Sovereign means controllable: who holds design authority, who signs the software, who owns the data, what is built here, what could be substituted, and whether a system can be repaired and recovered at home. Ten dimensions, each one stated as a commitment.
Sovereignty is defined by control and recoverability rather than by the nationality of every component. The question is who can decide, who can sign, and who can put a system back into service.
Canadian Shield treats sovereignty as a set of controllable choices: design, software, configuration, manufacturing, service and supply chain. Each of those is a decision somebody has to be able to make, and the sovereign question on each is whether the customer and a Canadian supplier hold it between them, or whether it sits abroad with a party neither of them can direct.
Recoverability is the second half, and it is the harder one. A system is recoverable when it can be repaired, calibrated, re-imaged and returned to service at home, from recovery media already held for supported field versions. Depot repair and secure re-image capability are designed to be held in Canada and in selected allies, so a unit that has to be rebuilt is rebuilt on friendly ground.
Sovereignty is a set of commitments about where authority sits and what happens when a part, a supplier or a version has to change. The positioning follows from that: Canadian-controlled capability designed for allied integration and local sustainment.
The commitments cover both halves of the company. Every other program on this site is a machine Canadian Shield builds; CDNS Autonomy is the operator for the machines a customer already runs. The fleet is drawn, moulded and assembled here; a converted machine is the customer's own host platform under a Canadian configuration. Where a dimension lands differently on the two, the row below says both, and Company carries the halves as one identity.
The commitment is over the choices: design, software, configuration, manufacturing, service and supply chain. It is also over the ability to put a system back into service at home.
Each dimension answers a question a procurement officer will ask, and each is written as a commitment about who holds the control and where the work is done.
| Dimension | The commitment |
|---|---|
| Design authority | Requirements, architecture, drawings and release are controlled in Alberta: on a fleet airframe under the division's own document control, and on a conversion under the group's. |
| Software authority | Source, builds, signing and field versions are controlled by the group. The architecture holds a hard boundary between high-complexity compute and deterministic safety authority. |
| Data authority | Machine data, operator data, derived skills and logs each have a named owner. The customer owns the hardware; the group owns the configuration and application; data rights are written into the terms. |
| Manufacturing | Airframes, moulds, fixtures, launchers and assemblies are built on the group's own floor in Alberta, and named assemblies are integrated and tested in Canada. A converted machine is the customer's own host platform, and the configuration and application governing it are the group's. |
| Supply chain | Compute, sensors and some actuators come from allied and global commercial suppliers, registered by criticality, with substitutes. |
| Service | Repair, calibration and recovery are designed to be done domestically, with allied depot options for allied customers. |
| Cloud and network | Core operation needs no foreign cloud, and there is no radio in any Canadian Shield design. Fleet guidance is preset, fibre or onboard. A converted machine takes one of three: loaded and sealed at the dock; a fibre tether to a person at a stand-off station; its own perception inside the same rules. |
| Crypto and update authority | A field software or model change is authorized by the group, in Canada, by signed release. |
| Training | Training is built for independence: operators and maintainers run and maintain the systems without perpetual vendor dependence. |
| Configuration | A customer can prove exactly what hardware, software and skill set is fielded. On a converted machine the Machine Configuration Record travels with the unit. |
Critical dependencies are registered with substitution plans; named assemblies are built, integrated and tested in Canada. Ten rows, one page: the fleet and a converted machine answer the same checklist.
The ten hold together or not at all. Design authority without software authority leaves a system drawn here and changed elsewhere. A domestic floor without a supply-chain register leaves a line one component away from stopping. The sections below take them in the order a checklist runs.
These two decide everything downstream. One controls what the system is; the other controls what it becomes after it ships.
Design authority. Requirements, architecture, drawings and release sit in Alberta, under the division's own document control. A change to what the system is starts as a requirement and ends as a released drawing, and both ends are held here.
Compute dependencies are abstracted, so a later move to different processors does not require the machine-control boundary to be redesigned.
Software authority. Source, builds, signing and field versions are controlled by the group. Development, test and production signing authority are kept separate, and model weights, calibration assets, machine-skill manifests and maps are handled as controlled software and data configuration items.
The architecture holds a hard boundary between high-complexity compute and deterministic safety authority.
Nothing reaches a machine except by signed release. Runtime learning gathers evidence for the next revision and cannot promote itself into service. A signed manifest and a deployment compatibility check confirm that what runs on a machine is the release issued for it.
Technology carries the mechanism both halves run on, including the guidance ladder. Autonomy carries the layer model behind that boundary: what proposes, what executes, what approves, and what may stop the machine.
Ownership is divided on purpose, and the division is written down. So is the record that proves what is actually fielded.
Hardware is bought in and owned by the customer. The configuration and the application are the group's, licensed, sealed and revocable, and the group remains the manufacturer of the finished product. That division lets a customer hold the asset outright while the rules governing it stay under one controlled authority.
Machine data, operator data, derived skills and logs each have a named owner, and the rights are written into the terms. Every operator record carries its own provenance, authorization and usage rights, and contractual rules govern customer data, operator demonstrations and the skills derived from them. The boundary between background intellectual property, derived work, model and data rights and customer data rights is settled in the agreement and answered in a screened conversation.
Configuration is the dimension a procurement officer can audit without taking anything apart. The Machine Configuration Record travels with every unit and covers host platform, human controls, machine kit, energy, compute, sensors, harness, software, calibration, skills, safety, maintenance and release — on a Responder CS-810 or a Defender CS-820 alike.
Operations carries the commissioning sequence that creates the record, and what is captured when a qualified operator teaches the machine.
Manufacturing is the half of sovereignty a visitor can walk through. The supply chain is the half that has to be written down before it matters.
