Deployment
One site. One workflow. Thirty days, live.
A brownfield operation with machines from more than one vendor and shared infrastructure, run by your people on a runtime you keep. A runtime runs programs, and ours runs the operation: scenarios are the programs, missions the processes, the world model the memory, verbs the system calls. Bounded on purpose.
The pilot fits when
- One site, one workflow, chosen together in week one.
- Two or more kinds of machine that do not share a vendor, or one kind plus the infrastructure it shares: lifts, doors, chargers, gates.
- An existing fleet manager or open middleware we integrate behind, not replace.
- A person with authority to hold the stop, and a network we can put a Companion on.
And what it is not
- Humanoid pilots: scoped as their own programme, because the body's own model is the long pole and we do not pretend otherwise.
- District-scale operations and public infrastructure: scoped as their own programme, with the authorities they involve.
- Greenfield sites with one vendor and nothing shared. You do not need us yet.
What stays yours.
The build is pinned
Your site runs the digest you promoted, and moves when you move it.
Execution is local
The Companion runs the operation at the site. The uplink is for planning and evidence.
Isolation is in the database
Your organisation is a row-level invariant, not a filter somebody remembered to add.
Every change passes one gate
Yours, an agent's, or the loop's. Same object, same review, visible to you.
Rollback is a binding
Promotion moves a pointer. So does undoing it.
Authority is delegated, explicitly
What a Companion may decide alone is written down, and what must wait for the whole picture waits.
One build, two places it lives.
Nothing is a fork. A site on its own hardware runs the build it was pinned to, and moves when you move it.
Cloud
Your operation, isolated at the database. Upgrades, observability and recovery are ours. The fastest path from a signed pilot to units moving.
Companion
The same software beside the machine, in the cell, or as a rack at the site. It runs with the uplink down and reconciles when it returns, and the site decides what crosses the uplink.
Three radii, one softwareWe have not seen your operation. That is the ordinary case.
A kind of unit we have never driven is data, not a release, and the system you already run is something we integrate behind rather than over. Your operation never learns which vendor is on the other end, which is the whole point of putting one there.
A kind we have never driven
It arrives as an adapter declaring its verbs, what it guarantees when it reports, and how custody passes. The core never learns what it is, which is why a kind nobody here has met is a day inside week one rather than a release you wait for.
An interface that answers badly
Vendors issue their own task ids, and some issue none at all. The adapter synthesises the key, and a job reported twice under two ids a minute apart is merged rather than driven twice. Nobody gets exactly-once at a vendor boundary by assuming it, so nothing here assumes it.
The system you already run
Your fleet manager keeps doing what it is good at, and so does the open middleware beside it. We own the layer above them: what the work is, who may do it, what holds a resource, and what happened.
A lift, a door, a barrier, a drone, a shuttle and a person, each behind a typed contract none of us wrote, all answering out of one verb surface.
The capability planeWhat actually happens.
No discovery phase that produces a slide deck. Thirty days, four steps, and each one answers the thing you are right to be worried about.
You have never seen our site.
So week one models it with you: spaces, units, vendors, shared resources and the rules you actually run by, as data rather than a statement of work. None of your operation is compiled into anything.
Our edge cases will break it.
Your first scenario runs in simulation against that model. The contended lift, the hand-off between two vendors, the capability that answers late: the failures you are worried about happen here, before anything moves.
It will move without asking.
The same scenario drives real hardware, with a person holding the stop and the authority envelope written down. A unit that cannot say where it is does not move, and neither does what it was carrying.
We will depend on you forever.
You take the keys. Your team edits the operation, your agents propose changes, rollback is a pointer you move, and the site keeps running the digest you promoted whether or not we are on the call.
Bring the workflow that exposes the whole operation.
A shared door, a charger, a lift, a hand-off between two vendors that have never agreed on anything: pick the constraint that makes the seams visible. Thirty days later your people are running that workflow themselves, on a runtime that stays where you put it, and what the operation learned is yours to take to the next one.