Evolved into a pure Headless API SaaS platform.
That comparison is a commitment, not a slogan. A solver earns its place the way Gurobi did — by being callable from anything, by being fast, and by publishing numbers that other people can reproduce. So every claim on this page carries the published value it was checked against and the value the engine actually returned. Where a number is not yet measured, it says UNKNOWN. It never says zero.
You need a second opinion that is independent of your primary tool and fast enough to sit inside a decision loop. Every response names the library and symbol that produced it, so a disagreement is traceable rather than mysterious.
Trade studies want a solver, not an application. No console, no seats, no per-user licence — a request goes in, arrays come back, and the whole thing scripts.
The force model is stated in full and the terms are named: EGM96 zonals to degree 8, the 1PN Schwarzschild term from IERS Conventions 2010, Lense-Thirring, third bodies from your own ephemeris. Nothing is folded into an opaque constant.
Free burner keys, and a portal built to be read rather than skimmed. Every worked example below is a real request against a real engine with the published value it is checked against printed alongside.
NOTE FOR PROCUREMENT · The technical depth on this page is deliberate and it is the commercial argument. This product sells exactly one thing — that the mathematics is correct and that you can check it without our help. A page that asserted rigour instead of demonstrating it would be asking you to take our word for the only thing that matters.
EACH MODULE ADDRESSABLE INDEPENDENTLY · STATUS STATED PER MODULE, NEVER AVERAGED.
| Module | What you send | What comes back | Engine | Status |
|---|---|---|---|---|
| Delta-V & transfer targeting | Two position vectors and a flight time; or two circular radii | Terminal velocities of the transfer arc; Hohmann and plane-change budgets | lambert · maneuvers · tensor_engine | LIVE |
| Conjunction & collision probability | A CCSDS CDM, or relative state plus combined covariance and hard-body radius | Probability of collision by Foster's method, miss distance, risk tier | conjunction · frames | LIVE |
| MicroKinetic force recovery | A predicted and observed state time series, spacecraft mass, optional area | Best-fit perturbing force in newtons with a one-sigma uncertainty, and a physical classification: drag, solar pressure, thermal recoil, propellant leak | micro_kinetic | LIVE |
| Harmonic orbit propagation | State vector, step, count, and how much of the gravity field you want | An integrated arc under zonals J2–J8 plus post-Newtonian terms | propagator · geodesic_batch | LIVE |
| Constellation grid harmonisation | Walker parameters i : T/P/F, altitude, planning horizon | Slot geometry, secular nodal and apsidal drift, nearest tesseral commensurability, slot-loss probability over the horizon | harmonic_propagation · elements | LIVE |
| Continuous low-thrust | Mass, thrust, specific impulse, target altitude | Edelbaum spiral budget, propellant consumed, revolution count, and an explicit convergence flag | continuous_thrust | LIVE |
| Space weather & drag environment | Altitude, F10.7 flux, geomagnetic index | Atmospheric density from NRLMSISE-00 | kamodo_weather · nrlmsise-00 | LIVE |
| Deep space & relativistic ephemeris | State, epoch, and your Chebyshev ephemeris coefficients | Long-arc trajectory with third bodies evaluated at each integration stage, plus a SHA-256 of the ephemeris that produced it | ephemeris · propagator · cr3bp | LIVE |
| Deterministic verification | — | Enclave attestation and a signed proof log binding a result to the exact image that produced it | enclave / NSM | LIVE |
| Non-conservative force model | A state, a ballistic coefficient, and an atmosphere callback; optionally a Sun ephemeris | Drag and radiation-pressure acceleration, and an orbit that can actually decay | nonconservative · kamodo_weather | LIVE |
| State transition matrix & covariance | A state, a 6×6 covariance at your OD epoch, and a target epoch | Φ and P = ΦPΦᵀ + Q, with the 3×3 position block ready for the Pc engine | covariance · propagator | LIVE |
| Uncertainty realism index | The same covariance and span | A dimensionless curvature index and a valid / not-valid verdict on the linear map | covariance | LIVE |
| Close-approach screening | Two states at a common epoch and a screening window | Every range minimum: TCA, miss, relative velocity, and the sampling adequacy flag | screening · propagator | LIVE |
| Avoidance manoeuvre design | A conjunction, a burn epoch, a Pc threshold, and optionally mass and Isp | Minimum ΔV in RIC, propellant, achieved Pc from a re-screened trajectory | avoidance · screening · covariance | LIVE |
