Autonomy Operating System · Core · Mesh · Forge · Ledger · Link

Revenant

Command that survives contact.

A revenant is what comes back after it dies. The name is the product claim.

Full mission model resident on every node 40 W SWaP envelope Auditable autonomy

The Argument

Cut every link.
REVENANT degrades toward itself.

The whole mission model is resident on the node — the world model, the mission graph, the commander's intent, the rules of engagement and the target set. Take the network away and the node still holds all of it. That single decision sets the 40 W envelope, the bearer list, the ledger, and every rung of the ladder further down this page.

The design point is the worst hour of the war, not the demonstration: jammed, spoofed, submerged, underground — or simply alone.

REVENANT CORE is an edge runtime with a network attached, not a network with an edge agent attached. Every node carries the full world model, the full mission graph, the commander's intent and the rules of engagement, resident, inside 40 watts. The mesh makes a force faster. It does not make it possible. Take the mesh away and a node loses cross-cueing and over-the-horizon fires. It does not lose the ability to navigate, sense, classify, decide, act inside its authorization, or record what it did.

Resident is expensive, and we paid for it. Carrying the whole mission model costs a node 40 W, 6.4 GB of resident state, a chip-scale atomic clock for the time it can no longer be handed, and a planning cadence sized for what one node can do by itself. A thinner node would be cheaper, lighter and easier to cool. It would also be worth less at the only moment we designed for.

The second decision is the record, and it is structural. Every observation, every classification, every human authorization and every engagement is hash-chained and signed at the edge, witnessed by peers within seconds, and exportable to a third party who can verify it offline with software we publish. A cryptographic evidentiary chain has to sit in the real-time loop, in the silicon, and in the consistency model from the first line of code. It is not something you add in a sprint, and bolted on afterwards it is theatre.

Where we are, stated plainly. REVENANT is not fielded at scale today. The bet is specific: that the fights that matter happen in EMCON, under jamming, below the surface and underground, and that the accounting for autonomous weapons happens in a hearing room. Both halves of that bet cost money and tempo now and pay later. We took them deliberately, and the ladder below is what they bought.

Every decision, and the bill that came with it
Question What REVENANT does What it costs us
Design point The disconnected node. Every peer it finds makes it better; none of them is required. Every node pays for the worst hour on every good day
Node with zero uplink Full world model, full mission graph, full ROE enforcement The substrate has to be built, compressed and loaded before the sortie, because nothing can be fetched in flight
Authority to use force Signed, scoped, expiring token carried on the node. No token, no release — eleven days into a blackout included. When the last token expires the node stops shooting, valid target or not. That is the design, not a bug.
Accountability artifact Hash-chained signed records, peer-witnessed, offline-verifiable with a published tool A signature on every record, 755 MB per 6.4 h sortie, and a gate that cannot permit when the ledger cannot write
Bearers below the surface and underground RF, free-space optical, confined optical, acoustic, magneto-inductive, spooled fibre Six bearer stacks to build, certify and sustain — one of them for 400 bit/s
What a captured node costs you Forward capability only. Forward-secure key ratchet means no prior record can be forged, altered or backdated. The epoch key's predecessor is erased on the node, so nothing can re-sign or reissue what it already wrote
What you hand a Congressional committee A file, and the software to check it Publishing the schema, the signing scheme and the verifier means anyone can audit us — on our bad days too

Scroll the table sideways to read every column.

The Stack

Five modules. One resident system.

CORE is resident. MESH is opportunistic. FORGE is off-board and asynchronous. LEDGER is mandatory and cannot be disabled by the operator, the mission plan, or a software update. LINK is a gateway, never a dependency.

Module 01 · Edge Autonomy Runtime

Revenant Core

The full world model, ROE engine and mission plan resident on every node, inside a 40 W SWaP envelope.

The resident world model is seven layers: a geospatial substrate of terrain, bathymetry, structures and known subsurface voids; a track store where a track is not a label but an evidence chain; a mission graph carrying commander's intent as both a utility function and a set of hard constraints; the authorization state; a self-and-peer model where every fact about a peer carries its own staleness clock; an electromagnetic and environmental model; and an adversary model that is used to choose between plans and never to justify a release of force.

