Built to be re-fitted

The autonomy's requirement is expressed as coverage, range, rate and classification confidence — not as a product. A mission that runs at night, into obscurants, or at higher speed changes the requirement, and the requirement changes the fit.

Range is a speed limit, and the vehicle knows it. The speed ceiling is derived from how far ahead the vehicle can currently classify the ground and what is standing on it, so a lighter sensing fit does not become an unsafe vehicle. It becomes a slower one, and the operator is told why.

Mission equipment mounts on documented power, data and command interfaces. A payload declares what it is and what it needs; the vehicle attaches operating limits to it — mass, center of gravity, slope, speed — and enforces them from that point on.

The vehicle also measures what it is actually carrying and compares that against what the record says it is carrying. When those disagree, the crew hears it from the vehicle rather than from the recovery afterwards.

No link is privileged and no topology is assumed. The gateway carries an authenticated session over whatever paths are available and moves between them without dropping it — direct, through another vehicle acting as a relay, or over a long-haul backhaul when the mesh cannot reach.

Where emissions matter, the vehicle can be held quiet and still be under authorization, reporting on a schedule the crew set rather than continuously.

A unit does not adopt a new common operating picture because it bought a vehicle. Ours publishes into the one already in use and accepts tasking and hazard reports back out of it.

That loop is closed, not cosmetic. A route closure somebody else posted arrives as a keep-out inside a re-issued authorization, and the vehicle's route bends around it without an operator retyping a coordinate.

The same stack runs three ways: as a set of nodes on the standard robotics middleware an integrator's team already knows, as a lean process on the vehicle where that overhead is not wanted, and entirely in simulation with no hardware at all.

All three run the same code. Simulation is not a separate model of the vehicle that has to be kept honest — it is the vehicle's own software with its edges simulated.

Every threshold that shapes behavior — speed ceilings, slope limits, standoffs, timeouts, loss-of-link actions, geofence margins — is a versioned configuration value. The set the safety core enforces is signed, and it verifies that signature before it will permit motion.

Re-roling a vehicle is therefore a reviewable change to a file with a signature and a version on it, which is an auditable act rather than a new build.