Secure connectivity and auditable tool execution for ROS 2 robot fleets on hostile networks — outbound-only reachability, signed WASM tooling, default-deny policy.
Reach robots deployed inside customer networks you don't own and can't configure — and run only signed, sandboxed, policy-bounded, audited tooling on them. Ganglion is a connectivity and governed-execution substrate. It is not a fleet-management platform, not a robot-autonomy framework, and not a SaaS product.
Connectivity tools answer one question: "Can I reach the robot?" Ganglion answers a second one they don't: "Can I reach it and run only signed, sandboxed, policy-bounded, audited tooling on it?" VPNs and overlays are network planes; Ganglion is a governed execution substrate that brings its own hostile-network reachability and composes with whatever runs on the robot.
Already on Tailscale + SSH? Keep them. Ganglion isn't another VPN to rip-and-replace — it's the governance layer those tools don't provide. A VPN gives anyone who connects ambient shell authority; Ganglion turns "reach the machine" into "run this specific signed tool, once, under a default-deny policy, with a tamper-evident record of who ran what." The two compose: your VPN for the humans who need a shell, Ganglion for the automated tooling that shouldn't get one.
| Tool | What it solves | What it doesn't | Reach for Ganglion when |
|---|---|---|---|
| SSH + VPN (Tailscale/WireGuard) | Machine-level network reachability | Anyone connected has ambient shell authority | "Who ran what on the robot?" must have a provable answer |
| Husarnet | ROS-friendly P2P VPN across sites | Governance of what executes once connected | You need per-tool grants, not network membership |
| OpenZiti | Zero-trust overlay for service access | No opinion on code that runs after connect | The unit to authorize is a tool run, not a network flow |
| Zenoh | Scalable pub/sub/query data plane, DDS-over-WAN | Signed, sandboxed, audited execution | You need governed actions, not (just) data flow |
| DDS (Fast DDS/Cyclone) | In-robot and LAN real-time pub/sub | NAT/CGNAT traversal; any execution model | Robots sit behind networks DDS discovery can't cross |
| PyZeROS | Python ROS 2 clients over Zenoh, no ROS install | Security, policy, audit (not its goal) | Someone else's laptop must run bounded tooling remotely |
| Foxglove | Robotics observability and visualization | Executing tooling on the robot | You need to act, not only observe (they compose) |
| Viam / Transitive | Platform to build robot apps on | Default-deny signed tooling for existing ROS 2 stacks | You keep ROS 2 and add governance, not re-platform |
Full depth, "use both" patterns, and an honest "Ganglion is not for you if…" list: docs/COMPARISON.md.
# Install — prebuilt binary, no Rust toolchain needed (Linux & macOS, x86_64 & arm64).
# Verifies its SHA-256 before installing. (Or: cargo install gang)
curl -fsSL https://raw.githubusercontent.com/RobotDen/ganglion/main/scripts/install.sh | shThen, in order:
gang demo # 60-second proof: keygen → sign → deploy → policy → sandboxed invoke → audit,
# all in one process. No Docker, no ROS 2, no network.
gang up # A REAL local fleet: loopback relay + robot agent + one signed sample,
# under a default-deny policy. Prints the exact commands to drive it.
gang tui # The live dashboard — peers, tunnels, policy allow/deny, and a tailing
# audit log, folded from a genuine server-push event feed.gang up prints a --data-dir; point gang tui --data-dir <that> at it in a second terminal to watch the fleet you just started.
That is the whole local loop. To go to a real multi-host deployment — stand up a relay, connect a robot that dials out, and enrol it in one line with gang pair / gang join — follow the full walkthrough with real transcripts in docs/QUICKSTART.md. Every command and flag is in docs/CLI_REFERENCE.md.
The gang CLI sends at most one anonymous request per day from operator
commands — version, OS/arch, install channel, and per-command success/error
counts — to help us build better tools. Enabled by default (the standard
OSS opt-out model), and nothing is sent before a one-time disclosure notice.
No arguments, names, patterns, peers, or anything from your network, ever.
The random id is resettable and derived from nothing. The entire pipeline
is in this repository — client
(telemetry.rs) and server
(telemetry/worker/) — and gang telemetry show
prints the exact payload before anything is sent.
