FOUNDRY LINE

Robot cells that buy tooling, sell capacity, and hold authority one shift at a time.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Contract manufacturer. Sixty cells trading capacity inside shift-scoped budgets.
• Robotics fleet operator. A kill switch that also freezes the money.
• Tooling supplier. Consignment stock that bills itself per insert.
• Maintenance as a service. Machines buying their own repairs, within ceilings.

The problem

A production line already negotiates: cells trade capacity, tooling moves between stations, maintenance is bought from whoever is free. All of it runs on a scheduler that pretends to be a market and a permissions model that pretends not to exist.

The system

FOUNDRY LINE runs a contract manufacturer’s 60 cells as economic actors. A milling cell that finishes early sells the slack to the neighbouring line; a tool changer buys inserts against a parts budget that dies at shift end; every machine identity is a workload certificate that renews itself and revokes in under a second. Authority is per cell, per shift, and the night shift’s tokens cannot spend the morning’s budget by construction.

Because a robot cannot eyeball whether the payment rail is healthy before committing a job, the network proves it continuously: synthetic canary transactions run the same paths real money takes and are judged end to end, so a degraded rail is a red light on a board, not a surprise in a settlement.

And when something is wrong, the response is wired for machines. One action freezes settlement plant-wide while the cells keep machining, because the kill switch here stops the money, not the motion. The safety interlocks that stop motion never meet this network at all; the emergency stop stays exactly where machine safety law put it.

The cast and their ceilings

The flow, step by step

1. The cell’s authority is a capability token: one cell, one shift, a parts budget that dies at shift end.
2. Mill-cell-12 finishes early and sells the slack to the neighbouring line, inside the clamp.
3. The tool changer buys inserts against the shift budget. Consignment stock bills itself.
4. Every trade lands on the ledger, append-only.
5. Canaries run the same paths real money takes, judged end to end. A degraded rail is a red light, not a surprise.
6. And one action freezes the money plant-wide. The safety systems that stop motion never met this network.

Each need, mapped to a live primitive

The attack this chamber refuses: The expired shift

The attack. A compromised cell holds on to its shift token and tries to keep buying inserts an hour after shift end, against the morning’s budget.

Why it fails. The token is an L4 capability: its caveats are intersected with the issuer’s current authority at the moment of use, and at shift end both the token and the budget it named are gone. There is nothing left to spend and no authority left to spend it with, so the attempt dies before any escrow exists to unwind.

What actually happens. The morning budget opens untouched. The denied attempts sit on the ledger timestamped an hour past shift end, which is how the plant finds the compromised cell.

Deep architecture

FOUNDRY LINE deployed: the plant’s frame runs the capacity market, the shift authority and the kill switch; tooling and maintenance suppliers settle from their own registries; the MES keeps scheduling, and the safety systems stay air-gapped on their own island of this drawing, connected to nothing here on purpose. The trace replays one shift, slack sold to money frozen.

The deployment, traced

1. Jobs arrive from the MES. The scheduler still schedules; it just stops pretending to be a market.
2. The cell’s authority is a capability token: one cell, one shift, a parts budget that dies at shift end.
3. Mill-cell-12 finishes early and sells the slack to the neighbouring line.
4. The trade lands on the ledger, append-only.
5. The tool changer buys inserts against the shift budget. Consignment stock bills itself.
6. The supplier’s frame credits exactly once, across any number of retries.
7. A repair is bought from whoever is free, inside declared ceilings.
8. Their ledgers write the same settlements.
9. A robot cannot eyeball a payment rail, so canaries run the same paths real money takes.
10. Judged end to end. A degraded rail is a red light on a board, not a surprise in a settlement.
11. And when something is wrong: one action freezes the money plant-wide. The safety systems, air-gapped below, never met this network.

Adoption, phase by phase

Discover: The line as a market, on paper.

• Runs. Nothing. One line’s shift plan redrawn as budgets, ceilings and trades.
• Agents. None. Production engineering argues about the ceilings; the argument surfaces what the scheduler has been hiding.
• Integrates. Nothing. The MES, the scheduler and every safety system stay exactly as they are.
• Deliberately not yet. No cell holds an identity. Nothing settles.
• Proof that gates the next phase. One week of the scheduler’s decisions re-told as trades between cells, and the plan agrees with what actually ran.

Pilot: Six cells, one market, pocket budgets.

• Runs. A single-VM frame at the plant. Six cells enroll through the identity fabric.
• Agents. Cell and tooling roles under shift tokens; the line operator holds freeze and suspend; canaries run from day one.
• Integrates. The MES feeds jobs read-side. Consignment billing is shadowed against the old process.
• Deliberately not yet. Pocket budgets. No external suppliers settle yet. Safety systems untouched, forever.
• Proof that gates the next phase. A month of pilot trades in which the shift-end token expiry is proven: the night shift demonstrably cannot spend the morning’s budget.

Production: Sixty cells, suppliers settling, kill switch armed.

• Runs. One sovereign frame per plant: registry, TEG, EventStore, identity fabric. About nine containers.
• Agents. The full cast; every machine identity renews itself and revokes in under a second; canaries judge every live path continuously.
• Integrates. MES and scheduler in production; tooling and maintenance suppliers federate bilaterally.
• Deliberately not yet. Cross-plant capacity trading. Each plant’s market stands alone first.
• Proof that gates the next phase. A freeze drill stops all settlement plant-wide in one action, and the resumed ledger shows a clean gap, not a mess.

Federation: Plants trade capacity like cells do.

• Runs. Unchanged. Plant frames peer bilaterally.
• Agents. Per-corridor policies bound what each plant can buy from another.
• Integrates. Each new plant or supplier is a signed card and a license.
• Deliberately not yet. Nothing on this path requires new software.
• Proof that gates the next phase. Two plants balance a capacity crunch across sites with settlements their controllers reconcile from the ledger alone.

Sizing

One insert, consignment to credit

sequenceDiagram
  participant Cell as mill-cell-12
  participant Gate as shift authority (L4)
  participant TEG as plant TEG
  participant XT as cross-registry pay
  participant Sup as tooling supplier (their frame)
  participant ES as event ledger
  Cell->>Gate: buy inserts (token: one cell, one shift)
  Gate-->>Cell: clamped approval, budget debits
  Cell->>TEG: A2A payment, per insert
  TEG-->>ES: settlement, append-only
  TEG->>XT: pay supplier (idempotency key)
  XT->>Sup: their TEG credits, exactly once
  Note over Gate: at shift end the token dies; the budget dies with it
  Note over TEG: canaries run this same path continuously and are judged

Topology, as declared

flowchart LR
  MES["MES / scheduler"] -.->|"jobs in"| C["mill-cell-12<br/>SPIFFE workload"]
  C -->|"shift token: one cell, one shift"| G{"shift authority"}
  G -->|"clamped"| M["capacity market<br/>A2A, exactly-once"]
  M -->|"inserts, per use"| Sup["tooling-supplier"]
  M --> L[("event ledger")]
  K["canary-runner"] -.->|"synthetic, same rails"| M
  Op["line operator"] -.->|"freeze, one action"| G

Standing it up

• Infrastructure. One registry per plant. The cells enroll through the identity fabric.
• Agents. Cell, tooling and maintenance roles; ceilings mirror the shift plan.
• Integration. The MES and the scheduler. Safety systems stay air-gapped and out of scope.

What this does not claim

• FOUNDRY LINE moves authority and money, not motion. No safety function, no real-time control, no OT network claims.