Frontier Mechanics Week 106: Gravis gives excavators autonomy, Moxi learns across hospitals, PACE binds an agent to transaction bytes, and Heronic compiles a dataset into an FPGA

Construction robotics

Gravis puts the autonomy kit on the machine already at the jobsite

Gravis Robotics announced on August 17 that SoftBank had invested $200 million in its Series A. The Swiss company says its autonomy software is already deployed on heavy machinery across four continents and that it will use the financing to scale deployments. It also cited an $8 million UK government-backed CAM Pathfinder project with Flannery Plant Hire. The round is exceptionally large for its stage, so the operating evidence matters more than the label largest construction-robotics Series A.

Construction autonomy is harder to standardize than a warehouse. Terrain changes because the machine changes it. Soil strength, slope, dust, water, occlusion, and lighting vary. Workers and vehicles enter without following robot-friendly lanes. Plans can be incomplete or stale. A loading cycle that worked yesterday may meet a trench, stockpile, or material boundary that did not exist an hour ago. The world model must be updated as production changes the world.

Retrofitting existing excavators, dozers, and loaders is economically attractive because contractors already own the expensive hydraulic and mechanical platform. The autonomy kit can add perception, compute, communications, and control interfaces without asking a customer to replace the fleet. Technically, every machine model brings different geometry, hydraulic latency, valve response, payload behavior, and wear. Calibration cannot assume that two nominally identical excavators produce the same bucket trajectory for the same command.

A useful control stack separates task intent from machine dynamics. A planner might request a bucket pose, dig path, or volume moved. A model-predictive or learned low-level controller then maps that request into boom, stick, bucket, swing, and travel commands while respecting pressure, stability, collision, and actuator limits. System identification can estimate response online. Safety monitors need independent authority to stop motion when a person enters a protected zone or the machine approaches a tipping condition.

Excavation makes contact estimation central. The bucket interacts with granular material whose forces depend on depth, angle, speed, moisture, compaction, and prior disturbance. Cameras cannot see through the soil. Hydraulic pressure and joint motion become proxies for contact state. A controller must detect a failed bite, hard inclusion, or overloaded bucket and replan rather than forcing the nominal trajectory. Productivity comes from recovering across thousands of variable cycles, not reproducing one smooth scoop.

Jobsite deployment is also a geospatial data problem. Design surfaces arrive from BIM or civil plans. Survey control defines the coordinate frame. Machines and human crews generate as-built measurements. An autonomous system should move material toward the specified grade while preserving a record of where it worked and with what confidence. If coordinate transforms, GNSS corrections, or site models disagree, the correct behavior is to stop and surface the discrepancy. Fast automation of the wrong datum is expensive.

Gravis emphasizes software-defined intelligence across brands, which implies a hardware abstraction layer for sensors, vehicle buses, actuators, and machine capabilities. The abstraction is credible when a new vehicle can be integrated through a bounded adapter and validated against common behaviors. It is weak when every deployment requires senior controls engineers to rewrite the stack. Metrics should therefore include engineering weeks per new model and site, not only autonomous hours after commissioning.

Two hundred million dollars can fund field teams, rugged hardware, spares, insurance, data infrastructure, and the long validation period that construction customers require. It can also finance expansion before the autonomy product is repeatable. The scorecard is material moved to specification per paid machine-hour, availability, safety events, intervention load, fuel or energy per unit, rework, and deployment time. If those curves improve across continents and machine brands, Gravis will have built a platform. If not, it will have built a well-capitalized projects business.

Healthcare robotics

Moxi 2.0 turns five years of hallway edge cases into a fleet model

Diligent Robotics said on August 17 that it had begun rolling out Moxi 2.0 to health-system customers in the United States. The mobile manipulator follows five years of operation across more than 25 hospitals and introduces redesigned hardware plus what Diligent calls a proprietary robotic world model. Diligent is now owned by Serve Robotics, creating a shared physical-AI research base across hospital and sidewalk-delivery fleets. The rollout makes this more than the product preview published in 2025.

Hospital logistics look simple when reduced to moving supplies. The environment is a live, semi-structured network of corridors, elevators, badge-controlled doors, carts, beds, visitors, staff, spills, temporary equipment, and changing infection-control rules. A robot must navigate without asking people to reorganize around it. It also has to complete chain-of-custody tasks for medications, lab specimens, and equipment while preserving privacy and not blocking clinical work.

