ORRERY

Downlink passes escrowed at booking and paid on the antenna’s own signed report, conjunction warnings bought per screening, and the manoeuvre left to a named flight director.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Earth-observation operator. Passes booked and paid per pass, inside a flight director’s mandate.
• Ground-station network. Antenna time sold per pass and paid on the antenna’s own signed report.
• Space-traffic service. Screenings paid per screening, every warning signed and on the record.
• Research payload team. Passes and screenings for one payload under its lead’s mandate, without a purchasing round trip.

The problem

The ground segment still settles on paperwork. An operator books antenna time at another company’s station through a portal, the pass report comes back as a log file, and payment follows weeks later against a spreadsheet of passes that neither side can independently check. Conjunction warnings arrive by email, and when a manoeuvre is questioned afterwards, nobody can show which warning was read, who decided, or under whose authority the money moved.

The system

ORRERY is where the ground segment settles: satellite operators, ground-station networks and space-traffic services, each on its own sovereign frame. At 22:10 UTC on a Thursday, Halcyon Imaging’s scheduling agent books pass 48213 for its earth-observation satellite HALCYON-7: the network’s antenna at Punta Clara, on a headland at the southern tip of South America, acquisition due at 04:17, 120 units. The 120 units are escrowed at booking and released on one thing only: the pass report signed by the station’s own antenna agent, under an identity its frame issues on a certificate that lives hours, not years. At 04:28 the report arrives: signal acquired at 04:17:06, lost at 04:27:51, 46.8 GB received. The pass is paid exactly once, and a pass that no antenna signed cannot be paid at all.

Mara Lindqvist, Halcyon’s flight director, never fills in a purchase order. She underwrites the mission planner with one mandate, confirmed with her device key: four approved networks, one traffic service, and no single spend above 500 units without her key in hand. The planner’s purse is funded 9,000 units a month, and nothing spends what it does not hold. The scheduler is the planner’s own sub-agent: it holds no wallet, books against the planner’s purse, and every booking it makes is checked against her mandate as it stands at that moment. The planner cuts it a capability token, and a token can only narrow what its issuer holds. The traffic service screens the constellation twice a day, paid per screening through a single-use token, and signs every warning under its own identity. At 06:40 one lands: HALCYON-4 and a debris fragment, closest approach at 11:02 UTC. The decision to manoeuvre is hers alone. The priority pass that carries her burn plan up costs 900 units, so it waits on her phone until her key signs it, and a request left unanswered expires as a recorded denial.

The protocol carries authority, money and evidence, and it never commands a spacecraft: the burn goes up through Halcyon’s own mission control, as it always has. What changes is the record. The warning, her signature, the pass that carries the burn plan and the antenna’s report are each kept on an append-only record, in the order they occur, for the network, Halcyon’s insurer or the traffic service to replay. When the network finds a breach at one of its stations, it revokes that antenna’s identity, which dies in under 500ms over the event stream. A report from a revoked antenna, or from anyone but the antenna a pass contract names, is refused before anything is released.

The cast and their ceilings

The flow, step by step

1. At 22:10 UTC the scheduler books pass 48213: HALCYON-7 over Punta Clara at 04:17, 120 units, inside the mandate.
2. An approved network, inside this week’s budget: the 120 units are escrowed at booking. Nothing is paid yet.
3. At 04:28 the antenna signs its report: signal acquired 04:17:06, lost 04:27:51, 46.8 GB received.
4. The contract names antenna-PCL-2 as its only attesting party. The signature is its own, so the escrow releases.
5. The network is paid exactly once, and the pass lands on the ledger beside its report.
6. At 06:40 a signed warning reaches her, paid per screening: HALCYON-4 and a debris fragment, closest approach 11:02.
7. The manoeuvre is her decision. The 900-unit uplink pass waits for her key; a request left unanswered is a recorded denial.

Each need, mapped to a live primitive

The attack this chamber refuses: The cloned antenna

The attack. A copy of the antenna agent’s software, running on a peer frame with a valid federation channel, submits a signed report for pass 48219, a pass the Punta Clara antenna never took, to collect its escrow.

