Spatial governance protocols
Clear operating boundaries and relational rules for modular robots, autonomous clusters and frontier hardware.
Spatial governance and verifiable safety for autonomous physical systems: machines prove they kept a site's rules, and the data stays with whoever holds it.
At ÉTÈ, we build the spatial governance and operational interface for autonomous, self-reconfiguring physical systems and frontier environments.
Move the infrastructure. The rules of the space decide what can be proved, and a verifier learns that the rules held, while every position stays with you.
On the left is the operator’s full composition. On the right is everything a verifier receives. The two views rotate together. The spiked crystal floating above is the commitment itself: the 32 bytes of the Merkle root, one spine per byte, each spine as long as its byte’s value. Move any element and it changes shape, while revealing no position.
These parameters go into the public statement. Both sides see them.
Select an element on the left. Its position and throughput exist only on this device.
The boundary cell, the throughput limit and the coupling length become assertions directly. The spatial arrangement decides which statements can be proved.
Each element is salted and hashed into a leaf, and the leaves combine into a Merkle root. The verifier holds the root. Any change alters it, and the root itself reveals no position.
When an audit calls for it, the operator opens a single element with its Merkle path. The verifier confirms it belongs to the committed composition, and the rest stay sealed.
Commitments, Merkle paths and checks on this page are computed for real in your browser, and nothing is sent anywhere. The rule check runs on this device. In the full pipeline the same statement is proved by a Noir zero-knowledge circuit, like the one on the Proofs page, so the verifier does not need to trust the operator’s device.
Clear operating boundaries and relational rules for modular robots, autonomous clusters and frontier hardware.
Proof that reconfigurable systems operate safely in shared space, from container terminals to harsh terrain.
Transparent, institutional-grade infrastructure so different hardware ecosystems can work together safely.
We co-develop with operators and startups: we start from a site report and build the governance layer with them, on their own fleets.
Incorporated in England and Wales. Opening in Barcelona, with a testbed for the port and critical infrastructure.
Model a site: every machine, rule and dependency.
Prove on the machine that the rules held, signed post-quantum.
Set and test the rules with operators, cities and communities.
Each film starts with one small change you can try yourself. Films two to four use the same synthetic scenario as the workbench and Python reference; the first is illustrative.
Physical couplings weaken with distance. Drag a forklift away and the effective stiffness on the workers’ side drops, while institutional couplings stay as they were.
Twelve units of reserve move from the shuttle operator to the public sensing and the pedestrian lane. The total stays the same, and the protected minimum rises from 0.444 to 0.825.
When rooftop power goes offline, the lowest-stiffness mode gathers on a few elements. The protected minimum falls from 0.600 to 0.444.
Each state is written as a hashed record linked to the one before. Any later edit makes verification fail.
Drag any element, click a line to switch a coupling on or off, move the reserve, or take an anchor offline. Every readout on the right is recomputed as you act. Synthetic scenario with illustrative weights.
Each + moves one unit (0.1) from the largest holder. The total stays 1.2.
Circle size is effective stiffness Φ_G. The halo is the softest mode. Double rings mark protected elements.
ÉTÈ Spatial LTD · Social Synthesis · online sheet
The audit forms the infrastructure: an Audit Nomos. Each pillar is a state, each curve a tension, each plate a policy, each contact a tangency. It has no physical scale. It lives in Coupling Space, both a relation and a dimension. As hardware becomes modular, self-assembling and autonomous, the challenge becomes spatial governance across scales and systems. Safety governance is the new engineering.
> spatial governance protocols for modular robots and autonomous clusters
> state verification for reconfigurable systems, from orbit to harsh terrain
> open governance rails so hardware ecosystems interoperate safely
Draw the coupling: who and what is involved. Add arrows: what depends on what. Something fails: draw the knock-on effect as a red dotted line. Move one thing and draw what changes. Answer the 5 questions.
pillar: state
curve: tension
plate: policy coordination
beam: coupling
tangency: tension meets policy
After drawing:
At the table:
Field:
Stay in touch (name, optional):
Reach me by:
Participants work through the workbench in order, and each step is something you can do there. The method has its first public test at Berlin Science Week on 6 November 2026, and it is refined from what participants record.
