Everything a machine needs to sense a room and face the people in it.

A robot that operates around people needs a camera, a microphone, a speaker, a display, an inertial sensor, a satellite fix, a light sensor, a network radio and enough compute to run machine learning on all of it. Bought separately, that is a parts list, a wiring loom and a month of integration.

It is also a phone. So Kilo's head is a phone, bolted to the chassis and running one purpose-built application.

The interesting consequence is not the saving. It is that the phone is a genuinely capable computer in its own right, which means the work that touches a person — hearing them, recognizing them, answering them — can happen on the head rather than in a data center.

The head is a sensor and interface bridge before it is a face. Everything the phone can perceive is published to a backend; everything the backend wants to say comes back the other way.

The eyes are not an avatar or a stock animation. They are drawn from first principles every frame — pupil color, lid closure, pupil scale, and four separate brow parameters that carry most of the expression. Fifteen states, from idle through focused, happy, worried and asleep.

Three details are the difference between a face and a graphic:

• It knows which way is up. The display is fixed to the chassis, so the face counter-rotates against gravity — the brows point up whichever way the phone is mounted, or whichever way the truck is leaning.
• The gaze is real. The eyes track the nearest face and follow it, smoothed so they settle rather than twitch, and rotated to stay directionally correct after the face itself has rotated.
• It is alive between actions. A two-phase blink, a per-frame micro-jitter, weighted pupil easing, and an eyelid flutter while Kilo is speaking. There is no mouth — deliberately. Eyes carry it.

A single tap locks the rotation where it is, for a fixed mount where counter-rotating while driving would look wrong.

Say “Kilo” and the robot answers. The wake word runs on the phone, against a model small enough to sit in the application, and it is tolerant of the ways people actually say the name rather than the one way a dictionary does.

Speech recognition and speech synthesis are on the device too. Kilo hears you, understands you and answers out loud with no network connection of any kind — which matters for a machine that is expected to work in a workshop, a field or a basement.

Kilo recognizes people. The faceprints never leave the phone, and no face is ever stored without the person saying yes out loud.

Face recognition on a robot is the point where a capability becomes a question about consent, so it was built as a consent system that happens to do recognition rather than the other way round.

• A new face is never stored silently. The head is mounted on a truck and has no keyboard, so Kilo asks, out loud, and takes the answer by voice.
• A refusal is remembered as a refusal. Say no and that face is recorded as declined, so you are never asked twice.
• Nothing is uploaded. The store lives in the application's own storage on the phone. There is no server copy, because there is no server.
• People age out. An ordinary entry expires after ninety days without being seen. An entry can be pinned so it never expires, or blocked so it is never kept.
• It will not interrogate a room. Kilo greets people it already knows passively, but only offers to remember a stranger when someone is actually engaging with it — a tap, the wake word, or a few seconds of sustained eye contact.

One more detail worth the paragraph, because it is the same discipline that runs through the rest of the robot: a face scoring just under the recognition threshold is held quietly rather than treated as a stranger. Without that, a face flickering across the line produces the worst possible behavior — greeting someone by name and then asking who they are.

Most of the work in making a machine pleasant to be near is not capability. It is restraint.

The head can also hold an open conversation through a general language model, local or hosted. Questions about the robot's own state never go there — those are answered from the machine.

The phone and the robot talk constantly. The head publishes a heartbeat several times a second, plus its orientation, its position and its light reading; the robot publishes its safety state, its control state and its mood back. Below a certain heartbeat rate the robot locks itself out — a head that has stopped talking is not a head that is fine.

Three things about that link are worth stating because they are the same fail-closed instinct the rest of Kilo is built on:

• Absence reads as absence. If the phone's motion sensor has not produced a reading yet, the head publishes nothing at all rather than publishing zeroes. Zeroes look exactly like a perfectly level, perfectly still vehicle — which is the most dangerous thing a robot can wrongly believe.
• Dropping the connection is not the same as closing it. If the phone disappears ungracefully the broker announces it on the phone's behalf and the robot runs its failsafe. A deliberate disconnect says so, and the failsafe does not fire.
• It finds the robot without being told. Cable first, then the local network, then a hotspot, then a remembered address. A supervisor keeps the link alive across network changes with nobody touching anything.

And a small one that people always like: the phone's ambient light sensor drives the robot's actual headlights. Walk it into a dark garage and the lights come on by themselves.

Kilo is one small truck. The head is a general answer to a problem every machine that works near people has: how does it see, hear, speak and be understood, without becoming a surveillance device?

The pieces that carry over are the consent-gated recognition store, the on-device voice stack, the readable face, and the fail-closed link to a machine that will not act on what it merely thinks it heard. None of them is specific to a rock crawler.

Stated plainly: it was built as one application, running on one handset, on one robot. It is now available for testing on other handsets — early, and by request — but it has not been published to any store and is not installed at scale anywhere.

The head application is available for testing. It is very early in development, and it was written for one robot — which is exactly why we want it on hardware we did not choose.

What it is for. This is the part of a machine that deals with people. Every machine that works near humans has the same problem — how does it see them, hear them, answer them and be understood, without turning into a surveillance device? The head is our answer to that, and none of it is specific to a rock crawler.

Which is why the most useful thing you can tell us is not technical. Install it, let it look at you, say its name, let it ask your name. Then tell us how that felt. Reassuring or unsettling? Did asking permission out loud read as respectful or as an interrogation? Would you leave it running in a room with your family in it? We have only ever watched people meet it while standing next to the person who built it, which is the one condition under which that reaction cannot be trusted.

What you can see without a robot. The face and its fifteen expressions, the counter-rotation against gravity, the wake word running offline against a model small enough to sit in the application, the full-vocabulary recognizer behind it, and the consent prompt that asks out loud before any face is remembered. None of that needs a chassis attached.

What you cannot. Anything that depends on the robot being there — the heartbeat link, the safety lockout, the mood channel, the headlights driven by the ambient light sensor. Without a chassis the head is a face and a voice, not half a robot.

What “very early” means here. No automated test suite. No crash reporting. No store listing, and no installer polish. It has run on essentially one handset for its whole life, so the first thing an unfamiliar phone is likely to find is that we assumed something about the screen, the sensors or the Android version that is not true of yours. That is the finding we want.

If recognition is jumpy on your phone before you conclude it is broken: match strictness is a slider in the app, 0.40 to 0.85, defaulting to 0.62. Front sensors vary enough between handsets that the right value is not the same everywhere, and where your phone lands is a data point we do not have.

Builds are handed over individually rather than published. Ask, and say what phone you would put it on — the model matters more than anything else you could tell us right now.