Autonomous Aviation Governance
Flightworks Systems inserts deterministic governance middleware between probabilistic AI outputs and MAVLink command authority. AI can propose. FlightLaw decides. Sentinel enforces at the wire. The record proves it.
Architectural Constraints from the Agency Paradox are enforced here as composed Codex Laws.
The authority gap
Autonomous UAS stacks let probabilistic AI outputs flow directly into autopilot authority with no named, auditable boundary. A detect-and-avoid model that "usually" refuses an unsafe maneuver is one clever rephrasing away from performing it — because the refusal lives in the same probabilistic layer as everything else the model does.
Flightworks inserts middleware governance: every AI proposal and every MAVLink frame passes through deterministic Laws before reaching hardware. Every decision is hash-chained. Every authority boundary is auditable. The same inputs always produce the same verdict.
Where Flightworks sits
The governance pipeline runs from AI proposal through constitutional evaluation to wire-speed enforcement. Watch Station (the operator ground control station) handles pre-flight authorization and post-flight evidence review; Sentinel handles in-flight frame evaluation at MAVLink wire speed.
Two runtimes, one kernel
Flightworks uses two language-specific enforcement kernels that implement the same AgentVector protocols — State, Action, Reducer, Law, Evidence, Replay — with cross-language determinism tests.
| Runtime | Kernel | Role | Status |
|---|---|---|---|
| FlightLaw | SwiftVector | Constitutional Laws 3, 4, 7, 8. Pre-flight authorization, mission package validation, operator interface. | SP0 kernel built |
| Sentinel | RustVector | MAVLink v2 proxy. Wire-speed frame evaluation, geofence enforcement, hash-chain recording. | v0.2.0 — geofence Law shipped |
| Watch Station | SwiftVector | Operator GCS. Pre/during/post-flight governance separation from autopilot execution. | SP0 kernel built; native UI in progress |
Deny-wins composition: if any Law returns DENY, the action is blocked regardless of other Law verdicts. No runtime bypass. Operator override requires identity and rationale — captured in the evidence chain.
The verdict contract
Every action the reducer evaluates resolves to exactly one of three verdicts. This three-state gate is the core of the enforcement model — identical across SwiftVector and RustVector implementations.
| Verdict | Meaning | What happens |
|---|---|---|
| AUTO_ALLOW | Action is within the authorized envelope for the current state. | Effect executes. Proposal, verdict, and result written to evidence chain. |
| AUTO_DENY | Action violates a Law or domain rule. No human review can rescue it in this state. | Effect blocked. Denial and reason recorded. State unchanged. |
| ESCALATE | Action requires human judgment — a deliberate handoff, not uncertainty. | Action held. Operator decides. Decision recorded with identity and rationale. |
Evidence and replay
Every governance verdict on every frame is recorded in a SHA256 hash-chained audit log. The post-flight evidence bundle is portable: an inspector or evaluator can verify chain integrity and replay every verdict deterministically.
sentinel verify --bundle FW-2026-04-15-001.json
# Chain intact. 7340 frames. SHA256 verified. No gaps.
sentinel replay --bundle FW-2026-04-15-001.json
# 7340/7340 verdicts identical. Determinism verified.The Part 108 compliance scenario walks through a complete BVLOS mission with frame-by-frame governance, one AI deviation escalation, and a sealed evidence bundle mapped to proposed FAA rulemaking.
Mission jurisdictions
FlightLaw composes four constitutional Laws (3, 4, 7, 8). Mission-specific jurisdictions extend FlightLaw with domain governance — same evidence format, different operational rules.
| Jurisdiction | Domain | Status |
|---|---|---|
| FlightLaw | Universal safety kernel | SP0 kernel built |
| ThermalLaw | Post-hail roof inspection, infrastructure assessment | Spec complete |
| SurveyLaw | Precision mapping with RTK (2cm accuracy enforcement) | Spec complete |
| FireLaw | Wildfire monitoring, multi-asset governance | Spec complete |
| ISRLaw | Swarm ISR, comms-denied pre-loaded authority | Spec complete |
Cross-domain proof
The same constitutional architecture that governs autonomous aviation also governs desktop AI agents. Vigil applies Boundary, Resource, and Authority Laws to shell-and-browser agents. Light Station provides the operator console. The kernel pattern is identical — only the Laws and evidence context change.
326 tests across 59 suites. Proves the kernel works in production outside aviation.
Vigil jurisdiction →Operator console for any AgentVector jurisdiction. Reference implementation v0.2.0.
Light Station →Status matrix
Honest maturity: what ships, what is documented, what is planned.
| Component | Shipped | Documented | Notes |
|---|---|---|---|
| Sentinel geofence Law | Yes | Yes | v0.2.0, PX4 SITL demo |
| FlightLaw SP0 kernel | Yes | Yes | Laws 3, 4, 7, 8 |
| Watch Station UI | Partial | Yes | SwiftUI shell in progress |
| ThermalLaw / SurveyLaw | No | Spec complete | PRDs written, code not started |
| Part 108 compliance scenario | N/A | Yes | Full walkthrough → |