Why it fails. The pass contract names antenna-PCL-2, by its identity on the network’s frame, as the one party whose report releases it. The report arrives over a valid mTLS channel, and the channel proves one thing: which frame couriered it. The principal inside the report is the copy, and copying an agent’s code does not copy its identity, which only its own frame issues. The contract checks the principal against the party it names before any release is considered.

What actually happens. The escrow does not move. Pass 48219 stays unpaid until the named antenna reports or Halcyon disputes the booking, and the refused report is recorded with the frame that couriered it.

The attack this chamber refuses: The runaway scheduler

The attack. A scheduler compromised through a build server tries to book 400 passes in an hour, 48,000 units of antenna time, each booking kept under the 500 units at which the flight director’s key is required.

Why it fails. The scheduler never holds Halcyon’s budget. It books on a capability token cut from the planner’s mandate, whose caveats carry the four approved networks and this week’s budget of 2,400 units, debited atomically with each booking. Every booking is checked against those caveats and the issuer’s authority as it stands now, before any escrow is touched. The flight director’s key does not stop this attack, because each booking stays under her threshold; the token does, because its budget travels with the token and not with the scheduler’s intentions.

What actually happens. The burst commits no more than what is left of this week’s 2,400 units, every unit escrowed at an approved network and released only on a signed pass report. Everything past the budget is refused before a unit moves, and each refusal is recorded.

Deep architecture

ORRERY deployed: Halcyon Imaging’s frame holds the mandate gate, the pass contract, the escrow and the mission ledger; the ground network and the space-traffic service act from their own frames; the fabric between them carries signed reports and exactly-once payments. Mission control and the tracking feeds stay where they run, outside the protocol by design. The trace replays pass 48213 from booking to settled report, then the warning, the flight director’s key, and the burn that stays Halcyon’s own.

The deployment, traced

1. At 22:10 UTC the scheduler books pass 48213 at Punta Clara, 120 units, on a token cut from the flight director’s mandate.
2. An approved network, inside the week’s budget: the 120 units are escrowed at booking, on Halcyon’s own frame.
3. At 04:28 the antenna signs its report: acquired 04:17:06, lost 04:27:51, 46.8 GB received.
4. The relay couriers the report. The contract checks the principal: antenna-PCL-2, the one party it names.
5. The escrow releases on that signature, and on nothing else.
6. The 120 units cross to the network exactly once, whatever the retries.
7. The network is paid. Its own frame holds a replica of the pass, with no path to the money.
8. The pass lands on Halcyon’s ledger beside its report, replayable by the network or the insurer.
9. The traffic service screens against its own tracking data, paid per screening through a single-use token.
10. At 06:40 its signed warning reaches the flight director: HALCYON-4 and a debris fragment, closest approach 11:02.
11. The decision is hers. The 900-unit priority pass exceeds her threshold, so it waits until her device key signs it.
12. The burn goes up through Halcyon’s own mission control. The protocol carries authority, money and evidence, never a command.

Adoption, phase by phase

Discover: One week of passes, re-read as contracts.

• Runs. Nothing. Last week’s passes at one partner network redrawn as bookings, escrows and signed reports.
• Agents. None. Operations, the network and finance agree what a pass report must say before anyone is paid for one.
• Integrates. Nothing. Mission control, the network’s scheduler and the tracking feeds stay exactly as they are.
• Deliberately not yet. No escrow, no mandate, no identity for any antenna.
• Proof that gates the next phase. One historical week re-expressed as pass contracts, and both sides agree its signed reports release exactly the amounts they actually paid.

Pilot: One network, one antenna, real passes.

• Runs. A registry seat or a single-VM frame for Halcyon, federated with the network’s frame.
• Agents. The scheduler under a pilot mandate, and antenna-PCL-2 signing its own reports.
• Integrates. The antenna’s modem logs feed its reports; the network’s scheduling interface keeps the calendar.
• Deliberately not yet. One network. Screenings still arrive by email. No spend above the presence threshold.
• Proof that gates the next phase. Thirty passes booked, escrowed and paid on signed reports, with every acquisition and loss time matching the network’s own pass log to the second.

Production: The constellation on rails, warnings signed.

