Physical AI System Design for Wafer Defect Inspection in the United States

Ontologies for Semiconductor Defect Classification Decide Yield

A drifting etch chamber prints its ring signature on wafer maps long before any single system can name the chamber, the lots it touched or the hold that should follow.

The abstract promised a physical AI system design with defect images classified at the tool, one governed model of the fab, and three named agents that draft while engineers decide. This chapter states the question behind that promise, the documented cost of leaving it unanswered, and the operation the design is written for.

1.1  The Question, the Data and the Regimes

Ontologies for semiconductor defect classification exist to answer one operational question: when a wafer map signature crosses a control limit, which chamber is drifting, which lots has it touched since onset, and what hold and disposition should follow. Ontologies for semiconductor defect classification answer it by joining evidence the fab already holds, because the question spans five systems at once: review images from the optical inspection and electron microscope tools, wafer maps and signatures from the yield management system, chamber sensor traces from the equipment data collection system, control limits from the statistical process control system, and lot genealogy from the manufacturing execution system. The proving fault is precise: one etch chamber drifting and printing a ring signature on wafer maps, a pattern the fab sees only after wafers have already carried it into later steps.

The answer must satisfy more than engineering. As a United States operator, the fab works under export control law, where deemed export of fab technology and semiconductor manufacturing end-use controls make even the nationality of a supporting engineer a compliance fact, and under the sector's own tool-network cybersecurity and equipment communications standards, which govern how any unit is onboarded to the tool network. Because the system advises decisions that touch product and safety, the functional-safety treatment of AI systems (ISO 2024) and the consensus finding that machine learning already runs across safety-critical applications (Nationalacademies 2025) set the frame for how much autonomy is granted; where visual inspection AI serves regulated markets, its risk classification is settled by rules of the kind the EU AI Act service desk and a 2025 compliance-pathways study describe (Europa n.d.; KB 2025).

1.2  The Documented Cost of the Problem

The sector's record shows what failure costs. The U.S. Chemical Safety and Hazard Investigation Board investigated an equipment fracture and fatal hydrogen chloride release at a polysilicon producer in the semiconductor supply chain (CSB 2020), and state regulators cited a major fab for a safety violation after a man died on the job (ABC15 2024); both document that equipment and process failures in this industry carry human consequences, not only yield consequences. The yield cost is quieter and compounds hourly: between excursion onset and hold, a drifting chamber keeps printing on every wafer that passes through it. That is why the design's headline measure is the time from excursion onset to hold, with a nominal of four hours, breached above it, measured against etch chamber drift printing a ring signature.

1.3  The Operation as a Scenario

The operator is a high volume wafer fab in the United States, and phase one is confined to a single etch module. Three roles hold the decisions, each by name: the defect review engineer confirms defect classes on review images; the yield engineer approves holds when a wafer map signature crosses a control limit; the process owner disposes of held lots as release, rework or scrap. The physical environments are cleanroom bays housing the etch, inspection and review tools, review stations where engineers read images, and an on-site server room on the fab's segmented tool network where the reasoning model runs on the operator's own hardware, with no third party model service anywhere. The counts are five named source systems, three named roles, one process module and one fab site, joined through one integration adapter family into one governed object model.

Every Fab System Sees One Slice of the Wafer

The manufacturing execution, yield management, defect, equipment data collection and statistical process control systems each hold one true slice of the argument, and none of them can join the slices without an engineer in the middle.

Chapter 1 stated the question and the scenario. This chapter shows why no single existing system can answer it, by walking through what each of the five holds and what it cannot see.

