The A1's Jetson Xavier NX has no PyTorch, ONNX runtime or TensorRT. So the policy ships as a flat weight file and a hand-written C++ forward pass (292,255 parameters: CENet encoder, velocity and latent mean, actor), checked on the robot against a PyTorch test vector: max difference 7.1×10−7 on the first export.
The contract
Most hardware failures here were silent mismatches, not physics. Each export has a written contract: observation order and scaling, joint order (breadth-first, unlike the URDF and the SDK), default pose, action scale, gains. The first one had the rear thigh default wrong, and it didn't say the history is ordered by observation term, which is the mistake the C++ then made.
Safety
Before the first run I fixed three defects in the inherited loop. A NaN action passed the clip (both comparisons are false) and reached the motors; now it holds stance. The tilt abort didn't latch, so a robot on its side re-primed itself after 3 s; now it latches into damping. The stall watchdog was one-shot per session; now it re-arms. And the inherited -ffast-math build flag makes g++ 7.5 fold std::isfinite() to true, deleting the NaN guard; the binary now tests its own guard at startup and refuses to run.
The test ladder
Every step that can move a motor needs my explicit go-ahead, because even a dry run applies damping torque. In order: weights against PyTorch; observation tests (gravity, joint permutation, defaults, and since Aug 16 history order, using values that encode their own position); a passive remote check, which found both horizontal stick axes inverted against Isaac Lab; robot hung with damping only; hung with live gains; then the ground, on a rope.
Before installing an export I now run the real control binary against the real weight file with a deliberately bogus recovery path: it loads the actor, prints provenance and exits before touching the motors. On Aug 22 I had verified a new file with a freshly built test binary, and the service binary turned out to be an older build that couldn't read it.