Moxi's tall mobile base, arm, and expressive head solve a social as well as mechanical geometry. Sensors need a useful view over clutter. The arm must reach cabinets and bins. The body must remain legible around people and fit through doors and elevators. Hospital acceptance depends on predictable motion, low noise, clear yielding, and obvious intent. A technically optimal path that repeatedly startles nurses is not an optimal path.

A world model can help predict how scenes evolve and which actions remain feasible. In a hospital, it might learn that an elevator queue moves differently at shift change, a cart is likely temporary, or a particular door interaction requires a human assist. The model should not replace maps, access rules, or collision safety. It can provide priors and forecasts to a planner that remains constrained by verified geometry and policy. Learned anticipation is useful only while uncertainty stays visible.

Fleet learning is the attractive part. One robot encounters a new cart arrangement, elevator behavior, or handoff pattern, and the fleet can eventually improve. The update path needs strict data and evaluation controls. Hospitals differ in layout, workflows, demographics, devices, and privacy requirements. A model trained on one site's traffic may produce unsafe confidence at another. Diligent needs site-stratified tests, shadow evaluation, rollback, version tracking, and an account of which experiences entered each release.

The hardware redesign is likely to matter more than a model headline for availability. Wheels, batteries, joints, grippers, doors, and charging contacts wear. Hospital floors include thresholds, reflective surfaces, narrow turns, and elevator gaps. Maintenance windows compete with clinical schedules. A 2.0 platform should improve mean time between service, service time, cleanability, battery endurance, manipulation success, and remote diagnostic coverage. Every extra autonomy feature adds little value if the robot waits for a technician.

The business metric is tasks that remove real work from clinical teams. Robot miles and completed missions can rise while staff still spend time loading, rescuing, cleaning, or waiting. A fair time study counts all human touches around the task, compares them with the previous workflow, and observes whether labor moves to patient care. It should also measure task lateness and cancellation. A delivery that arrives eventually may still fail the clinical process.

Moxi 2.0 has something many robotics launches lack: a deployed predecessor and years of operational data. That makes the next questions sharper. Diligent should publish availability, autonomous completion, interventions per mission, elevator and door success, service burden, and task-level labor savings by site maturity. If its world model improves those numbers without increasing opaque failures, this rollout will be a credible example of fleet data turning into a better physical product.

Agentic finance security

PACE assumes the trading agent is compromised and still refuses the wrong bytes

Researchers submitted PACE, Policy-Attested Contract Execution, on August 18. The design places a deterministic authorization pipeline between a language-model agent and decentralized-finance transactions. The agent proposes a typed intent. A simulator and policy verifier inspect it. An approved Policy Decision Record is signed and cryptographically bound to the policy, simulation, target, value, nonce, validity window, and exact calldata. A Solidity smart account rechecks that record before making the external call.

The threat model is well chosen. A DeFi agent reads token metadata, price feeds, web content, chat history, and tool output, any of which can contain prompt injection. If the same model that interprets untrusted text also owns the signing key, a malicious string can become an irreversible approval, swap, or transfer. Alignment lowers probability and cannot provide a transaction-level guarantee. PACE treats the model and its proposed intent as untrusted inputs.

Typed intent is the first control. Instead of approving a sentence such as maximize stablecoin yield, the verifier receives chain ID, sender, target, value, function selector, calldata, token approvals, slippage, and other explicit fields. Policy can limit addresses, selectors, token spending, unlimited approvals, slippage, simulation age, touched contracts, and post-state measures such as health factor. The verifier never asks the model whether an exception seems reasonable.

Simulation alone leaves a time-of-check to time-of-use gap. A transaction can be simulated safely, then have its calldata changed before submission. PACE hashes the intent and calldata into the signed decision record. The smart account recovers the verifier signature and compares those fields at execution. Nonce and expiry checks prevent replay of an old approval. This is a clean application of a general security principle: bind authorization to the exact side effect, not to a description of it.

The benchmark contains 40 tasks across benign actions, prompt injection, unsafe contracts, DeFi exploit patterns, and maximal-extractable-value or slippage cases. Across 2,800 deterministic trials, PACE reported zero unsafe executions and zero false positives, while an unguarded baseline executed unsafe actions at a rate of 0.80 across all trials. The on-chain enforcement added about 29,826 to 31,822 gas. These are controlled sandbox results, not evidence that live funds are safe.

The paper is explicit about the largest assumption: semantic fields must be derived from the bytes, not trusted from the language model. A model could claim a small approval while placing an unlimited approval in encoded calldata. A production verifier needs reliable ABI decoding and execution traces, including proxy and router behavior. The touched-contract set is also state-dependent. A contract may execute a different path between simulation and inclusion, even when calldata is identical.

