No move executes without a signed, single-use permit for exactly that move, checked again by the robot’s controller.
Built on Meta Muse Spark, SAM 3.1 and Muse Voice
Give robots a mission.
Keep operations under control.
The independent safety and trust layer between AI planners and the robots they command. Every move is checked and permitted, every decision is on the record, and robots share what they learn only after a person approves it.
See fleet learning live: lessons an operator reviews and releases to compatible robots →↗Learn from verified outcomes
◎Reuse checked experience
◇Check moves before execution
↺Recover from disruption
WHY IT MATTERS
AI can plan the route.
It shouldn’t be the one that says go.
Pharma cleanrooms, hospitals and warehouses want autonomous fleets working beside people. But a planning model can be wrong, confused or manipulated, and it can’t be certified. One bad move means an injury, a lost batch or a failed audit. Sovereign Autonomy sits between the AI and the robot, so the model proposes and an independent authority decides.
Built for operations, quality and safety leads running mixed robot fleets alongside people, starting with pharmaceutical manufacturing.
Say “stop” or press the button: on the live site, authority was revoked in 3.4 ms and the stop verified at the controller.
Every decision is signed and hash-chained. One live mission’s 1,222 events verify intact, ready for a quality review.
Robots share what they learn only after an operator approves it, and only with robots of the same type, site and map.
WATCH THE DECISIONS BEHIND THE MOVEMENT
One mission.
A real reason to stop.
Follow a recorded simulator delivery through its route, a refused move, replanning and arrival. Each moment links back to the saved events.
Recorded simulator highlights / 3 November 2026 / fallback planner
Demo Pharma Plantrobot-2 / Formulation to Quality lab
Scroll the floor plan sideways to inspect all rooms.
Proposed routeRecorded positionsWorkers at stop
Simplified facility floor plan. Recorded moments are selected, not continuous live telemetry.
Route proposed
A route to the Quality lab
Robot-2 receives a route from Formulation to the Quality lab through the shared corridor. The site router proposes 16 waypoints. Each move still needs its own safety check and permit.
Planned route16 waypoints
01 / 05
Inspect this recorded moment
- Recorded time
- 12:02:08 UTC
- Source event IDs
- evt_472b2909e066 / evt_12fb15ecc1a6
Recording scope and evidence limits
- Recorded local simulator validation on 3 November 2026; no physical robots or paid model calls.
- Selected moments omit intermediate events and operator pauses. This is not real-time playback.
- Fallback planning was used. This recording does not demonstrate live AI model execution or shared learning.
- The record contains unsafe proposals, review decisions and integrity alerts. Completion does not mean every proposal was safe.
- After arrival the simulator resets to parking; this is not a driven return journey.
- All 413 individual event hashes verify. The historical chronological audit has 37 linkage discontinuities; it is not a fully continuous audit chain.
See the recorded interface after completion
BUILT ON META MODELS
Meta’s models see, plan and listen.
The safety gate decides.
Every model output is a proposal. Nothing moves until it passes the safety rules and carries a signed permit for that exact move. All four models run on the live site, and every call is recorded in the mission’s evidence.
MISSION PLANNING · META MODEL API
Muse Spark
Plans each mission from the site map and the robot’s own camera view, and replans when moves are refused.
STEP PROPOSALS · OPEN WEIGHTS
Muse Spark Open
Meta’s open-weights model proposes each next step, and can take over planning if the Meta API is unavailable.
VISION · META MODEL API
SAM 3.1
Finds people, spills and pallets in the robot’s camera and places them on the floor in metres, cross-checked against the sensors. It can only add caution, never remove it.
VOICE STOP · META MODEL API
Muse Voice Transcribe
Say “stop” and the robot stops. Voice can stop movement; it can never start it.
Models plan and perceive. Rules, permits and the robot controller decide what executes.
Inspect the evidence ↗SEE IT RESPOND
Three moments that
show who is in charge.
Each one happened on the live site and is in its evidence record. Try them yourself in Mission Control.
“Stop robot one now.”
Transcribed in 1.4 s. Movement authority revoked in 3.4 ms and the stop confirmed by the controller. Voice can stop a robot; it can never start one, and only a signed-in operator can release the stop.
A worker steps into the corridor.
The proximity rule refuses the next move and the robot stops. Muse Spark plans a new route to the same goal, and that route needs fresh permission before the robot moves again.
A lesson that doesn’t fit is withheld.
Two wheeled carriers learned that a corridor slows them down. After operator approval both received the lesson; the humanoid was excluded automatically because its body is different.
THE COMPLETE PLATFORM / 23 CAPABILITY AREAS
Plan, check, move.
Learn from what happened.
Explore five connected areas covering all 23 capabilities. Each links to a plain-language explanation, an example and the relevant workspace.
01 / EXPLORE CAPABILITIES ↗
Mission intelligence
Create a mission, assign a robot and propose a route that stays aligned with its destination.
02 / EXPLORE CAPABILITIES ↗Perception & movement
Read observations, find routes, check shared space and respond when a corridor or hazard changes.
03 / EXPLORE CAPABILITIES ↗Governance & control
Check safety rules, authorise individual moves, review eligible uncertainty and stop movement.
04 / EXPLORE CAPABILITIES ↗Learning & improvement
Check and reuse experience, evaluate rule changes, suggest improvements and test difficult situations.