The planner proposes. The gate disposes. The planner is learned and heuristic, and it is never wired to an actuator. Every proposed action crosses a deterministic predicate evaluator running on a separate lockstep processor with its own memory, its own clock and its own copy of the authorization state. It returns PERMIT, DENY, or DEFER — and DEFER, the state where an action would be lawful but no human authorization exists for it, is a permanent condition under EMCON. That is the correct behaviour, not a failure.

Nine predicates must pass before force is released: geofence, target class, confidence floor, positive-identification basis, human authorization, deconfliction, collateral estimate, self-state, and ledger health. If the LEDGER cannot write, the gate cannot permit. A node that has lost the ability to record what it did loses the ability to do it.

Compute envelope
40 W total — inference 18.0 W, world model and planners 9.0 W, safety island 1.2 W, crypto 0.6 W, mesh host 6.0 W, platform 3.4 W, margin 1.8 W
Resident footprint
6.4 GB — 2.1 GB substrate, 1.9 GB model weights, 1.1 GB track and mission state, 1.3 GB working buffers
Track capacity
20,000 simultaneous tracks, each carrying its own signed evidence chain
Rate groups
400 Hz actuation · 50 Hz reactive planner · 20 Hz fusion and ledger append · 5 Hz deliberative planner · 1 Hz mesh and epoch close
Determinism
No heap allocation after init in the hard rate groups; static loop bounds in the gate; the linker fails the build if a heap symbol is reachable from an actuation entry point
Timing, GNSS-denied
Chip-scale atomic clock, 120 mW, holdover better than 15 µs/day. Mesh time transfer holds a group inside 200 µs.
Cold boot
41 s to mission-capable (CORE/H), 6 s (CORE/L)
Profiles
CORE/H 40 W · CORE/M 12 W · CORE/L 3.5 W · CORE/S under 1 W duty-cycled
Server requirement
None. There is no REVENANT server.

What that buys CORE degrades toward itself. Cut every link and the node still holds the plan, the rules and the target set — the bottom of the ladder is still a fighting node.

Module 02 · Zero-Infrastructure Network

Revenant Mesh

Peer-to-peer on opportunistic RF, optical and acoustic bearers. No master node. No cloud tether. No election to decapitate.

Every node runs identical routing and reconciliation logic, so losing any node removes exactly that node's contribution and nothing else. Bearers are plug-ins that advertise bandwidth, latency, energy per bit and detectability; the router picks per bundle against the EMCON policy in force, and a node routinely runs three at once. Emission is a budget the planner must justify, and every transmission is recorded.

MESH does not hold end-to-end paths. It is delay- and disruption-tolerant networking — Bundle Protocol v7 with BPSec, custody transfer, contact-graph routing where contacts are predictable and capped epidemic routing where they are not. Traffic is strictly prioritised: deconfliction and abort first, then human authorizations, then world-model deltas, then ledger epoch roots, then ledger segments, then bulk. The proof of a record is 180 bytes and travels immediately; the record itself is large and can take days to come home.

AP for the picture. CP for the trigger. Track evidence, coverage and observed substrate are conflict-free replicated types that merge in any order with any overlap; identity is re-derived from the union of what both islands actually saw, and the derivation is recorded. Authorization tokens and task assignments are never merged — they are issued, or leased with an expiry. Under partition we lose availability of an assignment, never consistency of it. The cost is tempo, and we paid it deliberately.

RF wideband
1.7–2.5 / 4.4–5.0 GHz MIMO, DSSS and FHSS hybrid over a 30-channel hop set. 2–40 Mbit/s, 5–40 km air-to-air.
RF narrowband
HF/VHF NVIS, 0.1–2.4 kbit/s at 50–600 km. Intent and epoch roots only.
Free-space optical
1550 nm, 200 mW, 60 µrad. 1–100 Mbit/s to 120 km in clear air with zero RF signature. 17.5 dB margin at 40 km — and fog takes all of it.
Confined optical
10 mW diffuse, 10–100 Mbit/s over 80–400 m down a drift. A tunnel is a waveguide. This is the BARROW chain bearer.
Acoustic
7–17 kHz OFDM, Doppler-tolerant. 400 bit/s at 10 km with 26 dB of margin; the limit is 60 ms of multipath spread, not power.
Magneto-inductive
1–5 kHz near-field, 20–200 bit/s through 20–40 m of rock
Spooled fibre
1.2 km on a CATACOMB spool. 1 Gbit/s, sub-10 µs, zero emission — and it breaks.
Satellite
BEACON LEO, scheduled contacts, plus alternative PNT for a GPS-denied position and time
Steady-state load
A 40-node force exchanges 40–400 kbit/s of picture. Deconfliction, authorization and epoch roots together are under 8 kbit/s — which is why a 400 bit/s acoustic bearer is still worth having.

