ENGINE STATUS NOMINAL | MISSION CUSTODY ZERO | CLASS ADVISORY

UTC --:--:-- | JD(UTC) -- | FRAME GCRF/J2000

REST JSON TLS 1.3

TECHNICAL DOCUMENTATION //API v1

Talking to the Gateway

One HTTPS request per operation. No SDK is required and none is privileged — every example here is curl because anything that speaks HTTP speaks this API. Responses are application/json, serialised through orjson, with IEEE-754 doubles round-tripped exactly.

PROVING GROUND MEASURED →

This page says how to call the engine. That one says how you know the numbers coming back are right — with the method, the reference, and what each result does not establish.

Quickstart

CONVERT A STATE VECTOR TO ORBITAL ELEMENTS

curl -sS https://api.geodesicspacesystems.com/v1/opm/elements \
  -H "x-api-key: $GDS_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "position_km":   [7000.0, 0.0, 0.0],
    "velocity_km_s": [0.0, 7.5461, 0.0],
    "mu": 398600.4418
  }'

RESPONSE

{
  "semi_major_axis_km": 7000.0,
  "eccentricity": 1.4e-16,
  "inclination_deg": 0.0,
  "period_s": 5828.517,
  "specific_energy": -28.4715,
  "engine": {
    "module": "geodesic.elements",
    "operation":  "elements.osculating",
    "execution_ms": 0.0084,
    "offloaded": true
  }
}

THE ENGINE BLOCK IS ON EVERY RESPONSE

It names the module and the operation, the wall time spent inside the native call, and whether the call was offloaded from the event loop. When two tools disagree the first useful question is which code actually ran; that should be answerable from the response rather than from a support ticket.

Authentication and tiers

A bearer token on every request. Keys are stored as HMAC-SHA-256 digests — the plaintext is shown once at issue and never again, so a compromised database does not yield working keys.

Tier	Who	Requests per minute	Compute rate steps per minute	Per call max steps	Total allowance	Validity	Telemetry
GDS_Burner_Key	Students, academics, researchers and engineers on a verified institutional domain. 3 keys per domain.	300	300,000	6,000	1,000,000 steps	48 h	—
GDS_Dev_Key	Integration, trade studies, commercial evaluation	1,200	12,000,000	12,000,000	40,000,000,000 steps	subscription	—

THE ALLOWANCE IS NOT THE PER-CALL LIMIT

The Allowance column above is what a key may spend in total. A single request is bounded separately, by the endpoint's own schema: /v1/opm/propagate accepts at most 100,000 steps per call and answers 422 above that. Longer arcs are several calls, each chained on the state the last one returned.

Your tier may bound a single call lower than the schema does, and the lower of the two wins. A GDS_Burner_Key is capped at 6,000 steps per call — enough for one full low-Earth orbit at one-second resolution in a single request.

That ceiling is the response, not the physics. Every step returns a state, so a hundred thousand of them is roughly 15 MB of JSON — measured here, 17.8 ms of integration inside a 693 ms call. Append ?want_trajectory=false and only the final state comes back: the same integration, the same state to the last bit, in 21 ms and 522 bytes. Ask for the arc when you want the arc.

CAPACITY AND REDUNDANCY

Every tier runs on the same fleet, which spans two regions so no tier depends on a single machine. Capacity is provisioned rather than elastic — there is no autoscaling, and nodes are started deliberately rather than in response to load.

Redundancy is a property of the platform rather than something a tier buys. A machine reserved for one customer is still one machine, and its failure is total for whoever is on it; spreading work across many is the stronger guarantee, so it is how the service is built for everyone.

Isolation of your data does not depend on any of this. Every computation executes inside the enclave, and the parent host has no address translation into that memory — whichever machine serves the request. A catalogue uploaded for signed derivation is the one exception: it is fingerprinted and signed inside the enclave, then held in memory on the Sweep server for 24 hours until it expires.

WHAT EACH KEY UNLOCKS

The two keys are cumulative: a Dev key reaches everything a Burner key does.

GDS_Burner_Key — message validation on /v1/opm/validate, /v1/cdm/validate and /v1/oem/validate, plus real propagation on /v1/opm/propagate. The validators are free: they run Pydantic only, never reach an engine, and never draw down your allowance, so you can lint a message generator against the real schema without spending anything. Propagation is metered.

GDS_Dev_Key — the full engine set: harmonic, ephemeris and non-conservative propagation, covariance and realism, conjunction assessment and screening, avoidance design, manoeuvre detection, ballistic estimation and decay, constellation planning, libration-point orbits and manifolds, thermal, atmospheric density, SRP and low-thrust spiral.

ARRANGED BY CONTRACT, NOT ISSUED AS KEYS

These are not tiers of the key above and are not reached by upgrading one. Each is arranged separately and deployed on a dedicated server.

Flight Ops service — everything above, with no compute ceiling of any kind, plus the near 100 Hz telemetry channel at /v1/stream/telemetry. The streaming channel is what the service provides and is the one capability a custom key cannot purchase separately.

Evidence service — signed receipts and an exportable audit chain, for compliance and underwriting. Arranged under agreement.

Engine Licence — the attested execution layer beneath your own service rather than an endpoint you call. Annual and negotiated.

Signed execution is available on every tier. Append ?certify=true to a physics call and the enclave signs the result — a free key can verify that claim rather than take it on trust.

SET A READ TIMEOUT ON THE STREAM

If the node serving your stream fails hard, nothing will tell you. A WebSocket cannot migrate between nodes, so the stream ends — but a node that loses power or its network sends no close frame, no FIN and no RST. Your socket stays open and silent, and the frames simply stop. We measured this deliberately rather than assuming it.

