What organizations assemble instead
A fleet deployment today is usually device management with no cryptographic identity, plus a VPN with no transport failover, plus a SIEM with no edge-native telemetry, plus a PKI with no delegation model, plus custom enrollment scripts with no audit trail. Integrating them costs more than any individual tool, and the gaps between them are where incidents happen.
If a device in the field cannot prove who it is, the data it sends is inadmissible. If it cannot prove it is running the code you wrote, it is a compliance finding waiting to happen. If it cannot keep collecting when the network goes down, it is not a field device. It is a demo.
The four properties you are actually buying
The Edge Agent was designed alongside the platform rather than integrated against it: the two share proto schemas, cryptographic primitives and authorization semantics. Everything below is a consequence of that, not a feature bolted on top.
Verifiable identity
A certificate-bound device ID that cannot be spoofed, even if the network is hostile and the gateway is compromised. The keypair is generated on the device and the private key never traverses the wire.
Revocable authority
A delegation token the platform can kill in one API call, effective on the next request. No certificate rotation, no reboot, no fleet-wide patch cycle.
Schema-pinned wire
A compile-time schema hash on every request, so wire-format drift is a typed error rather than a silent data-shape bug. A downgrade attack fails; a version sunset window lets a fleet upgrade gradually.
Offline-first
Store-and-forward, exponential backoff and health-scored failover across every configured carrier, so the device keeps collecting when the link does not, and an air-gapped device writes a signed bundle instead of dialling at all.
Identity proves what the device is. Delegation decides what it may do.
Two layers, deliberately separate, which is what makes authority revocable without touching the certificate.
Generated on the device
An ECDSA P-384 keypair is generated locally. The device sends a certificate signing request over a one-time bootstrap channel and receives a short-lived leaf certificate bound to a delegation token. A hardware fingerprint binds identity to the physical device.
Enrollment cannot be clobbered
Enrolling over a state directory that already holds an identity is refused unless re-enrollment is explicit, so a second enrollment can never silently replace the first. Certificate refresh, delegation rotation and revocation checks run automatically in the daemon loop.
Policy evaluated on the device
A formally-grounded policy engine evaluates authorization locally with no network round-trip, so a disconnected device still enforces policy, and a customer policy can restrict platform defaults but never loosen them.
| Carrier | Role and boundary |
|---|---|
| gRPC over mutual TLS | Primary. Direct to the cell's service ports, with token-by-token streaming for AI queries. |
| HTTPS / REST | Secondary, through the node's public gateway. |
| WebSocket | Tertiary, for networks that block gRPC and long-poll HTTPS alike. Every frame attests its delegation chain. |
| SSH tunnel | Bastion-style relay for estates whose only way in is a jump host. |
| MQTT | Constrained and low-power links. Refuses an AI query rather than publishing cleartext to a broker when the sealing key is absent. |
| DNS-over-HTTPS | Heartbeat-class traffic only, and we do not claim more than that. |
| Air-gapped posture | Writes a signed bundle for an operator to carry; the device never dials. Outside the ladder, because failing over to store-and-forward would let an outage read as success. |
Carriers, and the one we refuse to fail over to
gRPC is the primary. Behind it sit up to 5 fallback legs, each mounted only when its configuration is complete and usable, a half-filled config block counts as not requested, because dialling an endpoint assembled from blanks produces a confusing runtime failure in place of an honest “not configured”. If an adversary blocks one protocol, the agent fails over to the next healthy leg without a network redesign.
The failover stack
gRPC / mutual TLS
Primary. Direct to the cell's service ports, with token-by-token streaming for AI queries.
HTTPS / REST
Secondary, through the node's public gateway.
WebSocket
Tertiary, for networks that block gRPC and long-poll HTTPS alike. Every frame attests its delegation chain.
SSH tunnel
Bastion-style relay for estates where the only way in is a jump host.
MQTT
Low-power and constrained links. Refuses an AI query rather than publishing cleartext to a broker when the sealing key is absent.
