The operating model itself. Every requirement, in code.
| Requirement | St | Receipt · code |
|---|
| Five solutions, at least one at TRL 4 | MET | Five governed missions on one engine (#08 air, #07 FOB, #01 seabed, #02 convoy, #04 swarm); #08 TRL 4 on real drone-track data. c2-missions/src/runner.ts |
| A human approves every irreversible action, with a live abort | MET | Graduated-authority gate + always-live ABORT→MANUAL bar. c2-gate/src/gate.ts |
| The AI is held off the decision path; assists and narrates, never authors | MET | No-model-call CI test on the gate path; narration role IAM-denied from the ledger. infra/modules/runtime/hardening.tf |
| A tamper-evident audit trail of every human-machine interaction | MET | Ed25519-signed, SHA-256 hash-chained ledger + Merkle proofs + S3 Object-Lock WORM. core/src/ledger.ts |
| Authority and lawful posture scoped to each mission, enforced before any action | MET | Authority envelope per mission = ledger entry #1, enforced by the gate. contracts/src/authority-envelope.ts |
| One shared substrate; a new mission is a config change, not a new build | MET | Every mission imports the same runGovernedMission; a test asserts referential identity of the gate. test/one-engine.test.ts |
| Operation in denied or degraded conditions, reconciling on reconnect | MET | Greengrass v2 edge, on-device ledger, store-and-forward, reconcile-on-reconnect. infra/modules/edge |
| Real data, each mission's scope stated plainly | MET | Real NOAA AIS / ADS-B / SkyFusion + a SCOPE OF CLAIM panel per card. datasets/REAL-CORPORA.md |
8 of 11 in code. 3 disclosed as physics/profile. 0 faked. (#4 Counter-UAS is a separate use case with no published requirements.)
| Requirement (11) | St | Receipt · code |
|---|
| Multi-modal detection (RF, optical, acoustic, radar) | PARTIAL | RF + radar + EO/IR fused; acoustic on the same SensorAdapter seam, designed not wired. c2-fusion/src/fuse.ts |
| Autonomous threat classification and prioritization | MET | GNN + Kalman + JPDA fusion, LLM-free. c2-fusion/src/fuse.ts |
| Real-time trajectory prediction | MET | IMM prediction in fusion. c2-mission/src/missions/ch08.ts |
| Automated countermeasure selection and deployment | MET | Effector selection/tasking (NINJA-EW, LEONIDAS-HPM), simulated. c2-mission/src/effector.ts |
| Integration with existing air defense systems | MET | MITRE CoT over TAK; BSI Flex 335 / SAPIENT. c2-fusion/src/cot.ts |
| Friendly force identification and deconfliction | MET | Real ADS-B Cessna 172 (a24c5a) held cooperative; two-person rule. c2-mission/src/missions/ch07.ts |
| Operation in degraded network conditions | MET | Greengrass v2 DDIL edge + store-and-forward. infra/modules/edge |
| Must operate in all weather conditions | DISCLOSED | Weather-independent by design (radar/RF physics; EO/IR the clear-air adjunct). Not separately modeled; stated, not faked. |
| Limited power availability | DISCLOSED | Greengrass SWaP-constrained forward-node profile; demo runs on EC2 for reproducibility. No measured power budget claimed. |
| Restricted RF emissions in certain sectors | MET | RF NO-EMIT sector enforced in the gate. c2-gate/src/gate.ts |
| Rules of Engagement (ROE) compliance | MET | Graduated authority, positive hostile-ID at weapons-tight, two-person rule. c2-gate/src/gate.ts |
These recur in almost every use case. One engine satisfies them across all of them.
| Requirement that recurs everywhere | Appears in | The one artifact that meets it |
|---|
| Human approves every irreversible action | #4 #6 #8 #9 #11 #16 #17 #19 #22 | c2-gate/src/gate.ts |
| Tamper-evident / comprehensive audit trail | #8 #12 #16 #17 #19 #20 #22 | core/src/ledger.ts |
| Denied/degraded operation · store-and-forward | #7 #8 #9 #10 #11 #15 #22 | infra/modules/edge |
| Grounding / citations / no hallucinated references | #6 #15 #17 #18 #19 #22 | LLM off the decision path; every claim traces to a ledger record. hardening.tf |
| Same architecture, new domain by config not code | #19 #21 #22 | Swap the adapter, keep the runtime: ais-adapter.ts · imagery-adapter.ts |
| Use case | Meets | How · receipt |
|---|
| #20 FedRAMP Threat Detection real infra | 2+3 / 7 | NIST 800-53 mapping (SI/AU/IR/AC), GuardDuty/CloudTrail, audit-evidence export - real Terraform. .kiro/specs/security-800-53-mapping · infra/modules/observability |
| #21 Disaster Response Data Fusion architecture | 3+3 / 8 | Pluggable connectors + common model + near-real-time - our contract-first adapter pattern is "swap the source, keep the architecture." contracts/src/events.ts |
| #15 Intelligence Fusion (edge) | 3+1 / 7 | Austere-edge <500W, store-and-forward, explainable output with source attribution + confidence. infra/modules/edge |
| #19 Citizen Services Chatbot | 3+2 / 7 | Tamper-evident interaction log, human-escalation on confidence, config-driven multi-tenant substrate. core/src/ledger.ts + the gate |
| #16 Payment · #17 Policy · #10 Disaster · #12 Media | 1-2 each | Human-in-loop checkpoints + comprehensive audit trails + grounding, inherited from the governed runtime the moment a domain adapter is built. |