Every model, prompt and policy that can touch a line carries a version, and the run record names the versions that produced it.
Changelog
Every release that can touch a line, written down.
Nothing has shipped to a plant yet. This is the release line the first design partners will see, in the order it is planned, plus the policy that governs how any release reaches a line.
Illustrative scenario: Plant run · skim-milk-powder line + set-yogurt line · shared intake. Not a measured run.
Releases
The planned release line
Status is honest: everything is queued. Order follows the first-release plan.
-
v0.1Connectors and shadow mode QUEUED
Connectors to the wedge line's PLC and SCADA, inline analyzers, lab system and MES. Read-only. Predictions logged against lab results; nothing written.
-
v0.2Review console and audit log QUEUED
The console where technologists and process engineers approve, correct and annotate; the immutable, assurance-grade food-safety audit log from day one.
-
v0.3Assist mode QUEUED
Recommendations for separation, pasteurization or drying moves with the evidence and citation behind each one; approvals and corrections become labeled training events.
-
v0.4Bounded autonomy QUEUED
Guarded writes to low-risk separation, drying and inspection loops inside explicit tag, rate and magnitude limits, after the food-safety and ROI gates.
-
v0.5Lactwin: recipe before the run QUEUED
Single-domain surrogate twin reconciled against real runs, pre-run recipe suggestions to one control agent, and a validated synthetic rare-fault set.
-
v0.6Second module in the plant QUEUED
An adjacent agent on the same plant with deeper integrations; SSO and role-based access; SOC 2 Type II in progress.
Policy
How a release reaches a line
Golden datasets and model-as-judge evaluations gate model and prompt changes in CI.
Nothing reaches a plant until its predictions have been compared to that plant's lab in shadow mode.
Rollback by model version; a Milkeon outage returns the plant to its existing control.
Run timeline
The reference scenario each release is tested against
Every Milkeon run is an ordered, inspectable sequence. This is run_scn_01, an illustrative scenario: Plant run · skim-milk-powder line + set-yogurt line · shared intake. Scenario complete · both streams inside spec · one human approval at the dryer.
run_scn_01
scenario · not measured
SUCCEEDED
-
01
intake.receive
SUCCEEDED
0.9 s
Plant Orchestrator · Pulled both product specs, the HACCP plan with its pasteurization critical control point, the antibiotic screen for the tanker lot and the standing CIP window from MES and the lab system; locked the target envelope for the run.
-
02
twin.simulate
SUCCEEDED
41 s
Plant Orchestrator · Simulated 24 candidate recipes across separation, pasteurization, evaporation and spray-drying on the Lactwin as-processed twin; ranked them on composition margin, pasteurization margin, energy per kilogram of powder and takt, and discarded every candidate that thinned the pasteurization margin.
-
03
separate.standardize
SUCCEEDED
3 m 05 s
Intake-and-Separate · Fused inline NIR and mid-IR with the latest lab calibration, then trimmed the cream-skim split and the standardization blend valve so skim solids and the yogurt-stream fat sat at target with the minimum safe margin rather than the usual over-standardization.
-
04
pasteurize.verify
SUCCEEDED
continuous
Pasteurize-and-Homogenize · Held HTST at or above 72 °C for 15 s through the holding tube with the flow-diversion valve armed; every critical control point reading was written to the audit log against the HACCP plan.
-
05
culture.vat
SUCCEEDED
4 h 20 m
Ferment-and-Culture · Predicted the acidification curve for the culture lot from inline pH and the upstream composition, held the vat temperature profile and timed the hold so pH landed on the set-yogurt target curve; no abnormal acidification was flagged.
-
06
dry.spray
SUCCEEDED
2 h 10 m
Evaporate-and-Dry · Ran the dryer against the twin's moisture and stickiness prediction; stepped inlet temperature and feed solids toward the minimum-energy setpoint while predicted outlet moisture stayed inside spec and fouling risk stayed low.
-
07
inspect.pack
SUCCEEDED
continuous
Defect-and-Inspect · 16 camera streams across the two packing lines at the plant edge: fill, seal, cap and label checks on every unit, foreign-body and contamination models on the powder stream; two rejects were attributed back to a seal-jaw temperature drift and the packing line was notified.
-
08
cip.schedule
SUCCEEDED
6 s
Hygiene-and-CIP · Placed the pasteurizer and dryer CIP into the cheapest energy window, sequenced wash phases against tank availability and set the release checks that must pass before the next product.