2.1  What Each System Sees

The manufacturing execution system is the system of record for lots, routes, recipes, tool states and holds, and every trace the design builds ends in a lot and a hold here; it knows a lot is stopped, but it holds no defect image, no wafer map signature and no chamber telemetry, so it cannot say why anything stopped. The yield management system holds the wafer maps, the signatures and the excursion records, which makes it both the trigger the excursion agent listens to and the evidence store a trace reads from; it cannot reach back through process steps to a chamber's running hours since its last maintenance. The inspection tools' own defect databases produce the defect candidates and review images the edge units classify, fresh evidence from the fab floor, yet around each image they hold neither the route the wafer traveled nor the limits a signature must cross to become an excursion. The equipment data collection system carries the chamber sensor telemetry and fault detection traces in which drift announces itself first, but on its own a precursor cannot be tied to a lot, a wafer map or an image. The statistical process control system holds the control limits a wafer map signature crossing triggers on and raises the flag faithfully; it cannot trace the flag to a chamber, name the lots at risk or draft the hold that follows.

2.2  What None of Them See Together

What none of them see together is the argument itself: one chamber drifting, the lots it processed since onset, the ring signature those lots now carry, the review images that show it, and the hold that should follow, in one joined view. Figure 2 sets the five slices side by side and converges on that question. The cost in practice is the engineer in the middle, because a yield engineer assembles the join by hand across five systems while material keeps moving through the drifting chamber; the design measures that assembly as time from excursion onset to hold, against a nominal of four hours, with the fault being etch chamber drift printing a ring signature.

Sovereignty and the Tools-First Rule Shape Everything

Open weights on operator owned hardware inside the fab, tools read but never commanded, memory instead of training, and export control screening of every supporting engineer together fix the shape of every layer downstream.

The join failure is structural, so the constraints on any fix are structural too. This chapter states the four goals that shape every layer downstream, then the scoping they force.

3.1  Open Weights on Hardware the Operator Owns

The first goal is sovereignty: reasoning runs on GLM 5.3 open weights, self hosted inside the fab on hardware the operator owns, with no third party model service and no data leaving the boundary. This is hard in semiconductors because the fab's own data is controlled technology, which makes any external model path a compliance event rather than a procurement choice. The named model's 753 billion parameters served at FP8 need a full node of the 141 GB HBM GPU class, eight GPUs per node, to themselves; no language model is served at the tool, where the edge units' anomaly classifier runs on the on-device stack's own runtime.

3.2  Tools First: Read, Never Command

The second goal is the tools-first rule: the design reads from the tool databases and never commands a tool. This is hard because fab integration is contractual and tool by tool, negotiated over SECS/GEM, GEM300 and EDA according to which revisions each etch-module tool implements, and because a certified tool's state is safety-relevant. The rule runs through everything downstream: the gate for any hold is the manufacturing execution system interface, never an agent, and a hold placed or released without a recorded named approval is refused in code and audited per hold.

3.3  Memory Instead of Training

The third goal is memory instead of training: every confirmed class and every root cause becomes memory the next decision reads, and nothing is trained into weights. This is hard because the sector default is a classifier trained on labelled images, which locks the estate to one defect mix and becomes a standing retraining burden as that mix shifts. Improvement compounds in the record rather than in the weights, and any future trained classifier would be a different architecture, stated plainly.

3.4  Every Supporting Engineer Screened

The fourth goal is export control over people: access to fab technology by a supporting engineer who is a non-US person can be a deemed export under section 734.13, so every supporting engineer is screened before access is granted and the check is carried as a named approval. This is hard in an industry where the relevant expertise is global and the technology is controlled precisely because of what it makes; it is also the constraint most easily missed, because it binds the support team rather than the software.

3.5  Scoping Decisions

These goals force scope, and Table 1 records the three decisions that buy the phase one gate. Published examples of physical AI system design that travel across sectors trade fab specific keys for reusability, so this design scopes its model to the fab's own sixteen objects and proves the joins on one real week of production data before phase one is judged, recording where the truth actually lives in each source.

3.6  What the Design Chose Against

Table 2 records what was picked, what each pick displaced and why, ending with the boundary that stays out of scope.

One Stack Runs From Records to Surfaces

Systems of record sit below untouched, one governed object model sits in the middle as a projection over them, and the edge tier, the agents and the work surfaces sit above, each with a named responsibility.

