How it is built

One governed engine. Five missions. A model that is provably off the kill chain.

The same engine runs all five missions: the same gate, the same signed ledger, the same authority envelope. Only the fusion stage and the corpus differ. This page shows the spine, the governance design, the AWS topology, and the harness that proves the demo is not faked.

178

commits on main

22,168

source lines · 120 files

test files · workspace green

Kiro specs

engine packages

The governed spine

Telemetry enters, the model reasons in the open, and a deterministic gate makes every authority decision. Fuse is the only stage that varies across missions: each mission branches there, then rejoins the shared path. The decision and the record never change shape.

Six fuse variants in; one gate and one ledger out. Each mission injects its own sensor adapter, fusion, and corpus into the same runGovernedMission, which calls the identical c2-gate and the identical signed ledger. The import graph shows no fork: referential identity, asserted by test, not a claim on a slide.

INGEST

Normalize

Geometry and signal attributes only. No ground-truth label reaches the engine.

→

PER MISSION

Fuse

The one stage that varies. Multi-INT fusion per domain. The five missions branch here.

VARIES

→

DECIDE

CoT + gate

Model reasons in chain-of-thought. A deterministic graduated-authority gate decides. No model call on the decision path.

GATE

→

RECORD

Signed ledger

Ed25519-signed, SHA-256 hash-chained, Merkle-anchored, write-once. Every decision is non-repudiable.

→

ACT

Simulated effector

On engage, simulated only. No live-effect path exists by construction.

#08 FLAGSHIP

Area Counter-UAS

Air, 1 km sq · synthetic oracle + real drone-track

#07 DIFFERENTIATOR

FOB Defense

Air + ground UGV · reuse #08 runner, swap corpus + envelope

#01

Seabed Surveillance

Maritime · real NOAA AIS · recommend-only

#02

Convoy Escort

Maritime · 60 vessels / 6,775 fixes · 65 ledger records

#04

Swarm Reconnaissance

ISR imagery · real overhead imagery · COP-commit

One engine ran all five with no fork. That is the proof, not the claim. The branch is data, not code: each mission is a different corpus and authority envelope through the same runner.

Governance design

The hard requirement for a C2 system a government can deploy: the irreversible decision is made by something a human can read, audit, and overrule. The model never holds that authority.

The gate is plain code: a fused track and the signed envelope in, evaluated top to bottom, the first match decides. Everything defaults to the least authority and escalates only as far as positive ID, confidence, posture, and a second signer permit. Pull the model and the ladder still refuses every unauthorized posture — that is the test we run.

Deterministic graduated-authority gateThe gate is plain code, not a prompt. It maps a fused track plus an authority envelope to a posture: TRACK, RECOMMEND, or ENGAGE. The same inputs always yield the same posture. No model call sits on the decision path.

Positive hostile ID at every postureNothing escalates on suspicion. A contact must clear positive hostile identification before any posture above TRACK is reachable, at every step, not once at the top.

Two-person authorization on engageENGAGE is invalid without a second signer. One operator cannot reach an irreversible posture alone. The gate rejects a single-signer engage by construction.

The LLM is off the kill chainThe model fuses and explains. It does not gate. No engagement is reachable through a model output. Pull the model and the gate still refuses every unauthorized posture, which is the test we run.

Graduated authority, shown in #07FOB Defense engages the air drone with RF-defeat inside the envelope, but routes a ground intrusion to RECOMMEND-ONLY, a QRF cue the operator dispatches. Cooperative traffic is held at TRACK. One gate, three different authority answers.

Tamper-evident, not tamper-proofThe ledger is signed and hash-chained, so any change to a past record breaks the chain and fails verification. The surfaces display and verify the chain. They do not re-sign it. We claim detection, not prevention.

The signed ledger

Every decision the gate makes is written once into an append-only ledger. Four independent layers make a record both non-repudiable and tamper-evident. Break any one and verification fails loudly.

The signed authority envelope is entry #1; every gate decision and output chains after it. Each record carries the previous record's hash (SHA-256) and its own Ed25519 signature; one Merkle root commits to the whole chain; the chain lands in a write-once WORM bucket. Alter any field and its hash changes, the chain breaks, and verify() returns false — tamper-evident, replayable against the public key.

L1SHA-256 hash chain

Each record carries the hash of the record before it. Altering an earlier entry changes its hash and orphans everything downstream. The chain is the order of events made unforgeable.

L2Ed25519 signature

Each record is signed with the run's private key. The signature proves who wrote the record and that its contents are unmodified. Verification is public-key only, no secret needed to check.

L3RFC 6962 Merkle tree

Records aggregate into a Merkle tree, the same construction certificate transparency uses. One root commits to the entire ledger. A single inclusion proof shows a record is present without revealing the rest.

L4Write-once anchor

The ledger lands in write-once object storage, an S3 WORM bucket. Once written, a record cannot be overwritten or deleted within its retention window, even by the account that wrote it.

