Architecture
Why it is built this way.
Five decisions, and why we made each one. Most of them come from a single number: a modest robot puts 100 to 300 MB a minute on its message bus. That is more than a fleet on cellular links can upload, and more than anyone wants to pay to store.
The robot decides what to keep.
A modest robot means one 1080p camera, a 16-beam LiDAR, an inertial unit, odometry, and the control topics. At 200 MB a minute, one robot produces close to 300 GB a day. A hundred of them cannot send that anywhere.
We tried the small version first and shipped summary metrics only. It did not work. A CPU chart cannot tell you why a robot swerved, and by the time anyone asked, the data that would have answered it was gone. Recording everything fails the other way: the disk fills within hours and the one minute that mattered is buried in the rest.
So the agent chooses on the robot. It subscribes only to the topics that carry a diagnosis, holds their last 60 seconds in memory, and overwrites that memory in place the way a dashcam does. When a rule fires, it freezes that window plus a few seconds after. An engineer opens sixty seconds instead of a day of recordings.
Every capture is a single MCAP file.
We wrote our own recording format first and deleted it a week later. MCAP already had readers, a chunked index, and schemas that travel inside the file. Ours had a name and nothing else.
MCAP has been the default recording format in ROS 2 since May 2023, and NVIDIA Isaac has used it since 3.0. One reader handles most robots, so we do not write custom parsing per customer.
The format is append only, so a crash partway through a write does not corrupt what came before. It is indexed in chunks, so a tool reads the range it needs instead of the whole file. It opens in the viewers you already use. Nothing about it ties you to us: you can export every capture and go.
How close replay gets to the original run.
Reproducing a failure physically means staging the same aisle with the same lighting and the same pallet, on a robot that is currently doing paid work. Replay means an engineer opens the recording at their desk.
It is not the same run, though, and we will not pretend otherwise. Play one recording through a standard ROS 2 stack twice and you get two different trajectories, because message arrival order, thread scheduling, and clock reads all shift between runs. So we describe replay in four steps and always say which one we mean.
Playback is what ships today: the recording, rendered in a viewer. Re-running a single program against its recorded inputs comes next, and that one is deterministic for programs driven by messages rather than by hardware timing. Re-running the whole graph is after that, and it lands close to the original rather than on top of it. Reproducing a full run bit for bit is not possible on a standard robot stack, and we would want to see the mechanism from anyone who says they do it.
We use the word deterministic only for single program re-runs, and never without saying so.
Rust.
The agent runs on the same computer as the software that keeps a robot from hitting a person or a rack of shelving. It cannot be the reason that software misses a deadline. That rules out garbage collection pauses in the code that runs on every message, and it rules out memory safety bugs we would be debugging in production. Rust gives us both. Thin C and Python wrappers expose the SDK.
The budgets are design targets, and we enforce them as CI tests on reference hardware: under 5% of one CPU core, under 250 MB of memory, and no allocation in the per-message code. The benchmark harness is public, so you can run it on your own boards.
It ships as a static binary, a Debian package, a container, and a ROS 2 launch include.
Why we do not record everything.
Sending every recording to the cloud and keeping it there is a different product, and several companies already sell it. We do not sell storage and we do not charge for it.
The agent also has no physics simulator, no operations dashboard, and no teleoperation. It reads from the robot and never sends a command to it.
Every number above is a design target measured on our own hardware, not a figure from a customer fleet. Playback ships now. Single program re-run and multi-robot capture are being built, and this page will change as they land.