Three routes for a partner. Bring a payload to the interface standard the fleet shares, and to the chain that produces it. Integrate the autonomy subsystem behind one controlled interface. Or license the architecture, with a defined IP and data boundary and a manufacturing path in Canada.
A partner comes to the platforms Canadian Shield builds in two places: the interface standard they share, and the chain that produces them.
Eleven programs across Air, Water and Underground run on a single electrical and mechanical seam, and CDNS KAOS carries the ground on the same principle: a keyed deck interface, and assemblies that interchange across its three sizes. A common wiring and mounting interface standard runs across the platform family, adapted from established MIL-STD practice, so payloads and subsystems move between platforms instead of being re-engineered for each one. An integrator brings a payload to the standard, and the adaptation work happens on our side of it, against drawings and fixtures that are already ours. Manufacturing's interface section sets out the seam.
The lead program is the Goose CS-110: a ground-launched pneumatic interceptor round, a fully unpowered tube-launched moulded body that defeats an uncrewed target by kinetic collision alone. No battery, no motor, no onboard guidance electronics, and it is spent in salvo. One launch chain carries three Air programs. CDNS UAV Platforms carries the round and the launcher; The Fleet lists the four domains.
One electrical and mechanical standard across the platform family. A partner brings a payload to it, and the harnesses that carry the seam are built inside the group.
Six stages from design to assembly and quality inspection, on owned capability: a 5-axis cell cutting cavity, core and inserts, and moulding presses in-house.
The Forward Manufacturing Cell puts moulding, assembly, QA and proof on a host nation's own floor, fed by feedstock it collects, against dies cut in Canada.
Behind the round is a production chain of six stages. Design runs in one loop with the mould and the fixture, and the 5-axis cell machines cavity, core and inserts in-house, so the industry's eight-week mould lead time becomes shop hours. Detect, track and cue are owned capability, built in-house. The six stages, door to delivery sets the chain out.
For an industrial-participation lead, a cell is measurable on the host's own floor, and for the host's auditors it is the production ledger. Dependence narrows, deliberately, to what stays Canadian: the dies, the design IP and the doctrine. The cell's industrial-participation section sets out what travels with one.
What ships on that route is the moulded polymer airframe and the pneumatic launcher driven by compressed shop air. Fire control, seekers and guidance electronics stay in Canada, in every case. Doctrine states the rule the fleet is built to, and Technology carries the radio boundary: no radio and no GPS in any Canadian Shield design.
No warhead, no fuze, no energetic material, and no link to guide on.
A prime does not take on a new platform. It integrates a subsystem that keeps its own machine authority, reachable through one controlled interface.
The offer is a subsystem, not a competing product line. A prime integrating Canadian Shield's autonomy keeps isolated machine authority: its own command-and-control system reaches a mission gateway over a wired or at-the-dock interface, in a fixed, high-level task vocabulary — mission objects, status, health and events. Nothing else crosses. Isolated machine authority is physical as well as logical. The unit sits on the operator's seat and works the joysticks, levers, pedals and switches the manufacturer fitted; it never connects to the machine's CAN bus, ECU or firmware, and a fused accessory feed is the only wire. The physical stop and the manual release on every actuator always remain.
What a prime integrates is a family: engineering plant, logistics and handling, terrain and base support, or a customer-defined specialty family, marketed as a family rather than a machine-by-machine SKU. Each machine inside it is surveyed, fitted, calibrated and qualified as its own configuration.
AI proposes; it never commands the actuator. The full layer model that holds that boundary is described at Autonomy, and CDNS Autonomy carries the unit, the seat and the two profiles it is fitted for.
Integrated into the prime's own platform behind the controlled external interface, with isolated machine authority. The prime's own command-and-control system reaches a mission gateway by wire or at the dock, in high-level task vocabulary, and nothing else.
Canadian Shield inside the prime's own program, under the same interface and authority boundary, as a subcontracted capability rather than a separate product line the prime has to sell around.
The offer to an OEM is the architecture itself: a licence, co-development, or a path where the OEM's own product carries the integration.
The architecture, or a defined subsystem of it, licensed under field-of-use and IP terms. Hardware stays the customer's; the configuration and the application remain Canadian Shield's, sealed and revocable.
Canadian Shield's engineering and the OEM's own, inside one authority architecture and one legal review. Neither side designs around the machine-control and safety boundary; both design to it.
A non-invasive design carried into the OEM's own product, under an OEM partnership path.
The architecture is already engineered around six interface families: dual-axis hand control, rotary control, linear foot control, discrete control, instrument observation and dynamic-state sensing. An OEM's own control layout is read against these six families in the control-geometry survey that opens every new configuration.
Hardware is bought in and owned by the customer. The configuration and the application are Canadian Shield's: licensed, sealed and revocable. The group remains the manufacturer of the finished product.
