AdastraThe Open Runtime for Physical AI01 / 11

The bodies are getting smart. The world they work in is not.

Give AI a world to run, and learn.

We do not build the intelligence inside the body. We build the mind that runs the operation around it, and the world it can join.

The Harbour District operation as a live drawn model: eighty units across nine kinds, four live cameras, a card of what the Steward did without asking, a refusal naming the authority that stopped it, and the one decision left for a personThe Harbour District operation as a live drawn model: eighty units across nine kinds, four live cameras, a card of what the Steward did without asking, a refusal naming the authority that stopped it, and the one decision left for a personA photograph of the Harbour District waterfront at morning: a ferry terminal, a lift tower and footbridge, a container crane with a drone above the yard, driverless shuttles on the quay road, delivery vans and robots at a gate
AdastraThe Open Runtime for Physical AI02 / 11

Different scenarios. One runtime.

A warehouse, a city district, a farm and a home share no machines, no vendors, no rules. They share the problem: many kinds of body in one space, people in the loop, work that has to survive. So the core names no domain at all.

  • Smart warehouseHigh-bay shuttles, VNA trucks, driverless forklifts, AMRs, sorters and picking robots.
  • Smart city servicesDrones, L4 vehicles, sweepers and patrol units share one space, from the street to the sky.
  • Crop harvest and processingSmart greenhouses, scouting and crop-spraying drones, harvesters, transport vehicles and automated processing rooms.
  • Home and social careHousehold humanoids, quadrupeds, cleaning units and smart home devices.
AdastraThe Open Runtime for Physical AI03 / 11

Every body has a place in the operation.

A participant, not a device at the end of a call: an identity, its own work, its claims, delegated authority. It can decline, explain itself, and ask.

  1. hx-2 stopped 2.4 m short of a spill and declined its route.
  2. It acts inside a delegated envelope, and one request past it was refused.
  3. It argues in its own words, and a person picks one of two costed routes.
The Aurora Care Campus operation: a humanoid, hx-2, stopped short of a spill in corridor 2-east; in the panel beside the scene its authority envelope, one request it was refused, the work it was given, its own reasons in its own words, and two costed routes with their scoresThe Aurora Care Campus operation: a humanoid, hx-2, stopped short of a spill in corridor 2-east; in the panel beside the scene its authority envelope, one request it was refused, the work it was given, its own reasons in its own words, and two costed routes with their scoreshx-2 stopped 2.4 m short of a spill and declined its route.It acts inside a delegated envelope, and one request past it was refused.It argues in its own words, and a person picks one of two costed routes.
AdastraThe Open Runtime for Physical AI04 / 11

Every machine joins through one contract.

Lifts, doors, barriers, drones, shuttles — and people — arrive from every vendor as typed capabilities. A scenario calls a verb and never learns whose machine answered.

  1. Four adapters — WebSocket, MQTT, OPC UA, ONVIF — carry every unit, and none writes the ledger.
  2. Fourteen kinds, humanoids to barriers, answer one set of verbs: move means arrive.
  3. A vendor re-reported one task 63 s later; it was merged, and dv-4 drove once.
The capability plane of one operation: a roster of twelve units — shuttles, delivery units, survey drones, a lift bank, a door, a barrier and a person — each with its adapter, its verbs, the delivery guarantee and the transfer model it declares; the four adapters that carry eleven of them, none writing the ledger; the kinds that answer one set of verbs; and one delivery unit opened, where a vendor re-sent a task and it was mergedThe capability plane of one operation: a roster of twelve units — shuttles, delivery units, survey drones, a lift bank, a door, a barrier and a person — each with its adapter, its verbs, the delivery guarantee and the transfer model it declares; the four adapters that carry eleven of them, none writing the ledger; the kinds that answer one set of verbs; and one delivery unit opened, where a vendor re-sent a task and it was mergedFour adapters — WebSocket, MQTT, OPC UA, ONVIF — carry every unit, and none writes the ledger.Fourteen kinds, humanoids to barriers, answer one set of verbs: move means arrive.A vendor re-reported one task 63 s later; it was merged, and dv-4 drove once.
AdastraThe Open Runtime for Physical AI05 / 11

All of it meets in the operation’s world model, doubts intact.