-
09
approve.human
APPROVAL
1 m 48 s
Plant Orchestrator · The twin's lowest-energy candidate wanted a dryer inlet temperature above the site's bounded envelope. Held for the shift dairy technologist, who approved the step with a tighter outlet-moisture alarm.
-
10
release.genealogy
SUCCEEDED
1 m 12 s
Quality-and-Conformance · Both batches released: composition, CCP records, culture lot and pH curve, drying setpoints, inspection rejects and every human decision written to the batch genealogy and checked against spec.
Tool calls
What the tool log will show per release
Every tool invocation, argument and result is written to an immutable, human-readable log, and every reasoning step is expandable. Nothing about a run is hidden from the plant. The log below is the scenario run, not a measured one.
- 05:10:02mes.read_order({ lot: "T-0417", products: ["SMP", "SET-YOG"] })
- 05:10:02ok specs locked · HACCP plan v7 · CCP: pasteurization 72 °C / 15 s
- 05:10:03lab.read_results({ lot: "T-0417", test: "antibiotic_screen" })
- 05:10:03ok negative · lot accepted for intake
- 05:10:04twin.simulate({ candidates: 24, horizon: "shift" })
- 05:10:45ok best recipe #9 · pasteurization margin held · lowest energy per kg
- 05:10:46policy.evaluate({ recipe: 9, stage: "bounded" })
- 05:10:46ok 7 writes permitted · 1 write requires human approval
- 05:10:47plc.write_setpoint({ tag: "SEP1.BLEND_VALVE", basis: "nir+midir+lab" })
- 05:13:52ok skim solids on target · yogurt-stream fat at minimum safe margin
- 05:13:53plc.verify_ccp({ tag: "PAST1.HOLD_TUBE", min: "72 °C / 15 s" })
- 05:13:53ok CCP verified · divert valve armed · readings → audit log
- 05:14:10dose.culture({ vat: "Y2", lot: "C-2291", profile: "set-yogurt" })
- 05:14:10ok acidification curve predicted · hold timed to target pH
- 05:14:12approval.request({ action: "dryer.inlet", reason: "above bounded envelope" })
- 05:16:00ok approved by the shift dairy technologist · tighter moisture alarm set
- 05:16:01plc.write_setpoint({ tag: "DRY1.INLET_T", mode: "min_energy" })
- 05:16:01ok predicted outlet moisture inside spec · fouling risk low
- 05:16:02vision.stream({ cameras: 16, models: ["fill_seal", "foreign_body"] })
- 05:41:18reject: seal fault · unit 1184 · attributed to seal-jaw temperature drift
- 05:41:19defect.attribute({ event: "seal_fault", cause: "pack_line.jaw_temp" })
- 05:41:19ok packing line notified · second reject at 05:43:02 · drift corrected
- 05:41:20cuopt.schedule({ assets: ["PAST1", "DRY1"], window: "energy_low" })
- 05:41:20ok CIP sequenced · release checks armed
- 09:36:40mes.release_batch({ batches: ["SMP-0417", "YOG-0417"], genealogy: "full" })
- 09:37:52ok both batches released · scenario complete
Reasoning trace
Goal, plan, thought, action, observation, exactly as the orchestrator would record it.
GoalReceive tanker lot T-0417, standardize it once, pasteurize onc…
Receive tanker lot T-0417, standardize it once, pasteurize once, and run a skim-milk-powder stream and a set-yogurt stream to spec with full genealogy.
PlanSimulate the whole recipe on the twin first. Lead with composi…
Simulate the whole recipe on the twin first. Lead with composition so the dryer gets the right solids and the vat gets the right fat. Verify the pasteurization critical control point continuously. Let the dryer chase minimum energy only inside the bounded envelope; hold anything beyond it for a human.
ThoughtThe standing recipe over-standardizes both streams to protect …
The standing recipe over-standardizes both streams to protect against lab-sample lag. With continuous NIR and mid-IR estimates the blend can sit at the minimum safe margin. The saving is composition give-away, not safety margin: the pasteurization CCP is never a candidate for optimization.
Actiontwin.simulate(candidates=24) → recipe #9: minimum safe composi…
twin.simulate(candidates=24) → recipe #9: minimum safe composition margin, pasteurization margin unchanged, lowest predicted energy per kilogram of powder.
ObservationRecipe #9's dryer inlet temperature sits above the site's boun…
Recipe #9's dryer inlet temperature sits above the site's bounded envelope. The policy engine routes that single write to the shift dairy technologist and permits the other seven.