Chapter 3 set the four constraints and recorded what the design chose against. This chapter turns those constraints into a stack: one fixed order of layers, from the fab's systems of record up to the surfaces where engineers decide.

4.1  The Pattern and Why It Fits This Fab

The architecture is a projection, not a replacement. The fab's systems of record sit below, untouched: never replaced, never modified, never loaded, because fab integration is contractual and tool by tool over SECS/GEM, GEM300 and EDA interfaces, and because onboarding anything onto the tool network is governed by SEMI E187 and E188 network security standards. One governed object model sits in the middle, a projection over those systems that joins their records without copying their truth. Above it sit the edge units at the inspection and review tools, the three named agents, and the five work surfaces where the defect review engineer, the yield engineer and the process owner decide.

This order fits because the fab's hardest integration fact is that its records cannot be touched, and its hardest quality fact is that every decision must resolve to a lot, a tool and a named person. A projection answers both: the systems of record keep every fact, the object model keeps the joins, and the layers above only read and draft. Machine learning is already running across nearly every industrial sector, including safety critical ones (Nationalacademies 2025), but it only helps here if it sits over records that stay authoritative. Figure 3 shows the layered stack with its counts: eight sources, one adapter family, sixteen objects, seven services and five surfaces.

4.2  The Stack Stage by Stage

Table 3 walks the stack from the sources to the surfaces, naming the component responsible at each stage. The stage boundaries are also trust boundaries: everything below the adapter tier belongs to the fab's own systems, and everything above reads only through the backbone.

Table 7, printed with this chapter, carries the same stack layer by layer with the component, the choice and the reason for each row.

4.3  A Reusable Pattern

The shape a team can carry to any similar brief is the projection stack: sources of record untouched below, one governed object model projected over them in the middle, sensing and drafting agents above, and a named human as every gate. What a team swaps is the vocabulary and the doors: the sixteen objects become their own nouns, the SECS/GEM, GEM300 and EDA interfaces become whatever their sector's systems speak, and the FDC traces become their own telemetry. What they keep is the grammar: nouns become objects, facts become properties, relationships become typed links, and no agent writes to a system of record without a recorded approval.

Sixteen Objects Turn Fab Data Into One Argument

Sixteen objects and their typed links let one query walk from a defect image to a wafer, a lot, a tool, a chamber and a hold, a walk no document store and no single system of record can make.

Chapter 4 fixed the layers and named the stack's components. This chapter opens the middle layer: the sixteen objects, their typed links, and the single walk that turns a defect image into an argument about a chamber, a lot and a hold.

5.1  Sixteen Objects and the Links Between Them

The object model holds sixteen objects in six kinds: the materials wafer and lot; the events process step, inspection run, defect and excursion; the assets tool and chamber; the records recipe, hold and corrective action; the measure wafer map signature; and the record defect class, alongside the three actors defect review engineer, yield engineer and process owner. Each is anchored in the system of record that owns its truth: the wafer, lot, process step, tool, recipe and hold in the manufacturing execution system; the chamber in the equipment data collection system; the inspection run and defect in the inspection tools' own defect databases; the defect class, wafer map signature, excursion and corrective action in the yield management system. Figure 4 draws every object and its typed links, with the wafer in navy as the object the most links reach.

The links are what a document store cannot hold. One query can start at a defect image classified as a pattern defect, walk to the wafer it was found on, to the wafer map signature carrying a ring pattern, to the lot that wafer belongs to, back through the inspection run to the tool and the recipe it ran, to the chamber inside that tool whose running hours since PM and FDC trace explain the drift, to the excursion the signature triggered, to the hold the yield engineer approved, and to the corrective action that closes it. Table 8, printed with this chapter, lists every object with its anchor and its typed links. This is the shared core of industrial ontology examples in manufacturing: a defect argument that reaches every system of record without any of them being asked to join anything.

