Three checks. One named device. A verdict you can produce two years later.

No model, release or connector reaches a device until it has been tested against that specific device. Identity, fit and reach are verified before install — and the evidence outlives the deployment.

  • Tested against the exact device
  • A fail never reaches the edge
  • Verdict kept and reproducible

Borrowed from conservation science, not from DevOps.

In 1973 British Museum conservation scientist Andrew Oddy published a test that exposed silver, copper and lead coupons to a candidate material before that material was allowed anywhere near an irreplaceable object. After 28 days the coupons were inspected. The verdict was one of three: rejected, temporary, or permanent.

The insight is that you do not test the object — you test the thing you are about to introduce, under the conditions it will actually meet. We apply the same discipline to software reaching industrial hardware. A model is a candidate material. Your PLC-connected line is the irreplaceable object.

Rejected
Fails a coupon. Never receives an edge directive; stays quarantined in the control plane.
Temporary
Passes, but admitted to a time-boxed slot — a pilot, a trial model, an unproven publisher.
Permanent
Passes and may install to a persistent versioned slot until superseded or revoked.

The three coupons

Coupon 01

Identity

Publisher, version and SHA-256 digest must match the signed manifest. An unsigned or unmanifested build fails here and goes no further.

  • Signature chain verified to a known publisher
  • Digest matches the artifact byte for byte
  • Version is declared, not inferred
Coupon 02

Fit

Memory, runtime and accelerator requirements must sit inside the measured envelope of the named device — not a device class, and not a datasheet figure.

  • Resident memory below the device headroom
  • Runtime and quantization supported by that silicon
  • Thermal and power budget respected
Coupon 03

Reach

What the candidate is permitted to touch, and what you granted it on that device. A candidate that asks for more than the grant fails regardless of how well it performs — and a grant it never requested is never issued.

  • Requested reach matches the grant on that device
  • Write paths are named tags, not blanket access
  • No shell or arbitrary process execution
  • Network egress limited to declared endpoints

Declare, test, admit, keep.

  1. 01
    Declare

    A candidate arrives with its publisher, version, digest, intended role, requested reach and target device.

  2. 02
    Test

    Three coupons run against the specific device the candidate wants to reach — not a representative one.

  3. 03
    Admit

    A pass may install to a versioned slot. A fail never receives an edge directive.

  4. 04
    Keep

    Evidence and verdict stay on record, so you can answer what ran, on what, and why.

“What was running on that line in March?”

That question arrives after an incident, during a customer audit, or from a regulator. Without an admission record the honest answer is a reconstruction from deployment logs and memory.

An Oddy record answers it directly: which artifact, which digest, on which device, admitted when, under what reach, by whose signature.

See a candidate get tested.

Bring a model you are considering and the device you want it on. The free audit runs the three coupons against that pairing and returns the record it produces.