Four sentences govern every Canadian Shield program in air, on ground, in water and under ground. Nothing transmits by radio and nothing guides on a link. No program carries a warhead, a fuze or an energetic material. AI plans, rules govern, humans authorize, safety has veto. Nobody in harm's way.
The first limit decides what everything after it can be. Every Canadian Shield program carries something to a place. None of them carries an effect.
A carrier takes a payload to a position and leaves the decision with a person. Across the four domains the payload changes and the rule does not. A bay takes a sensor, a capture nose, a tool, or a length of optical fibre, which under ground is also the way back out and, on the boring line, the conduit product left in the bore. No Canadian Shield design carries a warhead, a fuze or an energetic material, and nothing in one operates a weapon.
The lead air program shows the shape of it. Goose CS-110 is an unpowered pneumatic interceptor round with no battery, no motor and no guidance electronics. Encapsulator CS-111 is the capture nose on the same launch chain, and capture is the whole of what it does.
The same refusal is written into the program that sits closest to a defence engineering task. Defender CS-820 takes the seat of the machines a defence engineering unit already runs, military-pattern vehicles included. Human safety comes first, on every line. It never operates a weapon and never fires anything.
A carrier boundary is cheap to write and expensive to hold, so it is held in the parts themselves. No Canadian Shield airframe carries a fuze or a warhead, and there is no energetic material anywhere in the fleet. The fleet is built to one rulebook across all four domains, and every entry on the roster answers this sentence before it answers any other.
Payload bays take sensors, capture noses, tools and fibre. Nothing in the fleet operates a weapon, and no design in it carries a warhead, a fuze or an energetic material.
There is no command radio and no satellite receiver in the guidance loop of any program on the fleet roster, in air, on ground, in water or under ground. Mine clearance is worked differently, and it is the one place this rule does not reach.
Jammed radio and denied GPS are the modern battlespace's default condition, not its edge case. A conventional uncrewed platform hangs from two invisible threads: a satellite fix and a command link. Electronic warfare cuts both, cheaply and at scale, and a fleet built around the spectrum degrades to inventory when it is needed most.
Under ground and under water, physics enforces the rule at no cost. Rock and soil kill radio outright and seawater conductivity does the same, which makes the CS-410 line the doctrine's purest expression.
The rule holds across the whole roster rather than across a family of it. Air, Ground, Water and Underground are built against the same ladder, so a buyer never has to work out which side of a boundary a program sits on. Technology carries the architecture platform by platform.
There is no command radio and no satellite receiver in the guidance loop, so there is no link to deny. Jamming denies the radio bands. A fibre and passive optics are not in them.
Clearance work carries a different fit, and it is the only work on this site that does. The rule over it does not change; the ground it is worked on does. The KAOS carrier in its mine clearance configuration and KMM-01, the uncrewed clearance workboat, work on ground and water whose perimeter the customer controls and has surveyed, under a named supervisor who is watching. A surface vessel is also required by the rules of the road to be seen and to answer. Both therefore carry a navigation and communication fit, and the reason is the work rather than the platform.
What that fit never does is decide anything. A lost link is a state settled before the task starts: it narrows what the machine may do and stops or returns it, and it never leaves a machine working unsupervised. The safety behaviour never sits downstream of the link, on either machine. The link buys supervision. It does not buy permission. Jam resistance is a property of the guidance tiers, and it is not offered on that work.
Three tiers carry every platform in the fleet, in the same order on both halves of the enterprise. A reader can place any program on the ladder before asking a single question about it.
Nothing guides in flight. On the Goose CS-110 lead round that is literal: no battery, no motor, no guidance electronics, so there is nothing aboard to jam.
The platform trails an optical fibre and a person commands it down the wire. A strand cannot be jammed, spoofed or direction-found, and it holds a person in the loop by construction.
Passive onboard sensing: optical-AI in the air, SLAM on the ground. The platform receives and does not transmit, so it offers no link to find.
The order is fixed and it reads the same on both halves of the enterprise. Fleet guidance is preset, fibre or onboard. A converted machine is loaded and sealed at the dock, on a fibre tether to a person at a stand-off station, or on its own perception inside the same rules. Each tier is a different way of not being in the spectrum. Tier 1 guides nothing in flight because there is nothing aboard to guide. Tier 2 puts a strand between the platform and a person, and a strand is not a channel. Tier 3 reads light and gives an emitter nothing to find.
Technology sets out where physics and mission bend the ladder, platform by platform.
Canadian Shield works from Alberta, on land and floor space the group holds, and the capability underneath it is older than the division. Thirty years of horizontal-directional-drilling engineering built that capability.
Horizontal directional drilling is a trade whose whole discipline is steering tooling through rock and soil with no line of sight. Walkover locating from the surface and wireline steering below it closed the loop, and the method reached ground nothing else could reach. That history left more behind it than experience.
