A quadcopter hovering at dusk above a city skyline, its status light lit

Trust, at the
point of action.

Open physical interlocks. Bounder verifies narrow authority, checks live conditions locally, and permits only device-safe action.

Explore the code See how it works
Scenario laboratory

Watch the boundary hold.

Scenario laboratory

Choose a scenario

Start with a cleared route, then explore a protective limit.

More scenarios · people and operating limits
People
Operating limits
Evidence loading evidence_pending

The 3D scene could not start. The decision panel remains available.

Dashed line: illustrative route. Coloured boundary: selected protection. The receipt supplies the outcome.

Fleet evidenceInspect recorded Guardians
Creed Space Fleet One protective rule, recorded as locally enforced by every Guardian. Loading software pilot evidence
Fleet
Loading
Guardians
Loading
Policy
Loading
Evidence
Loading

Waiting for recorded evidence.

A protective hold can be the expected successful result. Expand a Guardian to read its full reason and evidence.

Checks: contracts, digests and signature format. Audit authentication requires the producer’s public keys.

100-Guardian pilot evidence · Resilience evidence · Resilience schema · Signed envelope · Policy schema · Checkpoint schema

Contract inspectorVerify signed bytes locally
Creed Space contract round trip Verify signed Fleet authority before it reaches motion.

The published example is historical: its signature can verify while its expired policy remains held. Load that vector or inspect compatible JSON. Bounder verifies the exact Ed25519-signed payload bytes, validates the device policy, and links the policy profile to a recorded Go interlock receipt. The selected file stays in this browser.

Ready Choose the published vector or a local compatible file.
  1. EnvelopeAwaiting signed bytes
  2. SignatureAwaiting Ed25519 verification
  3. PolicyAwaiting schema checks
  4. ReceiptAwaiting matching Go evidence
Issuer
Not loaded
Subject
Not loaded
Fleet
Not loaded
Sequence
Not loaded
Key
Not loaded
Policy ID
Not loaded
Payload digest
Not loaded
Recorded receipt
Not loaded

Inspect the signed example: Signed vector · Signed receipt · Receipt schema · Integration guide

Fault replayExplore recorded failure timelines
Why Bounder

A narrow component with a serious job.

Between the decision and the motion, Bounder asks one question: is this change authorised, current, and within policy? If not, the machine does not move.

People

Protect people

A hospital, a school, a person with hands raised — any of these can stop an otherwise valid command. Protection overrides permission.

Separation

Prevent friendly harm

Authenticated friendly positions and minimum separation rules hold at the last point of control — where the cost of getting it wrong is highest.

Operations

Enforce ordinary limits

Altitude, weather, battery, identity, geography, time of day, communications — each is a first-class reason to hold. Routine limits deserve the same rigour as emergency ones.