Updating a fleet of constrained nodes without bricking it
The four questions an industrial buyer asks before asking anything about the model: how do you update two hundred machines, what happens when an update is bad, what is inside the image, and can you rebuild the version running in the field today.
Figures for the six governance repositories taken on 21 August 2026, those for Cartocortex on 17 October 2026, by running the test suites. None is copied from the README files.
The demonstrations are about inference; the procurement is about the rest
Every conversation about edge AI eventually reaches the buyer's actual questions, and none of them are about the model. How do you update two hundred of these. What happens when an update is bad. What is inside the image. Can you rebuild the version running in the field today.
This repository is the unglamorous half, built as a working model rather than a slide: A/B slots with automatic rollback, digest-bound manifests, SBOM diffing and reproducible builds.
Silence is a rollback, and the fleet halts itself
"The state that survives a power cut is pending, and pending reverts."
Activation opens a confirmation window. A node that boots a new image and does not check in reverts to what it was running before, on its own timer, consulting nothing, whether the image is bad, the network is down, or someone pulled the power. Second rule: a wave over its failure budget stops the rollout, and there is no flag to continue, because such a flag would be used at three in the morning by whoever wants the deployment finished.
plan : inspection-agent -> 2.4.0
waves : canary, pilot, fleet
updated : 2
failed : 4
rolled back : 2 <- the number that matters
untouched : 6
✓ node-01 updated health probe passed
✓ node-02 updated health probe passed
✗ node-03 transport-failure link dropped during transfer
✗ node-04 digest-mismatch manifest says sha256:ceba2163…, bytes hash to sha256:c1735458…
✗ node-05 health-probe-failed health probe failed
✗ node-06 health-probe-failed no health probe supplied
still on 2.3.0: 10 node(s)digest-mismatch
The download succeeded and delivered the wrong bytes. A check that asks whether the transfer worked says yes.
no health probe supplied
Rolled back for the absence of a check. A machine nobody can ask does not keep a change on the strength of its silence.
The rollout halted itself in the pilot wave, four nodes of five having failed against a budget of one. Six machines were never touched and are still running the version that works, and ten remain on 2.3.0: that is the rollout succeeding, not failing.
Five tiers, one hundred and thirty-four tests
Run on 21 August 2026 against the public repository. Thirty-two controls are each mapped to the test that demonstrates them, which makes the mapping verifiable rather than declarative.
| Tier | Tests | The question it answers |
|---|---|---|
smoke | 6 | Does it start at all |
unit | 57 | Does each part behave at its boundary |
functional | 27 | Does the rollout meet its specification |
security | 22 | What does it do with an image or manifest it did not produce |
pentest | 22 | Can the claim be broken |
| Total | 134 | 96 % |
The integration gate chains static analysis, strict typing, source security review, dependency advisories and a 90 per cent coverage floor. The repository has no runtime dependencies.
The known gaps, as the repository states them
The repository's threat model lists six residual risks. The five that matter to an outside reader are these.
- No anti-rollback protection. An older, correctly signed image is accepted, vulnerabilities and all.
- The health probe is sampled once, at confirmation. Whatever degrades afterwards is not seen.
- No attestation. The version a node reports is its own account of itself.
- The signature verifier is the caller's. The repository models the quorum; it does not supply a root of trust.
- Nothing has met a power switch. Every node is a Python object, and the power cut is simulated, not suffered.
Four documents, in the order they are read
- docs/GETTING_STARTED.mdAssumes no terminal experience, and leads to the first simulated rollout.
- docs/ARCHITECTURE.mdThe design decisions, and what they rule out.
- docs/CONTROL_MAP.mdThe thirty-two controls, each mapped to the test that demonstrates it.
- docs/THREAT_MODEL.mdThe six residual risks, stated without mitigation.
A governance claim is verifiable, or it is worth nothing
The code of each link is public. To discuss this work, write to the author.