Platform reference

One engine. Five missions. One signed ledger across all of it.

The platform is one fusion-to-gated-action engine. Each mission plugs in by swapping the sensors, the fusion stage, and the output. The gate and the signed ledger are the same module under every mission. This page is the mission family, how the engine generalizes, and the proof it is not faked.

missions, one engine

TRL 4 (partial 5)

consistent, earned

model calls on the gate path

Ed25519

signed, hash-chained ledger

The one engine

Telemetry is normalized to geometry-only detections, fused into tracks, and every consequential action passes a deterministic graduated-authority gate the human commands inside a signed envelope. Fuse is the only stage that varies across missions; the gate, the signed ledger, and the recommend-only discipline do not. The topology and the governance design are on the architecture page.

INGEST

Normalize

Geometry and signal attributes only. The ground-truth label is split out and never reaches the engine.

→

PER MISSION

Fuse

The one stage that varies. Air track, maritime vessel-track, or image-mosaic. The five missions branch here.

VARIES

→

SHARED

Gate

The deterministic graduated-authority gate. The same module under every mission. No model call on this path.

SHARED

→

SHARED

Signed ledger

Ed25519-signed, hash-chained. The signed authority envelope is entry #1; every decision follows.

The same gate module under every mission is referential, not a copy: the one-engine test asserts the mission's gate is the gate module. That is the strongest in-code statement of no fork.

The mission family

Air defense, forward-operating-base defense, maritime seabed and convoy, and a mapping-output recon variant. One engine across five domains. Each card discloses its real corpus and its synthetic tactical scenario.

#08 AIRthe floor

Area Counter-UAS

Sensors: radar + RF + EO/IR

Fusion: air track (GNN + Kalman)

Gate: up to engage-within-envelope, two-person signed

Output: simulated RF-defeat

Real: drone-track corpus / Synthetic: tactical oracle. 12/12 answer-key invariants reproduced.

#07 AIR + GROUNDthe differentiator

Forward Operating Base defense

Sensors: radar + RF + EO/IR + UGV ground feed

Fusion: air track + UGV ground delta

Gate: drone engageable; ground intrusion recommend-only

Output: simulated RF-defeat / QRF cue

Real: engine reused wholesale from #08 / Synthetic: FOB oracle + UGV feed. The second mission on the identical gate and ledger.

#01 MARITIMETRL 4 (partial 5)

Maritime seabed

Sensors: real public AIS

Fusion: maritime vessel-track variant (loiter / anchor-drag / AIS-gap)

Gate: recommend-only

Output: seabed-tamper alert (human releases)

Real: NOAA Marine Cadastre AIS / Synthetic: seabed-tamper event. Vessel keys are hashed; no raw identity leaves the adapter.

#02 MARITIMETRL 4 (partial 5)

Convoy sea-surface defense

Sensors: real public AIS

Fusion: maritime vessel-track variant

Gate: recommend-only

Output: convoy reroute + manned-escort cue

Real: NOAA AIS merchant traffic / Synthetic: fast-attack-craft threat. Mitigation stays recommend-only under Law of the Sea.

#04 OVERHEAD ISRTRL 4 (partial 5)

Drone-swarm reconnaissance

Sensors: real overhead imagery

Fusion: image-mosaic variant (a documented variant, not the track engine)

Gate: recommend-only COP commit, never auto-commits

Output: a reconnaissance mosaic committed to the common operating picture

Real: SkyFusion overhead imagery, annotations only / Synthetic: swarm sector-tasking. The widest point of the one-engine claim: a different output, the same governed spine.

Built to extend

A new mission swaps three things and forks nothing. Adding a domain never touches the gate or the ledger; it adds a sensor adapter, a fusion variant, and a recommend-only output. That is what keeps five missions honestly one engine.

Swap the sensorA sensor adapter normalizes a real feed into geometry-only detections and splits the label into a harness-only channel. A real feed bridges onto the shared seam, carrying its own corpus.

Swap the fusionReuse the air track fusion, or write a variant behind the same contract (maritime vessel-track, image-mosaic). A variant is documented honestly, never passed off as identical code.

Swap the outputA recommend-only output (alert, cue, COP commit) or a simulated effector. The width missions never reach engage posture.

Keep the spineThe gate module and the signed-ledger design are reused verbatim. The authority envelope is the same shape. A new domain extends the detection type as a superset, so the core contract is untouched.

The proof it is not faked

The credibility question is whether the engine is reading the answer key. It is not, and that is proven in code on the same framework for every mission.

Metamorphic invarianceScramble, collapse, and null the ground-truth labels and shuffle the rows; the engine's output partition does not change. An engine that secretly read the label fails the non-bijective transforms, and a negative control is caught failing them.

Two senses, never conflated"Answer-key invariants reproduced" is the #08 acceptance set, graded against the oracle. "Metamorphic invariance checks reproduced" is the framework proving no label leak. Different statements about different things.

The model is off the kill chainThe deterministic gate runs the real-time path; a CI check proves no model call sits on it. The model narrates after the fact, and the narration eval flags any claim not grounded in a ledger record.

The ledger is the source of truthEd25519-signed, SHA-256 hash-chained, with RFC 6962 Merkle anchoring and a write-once anchor. Tamper-evident: any modification is detectable. A console can only replay what the ledger recorded.

What we claim, and what we do not

Five missions at a consistent, earned TRL 4 (partial 5).

Real open-source corpus, the real governed engine, the gate, the signed ledger, against a synthetic tactical scenario. Past a lab toy, short of a relevant operational environment. Earned per mission with evidence.

Real corpus, synthetic scenario, disclosed per mission.

The data is disclosed real open-source and predates the build window. The system was built in the window; the data prep was not.

Recommend-only, effectors simulated.

The width missions never reach engage posture. Nothing is disseminated, cued, or actuated for real. The human commands every consequential action.

A running prototype, not a deployment.

NIST 800-53 is an r5 mission mapping and a Rev 3-class self-assessment, never "compliant," "hardened," or an ATO.