What that buys No single point of failure, and bearers for undersea and subterranean where RF is simply dead.

Module 03 · Sim-to-Real and Digital Twin

Revenant Forge

Fielded nodes stream trajectories back, the fleet re-trains nightly, and nothing reaches a weapon until it has survived seven gates.

A trajectory is not a video file. It is the tuple the node actually decided on: sensor digests, belief-state delta, candidate actions, planner scores, the gate's verdict and its failing predicate, the action taken, the observed outcome — and the LEDGER record ID for every one of those elements. Which means every training example is attributable to a node, a sortie and an epoch, and cannot be fabricated without forging a signature chain.

Failed and near-miss trajectories become scenarios in the digital twin automatically. Training touches perception, tracking and planner policies. It never touches the ROE gate. The gate is configuration signed by the operator, on a separate key, with a separate release path — a FORGE release has no mechanism by which it could loosen a constraint.

Keeping a bad update off the fleet is the whole job. Unsigned data cannot enter the corpus. No single node, sortie or 24-hour window may exceed a fixed share of the gradient for any class, so a compromised node cannot dominate by volume. The regression suite enforces absolute floors, not deltas. The most important measurement is not accuracy: it is whether the gate's verdict changes on any historical engagement, and if it does, a human reviews every instance.

Loop time
Field to sim to fleet in under 24 h when the loop is fed. On a deployed force with intermittent recovery, 3–6 days — the constraint is bandwidth, not training.
Regression suite
41,000 recorded scenarios drawn from field corpus and accumulated test
Adversarial suite
Out-of-distribution, spoofed, decoyed, camouflaged, degraded-sensor — and the deliberately ambiguous, where the correct output is low confidence
Sealed replay
Held-out real trajectories the training run never saw, replayed through the full stack including the gate
Hardware in the loop
Target hardware at real rates and real thermals, then a live range card. Timing and thermal regressions do not appear in a datacentre.
Release authority
Dual-key. Two named humans, engineering and safety, from separate organisations. A node refuses an image carrying one signature.
Canary
Under 2 % of the fleet, one platform class at a time, never to a node holding a live authorization for a class the update touches
Rollout
96 h minimum, halted automatically if gate-denial rate or confidence distribution moves outside bounds against the build it is replacing
Rollback
A boot-time property. The previous image stays resident in its own slot; a node rolls back autonomously on a boot-integrity or self-test failure.

What that buys A closed loop from field to sim to fleet in under 24 hours — and every classification a node makes names the model hash that made it, so you can prove which build flew.

Module 04 · Auditable Autonomy

Revenant Ledger

A hash-chained, signed, tamper-evident record of every observation, classification, human authorization and engagement. This is the moat.

The deep dive

Everything above this module is engineering, and engineering gets matched — give it money and three years. This is the part that changes what an autonomous weapon is as a legal and political object, and it only works if it was built into the runtime from the first line. Bolted on, it is theatre.

Ten record types, CBOR-encoded and COSE-signed, each carrying the SHA-384 of its predecessor. Every epoch — one second or one thousand records — closes with a Merkle root over that epoch and the previous root. Insert, delete or alter anything and every root after it breaks.

The hinge is the authorization record. A token is a signed grant naming a human identity attested by hardware credential, a scope (target class, volume, time window, effect, collateral ceiling, engagement cap), the required confidence floor and identification modalities, and an absolute expiry enforced by the node's own clock. The gate cannot be satisfied for a release of force without a valid, in-scope, unexpired token. The node cannot mint one, extend one, or infer one. There is no code path, no configuration flag and no build variant in which it can — and because the gate is 9,300 lines on a separate processor, that is a claim an auditor can check by reading it.

Which means: for every engagement, forever, there is a named human, a signed scope and a timestamp — even if the engagement happened eleven days into a comms blackout, four thousand kilometres from the person who authorized it.