Every unit, place, claim and custody report lives in one ontology, and every fact names who reported it and when. Where two sources disagree, the model keeps both.

  1. trolley-m2 is believed in two places, so its custody reads CONTESTED.
  2. Each fact names its source and age: a grip sensor at 18:00:30, a camera eight minutes stale.
  3. Nothing moves it as cargo until one report settles which is true.
The world model of the Aurora Care Campus operation: a type browser on the left with two additions the mind proposed from the record, a graph of typed objects, and a trolley whose custody is contested with the two reports that disagreeThe world model of the Aurora Care Campus operation: a type browser on the left with two additions the mind proposed from the record, a graph of typed objects, and a trolley whose custody is contested with the two reports that disagreetrolley-m2 is believed in two places, so its custody reads CONTESTED.Each fact names its source and age: a grip sensor at 18:00:30, a camera eight minutes stale.Nothing moves it as cargo until one report settles which is true.
AdastraThe Open Runtime for Physical AI06 / 11

Highly customised scenario logic, built by agents as code.

A scenario is a versioned TypeScript bundle, identified by the digest of its bytes. Promotion moves a binding, not a deployment.

  1. An agent rewrote a gate's fairness on a branch: priority first, with 90 s aging.
  2. A type check, 42 of 42 specs, a rehearsal on today's arrivals — then a person applies it.
  3. Missions already in flight stay pinned to the digest they started on.
A scenario the Surveyor agent wrote for the Riverside Cold Chain operation: the gate policy in TypeScript with the agent's own line on why this shape, its diff against the bound version, the lockfile, the specs including one written after rehearsal, and the binding a person may promoteA scenario the Surveyor agent wrote for the Riverside Cold Chain operation: the gate policy in TypeScript with the agent's own line on why this shape, its diff against the bound version, the lockfile, the specs including one written after rehearsal, and the binding a person may promoteAn agent rewrote a gate's fairness on a branch: priority first, with 90 s aging.A type check, 42 of 42 specs, a rehearsal on today's arrivals — then a person applies it.Missions already in flight stay pinned to the digest they started on.
AdastraThe Open Runtime for Physical AI07 / 11

When a machine is unsure, a person sees what it sees.

Remote assist is not a joystick. The machine shows what it grounded and the verbs it may use, and a person picks one.

  1. Two bins, neither label readable: hx-1 stopped and asked instead of guessing.
  2. It has solved the grip on the left bin and not committed to it.
  3. The answer is one of its own verbs; those it may not use are marked refused.
A person looking through a humanoid's own head camera at two unlabelled bins on a carrier's deck, the unit's detections drawn on the frame, a strip of the last sixty seconds it sensed and did, and its verbs listed beside it with two refused, one by a fence and one by its authorityA person looking through a humanoid's own head camera at two unlabelled bins on a carrier's deck, the unit's detections drawn on the frame, a strip of the last sixty seconds it sensed and did, and its verbs listed beside it with two refused, one by a fence and one by its authorityTwo bins, neither label readable: hx-1 stopped and asked instead of guessing.It has solved the grip on the left bin and not committed to it.The answer is one of its own verbs; those it may not use are marked refused.
AdastraThe Open Runtime for Physical AI08 / 11

Every operation leaves the next one wiser.

Six organisations under one operator share one data source and nothing else. What one site learns reaches the next as a shape, never a record.