What it left is why this page reads the way it does. No GPS, no line of sight and no radio signal that survives rock is the drilling problem, and it is also the jammed day the fleet is drawn for. Engineers who spent careers answering how you steer something you cannot see and cannot talk to do not start from zero when the radio is jammed and the satellites are gone. The link is ruled out at the design stage rather than hardened afterwards, because the heritage never had one to depend on.
A working 5-axis CNC machine shop once cut downhole drilling tooling. It now cuts the division's own injection moulds and machines the fittings and gauges beside them. The tool changed; the tolerance did not.
Tracked chassis the group designed and operated for a living, carried out of the drilling business. The ground platform inherits that discipline rather than learning it on a defence program.
Decades of drawings, none of them drawn for defence. What transfers is the method they record: steering a tool to a point nobody can see, set down on paper long before the doctrine was written.
The floor and the ground are the group's own. Approximately 60,000 ft² of manufacturing facility on industrial lands and remote Alberta land are both held within the group, and the launch, recovery and flight-trial ground sits on that land under Class G uncontrolled airspace, within sight of the floor where the parts are made. Cut the insert, shoot the part, take it out to the line and bring back what the line teaches: it is infrastructure held inside the group rather than range time booked from someone else. The group has run heavy equipment for three decades, so the questions here start with the machine rather than with the software.
Company carries the group behind the division and the two halves it builds. Manufacturing runs that floor stage by stage, from the mould shop to the Forward Manufacturing Cell.
Canadian Shield runs a four-domain fleet of uncrewed carriers and a removable operator for machines a customer already owns. The four sentences take a different shape on each line, because the ground does.
The doctrine is stated once and worked line by line. Each card below names what the line is, the designations it carries and the form the rules take once they meet its ground, and each one opens on the page that holds the mechanism and the figures.
Three programs leave the ground on compressed air from one launch chain: Goose CS-110, the unpowered lead round, Encapsulator CS-111, the capture nose on the same round, and CS-120, the powered class cued down a trailing optical fibre. No warhead, no fuze, no primer and no propellant, and a person arms every shot. The line.
A diesel-electric tracked work platform drawn around the absence of a driver, in three sizes of one architecture, with Core carrying the designation CS-270. A person commands it over an optical fibre from a stand-off station, and nothing on that path goes over the air. Its mine clearance configuration is the one place the rule above does not reach. The line.
CS-310 is the survey-and-carrier hull and CS-320 is the creeper it carries out and releases at a surveyed point. Seawater kills a radio signal outright, so the rule the rest of the fleet holds by choice costs this family nothing. KMM-01, the uncrewed clearance workboat and a configuration rather than a roster program, works the surface above them under a supervisor ashore, and it carries the same exception as the ground clearance configuration. The family.
CS-410 and Aquifer CS-411 are one coiled-tubing surface plant sent to two kinds of work. CS-425, CS-430, Trembler Line CS-435 and CS-460 enter, listen, ride or hold ground somebody has already opened. Rock and soil absorb a radio signal outright, so the guidance is a trailing optical fibre with a person on the far end of it. The family.
A removable operator that sits in the seat of a machine a customer already runs, works that machine's own joysticks, levers, pedals and switches, and lifts back out. It never connects to the machine's CAN bus, ECU or firmware; a fused feed from the accessory point is the only wire. Responder CS-810 is the emergency-services profile and Defender CS-820 is defence engineering, and Defender never operates a weapon and never fires anything. The line.
The fleet is uncrewed by construction, and the conversion line takes the person out of a seat that is already there. One doctrine governs both halves, and nothing in either of them operates a weapon.
The fleet sets the four domains side by side with the figures each family carries, and the roster holds every program as one filtered index. Technology carries the guidance ladder and the authority order platform by platform.
A converted machine does what its rule set allows and nothing else. The rule set is signed and sealed, the authorization is a lease, and the physical stop sits outside both.
Where a Canadian Shield design carries a rule set, the rules ship sealed: signed rules and firmware, a hardware root of trust, no debug access, and tamper detection that ends in a safe stop with the log retained. Signing keys are held in Canada. The seal is chosen into the parts rather than bolted on afterwards, and signing authority is separated across development, test and production.
Authorization is a lease. It is time-limited and signed, issued against a machine and a task, and withdrawable. Withdrawal or expiry ends in a safe stop at the next safe point and a minimum-risk condition. It is never an instant stop sent over the air, and the safety loop stays wired.
A minimum-risk condition is task-specific rather than universal. In a burning structure, stopping and waiting for a person can itself be the harm, so each task carries its own, decided in advance rather than in the moment. The physical stop and the manual release on every actuator always remain, on every profile.
Hardware is bought and owned by the customer. The configuration and the application are licensed, sealed and revocable. What that costs a buyer is stated once: a Canadian Shield design will refuse a job that sits outside its sealed set, and the way to widen it is a new signed release rather than a switch on the ground. Manufacturing carries the floor those parts are built on and Sovereignty carries who holds the keys.
Every limit above is bought with something. This is what it buys: a seat, a bore, a water column or a route that a person does not have to be in.
The principle is one sentence and it holds for any seat, whoever is in it. Nobody in harm's way. The purpose is to move people away from hazardous machine tasks, and the four domains are four ways of doing it.