So the detection time is yours, not ours. Set a read timeout on the socket and reconnect when it fires. At roughly 100 Hz a gap of more than a few hundred milliseconds is already anomalous; a timeout of 5 s costs nothing and bounds your exposure. A client with no read timeout will wait on a dead node indefinitely.

Reconnection itself is fast and is sized for the case where every stream comes back at once: a fleet-wide reconnect after a node loss was measured at 64 of 64 streams restored with zero throttled and zero refused, the whole burst completing inside 100 ms. A graceful node stop is different and better — the socket closes cleanly, your client learns immediately, and the measured gap was 0.30 s. It is the ungraceful case that needs the timeout.

Measured on the shared evaluation fleet. Every figure in this box came from keys served over shared connections. A dedicated deployment has not been measured, and these numbers should not be assumed to carry across to one.

RECONNECTION IS NORMAL OPERATION, NOT ERROR HANDLING

A long-lived stream will be closed on you, repeatedly, while everything is working correctly. Over a 60 minute run of 120 concurrent streams we measured 50.8% closed before the hour was out — a half-life of roughly 59 minutes. Nothing was wrong. Plan for a stream to last tens of minutes, not days.

It is the connection path, not our origin, and we can show that rather than assert it. The same load driven straight at the service, bypassing the public path, held 60 streams for 40 minutes with zero closes and again 60 for 35 minutes with zero closes — 14.4 million and 12.6 million frames, both at a clean 100 Hz. At the public rate those runs should have lost about twenty streams between them. They lost none. We cannot remove this, so we are telling you about it instead.

So treat a close as a reconnect, not as an incident. Reconnect on any close and on your read timeout, with a short jittered backoff — a few hundred milliseconds, randomised, so a fleet of your own clients does not return in lockstep. Do not page a human on a closed stream. Do not treat close frequency as a service-health signal; it measures the network between us, not the service.

A reconnected stream resumes from live, not from where it stopped. Telemetry is a sampled feed of a running propagation, not a replayable log — there is no cursor, no backfill and no gap-filling on reconnect. You lose the samples in the gap and nothing else. If your application needs continuity across a gap, interpolate locally or re-request the interval over /v1/opm/propagate, which is deterministic and will give you the same states.

During a failover you may also see a brief 530 on ordinary requests. That is the edge reporting it could not reach an origin; the request never arrived, so nothing was executed, recorded or metered. Retry it. During a failover the window is seconds and a retry succeeds. A 530 that persists means no node is currently serving — the fleet is started for evaluation rather than held up continuously, and that is a documented dormant state rather than an outage. A 530 is the one status on this API that means “ask again” rather than “something about your request was wrong”.

All of the above was measured on the shared evaluation fleet, where connections are shared across evaluating users. A contract is deployed on a dedicated server and has not been measured; expect to reconnect either way, but do not plan against these particular rates on one.

WHEN YOU REACH A LIMIT

Four limits, four distinct answers. Each names which one you hit, so you never have to guess.

You did this	Status	error	reason
Called an endpoint above your tier	403	FORBIDDEN	INSUFFICIENT_TIER
One call exceeded your per-call step ceiling	422	STEP_CEILING_EXCEEDED	TIER_MAX_STEPS_PER_REQUEST
Too many requests, or too many steps, this minute	429	RATE_LIMIT_EXCEEDED	TIER_RATE_CAP
Spent your total allowance	429	QUOTA_EXCEEDED	TIER_QUOTA_EXHAUSTED

A refused request costs you nothing. The meter reads before it writes, so a call rejected for any of the reasons above does not draw down your allowance. Nor do the validators, or health and documentation endpoints.

DOMAIN APPROVAL IS MANUAL

Institutional domains are added and burner keys approved by a human at Geodesic. Requests beyond the three-key allocation enter a queue rather than being refused outright. This is deliberate: an automatic issuer for a free tier in this domain is an automatic issuer for anyone.

CUSTOM KEYS

If a mission profile does not fit a tier — a hundred runs of a hundred thousand steps, a fixed window, a specific module set — the key builder in the portal composes one. Ceilings exist to keep shared capacity honest, not to force an upgrade.

