Autonomy that outlives its network

The next fight will be fought with the network down. We designed the entire company around that one sentence.

The opposite assumption is not stupid. It is inherited. Twenty-five years of counter-insurgency gave the United States and its allies uncontested spectrum, uncontested orbits, and a satellite link to a trailer in Nevada that never dropped. Every operational habit, every ground control station, every fusion architecture and most of the venture-funded autonomy built since 2015 is downstream of that experience. A peer adversary has spent those same twenty-five years studying it and building the tools to take it away: wideband barrage and reactive jamming, GNSS spoofing at theatre scale, counter-space weapons that have been tested in the open, and a demonstrated willingness to cut submarine cables and call it an anchor.

So the honest planning assumption is not degraded communications. It is absent communications — for hours, in a specific geography, at the exact moment the fight starts, and again every time the adversary decides. A system whose behaviour under that condition is "hold last commanded state and wait" is not an autonomous system. It is a remotely operated one with a good marketing department.

REVENANT CORE degrades toward itself. Every node carries the complete mission model, the full rules-of-engagement gate, and the whole mission plan in a 40 W SWaP envelope. There is nothing above it to fall back to, because there is nothing above it. That is not a fallback mode we bolted on. It is the only mode, and everything else — the mesh, the fleet retraining loop, the crewed-force gateways — is an accelerant layered on top of a node that was already sufficient.

Building it that way is the expensive option and we chose it with our eyes open. The world model has to be built, compressed and loaded before the sortie, because nothing can be fetched in flight. Every node pays in watts, memory and storage for a bad hour that may never come. And a 40 W computer will never assemble the cross-theatre correlation that a room full of racks can. We traded the biggest possible picture for the picture that will still exist in hour seventy-two.

This is an engineering bet, not a moral one. In the first seventy-two hours of a Pacific fight, the only context a node can rely on is the context it is carrying, so we spent the whole SWaP budget making sure it is carrying enough.

There is a constraint on autonomous lethality that has nothing to do with engineering, and it kills more programs than any technical failure: a commander cannot authorize what he cannot audit, and a government cannot defend in public what it cannot reconstruct. Ask why smart mines are not in the water despite forty years of adequate technology. The answer is not sensors. The answer is that nobody could tell a lawyer what the weapon would do, under whose authority, and how anyone would ever know.

Process does not answer it — an ethics board, a policy statement and a promise that a human is somewhere near the loop do not survive their first bad day. Our answer is an artifact: a hash-chained, cryptographically signed record written at the edge, exportable, and verifiable offline by software we do not control. See Auditable autonomy.

A runway is a coordinate. So is a drydock, a crane rated over 30 tons, and a shipyard. Every fixed airfield inside the first island chain has a published heading, a surveyed threshold and a known maximum-on-ground. It is a target set, not a sanctuary — and a fleet that cannot generate a sortie without one has already conceded the opening move.

So nothing in our arsenal requires a fixed base. WRAITH launches from sixty feet of transportable rail. LEVIATHAN goes in the water from a commercial pier. STYX sails from any quay. VIGIL self-erects in eleven minutes with one person. That constraint costs us performance in places — a rocket-assisted rail launch is expensive in mass and in structure — and we pay it deliberately.

Nothing on this site is in service. Every system here is in development, and we would rather you learn that from us on the way in than discover it later — because a fielded system is worth more than a good drawing, and we do not yet have one.

WRAITH has not flown. It is in development and first flight is targeted for Q1 2029. Until an airframe leaves the ground, the performance on its page is analysis — careful analysis, done by people who have taken aircraft to first flight before, but analysis. If a program office needs a collaborative combat aircraft in the air this year, we are not it. We will say that in a briefing room as readily as we say it here.

We are also clear-eyed about what a specification is. Every number on this site is a design target, not a test result. Design targets are cheap and flight test is expensive, and the gap between the two is where defense companies go to die. We publish the targets anyway, with the tolerances and the tradeoffs, because a program officer can do arithmetic and a program officer who catches you rounding in your own favour never trusts you again.

So Fantom Defense stands on architecture, not on maturity — we do not have maturity yet. The claim is specific: a system that degrades toward itself, proves what it did, and needs no fixed base is the right system for the fight now being planned for. That claim is checkable, and the two columns below are where we check it against ourselves.

Fantom Defense is the third Fantom company. Fantom Aero builds crewed electric aircraft; Fantom Robotics builds legged and humanoid robots. The three are separate businesses with separate customers, and this site speaks only for the defense company. But they are not separate engineering organisations, and pretending otherwise would give a reader the wrong picture of how fast this can move.

Shared autonomy stack. REVENANT CORE is the same runtime underneath all three. A flight-control and world-model stack that has to keep a person alive in a crewed aircraft is held to a certification standard that an uncrewed system usually escapes, and that standard flows down to the defense products rather than up from them. The locomotion work is the clearest example running the other way: MARROW, our uncrewed ground vehicle, follows a dismounted squad through terrain that defeats a conventional UGV because it borrows the Fantom Robotics locomotion stack outright. Fantom Robotics' humanoid program is the land domain's crewed-adjacent robotics entry; we reference it rather than re-specifying it here.

Shared manufacturing. All three build at FORGE-1. That is the argument for a 5.4 million square foot single-story plant instead of three smaller ones: composite autoclave and automated fibre placement capacity, a machine shop, an additive cell, a wire harness shop and a test campus are enormously expensive to stand up and are the same equipment whichever company is queueing for it. FORGE OS runs the floor for all three, and hashes every part from raw stock to fielded serial number regardless of which company's name goes on the airframe.

What is not shared. Classified and export-controlled work, program data, and personnel with access to it. Those are firewalled by contract, by facility and by system, and the arrangement is documented for the government customer rather than described in prose on a website.

FORGE-1 — Savannah, Georgia