Record types
OBS · CLS · TRK · AUTH · GATE · ENG · EFF · GAP · RECONCILE · EPOCH
Signing
Ed25519 in a discrete secure element, 60 µs per record. Every record, no sampling.
Post-quantum
ML-DSA-65 counter-signature on epoch roots only — 3.3 kB once per second is affordable, once per record is not
Capture resistance
Forward-secure hash ratchet. The epoch key is advanced and the predecessor erased, so an adversary who extracts every secret a node holds cannot forge, alter or backdate any prior record.
Witnessing
Each 180-byte epoch root is gossiped to peers, BEACON and LINK. Within one interval it exists in five or more independent ledgers on five or more independent devices.
Storage
A 6.4 h WRAITH sortie writes about 755 MB — roughly 1,300 flight hours on a 1 TB drive. WAKE writes 16 MB in 400 days.
Compaction
Never overwrite. Observation and track records compact to inclusion proofs; AUTH, GATE, ENG, EFF, GAP and RECONCILE are kept in full regardless of age.
Export
A signed .rvx bundle: manifest, chain, epoch roots, peer witness attestations, certificate chains, media hash manifest
Verifier
revenant-verify — offline, no network calls, no dependencies, to be published as source. Built and under test; not yet published. A verifier only the manufacturer can run is a press release, not evidence.

The Degradation Ladder

What survives at each rung

This is the honest statement of what a customer buys. Read it downward: at every rung the ROE gate still enforces and the signed record still writes. That is the design point, not the fallback.

  1. Rung 01

    Full mesh

    All nodes mutually reachable, directly or by relay. The force behaves as one distributed sensor and one distributed magazine.

    Retained

    • Common track picture across every domain — a WRAITH sensor cues a CAIRN effector
    • Cross-domain sensor–shooter pairing; the cheapest effector that can service the target fires
    • Authorization requests reach a human in under 2 s; returned tokens propagate in under 4 s
    • Dynamic retasking, live collaborative planning, real-time deconfliction
    • Epoch roots witnessed by five or more peers within one gossip interval

    Lost

    • Nothing
    PictureGlobal
    CollaborationForce-wide
    New authorityUnder 2 s
    ROE gateEnforcing
    Signed recordWriting
  2. Rung 02

    Partitioned mesh

    The network fragments into islands. Islands exchange bundles only on opportunistic contact, and delay-tolerant routing carries them across. Latency between islands is minutes to hours, and the planner is told so explicitly.

    Retained

    • Full, consistent picture within each island
    • Collaborative behaviour inside the island — cueing, pairing, mutual support
    • Every existing authorization, honoured to its written scope until it expires
    • Cross-partition deconfliction by pre-agreed airspace slabs, time windows and no-fire volumes
    • Complete recording; roots witnessed within the island

    Lost

    • Cross-partition cueing and fires
    • New authorization — no island can mint a token
    • Global re-planning and negotiated deconfliction
    • Task leases that cannot be renewed lapse and go unclaimed until expiry plus skew
    PictureIsland
    CollaborationIsland
    New authorityNone
    ROE gateEnforcing
    Signed recordWriting
  3. Rung 03

    Local cluster

    A handful of nodes inside one bearer hop. Typical after heavy jamming, under canopy, in a tunnel, or below the layer depth. The cluster is now a small self-contained force and plans as one.

    Retained

    • Shared local picture and cooperative behaviour — formation, coverage, mutual support
    • Local sensor–shooter pairing inside the cluster
    • Standing authorizations inside their scope
    • Recording, and witnessing within the cluster — enough to time-stamp the chain against any single captured member

    Lost

    • Everything beyond organic sensor range
    • Over-the-horizon targeting and external cueing
    • New authorization and retasking
    PictureLocal
    CollaborationCluster
    New authorityNone
    ROE gateEnforcing
    Signed recordWriting
  4. Rung 04

    Single node

    No peers. No uplink. No GPS. This is the rung the product was designed for, and it is not a safe-state — it is the mission, executed alone, inside the authority the node was handed before it left.

