The design baseline is a dead network
In the summer of 2022 the Excalibur round was one of the most effective weapons in Ukraine. A GPS-guided 155mm shell that could land within meters of a target from twenty-five miles out. Its hit rate ran around 70%. By mid-2023 that number had collapsed to under 10%. The Washington Post reported the cause in May 2024. Russian electronic warfare units learned to jam the GPS signal the round depended on. The shell still flew. The explosive still worked. The link died and the weapon became a very expensive way to miss.
This is the pattern that should keep every program office up at night. A capability that depends on a signal inherits every weakness of that signal. And the adversary knows it. CSIS documented China's rapid buildout of electronic warfare and communications infrastructure on its outposts near the South China Sea. Jamming arrays and signal intelligence sites positioned to blind and silence anything that operates in reach. The investment thesis is simple. Attacking the link is cheaper than attacking the platform. No missile required.
Most software built for defense still assumes a reachable server. The assumption hides in every architecture diagram with an arrow pointing to a cloud. Every one of those arrows is a single point of failure the adversary can attack without firing a shot. DDIL is not an edge case your system falls back into. It is the design baseline your system is built on. EdgeLance made that choice at the foundation and this paper explains what the architecture looks like as a result.
The mission ledger
Everything in EdgeLance rests on one structure. The mission ledger is a signed append-only record of mission state. Every consequential event becomes an entry. A chat message. A detection from a sensor. An AI answer. A task assignment. A file drop. Each entry is signed by the key of the node that authored it and appended to the ledger. Nothing is ever edited in place. Nothing is ever silently overwritten. The record only grows.
Every node in the mission holds a full replica of the ledger. There is no authoritative node and no tiebreaker server. When two nodes meet on any link they exchange the entries the other is missing. The merge is a deterministic CRDT operation. Two elements can operate separated for hours and accumulate hundreds of entries apart. When they reconnect the merge runs on both sides and produces byte-for-byte identical state. No coordinator decides the order. The math decides the order. Any two replicas that have seen the same entries are the same replica.
Deletion works through the same machinery. When a mission is burned the burn writes tombstone entries into the ledger. A tombstone is signed like any other entry and it propagates like any other entry. But a tombstone always outranks the data it kills. Any node that merges a tombstone destroys the corresponding payloads before they can render. This is what makes deletion provable across partitions. You do not need to reach a node to burn its data. You only need the tombstone to reach it before an operator does. The ledger guarantees it will.
Nine transports, no favorites
The ledger does not care how entries move. EdgeLance treats every transport as interchangeable and temporary. Nine of them ship today. WiFi and BLE for close-in mesh. LoRa through Meshtastic radios for kilometers of narrowband. MANET radios for tactical networks. LTE where it survives. Starlink profiles for satellite broadband. Direct-to-Cell for phones with nothing else. Iridium SBD for a few hundred bytes from anywhere on Earth. And a USB-C courier mode that moves the full ledger over a cable at zero RF emission.
Every outbound entry goes into a store-and-forward queue with priority ordering. When a link appears the queue replays in priority order for as long as the link lasts. A five-second window on a satellite pass moves the most important entries first. The system scores each available link continuously on latency and loss and throughput. When a link degrades the system steps down to the next one without operator action.
Payload shaping is where this gets interesting. The same ledger entry can be expressed at five levels of fidelity and the link health decides which one moves.
| Link state | Payload mode | What moves | |---|---|---| | Healthy broadband | Full | Complete entries with attachments | | Degraded | Summary | Entry text and metadata with attachments queued | | Narrowband | Coordinates | Position and status fields only | | Brief window | Burst | Highest-priority queue flushed in seconds | | Contested or emissions-controlled | Silent | Nothing transmits and everything queues |
A sensor detection with a full-motion clip attached is a full payload on Starlink. On LoRa it becomes a one-line summary with a grid reference. On Iridium it becomes coordinates and a classification code in under 300 bytes. The attachment waits in the queue until a link worthy of it appears. So the common picture stays current even when the network can only carry a whisper.
Shaping is also classification-aware. What a payload contains depends on what the link is cleared to carry. A commercial satellite link and a tactical radio net do not get the same expression of the same entry. The shaping policy strips fields that exceed the clearance of the transport before anything leaves the node. The operator never has to think about it. The wrong bits cannot reach the wrong wire.
Local AI at zero bars
AI that lives on a server behind a contested link is a peacetime feature. EdgeLance runs inference locally first. The model is on the device. The mission record is on the device. When connectivity drops to zero the AI keeps answering because nothing it needs left the node in the first place.