A defined intellectual-property and data boundary sits behind every licence. Its terms are stated in the licence itself, not on this page. There is no informal cross-use of source, models or drawings outside it.
Where the program calls for it, manufacture happens here too: named assemblies built, integrated and tested in Canada, or through an allied production partner where that is the better fit. See Manufacturing for how Canadian Shield builds, and Sovereignty for how control and recoverability are defined across design, software, data, manufacturing, supply chain, service and configuration.
Each line below is something a prime or an OEM can buy. What any of them costs is settled after a screened enquiry has set the scope.
Sustainment follows the machine-family discipline the rest of the architecture runs on: serialized line-replaceable units where appropriate, machine-family spares kits, calibration intervals, and depot repair and secure re-image capability in Canada and selected allies. A field issue is always linked to the exact configuration it happened on.
The compute, the safety and sensor kit, and a machine-specific actuator and mount kit: the physical goods that ship with every configuration.
Survey, kit adaptation, drawings, calibration and validation for a new configuration.
Secure updates, diagnostics, configuration management and supported machine skills, delivered under the same signed-release discipline as the architecture itself.
A bounded, time-limited trial, with support, sized to let a prime or an OEM assess fit before any larger commitment. It is a commercial arrangement, and it is not the signed authorization a machine's own motion runs under.
Core or subsystem, under field-of-use and IP terms: the route an OEM takes to build the architecture into its own product.
Qualified local assembly or manufacture where strategically appropriate, alongside named assemblies built, integrated and tested in Canada.
Operator, maintainer, depot and engineering-support packages, built around training measured as independence from Canadian Shield rather than dependence on it.
On the fleet route, moulds and dies are wear items, re-cut in Alberta on our own 5-axis machines and supplied with fixtures, augers, seals and qualified resin.
External systems reach Canadian Shield's autonomy through one controlled interface. Machine-control and safety networks stay on their own side of it.
An external command-and-control system requests tasks, areas, priorities or supervisory actions in a fixed, high-level vocabulary. That request arrives on a wired or at-the-dock interface rather than a radiated command link, and a mission gateway translates only the permitted request types into the local task vocabulary the machine understands. Nothing outside that vocabulary passes through, and there is no direct network path from the external system to motion or safety.
Machine-control and safety networks stay segregated from service and mission networks. A lost or compromised external link cannot create actuator authority; it can only remove it. The safety loop and motion commands travel on a wired path, never a wireless one.
The interface is documented rather than described in outline: a controlled external interface control document covering mission objects, status, health and events. It opens at T1, after screening, and no interface document is released without an export-control assessment and a publication decision. What sits behind it stays behind it. The authority order behind it is set out at Safety.
An external system requests. It never commands. Nothing outside Canadian Shield's own authority chain reaches an actuator.
Offline-first operation does not eliminate cyber risk. The interface sits inside a wider cyber program:
Every integration is scoped by an engineering review, a legal review, and the interface boundary above. Two things do not move: the scope of what integrates, and access around that boundary.
The limits are the product, as much as the subsystem or the architecture is. Canadian Shield's autonomy does what its rule set allows, and nothing else.
A prime or OEM enquiry is screened before anything technical is discussed. What follows is a tier of disclosure, not a sales call.
For a prime, the conversation starts with the controlled external interface and where the intellectual-property boundary sits. For an OEM, it starts with machine validation, data and IP, and the lifecycle terms of a licence. On the fleet route it starts with the standard a payload must meet.
The same four tiers run behind every door: T0 on this site, T1 on request after screening, T2 under agreement, and T3 under NDA, export and security controls. Procurement's data room sets them out for every reader.
Export posture is counsel-first. Controlled goods leave Canada only under permits issued per shipment by Global Affairs Canada. Nothing on this site is an offer, and no prices are published; a quote follows scope.
| Tier | What it carries |
|---|---|
| T0 · This site | Capabilities, programs, architecture and manufacturing — everything on this site. |
| T1 · On request, after screening | Program briefs, sanitised interface descriptions, the qualification plan, supplier and production overview. |
| T2 · Under agreement | Machine configuration records, detailed test plans and results, integration requirements, and cyber and support documentation. |
| T3 · Under NDA, export and security controls | Drawings, bills of materials, detailed hazard analyses, vulnerabilities and restricted technical data. |
Moving between tiers is an agreement, not a click.
Name the platform, the domain it has to work in, and where the boundary should sit.
A screened enquiry starts the conversation, whether the next step is a payload brought to the fleet's interface standard, a cell sited on an ally's own floor, the autonomy subsystem, a licence or an OEM-integrated path.
A prime names the platform and the ground it has to work on. An OEM names the product. An industrial-participation lead names the floor a cell would stand on. The interface boundary above holds before a drawing or a line of source changes hands.