Endpoint reference

BASE · https://api.geodesicspacesystems.com

Method	Path	Purpose	Tier	Status
ORBIT PARAMETER MESSAGE
POST	/v1/opm/validate	Check a CCSDS OPM without spending engine time	any	LIVE
POST	/v1/opm/elements	State vector to osculating classical elements	any	LIVE
POST	/v1/opm/transfer	Lambert boundary-value solution between two positions	dev	LIVE
POST	/v1/opm/propagate	RK4 with optional J₂ and a Delta-F force term	dev	LIVE
POST	/v1/opm/propagate/harmonic	Zonals J₂–J₈ plus post-Newtonian terms	dev	LIVE
POST	/v1/opm/propagate/ephemeris	As above, plus third bodies from your ephemeris	dev	LIVE
POST	/v1/opm/propagate/nonconservative	As above, plus atmospheric drag and solar radiation pressure	dev	LIVE
POST	/v1/opm/covariance	Map a 6×6 covariance to a target epoch by state transition matrix	dev	LIVE
POST	/v1/opm/covariance/realism	Uncertainty realism index: is the linear map still meaningful	dev	LIVE
POST	/v1/ballistic/decay	Secular decay rate and orbital lifetime with an uncertainty bracket	dev	LIVE
POST	/v1/ballistic/estimate	Estimate C_dA/m from a residual arc	dev	LIVE
CONJUNCTION & EPHEMERIS
POST	/v1/cdm/validate	Check a CCSDS CDM	any	LIVE
POST	/v1/cdm/screen	Foster probability of collision and risk tier	dev	LIVE
POST	/v1/conjunctions/screen	Find every close approach between two states over a window	dev	LIVE
POST	/v1/conjunction/assess	Screen, propagate both covariances, and score P_c in one call	dev	LIVE
POST	/v1/cam/design	Minimum-ΔV avoidance manoeuvre at a chosen lead time	dev	LIVE
POST	/v1/oem/validate	Check a CCSDS OEM	any	LIVE
HARDWARE & ENVIRONMENT
POST	/v1/hardware/spiral	Edelbaum low-thrust transfer budget	dev	LIVE
POST	/v1/hardware/microkinetic	Perturbing-force recovery from a residual series	dev	LIVE
POST	/v1/sda/maneuver	Impulsive manoeuvre detection: ΔV, epoch, and classification	dev	LIVE
POST	/v1/hardware/thermal	Transient node temperatures with an orbit-driven eclipse fraction	dev	LIVE
POST	/v1/hardware/density	NRLMSISE-00 atmospheric density	dev	LIVE
POST	/v1/hardware/srp	Projected area toward the Sun from an ingested mesh	dev	LIVE
CONSTELLATION & STREAM
POST	/v1/constellation/plan	Walker slot geometry with secular drift and resonance	dev	LIVE
WSS	/v1/stream/telemetry	Continuous propagated frames at a fixed cadence	flight ops	LIVE
CISLUNAR
POST	/v1/cr3bp/manifold	Libration-point periodic orbit — planar Lyapunov or halo — with its monodromy spectrum and invariant manifolds	dev	LIVE
SERVICE
GET	/v1/dictionary	Machine-readable interface dictionary: channels, ids, units, limits	any	LIVE
GET	/v1/entitlements	What this key may do, and what remains	any	LIVE
POST	/v1/keys/burner	Request a free institutional key	none	LIVE
GET	/healthz · /readyz	Liveness and readiness, including per-engine load state	none	LIVE
ATTESTATION
GET	/v1/attestation	The enclave's current signing key, its PCR measurements, and the AWS attestation document that vouches for both	none	LIVE
GET	/v1/attestation/keys	Every signing key this service has used, so a certificate stays checkable after the enclave that issued it is gone	none	LIVE
GET	/v1/attestation/{key_id}	One key and its attestation document, by id	none	LIVE

EXECUTION CERTIFICATES · ADD ?certify=true TO MOST PHYSICS CALLS

Every physics endpoint above except /v1/hardware/density and /v1/hardware/srp can return a signed receipt for the computation it just performed. The signature is made by an Ed25519 key that is generated inside an AWS Nitro Enclave, never written to disk, and never leaves it — the parent host cannot read it, because there is no interface that returns it.

That alone would only be our word for it. What makes it evidence is that AWS signs a statement binding that public key to the measurement of the image it is running in, and the chain from that statement up to Amazon's own root is checkable without trusting anything we operate.

THE CHAIN, END TO END

AWS Nitro root CA          // pinned, not fetched
  → regional CA
    → zonal CA
      → this instance
        → this enclave       // leaf, ~3 h validity
           signs the attestation document
             which carries PCR0 and the
             Ed25519 public key
               which signs your certificate
                 which names your request
                 and commits to the result

WHAT THE CERTIFICATE COMMITS TO

client_digest	SHA-256 of the exact request bytes you sent
input_sha256	SHA-256 of what the enclave actually received, measured by the enclave itself
output_sha256	SHA-256 of the result, over the raw bytes the engine produced
output_bytes	those bytes, with a published layout so you can decode them yourself
input_bytes	the struct the enclave received, with a published layout — decode it and read whether it says what you asked for
engine_digest	which engine build produced it
key_id	the enclave key, resolvable at /v1/attestation/{key_id}

The request itself is never stored. Only its hash travels, which is what lets you prove a certificate is yours without us holding a copy of what you sent.

One boundary, stated plainly. Those first two hashes are both signed and nothing ties them to each other: the gateway translates your request into the numbers the engines take, and the enclave does not re-derive that translation. So the certificate alone establishes that the attested engines produced this result from the input the enclave received — not that the input was derived from your request without error.

What closes it, and how far. On most certifiable operations the certificate now carries input_bytes: the exact struct the enclave measured, authenticated by the enclave’s own signed input_sha256. The verifier checks that hash for you. Reading the numbers is yours to do — no tool can know what you meant, so a certificate that passes every check on a struct you never opened still tells you nothing about whether your inputs were used. That makes a mistranslation detectable, not impossible, and we would rather state the difference than let it be assumed.

The others make it opt-in rather than omitting it, and the reason is size rather than reluctance: /v1/opm/propagate/ephemeris, /v1/opm/propagate/nonconservative, /v1/hardware/thermal, /v1/hardware/microkinetic, /v1/sda/maneuver and /v1/ballistic/estimate ingest sample arrays or ephemeris blocks. Echoing one back would add hundreds of kilobytes to a request already near the 1 MiB limit, and most callers should not pay that on every request. Ask for it and you get it: add echo_input=true beside certify=true. Leave it off and the certificate is unchanged.

The verifier now reads the struct for you. “Decode it and read it” is fair advice for a 56-byte request and useless for a twelve-thousand-element one, so geodesic_verify.py prints input_bytes as named fields with units — including the things the bytes cannot say about themselves, such as a -1.0 meaning you omitted this and the engine chose. Pass --decode-input for every element rather than the first few.

On ephemeris_sha256, plainly. That field is computed by the gateway and carries no signature of its own, so by itself it is a checksum — it catches a truncated or mis-parsed upload and proves nothing against us. It is also, exactly, the SHA-256 of input_bytes from byte 144 onwards. So request the echo once, check it with --ephemeris-sha256, and you have chained it to the enclave’s signature; after that it is a cheap check you have grounds to trust on every later call, including uncertified ones.