5.2  Where the Human Loop Lives and the Hosting Posture

The human loop lives in the actors and in the approval properties every record carries: a hold records who raised it and who approved it, a defect records which review engineer confirmed its class, and an attempt to place or release a hold without a recorded named approval is refused in code and audited per hold, because the gate is the manufacturing execution system interface, never the agent. Functional safety and AI is an active standards question (ISO 2024), and AI based visual quality inspection carries its own classification and compliance pathways (KB 2025), which is why every drafting agent ends at a named person rather than at an action.

The hosting posture is sovereign end to end. All data stays inside the fab on the operator's own hardware, with no third party model service and nothing crossing the fab perimeter; identity is held in Keycloak on site; the edge units carry no internet path; and no write path leads back toward a system of record except an approved hold or disposition through the manufacturing execution system interface.

5.3  One Object in Its Recorded Form

The code block shows one object in its recorded form: the wafer, the object the most links reach, with its properties and its two typed links.

{ "id": "wafer", "label": "Wafer", "kind": "material", "anchored_in": "The manufacturing execution system", "properties": [ "Wafer ID", "Lot membership", "Slot", "Current process step" ], "status_vocabulary": [], "links": [ { "to": "lot", "label": "belongs to" }, { "to": "wafer map signature", "label": "carries" } ] }

Every Source Enters Through an Adapter, Never Directly

One adapter family over SECS/GEM, GEM300 and EDA interfaces carries every record into the event backbone, so no source system is ever loaded, modified or replaced, and no join is trusted until it is proven on a real week of production data.

Chapter 5 showed what the object model holds and how one walk crosses its links. This chapter covers how records reach it: through one adapter family, never directly, and never with a join trusted before it is proven.

6.1  Eight Sources, One Door Each

Eight sources feed the design. Five are named systems of record, all of the operator's own and all read only: the manufacturing execution system, the system of record for lots, routes, recipes, tool states and holds, where every trace ends in a lot and a hold; the yield management system, which holds wafer maps, signatures and excursion records; the inspection tools' own defect databases, the source of defect candidates and review images the edge units classify; the equipment data collection system, which carries chamber sensor telemetry and FDC traces for drift precursors and excursion tracing; and the statistical process control system, which holds the control limits a wafer map signature crossing triggers on. The remaining sources are the tool interfaces and telemetry streams at the edge. Figure 5 maps each named system, its provenance class and its adapter path into the backbone.

6.2  What the Adapter Tier Guarantees

One adapter family, the integration adapter, carries every record in, over SECS/GEM, GEM300 and EDA interfaces decided by which revisions each etch module tool implements. The tier guarantees four things. First, no source is ever loaded, modified or replaced: the adapters read, and nothing is written back toward a system of record except an approved hold or disposition through the manufacturing execution system interface. Second, every record carries its provenance and its timestamp, so any figure on any surface can be traced to the system that holds its truth. Third, event logs are constructed in the pipeline layer rather than trusted as they arrive, because source systems differ in what they call an event and when they record it. Fourth, no join is trusted until it is proven: the adapters reconcile the source keys across the systems on one real week of production data before phase one is judged, recording where the truth actually lives, because an ontology that joins silently wrong keys is worse than four systems that do not join at all.

6.3  The Event Backbone

The backbone is Apache Kafka with KRaft, and it answers four questions. Ordering: events are keyed per wafer and per tool, so inspection runs, defect candidates and telemetry replay in the sequence they happened. Delivery: adapters are at least once and idempotent, so a replayed event cannot double count a defect or a confirmed class. Buffering: the backbone absorbs bursts when a review tool emits images faster than the edge tier classifies them, and the edge units buffer locally when their uplink is briefly lost. Replication: topics are replicated across brokers so the loss of a broker does not lose records, and the artifact registry in Harbor keeps the edge tier's software resynchronizable without any internet path. Time alignment across sensors and systems is held by Linuxptp against an Open Time Card grandmaster class clock, so an FDC trace, an inspection run and a wafer map signature from the same excursion share one clock. Nothing on the backbone crosses the fab perimeter.

