Trisphere · Aram OS

Autonomy that holds
when the link doesn't.

Aram is the coordination kernel for machines that work in the field: tractors, rovers and drone swarms. It runs on hardware you own, keeps every machine inside its fence, and fails safe when the radio goes quiet.

Request a briefing See how it works

01 The kernel

One kernel. Every machine.

Operators, safety logic and hardware drivers meet in a single process at the edge. Swap the machine underneath and the mission, the fence and the audit trail stay the same.

Operators Browser HUD · Scout tablet (Android, iOS) · HTTP API Keycloak single sign-on, role per actor
Aram kernel Mission state machine · Comms watchdog · Geofence · Command signing · Audit log · Licensing One binary, SQLite, runs offline
Hardware layer Serial bridge (ESP32) · J1939 / ISOBUS over CAN · Simulation Per-machine profiles, one interface
Machines Tractors · Rovers · Test rigs · Drone fleets Mutual TLS identity per device

Several kernels can coordinate as a swarm over mutually authenticated links, so a fleet can span fields, sites or teams.

02 Missions

Built for the field.
Open to every mission.

The same kernel runs a working farm, a coordinated swarm or a rover on a workbench. Each mission has a status label, and we don't claim more than we've built.

Autonomous field fleets

Plan the work, set the fence, and let a fleet run its rows. Aram tracks every unit's state, brakes anything that loses contact, and records who commanded what.

Available Fleet supervision, patrol and go-to missions, geofencing, audit trail
In development J1939 / ISOBUS tractor driver: implemented, field validation underway

Aram Scout HUD, Live Ops: a field tactical map with six tractors, state counts across the top and a STOP ALL button — The Scout HUD against Aram's fleet simulator: six simulated tractors on one field. Every state has its own colour, and one unit is on hold.

Per-unit cards in the Scout HUD: energy, heading, speed and Go To, Hold and Recharge controls, with one unit on hold — The Scout HUD against Aram's fleet simulator: six simulated tractors on one field. Every state has its own colour, and one unit is on hold.

03 Safety architecture

Fails safe. By design.

Machines that move need a kernel that assumes the worst. These behaviours are enforced in code, not left to operating procedure.

Comms watchdog

A unit that goes silent for 20 s drops to COMMS_DEGRADED and is braked. It needs 8 s of continuous uplink before it may move again.

Brake escalation

A brake command is retried 3 times, 200 ms apart. If the hardware still doesn't confirm it, the unit escalates to EMERGENCY_STOP. Leaving that state takes an explicit maintenance or hold step.

Geofence

Containment uses spherical (S2) geometry for a hard stop at the fence, with a buffer zone that warns before a unit gets there.

Signed commands

Every API call carries a Keycloak token or an HMAC request signature, and signing keys rotate without downtime. Roles run from observer to admin, and each role is limited to what it may command.

Device identity

A built-in certificate authority issues each machine its own identity. Hardware check-in requires mutual TLS, and check-ins are rate-limited per unit.

Audit trail

Every command is logged with its actor, role, source, outcome and reason, and the database is backed up on a schedule.

PATROLLINGGO_TOHOLDLOW_BATTERY COMMS_DEGRADEDTRUST_LOSTEMERGENCY_STOPMAINTENANCE

The Scout HUD command palette, with Stop all units as the first entry — The command palette (Ctrl/Cmd+K) always lists Stop all units first: brake every unit and latch it in hold.

04 Specifications

The numbers.

Runtime	Single Go binary on Linux · SQLite (WAL) · systemd service
Connectivity	Runs fully on site. Cloud sync is optional and licenses verify offline.
Hardware drivers	Serial over ESP32 bridge (BNO055 IMU, BN-880 GPS, PWM servo/ESC) · SAE J1939 / ISOBUS over SocketCAN · Simulation
Operator clients	Browser HUD · Flutter Scout tablet (Android, iOS) · JSON HTTP API
Identity & access	OpenID Connect with PKCE (Keycloak) · HMAC request signing with key rotation · Role-based actors
Device trust	Built-in CA · Mutual TLS for hardware check-in · Per-unit rate limit (default 10/s)
Safety timers	Comms loss 20 s · Recovery 8 s · Brake retry 3 × 200 ms → EMERGENCY_STOP
Geofence	S2 spherical containment · Hard stop and buffer warning zone
Licensing	Ed25519-signed keys · Demo 2 units · Starter 3 · Pro 10 + cloud sync · Enterprise unlimited + swarm
Pricing	Scoped per deployment: the kernel, the hardware it drives and the support around it. Request a briefing for a quote.

05 Engage

Put Aram in the field.

Briefings for agencies, operators and integrators. Demo licenses for builders. Responsible disclosure for researchers.

Request a briefing [email protected] Get a demo license Two units, free Report a vulnerability [email protected]

More from Trisphere: Bunnie · Vandelay · Lenz · SheekBot · All products

Autonomy that holds
when the link doesn't.

One kernel. Every machine.