One canonical agent model. One deterministic gate. One event record that explains everything that happened.
This page is the engineering view of AEROE: the architectural rules, the constraint gate's verbatim output, the formation library with the gate's own measurements, and what the current increment adds. Requirement and unit identifiers refer to SRS v4.0 (Project Meridian). For the plain-language overview, start here.
AEROE is a coordination platform. Mission, orchestration and planning depend only on a canonical agent interface and a capability model — never on a vehicle, a vendor or an application. Everything else, from a survey sweep to a display programme, is built on it and lives outside the core.
A new robot type is an adapter alone — a published SPI, a conformance suite and an offline-verifiable certificate. A build gate fails the moment a neutral layer names a platform or branches on an adapter id. Agnosticism is not a promise in a brochure; it is a test that runs on every commit.
Link latency and silence interval, command rate, endurance, positioning uncertainty, time-sync error — each is a declared value that becomes the limit the orchestrator enforces. A separation the fleet cannot hold is not a separation; a cue tighter than the clock is refused before launch, naming the shortfall.
If not, it does not enter the core. A programme is a sequence of formations — a survey's flight lines as much as a show's figures. An effector is an abstract state on a declared capability, never a device. Nothing below the console knows what it is being used for.
Author a mission in structured controls or plain language. The gate checks it before anything is dispatched. Then watch the fleet take station in a 3D twin or a top-down plan view — both driven by the same mission state — beside the mission's own event log, its armed contingencies and the version in force.
Screenshots are the console's own output, captured from a running installation. All state shown is produced by AEROE's kinematic simulator — no figure on this page is evidence of physical flight.
A formation type is one generator interface, registered — validation and assignment never change. Each panel below is the console's plan view of a mission the gate passed and the simulator flew, with the numbers a customer asks about measured the way the gate measures them: closest pair (CV-001) and extent (CV-005), against a 3 m minimum.
20 agents
24 agents
10 agents
13 agents
9 agents
14 agents
100 agents
14 agents
24 agents
18 agents
200 agents
90 agents
Not shown: rectangle (a grid under another name) and traced image — an uploaded picture is traced once, at authoring time, onto a fitted hexagonal lattice; the mission carries the points and never the picture, so generation stays a pure function of its parameters. Flags are geometry only: showing a colour needs a declared effector, and an effector is an abstract state the core never names.
Every rule in the constraint ruleset returns the measured value, the limit and, where one exists, the value that would pass. These are the verbatim answers the platform gave while the missions on this page were being authored.
Moving from formation 0 to 1, two agents pass within 1.53 m of each other — 3.00 m is needed — 23% of the way across, although both formations are themselves legal. Lengthen the 45.0 s transition, or re-order the formations so the paths do not cross.
The only rule that measures something moving. A transition validated at its endpoints has not been validated.
Agents for slots 148 and 189 converge within 2.1 m at settle: their slots are 3.09 m apart and each may be 0.50 m off. 3.00 m required.
An agent is "at" its slot anywhere inside its tolerance. The gate measures the worst case, not the drawing.
This mission's airspace overlaps mission "Circle — 20 agents, 15 m" (EXECUTING) by 33.0 m east-west, 33.0 m north-south and 3.0 m vertically. Move 3.0 m along the vertical, change the altitude band, or wait for it to finish.
Concurrent missions hold claims derived from their geometry. Two missions never share airspace by accident.
This installation is declared for 10 concurrent missions; accepting this would make 11. To proceed, complete or abort a mission.
Capacity is a declaration too. The installation says what it will carry, and the gate holds it to that.
The current increment takes the platform from a single held formation to a programme: an ordered set of committed formations with declared transition and hold times, validated as a whole, composed for a declared observer, and recorded figure by figure. Every mechanism is general — the same machinery flies a survey's lines and a patrol's legs.
A formation declares the plane it stands in — a tilt and the bearing it faces. The shape is rotated rigidly, so every pairwise distance, and every separation rule, means exactly what it meant when it was flat.
Steps follow the mission's own formation. Over each transition, no pair of agents may come within the separation minimum at any instant — computed in closed form, never sampled. Execution needed no new mechanism: each figure compiles to a barrier the fleet already knew how to wait at.
An adapter declares its positioning uncertainty; commanded separation is checked against the convolved pairwise uncertainty plus the minimum. It declares its time-sync class and error bound; a programme whose cue tolerance is tighter than the clock is refused. A barrier waits for the slowest — a cue does not.
An observer position is on the versioned specification, not a camera setting. A five-agent line is fifteen degrees wide from the east and a dot from the south; the console renders what the audience sees — bearing and elevation per slot, with no lens anywhere in the model.
A launch is a transition from surveyed ground; the programme's whole duration is validated against the worst declared endurance minus reserve. On agent loss the operator chooses, before launch: hold the shape with a hole, re-derive, or end early. The default is the hole — a crew can predict it.
A committed version records what was flown — every figure's slots and assignments — and a rehearsal is compared with the plan per formation and per transition, in simulation time. "Record 17 differs" is a determinism check; a crew asks which figure, and by how much.
The first command in the vocabulary that moves nothing. An effector is a declared capability with abstract states, stamped on slots, never safety-bearing — and the core never learns what it is.
Traceability, vendor neutrality, import boundaries, schema drift, adapter effort, release reproducibility and the air-gapped posture are all build gates, not review habits. A requirement a unit claims is a requirement CI measures.
The console names no host but its own API; images are pinned; the installer runs from a bundle. A gate fails the build on any external fetch. The optional model provider is the one declared exception, and the console says so on screen.
Evidence exports are canonical and byte-deterministic; audit logs are append-only and hash-chained; every archive ships its own dependency-free verifier. A bundle only verifiable by the software that produced it proves nothing to a third party.
Every result on this page comes from a kinematic simulator with fixed seeds. The physical track is gated separately, and the software that enables it — edge agents, site models, checklists, declared envelopes — is built and tested before a vehicle is asked to.