Classification Runs at the Tool, Reasoning Inside

The anomaly classifier runs on sealed fanless units at the inspection tools with no internet path, while reasoning waits on verified open weights self hosted inside the fab, and the latency budget is set by images arriving, not by users waiting.

Chapter 6 followed every record from the fab's systems of record through the adapter tier into the object model. This chapter follows the same data one step further, to where it is computed: which model runs on a sealed unit at the inspection tool, which runs on the operator's own servers deeper inside the fab, and what that split costs in latency and failure exposure.

7.1  Two Tiers, Each Placed for a Reason

The design has two inference tiers, and Figure 6 sets them side by side with what runs on each and what crosses between them. The first tier is the tool itself. Sealed fanless units beside the optical inspection and electron microscope review tools classify defect images as they arrive, on the CodeNinja on-device AI stack runtime, using an unsupervised anomaly model fitted on this fab's own normal images, so a class candidate exists before any image leaves the tool bay. The unit is an octa core edge SoC class with a 6 TOPS neural processing unit, commercial grade rated 0 to 80 C, in a fanless sealed smooth-wall cleanroom enclosure with a power over Ethernet front end, because a fan sheds and moves particles. The arithmetic that matters at this tier is load, not weights: the NPU load figures on the on-device shelf were measured for detectors rather than an anomaly model, so a 60 percent headroom gate governs until the real load is measured, and a saturated unit dropping images silently is the named failure mode behind that gate.

The second tier is inside the fab, on the operator's own servers. The stack row that names GLM 5.3 calls it a 753-billion-parameter model at FP8 precision and node class, which is exactly why no language model is served at the tool. What the plan holds for this tier is the class and the rule: a 141 GB high bandwidth memory GPU class with 8 GPUs per node, and the frontier model footprint sizing rule for vLLM and SGLang serving. What it does not hold is the split between weights, usable memory and the KV cache ceiling, because no verified model row stands in the register; those figures are derived only when one does, and Chapter 8 explains why none does yet.

7.2  Latency Runs From Image Arrival to Hold Approval

The budget has two ends, and neither is a person waiting on a chat reply. At the near end, classification sits in the arrival path: the unit must keep pace with the inspection tool's own output, and the headroom gate exists so that bursts of arrivals never queue behind a saturated unit. At the far end sits the rollout's own measure, time from excursion onset to hold, with a nominal of 4.0 hours and a breach above it, exercised by the simulated event of one etch chamber drifting and printing a ring signature on wafer maps. Everything between, from the wafer map signature crossing a control limit, through the excursion agent tracing it to a chamber, to the yield engineer approving the hold, must fit inside that figure. The people in the loop pace the budget and guard it at once, and that is deliberate: how inspection AI is classified is an active regulatory question, with published analyzes of risk classification and compliance pathways for AI-based visual quality inspection (KB 2025), so every class candidate and every hold draft ends with a named approver rather than acting alone.

7.3  What Crosses the Boundary, and What Fails When It Does

Nothing crosses the fab perimeter. Tool-to-server flows ride internal segmented conduits under the fab's own cybersecurity program, no edge unit gets any internet path, and the event backbone, Apache Kafka in KRaft mode, carries class candidates, defect records, wafer map signatures and heartbeats between the tiers, with linuxptp and an Open Time Card grandmaster class keeping event order honest across systems. Each failure mode is bounded. If the link fails, classification continues at the tool because the classifier is local, and queued events move when the conduit returns, while the surfaces show the gap honestly. If power fails, the unit drops with it, since power arrives on the same Ethernet front end, and the edge unit heartbeat puts the drop on the health surface where someone sees it. If the update path fails, nothing is pushed from outside, because there is no outside path: artifacts and model updates move through Harbor, the air-gapped artifact and model registry, on the internal network, and a unit that misses an update keeps running its last verified artifact until the path returns.