What is on this street, and who is present?
Who depends on whom? Click a line to see its kind of coupling.
Take rooftop power offline. Which protected element softens first?
Move only the reserve, add nothing. Can you restore the floor?
Which assumption, weight or boundary should be challenged, and who sets the floor?
Your note joins the record chain with the current state attached. Please leave out names, addresses and other personal data.
Fill this in directly. Your entries stay in this browser; nothing is sent to a server. You can download a copy or move the summary to the note form.
The page and coupling_state.py compute the same object: the stiffness structure of the coupling space, independent of how much resource it holds.
Physical couplings weaken with distance and institutional ones keep their weight. Moving an object changes only the former.
After the power anchor is lost, moving the same 1.2 of reserve restores the protected minimum from 0.444 to 0.825, above the starting 0.600.
The leverage formula is checked against finite differences, and state records reproduce exactly, with any change altering the hash.
python -m pip install numpy python coupling_state.py # runs S0 → S1 → S2, writes reference.json python -m unittest -v test_coupling_state.py # 10 tests
Φ_G(v) = 1 / [K⁻¹]ᵥᵥ, where K is the grounded stiffness matrix. Reserve is held as backup anchorage, so losing the power anchor softens K, and moving the reserve re-places the prestress.
Most spatial computing systems find out whether a place is working by watching it. Sensors stream data into a central model, and the model is checked afterwards. The Composition Lab is testing a different route. The boundaries, capacities and adjacencies of a place are written as rules in a zero-knowledge circuit. When something moves through that place, the operator produces a short proof that every rule held.
A regulator or a resident can check the proof and see the outcome, while the raw operating data stays with whoever holds it. Space becomes the constraint system: the physical arrangement decides which actions can be proved.
| Continuous telemetry (digital twins) | Geometric proof (Coupling Space) | |
|---|---|---|
| System state | A live 3D model kept current by constant IoT updates. | Rules derived from the physical layout, checked at the moment an action happens. |
| Transactions | Database events that modify a central model. | Flows across nodes, each producing a proof. |
| Data and GDPR | Continuous streams that are retained and can be used for tracking. | Only what the proof needs, held locally by the operator. |
| Infrastructure | Dense edge gateways and streaming pipelines. | Proofs generated on local hardware and checked quickly and cheaply. |
| Governance | Automated loops that are hard to inspect. | Machines produce proofs; people judge what the rules should be. |
Noir is an open-source language for zero-knowledge programs, developed by Aztec Labs, with syntax close to Rust. It compiles to an intermediate form called ACIR, so the same circuit can run on different proving backends. The circuit below proves that every protected element stays at or above the floor the community set, and that the reserve adds up to the declared total, without revealing any single element’s value.
// coupling_floor/src/main.nr global N: u32 = 10; // elements on the grid street global R: u32 = 5; // sites that can hold reserve fn main( phi_milli: [u64; N], // private: effective stiffness × 1000 reserve_milli: [u64; R], // private: reserve at each site × 1000 protected: pub [bool; N], // public: which elements must hold floor_milli: pub u64, // public: the agreed floor × 1000 reserve_total_milli: pub u64, // public: declared reserve total record_ref: pub Field, // public: stamped record it refers to ) { for i in 0..N { if protected[i] { assert(phi_milli[i] >= floor_milli); } } let mut total: u64 = 0; for i in 0..R { total += reserve_milli[i]; } assert(total == reserve_total_milli); assert(record_ref != 0); }
Every change you make in the workbench updates the check below. The exported Prover.toml drops straight into a Noir project for nargo execute and bb prove.
