Vision

The missing layer of
the autonomy stack.

Every machine that moves is getting a model. Models are getting more capable and less inspectable at the same time — and no amount of training makes a neural network certifiable. The industry's honest answer is an old one, rebuilt for the AI era: don't verify the driver; verify the envelope. That layer is what Kirra is.

The need

Three forces, one gap

The next decade of robotics is already legible: capability is outrunning verification, regulation is converging on runtime assurance, and compute is consolidating onto certified platforms. All three point at the same missing piece.

AI is outrunning verification

Foundation models are entering planners, and language is becoming a robot interface. You cannot test a distribution into being safe — but you can bound what any of it is permitted to do. Kirra's safety case is deliberately doer-invariant: it holds whether the doer is geometric code, a learned policy, or an LLM, which means it also holds for the doer nobody has built yet.

docs/adr/0020-doer-invariant-safety-case.mddocs/llm_integration_guide.md

Regulation is converging on runtime assurance

UL 4600 safety cases, SOTIF, ASTM F3269 run-time assurance, and the emerging AI-safety standards (ISO/IEC TR 5469, ISO/PAS 8800) all circle the same architecture: an untrusted complex function behind a verifiable monitor. Kirra maintains mappings to each of these — drafted in the open, versioned with the code — so the compliance story grows with the product instead of after it.

docs/safety/UL4600_SAFETY_CASE.mddocs/safety/ASTM_F3269_RTA_MAPPING.mddocs/safety/ISO_IEC_TR_5469_MAPPING.md

Platforms need a governed layer

Certified hypervisors and safety-rated silicon solve isolation and compute — they don't decide whether a command is safe. Kirra is built to be that decision layer on exactly those platforms: the deployment decision of record is a QNX 8.0 safety partition, and the inference substrate is vendor-neutral by design.

docs/adr/0032-governor-deployment-platform.mdparko/README.md

Where it fits

Between certified platforms
and unverifiable AI

Kirra doesn't compete with the layers above or below it. It's engineered as an SEooC — ISO 26262's term for a safety element built out of context, for integration into someone else's product — with its assumptions of use written down and its integration seams frozen.

The autonomy stack of tomorrow Four layers: AI doer stacks at the top; the Kirra governed layer beneath them; certified operating systems and hypervisors below that; and safety-rated silicon at the base. Kirra is the layer that makes the unverifiable top compatible with the certified bottom. AI doer stacks — capable, fast-moving, unverifiable Autoware-class AV stacks · learned planners · LLM agents · whatever comes next KIRRA — the governed layer typed intents · posture · kinematic envelopes · RSS · signed release an SEooC: a safety element designed to be integrated, not a stack that competes Certified OS & hypervisors QNX 8.0 for Safety (the recorded deployment target) · safety-certified RTOS class Safety-rated silicon DRIVE-class targets · Jetson Orin today · vendor-neutral inference: ONNX / OpenVINO / TensorRT, Qualcomm QNN & TI TIDL on the roadmap bounded, never trusted

Vendor-neutral on purpose: today's inference backends are ONNX Runtime, OpenVINO, and TensorRT; Qualcomm QNN and TI TIDL are tracked on the roadmap PLANNED

docs/safety/GOVERNOR_SAFETY_MANUAL.mddocs/safety/ASSUMPTIONS_OF_USE.mddocs/adr/0003-two-tier-base-and-d1-addon.md

Built to be built upon

Engineered for integration
from the first commit

Whether Kirra ships inside a vehicle program, an industrial platform, or a larger safety portfolio, the properties an integrator has to diligence are already in place — and machine-checked where possible.

Clean, permissive IP posture

The dependency license policy is an enforced allowlist — MIT, Apache-2.0, BSD-family and peers only, gated by cargo-deny on every push, with crates.io as the sole permitted source. The robot MCU firmware is a documented clean-room implementation. No copyleft surprises, no vendored mystery code.

deny.tomlfirmware/rosmaster-r2/README.md

The paper trail ships with every release

Tagged releases build a safety-case evidence bundle in CI — traceability matrix, safety constants provenance, gate results — so an assessment (or a diligence review) starts from artifacts, not interviews. Actions are SHA-pinned; containers are digest-pinned and cosign-signed.

.github/workflows/release.ymlci/build_safety_case.py

One repository, fully auditable

The checker, the runtime, the proofs, the safety case drafts, the hardware runbooks, and this website live in a single versioned tree with 27 blocking CI lanes. What you can diligence in a week here would take a quarter against a stack of private wikis.

.github/workflows/ci.yml

Small, certifiable core

The path to certification runs through a minimal no_std verdict core with a purity gate — no allocation, no clock, no crypto inside the decision — and a Ferrocene-ready toolchain direction. The expensive artifact to certify is deliberately the smallest one.

ci/check_verdict_core_purity.pydocs/adr/0032-governor-deployment-platform.md

The bet

Autonomy will be won by whoever
can prove safety at runtime.

Models will keep changing. Sensors will keep changing. The one durable interface in the stack is the envelope between intent and actuation — and whoever owns a proven, portable, certifiable version of that layer owns a seat in every machine that moves. Kirra is that layer, built in the open, with its evidence attached.

See it applied See how it's built Start a conversation