VERIFY IT YOURSELF

geodesic_verify.py is standalone. Its only dependency is cryptography, and it imports nothing of ours — a verifier that ran our code would be checking our arithmetic with our arithmetic. Read it before you run it; it is short on purpose.

CHECKED AT THE ATTESTATION TIME

An enclave leaf certificate is valid for about three hours; what it attests does not expire. The chain is therefore validated against the document's own timestamp. Checking it against the current clock would reject every certificate older than an afternoon.

DETERMINISTIC MEASUREMENT

PCR0 is a SHA-384 over the enclave image. The build is pinned and normalised so that two independent rebuilds produce the same measurement byte for byte — which we verify by rebuilding. So the value is stable, and any change to the image changes it. It is not something you can rebuild yourself: the image carries our engine binaries. What you check is that the attestation is genuine and that PCR0 is the one you were told to expect.

GET THE VERIFIER

Download geodesic_verify.py, then check it against the digest opposite before you run it.

# 54,520 bytes, Python 3.9+, one dependency
pip install cryptography
python geodesic_verify.py --certificate cert.json \
    --request request.json \
    --expect-pcr0 <the measurement you pin>

SHA-256 of the file:

64a5f1d86697953d25bcc0686e8de1
a54cfbd10af390e15b416242fc864c
55ab

That digest catches a truncated or altered download. It cannot vouch for the file against anyone who controls this page — a hash published beside the thing it describes is a checksum, not a signature. The real defence is that the file is short, dependency-free and meant to be read.

HOW LONG IT STAYS VERIFIABLE

Signing keys are retained for at least 90 days from issuance. In practice the register is append-only and cannot be pruned, so keys are not going anywhere — but 90 days is the part we commit to, and a floor we can keep is worth more than a promise of forever that no service can.

Capture within 60 days and the question stops applying. An attestation document carries its own AWS certificate chain, so an exported bundle is self-contained: it re-verifies with no network access, no API, and no Geodesic. Insurers and flight-ops teams should capture on receipt.

// once, while the certificate is fresh
python geodesic_verify.py \
    --certificate cert.json \
    --export-bundle evidence.json

// any time after, offline, with no request to us
python geodesic_verify.py \
    --offline evidence.json

If the API is unreachable the verifier falls back to attestation-keys.json, a static mirror of the key register served from this site. Keep a copy of the verifier beside your bundles: formats change, and every published version stays downloadable so evidence never outlives the tool that reads it.

WORKED · THIRD-BODY PROPAGATION WITH YOUR OWN EPHEMERIS

POST /v1/opm/propagate/ephemeris
{
  "state": [42164.17,0,0, 0,3.0747,0],
  "dt_seconds": 600.0,
  "steps": 52596,          // one year
  "jd_tdb_int":  2451545.0,  // split epoch —
  "jd_tdb_frac": 0.0,        // see note below
  "zonal_max": 8,
  "integrator": "sc8",
  "third_bodies": [
    { "jd_start": 2451545.0,
      "block_days": 4.0,
      "n_blocks": 95,
      "n_coef": 13,
      "mu": 4902.800118,
      "coefficients": [ /* 3705 doubles */ ] }
  ]
}

{
  "steps": 52596,
  "zonal_max": 8,
  "integrator":      "sc8",
  "integrator_path": "sc8",
  "third_body_count": 1,
  "ephemeris_sha256":
    "c5e8ac141dbe2b86…",
  "states": [ … ],
  "engine": {
    "module": "geodesic.propagator",
    "operation":  "propagate.ephemeris"
  }
}

NO KERNEL SHIPS WITH THE ENGINE

You supply the Chebyshev coefficients — DE440, DE441, an agency set, or your own fit. We evaluate what we are given and hash it. Body positions are your input, not our output, which is what “you certify the inputs” means in practice. Twenty-five years of Sun and Moon is roughly 843 KiB, uploaded once.

WHY THE EPOCH IS SPLIT

One unit in the last place of a J2000-era Julian Date is 40 microseconds. At the Sun's 29.8 km/s that quantises its position to 1.2 metres before any physics runs. Passing whole days and a fraction separately removes that, and is the same split JPL and SPICE use.

COVERAGE IS CHECKED FIRST

A Chebyshev fit diverges outside its block, so the engine refuses rather than extrapolates. If your series does not span the whole arc the request is rejected with the JD range it does cover — before you spend the run, not partway through it.

Certification artefacts

Four fields turn a result into something you can defend to a reviewer years later. None of them require trusting us — each is checkable against material you already hold.

Field	What it binds	How you check it
engine.module engine.operation	Which module and which operation produced the numbers	Compare against the release manifest; a substitution is visible without asking us
integrator_path	The scheme that actually executed, which can differ from the one requested	Two arcs compared across sites must show the same path, or the comparison is void
ephemeris_sha256	The precise coefficient set the third-body forces came from	Re-hash your own coefficients; the digest changes on a one-ulp edit
engine_path	Whether the batch C loop or the reference Python loop produced the trajectory	The two are held bit-for-bit identical; this says which ran

REPRODUCIBILITY, SCOPED HONESTLY

Identical inputs against a pinned engine image reproduce bit-for-bit. Across different images the guarantee is weaker and we will not claim otherwise: IEEE-754 mandates correct rounding for + − × ÷ √ but not for sin, cos, pow or exp, and different maths libraries can differ in the last place. That is why both integrators are fixed step — an adaptive controller turns a last-bit difference into a different step sequence, which we measured at 57 million times the spread of the fixed-step path.

Error semantics

Errors carry a stable machine code, a human sentence naming what to change, and an F´ severity so an existing ground system can route them without a translation table. An invalid packet is dropped at the gate with 422 and never reaches an engine.