Concrete instance: Convoy Escort wrote 65 ledger records, with the signed authority envelope as entry one and the hash chain verified end to end. A judge can replay the run and re-verify every signature against the public key.

AWS topology

Two tiers in account 521034048482, region us-east-1. The edge tier carries the governed runtime and is torn down after judging. The cloud tier holds the write-once ledger and serves the static war-room. Static surfaces sit at roughly zero at idle.

The edge tier runs the governed loop on a disconnected Greengrass v2 core and stores-and-forwards its signed ledger to a write-once S3 WORM bucket on reconnect. The cloud is the system of record, never in the disconnected decision loop. Bedrock is a one-time off-box extract, off the decision path. The edge costs about a dollar a day and is destroyed after judging; the static surfaces are near zero at idle.

Edge tier ~ $1 / day · torn down

governed runtime · provision, run, reconcile, teardown

Edge coreAWS IoT Greengrass v2

Runs the engine on a disconnected core: normalize, fuse, gate, write the on-device ledger. No model call on the decision path. Reconciles to the cloud ledger on reconnect.

Track streamAmazon Kinesis

Real corpus replayed as a live telemetry feed into the edge core. Predates the build, disclosed as real open-source.

One-time extractAmazon Bedrock

A single off-box pass, roughly $3, for the reasoning leg. Off the decision path by design. Not in the disconnected loop.

Cloud tier ~ $0 at idle

durable record + static surfaces

Signed ledgerAmazon S3 (WORM)

Write-once, retention-locked object storage. The reconciled hash-chained, Ed25519-signed ledger lands here. The durable anchor, layer four of the ledger stack.

War-roomAmazon CloudFront

Serves this surface and the operator consoles from S3 behind CloudFront, under a strict same-origin CSP. Static, so near zero at idle.

Edge to cloudstore-and-forward

The edge runs offline and forwards its ledger to the WORM bucket on reconnect. The cloud is the system of record, never in the disconnected decision loop.

Flow: Kinesis feeds the Greengrass core, the core runs the governed loop and writes an on-device ledger, and on reconnect it stores-and-forwards to the S3 WORM ledger. The static war-room serves from CloudFront. The edge stack costs about a dollar a day and is destroyed after judging. The static surfaces are essentially free at idle.

Is the demo faked?

No. The engine cannot read the answer-key label, and a metamorphic invariance harness proves it.

The fair worry about any scored demo: the system was tuned to the test, or it can see the label and parrots it back. The harness answers that mechanically. It transforms inputs in ways that must not change the governed decision, then checks that the decision held. If the engine were secretly keyed to the label, these transforms would flip its output. They do not. The harness runs green across the missions.

[ok]

Label is never an inputThe normalize stage passes geometry and signal attributes only. The ground-truth label is held by the oracle, never handed to the engine.

[ok]

Relabel invariancePermute or rename the scenario labels and the governed decision is unchanged. The engine is reasoning over the track, not the name attached to it.

[ok]

Label-form invarianceCollapse the labels to one, make them all distinct, or blank them: the fused track partition is unchanged. The grouping comes from sensor geometry and attributes, not the label text.

[ok]

Order invarianceShuffle the arrival order of corroborating sensor reports and the fused identification holds. No dependence on a lucky sequence.

Keep two senses of the numbers distinct. Answer-key invariants reproduced is per-mission acceptance: #08 reproduces 12 / 12, #07 reproduces 13 / 13. Metamorphic invariance checks is the harness proving the engine cannot read the label: 12 / 12 reproduced on the framework's transform set (the categories above are representative). The same word, two different jobs. We never conflate them.

Honest scope

What we claim, and the exact edge of each claim. Judges read this, so the boundary is part of the work.

The split is load-bearing. Real open-source corpora (NOAA AIS, real drone-track, overhead imagery) feed the engine as the operating picture. The synthetic tactical scenario is the oracle answer key: it verifies the output but never feeds the engine, so the answer-key-leak class of bug is structurally impossible (the invariance harness proves it). The system was built in-window; the data predates and is disclosed real open-source.

TRL 4 (partial 5), all five at the same level

Validated beyond a lab on real open-source data with the governed loop. Not operationally demonstrated, not a relevant environment.

Real corpus, synthetic scenario

The data is real open-source and predates the build: NOAA AIS, real drone-track, real overhead imagery. The tactical scenario oracle is synthetic and disclosed. The system was built in-window. The data was not acquired in-window.

Simulated effectors only

No live-effect path exists by construction. On engage, defeat is tasked and recorded, never produced.

Model off the kill chain

The decision path is a deterministic gate. No model call gates an engagement. Remove the model and the gate still refuses every unauthorized posture.

Tamper-evident ledger

Signed and hash-chained. The surfaces show and verify the chain, they do not re-sign it. Tamper-evident, not tamper-proof.

Cost frame

Roughly $1/day for the edge, a Greengrass core plus a Kinesis stream, torn down after judging, plus a one-time ~$3 Bedrock pass. Static surfaces are near zero at idle.