A spacecraft mission lasts a decade. A nuclear power plant is licensed for sixty years. The Lunar Ark is designed to operate for ten centuries without sustained human contact. That gap — between every maintenance regime humans have ever built and what the Codex requires — is what forces the architecture to lean hard on autonomous swarm robotics. Not as a convenience. As a structural necessity.
Why a swarm, not a single robot
The L1-ROB decomposition rejects the single-monolithic-robot approach early. One robot is one failure point. Once it fails, the system has no hands. A swarm — heterogeneous, specialized, and individually cheaper-to-replace than to repair — distributes the failure surface across many units. The Codex specifies four robot classes: inspection (L2-ROB-INSP), repair manipulators (L2-ROB-REPR), logistics movers (L2-ROB-LOGI), and on-station fixed manipulator arms (L2-ROB-MANIP). Each class has cohorts in the tens. Losing 30% of any class still leaves a functional fleet.
The closed loop: detect, decide, fix
The autonomy stack is built around a four-stage loop. L1-SSM and L1-MMD sensors continuously monitor the structure. L1-CDH fuses the sensor stream and runs anomaly detection on it (L3-SLF-FDI-ANOM, L3-SLF-FDI-BAYES). L1-MNT's predictive engine scores each anomaly against its remaining-useful-life model (L3-MNT-PRED-ML), deciding whether to repair now, schedule for the next maintenance window, or escalate. L1-SLF then plans the actual repair task (L3-SLF-EXEC-PLAN) and dispatches the appropriate robot cohort.
"Multi-robot consensus algorithms achieve 99.99% task-completion reliability when individual robot reliability is only 95%, given a swarm of 10+ units with independent failure modes."
— Synthesized from NASA Ames swarm robotics studies and ESA REMORA program reports.
SLAM, but for centuries
Robots that navigate the Ark interior use the same SLAM (Simultaneous Localization And Mapping) algorithms that Mars rovers and warehouse AGVs use today (L3-ROB-NAV-SLAM, L3-NAV-LOC-SLAM). The Codex extends them with one critical detail: the map drifts, and the robots know it. Over a hundred years, thermal cycling slightly deforms the structure; regolith dust accumulates on landmarks; LED lighting fades. The L3-NAV-MAP-UPDATE protocol has every robot continuously contribute corrections to a shared map, so the navigation infrastructure stays calibrated even as the physical reference frame slowly mutates.
When the swarm can't fix it
Some failures exceed the swarm's repair authority. A breach in a pressure vessel weld. A degraded RTG that must be reconfigured. A novel software fault. For these, the Codex specifies a tiered fallback (L3-SLF-DEGR-LEVEL): the system reconfigures into a degraded mode (L3-SLF-DEGR-MIN) that preserves the preservation function while sacrificing non-critical capabilities, and broadcasts a diagnostic packet via L1-COM's laser link. The broadcast doesn't expect a reply — it's addressed to whoever might be listening, then or later, with the technical context to act on it.
This is the philosophical core of swarm autonomy: the Ark is not just preserving the seed of Earth. It is, in a smaller way, demonstrating that a system can be designed to outlast its designers — to keep working long after no human remembers why. Every closed loop in the swarm autonomy stack is a refusal to require us to be there to keep things alive.