No Weights Are Committed Before Verification

The register is honestly empty: no open weight model survived this run's live checks, so GLM 5.3 stands as a named intention with an unsized footprint rather than a committed row, and the gate to commit it is verification, not preference.

Chapter 7 placed classification at the tool and reasoning inside the fab, and it left one number deliberately unfixed: the size of the reasoning footprint. This chapter shows why the register is empty, what stands in it instead, and what it will take to commit a model row.

8.1  An Honest Register Holds One Intention and One Fitted Model

Figure 7 lays the model stack out, and its most important feature is an absence: the register holds no model row, because no open weight model survived this run's live checks. The catalog entries the tooling lens brought in were each verified by a person on the date the entry carries and were not rechecked live for this build, and that outstanding verification is the gate to commit, not a matter of preference. GLM 5.3 therefore stands as a named intention. The operator's own ask names it, reasoning on GLM 5.3 open weights, self hosted inside the fab, acquired by a commercial buyer, and the work surface commits frontier-class open weights self hosted for sovereignty, of GLM 5.3 or Kimi class. Behind the name stand a role and a placement: reasoning for the three named agents and for the command center's conversational interface that answers with citations, running on the operator's own servers inside the fab, never at the tool, never as a third party model service. Behind it do not stand a filed parameter count, precision, license terms or context window, so the footprint is unsized and no GPU count is derived; the stack row that calls GLM 5.3 a 753-billion-parameter FP8 node-class model is the argument for where it sits, not a committed figure. Committing the row means a live check on this build, filed together with the parameter count, precision and license terms, and only then does the sizing rule fix the node count, the weights against usable memory and the KV cache ceiling.

The second model in the stack is not a language model at all. The edge tier runs an unsupervised anomaly model fitted on this fab's own normal images, served on the CodeNinja on-device AI stack runtime at the tool. It was chosen against a defect classifier trained on labelled images, for two reasons the design states plainly: System of context forbids a model trained for this operator, and a trained-classifier estate becomes a standing retraining burden. Confirmed classes and root causes become memory instead, and no weight is ever updated by them. Assurance cannot lean on mature certification here, because the functional safety and AI standard is a technical report (ISO 2024), so the design's own gates carry it: the phase one bench run measures the anomaly model on the fab's own images, and no accuracy is quotable before that run.

An empty register is not a gap in the design; it is the design holding its own rule. The operator is buying weights it will hold, so which weights is part of what is being bought, and a row that could not survive a live check would be a costly line in the build.

8.2  The Choice Register on One Page

Table 4 gathers what the register does hold: each model with its status, the hardware classes and the sizing rule, the sensing the design stands on, the pattern, and the ground it runs on. Read as a whole, it says that everything is committed except the weights themselves, and that the weights wait on verification rather than preference.

One Etch Module Quarter Proves It First

Phase one is one etch module for one quarter, gated on classification quality on this fab's own images, joins proven on production data and named approvals on every hold, before any extension gate opens.

Chapter 8 ended with the register's honest gap: the weights the operator named sit in the catalog, but no model survived this run's live checks, so the fab's inference server stays unsized until a verified model stands in the register. This chapter turns that honesty into sequence: the riskiest assumption, classification quality on this fab's own images, is proven first on one etch module, and every extension gate opens only on recorded evidence.

9.1  Phases, Gates and Coverage

Phase One is the etch module phase: 17 items across six workstreams, namely approvals and security, the command center, memory, the named agents with engineers deciding, one model of the fab, and the phase one gates. The items include the units placed at the inspection tools, the hardening of the zero shot defect classifier, and the fab ontology of yield objects, the 16 objects from wafer to process owner. Its exit gate is zero shot defect classifier hardening: the anomaly model is measured offline on a development board against this fab's own images before any accuracy figure is quoted, and only ranges with stated conditions are quotable before that bench run. Phase Two carries a single item, the extension gates and module rollout, and it opens only when Phase One's gates have been judged against recorded baselines. Figure 8 sets both phases, their item counts and their gates side by side, with requirement coverage beside them: the plan's coverage record holds the requirement covered, with nothing partial and nothing open.

