Compute placed where the work happens.

The edge node is the compute payload that travels with the machine — mounted on it or integrated inside it. It runs what cannot tolerate distance: perception over the machine’s own sensors, vision-language-action inference for manipulation and navigation, and the local autonomy that keeps the machine productive when nothing else is reachable.

Its defining constraint is the safety-path separation. Everything learned — perception, policies, planners — runs on the throughput side of the node. Interlocks, stop authority, and motion limits live on an isolated control path with bounded timing that does not share fate with inference. A model can stall, restart, or be replaced mid-shift; the machine’s ability to stop safely never depends on it.

The node is being designed as a sealed unit in the same discipline as the rest of the platform: a signed, read-only image, a single defined workload, and attestation before it is allowed to participate in the fleet. A machine that cannot prove what it is running does not get work.

The facility plane is the heavy end of the system: sealed compute installed inside the customer’s boundary, sized for the fleet it serves. It carries what is too large or too shared for any single machine — the models that need real accelerators, and the coordination state that belongs to the facility rather than to a robot.

Its first job is fleet coordination: task allocation, deconfliction, and a shared world model that lets machines act on common, current knowledge of the space they work in. Its second is heavy inference — the queries too expensive for the edge, answered across the local network in local time. Both stay inside the fence, so the facility’s video, telemetry, and layouts never leave it.

The third job is adaptation. A working fleet generates the most valuable training signal that will ever exist for that facility, and it is generated on the wrong side of the boundary for any cloud to use. The facility plane is designed to run scheduled adaptation on the day’s data — overnight, inside the boundary — so the fleet gets better at this facility’s work without the data going anywhere.

The fleet plane is how an operator runs many sites without dissolving the boundaries that make each site sovereign. It provisions nodes, distributes models and updates as signed bundles, collects attestation evidence, and rolls up audit records — the administrative spine of the system.

Its design constraint is asymmetry: authority flows down, evidence flows up, and operational data does not flow at all. The fleet plane can prove that a site runs approved software on untampered hardware without ever seeing that site’s video, telemetry, or throughput. For air-gapped sites, the same functions operate by bundle transfer across the boundary instead of by connection.