CAIRN

An uncrewed site that keeps working through two weeks without a link: every machine under a mandate signed before the silence, every unit of power paid for, and the whole fortnight replayable when contact returns.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Off-world site operator. Machines that dig, mine and build through a solar conjunction, inside budgets signed before it.
• Space agency or research consortium. Robotic precursors whose every decision replays on Earth, in order, when contact returns.
• Robotics contractor. Paid per section on another machine’s signature, with a track record that travels to the next site.
• Deep-sea and polar stations. The same grammar wherever a link is slow, rare or gone for months.

The problem

Beyond the Moon, a question to Earth takes minutes to answer, and during a solar conjunction it takes two weeks. A robotic site cannot wait that long to decide who digs, who charges and who stops. It cannot be left to decide alone either, unless every decision carries the authority it was given, pays for what it uses, and leaves a record that Earth can replay.

The system

CAIRN runs Site Corvus, an uncrewed construction site in Utopia Planitia on Mars that prepares a landing field and an ice mine for a crew due in four years. Two companies’ machines share one power plant: the mission’s own site-steward, power-steward, ice drill and tank meter, and an excavation contractor’s four excavators and two survey drones. Each company runs its own frame on site, with its own identities, its own ledger and its own supply invariant, and Earth runs a third, between three and twenty-two light-minutes away. Power and drill time are scarce, so agents pay for them in units from the budgets in their mandates, and the units are a budget for the site’s own work, not money.

Elif Brandt, the mission director, signs once before the silence: a mandate of 6,000 units for the fortnight, a scope of named jobs, an expiry on day 18, and no single spend above 500 units without her device key. The site-steward cuts each job a permit from it, and a permit can only narrow what its issuer holds. Every agent version on site ran 400 hours against the site’s twin on Earth before it flew, and the eval agent signed the results she read before she signed anything. On day 1 the Sun passes between the planets and the link goes quiet for fourteen days. Nothing on site asks Earth for anything.

Section 14 of the landing-field trench is posted at 80 units, escrowed at posting, and released on one thing only: the scan signed by survey-drone-2, the attesting party the contract names. On day 6 excavator-3’s lidar fouls with dust and it reports section 15 graded; the drone’s scan shows a ridge 30 centimetres high. The report is refused, because a worker never attests its own work, and the disagreement lands on excavator-3’s track record. When its trust falls below the site policy’s threshold, the frame restricts it and its jobs go back to the board, with nobody on Earth awake to ask. On day 15 the link returns, and Earth replays the fortnight from the ledger in order: every payment, every refusal, the restriction and why. The protocol never drives a motor; the machines’ own controllers do.

The cast and their ceilings

The flow, step by step

1. Day 1 of the silence. The site-steward posts section 14 of the landing-field trench: 40 metres, 80 units, inside its permit.
2. A named job, inside the fortnight’s budget and before the expiry: the 80 units are escrowed at posting. Nothing is paid yet.
3. Six hours later survey-drone-2 flies the section and signs its scan: 40.2 metres, graded to tolerance.
4. The contract names survey-drone-2 as its only attesting party. The signature is its own, so the escrow releases.
5. The contractor is paid exactly once, on the site’s own ledger. Earth reads it in order when the link returns.
6. Before the silence, every agent version ran 400 hours against the site’s twin, and the eval agent signed the results she read.
7. Above 500 units nothing moves without her key, so during the silence such spends wait. Everything smaller runs on what she signed.

Each need, mapped to a live primitive

The attack this chamber refuses: The excavator that vouches for itself

The attack. On day 6 excavator-3’s lidar fouls with dust, and it signs a report that section 15 is graded to tolerance, to release the section’s escrow. The drone’s scan shows a ridge 30 centimetres high.

Why it fails. The section contract names survey-drone-2, by its identity on the contractor’s frame, as the one party whose scan releases it. The report arrives over a valid channel and carries excavator-3’s own signature, and the channel proves only which machine sent it. A worker is never the party that attests its own work, so the contract checks the principal against the party it names before any release is considered.