| Manoeuvre detection | A residual time series against a predicted arc | Impulsive / continuous / quiescent verdict, ΔV and epoch with uncertainties | maneuver_detect | LIVE |
| Ballistic coefficient estimation | A residual arc and the orbit-averaged density it is conditional on | CdA/m with separate fit and total uncertainty; a manoeuvre flag if drag is not the story | bc_estimate | LIVE |
| Orbital lifetime & disposal | An altitude, a ballistic coefficient, and an atmosphere callback | Days to re-entry with a bracket from re-integrating at the uncertainty edges | bc_estimate · kamodo_weather | LIVE |
| Third-body ephemeris | Chebyshev coefficients for the bodies you want included | Body position and velocity at a split epoch; a refusal outside the supplied span | ephemeris | LIVE |
| High-order integration | The same propagation request, with the integrator selected | An order-8 Störmer-Cowell arc, or an honest fallback notice below eight steps | integrator_sc8 | LIVE |
| Thermal & eclipse | A node network, an orbit, and a beta angle | Transient node temperatures with an orbit-driven eclipse fraction | thermal | LIVE |
| Libration-point orbits & manifolds | A mass ratio, a collinear point, and a family — planar Lyapunov or halo | The differentially corrected periodic orbit and its period, the monodromy eigenvalues and stability index, and the stable and unstable manifold trajectories seeded around it — with the residuals that say whether to believe any of it: whether the orbit closed, whether the Jacobi constant held, and whether the transition matrix stayed symplectic | cr3bp | LIVE |
The probability integral is implemented and verified. It scores a conjunction between two objects you supply — both states, or the conjunction geometry directly. We do not screen a catalogue on your behalf: finding which objects come close to yours is the job of your own screening or your conjunction data provider, and it is stated here rather than left for you to discover.
Cryptographic attestation binds a result to the measured enclave image that produced it. The path is built: add ?certify=true to a physics call and the enclave signs the computation, returning a certificate over a SHA-256 of your request rather than the request itself. The measurement it attests to and the AWS root it chains back to are both published in the technical documentation, so the certificate can be checked against them without asking us anything.
EVERY ROW IS AN OUTSIDE ANCHOR — A PUBLISHED VALUE OR A STRUCTURAL INVARIANT · NOT A SELF-COMPARISON.
An engine that agrees with itself proves nothing. Each anchor below is a quantity somebody else measured or derived, published, and can be looked up independently — Einstein's perihelion advance, the sun-synchronous condition, the inclination drift every geostationary operator budgets against. If our number and theirs disagree, ours is wrong.
The lower rows are a different kind of anchor and in some ways a stronger one. A structural invariant is not a number to match but a property the mathematics forces — a gravity gradient whose trace must vanish because the potential is harmonic, a conservative flow that must preserve the symplectic form, a determinant tied to a Jacobian trace by Abel's identity. A tolerance can be met by a lucky cancellation. An identity cannot.
| Quantity | Published anchor | This engine | Source |
|---|---|---|---|
| Mercury perihelion advance | 42.98 ″/century | 42.9807 | Einstein 1915; general relativity, 1PN Schwarzschild term |
| LAGEOS perigee advance | ≈ 3.28 ″/yr | 3.2791 | Same term, four orders of magnitude away in μ |
| Lense-Thirring, relative size | ≈ 1 % | 1.257 % | LAGEOS: 31 mas/yr nodal drag against 3300 mas/yr Einstein precession |
| Critical inclination | 63.4349° | < 1e-4° offset | arccos √(1/5); apsidal drift vanishes — the Molniya condition |
| Sun-synchronous nodal rate | 0.98565 °/day | 0.99015 | 360/365.2422, from a numerically integrated J2–J8 arc |
| GEO luni-solar inclination drift | 0.75 – 0.95 °/yr | 0.75493 / 0.95205 | Both extremes of the 18.6-year lunar node cycle |
| Lunar third-body acceleration, LEO | ≈ 1e-6 m/s² | 1.242e-06 | Montenbruck & Gill, Satellite Orbits, Table 3.1 |
| Solar third-body acceleration, LEO | ≈ 5e-7 m/s² | 5.550e-07 | Same table; the Moon dominating the Sun is itself a check |
| Geostationary period | 86164.1 s | within 5 s | Sidereal day; 1:1 tesseral commensurability detected |
| Foster Pc integral | exact arithmetic | 3.3e-16 rel. | NASA CARA encounter-plane method, checked against rational arithmetic |
| Integrator convergence order | 8 | measured ≥ 7.5 | Halving the step against a closed-form circular orbit |
| Order-8 accuracy vs RK4 | — | 2,298,924× | Same step size, 20 orbits, dt = 50 s |
| Gravity gradient, Laplace | trace = 0 exactly | 2.3e-16 of diagonal | The perturbing potential is harmonic outside the body. An algebraic identity in the Legendre recursion, so a wrong second derivative cannot hide. |
