Robotics

A fleet of robots built around a local language model, running fully offline. A central server — the Heart — holds the model, the knowledge corpus and the archive. Individual units connect to it, and each one enforces its own permissions.

Voice, a wired console and a LAN API all normalise into a single command envelope. Deterministic perception feeds a "was I addressed" gate before anything reaches the model, and the model acts only through a fixed set of tool calls.

No cloud. No accounts. No eavesdropping. The main model has no network namespace at all.

How it is put together

Seven decisions shape the architecture, and most of them are about what a compromised component is still unable to do.

Platforms: 8
Flagship: Barty
Model: Local, offline
World model: 3D voxel
Knowledge corpus: 320 GB
Identity: Ed25519 + SE
Repository: Private

The software is built and tested. What remains is mostly hardware that has not arrived yet, or a person in the room to operate it.

Offline by default

The main model has no network namespace. Web search, where it is used at all, runs on a separate cheap outer machine joined to the rest by two unidirectional serial links — a data diode, not a firewall rule.

The Heart routes; each unit enforces

The server resolves a destination and forwards a proposal. The destination's own authorization gate decides. A compromised Heart can drop, delay or misroute an instruction — it cannot manufacture one.

Signed grants for cross-unit instruction

Telling one robot to instruct another needs a grant signed in a physical-presence ceremony, naming destination, tool, arguments and expiry. The destination verifies the signature itself, and never takes the Heart's word that a grant existed.

A secure element in every unit

Each unit's identity is a keypair whose private half never leaves a secure element. Identity is proved by signing a challenge, never by presenting an identifier.

Hub and spoke, not a mesh

Units connect to the Heart and cannot address one another. All cross-unit traffic transits the Heart, where it is mediated.

Routines you build by talking

A routine composes tools that already exist and never becomes a new capability. It is authorized as the invoker and capped at its author's authority, and every step is authorized individually.

A guest tier that is genuinely walled off

The lowest rank gets ambient facts and a public corpus. No vault, no world model, no sensors, no history, no network.

The fleet

Eight platforms, one architecture

Every unit runs the same fleet code and the same permission model. What changes is the body.

Barty Flagship

A head, torso and arms unit — the full-capability platform every other unit is a subset of. The current build target: the software is essentially complete, and what remains needs hardware in the room.

Alnita

The culmination — a full humanoid where the other robot lines merge. A long-term end design, not yet scheduled.

Diu

A head-only unit: perception, voice and presence without a body. Specified as a platform.

Ronny / R-Swarm

An aerial unit that carries no model of its own — it flies a signed mission and reports back. The mission format is specified in full and implemented in the shared fleet code.

Lugh / L-Swarm

A multi-legged walking unit with no head or arms, built to range out and collect samples.

Picky

A stationary gantry that lifts tiny components out of trays with a vacuum nozzle and places them on a circuit board, down to 0402 parts. Fully specified and partly built.

Sentry

Deferred by design.

Heart & Wings

The two companion applications. Heart runs on the server and holds the chat log, recordings, registered people and the routines built by voice; Wings is the operator-side app that connects to it.

Two rules worth stealing

The camera finds where the board is, never what belongs on it.

That is Picky's placement rule. Component positions come from the centroid file the design tool already wrote; a scan that disagrees with it is a fault, not a plan. And a board is a single signed job that the machine verifies once — not two hundred separate remote commands that would put the network in the path of every placement.

Lost-link is precisely when a unit knows least about whether finishing is affordable.

That is Ronny's. An aerial unit finishes a mission only if its remaining budget covers finishing and returning. Otherwise it abandons and comes back now.

Follow the build.

The robot repository is private for now. Everything else we make in the open is on GitHub.

View the code on GitHub