ActionExecute recipe #9 at the bounded stage: separation and standar…
Execute recipe #9 at the bounded stage: separation and standardization writes, CCP verification, culture dosing and the vat profile proceed; the dryer inlet write waits.
ObservationApproval granted at 05:16:00 with a tighter outlet-moisture al…
Approval granted at 05:16:00 with a tighter outlet-moisture alarm. Two seal rejects on the yogurt packing line were attributed to seal-jaw temperature drift and corrected by the packing line.
OutcomeScenario complete. Both batches released with composition, CCP…
Scenario complete. Both batches released with composition, CCP records, culture lot, drying setpoints, inspection events and the human decision in the genealogy. No measured plant result is claimed; this is the run the platform is designed to execute.
Roadmap
What comes after the first release
From the roadmap, by horizon.
| Horizon | Planned |
|---|---|
| 0–6 months | Three to five design partners on the wedge workflow; MVP: connectors, agent loop, review console, audit log; accuracy and ROI proven in shadow then assist; SOC 2 Type I in progress |
| 6–12 months | Design partners convert to paid; bounded autonomy on low-risk loops; Lactwin hit-composition-before-run; second module per plant; SOC 2 Type II; SSO and RBAC; assurance packages |
| 1–3 years | The full intake-to-inspection loop; multi-site processors and groups; OEM and MES channels; benchmark data products |
| 3–10 years | The autonomous system of action for dairy processing, with adjacent scopes through packaging and cold chain |
Autonomy
Four stages, set per loop
A plant does not go from manual to bounded control in one step. Milkeon makes the stage explicit per loop, auditable and reversible at any time, and some decisions never leave the person.
| Stage | What the agent does | What the person does | When |
|---|---|---|---|
| Shadow | Predicts composition, contamination, moisture and takt; writes nothing | Runs the plant as today; compares predictions to lab results | First phase with every design partner |
| Assist | Recommends separation, pasteurization, culture and drying moves with the evidence | A dairy technologist or process engineer approves or corrects each one | After accuracy is proven against the baseline |
| Bounded | Writes low-risk separation, drying and inspection setpoints inside explicit limits | Approves anything above the limits; reviews the shift record | After the food-safety and ROI gates agreed up front |
| Exceptions | Escalates anything outside its envelope, CCP-adjacent moves and release decisions | Always decides these; the agent never does | Permanent |
Accelerated computing
Physical AI, at the plant edge
Milk is perishable and the lines are continuous, so perception has to be local and fast. Milkeon runs GPU inference at the plant edge and keeps training, simulation and optimization in the cloud, in a private cloud or on-prem. Items marked planned are on the roadmap, not running.
Edge perception
8 to 24 camera and inline-analyzer streams per line. Design target: 50 to 150 ms reject and alert decisions, 250 to 1,000 ms composition estimates, all at the plant edge.
Model serving
Defect, composition, shelf-life, process-state and dairy-reasoning models behind one orchestrator, with version routing by product, line and sensor package. Design target: 10 to 40 concurrent models per plant.
Training (planned)
Vision, spectral, time-series and dairy-reasoning models fine-tuned from labeled batch outcomes, operator corrections, lab results and validated deviations. Initial design target: 2k to 10k GPU-hours.
Digital twin (planned)
GPU-accelerated CFD and process simulation of separation, heat exchange, fermentation, evaporation and spray-drying, run as-processed before the batch to find safe, low-energy recipes.
Synthetic data (planned)
Rare contamination, foreign-body, fouling, seal, fill and drying-upset scenarios generated with domain randomization and always validated against real plant events before use.
Optimization
Product sequencing, tank allocation, dryer scheduling, CIP timing, energy and water constraints and line balancing, recomputed on the GPU when the plant is disrupted.
Robotic handling
Packaging, palletizing and material handling for product, packs and pallets, with perception and motion policies built in simulation before they touch the packing hall.
Guardrails
An agent that can move a setpoint needs a leash
Milkeon writes to production equipment in a food plant. Every capability is scoped, every write is policy-checked, every output is cited, and every action is written to an append-only audit log the plant owns.
- Bounded action space. Each agent can only write to an explicit tag allow-list, inside per-tag rate and magnitude limits, at the autonomy stage the plant has set.
- Critical control points are read, never written. Pasteurization time-temperature, flow diversion and release decisions stay with the HACCP plan and the people who own it.
- Policy engine before every write. Autonomy stage, interlock state, product, shift and operator presence are evaluated before a setpoint moves.