Most EU zero-knowledge work today focuses on identity: proving who someone is. ÉTÈ focuses on proving what happened in a place.
A proof is as trustworthy as its inputs. The circuit shows that the rules hold if the values are true, and those values come from sensors, operators or inspectors. We are working on how to have those inputs signed by a trusted party, how to bind the record reference to a hash computed inside the circuit, and how to turn spatial adjacency, for example DGGS grid cells, into reusable circuit libraries.
Writing spatial geometry, network adjacency and capacity limits as reusable Noir circuit libraries.
Connecting spatial modelling workbenches to readable composition audit sheets and verifiable outputs.
Studying privacy-conscious proof architectures for public infrastructure and institutional governance.
ZK developers, spatial theorists and civic researchers are welcome to join. Write to yidi-lola@ete.institute
Streets, grids and municipal robots stay in service for thirty years or more. The mandates that govern them, and the records of what they did, need to stay trustworthy for the whole of that time, including after quantum computers can break the signature schemes in common use today.
Here you can sign the composition from the workbench with the post-quantum signature standards NIST published in 2024. The signature covers the whole arrangement: the protected elements, the floor, where the reserve sits and where every element stands. Change any of it after signing and the signature stops verifying.
Read live from the workbench. Change something there, then come back and see whether the signature still holds.
The key is generated in this browser tab for demonstration. In a deployment it would be held by a qualified trust service provider.
SHA-256. Quantum search at most halves its strength to about 128 bits, which is sufficient now and later.
ReadyML-DSA (lattice-based) or SLH-DSA (hash-based), in place of ECDSA, which Shor’s algorithm breaks.
Running on this pageSeal the chain head, and re-seal under newer algorithms as standards change, so records stay verifiable for the life of the asset.
Running on this pageThe Noir circuit on the Proofs page currently runs on the Barretenberg backend, which is built on the BN254 curve and is classical. The next step is a hash-based (FRI) proving backend, with the circuit itself unchanged.
In transitionAuthorisation is written as a signed file that states what is allowed, where, and who approved it. The enforcement point checks it before an action happens, and acts only on a mandate whose signature verifies.
For signatures, the long-term risk is that someone later forges or backdates an old record. Post-quantum signatures plus regular re-sealing keep an audit sound twenty or thirty years on.
The spatial arrangement decides which actions are allowed and which rules must hold. Post-quantum signatures and proofs make sure those rules, and the record of keeping them, cannot be altered or forged.
The EU’s coordinated implementation roadmap (June 2025) asks member states to have national post-quantum plans by the end of 2026, to migrate high-risk uses such as critical infrastructure by 2030, and to complete as much of the rest as feasible by 2035.
ÉTÈ’s mandate and record formats are designed for that timeline from the start, with room to move to newer algorithms as standards change.
Notes on birds, territorial imagination, and the governance of movement
Fatemeh Kazemi
What does it mean to demilitarize a territory? The question appears to have an answer already contained in its wording: to remove military forces, infrastructures, or arrangements from a designated space. Yet a territory does not cease to be governed when its military presence is reduced. Its boundaries have histories; its passages are regulated; its inhabitants have unequal capacities to move, remain, and determine what happens to the places they inhabit. Demilitarization, understood as a spatial proposition, therefore raises a more difficult question: what forms of authority would need to change for a territory to be organized otherwise?
In his essay Commentary on the Birds, Jed Munson approaches the Korean Demilitarized Zone through an encounter between geopolitics and ecopoetics. Following the movements of cranes brings him toward a territory he cannot freely enter. The birds become a way of approaching the border, organizing his movements and attention, while exposing the limits of his own position as a visitor. Munson eventually questions the mobility that enables him to follow the birds, as well as his distance from the violence that shapes their habitat. His account refuses an easy distinction between a militarized landscape and a nature existing outside it. The DMZ is at once a political arrangement, a habitat, a frame for observation, and a place from which the observer remains partially excluded.