DNS-over-HTTPS
Heartbeat-class traffic only, enough to get a signal out, and we do not claim more than that.
Air-gapped mode is a posture, not a fallback
Configure a bundle directory and the device stops dialling entirely: it writes a signed bundle for an operator to carry to the cell. That is deliberately outside the failover chain, and the reason is the most useful thing on this page.
Store-and-forward returns its own acknowledgements. If the stack could fail over to it automatically, an outage would read as success, the device reporting delivery while nothing reached the cell until somebody moved a disk. A platform that will not let an outage look like success is the whole argument, so it applies to our own transport layer first.
Not a telemetry daemon. An operator.
The agent can be given an objective rather than a polling interval. Everything below runs on the device, under the same identity, policy and audit model as the rest of the platform.
Sovereign inference on the device
A local model runtime executes on the device with no vendor egress, and it is on by default in the shipped binary. An AI query carried to the fabric instead runs over the full-duplex transports, with token-by-token streaming on gRPC.
A frontier model, under the same admission gate
A hosted model (Anthropic, OpenAI, Ollama or any OpenAI-compatible endpoint) is admitted by the same signed-manifest verifier that admits a local one: origin policy, classification ceiling and task allowlist all enforced at import. It is refused below the posture that permits off-device reasoning, and the build for an air-gapped site simply omits the capability.
A governed sandbox, not a shell
Resource limits derive from the grant rather than a config file. A read-only base filesystem with a bind-mount allowlist, no host home directory, no credentials, and no bind outside the allowlist is even representable. The namespace is network-isolated.
Reading documents offline
Text extraction and chunking run on the device, with entity extraction guided by a subset of your own ontology synchronised to it, so data is structured against your object model at the point of capture, not re-inferred at the core. The on-device format set is deliberately narrow; the platform's wider extraction stack stays at the core.
A sub-conductor when the cloud goes dark
The device is a leaf of the platform's federated reasoning tree. When the link drops it becomes a sub-conductor, so a disconnected group of devices can still answer a question among themselves and rejoin with its history intact.
Provenance attached at capture
On-board and hardware sensor drivers plus on-device speech-to-text feed a tamper-evident capture hash chain with frame-level content-provenance signing, so provenance is attached at the moment of capture rather than asserted afterwards.
A run record you can hand to someone else
Every reasoning step can be recorded to a hash-chained, flushed-to-disk journal, exported as a portable bundle signed with the device's own key, and verified by a third party offline, integrity and signature, with no service to call. And each completion is attributed to the engine that actually served it, so a turn taken on a hosted model is auditable by vendor rather than blurred into a total.
Software engineering, disconnected
The same plan → edit → search → test → commit loop the platform runs centrally, running on a device that has never touched the internet. A local model reasons on-device; not a byte leaves it.
The journal, the fleet, and what happens on compromise
A hash-chained journal
A durable, append-only, hash-chained journal on an embedded key-value store records every operation, and keeps recording with no link. The heartbeat reports how far the backlog has grown so the fleet can watch it. Draining that backlog back to the cell is not built yet, we say so rather than let you assume it.
Governed fleet releases
Signed packages and manifests, release tracks, named cohorts, ring-by-ring rollout state machines, drift detection, install tokens and reconciliation, so a fleet change is paced rather than fanned out.
40+ records per heartbeat
Battery, storage, location, transport health, certificate status and pending commands are refreshed on every heartbeat, with stale-device detection at two thresholds. Edge telemetry lands in the same detection engine as everything else.
Response reaches the device
Because the edge is native to the security plane rather than federated into it, a response playbook can suspend a device, revoke its delegation, or push a destruction command, from the same console that raised the detection.
Destruction of key material
A zeroize command destroys agent keys, revokes certificates and overwrites workflow state, the journal and local model weights, for the capture scenario, where the question is what an adversary gets rather than whether they get the hardware.