Airframes, moulds, fixtures, launchers and assemblies are built on the group's own floor in Alberta, and named assemblies are integrated and tested in Canada. The group's own land holds the launch, recovery and flight-trial ground, under Class G airspace, within sight of where the hardware is built.
The owned floor is also the exportable part of the argument. The Forward Manufacturing Cell is a containerized slice of that line, commissioned on an ally's floor so airframes are moulded and assembled in-country from local feedstock. It carries the moulded polymer airframe and the pneumatic launcher, and nothing else: fire control, seekers and guidance electronics stay in Canada, and no energetic material exists at any point in the process.
Compute, sensors and some actuators come from allied and global commercial suppliers. Each sits on an approved component list recording origin, lifecycle, lead time, export sensitivity, single-source risk and the substitutes that would replace it. A dependency registered with a substitution path is a dependency a customer can plan against.
Obsolescence is managed as a standing engineering task across compute, storage, sensors and connectors, and long-term support branches carry supported releases through it. Manufacturing carries the floor itself.
A capability that has to cross an ocean to be fixed is not a sovereign one. Service is designed to be done domestically, and recovery is designed to work with no network at all.
Repair, calibration and recovery are designed to be done domestically, with allied depot options for allied customers. Depot repair and secure re-image capability are designed to be held in Canada and in selected allies, so a unit that has to be restored is restored inside a perimeter the customer or Canada already holds.
Recovery does not depend on reaching a service. Offline build artifacts, signed images, dependency mirrors and recovery media are maintained for supported field versions, and a controlled recovery image and disaster-recovery procedure sit behind them. The media that rebuilds a machine is held before it is needed.
Core operation needs no foreign cloud, and no Canadian Shield design carries a radio. What remains to be controlled is who may change a fielded machine, and that authority sits in one place.
Guidance is preset, fibre or onboard. There is no radio and no GPS in any Canadian Shield design: nothing in the fleet transmits by radio, and nothing guides on a link. Mission runtime and safety functions execute locally, and a supported release can operate and recover locally.
Where an external command and control system is present, it is isolated behind a gateway that translates only permitted request types into the local task vocabulary. Machine-control and safety networks stay segregated from service and mission networks, and no external network ever holds actuator authority.
Signed rules and firmware, a hardware root of trust, no debug access on shipped units, and keys held by the group in Canada. A field software or model change is authorized by the group, in Canada, by signed release.
Authorization itself is time-limited, signed and withdrawable. Expiry or withdrawal ends in a safe stop at the next safe point and a minimum-risk condition, never an instant stop, because the safety loop stays wired. A unit whose authorization has ended stays installed and will not run, and the host machine is never touched. The physical stop and the manual release always remain.
Doctrine carries the four sentences these commitments sit under: AI plans, rules govern, humans authorize, safety has veto.
Training is built for independence, and the measure of it is whether a customer's own operators and maintainers can run and maintain the systems without perpetual vendor dependence.
Operators and maintainers are trained by role, against the configuration they will actually work. Controlled publications cover installation, operation, maintenance, recovery and safety, and they are issued for that same configuration.
Role-based training for the people who set the job, approve the envelope and supervise the machine, on the configuration they will run. Publications are issued against that same configuration.
Role-based maintainer training, calibration intervals, recalibration triggered by a repair, and field diagnostic tooling that runs with bounded privileges. Service access is separated from developer access.
Depot repair and secure re-image, in Canada and in selected allied depots, so a unit can be restored without leaving friendly ground.
Engineering support packaged alongside the operator, maintainer and depot training, for the questions that reach past a publication. Support is packaged against the supported release, not against a version a customer no longer runs.
Operations sets out the commissioning sequence a crew is trained against, and what a supervising person sees while a machine is working.
Canada is where the line proves itself first, and allied conversations follow a Canadian reference rather than replacing it.
Sovereignty is told here as a manufacturing and control story: an owned shop, owned tooling, owned configuration authority. It is not a flag on a brochure.
The offer to an ally comes out of the same architecture: Canadian-controlled capability designed for allied integration and local sustainment. That means local operation without a foreign service in the loop, allied depot options, and depot repair and secure re-image capability designed to be held in Canada and in selected allies. Where it is strategically appropriate, qualified local assembly or manufacture is part of the conversation.
Integration is published rather than improvised. A controlled external interface document carries mission objects, status, health and events, while internal implementation stays protected and no external system is given actuator authority.
Export posture is counsel-first. Every enquiry is screened before any discussion, and international transfer requires Government of Canada permits, issued per shipment. Procurement carries the route in and the four tiers of access along it; Government and ministries carries what a screened enquiry gets back and how access to a controlled brief escalates from there.
This page is read by people with a checklist and a decision to defend. Both halves below are worth having before a screened enquiry rather than after it.
The commitments hold in both directions. Control is stated over the choices a customer would otherwise have to take on trust: who draws it, who signs it, who owns the data, who may change a fielded machine, and who can put it back into service. Capabilities sets out what the two halves deliver against those choices.
If sovereignty is a condition of the buy, the useful first exchange is the checklist itself rather than a capability brief.
Send the dimensions your own policy requires, and name the ones you cannot move on. Every enquiry is screened before any discussion, and the export posture is counsel-first. Program briefs follow a screened enquiry.
Manufacturing is the floor these commitments are made on, and the Forward Manufacturing Cell is that floor offered to an ally. The fleet carries the machines Canadian Shield builds; CDNS Autonomy carries the operator for the machines already in a customer's yard. Operations carries commissioning, the configuration record and the training a crew is put through. Government and ministries is the door for a ministry or an agency, and Contact reaches one desk, and a person answers.
Nothing on this page is an offer, a commitment or a representation to any government body. Canadian Shield designs are patent pending, the export posture is counsel-first, and international transfer requires Government of Canada permits, issued per shipment.