Under ground the argument is the shortest. Send the robot down the hole, not the soldier. The CS-410 line runs boring, tunnel reconnaissance, buried sensing and pipeline riding, on the drilling heritage the company already owns.
In the water CS-310 and CS-320 are two moulded low-signature platforms working the medium that is hardest to put a person into. In the air the interceptor round is cheap in quantity, and depth is what makes a low-cost answer hold against a cost-exchange problem.
The same principle runs the two CDNS Autonomy profiles. Responder CS-810 works fire ground, structural collapse, hazmat, flood and wildfire earthworks, and rubble and route clearance for civil agencies. Defender CS-820 is defence engineering. Human safety comes first, on every line. Defender never operates a weapon and never fires anything. The unit takes the seat rather than the machine's wiring, and the machine's physical stop and manual release always remain. In both of them the exposure is the seat.
Each line below is a property of how the architecture is wired. Removing one of them means removing a layer, and every layer is named above.
Unknown state is a valid state. A design is allowed not to know, and the response to not knowing is written before the job rather than found during it. When state quality falls below what a task requires, the task system slows, stops, asks for human review, or prohibits the skill outright. Uncertainty changes permissible behaviour.
Safety-relevant sensors carry their own diagnostics and a defined failure response, so a sensor that has stopped seeing is a known state rather than a silent gap. A machine can be locally collision-free and still be unsafe, because of slope, slip, load, hydraulic response, swing inertia, tool contact, ground failure or uncertain chassis orientation, and on a continuously rotating machine the upperstructure attitude is never silently substituted for the chassis attitude.
Authority that cannot be reconstructed afterwards was never governed. Every act lands on one chained record, and the configuration record travels with the unit.
Every act lands on one chained record, and nothing is deleted. An authorization is time-limited and signed, issued against a machine and a task, and it lands on the record with everything else. An approval without an end is not an approval, and authority that has expired has been withdrawn.
The configuration record travels with the unit. A customer can prove exactly what hardware, what software and what skill set is fielded. Ownership of machine data, operator data, derived skills and logs is defined rather than assumed.
The safety case is per machine, per task and per configuration, and the record is what it is checked against. Procedures, training, exclusion zones, recovery and maintenance are part of the safety system.
Sovereignty carries the ten dimensions of control and recoverability, including the configuration dimension this section rests on. Manufacturing carries where the named assemblies are built, integrated and tested.
Four lines carry the whole posture, and they read the same everywhere on this site that the question arises.
Public first, controlled last. What is public is capability and architecture, which is this site. Program briefs and controlled external interface descriptions follow a screened enquiry. Configuration records, integration requirements, cyber and support documentation belong to an evaluation. Drawings, bills of material, detailed hazards and restricted technical data sit under non-disclosure, export and security controls.
For an integrator the boundary is a controlled external interface description: mission objects, status, health and events, with the internal implementation protected. An external system requests work in that vocabulary and receives no actuator authority, which is the same rule as the authority order and not a second one.
Designs are patent pending. Partners and Procurement sets out what each reader gets and in what order, and Government carries the ministry route.
This page is written for a reader who will hold it against a specification. The boundaries are part of the design.
The route from this page to a technical discussion runs through one screened desk and opens in four steps. Moving between them is an agreement, not a click.
| Tier | What it holds | How it opens |
|---|---|---|
| T0 · Public | Capability, programs, architecture and manufacturing. Everything on this site. | Open. Nothing is asked of the reader. |
| T1 · Partner | Program briefs, controlled external interface descriptions, the qualification plan, the supplier and production overview. | On request, after screening. |
| T2 · Evaluation | Machine configuration records, integration requirements, cyber and support documentation. | Under agreement. |
| T3 · Controlled technical | Drawings, bills of material, detailed hazard analyses and restricted technical data. | Under non-disclosure, export and security controls. |
Public first, controlled last. The tier a conversation reaches follows the agreement in place, never the size of the question.
Three doors lead to the same desk. Government is the ministry and agency route, and it carries the work we turn down before it carries the offer. Primes and OEMs is teaming, integration and manufacturing, including the controlled external interface. Suppliers is qualification and capability submission for the sovereign supply-chain register.
Partners and Procurement holds all three and the four tiers above. Contact is two addresses and one desk.
A doctrine is only worth reading if it survives contact with a specification. Bring the paragraph yours turns on.
State the requirement, the ground it is written for and the domain it sits in, and the answer comes back against the four sentences on this page rather than around them. Where a limit rules the requirement out, the limit is the reply, and it arrives at the first exchange rather than at the last.
The four domains are Air, Ground, Water and Underground, and the questions that are worth putting first are the ones about a mission a person should not be sent on. The fleet is the place to start if the requirement is a platform. Technology is the place to start if it is an architecture.
Enquiries are screened before anything is discussed. Nothing on this site is an offer, and no prices appear on it.
Designs are patent pending. International transfer is subject to Canadian government permits taken per shipment. Nothing on this page is an offer.