| Gravity gradient, symmetry | G = Gᵀ exactly | 0.00e+00 | It is a Hessian. Exact equality, not a tolerance. |
| State transition matrix | finite differences | 1.7e-10 worst column | Every column of Φ against a perturbed run of the full nonlinear propagation |
| Symplectic structure | ΦᵀJΦ = J | 1.4e-14 relative | Hamiltonian flow under a conservative model — and the same test correctly FAILS once drag is added |
| Phase-space contraction | det Φ = exp ∫tr A dt | 8.1e-06 relative | Abel's identity; ties the drag Jacobian to the integrator with no shared arithmetic |
| Collision probability | Monte Carlo, 4×10⁷ draws | ≤ 2.2σ | Sampled truth, sharing no quadrature with the engine, across the operational envelope |
| Conjunction geometry | R δu cos(i/2) | 7.1e-09 relative | Closed form for two equal-radius circular orbits crossing at a shared node |
| Avoidance manoeuvre | brute force, 684 directions | 0.1% of minimum | Model-free search over the real objective, magnitude bisected on the probability engine |
| Drag secular drift | CW constant tangential thrust | 0.94825 vs 0.9468 | Along-track response including the bounded oscillatory term, against propagated arcs |
| Ballistic coefficient | known CdA/m, 16× range | 0.001% worst | Recovered from residuals between two fully propagated arcs |
| Energy under drag | −½ρBv³t | 0.250% | Closed-form energy loss over one pass, against the integrated trajectory |
The sun-synchronous row reads 0.99015 against a published 0.98565, and that gap is reported rather than tuned away. It is an osculating rate measured over a single day from an integrated arc, compared against a secular condition — the two are not the same quantity, and forcing agreement would mean fitting the engine to the test. Numbers that disagree are more informative than numbers that match, and both are printed.
THREE LAYERS · EACH ONE CONSTRAINS THE ONE BELOW IT.
What forces exist, and how large each one is. The central term, then the Earth's oblateness as zonal harmonics, then third bodies, then relativity — added in descending order of magnitude so a caller can truncate anywhere and know what they gave up.
Turning forces into answers. Two regimes, and conflating them is the most common way to get a manoeuvre budget wrong by a factor that matters.
IMPULSIVE — Lambert's problem in universal variables with Stumpff functions. The burn is instantaneous relative to the orbit, so Tsiolkovsky applies directly and the transfer is a conic.
CONTINUOUS — Edelbaum for low thrust, where the vehicle spirals over hundreds of revolutions and the quasi-circular assumption has to be checked rather than assumed. The engine reports whether it held.
SECULAR — orbit-averaged drift rates for questions about years rather than seconds. Cheap and exact for what it answers; silent about where the spacecraft is at any given moment.
Every routine states the domain on which it is valid, and refuses outside it. This is the layer that decides whether an answer is trustworthy, and it is where most astrodynamics software is quietest.
THE SUN-SYNCHRONOUS CONDITION · ONE REQUEST, ONE CHECKABLE ANSWER.
A sun-synchronous orbit keeps a constant angle to the Sun by letting the Earth's oblateness precess its orbital plane at exactly the rate the Earth goes round the Sun: 360° / 365.2422 days = 0.98565 °/day. At 800 km that requires an inclination near 98.6°, and it is retrograde — the plane has to be tipped past the pole for the nodal regression to change sign. Here is that as an API call.
POST /v1/opm/propagate/harmonic x-api-key: GDS_Dev_Key_… { "state": [7178.137, 0, 0, 0, -1.1132, 7.3562], // km, km/s · i = 98.6° "dt_seconds": 1.0, "steps": 86400, // one day "zonal_max": 8, // J2 through J8 "include_relativity": false // isolate the gravity field }
{
"steps": 86400,
"zonal_max": 8,
"include_relativity": false,
"integrator": "rk4",
"integrator_path": "rk4", // what ACTUALLY ran
"states": [ … ],
"engine": {
"module": "geodesic.propagator",
"operation": "propagate.harmonic",
"execution_ms": 184.6
}
}
// RAAN drift over the arc: 0.99015 °/day
// sun-synchronous condition: 0.98565 °/day
integrator is what you asked for; integrator_path is what ran. They differ when the order-8 scheme declines an arc shorter than its own order and falls back. Reporting only the request would let that substitution pass unnoticed.
Both integrators are fixed step. Perturbing μ by one unit in the last place and integrating a day moved a fixed-step result by 8.1e-9 km and an adaptive one by 4.6e-1 km — 57 million times more, because the step controller reacted to the last bit and the two runs stopped being the same computation.
Every response names the module and the operation that produced it. When two tools disagree, the first useful question is which code actually ran — and that should not require a support ticket to answer.
