The software the units built themselves
In 2022 a Ukrainian artillery crew could receive a target, compute a fire solution, and adjust off drone video inside a single app on a commercial tablet. The app was not a program of record. Volunteers built it. CSIS documented how Ukraine's military went digital from the bottom, with artillery software like Kropyva spreading unit to unit until adoption hit 90 to 95 percent. The official system it displaced never got close. It died in development while the volunteer app fought a war.
The pattern repeated everywhere. Strike coordination ran through bots on messaging apps. Units wired commercial drones into targeting tools built by developers who had been civilians a year earlier. Chatham House studied the phenomenon and concluded that Ukraine's decisive innovations came from soldiers and volunteers close to the fight. Every unit that could not wait for official software built its own.
For a decade the defense industry read this pattern as a procurement failure story. Broken acquisition, heroic workarounds, a problem for better contracting to fix. That reading misses what the pattern actually is. It is a market signal. Operators at the tactical edge have a category of software need that no vendor was serving, and when the need got acute enough they built the category themselves. The right response to a signal like that is a product.
The layer between the platforms and the pipes
Defense software has consolidated at two altitudes. At the top the Army awarded Anduril $20 billion to deploy Lattice as the open architecture for battlefield integration, and the Pentagon pushed the Maven Smart System ceiling past a billion dollars as it hardened into a program of record. At the bottom sit the transports. TAK for shared situational awareness, tactical radios, mesh networks. Both altitudes are settled markets with entrenched winners.
Between them is where missions actually happen. A team plans an operation, executes it disconnected, and reviews what its sensors and its AI produced. The enterprise platforms sit too high to run that loop. The transports sit too low to think about it. We call the ground between them the mission application layer. The volunteer apps in Ukraine were its first native software.
Five characteristics define a mission application. It runs on hardware the team owns. It treats disconnection as the normal operating condition. Its AI runs locally and every answer is coupled to evidence. Its data has a lifecycle; records are born inside a mission, die in a burn, and get promoted only on purpose. And every consequential action produces a signed record. Software with those five properties behaves differently from everything above and below it in the stack, which is why neither the platforms nor the transports have produced it.
The architecture of the layer
EdgeLance built the layer as four subsystems. Each exists because one of the five characteristics demands it. | Subsystem | What it does | | --- | --- | | Inference gateway | One door for every model call. Policy per request. Signed provenance. | | Mission ledger | Signed append-only log. Peer-to-peer replication. Deterministic merge. Burn tombstones. | | Operational scopes | Organization, workspace, mission. Control leases for asset handoff. | | Sensor fabric | Six modalities fused at the node. Video, acoustic, RF, TPMS, NFC, wearables. Hash-linked evidence. |
Every model call on every node passes through the inference gateway. The gateway checks capacity, classification, and thermal policy before a single token is generated. When the call completes it writes a signed provenance record carrying the model hash, the quantization level, and the adapter version. Session prompt caching keeps repeated mission context cheap on constrained hardware. The gateway does not care which model sits behind the door or which operating system hosts it. Any open-weight model runs. Windows, Android, macOS, iOS, and Linux all carry nodes.
The mission ledger is a signed append-only log that replicates peer to peer across the team's devices. Merges are deterministic CRDT operations, so two nodes separated for hours converge to identical state without a coordinator. Lose a node and the mission continues on the survivors. Burn a mission and the ledger writes tombstones that prove the destruction happened.
Operational scopes give data and authority a place to live. An organization holds workspaces. A workspace holds missions. Assets move between operators through control leases that are explicit, signed, and time-bounded. Handing a drone from one operator to another is a signed ledger event with a start and an expiry.
The sensor fabric fuses its six modalities at the node itself, so a disconnected team still gets fused intelligence. The RF modality includes TPMS vehicle fingerprinting across more than 28 protocols, which turns the tire-pressure chatter of passing vehicles into trackable signatures. Every capture is hash-linked into the evidence chain the ledger carries. When the local AI cites a detection, the citation resolves to a specific hash in that chain.
Trust that survives the mission
Access control fails closed. A node that cannot verify who is holding it locks. Identity check-in happens at the device through biometrics or an NFC token, which makes physical presence the security boundary. A jammed mesh degrades bandwidth. It never degrades security, because security was never wired to the network in the first place.
Mission burn destroys mission data on command while leaving a proof chain that survives the burn. The unit can show exactly what was destroyed and when without retaining any of the content. The same audit ledger feeds four readers from one record stream. It serves the commander, the accreditor, counsel, and the after-action review, and each of them queries the identical signed history rather than a report someone assembled later.
Accreditation evidence generates itself as a build step. Every build emits a CycloneDX SBOM, a control matrix mapped to NIST SP 800-53, a model provenance attestation, and a STIG posture report. The control matrix is generated from the ledger instead of written by hand, so it describes the system as it ran. The gateway's provenance records give the NIST AI Risk Management Framework something it rarely gets at the edge. Ground truth about which model ran, in what configuration, on whose authority.
Shipping to places with no network
The platform ships as a single signed Zarf package with the models bundled inside. It installs cold on an air-gapped network with nothing reaching back out. A base or forward operating base running Kubernetes deploys through Helm charts, and the package is UDS-compatible for organizations standardized on that stack. Node agents cover five operating systems. When no network exists at all, a USB-C courier workflow moves signed updates by hand from device to device, and the ledger reconciles the deltas on contact.
The layer is bigger than it looks from above. Making plan, execute, and review work disconnected took 629,791 lines of first-party code. The platform exposes over 1,000 API endpoints and twelve workspace modules that carry a mission from planning through after-action review. The load-bearing pieces of the architecture are patent pending.
That scale is the honest cost of the five characteristics. Disconnection as the baseline forces peer-to-peer replication. Evidence-coupled AI forces the gateway and the hash chain. Data lifecycle forces burn tombstones and promotion workflows. None of it can be bolted onto an enterprise platform that assumed a cloud, which is why none of it has been.
Why bottom-up wins the layer
Ukraine already ran the adoption experiment. Kropyva did not reach 90 percent of artillery units through a fielding directive. It reached them because a battery that adopted it shot faster than a battery that did not. Software that serves the user spreads without a mandate. The mission application layer will be won the same way, team by team, because the operator holding the device decides what gets used when the network is down and headquarters is far away.
The enterprise platforms are consumers of what this layer produces. Lattice and Maven are worth their contract ceilings because of the data flowing into them, and the highest-value data is born at the edge during missions. Whoever owns the producing layer sits upstream of every platform above it. That is the position EdgeLance built for.
And the layer compounds. Mission records accumulate in the unit's own ledger. Those records train unit-scoped adapters, small model updates that carry the unit's terrain and targets and radio habits. The adapters make the next mission sharper, which produces better records, which produce better adapters. The unit owns every turn of that wheel. No cloud vendor holds the data and no headquarters has to approve the learning.
What evaluating the layer looks like
A serious evaluation of this layer asks questions that enterprise platform evaluations never reach. Pull the network cable before the demo starts and watch what still works. Ask for the provenance record of a specific model output and time how long the answer takes. Order a mission burn, then demand proof of what was destroyed. Hand an asset between two operators and check the ledger for the lease. Request the SBOM and the 800-53 control matrix for the exact build under test, and reject anything a human wrote after the fact.
A vendor whose product was built for this layer answers each of those on the spot, because the answers are records the system already produced. A vendor whose product assumed a cloud will ask for network access first, and that request is the evaluation result.
The volunteer developers in Ukraine proved the layer exists and proved operators will fill it themselves if industry does not. EdgeLance built it as a product. The evaluation starts with a signed package on a USB-C drive and a room with no network.