The runtime that
verifies before it obeys.
LoxOS is the on-robot runtime. It boots signed builds, verifies every manifest against its Robinhood Chain anchor before flashing, and reports fleet health in real time. If the signature doesn't check out, the robot doesn't run it.
Chain-verified boot
Every build manifest is signed by its author and anchored on-chain. Units fetch the anchor and verify both before a single byte flashes. Supply-chain attacks bounce.
Staged OTA
Rollouts ship in waves — 25% of the fleet at a time by default. Health checks gate each wave; a degraded wave halts the rollout automatically.
Instant rollback
abortRollout() is one call. Units revert to the last healthy manifest from their local A/B slot — no truck rolls, no bricked hardware.
Skill sandboxing
Community skills run in capability-scoped sandboxes. A navigation skill can read LiDAR; it cannot touch the payment keys or the OTA slot.
Fleet telemetry
Heartbeats, task metrics and anomaly flags stream to your dashboard. unitsHealthy/unitsTotal isn't a guess — it's a live number you can query from the SDK.
Keys stay on-robot
Unit identity keys live in the secure element and never leave the device. Signing happens locally; the chain only ever sees proofs.
Ship your first rollout.
Sign a manifest and stage it across a fleet with two SDK calls. Abort is always one call away.