Contingency Autonomy for 2027–2033: When AGI Care Robots May Diagnose, Prescribe, Treat and Operate

Why a contingency framework now

Part 1 set three practical autonomy rungs for spaceflight and kept higher medical-robot autonomy levels out of scope [1][8]. Part 2 and Part 4 walked library protocols whose ceiling is rung 2 (supervised): the robot never diagnoses and never chooses a medicine [2][4]. Part 3 treated rung 3 as a stricter design target, not a demonstrated care mode [3].

Exploration pressure does not wait for that near-term ladder to finish. On the way to Mars, a one-way radio signal can take up to about 21–23 minutes, with blackouts of about 2–3 weeks [9]. Evacuation to definitive care can be months away. NASA medical operations already place medical authority with the flight surgeon and delegated onboard care with the crew medical officer (CMO) [7]. NASA-STD-3001 Volume 1 requires onboard capability sized to mission length and return time [6]. Those facts motivate asking what happens when no capable human authority can act in time — without rewriting everyday LEO cruise rules.

This Part 5 is that ask: a contingency / Earth-independent extension of the series ladder for a 2027–2033 planning horizon. Higher modes are fallbacks, not default cruise settings.

The 2027–2033 planning horizon

Two pressures define the window:

1. Exploration / Mars-class Earth-independent ops. Delay and blackout make real-time ground approval unavailable at the worst moments [9]. Onboard treat-and-stabilize capability must grow with distance [6].
2. AGI + humanoid capability as a planning assumption. For design work in this thought experiment, the foundation assumes that by the late 2020s to early 2030s, AGI-class clinical models paired with sufficiently capable humanoid platforms may be able to safely diagnose, prescribe, treat and operate within certified bounds. That is a foundation planning assumption, not peer-reviewed evidence that AGI exists, works in space, or is approved by any agency. It is also not a schedule guarantee that any product ships by 2027 or 2033.

Parts 1–4 remain the near-term demonstrated design space (rungs 1–3). Part 5 extends them; it does not erase “robot never diagnoses” for everyday ops.

Extended autonomy ladder (rungs 1–5)

Yang and colleagues describe six levels of medical-robot autonomy, from none through full autonomy [8]. Part 1 mapped three practical spaceflight rungs onto the lower part of that language [1]. Part 5 keeps rungs 1–3 and adds two contingency-only rungs:

Default cruise: human medical authority (flight surgeon / CMO chain) plus rungs 1–2, with rung 3 only where a program has cleared proposal/approve branches under delay [3][7]. Rungs 4–5 never self-select as the everyday mode.

Rough Yang mapping for the new rungs (illustrative, not regulatory): rung 4 ≈ high autonomy inside a locked envelope; rung 5 ≈ full autonomy under last-resort triggers [8]. Spaceflight still needs mission-specific gates that Earth OR frameworks do not supply.

Contingency arming triggers (explicit and auditable)

Higher modes kick in only when human support is unavailable or insufficient. Arming is an auditable state change [V2 10162], [V2 10164], not a soft mood.

Examples a pre-mission contingency matrix would map (trigger → max rung → allowed envelopes):

1. Ground medical unreachable beyond a mission-set timeout (Mars delay, conjunction blackout, sustained loss of private medical link) [7][9].
2. CMO incapacitated, missing, or unable to perform (injury, EVA, concurrent emergency, or the CMO is the patient) [6].
3. Capable human present but insufficient for the acuity or time available (skill gap, not enough hands, multiple casualties).
4. Pre-mission signed matrix owned by the flight surgeon program: which triggers allow which max rung and which ICL-class envelopes [10].
5. Arming preference: prefer human-declared arming whenever any capable human exists; allow auto-arm only for pre-listed time-critical envelopes when no capable human can declare.

Every arming event logs: trigger ID, evidence, declared vs auto, max rung, envelope IDs, confidence, and who (if anyone) concurred [V2 10163], [V1 7003].

Safe defaults and hand-back

• Human support returns → automatic de-arm to rung ≤3; humans reclaim authority; mode change is announced [V2 10162], [V2 10164].
• Uncertainty or out-of-envelope → stop or escalate to the safest holding actions (airway support already started, hemorrhage control already in progress, monitoring, alert). The robot never invents unlisted drugs, doses, or procedures.
• Full black-box + human-readable log: trigger, confidence, differential, orders, actions, overrides, and de-arm reason — protected as private medical data [V1 6003], [V1 7003], [V2 10163], [V2 10170], [V2 10171].
• Override preserved: any capable human can stop or take over at any time [V2 10165], [V2 10168].
• Tension with today’s NASA-STD-3001 §10.6: the standard requires human start and human-only restart after emergency stop [V2 10174], plus override and safe defaults [5]. Contingency auto-start under defined triggers would need standards evolution (pre-authorized auto-arm for listed envelopes) while keeping override and hand-back when any capable human can act. This article does not claim that evolution has happened or that NASA has approved it.