- Grounded and cited. Every recommendation carries a citation to the recipe, spec or procedure it relied on. Retrieval is tenant-isolated and permission-aware.
- Immutable audit log. Append-only, exportable and retained on the plant's own storage, aligned to HACCP, FSMA, ISO 22000 and FSSC record-keeping.
- Hard fallback. If the edge node, the network or a model stops, the plant keeps running on its existing PLC and SCADA control and interlocks.
- Tenant and IP isolation. Recipes, supplier data and tolerance models never cross a customer boundary. On-prem deployment available.
Assurance posture
| Item | Scope | Status |
|---|---|---|
| SOC 2 Type I | Cloud control plane | QUEUED Roadmap, first 6 months |
| SOC 2 Type II | Cloud control plane | QUEUED Roadmap, 6 to 12 months |
| HACCP · FSMA · ISO 22000 · FSSC · Codex | Grounding and record-keeping | RUNNING Design basis for retrieval and the audit log |
| Per-tenant isolation | Data, memory, models | RUNNING Design rule |
| On-prem deployment | Recipe-sensitive producers | RUNNING Design option |
Milkeon supports your food-safety records. It is not a certification and it does not replace your HACCP plan.
Integrations
It speaks plant, not cloud
Milkeon reads and writes through the systems already on the floor. No parallel historian, no new HMI, no rip-and-replace. Connectors are built against each design partner's stack first; long-tail integrations are out of scope for the first release.
PLC and SCADA of separators, pasteurizers, homogenizers, culture vats, evaporators, spray dryers and CIP skids
Setpoint reads, guarded writes, interlocks untouched
NIR and mid-IR composition, inline pH, moisture, temperature and humidity
Continuous composition and process state
LIMS results, calibrations, antibiotic and micro screens
Calibration and release evidence
Orders, recipes, product specs, batch genealogy
Targets in, release records out
Multi-camera stations on filling, sealing, capping, labeling and powder lines
Frames, defect events, reject commands
Plant and asset-level meters
Hard constraints for the dryer and CIP schedule
Isaac-driven packaging, palletizing and handling cells
Perception and motion for packs and pallets
SSO and role-based access; SOC 2 on the roadmap
Named approvers, scoped roles
FAQ
Straight answers
The questions plant directors, technologists and quality managers ask in the first meeting.
Only at the autonomy stage your plant has set, and only to an explicit allow-list of low-risk loops inside explicit limits. Every design partner starts in shadow mode, where Milkeon predicts and writes nothing. Assist mode follows, where a technologist approves each recommendation. Bounded autonomy on separation, drying and inspection loops comes after the food-safety and ROI gates agreed up front.
Critical control points are not optimization variables. The pasteurization CCP, the flow-diversion interlock and release decisions stay with your HACCP plan and your people. Milkeon verifies readings, writes them to an immutable audit log and attaches them to the batch genealogy. It supports HACCP, FSMA, ISO 22000 and FSSC records; it is not a certification and does not replace your plan.
Milkeon sits above your existing automation as a supervisory layer. If it stops, the plant keeps running on its current PLC and SCADA control and the interlocks it already has. A Milkeon outage degrades the plant to the way it runs today, not to a stop.
The first phase is shadow mode on one line: Milkeon reads your analyzers, PLC history, lab results and MES while you run the plant as usual, and we measure its predictions against your lab. Recommendations start when accuracy is proven against that baseline, and improve as plant-specific history and technologist corrections accumulate.
Recipes, product specs, tolerance models and supplier data are tenant-scoped and never used to train another customer's models. Retrieval is multi-tenant isolated and permission-aware. On-prem deployment is available for processors protecting sensitive recipes.
You are, the same as with any control strategy. That is why every write is policy-checked, bounded, logged and reversible, every output carries a citation to the recipe or procedure it relied on, and anything above your threshold waits for a named approver. The audit log records the request, the reasoning, the limits applied and the human decision.
As a design partner, on one line, with one hard metric: fat or protein give-away, energy per kilogram of powder, moisture or composition variance, or contamination escapes. We instrument the line in shadow mode, measure the baseline, move to assist mode when accuracy is proven, and expand only when the number holds.
Full multi-module autonomy across the whole plant, long-tail integrations beyond the design partners' stacks, and self-serve onboarding. The first release is one wedge workflow, its connectors, the agent loop with human checkpoints, the review console and the food-safety audit log.
Get started
Follow the release line
Design partners see each release before it reaches their line. Ask to be one.