What leaves the building: nothing

Most data policies are written as lists of exceptions. Nothing leaves, except telemetry. Nothing leaves, except crash reports. Nothing leaves, except the anonymized samples that improve the model for everyone. Each exception sounds small, and together they describe a building that is leaking steadily through holes it agreed to.

The Element 31 policy has no exceptions clause. Nothing produced on the floor leaves the operator's hardware or the operator's network. This article walks through what the floor produces, item by item, and shows where each one lives.

The inventory

A robot floor served by a facility pool produces five kinds of material.

Camera feeds are the raw sight of the building: the aisles, the racks, the goods, the people, the vehicles. Captures are the frames and sequences the fleet saves, usually because something was hard or new. Task records describe each site task that was authored in Agency Studio, who approved it, what bounds it ran under, and every run of it. Adapted weights are what the pool's models become after they are tuned on the site's own captures. The decision record is the log of what the pool told each robot and when.

Every one of these lives on the Czar nodes in the building's own rack and travels only over the facility's own network. There is no sixth item that is treated differently.

Why nothing is harder than little

Keeping most data inside is an ordinary engineering goal. Keeping all of it inside changes how the system has to be built, because the usual reasons for an exit have to be solved some other way.

Model improvement is the first. The common pattern sends captures to a vendor's cloud, where the model is retrained and a new version is pushed down. Substrate runs adaptation on the pool instead. The captures stay, the fine-tuning happens on the site's own hardware, and the adapted weights never travel. The floor gets better at its own floor without teaching anyone else's.

Support is the second. The common pattern keeps a persistent connection open so a vendor can look in. Customer appliances never connect to the Element 31 portal. Updates are downloaded by the customer and applied by the customer. Remote sessions are opened by the customer, and on sovereign sites only after the customer attests to detached data disks, an isolated network, a supervised console, and confirmed authority, inside a window that expires on its own.

Monitoring is the third. The usual answer is telemetry streamed to a dashboard somewhere. On a facility pool the record is kept on the pool, and Watchman verifies integrity from inside the building. The operator reads its own record.

Adaptation without an exit

The adaptation point deserves its own section because it is the one most often assumed to require a cloud. A pick arm encounters a new kind of packaging. A humanoid on an assembly line meets a fixture the general model has never seen. The fleet captures the moment, and the site wants the model to learn from it.

On the Grid, that learning is local. The captures are already on the pool. Substrate fine-tunes on them, on the pool, evaluates the result, and keeps the record of that evaluation on the pool as well. The improvement is specific to the floor that produced it, which is usually what the operator wanted anyway. The general model elsewhere is not touched, and the site's packaging, fixtures, and layout are not described to anyone.

Connected sites and the shape of the exit

An air-gapped site has no path out, so the nothing is physical. A connected site has declared routes, so the nothing has to be stated more precisely: the pool reaches the systems the site named, for the purposes the site named, and nothing in the inventory above is exported through those routes.

Local Bridge enforces that. Only declared routes exist, and egress is denied by default. A route to the warehouse system carries work orders and status. A route to a robot vendor's fleet software carries coordination with that fleet. Neither route is a channel for camera feeds or weights, and no undeclared route exists to carry them either. See A connection is a decision, not a default for how declarations are made.

Reading the policy as a fact

The claim that nothing leaves is checkable in a way that a list of exceptions is not. The site can read the declared routes and see that none of them is an export. The site can read the record and see that adaptation ran on the pool. The site can confirm that the portal never received a connection from the appliance, because the appliance never opens one.

That is the practical meaning of the word nothing: not a promise about intentions but an absence the site can look for and fail to find. For the broader picture of why this matters to buildings that never thought of themselves as sensitive, see Sovereignty for ordinary facilities. For the serving system that makes local adaptation possible, see Substrate.