Level 2 · OEM & fleet

Govern in production

For manufacturers embedding governance in the body and operators running a fleet. The open core proves the model in your lab; production adds the inline deployment, the versioned SDK surface, and the admissible audit you can hand to a regulator. This path ends in a conversation, not a checkout.

Embed the SDK surface

A versioned governor surface (rgov.sdk.Governor / Verdict) you compile into firmware or a control node. Same canonical vocabulary, same profiles — the body ships already governed.

Inline, no bypass (Mode B)

The gate sits physically inline between the agent and the actuators — two domains across a board — so there is no path to the body that skips governance. The sole-writer guarantee becomes a wiring guarantee.

Admissible audit (AuditAnchor)

Every verdict can be sealed behind the AuditAnchor seam — DID / verifiable-credential signatures and a hash-chained ledger — so the record stands up as evidence. The closed engine stays closed; the open core never embeds it.

Fleet policy & rollout

Per-body profiles, signed policy distribution, and staged monitor→enforce rollout across a fleet — with the same capability-based rules governing a Bumi, a Lumos, and a ROS 2 body identically.

What we will not say

We only call a body "supported" once it's proven on a real wire (today: DDS / LCM / ROS 2). Anything else is "bring or write the profile." Production engagements start from that same honesty — we scope against what your bodies actually speak, not a slide.

Let's scope your deployment

Tell us what your bodies speak and where governance has to sit. We'll map it to profiles, show you the gate in monitor on your own traffic, and plan the path to enforce.

Talk to the team