Economic outcomes are not byte outcomes. PACE can guarantee that the approved bytes reached the approved target within a time window. It cannot guarantee that reserves, oracle values, ordering, or contract implementation remain as simulated. A sandwich attacker can change realized price within allowed slippage. An upgradeable proxy can alter logic. Sound policy therefore needs conservative bounds, freshness, trusted state sources, and possibly private submission or inclusion guarantees. Cryptographic fidelity is necessary and narrower than profitable execution.

The ablation results are instructive. Permissive policy settings raised unsafe execution most sharply, and removing the touched-contract allowlist also weakened the system. That means the framework moves risk into policy authorship and trace interpretation. A deterministic verifier faithfully enforces a bad policy. Usable templates, safe defaults, policy testing, human-readable explanations, and recovery controls become part of security. Formal structure does not remove governance.

PACE is relevant beyond DeFi. Any agent that can send an email, deploy code, buy inventory, change infrastructure, or command a robot should cross a deterministic authorization boundary before the side effect. The boundary should parse a typed action, verify policy against trusted state, bind approval to exact execution, prevent replay, and preserve an audit record. Language models are useful planners. They are poor roots of authority. This paper gives that separation a concrete, measurable shape.

Edge AI

Heronic and ONE WARE try to make dataset-to-FPGA a reproducible compiler path

Heronic Technologies announced on August 19 that it had partnered with ONE WARE. ONE AI automatically searches and trains application-specific models from a dataset. Heronic then converts the selected network into deployment-ready register-transfer-level logic optimized for a target FPGA and performance requirement. The companies describe a continuous path from data to hardware. No customer benchmark or production deployment was included, so the value lies in the shape of the toolchain and the questions it has to answer.

An FPGA contains configurable logic blocks, multipliers, memories, routing, and high-speed interfaces. Unlike a GPU, which executes a model as instructions and kernels, an FPGA can instantiate a custom pipeline whose operators exist spatially in the fabric. Data can stream through convolution, activation, rescaling, and output stages with deterministic latency. Precision can be chosen per signal. Unused general hardware disappears from the active design. For stable edge workloads, that can improve latency and energy efficiency.

The cost is compilation complexity. A neural architecture has tensor shapes, operations, quantization, and control flow. The hardware target has finite DSP blocks, lookup tables, block RAM, bandwidth, timing paths, and I/O. Mapping requires choosing parallelism, tiling, buffering, pipeline depth, clock frequency, and numerical formats. More parallel operators raise throughput and resource use. Deeper reuse saves area and raises latency. Place-and-route may fail timing even when a high-level estimate looked comfortable.

Automated model search adds another loop. ONE AI can explore architectures that meet accuracy and perhaps size objectives. If hardware cost enters only after training, it may select a model with awkward operators, memory access, or fan-out. A real dataset-to-FPGA system should include resource, latency, bandwidth, and timing estimates inside the search objective. Better yet, it should learn from completed implementations so that predicted hardware cost tracks actual synthesis and place-and-route results.

Quantization is the bridge. Integer and fixed-point arithmetic use FPGA fabric efficiently, but reduced precision changes model behavior. Calibration chooses scales and clipping from representative data. Quantization-aware training can recover accuracy by exposing the model to simulated low-precision effects. Per-channel scales help weights and complicate hardware. Accumulators need enough width to avoid overflow. The generated artifact should include a numerical contract so that software reference outputs and RTL agree within stated bounds.

Register-transfer-level generation is only an intermediate success. The design still needs synthesis, timing closure, verification, board integration, drivers, and monitoring. A generated module must handle resets, backpressure, malformed inputs, clock-domain crossings, and finite buffers. Safety-critical or industrial deployments also need traceability from training dataset and model version to bitstream. If a model is retrained, teams must know exactly which hardware image changed and which tests were rerun.

The partnership also raises a verification opportunity. The automated system can generate a testbench alongside the RTL, using held-out inputs and bit-accurate reference outputs. Formal checks can prove interface properties, bounded latency, absence of overflow in declared ranges, and equivalence between transformations. Continuous integration can rebuild the bitstream when data or requirements change. Automation is more valuable when it produces evidence with the design, not merely the design faster.

The result to watch is time from a new labeled dataset to a timed, power-measured bitstream on a named board, with accuracy, latency distribution, resource utilization, clock frequency, memory traffic, and power at the wall. Then repeat the process for a materially different model. If engineers only intervene to state constraints and review results, the toolchain has compressed scarce FPGA work. If every generated network needs manual RTL rescue, the partnership is still a promising front end around a traditional hardware project.