Code	HTTP	F´ severity	Meaning
VALIDATION_FAILED	422	ACTIVITY_HI	The payload did not satisfy the schema. The message names the field.
STEP_CEILING_EXCEEDED	422	ACTIVITY_HI	Requested step count is above this key's ceiling.
DOMAIN_NOT_APPROVED	403	ACTIVITY_HI	Burner key requested from an unapproved institutional domain.
FORBIDDEN	403	WARNING_LO	Valid key, but not entitled to this module.
RATE_LIMIT_EXCEEDED	429	WARNING_LO	Sliding-window rate exceeded. Retry after the header interval.
QUOTA_EXCEEDED	429	WARNING_LO	Execution allowance for the period is spent.
CAPACITY_EXHAUSTED	503	WARNING_HI	Shared capacity is saturated. Flight Ops channels are unaffected.
ENGINE_EXECUTION_FAILED	502	WARNING_HI	The engine ran and rejected the work — the physics did not converge, or an input was outside the model's domain.
ENGINE_UNAVAILABLE	503	FATAL	A required library did not load. The response carries the verbatim linker error rather than a plausible number.

502 VERSUS 503 IS NOT COSMETIC

503 means the engine was never reachable and the same request will fail identically until a deployment is fixed — do not retry in a loop. 502 means it ran and refused the work, so the request itself is the thing to change. Collapsing the two would cost an operator the one piece of information that decides what to do next.

Stress tests & bounded mathematics

OPEN ANY ENTRY FOR THE FORMULA, THE INPUTS, AND THE MEASURED RESULT AGAINST ITS ANCHOR.

Each entry is a harness that runs against the compiled engine, not a description of one. Each note also records the trap the test is built to avoid, because a harness that can only pass is not evidence — a check has to be capable of failing for the right reason before passing it means anything.

TESTS

ANCHORED & PASSING

PENDING

FABRICATED

PROPAGATOR — GRAVITY FIELD AND RELATIVITY

ST-01 Zonal field reduces to the legacy J₂ term geodesic.propagator 2.59e-16

What the engine computes

Ψ(r,u) = (μ/r) Σ J_n (R/r)ⁿ P_n(u), u = z/r
a = −∇Ψ
P′_n = u P′_n−1 + n P_n−1

— The derivative recurrence avoids the (u²−1) division, which is singular at the poles — where a polar orbiter passes twice per revolution.
— Truncating at degree 2 must reproduce the pre-existing J₂-only acceleration exactly. This is the regression guard on the whole extension.

Example input

points: 5 positions, LEO to GEO
n_max: 2
J: EGM96

Measured against the published anchor

worst rel. disagreement: 2.593e-16
tolerance: 1e-12

VERDICT · Machine precision. The legacy path is verifiably unchanged.

ST-02 Mercury perihelion advance geodesic.propagator 42.9807 ″/cy

What the engine computes

a = (μ / c²r³) [ (4μ/r − v²) r + 4 (r·v) v ]
IERS Conventions 2010, eq. 10.12, β = γ = 1

— Measured differentially: the same arc integrated twice, with and without the 1PN term, then the angle between the two eccentricity vectors. RK4 truncation is common to both runs and cancels.
— This is the classical test of general relativity — Einstein, 1915.

Example input

a: 0.38709893 AU
e: 0.20563069
arc: 20 orbits, dt = 200 s

Measured against the published anchor

published: 42.98 ″/century
measured: 42.980684
predicted per orbit: 5.018654e-07 rad
measured per orbit: 5.018678e-07

VERDICT · Agreement to five significant figures against a value fixed in 1915.

ST-03 LAGEOS perigee advance — independent scale geodesic.propagator 3.2791 ″/yr

What the engine computes

Δω = 6πμ / ( c² a (1 − e²) ) per revolution

— Mercury and LAGEOS differ by four orders of magnitude in μ and two in radius. Matching both constrains the 1PN scaling, not just its size at one point.
— A single anchor can be hit by a wrong model with a compensating constant. Two cannot.

Example input

a: 12270 km
e: 0.0045
arc: 200 orbits, dt = 1 s

Measured against the published anchor

published: ≈ 3.28 ″/yr
measured: 3.279053

VERDICT · The relativistic term scales correctly across four decades of μ.

ST-04 Lense-Thirring frame dragging, relative size geodesic.propagator 1.257 %

What the engine computes

a = (1+γ)(μ / c²r³) [ (3/r²)(r × v)(r·J) + (v × J) ]

— Documentation originally said this term was three orders below Schwarzschild. It is two. The comment was corrected against the measurement, not the other way round.
— Both terms are checked against their closed forms for a circular orbit rather than against guessed order-of-magnitude bands. An asserted band fails correct engines and passes wrong ones.

Example input

orbit: circular, 400 km
J/M: 9.8e2 km²/s

Measured against the published anchor

Schwarzschild: 1.7030e-08 m/s²
Lense-Thirring: 2.1406e-10 m/s²
ratio measured: 1.257 %
LAGEOS published: 31 vs 3300 mas/yr ≈ 1 %

VERDICT · Both terms match their closed forms to ratio 1.000000.

ST-05 Sun-synchronous nodal rate from a numerical arc geodesic.propagator 0.99015 °/day

What the engine computes

Ω̇ must equal 360° / 365.2422 d = 0.98565 °/day
the condition that keeps the orbital plane fixed relative to the Sun

— This is the claim the Propagation module actually makes: a numerically INTEGRATED J₂–J₈ arc, not an orbit-averaged secular rate.
— The 0.0045 °/day gap is reported rather than tuned away. An osculating rate over one day is not the same quantity as a secular condition, and forcing agreement would mean fitting the engine to the test.