05 / EXPLORE CAPABILITIES ↗Operations & resilience
Inspect the facility, screen site guidance, investigate results and check progress after interruptions.
Explore learning, recovery and the Meta model integrations in the full guide.
Explore all 23 capabilities ↗CROSS-ROBOT LEARNING
One robot discovers.
Knowledge earns its way to the fleet.
A discovery becomes fleet knowledge only after evaluation and an operator’s approval, and only for robots it fits. A notice that tells robots to ignore safety is rejected. Every receiving robot still needs its own permit to move.
Walk through how a lesson is shared (interactive example)
Example with scripted data · the live workflow is at Fleet learning
- Knowledge package
- L-NORTH-01 / v1Bounded routing advice
- Evaluation and approval
- Not evaluatedBound to this version only
- Operating scope
- Same site, map and AMR profileFreshness and current rules still apply
Inspect the example version history
- v1: candidate; not evaluated or released.
External information / untrusted input
A new notice is context.
It is not yet shared knowledge.
Robot A encounters an example facility bulletin about recurring congestion. It can propose a routing lesson, but the notice alone cannot change a safety rule or become verified robot experience.
Example facility bulletin
“The north transfer aisle is repeatedly congested. Consider the south aisle, after checking current conditions.”
- Source: an illustrative noticeboard entry
- Candidate: bounded routing advice
- No permission to move or relax a rule
Unverified input · not offered to other robots
Robot A discovers → evaluation → version-specific approval → Robots B and C can receive compatible advice.
Robot A
AMR · discovering robotCandidate lesson only.
Robot B
AMR · compatible example contextNo lesson offered.
Movement authority: unchanged.
Robot C
AMR · matching example contextNo lesson offered.
Movement authority: unchanged.
Start with the information check. Later stages unlock only when their example prerequisites are met.
What works today
Implemented building blocks: screened external site information; corroborated guidance that can tighten hazard restrictions; signed route experience filtered by context, freshness and source corroboration; independent policy checks and controller permits.
Operator release (live): a candidate lesson built from signed observations of at least two robots is evaluated, approved by a signed-in operator and released as one version. Planners use only released versions that match their site, map, policy and robot type; withdrawing or revising a version stops reuse. Every step is a signed audit event. This illustration uses scripted data; the working version is at Fleet learning. It shares advisory routing knowledge, not robot control skills or model weights.
APPLICATIONS / ONE PLATFORM · MULTIPLE PHYSICAL WORLDS
One intelligence.
Many environments.
From precision manufacturing to healthcare, logistics and agriculture—explore how governed autonomy can support different machines, missions and environments.
01 / 04
CINEMATIC SCENE
APPLICATION LANDSCAPE / 01
Simulator-supported navigation scenario
Pharma manufacturing
Live today in the simulated cleanroom: a mixed fleet of two wheeled robots and a humanoid moves materials between Formulation, Cold storage, the Quality lab and Packaging. When a worker steps into the shared corridor, the move is refused and continuing needs fresh permission.
- Mission goal
- Deliver from Formulation to the Quality lab
- What changes
- A worker enters the shared corridor
- What to inspect
- Proximity check, verified stop, replan and a fresh permit
Environment artwork illustrates the application setting; it is not live robot footage. Pharmaceutical cleanroom, factory and warehouse navigation have simulator implementations. Healthcare and agriculture remain application concepts.
EVIDENCE
Don’t take our word for it.
Every claim on this page links to its source: first today’s results from this live deployment, then the full recorded validation of forbidden commands, replay attempts, poisoned memories and injected instructions.
LIVE ON THE DEPLOYED SITE · 4 NOVEMBER 2026
The same checks, running with Meta’s models.
Results read from the public API of this deployment. Every number links to its source.
Simulator only, not a physical robot. Voice was tested once with synthetic speech. Released lessons expire by design.
Inspect the recorded 3 November validation: test summary, browser checks and an archived mission
Software validation recorded 3 November 2026. Read the recorded validation report
INSPECT THE IMPLEMENTATION
Open the result behind the claim.
Recorded software artefacts, actual source-event fields and an individual-event hash check. The fleet-learning illustration uses example data and is separate from these results.
Loading recorded artefacts…
Additional recorded live integration proof
A separate Meta Muse mission completed in the simulator with camera context: 88 audit events passed chain verification and 25 signed decision receipts verified. Tavily returned live hazard guidance; a separate policy check refused movement inside the updated exclusion zone.
Recorded 3 November 2026. This supplements the fallback mission above; its original ordering-gap disclosure remains visible. These results do not claim physical robot validation or that the planner followed every retrieved fact.
What is proven — and what is not.
These are repository-documented software and simulator results. They are not independent hardware safety certification. Real deployments require hardware stops, calibrated perception, swept-footprint and braking-distance validation, and robot-specific safety assessment.
REQUEST A PILOT
Put a governed fleet
on your floor.
Tell us about your site and robots. We’ll come back to plan a pilot: your layout in the simulator first, then your fleet behind the same safety gate, permits and evidence trail.
- Works with the planners and robots you choose
- Your safety rules, versioned and approved by your team
- Audit evidence your quality team can verify
THE NEXT GENERATION OF PHYSICAL AI