# Meshanics Docs > Zero-trust over-the-air updates and fleet management for industrial and edge-AI devices. Every payload - container, ML model or configuration - is signed at the source, verified on the device, applied atomically, and rolled back automatically if a health check fails; every action is recorded as append-only, hash-chained evidence. This is a curated index of the Meshanics documentation for language models and agents. Every page below links to its raw Markdown. The full text of the entire documentation set, concatenated into one file, is at https://docs.meshanics.com/llms-full.txt. ## Platform > What Meshanics is and how the pieces fit together. - [Overview](https://docs.meshanics.com/platform/overview.md): What Meshanics is: zero-trust OTA updates and fleet management for industrial and edge-AI devices. - [How it works](https://docs.meshanics.com/platform/how-it-works.md): The signed, A/B base layer and how your application and model code ride on top of it. ## Core concepts > The model behind signed, rollback-safe delivery. - [Zero-trust model](https://docs.meshanics.com/concepts/zero-trust.md): The trust boundaries: mutual TLS everywhere, no unsigned path, per-fleet trust domains. - [The Update Framework](https://docs.meshanics.com/concepts/tuf.md): Role separation, offline roots, and freeze-attack protection for update metadata. - [Device identity](https://docs.meshanics.com/concepts/device-identity.md): Per-device X.509 over mutual TLS, with the private key generated on-device and never shared. ## Getting started > From a factory-fresh device to a verified model swap. - [Enroll a device](https://docs.meshanics.com/getting-started/enroll-a-device.md): Onboard a factory-fresh device into the fleet with a single command. - [Push a model bundle](https://docs.meshanics.com/getting-started/push-a-model.md): Sign a model artifact and roll it out to a device with a canary and automatic rollback. ## Device agent > Install, configure, run, upgrade and harden the on-device agent. - [Overview & design](https://docs.meshanics.com/agent/overview.md): What the device agent is, what it does on each device, and why it is small, static, and verification-first. - [Install](https://docs.meshanics.com/agent/install.md): How to install the device agent as a hardened systemd service, online or air-gapped. - [Configuration](https://docs.meshanics.com/agent/configuration.md): The flags and environment variables that configure the device agent, and the safe defaults behind them. - [Runtimes: container & standalone](https://docs.meshanics.com/agent/runtimes.md): How the agent applies container, model, and configuration payloads - with or without a container runtime. - [Upgrading & hardening](https://docs.meshanics.com/agent/upgrading-and-hardening.md): How to upgrade the agent, the systemd hardening it runs under, and how it cleans up on decommission. - [MCU install (Zephyr SDK)](https://docs.meshanics.com/agent/mcu-install.md): Add secure over-the-air updates, fleet identity, and automatic rollback to an ESP32-S3 or other Zephyr-based microcontroller — without writing the update machinery. ## Fleet & groups > How devices join, get grouped, are targeted, and stay isolated. - [Devices & lifecycle](https://docs.meshanics.com/fleet/devices.md): How a device joins the fleet, reports what it is, stays live through heartbeats, and is retired - all keyed to a cryptographic identity it cannot fake. - [Static & dynamic groups](https://docs.meshanics.com/fleet/groups.md): Groups are how you point a rollout at a set of devices - named static groups today, with selector-driven dynamic groups on the roadmap. - [Capability selectors](https://docs.meshanics.com/fleet/capability-selectors.md): The device facts - hardware profile and tags - that describe what a device can run, and how they are meant to drive targeting across a heterogeneous fleet. - [Isolation & support access](https://docs.meshanics.com/fleet/tenancy.md): Your environment is isolated and yours alone, and you control whether and when support can operate in it. ## Artifacts & bundles > Signing, registry connections, artifact kinds and bundle compatibility. - [Artifact kinds](https://docs.meshanics.com/artifacts/kinds.md): The kinds of update payload the platform signs and ships - models, containers, and configuration - and what each carries. - [Registry connections](https://docs.meshanics.com/artifacts/registries.md): Connect the container registries you already use, browse their tags, and pin images as signed artifacts - without handing credentials to devices. - [Publishing & signing](https://docs.meshanics.com/artifacts/publishing.md): How an artifact becomes a signed, shippable target - and why there is no unsigned path through the platform. - [Build provenance](https://docs.meshanics.com/artifacts/provenance.md): Tell your fleet who built an artifact and from where - declared from your pipeline, or cryptographically verified from a signed attestation. - [Bundles & compatibility](https://docs.meshanics.com/artifacts/bundles.md): How artifacts carry compatibility metadata so the right payload reaches the right hardware - and where bundle-level grouping is heading. ## Rollouts > How a signed artifact becomes a fleet-wide change - waves, canary, halt, abort. - [Rollout model](https://docs.meshanics.com/rollouts/model.md): The pieces of a rollout - artifact, target group, health probe, strategy - and the device states it moves through. - [Waves & canary](https://docs.meshanics.com/rollouts/waves-and-canary.md): How a rollout widens in waves - from a small canary to the whole group - with automatic and manual gates. - [Halt rules & abort policy](https://docs.meshanics.com/rollouts/halt-and-abort.md): How a rollout stops itself when failures cross a threshold, and how an operator aborts with the option to revert. - [Pre-flight & compatibility](https://docs.meshanics.com/rollouts/pre-flight.md): The checks that run before a rollout reaches your fleet, starting with the vulnerability admission gate. ## AI/ML model OTA > Package, deploy, canary and test ML models as signed, hardware-matched artifacts. - [Model packaging](https://docs.meshanics.com/ai-ml/packaging.md): How a model becomes a signed, self-describing artifact the platform can match to hardware and roll out safely. - [Runtime, model destination & eval](https://docs.meshanics.com/ai-ml/runtime-and-eval.md): Package a model runtime, place the model where the runtime reads it, ship a golden set, and quality-gate an atomic model+runtime rollout. - [Deploying a model](https://docs.meshanics.com/ai-ml/deploying.md): Roll a signed model to a fleet with a health probe, canary waves, halt rules, and automatic rollback. - [Experiments & promotion](https://docs.meshanics.com/ai-ml/experiments.md): How canary cohorts and channels let you compare a candidate model against production before promoting fleet-wide. - [Shadow testing](https://docs.meshanics.com/ai-ml/shadow-testing.md): Pre-flight a candidate bundle on emulated and lab devices, with on-device shadow evaluation as a planned direction. ## Health probes & rollback > How the agent health-checks every update and auto-reverts on failure. - [Rollback safety](https://docs.meshanics.com/rollback/safety.md): How the device agent keeps the previous version recoverable so a bad update never strands a device. - [Defining health probes](https://docs.meshanics.com/rollback/probes.md): The three health-probe types the agent runs after a swap, and how to configure them safely. ## CRA & compliance > SBOMs, vulnerability watch, deadline-tracked incidents and signed reports from recorded activity. - [CRA overview & timeline](https://docs.meshanics.com/compliance/cra-overview.md): How Meshanics assembles evidence for the EU Cyber Resilience Act from your fleet's recorded activity. - [SBOM & vulnerabilities](https://docs.meshanics.com/compliance/sbom-and-vulnerabilities.md): Attach a software bill of materials per artifact, then watch for new vulnerabilities across your fleet. - [Incident reporting](https://docs.meshanics.com/compliance/incident-reporting.md): Deadline-tracked incident handling that records each CRA reporting step against the regulation's clocks. - [Evidence & reports](https://docs.meshanics.com/compliance/evidence-and-reports.md): The signed audit-log export, the framework readiness report, and the vulnerability report - all computed from recorded activity. ## Configuration delivery > Ship config as signed artifacts that place a file and reload within an allowlist. - [Delivery profiles](https://docs.meshanics.com/config/delivery-profiles.md): How a configuration file becomes a signed artifact that declares where it lands on the device and what to reload. - [Place-file & reload](https://docs.meshanics.com/config/place-file-and-reload.md): How the device agent applies a signed config file at a declared path, reloads within an allowlist, and rolls back on a failed probe. ## Air-gap & on-prem > Run on one node, fully offline behind an air gap, or for restricted networks. - [Single-node deployment](https://docs.meshanics.com/air-gap/single-node.md): Run the entire Meshanics control plane on one Linux box, with no cloud dependency in the core path. - [Offline & air-gapped operation](https://docs.meshanics.com/air-gap/offline.md): Operate a complete trust domain with no internet path, keeping signing roots offline and provisioning devices from media. - [Relay for restricted networks](https://docs.meshanics.com/air-gap/relay.md): How devices behind NAT and tight egress reach the control plane: the outbound-only model and the site gateway. ## Integrations > Outbound event push and registry backends - signed, metadata-only. - [Outbound integrations](https://docs.meshanics.com/integrations/overview.md): How Meshanics pushes signed, metadata-only events and connects to your container registries - without ever exporting your payloads. - [Webhooks](https://docs.meshanics.com/integrations/webhooks.md): Signed, replay-protected webhook deliveries that carry platform event metadata to an endpoint you control. - [Registry backends](https://docs.meshanics.com/integrations/registry-backends.md): Connect the container and artifact registries you already run, with short-lived cloud credentials and a digest-only pull-through facade. ## Security & trust > Everything is signed - and here is how to see it for yourself. - [Security model](https://docs.meshanics.com/security/overview.md): The security properties that are true in the code today, each in one sentence. - [PKI & CA strategy](https://docs.meshanics.com/security/pki-ca-strategy.md): Your own certificate authority with offline roots - no per-CA cloud PKI tax. Bring your own CA or use ours. - [Trust Center](https://docs.meshanics.com/security/trust-center.md): The console view that shows the cryptographic material we sign with, read live from the running system. - [Summary of crypto keys](https://docs.meshanics.com/security/summary-of-crypto-keys.md): Every key the platform uses: what it is for, where it lives, and who holds it. - [Verify our claims](https://docs.meshanics.com/security/verify-our-claims.md): How to check the platform's trust claims yourself - the audit export signature, the live trust material, and the update anchor. ## API reference > The operator REST API, the device gRPC service, and shared conventions. - [REST API overview](https://docs.meshanics.com/api/rest-overview.md): The operator-facing REST API: how to authenticate, what it covers, and where to start. - [Device gRPC API](https://docs.meshanics.com/api/device-grpc.md): The mTLS-only gRPC service the on-device agent uses to register, heartbeat, and report update status. - [Errors & pagination](https://docs.meshanics.com/api/errors-and-pagination.md): Status codes, error shape, and the pagination and filtering conventions shared across REST list endpoints. ## Operations & runbooks > Deploy, upgrade, back up and operate a node, with runbooks and troubleshooting. - [Deployment & upgrade](https://docs.meshanics.com/operations/deployment.md): Stand up the Meshanics control plane on a single node, and upgrade it safely in place. - [Backup & restore](https://docs.meshanics.com/operations/backup-and-restore.md): What to back up on a Meshanics node, why it matters, and how to restore it. - [Runbooks](https://docs.meshanics.com/operations/runbooks.md): Step-by-step procedures for the operations you run most: pausing a rollout, rotating credentials, and recovering a device. - [Troubleshooting](https://docs.meshanics.com/operations/troubleshooting.md): Diagnose the most common issues - enrollment, connectivity, verification, and stalled rollouts.