The edge gateway
It fuses several devices into one picture of a person, evaluates the rule graph, and owns the approval queue. That last part is the important one: approvals still work when the site is offline.
Every sample keeps its clock
Devices are time-disciplined against the gateway, so a fused event carries a defensible ordering.
One person, not four feeds
Signals from patch, band and ring are reconciled into a single state with a confidence attached.
The graph, not a script
Rules compile to a DAG. Evaluation is bounded, deterministic and replayable.
Queue the proposal
The gate lives here, which is why an outage never means a lost decision.
Store and forward
Signal and decisions are buffered locally and reconciled in order when a link returns. The ledger never has a hole in it.
Mutual authentication
Every workload holds an identity issued by SPIFFE/SPIRE, and every hop runs over mutual TLS. There is no anonymous participant.
Survives a power cut
The approval queue is write-ahead logged. A gateway that loses power mid-decision comes back holding the same proposal.
Start with one ward, one shift, or one squad
A pilot runs four to sixteen weeks depending on deployment model. You bring the population and the responders. We bring devices, gateways and the first set of rules, and we measure override rate and time-to-answer from day one.