Example input

altitude: 800 km
inclination: 98.6°
arc: 1 day, dt = 1 s
zonal_max: 8

Measured against the published anchor

published condition: 0.98565 °/day
measured: 0.990146
tolerance: 0.02 °/day

VERDICT · Within tolerance, with the residual gap explained rather than hidden.

ST-06 Odd zonals break north-south symmetry geodesic.propagator 0.3251 % of J₂

What the engine computes

Even zonals give a field symmetric about the equator.
J₃ is the pear-shape term — it must destroy that symmetry.

— If enabling degrees 3–8 changed nothing, the coefficients would not be reaching the sum. This test cannot pass on a stub.
— Bounded check: the higher zonals must be a SMALL correction. A value outside 1e-4 to 1e-1 of J₂ would mean a scaling error, and is rejected.

Example input

north: (3000, 2000, +6000) km
south: (3000, 2000, −6000) km

Measured against the published anchor

J₂ only, N vs S: 0.000e+00
J₂–J₈, N vs S: 3.549e-03
J₃–J₈ vs J₂: 0.3251 %

VERDICT · Odd zonals are live, and their magnitude is physically plausible.

EPHEMERIS — CHEBYSHEV EVALUATION AND THIRD BODIES

ST-07 Exactness on a representable polynomial geodesic.ephemeris 1.60e-14

What the engine computes

x(τ) = Σ c_k T_k(τ), τ ∈ [−1, 1]
Clenshaw backward recurrence

— A degree-3 polynomial lies inside the space a 12-coefficient basis spans, so the evaluation must be exact to rounding — there is no approximation to hide behind.
— The first version of this harness failed at 1.4e-8. The engine was exact; the TEST was passing absolute Julian Dates, whose ulp is 40 microseconds. That finding produced the split-epoch API.

Example input

blocks: 1 × 4 days
n_coef: 12
sampled: 41 points

Measured against the published anchor

worst |error|: 1.60e-14
tolerance: 1e-12

VERDICT · Exact to rounding across the block.

ST-08 Clenshaw against direct T_k summation geodesic.ephemeris 6.66e-16

What the engine computes

Clenshaw: b_k = 2τb_k+1 − b_k+2 + c_k
Direct: T_k = 2τT_k−1 − T_k−2

— Two independent evaluations of the same series. Clenshaw is the stable one and is what ships; the direct form is computed in the harness purely to disagree with it if either is wrong.
— Bounded check: this is a pure numerical-analysis identity with no physics in it, so any disagreement above rounding is a coding error rather than a modelling choice.

Example input

function: e^τ sin 3τ
n_coef: 14
sampled: 51 points

Measured against the published anchor

worst |error|: 6.66e-16
tolerance: 1e-13

VERDICT · The two agree to three ulp.

ST-09 Four-hundred-day round trip geodesic.ephemeris 1.128e-08 km

What the engine computes

fit → store → evaluate → compare against the analytic path
100 blocks × 4 days × 13 coefficients

— The engine's job is to reproduce whatever coefficients it was handed. A known analytic body path makes the ground truth exact, so the error measured is the engine's alone.
— This is also the volume test: 400 days at this resolution is the shape of a real lunar series.

Example input

path: circular, 384400 km, i = 5.145°
period: 27.321661 d
sampled: 2001 epochs

Measured against the published anchor

worst position error: 1.128e-08 km
tolerance: 1e-06 km

VERDICT · Eleven micrometres over 400 days.

ST-10 Analytic derivative against a central difference geodesic.ephemeris 3.19e-09

What the engine computes

dT_k/dτ = k U_k−1
Chebyshev of the second kind, run directly rather than converting coefficients

— The velocity is differentiated analytically, so it is checked against a numerical derivative of the position it claims to describe. The two use entirely different code paths.
— Bounded check: the finite difference itself has O(h²) error, so agreement below 1e-8 is as tight as this comparison can be.

Example input

step: 1 second
sampled: 200 epochs

Measured against the published anchor

worst relative error: 3.19e-09
tolerance: 1e-08

VERDICT · Position and velocity are mutually consistent.

ST-11 Block-boundary continuity geodesic.ephemeris 1.477e-08 km

What the engine computes

Each block is checked against TRUTH just inside its own edge,
not against the neighbouring block at a different epoch.

— The two blocks are compared at the SAME epoch. Differencing them at t±1e-9 days instead would report 1.768e-4 km as a seam, when the body genuinely moves 1.763e-4 km across those 0.17 ms — measuring the Moon moving, not a discontinuity.
— The corrected test asks the right question: does each block agree with the function at the seam.

Example input

seams: 99 block boundaries
probe: ±1e-6 d from each seam

Measured against the published anchor

worst edge error: 1.477e-08 km
tolerance: 1e-06 km

VERDICT · Both blocks agree with the function at every seam.

ST-12 Battin's third-body form versus the naive difference geodesic.ephemeris 3.33e-16

What the engine computes

naive: a = GM_b [ (r_b−r)/|r_b−r|³ − r_b/|r_b|³ ]
q = r·(r − 2r_b) / |r_b|²
f = q(3 + 3q + q²) / (1 + (1+q)^3/2)
Battin: a = −(GM_b/|r−r_b|³)[ r + f r_b ]

— Algebraically identical. The naive form subtracts two vectors that agree to about 4 parts in 10⁵ in LEO, losing most of its significant digits exactly where this product's traffic is.
— Ground truth is exact rational arithmetic, so this is not one approximation checked against another.

Example input

radii: 6778 / 7000 / 42164 / 192200 km
body: Moon, μ = 4902.8 km³/s²

Measured against the published anchor

Battin, worst: 3.33e-16
naive at 6778 km: 4.24e-15
naive at 7000 km: 1.34e-15

VERDICT · An order of magnitude better precisely where it matters most.