Governed, never billed as core
The edge is observed and governed, and it is never billed as core consumption. A fleet of ten thousand devices does not change the shape of your invoice, only the work does.
The engineering posture, stated precisely
Memory safety
unsafe is denied workspace-wide. Every crate but two forbids it outright, and the agent’s core crate forbids it entirely on Linux and macOS, so a non-Windows build carries no unsafe in it at all. Seven documented foreign-function carve-outs remain: six on the Windows platform surface, and one Linux camera device module.
Binary
59 MiB, release-built, statically linked and cross-compiled, with on-device inference and optical character recognition linked in, which is where the weight is. Measured on the shipped artifact and gated in continuous integration, so the next drift fails a build rather than a datasheet.
Interoperability
Client-side wire paths are covered by mock-gateway integration tests. End-to-end validation against a live backend is pending, so we describe capability here rather than proven interoperability.
Operator surface
One command-line tool covers the lifecycle: offline diagnostics, identity and status inspection, enrollment, heartbeat, the daemon loop, certificate refresh, delegation rotation, revocation checks, profile management, offline extraction, audit, consent, fleet-release interaction, and conversational and task-running modes.
One limit worth stating before you assume it away
The heartbeat reports the pending-entry count so the cell can watch a backlog grow. Nothing drains it. Reporting a backlog and clearing it are different claims, and only the first is true. Everything the device records while disconnected is kept and chained locally, and the fleet can see the backlog growing, but do not plan a deployment around history back-filling itself the moment a link returns. That path is a build, not a setting.
Where the edge sells first
Tactical defense
Wearables, vehicles, sensors and field kits that must prove identity to the command system, keep collecting through a jammed or intermittent link, and hold a chain of custody that survives a post-operation review. A captured device is cut off within one gateway round-trip.
Law-enforcement body-worn cameras
Hardware-fingerprint binding proves the footage came from the camera the agency issued. Delegation binds the device to the assigned officer at the moment of capture, so chain of custody is unambiguous rather than argued.
Critical infrastructure and SCADA endpoints
Bind every substation device to a verifiable identity so a rogue device cannot inject control signals. Schema pinning specifically defeats the wire-confusion class of attack, and revocation isolates a compromised endpoint without physically visiting the site.
Remote patient monitoring
Refuse any reading not signed by a known device under a known delegation. Withdrawal of consent is implemented at the wire level, revoke the delegation and the next heartbeat fails. Store-and-forward covers a home network that resets.
Remote industrial fleets
Oil rigs, wind farms, vessels and mining sites on expensive satellite links, measured in tens of thousands of devices. Bandwidth-budgeted heartbeats, store-and-forward on loss, and per-profile capability gating so a low-cost sensor and a rig controller run the same binary with different powers.
The Data Exchange at the edge — and why sovereignty is the strength here
The Data Exchange is System9’s cross-org data marketplace, where a listing is a signed attestation that a recipient verifies offline. The edge meets it in two distinct shapes, and the difference is worth stating precisely rather than blurring.
The Edge Agent: a consumer and verifier
On its own, the Edge Agent verifies cross-org listings offline and pins peer-org keys with validity windows, reading from a cell rather than serving data itself. It is the on-device verify-and-operate layer. It does not run a lakehouse, and there is no edge-side ingest or enrollment tool for the exchange.
A collocated cell: the full exchange, locally
But the edge is a deployment, not only that agent. Collocate a full System9 cell with the Edge Agent at the edge, and the complete data platform and the exchange economy (serving, marketplace and settlement) run locally, sovereign and air-gapped, with no cloud in the loop. The agent is the on-device layer; the collocated cell is the local data plane.
Said precisely
The sovereignty story is stronger at the edge, not absent: cross-org trust that verifies offline is exactly what an air-gapped site needs. What a lone device does not do is serve data or run the marketplace — only a collocated cell does that. And the settlement side is an accrual ledger denominated in Compute Units, not a live payout rail.