• Runs. Halcyon’s frame, federated with the network’s and the traffic service’s, each booted from the free licence.
• Agents. The full cast: planner and scheduler under the flight director’s mandate, one agent per antenna, the traffic service’s screener.
• Integrates. Mission control reads booked passes; the tracking feeds stay the service’s own; finance reads settlement from the ledger.
• Deliberately not yet. A second network or service on the same terms. One set of partners proves itself first.
• Proof that gates the next phase. A warning, the flight director’s signed decision and the priority pass that carries the burn plan replay from the ledger in order, and every pass in the month is paid exactly once.

Federation: Every network, one grammar of passes.

• Runs. Unchanged. New networks and traffic services bring frames or seats.
• Agents. A network’s delivery record travels with its antennas’ identities to the next operator.
• Integrates. Each new network is a signed card and a licence, not a bilateral integration project.
• Deliberately not yet. Nothing structural. Growth is stations and coverage.
• Proof that gates the next phase. An operator books and pays for a pass at a network it has never used, on the strength of reports it can replay.

Sizing

One pass, booking to signed release

sequenceDiagram
  participant Sch as pass-scheduler (Halcyon)
  participant Gat as mandate gate
  participant Esc as pass escrow
  participant Ant as antenna-PCL-2 (network frame)
  participant Rel as report relay (fabric)
  participant Con as pass contract
  participant Led as mission ledger
  Sch->>Gat: book pass 48213, 120 units
  Gat->>Esc: inside the caveats: escrow at booking
  Ant->>Rel: pass report, signed: AOS 04:17:06, LOS 04:27:51, 46.8 GB
  Rel->>Con: couriered, principal checked
  Con->>Esc: release on the signature of the named antenna
  Esc-->>Led: released exactly once, append-only
  Note over Rel: a valid channel proves the courier, never the principal
  Note over Gat: above 500 units the flight director signs with her device key

Topology, as declared

flowchart LR
  FD(["Mara Lindqvist<br/>flight director"]) -->|"key above 500"| G{"mandate gate<br/>networks, budget, key"}
  S["pass-scheduler"] -->|"pass 48213"| G
  G -->|"120 units, escrowed"| E["pass escrow"]
  A["antenna-PCL-2<br/>Punta Clara"] -->|"report, signed"| C{"pass contract<br/>names its antenna"}
  C -->|"release, once"| E
  E --> L[("mission ledger<br/>replayable")]
  T["traffic-screener"] -.->|"warning, signed"| FD

Standing it up

• Infrastructure. Each operator, network and traffic service on its own frame, federated, booted from the free licence and pre-built images. Nothing to write.
• Agents. A planner and a scheduler per operator, one agent per antenna, one screener per traffic service. Scheduling logic and flight dynamics stay the operator’s; the SDK carries identity, payment and attestation.
• Integration. Mission control, the network’s scheduling interface and the traffic service’s tracking feeds. This is where the real time goes, and it stays with the teams that run those systems.

Runs beside what you already have

• Mission control software. Commands, telemetry and flight dynamics stay where they run. A booked pass carries the mission control pass ID, and the burn goes up the way it always has.
• Ground-station scheduling interfaces. A booking made through the network’s interface becomes an escrowed pass contract. The network’s scheduler still owns the antenna calendar.
• Space surveillance data feeds. Screenings run on the traffic service’s own data. Each warning arrives signed and paid for, and stays on the record beside the decision it informed.
• Billing and pass accounting. Passes settle from escrow on the signed report. Finance reads settlement instead of reconciling pass logs against invoices.

A full sovereign frame is nine containers and boots in about two minutes, on anything from a Raspberry Pi to a rack. That is cheap enough to run the whole system in parallel with the legacy stack: the old system keeps running, real work mirrors onto the rails, and you compare ledgers until the evidence settles the argument. Nothing is ripped out.

Planned: a public proxy library. Free, ready-made connectors for the systems above and whatever else a merge needs, so the bridge is an import, not an integration project.

What this does not claim

• ORRERY does not command spacecraft, compute orbits or screen conjunctions. It carries identity, authority, money and evidence for the services that do.
• Spectrum licensing, launch and space-object registration stay with the regulators and operators that hold them. A caveat narrows what an agent may book; it grants no licence to transmit.
• The decision to manoeuvre stays with the operator’s flight director. A signed warning proves who said what and when, not that the screening was right.
• No conformity with any national space law, spectrum rule or export-control regime is claimed or implied.