ST-13 GEO inclination drift from luni-solar attraction geodesic.propagator 0.95205 / 0.75493

What the engine computes

Third bodies evaluated at EACH RK4 stage: t, t+h/2, t+h/2, t+h
a body frozen at the step start drops the term to first order

— The number every geostationary operator budgets north-south station-keeping against. It cannot be produced by accident: it needs the third-body term, the obliquity coupling, correct geometry and an integrated arc.
— Both extremes of the 18.6-year lunar node cycle are tested. A single mid-cycle figure would not check the geometry coupling at all, and a band asserted around one of them fails by 0.002 on a correct engine.

Example input

orbit: GEO, i = 0 exactly
arc: 1 year, dt = 300 s
bodies: Sun (16-d blocks) + Moon (4-d)

Measured against the published anchor

published band: 0.75 – 0.95 °/yr
node HIGH (28.6°): 0.95205
node LOW (18.3°): 0.75493
J₂ alone: 0.00000

VERDICT · Both ends of the published band, in the right order, Moon dominating Sun.

MICROKINETIC — FORCE RECOVERY FROM A RESIDUAL SERIES

ST-14 Exact force recovery across ten decades geodesic.microkinetic rel err 0.0e+00

What the engine computes

a_v = slope of Δv(t) ← primary, first order in dt
a_r = 2 × curvature of Δr(t) ← independent
F = m a_v ± m σ_slope

— Ground truth is CONSTRUCTED: a known force on a known mass for a known time displaces the state by exactly what Newton's second law fixes. There is no reference data to argue about.
— The engine this replaced returned 6.206e-04 N for every one of these rows — a function of solar flux alone, identical for a 1 N misfire and a 5e-5 N solar-pressure residual.

Example input

mass: 1000 kg
dt: 60 s
forces: 1e-8 N through 1e1 N

Measured against the published anchor

relative error: 0.0e+00 across all
confidence: 1.0000
monotone over 10 decades: yes

VERDICT · Exact recovery where the old engine returned a constant.

ST-15 Error falls as N^−3/2, not 1/√N geodesic.microkinetic 194× over 32×

What the engine computes

σ_slope = σ / √(Στ²)
at fixed cadence more samples also lengthen the ARC, so Στ² grows as N³

— This is the whole reason the engine takes a time series rather than a pair of states. A two-state formulation has N = 1 by construction and cannot average anything.
— The convergence law is derived rather than assumed. A 1/√N column would have the engine beating it by 30×, which indicts the law and not the engine.

Example input

noise: 1 m position, 1 mm/s velocity
N: 8 → 256

Measured against the published anchor

σ at N = 8: 9.25e-03 N
σ at N = 256: 4.78e-05 N
improvement: 194×
N^−3/2 predicts: 181×

VERDICT · Better than square-root averaging, for the stated structural reason.

ST-16 Classification by physical signature geodesic.microkinetic 5 / 5 classes

What the engine computes

drag → anti-parallel to v, and 1/rev modulated
SRP → |F| matches P·A·C_r with P = S/c
thermal → well below direct SRP on the same body

— Direction is tested before magnitude: drag and a propellant leak are routinely the same size, and only direction separates them.
— Bounded check: without an effective area the SRP force cannot be predicted, so the classifier declines to attribute solar pressure rather than guessing. A missing input produces a narrower answer, never an invented one.

Example input

area: 10 m²
C_r: 1.3
flux: 1361 W/m²

Measured against the published anchor

predicted SRP force: 5.9017e-05 N
anti-velocity: → DRAG
SRP-matched: → SRP
sub-SRP: → THERMAL
large off-axis: → LEAK
below floor: → NOMINAL

VERDICT · Every signature resolved to its physical cause.

ST-17 A non-constant force must not be reported as one geodesic.microkinetic UNDERDETERMINED

What the engine computes

residual curvature = corr( fit residual, τ² )
white noise leaves none; a ramping force leaves a systematic signature

— A ramping force a(t) = kt is a leak that is opening, or drag as an orbit decays. No constant force describes it, and saying so is more useful than returning the best-fit constant silently.
— Estimator agreement was DELIBERATELY REMOVED from this gate. A case measured at SNR 53 on the velocity slope still scored 0.32 on agreement because the position estimator sat at SNR 3.7 — that is imprecision, not a wrong model, and conflating them sends an operator hunting a cause that is not there.

Example input

force: a(t) = kt, k = 2.0e-9 m/s³
samples: 64

Measured against the published anchor

estimator agreement: 1.0000
residual curvature: 1.0000
classification: UNDERDETERMINED
constant + noise: not flagged

VERDICT · Agreement alone would never have caught it. Curvature does.

INTEGRATOR AND EXECUTION PATH

ST-18 Order-8 coefficients derived, not transcribed geodesic.integrator exact match

What the engine computes

b_j = ∫₀¹ L_j(s) ds Adams
c_j = ∫∫ L_j forward + backward Stormer-Cowell

— The first Adams-Moulton table written from memory was the order-SIX set and summed to 0.336 instead of 1. A wrong table does not fail loudly — it silently degrades the order while the trajectory still looks like a trajectory.
— The derivation self-validates: it reproduces published AB4 and AM4 exactly, collapses to Verlet at k = 2, and yields Numerov's (1/12, 5/6, 1/12) at k = 4.

Example input

method: exact rational arithmetic
order: 8

Measured against the published anchor

vs binary tables: 0.0e+00
all sets sum to: exactly 1
k=4 check: 1/12, 5/6, 1/12

VERDICT · Every coefficient in the binary matches an independent derivation.