Every inference request passes through a local gateway that enforces policy per request. Capacity policy decides whether the device has the memory and compute headroom to run the request at all. Classification policy decides what mission data the request may touch. Thermal policy throttles or defers heavy work when the device is hot. And every answer the gateway produces gets stamped with signed provenance. Which model ran. Which documents it read. Which node produced it. That stamp becomes a ledger entry like everything else. Six months later an auditor can trace any AI-influenced decision back to the exact context that produced it.
Mission RAG answers only from the local vault. Every answer cites the specific ledger entries it drew from. And when the record is silent the system refuses to answer. There is no parametric fallback where the model improvises from training data and dresses the guess up as mission knowledge. An operator asking about the last known position of a friendly element gets the record or gets a refusal. Both are safe. A confident hallucination is not.
Session prompt caching keeps mission context hot on the device so repeated questions in a working session cost a fraction of a cold start. And compute placement is a policy decision rather than an assumption. A request can run on local silicon or route to a base GPU or an approved cloud when link state and classification permit. The policy chooses per request. The architecture never assumes the bigger machine is reachable.
One entry's hard day
Abstractions are easy to admire and hard to trust. So walk one entry through a bad day.
A forward observer's device flags a vehicle detection at 0430. The entry is authored locally and signed with the node's key and appended to the local ledger. At 0445 a teammate passes within BLE range and the entry crosses in the routine background sync. Two replicas now exist. At 0600 the originating node is lost. Destroyed or captured or simply gone. The entry survives because replicas do not care about their author's fate.
At 0700 a jamming window opens and holds for nine hours. Nothing transmits. The teammate's queue holds the entry at priority and the payload shaper stands ready to compress it for whatever link eventually appears. No link appears. At 1600 the teammate reaches the operations center and connects a USB-C cable. The full ledger crosses the courier link at zero RF emission. The operations center verifies the entry's signature against the dead node's enrolled public key. The signature holds. A detection authored twelve hours ago on hardware that no longer exists enters the common operational picture with its proof of origin intact.
Now run the burn case. A mission is burned at 1800 while one node is still out of contact in the field. The burn writes tombstones into the ledger and every reachable node destroys its payloads within seconds. The disconnected node knows nothing. It carries live mission data for three more hours. At 2100 it regains a link and merges. The tombstones arrive and outrank every stale payload on the device. The data dies before a single pixel of it renders. The operator holding that device never sees what was burned. That is what provable deletion means when the network cannot be assumed.
Fleet under DDIL
A mesh is only as good as the discipline of the nodes in it. EdgeLance fleet management starts at enrollment. Every device is measured and assigned a capacity tier. Scout for phones and small handhelds. Operator for capable laptops and tablets. Command for high-memory workstations. The tier determines what the node is asked to carry and what inference it is asked to run.
Mission packs are sized against those tiers. A pack bundles the models and prompts and data a mission needs and a fit gate checks it against the target node before delivery. A pack that exceeds a scout node's memory never ships to it. A smaller variant ships instead. Delivery itself is signed end to end and moves over the network when the network exists and over USB-C courier when it does not. Every install creates a rollback point so a bad update is a two-minute reversal rather than a mission abort. And every node reports posture continuously into the fleet view so command sees battery and thermal and storage and link state across the whole formation.
For classified and disconnected networks the entire platform ships as one signed Zarf package with models bundled inside. An operator carries it in on removable media and cold-installs it on a network that has never touched the internet and never will. The package is UDS-compatible, and a Helm chart covers base Kubernetes for everyone else. CSIS has documented how hard Ukraine has pushed to get software onto the devices soldiers already carry. That is the model. EdgeLance runs on Windows and Android and macOS and iOS and Linux because the fleet you have is the fleet you deploy.
Pull the cable
Chatham House's study of Ukrainian innovation lands on a blunt lesson. The systems that matter are the ones that keep working when conditions turn hostile. Vendor claims about resilience are worth exactly as much as the tests behind them. So here are the tests that matter for any DDIL claim. EdgeLance passes all three and any serious evaluation should demand the same of every competing system.
First. Pull the cable mid-mission. Kill every radio on a node while an operator is working. The workspace must keep working. Chat history readable. Mission AI answering from the local vault with citations. New entries authoring and queueing. If any screen spins or blanks the system was designed around a server and the demo just proved it.
Second. Partition two elements. Run them separated for hours while both author entries. Reconnect them over any link you choose and diff the two ledgers. They must reconcile byte-for-byte with every signature intact and no operator intervention. If reconciliation needs a human or a central server the system does not have a merge. It has a help desk ticket.
Third. Burn with a node offline. Execute a mission burn while one enrolled node is out of contact and holding live mission data. Bring the node back hours later. The tombstones must win the merge and destroy every stale payload before rendering. Then check the receipts and confirm the burn is provable on every node in the fleet.
Book a technical session and we will run all three tests on your hardware with the cable in your hand.