EIGHT RULES · THEY ARE ENFORCED IN CODE, NOT ASPIRED TO IN DOCUMENTATION.
These came out of auditing our own engines, not out of a whiteboard. Each one exists because its absence had already produced a wrong number somewhere, and the failure was instructive enough to make into a rule.
Unknown renders as --, null, or a sentinel that cannot be mistaken for data. Never zero. A zero that means “we did not compute this” is how a manoeuvre gets flown on a number nobody produced.
A test that compares an engine to itself passes when the engine is wrong. Every verification target is a published value from outside this organisation.
Outside its domain, a method returns an error. A confident wrong answer is worse than no answer, because it does not prompt anyone to check.
Every struct layout is asserted against the C ABI at import, and a library that cannot load stops the process. Two engines had never loaded at all, and a fallback was reporting them healthy while they returned numbers that came from nothing.
Responses carry the library, the symbol, the integrator that actually executed, and which code path produced the trajectory. Substitutions are visible.
A recovered force is returned with its one-sigma uncertainty at every layer through to the response. A force without one invites a decision the data may not support.
Where a faster method would make results depend on the last bit of a library call, the slower reproducible one wins. Reproducibility is the product.
New force models are added beside the old ones, never through them. A result that has been validated must not move because something unrelated was improved.
NAMED SPECIFICALLY · INCLUDING WHERE WE ARE ALIGNED RATHER THAN COMPLIANT.
The engines are F´-aligned passive-component architecture, and the wording is chosen precisely. They are not NASA F´ ports: F´ is JPL's C++ framework with an FPP autocoder generating C++ base classes, and there is no FPP model and no autocoded topology here — the engines are plain C in shared objects reached through a ctypes bridge. What is true, and what the alignment refers to, is that every engine matches F´ passive-component semantics exactly: pure, re-entrant, no file-scope mutable state, running in the caller's context with no thread and no queue. We state the weaker claim because the people most likely to read the stronger one are the people most likely to know it is wrong.
THE THINGS NO AMOUNT OF PHYSICS IMPLIES · STATED PLAINLY.
Outputs are advisory computational products. The mathematics is checked against published references; the system holds no airworthiness, launch, or operational authority and is not flight certified. Every manoeuvre, avoidance and station-keeping decision requires explicit Flight Dynamics Officer sign-off inside the operator's own certified process. We advise; you execute.
No state vectors, ephemerides, telemetry or mission files are retained, with one stated exception: a catalogue uploaded for signed derivation is held in memory for 24 hours, then expires. Request metadata — key identity, timestamp, module, step count — is retained for billing and audit, because a service that could not bill could not run. That distinction is stated rather than folded into an absolute claim, because counsel will test the absolute one. Customer data is never used for model training.
Conjunction assessment and manoeuvre planning sit near controlled-technology classifications in several jurisdictions. Our posture is UNKNOWN and is published as unknown rather than asserted as clear. It will be resolved before any non-domestic subscription is issued. If your acquisition requires a determination now, contact us before evaluating.
Three tiers, plus a custom key builder. Burner is intended for students, academics and researchers on a verified institutional domain, and runs real propagation rather than schema checks alone. Dev carries a large Step allowance for integration and trade studies. Flight Ops service carries uncapped compute — a request-rate cap still applies — and adds the near 100 Hz telemetry stream. No tier is open yet: issuance begins with the production deployment, and every tier reads PENDING until it does.
SUBSCRIPTION DETAIL →When a manoeuvre is questioned months afterwards, a screening log is an assertion — it records what a system says it did. Every computation here can instead carry a signature produced inside the enclave, checkable against a published measurement by somebody who was not present and does not have to trust us. The Ledger that records consumption is append‑only and carries its own verification endpoint. The signing and the chain already exist; what an underwriter or a compliance function needs exported, and in what form, is the part we would rather agree with you than guess at. Offered under agreement rather than self‑serve, and PENDING with the rest.
ENQUIRE →For an operator or platform putting its own service in front of these engines. The licence covers the attested execution layer beneath your product, so your customers can verify a result against a measurement they pin themselves — without trusting your infrastructure, or ours. It is not an API key and carries no rate limit or step allowance; it is an annual agreement, scoped to what you are embedding and where. PENDING until the production deployment.
ENQUIRE →Outputs are advisory computational products. Results are signed and independently verifiable; the system is not flight certified and carries no airworthiness, launch, or operational authority. All manoeuvre, avoidance, and station-keeping decisions require explicit Flight Dynamics Officer sign-off within the operator's own certified process. Simulated or unpopulated parameters are surfaced as -- or UNKNOWN and must never be interpreted as nominal values.