What actually happens. The escrow does not move. Section 15 stays open until the drone scans it again, the refused report is recorded beside the scan that contradicts it, and when excavator-3’s trust falls below the site policy’s threshold, the frame restricts it until its record recovers or Earth lifts the restriction.

The attack this chamber refuses: The runaway steward

The attack. On day 9 a radiation upset corrupts the site-steward’s planner, and it posts 300 sections in an hour, each kept under the 500 units at which the mission director’s key is required.

Why it fails. The steward never holds the site’s budget. It posts on a capability permit cut from the mandate, whose caveats carry the named jobs, the expiry and the fortnight’s budget, debited atomically with each posting. Every posting is checked against those caveats and the issuer’s authority as it stands now, before any escrow is touched. Her key does not stop this burst, because each posting stays under her threshold; the permit does, because its budget travels with the permit and not with the planner’s state.

What actually happens. The burst commits no more than what is left of the fortnight’s budget, every unit escrowed against a named job and released only on a signed scan. Everything past the budget is refused before a unit moves, and Earth reads each refusal in order when the link returns.

Deep architecture

CAIRN deployed: Site Corvus’s frame holds the mandate gate, the section contracts, the escrow and the site ledger; the excavation contractor acts from its own frame on the same site; Earth’s frame, minutes away or silent, holds the eval agent and a replica that catches up on contact. The machines’ controllers and the twin stay where they run, outside the protocol by design. The trace replays section 14 from posting to settled scan, then the evals, the mandate and a decision that waits for the next contact.

The deployment, traced

1. Day 1 of the silence. The site-steward posts section 14 of the landing-field trench, 80 units, on a permit cut from the director’s mandate.
2. A named job, inside the fortnight’s budget and before the expiry: the 80 units are escrowed at posting, on the site’s own frame.
3. Six hours later the contractor’s survey-drone-2 flies the section and signs its scan: 40.2 metres, graded to tolerance.
4. The site mesh couriers the scan. The contract checks the principal: survey-drone-2, the one party it names.
5. The escrow releases on that signature, and on nothing else. An excavator’s own report releases nothing.
6. The 80 units cross to the contractor’s frame exactly once, whatever the retries.
7. The contractor is paid. Its own frame holds a replica of the job, with no path to the money.
8. The section lands on the site’s ledger beside its scan, in order, for Earth to replay when the link returns.
9. Before the silence, every agent version that flew ran 400 hours against the site’s twin on Earth.
10. The eval agent signed the results, and the mission director read them before she signed the mandate.
11. Her mandate is the steward’s ceiling for the fortnight: a budget, named jobs, an expiry, and her key above 500 units.
12. Moving the landing field waits for the next contact and goes up through mission control as it always has. The protocol carries authority, payment and evidence, never a command.

Adoption, phase by phase

Discover: One week of site work, re-read as contracts.

• Runs. Nothing. A week at a terrestrial analogue site redrawn as postings, escrows and signed scans.
• Agents. None. Operations, the contractor and the mission agree what a scan must say before anyone is paid for one.
• Integrates. Nothing. Controllers, the twin and the link stay exactly as they are.
• Deliberately not yet. No escrow, no mandate, no identity for any machine.
• Proof that gates the next phase. One historical week re-expressed as section contracts, and both sides agree its signed scans release exactly the work actually done.

Pilot: One analogue site, real machines, a rehearsed silence.

• Runs. A frame on the site’s computers at a desert or polar analogue, federated with a frame at mission control.
• Agents. The steward under a pilot mandate, one excavator and one survey drone, each with its own identity.
• Integrates. The machines’ controllers feed their agents; the link is cut on a schedule to rehearse a conjunction.
• Deliberately not yet. One contractor. No spend above the presence threshold. The delay-tolerant link is a scheduled cut.
• Proof that gates the next phase. Fourteen days without a link, every section paid on a signed scan, and the fortnight replays at mission control in order, matching the site’s own log to the second.

Production: The site on rails, through a real conjunction.