Certification gates before any rung 4/5 use (planning, not claiming done)

None of the following is asserted as complete today:

1. Co-certification of model + robot + kit against an exploration condition list (ICL-class scale and selection logic as published for exploration planning — 120 conditions in ICL 1.0 from 443 candidates in the cited abstract) [10].
2. Blinded Earth clinical + analog + delay-sim trials with pass/fail criteria set in advance (same discipline as Part 3’s validation ladder) [3].
3. Formulary and procedure allow-lists with expiry and mismatch → quarantine still applying unless a pre-authorized rung-5 override class is logged. Part 4’s supervised pharmacy path remains the default; contingency prescribe does not silently delete quarantine for unmatched physical items [4].
4. Independent safety board + flight surgeon program approval for each envelope and for the contingency matrix (Part 3’s protocol vs each-run distinction, extended) [3][7].
5. Liability and consent remain open as in Part 1: Outer Space Treaty Article VI responsibility and supervision; Liability Convention Article VII gaps for injuries to a launching state’s own nationals / participants; no rule set found that settles care-robot patient harm in space [1][11][12].

Until those gates are real, the public status of rungs 4–5 is the same as the rest of this series: conceptual; not for clinical use.

Worked vignette (speculative)

Setting: Mars-class transit; one-way delay ~20 minutes; private medical link degraded past the mission timeout. A crewmember develops a time-critical condition on the pre-certified envelope list. The CMO is incapacitated in the same event. No other crewmember meets the matrix’s “capable authority” bar for that acuity.

1. Trigger: matrix rows “ground medical unreachable past timeout” + “CMO unable to perform” fire; evidence logged.
2. Arm: auto-arm to rung 4 for the matching envelope (not rung 5 — broader judgment not required by the matrix for this envelope). Mode announced ship-wide and queued to Earth [V2 10162].
3. Act within envelope: assess against allow-listed findings; select from approved formulary/actions; treat and assist only listed procedures; mismatch or out-of-envelope → hold / safest actions, no invention.
4. Hand-back: hours later the link returns and a capable human (flight surgeon uplink or recovered CMO) takes authority → automatic de-arm to rung ≤3; full log available for review [V2 10163], [V1 7003].

If the envelope had not matched, the robot would not invent a path — it would hold and escalate. Rung 5 would appear only if the matrix listed it for that trigger class and no narrower envelope applied.

What does NOT change

• Everyday LEO / good-link ops stay rungs 1–2 (human authority; supervised library protocols). The robot does not silently become the doctor on a normal station day.
• “Never diagnoses / no drug advice” remains the default for rungs 1–3 and for all current library drafts [2][4][15]. Contingency exceptions are gated, logged and rare.
• Privacy: contingency recordings and differentials are private medical data [V1 6003], [V1 7003].
• Educational disclaimer: nothing here is operational, FDA-cleared, or NASA-approved [16].
• Capabilities board for rungs 1–3 stays the scannable near-term matrix; rungs 4–5 live in this article and a short contingency note on the board page [13].

FAQ

Is this operational today?
No. No known humanoid has flown as a medical crewmember, and no program has cleared rung 4/5 care robots for flight. This is a thought-experiment framework for a 2027–2033 planning horizon.

What does “AGI” mean here?
A foundation planning assumption: clinical-grade models that, with a capable robot and kit, could safely diagnose, prescribe, treat and operate within certified bounds. It is not a claim that AGI is proven today, that any named product does this, or that NASA has endorsed it.

Who is liable if contingency care harms a patient?
Still an open question. Part 1 notes Outer Space Treaty Article VI responsibility/supervision and Liability Convention Article VII gaps for many crew injuries; we found no rule that settles operator vs maker vs clinician vs crew liability for a care robot in space [1][11][12].

Can the robot prescribe without a human?
Only under armed rung 4 (within a pre-certified formulary envelope) or rung 5 (last-resort broader judgment), after matrix triggers and certification gates — never as default cruise behavior. Today’s library pharmacy path (Part 4) still requires a human order and mismatch quarantine [4].

When does contingency mode turn off?
When human support returns or a capable human reclaims authority: automatic de-arm to rung ≤3. Humans can also override or shut down at any time [V2 10165]. Out-of-envelope or low-confidence states stop or hold rather than widen the mission [V2 10171], [V2 10173].

Do rungs 4–5 replace Parts 1–4?
No. They extend them for Earth-independent contingency. Near-term design, testing and library protocols remain rungs 1–3 [1][2][3][4].

Where this sits on the site

• Series hub: Robotic and autonomous medical care
• Part 1 · Part 2 · Part 3 · Part 4 · Part 6
• Capabilities board (rungs 1–3; contingency note for 4–5) [13]
• Protocol library and shared safety rules [15]
• Ground console / comm-delay tool [14]
• OCHMO-TB-044 medical operations [7]
• Disclaimer [16]

What comes next

• Keep library walks and validation work on rungs 1–3 as the near-term path.
• Treat rung 4/5 envelopes as research questions for certification design — not silent edits to RENAL/PHARM defaults. Part 6 lists the protocol-schema arming fields a future envelope must declare before it can arm.
• Any future protocol that claims contingency prescribe or operate must carry explicit arming fields, allow-lists and de-arm rules; mismatch quarantine for physical items stays unless a logged rung-5 override class is pre-authorized.

Part 5 adds the contingency half of the ladder. It does not clear any robot to diagnose, prescribe, treat or operate today.