9.2  What the Rollout Measures

The loop is judged on one measure: time from excursion onset to hold, in hours, with a nominal of 4.0 and a breach when the measured time rises above it. The fault that exercises the measure is the design's simulated event, one etch chamber drifting and printing a ring signature on wafer maps. The excursion agent must trace that signature to a chamber through the equipment data collection traces, draft a hold, and a yield engineer must approve it before the clock stops. Baselines and counting rules are agreed before the first model is fitted, a discipline the sector's own precedents taught, and since neither precedent published a false-call rate, the nuisance trend surface carries ranges with conditions rather than a single figure. Machine learning already runs across nearly every safety-critical industry, which is why these gates are agreed in advance and judged against recorded baselines rather than after the fact (Nationalacademies 2025), and the hold refusal rule is anchored in code in the spirit of functional safety guidance for AI systems (ISO 2024).

9.3  Failure Modes

Table 5 states what can fail and what the design does about each failure, and every mitigation named in it is an item or a gate already carried by a phase.

9.4  Lessons

Agree the baselines and counting rules before the first model ships. The sector's precedent builds that skipped this step spent their first measured period arguing about what counted as a defect rather than improving the model; this plan fixes the counting rules as a gate item, so the bench run measures against a settled definition and the false-call question is asked with the same denominators throughout. Design drift handling in from version one. The simulated event is a chamber drifting gradually and printing a ring signature, not a step change, so the excursion path, the chamber telemetry precursors and the hold drafting are exercised from the first version rather than retrofitted after a first excursion is missed. Fit the classifier on this fab's own images. The pattern the history lens surfaced is that an image model learns the fab, not the defect: a model fitted elsewhere inherits another fab's illumination, another tool's artifacts and another process's nuisance population. The anomaly model is therefore fitted unsupervised on this fab's own normal images, and no edge unit holds any internet path.

9.5  What Is Still Open

Three questions remain open, and each settles into a design change. The false-call rate: neither sector precedent published one, and settling it would let the nuisance trend surface carry a single quotable figure instead of ranges with conditions. The model register: no open-weight model survived this run's live checks, so the reasoning weights the operator named are not yet sized under the register; settling it fixes the fab's inference server, its GPU count under the 141 GB HBM rule and its license terms. The sovereign obligation: the rule of no cloud and no third party model service is confirmed with the operator's own compliance owner and bound to a named scope item before design freeze, and settling it removes the last condition on the boundary the ownership chapter describes.

The Intelligence Stays with the Fab Producing It

The ontology, the memory of confirmed classes and root causes, the decision record and the boundary all belong to the operator, held on its own hardware, and the agents never place or release a hold without a named approval.

Chapter 9 set the gates that protect the build's integrity; this chapter states who holds what those gates protect, which is the operator, on every axis that matters.

10.1  Who Owns What the Build Produces

The operator owns the object model. The 16 objects and their typed links are a projection over the operator's own systems of record, never a shadow copy of them, and the crossing mappings that answer questions no single system can are held with the ontology. Unlike most industrial ontology examples, which live in a vendor's documentation, this one lives on the operator's own hardware and changes only through its named owners. The operator owns the memory: every confirmed class and every confirmed root cause is kept as decision memory that the next run reads before it acts, and because nothing is trained or distilled into weights under system of context, there are no fine-tunes whose ownership could ever be contested; the anomaly model is fitted unsupervised on the fab's own normal images and runs where the fab runs. The operator owns the decision record: every hold carries who raised it and who approved it, the approval-missing attempt is refused in code, and the audit trail per hold is the operator's own evidence, produced by its own people acting under its own authority. The operator owns the boundary: the whole build runs on the operator's own hardware inside the fab, nothing crosses the fab perimeter, no managed cloud service and no third-party model service appears anywhere, and the support team is screened under the EAR deemed export rule before any access is granted.

