Platform Metrics · Wolfberg Per Aspera

The thesis one engine, five missions, zero forks

1

governed engine

One spine: normalize, fuse, CoT and gate, signed ledger, simulated effector. Ten engine packages compose it, no per-mission fork.

5

missions on that engine

Air (#08), air-plus-ground (#07), two maritime (#01, #02), and ISR imagery (#04). Each swaps the fusion stage and the corpus only.

0

engine forks

The one-engine claim is structural — solutions/c2-missions/test/one-engine.test.ts asserts referential identity of the gate module across every mission's runner.

The build measured from the repo at deploy

Greenfield, in-window. Counts are produced by scripts/metrics_producer.py right before deploy and fetched same-origin from metrics.json. No hand-typed number on this board.

145

commits on main

The greenfield history. No carry-over from a prior codebase.

24,122

source lines

TypeScript, JavaScript, Python, HTML, CSS across the workspace.

131

source files

Engine packages, mission solutions, harness, infra, and war-room surfaces.

22

test files

Full workspace green. The invariance harness proves the engine cannot read the label.

10

engine packages

contracts, core, packages/sdk, packages/mock, plus c2-fusion, c2-gate, c2-mission, c2-missions, c2-width, invariance-harness.

3

Kiro specs

Spec-driven build: governed-c2-platform, security-800-53-mapping, aegis-edge. Requirements -> design -> tasks.

8

deployed surfaces

Home, C2 console (2D + 3D), monitor, gallery, metrics, judge walkthrough, architecture, reference. CloudFront + S3, strict CSP.

5

missions governed

All on the one engine. C-UAS ships a live 3D operator console; the rest run the same gate + signed-ledger spine.

The evidence from the signed runs and the real corpora

Per-mission counts from the shipped run NDJSON. The signed-ledger chain is Ed25519 with SHA-256 prev-hash links; the surfaces show the chain, they do not re-sign it.

144

signed ledger records

Across #01 (67), #02 (67), #04 (5), and #07 (5). #08 builds the chain client-side from the cuas-events feed.

241

fused tracks

Across the four governed-runtime missions on disk: #01 (61), #02 (61), #07 (119), and #04 mosaic candidate.

12 + 1

metamorphic transforms

Twelve invariance transforms plus one negative control (the cheating engine, which fails). Framework count distinct from the per-mission answer-key invariants.

6,775

real AIS fixes

NOAA Marine Cadastre AccessAIS (U.S. public domain). 60 vessels, 12 h window of 2024-01-01, San Pedro Bay. Drives #01 and #02 unchanged.

129

real imagery detections

SkyFusion overhead-imagery annotations (Apache-2.0). Aircraft + ship objects across 22 tiles, NAS North Island + San Diego Bay. Drives #04.

a24c5a

real ADS-B anchor (#07)

ICAO a24c5a — Cessna 172, Fort Irwin NTC overflight, adsb.lol open API. Correctly classified cooperative against the synthetic drone threat — the discrimination win.

12 / 12

#08 answer-key invariants

Reproduced in solutions/c2-fusion/test/invariance.test.ts. Per-mission acceptance set for the C-UAS floor.

13 / 13

#07 answer-key invariants

Reproduced on the FOB-defense reuse run. Same gate, same ledger as #08; only the corpus and envelope swap.

Per mission same engine, distinct evidence

Two senses of the invariant counts stay distinct. Answer-key invariants are per-mission acceptance (the run reproduces the disclosed key). Metamorphic invariance is the framework count proving the engine cannot read the label. They are not the same number.

Mission	Domain & corpus	Evidence	TRL
#08 FLAGSHIP	Area Counter-UAS Air · 1 km² · synthetic oracle + real drone-track	12 / 12 answer-key invariants reproduced Engage the hostile drone within the envelope, two-person auth. Live 3D console.	TRL 4 (partial 5)
#07 DISCRIMINATION	FOB Defense Air + ground (UGV) · real ADS-B anchor + synthetic threat	13 / 13 answer-key invariants reproduced Same gate / ledger as #08. Real Cessna 172 (ICAO a24c5a) classified cooperative; drone engages.	TRL 4 (partial 5)
#01	Seabed cable corridor Maritime · real NOAA AIS (San Pedro Channel)	67 signed-ledger records, 61 fused vessel tracks UNCLOS recommend-only posture; synthetic loiter / anchor-drag near the cable corridor, operator-engagement arc to USCG dispatch.	TRL 4 (partial 5)
#02	Convoy escort Maritime · same real NOAA AIS, different posture	67 signed-ledger records, 61 fused vessel tracks UNCLOS self-defense posture; synthetic fast-attack-craft closing run, simulated RF-jam under R-G2.engage.	TRL 4 (partial 5)
#04	Swarm reconnaissance ISR · real SkyFusion overhead-imagery annotations	5 signed-ledger records, mosaic-fusion variant COP-commit output, operator-authorized. Invariance harness green on real imagery.	TRL 4 (partial 5)

The cost what it actually took to run

Counted, not modeled. The static war-room sits on S3 + CloudFront and reads near zero at idle. The only metered compute is the edge, stood up for judging and torn down after, plus a one-time generative pass.

Metered · the edge, while live

~$1 / day + ~$3

Roughly a dollar a day for a Greengrass edge core and a Kinesis stream, torn down after judging, plus a one-time Bedrock pass near three dollars.

AWS account 521034048482, us-east-1. The edge is provisioned for the demo window only; it does not run at idle.

At idle · the static surfaces

~$0

The eight war-room surfaces are S3 + CloudFront. Serving the consoles and this board reads near zero when nothing is running.

No always-on compute backs these pages. The governed runs are replayed from signed ledgers, not recomputed live.

The spine the one engine, stage by stage

INGEST

Normalize

Geometry and signal attributes only. No ground-truth label reaches the engine.

PER MISSION

Fuse

The one stage that varies: multi-INT fusion per domain. Air, maritime, ground, imagery.

DECIDE

CoT + Gate

Deterministic graduated-authority gate. No model call sits on the decision path.

RECORD

Signed ledger

Ed25519-signed, hash-chained. Tamper-evident, never tamper-proof.

ACT

Effector

Simulated only, on engage. No live-effect path exists by construction.

Every mission shares the same gate, the same signed ledger, and the same authority envelope. The proof is structural, not asserted: one engine ran all five, with no fork.

How it stays honest the disclosures, stated plainly

LLM off the kill chainThe decision path is a deterministic gate. No model call gates an engagement. A no-model-call CI test on c2-gate enforces it.

Two-person authorizationEngage posture is invalid without a second signer. Positive hostile ID is required at every posture.

Simulated effectorsNo live-effect path exists by construction. Defeat is tasked and recorded, never produced.

Tamper-evident ledgerEd25519-signed and hash-chained. Tamper-evident, never tamper-proof. Surfaces show the chain; they do not re-sign.

TRL 4 (partial 5)Meets TRL 4 (lab-validated with the real governed engine, real open-source corpora, signed ledger closed). Partially meets TRL 5 (real-world data, governed loop). Not fully: synthetic scenarios, simulated effectors, no relevant operational environment.

Real corpus, synthetic scenarioThe open-source data is real and predates the build. The tactical scenario oracle is synthetic and disclosed. The system was built in-window; the data was not.