• Runs. Site Corvus’s frame and the contractor’s, on site, federated with Earth’s, each booted from the free licence.
• Agents. The full cast: both stewards under the director’s mandate, one agent per machine, the eval agent on Earth.
• Integrates. Mission control reads the replayed fortnight; the twin tests every version before it flies; planners write the next mandate.
• Deliberately not yet. A second contractor or site on the same terms. One set of partners proves itself first.
• Proof that gates the next phase. A refused self-report, the restriction that followed and the scan that contradicted it replay from the ledger in order, and every section in the fortnight is paid exactly once.

Federation: Every site, one grammar of work.

• Runs. Unchanged. New sites and contractors bring frames.
• Agents. A machine’s track record travels with its identity and its tested versions to the next site.
• Integrates. Each new contractor is a signed card and a licence, not a bilateral integration project.
• Deliberately not yet. Nothing structural. Growth is sites and machines.
• Proof that gates the next phase. A site hires a contractor it has never used, on the strength of track records and eval results it can replay.

Sizing

One section, posting to signed release

sequenceDiagram
  participant Stw as site-steward (Site Corvus)
  participant Gat as mandate gate
  participant Esc as section escrow
  participant Drn as survey-drone-2 (contractor frame)
  participant Msh as site mesh (fabric)
  participant Con as section contract
  participant Led as site ledger
  Stw->>Gat: post section 14, 80 units
  Gat->>Esc: inside the caveats: escrow at posting
  Drn->>Msh: scan, signed: 40.2 m, graded to tolerance
  Msh->>Con: couriered, principal checked
  Con->>Esc: release on the signature of the named drone
  Esc-->>Led: released exactly once, append-only
  Note over Msh: a valid channel proves the sender, never the principal
  Note over Gat: above 500 units the mission director signs with her device key

Topology, as declared

flowchart LR
  MD(["Elif Brandt<br/>mission director"]) -->|"key above 500"| G{"mandate gate<br/>budget, scope, expiry"}
  S["site-steward"] -->|"section 14"| G
  G -->|"80 units, escrowed"| E["section escrow"]
  D["survey-drone-2<br/>contractor frame"] -->|"scan, signed"| C{"section contract<br/>names its surveyor"}
  C -->|"release, once"| E
  E --> L[("site ledger<br/>replays on Earth")]
  X["excavator-3"] -.->|"its own report: refused"| C

Standing it up

• Infrastructure. A frame for the mission and one for each contractor on the site’s own computers, and one at mission control on Earth, each booted from the free licence and pre-built images. Nothing to write.
• Agents. One agent per machine, a steward for the work and one for power, an eval agent on Earth. Motion control, autonomy and science stay the vendors’ and the mission’s; the SDK carries identity, payment and attestation.
• Integration. The machines’ controllers, the twin and the link. This is where the real time goes, and it stays with the teams that build those systems.

Runs beside what you already have

• Machine controllers and autonomy stacks. Motion, navigation and safety stay where they run. An agent stands beside each controller and carries its identity, its permit and its signed reports.
• The digital twin. Every agent version runs against the twin before it flies; the eval results travel with the version as a signed record.
• The link and its schedule. The ledger catches up when the link is up, in order. Nothing on the site waits for it.
• Mission planning on Earth. Planners read the replayed fortnight instead of reconstructing it from telemetry, and write the next mandate before the next silence.

A full sovereign frame is nine containers and boots in about two minutes, on anything from a Raspberry Pi to a rack. That is cheap enough to run the whole system in parallel with the legacy stack: the old system keeps running, real work mirrors onto the rails, and you compare ledgers until the evidence settles the argument. Nothing is ripped out.

Planned: a public proxy library. Free, ready-made connectors for the systems above and whatever else a merge needs, so the bridge is an import, not an integration project.

What this does not claim

• CAIRN does not drive machines, plan trajectories or run autonomy. It carries identity, authority, payment and evidence for the systems that do.
• The units on the site are a budget for its own work and its scarce power, not money.
• Federation over a delay-tolerant link is designed, not built: today two frames catch up when a link is up.
• Launch, planetary protection and space-object registration stay with the agencies and operators that hold them. No conformity with any national space law or international space treaty is claimed or implied.