Telemetry never transmits from gang agent, gang join, or gang relay
— that boundary is enforced by tests and the CI harness. Robots keep a
local-only usage bundle (capability-group counts, no names, no
identifiers, no send path) that operators can pull with
gang telemetry fleet pull; forwarding the fleet aggregate is a separate
explicit opt-in (ADR-027). Workstation telemetry should still not run in
your customers' environments: if you use Ganglion in production, disable
it — gang telemetry off on every operator workstation, or
DO_NOT_TRACK=1 fleet-wide. Every detail and every opt-out:
TELEMETRY.md.
Everything local, the connectivity layer, and the remote dispatch hop are built and verified: gang demo, identity, component signing, the policy/audit pipeline, the relay server, robot agents that dial out and hold a circuit reservation, the peer registry, and remote deploy/run/caps over the relay circuit with SSH-style TOFU host-key verification, replay-protected control, and honest non-zero exits.
The presence/streaming layer is built too: an authenticated, bounded robot→operator event feed (presence, policy decisions, audit appends, connection changes, heartbeats) powers gang logs, gang connect, gang transport-stats, gang list, and the gang tui dashboard. The feed defaults to a genuine server-push substream over /ganglion/events/1.0 (libp2p-stream) — events reach operators the instant the robot emits them — with the request-response poll retained as an automatic fallback (--events-transport auto|push|poll), because libp2p-stream is pre-release. See ADR-024.
Three layers:
- Connectivity — libp2p peer identity, secure channels (Noise), TCP + QUIC, circuit relay v2, NAT traversal (DCUtR hole-punching). Robots dial out; operators reach them via a shared relay. Inbound connectivity is never assumed.
- Tool execution — a WASM component runtime (Wasmtime). Signed, sandboxed, versioned tools with explicit capability declarations. No ambient authority; memory limits, CPU budgets, and wall-clock deadlines enforced per component.
- Native brokers — privileged host processes that mediate WASM capability access to ROS 2 topics/services/parameters, filesystem, logs, diagnostics, subprocess execution, network probing, and metrics. Pattern-based access gating with a default-deny policy.
Full reference: docs/ARCHITECTURE.md.
Ed25519 identity (PeerId = Blake3 of the public key) · Noise-encrypted channels · signed component manifests verified against a trust store · a default-deny policy engine that fails closed on malformed input · tamper-evident Blake3 hash-chain audit log · replay protection on control requests · a TOCTOU-closed symlink jail, command allowlisting, and SSRF guards on the brokers · fuel/memory/deadline limits on every WASM execution.
Full threat model: docs/SECURITY.md. Taking this architecture through a security review? There's a reviewer-facing overview at tafylabs.io/fleetlink/security.
- docs/QUICKSTART.md — the full getting-started walkthrough with real transcripts.
- docs/CLI_REFERENCE.md — every command, flag, and example.
- docs/ARCHITECTURE.md — the three layers, the eight WIT capability groups, and the crate map.
- docs/NETWORK_ARCHETYPES.md — the five network environments Ganglion is designed around (open warehouse, NAT'd office, enterprise DMZ, regulated facility, mobile/CGNAT).
- docs/CAPABILITY_AUTHOR_GUIDE.md — writing capabilities in Rust, C++, Python, or Go.
- docs/ZENOH.md — running Ganglion on
rmw_zenohfleets (it composes; Zenoh moves data, Ganglion adds reach + governance). - docs/OTA.md — pairing Ganglion with Mender / balena for OS/app updates (reach + tooling vs. OTA — a clean split).
- CONTRIBUTING.md — building from source and the test harness.
Ganglion is Apache-2.0, forever. The core substrate — reachability, relay, sandbox, signing, audit, the open registry — stays open permanently: no rug-pull, no relicense, and you can self-host the entire path with no vendor in your data loop. Run it, fork it, no strings. If it saves you a truck roll, sponsoring the den is a welcome thanks and keeps the open core moving.
When one engineer's setup becomes a fleet with auditors, SLAs, and many sites, that's where the open core ends and FleetLink begins — the enterprise layer built on this substrate: multi-tenant gateway, hosted/HA relay, SSO and RBAC, compliance reporting, and fleet-scale OTA, plus fixed-scope architecture reviews and implementations by the people who wrote Ganglion. Start at tafylabs.io/fleetlink or email bobby@tafy.ai.
Apache-2.0