Product
Five services. One layer.
Everything above hardware and below your business. Each piece is separately deployable, and none of them can be replaced by a better model.
Work Engine
A business objective in. Verified physical work out.
A named standard decomposes deterministically. When a customer writes cleanliness: 'hotel_standard', that string is a contract somebody signed and may dispute — it has to mean the same five things every time.
A model improvising a different task list per room would make the completion report unauditable, and the completion report is what we sell.
Below that, the WorkGraph expands recursively — but only where no single skill can do a task whole, and only when a machine is about to run it.
WorkGraph
Expand it yourself.
A node stops decomposing the moment a published skill can execute it whole — not at a fixed depth. So “replace the towels” is a leaf and “make the bed” is three levels deep, purely because one has a skill and the other does not.
Expand a node and it stops as soon as a published skill can execute it. Nothing decomposes to a fixed depth: “replace the towels” is a leaf and “make the bed” is three levels deep, purely because one has a skill and the other does not. Publish a make-bed skill tomorrow and that subtree disappears.
Fleet
Deploy, monitor, audit, benchmark.
Audit is not a feature here — it is the reason an enterprise can adopt at all. Every autonomous action has to be reconstructable after the fact.
The interface is the real one. The fleet, the job counts and the savings figure are illustrative — see what is real.
State before metrics
A supervisor with 800 robots needs to know which ones need them, right now. Only needs assistance reads as an alarm — colouring “charging” red teaches operators to ignore red.
Never a filled-in number
An unreachable service is reported as unreachable. A console that substitutes a plausible figure has someone making decisions about a fleet while looking at a default.
Inspector
The first commercial surface.
Walk in, scan, walk out with an estimate you can defend. Every quantity carries a tolerance, because an estimate with no stated tolerance is a guess wearing a number — the contractor either over-buys every job or eats the shortfall on some of them, and never learns which.
Findings arrive as hypotheses with the evidence that would confirm them, ordered cheapest and least destructive first. That is what lets the machine ask “do you want me to inspect behind the sink?” instead of guessing.
And when no perception provider is wired, it shows a blocker rather than a number. A takeoff built on invented geometry is the one failure that would kill this product: the contractor prices the job, wins it, and finds out on site.
Edge · safety
A model requests. Only the governor permits.
Force, speed, geofence and e-stop are enforced in the runtime, beneath the model, deterministically. No enterprise deploys machines whose safety depends on what a model decided to do.
Speed clamps. Force refuses. Ask for 3 m/s and you get 1.2 — the job continues. Ask for 200N on an 80N body and you get nothing, because that is not a request to push gently, it is a misjudged task.
Edge · offline
Then take the network away.
Warehouses, construction sites and basements have bad networks. A runtime that needs the cloud is not a runtime.
Offline, the machine keeps working with degraded autonomy — a cached plan it has already proved here, and verification that reports uncertain rather than guessing. Uncertain work never counts toward Verified Autonomous Jobs, which is the honest answer: nothing checked it.
Skills · WorldGraph · Edge
The three that compound.
Skills
A skill declares what a body must be able to do — never who made it. A manifest naming a robot brand is rejected at publish time, because the first one accepted turns the registry into a pile of vendor plugins.
WorldGraph
Every attempt, correction and outcome. It answers the question nobody with a frontier model can: which model, body, skill and environment combination actually completes paid work.
Edge
Runs on the machine with zero dependencies, because a runtime with a dependency tree fails to install on the Jetson that matters. Offline-first, with the safety governor beneath the model.