Warden Edge

No. Warden Edge is pre-launch. What this page shows is a concept and a technical demonstration of the underlying loop. There is no shipping product, no deployment, no pilot programme, and no results to report. Anything on this page describing site types or hardware describes intent, not something already delivered.

No — that is the whole point of the design. The patrol dog is an actuator. It patrols, carries a camera, and plays a response that a person has already authorized. Detection and reasoning happen on the fixed edge-AI box, and the loop deliberately stops and waits while an authorization notification goes to the operator's phone.

From detection to authorization, the patroller does not move. No command reaches the locomotion controller while an event is open. The patroller detects while already stopped in dwell, so there is no motion of any kind to interrupt or reverse.

The authorized response is deliberately contained: an audio deterrent played through the audio module on the unit's expansion port, asking the person to leave the premises, from wherever the unit already is. It does not navigate toward the subject, and it has no authority to. Speak, do not chase — the restraint is part of the design, not a limitation of it.

The distinction matters because an unsupervised machine taking action on a commercial property creates exposure rather than removing it.

Yes, and that needs stating plainly. If the model can escalate, it can also decline to, and that is a machine making a decision. The distinction that matters: the model decides what reaches a human’s attention. It never decides what happens. Triage, not authorization. No action is ever taken without a person — that claim is unchanged.

Three constraints bound the triage:

1. Suppression is recorded. A non-escalation writes a record entry with the segment reference and the reasoning. This is not a loss, it is due-diligence evidence. An operator who can produce “at 01:40 a person was observed in zone C, assessed as site staff on the scheduled dock round, not escalated” is in a stronger position than one whose system silently saw nothing.

2. Suppression is bounded. Above a detector-confidence threshold, or with corroboration present in a restricted zone, escalation is unconditional and the model’s assessment does not apply. Judgment is exercised only inside a band the operator defines.

3. Suppression fails open. Timeout, malformed output, or a hedged answer all escalate. A slightly under-informed notification costs ten seconds; a suppressed real event costs the thing this product is for.

It recommends. The notification carries what was observed, why it warrants a response, and a recommended action with the reasoning behind it — so the operator is making an informed decision rather than interpreting a raw detection at two in the morning.

The system recommends; the person decides. The operator adjudicates the recommendation: approve it, decline it, or authorize a different action. Nothing executes without that decision, exactly as before — presenting a recommendation does not move the gate, it only means the human is better informed when they reach it.

Recommendations are bounded. They are drawn only from the same pre-authorized, non-confrontational action set the system could ever execute — an audio deterrent from a held position, no approach, no pursuit. The system selects from that fixed set and explains why; it does not compose new actions. That keeps this consistent with triage: the model shapes what reaches a person and what it suggests, never what happens.

A bounded sidestep, tried twice. The unit stops short of the obstruction, reverses, offsets laterally away from the fence line, runs parallel to the route and rejoins it. If it is still blocked the offset widens once and retries. That is the whole budget.

After the second attempt the unit skips to the next waypoint and records the gap — which segment was blocked, and which waypoint went unscanned on that pass. An obstacle is a coverage gap, and coverage gaps are the thing this concept exists to close, so reporting the uncovered ground is the point rather than an admission.

This is not a navigation stack. There is no map, no path search and no SLAM — one fixed maneuver with a single variable, inside a corridor set at install. And it never applies while an event is open: once a detection is raised the unit is already stopped and stays stopped.

Corroboration comes from ONVIF person events emitted by the fixed cameras the site already runs. When the patroller raises a detection, the box correlates it against ONVIF events inside a lookback window and reaches one of two named outcomes.

Corroborated — the event falls inside fixed-camera coverage and an ONVIF person event agrees within the window. Two independent sources.

Uncorroborated, high confidence — the event is in a blind spot, which is the case the patroller exists for, so there is no second source to correlate against. A higher detection-confidence bar carries it alone. This is the honest limit of the approach: where the patrol is most valuable is exactly where corroboration is unavailable.

Both outcomes escalate to a human. Which one applies is stated in the notification and written into the record, and an uncorroborated event is never described as verified.

Corroboration and reasoning answer different questions. Corroboration answers is this real — it kills phantom detections. It does nothing about a person who is genuinely there and genuinely should be: a contractor, or scheduled staff on a legitimate task. There the detector is right, both sources agree, and the event still should not wake anyone. Deciding that is the video model’s job, not corroboration’s.

Corroboration uses the cameras already on site — closing the gap needs no additional fixed hardware. The coverage audit establishes which of them qualify: a camera has to emit classified person events to corroborate. Cameras that emit motion events only are non-corroborating, and their zones join the uncorroborated class. Motion on a windy night is noise, and counting it as agreement would make false positives worse rather than better — so the audit maps person-event coverage, not merely camera coverage.

The intent either way is to reduce the number of times an authorization notification lands on someone's phone for something that isn't real, so that an escalation carries weight.

The perception and decision path is designed to run on-premises. Inference happens on the local edge box, and the console, cameras, and box communicate over the local network — so video need not leave the site for the loop to function.

Connectivity would be optional and relevant to things like remote access or software updates, not to detection or authorization.

Three reasons. Continuous video against a cloud API means continuous per-query cost, which scales badly for something meant to watch a perimeter all night. Round-trip latency sits in a loop that may need to respond quickly. And continuous outdoor video from a commercial site is exactly the kind of data an operator has good reason to keep on their own premises.

Running the model on the edge box addresses all three at once.

They are optimized for different jobs. The console handles display, touch, camera, audio, and real-time interaction on an RTOS, where predictable sub-millisecond response matters. The edge box handles compute-intensive work — running vision-language models, reasoning over multiple camera streams — on ARM64 Linux with NPU acceleration.

Keeping heavy compute off the interface is what lets the interface stay responsive.

Yes, in principle. Open-source vision-language models can be fine-tuned on domain-specific data, and retrieval over site-specific context can shape how events are described. A vehicle lot and a self-storage site care about different things, and the descriptions attached to a record should reflect that.