This refusal matters. The abundance of wildlife within a restricted territory can easily become evidence for the restorative powers of nature, as though military division had inadvertently produced a refuge that might redeem its history. Munson's essay complicates that reading. The birds do not resolve the contradiction of the DMZ; they bring the observer into contact with it. Their movements provide a route toward a place while making the conditions of access, observation, and belonging more difficult to overlook.
One episode in the essay stays with me. A small waterbird attempts to cross the Yellow Sea during a storm. Researchers follow its progress through a tracking device, watching its movement as a dot on a monitor. At one point, the dot stops advancing. The researchers cannot know precisely what is happening to the bird's body, whether it is struggling against the wind or whether the tracking device has failed. They can only watch, interpret, and wait. Eventually, the dot begins moving again.
The scene brings two forms of movement into relation: the bird's physical struggle and the data through which that struggle becomes perceptible. The tracking system makes the bird's position available for observation, but its representation cannot fully convey the bird's experience. Visibility does not amount to knowledge, and knowledge does not necessarily confer the ability to intervene.
What happens when this distinction becomes a question of territorial governance?
On June 30, 2019, Donald Trump met Kim Jong Un at the Korean DMZ and briefly crossed the military demarcation line into North Korea, becoming the first sitting U.S. president to enter the country. The encounter was staged and circulated as a major diplomatic event. In photographs of the crossing, the boundary becomes both a physical line and a surface for the performance of political authority. A crossing ordinarily subject to exceptional restrictions becomes possible through the authority of the people crossing it. The event is recorded as history; the unequal conditions that organize movement across the border remain.
Placed beside Munson's account of the tracked bird, the photograph offers a different way to think about visibility and mobility. The bird appears as a point whose movement is monitored and interpreted. The political leader appears as a figure whose movement acquires historical significance through the image. Their situations are not equivalent. What matters is the contrast between the systems through which different movements become meaningful, actionable, or exceptional.
The photograph also raises a question about the authority to cross a border without transforming the conditions that make it a border. A single crossing can become an image of possibility while leaving the territorial arrangement intact. What would it mean to move beyond the exceptional event and reconsider the arrangement itself? Who would participate in determining the conditions of passage, and whose presence would count in imagining what comes next?
These questions acquire another dimension as artificial intelligence enters the administration of territory. Surveillance systems, predictive models, digital twins, and automated administrative processes increasingly participate in how movement is represented and decisions are made. A territory can be rendered as a model in which routes, boundaries, risks, and infrastructures become measurable variables. Such representations are consequential not because they simply reproduce the world inaccurately or accurately, but because particular representations can become the basis for interventions in the world.
A digital twin of a border, for instance, might bring together movement data, infrastructure, environmental conditions, and predictive assessments. Its apparent comprehensiveness could obscure the decisions through which its field of vision was constructed. Which movements are classified as risks? Which forms of presence are recorded? What cannot be measured, and who has the authority to challenge the model? When a prediction informs an administrative decision, where does the possibility of refusal or appeal reside?
The question of AI governance is therefore also a question about the production of space. Systems designed to interpret territory can begin to participate in determining its practical limits. Their classifications may influence who can move, where resources are allocated, which conditions warrant intervention, and which forms of life remain outside the scope of institutional attention. Audit, in this context, cannot be limited to checking whether a system has performed according to its technical specifications. It must also examine the political assumptions embedded in the system, the authority under which it operates, and the consequences of its decisions.
This is where I want to reclaim the idea of a demilitarized commons. I understand the commons here as a proposition about the authority to shape a territory, rather than a description of land available for collective use. A demilitarized commons would ask how the conditions of territorial governance might be reorganized so that security, prediction, and control no longer serve as unquestioned foundations for deciding who and what belongs.
