor evidence acquisition. Its core architectural claim is narrow but important: multi-agent proposal and large-scale simulation can coexist with embodied sensing only when execution authority remains deterministic, provenance is explicit, and every transition is auditable. In retrospective GaitNDD evaluation, EARL reduced uncertainty earlier than fixed and random ordering, but pure EIG was superior on the predeclared primary endpoint and EARL showed a different accuracy–calibration trade-off. The complete package establishes reproducible software and benchmark behavior. It does not establish clinical diagnosis, therapeutic benefit, physical-robot safety, or patient outcomes.