Robotics fleets
Humanoid Uplink
Signed over-air skill, policy and firmware transfer between humanoids, commanded from one fleet hub.
Held by Manthra Tech Ventures Inc.
- Lane
- Robotics fleets
- Payment rail
- Zen Payments · PayKings
- Rail classification
- High-risk merchant
- Operating vault
- Mercury Operating Beta
- Frameworks
- MiCA (EU) · FATF Travel Rule
- Target domain
- manthratech.io
Every Web3, autonomy and luxury ledger here stays completely outside HealthyManthra Inc.'s HIPAA/GovCloud clinical stores.
Feasibility
Buildable now — with one honest constraint.
Every layer of an over-air humanoid programming pipeline already ships somewhere: signed fleet updates (Uptane 2.1.0, Mender, RAUC with A/B partitions), ROS 2 peer discovery with DDS-Security, private-5G and Wi-Fi 7 links, docked 60 GHz bulk offload. What does not exist as a product is the middle: robot-to-robot skill handoff where a validated unit serves the same signed bundle to its neighbours, with provenance recorded per hop. That gap is the white space.
The air-link carries skills, policies, configuration and telemetry — never the control loop. Whole-body balance and manipulation run locally at 500 Hz to 1 kHz; a radio path never enters that decision at any latency.
Technology readiness
| Capability | State of the art | Readiness |
|---|---|---|
| Fleet-wide command and update console | Shipping (automotive, warehouse AMRs; rare on humanoids) | TRL 9 |
| Signed OTA images, A/B slots, anti-rollback | Shipping (Uptane, Mender, RAUC, balena) | TRL 9 |
| Robot-to-robot messaging and discovery | Shipping (ROS 2 + DDS, Zenoh for routed mesh) | TRL 8 |
| Multi-robot traffic and zone coordination | Shipping (Open-RMF adapters) | TRL 8 |
| Docked bulk sensor offload (60 GHz / Wi-Fi 7) | Deployed in labs, not standard practice | TRL 7 |
| Shared learned policies across one fleet | Pilot stage (fleet learning, distillation) | TRL 6 |
| Safety parameter updates under ISO 10218-1:2025 | Emerging — standard is new | TRL 4 |
| Peer-to-peer skill handoff with per-hop attestation | No packaged offering found | TRL 3–4 |
Stack that already exists
Layer by layer, with the piece this portal would own.
| Layer | Existing technology | What we add |
|---|---|---|
| Air link | Wi-Fi 6E/7, private 5G (URLLC), docked 60 GHz, UWB ranging | Dual-link failover behind one signed peer handshake |
| Middleware | ROS 2 with DDS-Security (SROS2); Eclipse Zenoh for routed, constrained mesh | Skill bundles addressed as immutable, signed artefacts |
| Local fleet logic | Open-RMF for traffic, zones, lift and door arbitration | RMF adapter that refuses unverified units into a zone |
| Update framework | Uptane 2.1.0 — Director repository plus Image repository, TUF metadata on both | Two-repository model applied to whole-body policy bundles |
| On-robot install | Secure boot chain, A/B partitions, anti-rollback counter, self-test gate | Certified safety envelope packed with the policy it governs |
| Signature and keys | FIPS 204 ML-DSA for signing, hybrid X25519 + ML-KEM (FIPS 203) on links | Post-quantum by default — a 12-year fleet outlives a classical key |
| Compliance spine | ISO 10218-1/-2:2025 (cyber clause 5.1.16 / 5.2.16, port hardening, trusted vs untrusted networks), IEC 62443, EU Cyber Resilience Act secure-update duty, EU Machinery Regulation 2023/1230 | Update campaign produces the evidence file the standard asks for |
How one command reaches a cell
- 1
Author and sign
A skill bundle is built in CI: policy weights, configuration, the safety envelope it is allowed to run inside, and the acceptance tests it must pass. Signed with an ML-DSA key held in an HSM.
- 2
Stage to a cohort
The Director repository targets by site, shift, model and serial range — never the whole fleet at once. The Image repository holds the ciphertext; the two disagreeing is a refusal, not a warning.
- 3
Deliver
Units pull over Wi-Fi 7 or private 5G on charge. A designated hub robot relays the same bundle into an air-gapped cell; multi-gigabyte logs leave over docked 60 GHz instead of the air.
- 4
Verify and install
Secure boot checks the signature and rollback index, writes the inactive slot, runs self-test, then promotes or reverts — unattended, because a bricked humanoid costs days of operations.
- 5
Propagate peer-to-peer
A promoted unit serves the identical signed bundle to neighbours in its cell and attests what it handed over. Each hop writes a provenance receipt into the Beta compliance ledger.
Hard limits worth pricing in
- Control loop
- 500 Hz – 1 kHz local; a radio path adds 5–50 ms
- Central control is mission-level only
- Raw sensor volume
- 1–4 TB/day per humanoid (stereo, depth, proprioception)
- Stream events; offload bulk data docked
- Actuator and ECU count
- 20–60 per unit
- A campaign, not a file copy
- Unattended success rate
- Effectively 99.9%
- Canary cohorts and one-command revert are mandatory
Where the defensible claim sits
- Peer-to-peer signed skill propagation with attestation per hop — no central server inside the cell
- Uptane's two-repository model applied to humanoid whole-body policy bundles, with site/shift canary targeting
- Safety-envelope co-versioning: a bundle that refuses to load unless its certified envelope matches the installed firmware baseline
- A hub robot acting as local update relay for air-gapped or radio-quiet sites
- Post-quantum signature verification budgeted for embedded update agents, not assumed
Landscape references
AI-generated briefing. Assembled from public standards and vendor documentation for scoping only — verify every figure with engineering and counsel before any filing, quotation or customer commitment.