    Retained

    • The full resident world model — substrate, tracks, mission graph, intent, constraints
    • Navigation by inertial, terrain-relative, visual-odometry and celestial or acoustic aiding
    • Perception and classification at full rate; the mission graph executes
    • The ROE gate enforcing all nine predicates
    • The LEDGER writing every record and closing and signing every epoch
    • Any action inside a still-valid authorization token

    Lost

    • Cross-cue, over-the-horizon targeting, retasking
    • Release of force once the last in-scope token expires — the node reverts to sense, classify, record and deliver
    • Live witnessing; only the roots gossiped before isolation are held elsewhere
    PictureOrganic
    CollaborationNone
    New authorityNone
    ROE gateEnforcing
    Signed recordWriting

The node never self-authorizes. There is no rung at which it can. When the last token expires it keeps flying, keeps sensing, keeps recording — and does not shoot.

Ledger Deep Dive

One engagement, eleven days into a blackout

Below is a stylised engagement record written by a single WRAITH at Rung 04 — no peers, no uplink, no GPS. It is the shape of the artifact a court, an inspector general or a Congressional committee would be handed.

REVENANT LEDGER · RECORD TYPE ENG Chain verified
Seq
0x0004A19C
Prev
sha-384 b7c1…9e04
Node
FD-WRAITH-0117 · devid 04a3…9f
UTC
2029-03-14T03:17:42.118Z ± 3.1 µs · source CSAC
Rung
04 — single node, no uplink, no GNSS
Track
T-8841 · evidence 214 obs / 4 modalities
Cls ref
0x0004A0E2 · conf 0.91 · model 8f2c…d417
Auth ref
0x00049B77 · MAJ R. OKONKWO · CJTF-77 · scope 6 h · expires 04:00Z
Gate ref
0x0004A198 · PERMIT · 9 of 9 predicates
Effect
AIM-120D · collateral est. 0.00 · deconflict clear
External
false — no unsigned track contributed
Image
core 2.4.11 · hash 3ad9…c108
Sig
ed25519 · epoch 4471 · key gen 12

Epoch roots — 180 bytes each, gossiped to every peer in range. Five independent devices already hold epoch 4471.

The record has no null encoding for the authorization field. An engagement record without one is not a record with a missing value — it is a malformed record, and the verifier reports it as a chain integrity failure. The schema itself refuses to describe an unauthorized engagement.

  1. What exactly gets signed

    A Merkle root over every perception frame batch. Every classification, with the model's identity by hash and the confidence it held. Every track identity change with its evidence set. Every authorization, refusal, expiry and revocation. Every gate verdict — including denials, which are the most valuable thing in an after-action review. Every engagement and effect assessment. Every gap in recording, with its cause. Not the raw sensor media: the chain stores a digest and a pointer, so if the media is recovered you can re-run the classifier and prove the digest matches, and if it is lost the chain still proves what the node believed and did.

  2. Keys at the edge

    A device identity key fused in the secure element at FORGE-1 and bound to the part's provenance record. A per-deployment attestation key released only after a measured boot. A per-sortie signing key issued at the arming point — a physical event with a human present. Then an epoch key advanced by hash ratchet every second, with its predecessor erased from the device.

  3. When a node is captured

    Forward security means an adversary who extracts every secret the node currently holds can write false records going forward under that identity — which we detect and revoke — and cannot forge, alter or backdate anything from a prior epoch, because the keys that could have done so no longer exist anywhere. Tamper detection zeroizes and renders the on-node archive unreadable to the captor. What we already know is untouched, because the roots were witnessed within seconds.

  4. Witnessing beats self-signature

    A node signing its own log proves the log has not changed since it was written. It does not prove when it was written. Peer countersignature closes that gap: history becomes immutable in seconds rather than on recovery, a divergent chain is detected at the exact record where it forked, a destroyed node still leaves proof that its records existed and how many there were, and a node that goes silent produces a visible discontinuity in every witness. Absence of record is itself recorded.

  5. Export, redaction, verification

    The export bundle carries the manifest, the chain, the epoch roots with their post-quantum counter-signatures, the peer witness attestations and the certificate chains. revenant-verify runs offline and reports chain integrity or the exact offset of the first divergence, how many independent devices corroborate each epoch, every gap and every unexplained discontinuity, and a one-page human-readable timeline from observation to effect. Classification review will redact — a redacted leaf is replaced by its hash, the Merkle path still computes, and the redaction is visible as a redaction. You can withhold contents. You cannot silently remove a record.

  6. Why this is the answer to DoDD 3000.09

    The directive requires appropriate levels of human judgment over the use of force, rigorous verification and realistic test, designs that minimise unintended engagement, and systems that are traceable and governable. That conversation is normally a document review. We answer it with a file you can run software against: the authorization token is the human judgment, enforced at the gate rather than promised in a procedure; the release record proves which build flew; the gate record proves what was evaluated and what was refused; and the chain proves all of it to someone who does not trust us.