  1. Six organisations on one data source, each a row-level boundary, never a merge.
  2. A gate rule that held in 23 of 24 operations arrived at Riverside as a seed.
  3. Tidewater has run on its own journal for nearly nine hours.
Six operations under one operator, each with its bound scenario and digest, missions in flight, units reporting and Companion mode; the bindings that moved this week and what stayed pinned; four things needing a person across four organisations; and one site running on its own journal with no uplinkSix operations under one operator, each with its bound scenario and digest, missions in flight, units reporting and Companion mode; the bindings that moved this week and what stayed pinned; four things needing a person across four organisations; and one site running on its own journal with no uplinkSix organisations on one data source, each a row-level boundary, never a merge.A gate rule that held in 23 of 24 operations arrived at Riverside as a seed.Tidewater has run on its own journal for nearly nine hours.
AdastraThe Open Runtime for Physical AI09 / 11

Work that survives the failure.

A mission is a journal, not a process. When the host goes, every mission replays to where it was, and a command already sent is correlated, not re-issued.

  1. The host restarted at 09:37:20 with twelve missions on the line.
  2. Twelve journals replayed in 4.1 s, six of them from inside a step.
  3. tool-swap-2 resumed at step 17: its open vendor task was correlated.
Twelve missions running on one assembly line, drawn as lanes over time: a claim one mission holds that a second is queued behind, three lanes waiting on a fence, and a host restart marked across every lane with the journal that replayed through itTwelve missions running on one assembly line, drawn as lanes over time: a claim one mission holds that a second is queued behind, three lanes waiting on a fence, and a host restart marked across every lane with the journal that replayed through itThe host restarted at 09:37:20 with twelve missions on the line.Twelve journals replayed in 4.1 s, six of them from inside a step.tool-swap-2 resumed at step 17: its open vendor task was correlated.
AdastraThe Open Runtime for Physical AI10 / 11

Autonomy, inside a boundary.

Agents act on delegated authority, and a site adds rules of its own. Every request is dry-run first, and what needs a person waits for one.

  1. The site's rule: barrier-q1 opens only after a person on the quay acknowledges.
  2. The Planner's request is dry-run first: every effect listed, nothing actuated.
  3. It may request and re-plan, never acknowledge for a person — so its apply was refused.
A request from a running scenario to open a quay barrier on the Harbour District operation: the six checks it has to pass with the source and age of each, the site’s own rule written as TypeScript, the authority envelope in force, a dry run with nothing actuated, and two refusals, one by site policy and one by authorityA request from a running scenario to open a quay barrier on the Harbour District operation: the six checks it has to pass with the source and age of each, the site’s own rule written as TypeScript, the authority envelope in force, a dry run with nothing actuated, and two refusals, one by site policy and one by authorityThe site's rule: barrier-q1 opens only after a person on the quay acknowledges.The Planner's request is dry-run first: every effect listed, nothing actuated.It may request and re-plan, never acknowledge for a person — so its apply was refused.
AdastraThe Open Runtime for Physical AI11 / 11

The site keeps running when the cloud does not.

The Companion is the same runtime, at the site. With the uplink down it carries every admitted mission to its end, and replays its journal when the cloud returns.

  1. Tidewater Port has had no cloud for nine hours.
  2. The night shift ran anyway: 41 missions finished on site, 3 still in flight.
  3. Two carriers settled a one-at-a-time gate in 61 ms, with the Companion as witness.
The Tidewater Port operation nine hours after its uplink dropped: forty-one missions finished, thirty-nine of them on the digest the cloud bound, a peer-to-peer card where two carriers settled a capacity-one gate between themselves in 61 milliseconds, the buffered journal, the one refusal that is the cloud's to lift, and two live camera feeds at night, one from the gatehouse and one from the carrier waiting its turn at the gateThe Tidewater Port operation nine hours after its uplink dropped: forty-one missions finished, thirty-nine of them on the digest the cloud bound, a peer-to-peer card where two carriers settled a capacity-one gate between themselves in 61 milliseconds, the buffered journal, the one refusal that is the cloud's to lift, and two live camera feeds at night, one from the gatehouse and one from the carrier waiting its turn at the gateTidewater Port has had no cloud for nine hours.The night shift ran anyway: 41 missions finished on site, 3 still in flight.Two carriers settled a one-at-a-time gate in 61 ms, with the Companion as witness.
Arrow keys to move · F for full screen · Esc to leave01 / 11×