Such a proposition must remain attentive to the history of the Korean peninsula and the particular conditions of its division. The DMZ cannot be detached from that history and treated as a universal model. Nor can its ecological life be appropriated as evidence that restricted territory is somehow better left alone. To reclaim the idea of demilitarization requires asking who has the authority to imagine a territory's future, whose knowledge enters that process, and how decisions might remain open to contestation rather than becoming permanent through infrastructure.
The Strait of Hormuz offers a different site from which to pursue this question. It is not another DMZ, and the histories of these territories should not be collapsed into an analogy. Yet Hormuz makes visible the relationship between territorial control, the circulation of resources, and the infrastructures through which movement is governed. The passage of oil connects maritime space to energy markets and geopolitical power, while the waters themselves sustain coastal communities, fisheries, and ecological relations that exceed the boundaries of any single jurisdiction.
What might a different future for this territory look like if its organization began from these relations rather than from the strategic management of passage? What would a digital representation of Hormuz need to register if it were to account for the conditions of life along its shores, rather than treating shipping, extraction, and security as its primary measures of significance? How could the people whose lives depend on these waters participate in determining what the system records, what it predicts, and what it is permitted to do?
These questions do not require the fantasy of a territory untouched by technology or human intervention. They require a different account of what territorial technologies are for, and who has the authority to decide. They also require recognizing that the consequences of governance extend beyond the human movements most readily registered by administrative systems.
Bread and oil offer two material ways to remain with this problem. Oil moves through the Strait as a commodity and a source of power, while bread depends on agricultural cycles, water, labor, transport, and the distribution of food. Their relationship is neither a simple opposition between extraction and nourishment nor a moral contrast between destructive and benevolent materials. Both belong to systems of circulation shaped by political decisions. When maritime passage is disrupted or ecological conditions deteriorate, the effects reach into the everyday relations through which food is produced, shared, and received.
I return here to the image of bread crumbs falling into water. The gesture does not make the water a symbol of purity, nor does it suggest that nourishment can repair ecological damage. It asks what conditions make an exchange possible in the first place. What happens when the water can no longer sustain the lives that gather around it? What would it mean for the governance of a territory to account for such dependencies, including those that cannot be reduced to a human security calculation?
The Qur'anic phrase fasād fī al-barr wa-al-baḥr, corruption on land and sea, offers another point of entry into this question. It connects human action to the conditions of the world in which life unfolds. Read alongside the politics of territorial governance, it invites reflection on responsibility for the consequences of extraction, intervention, and control, without providing a ready-made answer to the contemporary problems at stake.
A demilitarized commons would not promise to resolve these problems through a new model or a more comprehensive system of observation. Its proposition is more demanding: to make the authority to represent and govern territory itself available for scrutiny and transformation. This would entail asking who can contest a classification, who can refuse an intervention, whose knowledge can alter a decision, and how responsibility is assigned when automated systems produce material consequences.
Munson's bird remains a useful companion to this proposition, not because its movement offers an alternative to politics, but because it exposes the distance between representing a life and understanding the conditions under which it continues. Trump's crossing, meanwhile, reminds us that visibility and mobility are never distributed equally. Together, these encounters make it possible to ask how territory might be imagined beyond the exceptional movement of powerful figures and the automated management of everyone else.
To imagine a demilitarized commons is to reopen the question of what a territory can become, and who gets to participate in deciding its future. It is to insist that a boundary, a model, or an administrative decision should not become unquestionable simply because it has been established, mapped, or automated. The work of demilitarization would begin there: in contesting the arrangements through which movement is governed, in making their assumptions visible, and in creating the conditions for other forms of authority to emerge.
A lunar settlement can be designed across one site, three phases (years 1, 10 and 20) and three scales: the human and robot, the building, and neighbourhood infrastructure. The same state grammar can describe how a settlement’s power, pressurised volume and access couplings hold across those scales, and how a lost anchor propagates between them.
This is a direction ÉTÈ plans to develop in 2027.
We are looking for engineers and social architects.
Start a conversation ↗