Use cases · Distributed mind · Nexus over RF
Nexus over RF :
secure, encrypted,
jam-tolerant.
One Senua AI mind, shared across a fleet over the radio it actually flies : kilobits per second, half-duplex, lossy, contested. It works because Senua ships the diff, not the mind: a ~570-byte update so brief it hops frequencies faster than a jammer can follow, sealed with ChaCha20-Poly1305 so nothing legible ever crosses the air. Measured live: no cloud, no GPU, no central server.
The scenario
Every “AI fleet” assumes a network that isn’t there.
Put a language model on each drone and they are islands: nothing they learn in flight reaches the others without a cloud round trip, and the fleet flies exactly where the cloud isn’t. The alternative on offer, streaming every aircraft’s telemetry to a central GPU stack, needs a fat, reliable uplink no swarm has and no operator can afford.
Senua AI shares one mind across the fleet over the radio the aircraft already carry . SiK-class telemetry modems, ELRS backchannels, MAVLink tunnels. This is a data-synchronisation problem language models do not even address, solved in the substrate language itself: a from-scratch datagram protocol with real integrity, selective-repeat recovery and resumable sessions, small enough to ride a telemetry radio.
How the knowledge crosses a broken radio
The same sync fabric every Senua deployment uses: taught to be honest about running on a radio that drops, corrupts, and disappears.
1 · One drone learns
A drone watching its own telemetry learns something new: a fact, a fresh causal state, a detection. Its mind marks itself dirty and arms a push toward its peers.
2 · The link fights back
Frames arrive corrupted, out of order, duplicated, or not at all. Every frame carries a CRC-32: a corrupted frame is caught and discarded, never applied to the shared mind. The byte-stream deframer resyncs past dropped bytes.
3 · It recovers, then heals
One acknowledgement per burst tells the sender exactly which frames to resend: because the radio is half-duplex. Drop mid-transfer and the session resumes where it stopped. The peer converges byte-identical, then relays onward to the next aircraft.
Why it’s hard, and why LLMs don’t do it
Sharing a mind over a contested link is a systems problem, not a prompt.
A chatty stop-and-wait protocol chokes on a half-duplex radio’s turnarounds. A protocol without integrity silently corrupts the shared mind on the first bit-error. A protocol that restarts on every link flap never finishes on a channel that’s down more than up. Senua’s fabric answers all three (a windowed, bitmap-acknowledged, resumable datagram carrier) and it forms consensus with no central server and no fleet-commander process. A pure relay drone on a quiet link doesn’t even wait for its own next write to forward: it re-arms from a link-health confidence signal, so a fleet that goes quiet still converges.
Measured on a live two-node arm64 fleet
Compression. Anti-jamming. Encryption.
Three properties make one shared mind survivable on a contested radio, and they all fall out of a single fact: Senua sends the diff, not the state. Each measured end-to-end over an emulated 57.6 kbps half-duplex link with per-byte loss and corruption. Full method and tables in the datasheet.
Compression: 573 bytes
One new fact reaches the whole fleet as a 573-byte binary delta: about 80 ms of airtime, ~1.5 s end-to-end. That is 5,979× smaller than reconciling the 3.4 MB mind. Nexus ships the change, never the graph, never JSON.
Anti-jamming: survives 75%
Spread across a 32-channel hopping band, the mesh keeps syncing with a jammer blanketing up to 75% of the band: it just re-sends on the clear hops, and latency degrades gracefully. Only a full-band barrage stops it. The console shows the channel hopping clear of the jammed slice.
Encryption: nothing in the clear
Every delta is sealed with ChaCha20-Poly1305 under a fleet key. A live packet capture shows the frames crossing but zero plaintext: no delta magic, no knowledge text. The cost is +5%: encryption is a tax on the compression win, not a trade against it.
The chain is the point: compression → frequency agility → survivability. You do not out-power a jammer : an update that brief is never on a frequency long enough to be caught.
Validated in the open, before it was built
The datagram protocol was proven against five pre-registered falsifiers on a seeded impairment channel: the test written before a line of carrier code.
Integrity
Under injected bit-errors on 1: 5% of frames, zero corrupt updates were delivered: every corrupted frame caught by CRC-32.
Convergence
A 64 KiB backlog transferred byte-identical at 9.6 and 57.6 kbps across 5% and 20% loss: well inside the time budget.
The half-duplex win
The windowed protocol beat per-frame stop-and-wait on turnarounds (~9× fewer) and on time, in every channel: the reason the design exists.
Resume re-sent only the remainder after a severed link; duplication and reordering left the output byte-identical, with no update ever applied twice. The carrier is separately proven over a real operating-system socket with fragmented writes, partial reads, and injected garbage.
Two proofs: one we wrote, one the industry uses
Because a channel emulator you wrote yourself is a fair question.
A radio emulator, written in Senua’s own language
A half-duplex RF channel emulator: a shared medium with bounded bit-rate, per-byte loss and corruption, and turnaround cost: built in the same substrate language as the AI, running the exact impairment model the protocol was validated against. Two minds that can only hear each other through it must survive precisely what the radio does. The platform writes its own test rigs.
EMANE: the independent check
The same fleet run over EMANE, the Naval Research Lab’s mobile ad-hoc network emulator, with a real radio-frequency propagation and TDMA half-duplex model: an industry-standard cross-check that the resilience isn’t an artefact of our own emulator.
What you’ll see
Watch a mind cross a link that drops half of what it carries.
On the Console, Topology draws the fleet as one mind in many bodies: each aircraft a Senua node, joined by the radio link, with packets marching the edge in real time. The animation stops the moment the link goes quiet and restarts the instant new knowledge is taught. A floating stream panel pairs every packet with the bytes it carried: the frame on the left (sequence, direction, size), the actual on-wire bytes as hex on the right, with the knowledge they encode decoded beneath.
What actually crosses the radio is not that readable text. Nexus ships a compact binary delta: only the slice of the mind that changed since the peer last acknowledged, as dense tagged records, with split-horizon so nothing is echoed back. Sending the diff, not the state: a few hundred bytes, never the whole graph and never JSON: is the compression that makes a shared mind feasible on a kilobit link. The panel decodes a sample of those bytes for the human watching; the mind itself travels as the compact delta, integrity-checked frame by frame. Then a fact taught on one aircraft is recalled, byte-identical, on the other.
The honest boundary: stated up front
What we claim, and what we don’t.
Jam-tolerance, not jam-proof.
Multi-channel diversity and keyed agility raise the cost of disruption; they do not make a link un-jammable. We never say jam-proof.
An emulator is a model of the channel.
Real over-the-air numbers (actual error rates, retune latency, hop rate) come only from a hardware bench with software-defined radios. The emulators buy scale, repeatability and isolation, not proof on metal.
The flight-critical link is untouched.
The sync fabric is a polite guest on the radio: it yields to the aircraft’s own heartbeat and failsafe streams. Sync is the fabric; flight safety comes first, always.
One mind. Many edges.
This is the fleet layer of the autonomy arc: the same causal-state engine that flies the mission and watches the telemetry, shared across the aircraft that fly together.