  7. And the political attack

    The honest case against autonomous weapons is that they diffuse responsibility until no human is accountable for a death. It is a serious argument and it is not answered by an ethics board or a promise that a human is on the loop. It is answered by a record: a named human, a signed scope, a timestamp, a model identity, a confidence value and a reconstructable decision path — checkable by an inspector general, a court, a committee, an ally's ministry of defence or a journalist, using software we do not control, on an air-gapped laptop. When the hearing comes, we intend to hand over a file and the tool that checks it.

What Runs On It

Every system in the arsenal

REVENANT is not sold separately and it is not an option line. Every Fantom system ships with the profile its power budget can carry — from 40 W on a collaborative combat aircraft to under a watt on a pod buried in the ground for four hundred days.

Subterranean

Domain
SUB-01 CATACOMB Maps and fights in total RF and GPS denial, survey-grade, under fire CORE/M SUB-02 DOWSER Muon tomography finds a hardened tunnel at 90 m through rock CORE/M SUB-03 BARROW Extends MESH on optical and acoustic bearers, one node every 80 m CORE/L SUB-04 WAKE 400 days at 1.1 W; 16 MB of ledger across the whole life CORE/S

Sea

Domain
SEA-01 LEVIATHAN 6,500 nm XLUUV; 90-day patrol, 37 GB of signed record CORE/H SEA-02 STYX Launches and recovers BANSHEE and SHADE at sea; carries a LINK gateway CORE/H SEA-03 DEADFALL Cannot arm without a signed LEDGER authorization — the legal unlock for smart mines CORE/S → /L SEA-04 TIDEWALL Attributes a seabed intrusion to a hull, not to a noise CORE/H

Land

Domain
LND-01 GHOST Armoured bipedal humanoid; no round leaves the barrel without a signed human authorisation CORE/H LND-02 VIGIL Twelve-day solar autonomy at 40° N in December; eleven years of ledger on 512 GB CORE/M LND-03 PALL The whole REVENANT stack on 3.2 kW; cold generator to mission command in 8 minutes CORE/H LND-04 CAIRN Layered kill chain in one emplacement; taskable from IBCS through a LINK A-Kit CORE/M LND-05 MARROW 1,400 lb payload on the Fantom Robotics locomotion stack CORE/M LND-06 VEIL 620 g. The soldier keeps the picture when the radio is jammed CORE/L

Air

Domain
AIR-01 WRAITH Fights fully in EMCON with zero uplink; MADL-native with the F-35 CORE/H AIR-02 POLTERGEIST Warhead, seeker and fuel traded at the flight line, not the factory CORE/M AIR-03 BANSHEE If it does not engage it returns, refuels and re-arms itself in nine minutes CORE/M AIR-04 SHADE 4.1 lb. The ROE engine runs on the flight controller, not a second computer CORE/L AIR-05 SPECTER Ducted lift plus wing-borne cruise; one airframe, two mission profiles, 14 h CORE/M AIR-06 REQUIEM Writes and validates a technique in flight, then signs it into LEDGER so it is releasable CORE/H

Space

Domain
SPC-01 LANTERN Custody, not detection — a continuous track file on a manoeuvring object CORE/H SPC-02 CHARON 3.1 km/s delta-v; a payload across planes in days, not months CORE/H SPC-03 SHROUD Every proximity action LEDGER-signed — the only way this is politically fieldable CORE/H SPC-04 BEACON MESH bearer of last resort and a GPS-denied position for every node on Earth CORE/M

FORGE OS carries the same chain into manufacturing: every part on every system holds a LEDGER hash from raw stock to fielded serial number. FORGE-1

Next

Bring us a threat model, not a demo request.

The useful conversation starts with what your network does under attack, what your rules of engagement actually say, and what you would have to prove afterwards. We will tell you where REVENANT helps, where it does not, and what is still hard — the same list our own engineers work from.

Request a technical briefing See it fly — WRAITH Auditable autonomy
Programs
programs@fantom.aero
International
Allied and NATO
Manufacturing
FORGE-1, Savannah
Engineering
Open roles

Performance figures are design targets. No export-controlled information is published on this site.