ENGINEERING NOTES
Design notes, published as we build.
How we are reasoning about the system while it is being built: constraints, architecture decisions, and the problems still open. Dense on purpose.
All notes
- Architecture
- Physical AI
- Safety
- Deployments
- Sovereignty
- Company
Company
Why we publish before we ship
There is a conventional way to bring infrastructure to market, and it involves staying quiet until there is something to announce. An account of why this site does the opposite, and what that costs.
· 7 min read
Physical AI
The long tail belongs to the building
The distance between a robotics demonstration and a robotics deployment is a long tail of situations particular to one site. Why that tail cannot be closed centrally, and what a learning loop has to look like if it is going to close it at all.
· 8 min read
Architecture
The facility is the datacenter
A working fleet generates its most valuable training signal on the wrong side of the boundary for any cloud to use. The case for treating the facility itself as the unit of compute, coordination, and learning.
· 7 min read
Sovereignty
An audit trail a regulator can read
An operator owes an outside reviewer a credible account of what their autonomous systems are doing, and cannot let the material behind that account leave the site. The contradiction dissolves once evidence and data stop being treated as the same substance.
· 8 min read
Deployments
Austere sites and the emitting uplink
In every other environment, connectivity is something an operator would like and cannot always have. At an expeditionary site it is something they may have and must sometimes refuse, because an emitting uplink is a signature and a reachback path is an exfiltration path.
· 8 min read
Safety
Reconstructing an incident after the fact
When an autonomous machine does something unexpected, the questions arrive with urgency and the answers depend entirely on decisions made months earlier about what was retained. What a reconstruction actually needs, and why telemetry is not it.
· 7 min read
Sovereignty
Attesting a machine that moves
Attestation was invented for servers in locked rooms. Machines that work in yards, corridors, and forward sites need it more — and need it to mean more. What integrity has to look like when the computer has wheels.
· 6 min read
Deployments
Seasonal fleets and the field boundary
Agriculture breaks two assumptions the other environments share. The work happens in a short annual window rather than shift after shift, and the boundary that compute is supposed to stay inside is a field rather than a building.
· 8 min read
Safety
Degraded modes and the order things fail in
The fully healthy configuration is the easiest state to build and the rarest state to be in. A fleet system's real behavior is defined by its degraded modes, and most systems have degraded modes that nobody designed.
· 7 min read
Physical AI
Teleoperation inherits every constraint
Putting a person on the far end of the link does not remove the network from the control loop. It adds a person to it. Teleoperation is a supervisory layer above a locally autonomous machine, never a replacement for one.
· 8 min read
Deployments
Linear infrastructure and the thin uplink
Inspection fleets for energy and utilities break the assumption that a facility is the unit of deployment. When the asset is a corridor of small unstaffed sites rather than a building, where the compute lives becomes a genuinely open question.
· 8 min read
Architecture
Keeping what the fleet saw
A fleet records continuously, and forever is not an option even inside your own building. Learning, investigation, and operations want different things from that record — conflating them produces a storage design that serves none of them.
· 8 min read
Physical AI
The latency budget is a physics problem
A control loop's budget is set by the dynamics of the task, not by product requirements. Working through where the milliseconds go — and why a network round trip can't be one of the line items.
· 6 min read
Sovereignty
Who holds the keys
Sovereignty claims are cheap and custody questions are not. Who can decrypt the data, who can sign what the fleet will run, and who can revoke a machine's ability to work are the three questions that describe the real power structure.
· 8 min read
Architecture
Power, thermal, and the siting problem
Putting accelerator-class compute inside a working facility is a building problem before it is a software problem. Power, heat, dust, noise, physical access, and service are the constraints that decide whether onsite compute can be installed at all.
· 8 min read
Physical AI
Simulation to real without leaving the site
Every artifact in a sim-to-real loop is site-specific, from the scene to the evaluation scenarios. The gap worth closing is a local gap, which puts the whole loop on the wrong side of the boundary for any external simulator to reach.
· 8 min read
Deployments
Ports and yards are radio canyons
A container terminal is a structure built out of cargo, and stacked steel is as opaque to radio as anything an engineer would design on purpose. What defeats the usual mitigation is that the obstacles move, because the obstacles are the work.
· 7 min read
Architecture
Scheduling a fleet that cannot wait
Task allocation for machines is not job scheduling with a different noun. Work has a location, the resources include shared space, and a queued task goes stale — so the real design is admission control and a declared degradation order.
· 8 min read
Physical AI
What a vision-language-action model asks of its host
A large learned policy is not an application you install on a robot. It is a workload with residency requirements, a latency distribution, an input contract, a thermal profile, and a lifecycle, and the machine underneath has to be designed against all five.
· 8 min read
Deployments
Warehouse fleets and the coordination ceiling
Fulfillment is the archetype that puts the most machines in the least space, so the binding constraint is coordination cost rather than connectivity. Coordination scales badly, and where it stops scaling is set by how fresh the fleet's shared picture is.
· 7 min read
Physical AI
Designing for the link that is not there
Offline is not one condition. It is at least five, and a system that treats them as a single failure state will behave badly in all of them. What it actually costs to design disconnected-first.
· 8 min read
Sovereignty
Provenance below the software
Every integrity argument above the hardware rests on an assumption about the hardware, and the assumption is usually inherited rather than examined. What a supply chain has to be able to answer when the computer is attached to something that moves.
· 8 min read
Safety
Worst-case execution is a different discipline
Two kinds of computing with incompatible definitions of good end up on the same physical node. Walking through the mechanisms by which a throughput workload steals determinism from a control loop, and what real separation requires.
· 7 min read
Physical AI
Data gravity is not a bandwidth problem
A fleet's sensor stream is too large to move and too revealing to release, and the second half is the one that decides the architecture. Why cost, law, and competitive exposure all point the same direction.
· 8 min read
Deployments
The line does not stop for the network
A production line runs to a takt, and a stoppage propagates through buffers that were never sized to absorb it. That is why a runtime dependency on a link outside the building is a scheduling risk rather than an IT risk.
· 8 min read
Architecture
An onsite inference plane is not a small cloud
Calling the facility plane a private cloud imports assumptions that are false onsite — elasticity, tenant isolation, a control plane above, someone with a shell. What survives the move, and what has to be designed differently.
· 7 min read
Architecture
The shared world model is not a map
A fleet needs a current, common representation of the space it works in — not a static map, and not a pile of private per-robot beliefs. What that structure has to hold, and why consistency is the hard part.
· 7 min read
Sovereignty
Signed bundles and the cost of rollback
Getting an update across an air gap is the part teams design carefully. Getting it back off is the part they improvise. Why the reversal path deserves the same rigor, the same evidence, and the same storage as the forward one.
· 8 min read
Safety
The safety case and the learned component
A safety case is a structured argument backed by evidence, and none of its usual evidence attaches to a large learned policy. The architectural answer available today is to remove the policy from the argument entirely.
· 7 min read
Architecture
Time is the first shared resource
Clock synchronization gets treated as plumbing. In a fleet it is a correctness dependency — fusion, deconfliction, and incident reconstruction all fail quietly when the participants disagree about when things happened.
· 8 min read
DESIGN PARTNER PROGRAM
Build this with us.
We are working with a small number of teams operating real fleets in constrained environments. If the cloud is not an option where your machines work, we want to talk.