10.2  The Offer Behind the Design

CodeNinja designed this system on Praxis, its platform for designing physical AI systems, and the design maps directly onto what CodeNinja builds: the governed object model of wafers, lots, tools, chambers, excursions and holds is Hyper Ontology; the command center where the yield team works excursions, holds, tool risk and agent drafts, and where the operator's own people can build further agents on models they can change without losing what was built, is Hyper Pragma; the three named agents that draft classifications, excursion traces and dispositions for a named engineer to confirm and approve are Decision Systems; and the whole posture, open weights on hardware the operator owns inside its own fab with no third-party model service, is Sovereign Infrastructure.

The Fab Should Reason Over Its Own Records

One design holds the whole argument: classification at the tool on sealed fanless units, one governed ontology joining eight sources into sixteen objects, three named agents that draft while named engineers decide, memory of confirmed classes and root causes instead of retraining, and every byte staying inside the fab boundary on hardware the operator owns, with the model register stating plainly that no weights are committed until a verified row stands.

Running the same shape elsewhere takes an operation willing to name its systems of record and its approvers before the first model is discussed, edge units rated for the floor environment rather than adapted office hardware, an export control screen on every supporting engineer before access is granted, and a first phase aimed at the riskiest assumption, classification quality on that fab's own images, rather than the widest scope.

How Praxis Contextualized and Reasoned This Design

Every choice in this design traces to recorded reading: eight reasoning lenses and the brief in the operator's own words.

Chapter 10 closed the argument on ownership; this chapter opens the record, so a reader can trace any choice in the paper back to the reading that justified it. Every design in this series is produced on Praxis, CodeNinja's platform for designing physical AI systems, and Figure 9 shows the path from the ask to the reasoning to the design.

11.1  Contextualizing the Ask

The ask, in the operator's own words, was a physical AI system for wafer defect inspection and yield analytics: edge units next to optical inspection and electron microscope review tools classifying defect images as they arrive, one governed fab ontology joining the manufacturing execution, yield management, tool defect, equipment data collection and statistical process control systems, three named agents drafting for engineers who confirm and approve, memory keeping every confirmed class and root cause, reasoning self hosted inside the fab, and one simulated event, an etch chamber drifting and printing a ring signature on wafer maps. Praxis assigned the design to the Enterprise AI family; the semiconductors pin is the FDE's own decision on this project, stated as a decision rather than a reasoned match, and the brief was read as reasoning input.

11.2  The Lenses

Table 6 states what each of the eight lenses could see, how many sources it cited and what it contributed to the design. Every lens returned a contribution; the gap in this design is not a lens that saw nothing but a register that could not yet stand behind weights, which the tooling lens records plainly.

11.3  Patterns Adopted and Set Aside

System of context was adopted as the primary pattern, pinned by the FDE, because the requirement asks exactly for its shape: a governed ontology tied to source systems that are never replaced, never modified and never loaded, agents that draft while engineers decide, and memory that improves without training. Its fixed grammar governs the whole build: nouns become objects, facts become properties, relationships become typed links, and actions change them. No pattern was set aside; the reasoning trace records none, and the design carries no orphaned architecture.

11.4  Where the Reasoning Lands

The reasoning lands on equipment classes rather than named products wherever the shelf holds no verified entry: the octa-core 6 TOPS NPU edge SoC class in fanless sealed cleanroom enclosures, the Open Time Card grandmaster class for time synchronization, the 141 GB HBM GPU class for the fab's inference server, and fab integration decided tool by tool over SECS/GEM, GEM300 and EDA according to which revisions each etch-module tool implements. Two precedents were read in the sector, the Seagate fab image defect build and the SK hynix virtual metrology build, and both shaped the phase gates rather than decorating the prose. Everything shown in this chapter was recorded reading: the citation counts and the gap in the model register are as recorded, and nothing is inferred.