Estates with many sites and more than one posture

An operator with many buildings does not have many identical risk profiles. One warehouse handles general merchandise and lives comfortably connected to its warehouse system and its robot vendors' fleet software. Another runs under a contract that forbids any path out. A plant has a prototype shop that the rest of the plant is not allowed to see into. The estate needs more than one posture, and it does not want more than one kind of appliance to get it.

It does not need one. Czar is the same sealed node at every site. Posture is a choice made per site at installation: air-gapped, with no path out, or connected only to the systems the site already secures. An estate that runs both is a mixed estate, and it is the normal case rather than the exception.

Two postures, one appliance

An air-gapped Czar has no route out of the building. Updates arrive as signed bundles carried in on media. Remote sessions do not happen unless the site opens a window for one, under conditions the site attests to. Everything the pool sees, decides, and learns stays on the site's hardware, and the site can prove there was never a path for it to leave.

A connected Czar reaches only what the site declared. Through Local Bridge, the declared routes are typically the robot vendors' fleet software, the warehouse or execution system, and the PLCs if the site chose that. Egress is denied by default. Everything else is unreachable. The site's feeds, captures, task records, and adapted weights stay on its own hardware exactly as they would on the air-gapped site; the difference is which systems inside the perimeter the pool may talk to.

Both run Substrate. Both run Agency Studio. Both attest what they are running before joining a Grid or accepting a task. Both keep the same kind of record. An engineer who knows one knows the other.

A connection is a decision

The thing a mixed estate is really managing is the list of decisions. At each connected site, someone declared each route, and that declaration is on record. At each sovereign site, someone decided there would be none. The estate's security lead can read those decisions back for every building without visiting it, because the decision is a configuration on the node, not a habit of the installer.

That is what it means to say a connection is a decision rather than a default. A new site does not arrive connected and get locked down. It arrives with no routes and is opened only to what the site declares. A site that moves from connected to air-gapped, because a contract changed, does so by removing declarations and taking updates by media from then on. The appliance did not change.

Updates across the estate

Signed updates reach every site, and they reach each site in the way its posture allows. A connected site downloads a signed update when the site's staff initiate it. A sovereign site receives the same signed bundle on media, carried in by staff, and the node verifies the signature before applying it. In neither case does the appliance reach out on its own.

Customer appliances never connect to Element 31's portal. The portal, at e31.online, is where the estate's staff download signed updates, open support tickets, and manage billing. It is a place the operator's people go; it is not a place the operator's appliances go. A remote session is always customer-initiated, and on a sovereign site it requires the customer's attestation that data disks are detached, the network is isolated, the console is supervised, and authority is confirmed, before staff can approve a window with a hard expiry.

What does not cross between sites

Each site's pool holds that site's footage, captures, adapted models, and record. The estate does not pool them into one place. A model adapted on one warehouse's frost is that warehouse's model. A plant's prototype shop footage does not exist outside the plant's air-gapped node. The operator can carry an adapted model or a task version from one site to another as a decision, by the same means updates travel, but nothing moves on its own.

Site tasks follow the same rule. A task authored in Agency Studio at one site is a versioned artifact approved by a named role at that site. Whether a sister site adopts the same task is that site's decision, with its own approval and its own bounds, because its zones, speeds, and distances are its own.

One commercial model across the estate

Each site's Grid is a subscription for the configured Grid at that site: hardware, platform license, and sustainment in one line, fixed for the term. A sovereign site and a connected site are the same kind of line. More robots on either pool do not move it. Some sites in an estate arrive by Facility Direct, where the building subscribes; others arrive as Czar Chassis, shipped by the robot vendor or integrator under their own name. Either way it is the same Grid under the same sustainment and attestation.

For the physical side of placing a pool in each building, see Where the pool sits in the building. For how the commercial routes work, see How to buy.