A warehouse robot platform, safe by design, built in 5 days.

Forklifts, robot arms, conveyors and cameras on one platform. Built by AI agents, proven on a simulated warehouse.

LANE A LANE B RESERVED FOR agf-03 agf-07 CONVEYOR plc-01 pnp-02 · moving HOLD · R4 pnp-01 · person in cell arm held within 150 ms R3: nobody enters a station while its arm can still move
Drawn from the simulated site’s rules: while a person is in a cell, its arm holds.

  • 5 days

    From first instruction to the full system

  • 1,700

    Automated tests

  • 25

    Fault types, each tested

  • 0.1 s

    To stop the whole fleet

Three layers on one shared contract

L1 Part 1

Dashboard and cloud

What operators see: live map, alarms, commands, history. Seven roles.

NATS and protobuf · state, alarms, commands, safety records

L2 Part 2

The edge server

On site. Admits devices, issues the permit, routes forklifts without collisions, survives a lost node or WAN.

VDA 5050 · MQTT · OPC UA · RTSP · mTLS with enrolled certificates

L3 Part 3

Devices and their world

An agent on every machine, and a physics simulation: batteries, radio dead zones, people, MuJoCo arms.

Shared kit contractsconformance suitessimulation corereference sitessigned bundlesimport boundaries checked on every build

When an operator pauses the fleet

  1. Operator presses Pause

    sent as the person

  2. Cloud records it

    who, what, when

  3. Edge relays it at once

    no wait on storage

  4. Permit withdrawn

    permit every 0.5 s

  5. Every device holds

    measured 0.1 s · limit 1 s

The running system

A 3D view of the simulated warehouse: forklifts on their lanes, two robot arms, and two machines in red after faults were struck on purpose.
  1. Faults struck: a person in a cell, an E-stop
  2. arm-01 in red: protective stop
  3. agf-03 in red: E-stop pressed
  4. Radio dead zone (pink) behind a rack

The 3D view, with faults struck on purpose.

The alarm console: a person entered a robot cell and an E-stop was pressed; both alarms stand until a person acknowledges them.
  1. Someone entered arm-01’s cell
  2. The station goes down with its arm
  3. Device back: the alarm waits for a person

The alarm console, a minute later.

Nothing moves without permission

Robots move only while they hold a fresh permit. If the server goes silent, they stop.

0 s1 s2 s3 s time on the device’s clock permit sent at 0 s, valid to 1 s last permit, sent at 1.5 s edge lost at 1.5 s ALL DEVICES HOLD

  • Trusted devices

    Certificates and mutual TLS: only enrolled machines connect.

  • Signed updates

    Every configuration is signed, and rolled back if a machine fails.

  • Two people to restart

    Sign in again to resume a robot; a second person for the whole fleet.

  • Full audit trail

    Every command: who, what and when.

  • One leader only

    A frozen server that wakes up can never send a robot moving.

  • No safety event lost

    Stored before it is confirmed, even through a power cut.

25 faults, each struck on purpose and tested

People and motion

  • F01 E-stop
  • F02 person in path
  • F03 localization
  • F15 frozen sensor
  • F24 person in cell

Machines

  • F06 vacuum loss
  • F07 double pick
  • F08 conveyor jam
  • F13 motor over-temp
  • F14 ageing battery

Pallets and cameras

  • F09 camera obstructed
  • F10 low confidence
  • F11 pallet askew
  • F12 pocket blocked

Network, power and software

  • F04 roaming gap
  • F05 dead zone
  • F16 duplicates
  • F17 malformed
  • F18 clock skew
  • F19 reboot
  • F20 log storm
  • F21 older firmware
  • F22 cert near expiry
  • F23 broker failover
  • F25 power blip

Open standards and proven libraries

VDA 5050
Forklift orders and state, third-party makes included.
OPC UA
Conveyor PLCs, served and read as real OPC UA nodes.
ISA-18.2
Alarm life cycle: raised, acknowledged by a person, cleared.
EST and mTLS
Device enrolment, certificate renewal and revocation.
OIDC
Operator sign-in; roles re-read every 10 minutes.
cosign, ECDSA P-256
A signature on every configuration bundle.
Protobuf and NATS
The edge-to-cloud contract, built for outages.
MQTT and RTSP
The device contract and raw camera streams.
WebRTC (WHEP)
Camera pictures in the browser.
MCAP, glTF, URDF
Run recordings, site models, robot descriptions.
LIF
Forklift lane layouts, imported as they come.
Foxglove
The floor streamed at 10 Hz to a 3D view.

Libraries and tools

Language and screens
  • Go 1.26
  • SvelteKit
  • Svelte 5
  • TypeScript
  • Vite
Messaging
  • NATS JetStream
  • Protocol Buffers
  • gRPC
  • Eclipse Paho
  • Mochi MQTT
Machines and video
  • gopcua
  • gortsplib
  • Pion
  • MediaMTX
Data
  • PostgreSQL
  • TimescaleDB
  • ClickHouse
  • Valkey
  • SeaweedFS
  • bbolt
Sign-in
  • Dex
  • go-oidc
  • go-jose
Simulation and 3D
  • MuJoCo
  • Unity 6
  • glTFast
  • Foxglove MCAP
Testing
  • Playwright
  • Vitest
  • Storybook
  • axe-core
  • rapid
  • Go race detector

Measured against limits set in advance

Worst measured figure, as a share of its limit

Shorter is better. Every bar ends well before 100%.

  • Stop the whole fleet limit 1 s

    100 ms 10% of limit

  • Command to 1,000 devices limit 300 ms

    30 ms 10% of limit

  • 1,000 devices to the cloud limit 500 ms

    81 ms 16.2% of limit

  • 500 operator screens limit 500 ms

    153 ms 30.6% of limit

  • 120 devices rebooted at once limit 30 s

    3 s 10% of limit

worst measured room left under the limit

  • 0

    Collisions in 6,826 forklift journeys

  • 72 h

    Network outage, then every record replayed once, in order

  • 29 s

    1,000 devices power-cycled at once: all back, no safety event lost

  • ~5 s

    Server killed: another takes over, never two in charge

Where it stands

No hardware yet

Every figure comes from a simulated warehouse on a development machine. On a real floor, each machine’s own safety circuit acts first and this platform is the second layer.

How we measured
Time
From the first record in the AI session logs (Oct 13, 18:47) to the last commit of the build shown here (Oct 18, 12:50): about 114 hours and 67 commits.
Tests
Test functions counted in the source on Oct 18: 1,472 Go, 124 web unit, 43 browser, 29 component and 32 Unity tests.
Speed
The worst figure of each test against a limit written down before it, as recorded in the repository. Local runs on a development machine.

Tell us how your work flows. We’ll show you where AI saves the most time.

Free AI audit (30 min)