the contract
What Danu must do — the mission, the targets, the safety rules, and the ethics we hold every design decision to. When we have to choose, we choose whatever keeps these true.
Find Lake Michigan shipwrecks autonomously — no pilot, no tether. She runs the mission; we review at surfacings.
4K video and sonar imagery, recorded onboard. The footage she carries back is the whole point.
Days at a time on her own — dive, search, rest on the bottom, surface to report, repeat.
Radio doesn't go through water, so she surfaces on a rhythm: GPS fix, send findings, take new orders, dive again.
The process is public — the wins, the snags, and the floods. That's a requirement, not a side effect.
Design targets — the reservoir and lake tests turn these estimates into measurements.
The worst outcome isn't a broken part — it's losing the vehicle. Every rule below exists so that no single failure can keep her down.
Any single failure — computers dead, battery dead, software hung — must end with Danu floating on the surface with a locator running. Drop-weights, an independent timer release, a strobe, and an acoustic beacon layer on top of each other so no one failure can keep her down.
Three independent brains. A tiny bare-metal supervisor owns the failsafes and answers to nobody — if heartbeats stop, it cuts power and surfaces the vehicle. The AI only ever suggests; deterministic checks (geofence, energy, depth, deadline) decide.
Leak probes plus pressure-based seal monitoring inside every tube. Any trip aborts the mission. Before every dive, the tubes must hold a vacuum — a failed seal test blocks the dive.
She turns for home with the return trip's energy plus a 30% reserve still in the bank — enforced by the mission computer, and independently by the supervisor at critical voltage.
300 m is the design target, but she never dives deeper than what we've pressure-tested to at least 1.5× — proven in a chamber before it's trusted in the lake.
Observe from outside, always. Penetration is how underwater robots are lost — and wrecks deserve the respect anyway. Thruster guards and never-power-through-a-snag rules handle fishing line, the real enemy.
Great Lakes shipwrecks are protected by law — Michigan bottomlands law and the federal Abandoned Shipwreck Act. Danu films; she does not touch, move, or take anything from a wreck, ever.
Missions are planned outside shipping lanes and marinas; lane crossings happen deep, below freighter keels. She listens (AIS + hydrophone) before surfacing, and shows a hi-vis marker and strobe when up.
Public posts are time-delayed, positions are fuzzed, and wreck coordinates are never published — protecting both the vehicle and the sites.
The hull carries a name, contact, and reward label — if a stranger finds her, she can come home.
Crawl → walk → run. Each stage must pass before the next; dry tests before wet tests, always.
Every system proven dry — including dry-firing every failsafe.
Watertight, trimmed, swimming — where a mistake is grab-it-by-hand cheap.
Real autonomy: waypoints, return-to-home, and the endurance data that turns estimates into measurements.
Tubes, dome, and seals proven past operating depth before any deep water.
Shallow and short first; multi-day wreck missions as trust is earned.
Watch these requirements get tested for real in the Build and the Ship's Log.