ST-19 Measured convergence order and the roundoff floor geodesic.integrator 2,298,924× RK4

What the engine computes

halving the step must cut the error by 2⁸ = 256
reference is a closed-form circular orbit, not another approximation

— The order column is checked across its whole range rather than by max(). A column reading 11.74 at one step and −5.91 at another is not a noisy 8 — the error ROSE when the step was halved, and truncation error cannot do that.
— The order is now fitted only where truncation dominates, and the floor is reported explicitly. It sits at 2.9 nm-scale over twenty orbits; the summed Gauss-Jackson form would push it lower and is not implemented because nothing operational lives below it.

Example input

orbit: 7000 km circular, 20 orbits
dt: 200 → 12.5 s

Measured against the published anchor

order where truncation dominates: ≥ 7.51
vs RK4 at dt = 100 s: 20,045×
vs RK4 at dt = 50 s: 2,298,924×
roundoff floor: 2.913e-09 km

VERDICT · Order 8 confirmed, with the floor published rather than hidden.

ST-20 Adaptive stepping breaks reproducibility design decision, measured 57,000,000×

What the engine computes

perturb μ by ONE unit in the last place, integrate one day
the only difference between the two runs

— This measurement is why both integrators are fixed step and nothing adaptive is offered. A step-size controller reacting to a last-bit difference put the two runs on different step boundaries at step 131 of 14225, after which they are no longer the same computation.
— Bounded consequence: a cross-cloud comparison of an adaptive arc can only ever be tolerance-based, never exact. For a product whose results must reproduce bit-for-bit across machines and regions, that disqualifies it.

Example input

perturbation: 1 ulp on μ
arc: 1 day

Measured against the published anchor

fixed step h = 6 s: 8.12e-09 km
adaptive tol = 1e-9: 4.63e-01 km
ratio: 57,006,821×

VERDICT · Determinism chosen over efficiency, on evidence.

ST-21 Batch shim is bit-exact against the reference loop geodesic.batch 0.0e+00

What the engine computes

the C loop and the per-step Python loop must produce
IDENTICAL bits, not merely close values

— If the two disagreed in the last bit, the trajectory a customer receives would depend on whether an optional shared object happened to be built. That is not a defensible answer.
— Checked across four force models so the equality is not an accident of one configuration.

Example input

arc: 3000 steps, SSO
models: J₂ / J₂–J₈ / +1PN / +LT

Measured against the published anchor

J₂ only: 0.0e+00
J₂–J₈: 0.0e+00
+ 1PN: 0.0e+00
+ Lense-Thirring: 0.0e+00

VERDICT · Identical bits on every configuration tested.

ST-22 The verified legacy path is never rerouted geodesic.propagator not identical

What the engine computes

the zonal series at degree 2 IS the J₂-only acceleration algebraically,
but the operation ORDER differs — so the last bits move

— This is the measurement that justifies keeping two steppers rather than routing the old one through the new. A first check on one SSO orbit came out exactly equal and briefly suggested they were interchangeable.
— They are not: at the acceleration level only about a fifth of components agree bit-for-bit over 20000 random points. Whether a given trajectory moves depends on its geometry, which is why five orbits are checked.

Example input

orbits: SSO / ISS / equatorial / polar / Molniya
arc: 5000 steps, dt = 2 s

Measured against the published anchor

equatorial gap: 1.511e-10 km
SSO gap: 2.274e-13 km
ISS / polar / Molniya: 0.0e+00
operational significance: sub-micrometre

VERDICT · Negligible in magnitude, non-zero in fact — so the verified path stays untouched.

ORBITAL DYNAMICS AND SAFETY

ST-23 Critical inclination and sun-synchronous condition geodesic.harmonic < 1e-4°

What the engine computes

ω̇ ∝ (5 cos²i − 1) → vanishes at i = arccos√(1/5)
= 63.4349°, the Molniya condition

— The J₂ term cancels exactly at the critical inclination, but J₄ does not — so a small residual apsidal drift remains and the true J₄-corrected critical inclination is slightly displaced.
— An earlier assertion of exactly zero was testing a J₂-only theory against a J₂+J₄ engine. The test now checks the residual is the J₄ term.

Example input

altitude: 1000 km
horizon: 10 years

Measured against the published anchor

critical inclination: 63.4349°
offset measured: < 1e-4°
SSO solved inclination: 98.60° ± 0.05
ISS-like nodal regression: ≈ −5.0 °/day

VERDICT · Three independent published conditions reproduced.

ST-24 GEO is a 1:1 tesseral resonance geodesic.harmonic 1:1 detected

What the engine computes

T_orbit / T_sidereal → nearest commensurability m:n
sidereal day = 86164.1 s, not 86400

— A geostationary orbit is by definition locked to Earth's rotation. An engine that could not detect the most obvious resonance in astrodynamics would not be trustworthy on subtler ones.
— Bounded check: risk over a planning horizon must be MONOTONIC. An earlier build oscillated, which meant a longer horizon could report less risk.

Example input

a: 42164.17 km
horizon: 10 years

Measured against the published anchor

period measured: within 5 s of 86164.1
commensurability: 1:1
risk monotone in horizon: yes

VERDICT · The defining resonance of GEO, detected from the state vector alone.

ST-25 Lambert targeting across the transfer domain geodesic.trajectory 17 / 17 geometries

What the engine computes

universal variables with Stumpff C(z), S(z)
t_parabolic = (1/3)√(2/μ)(s^3/2 − ±(s−c)^3/2) hard lower bound

— Analytic bracketing from Lambert's theorem replaced a blind scan, cutting the solver count from ~287 to 101 per call — measured, at 2.9×, not the 60× an earlier estimate claimed for a different method.
— The 180° transfer is degenerate: the transfer plane is undefined by the two position vectors alone, and is resolved from the departure velocity rather than guessed.

Example input

geometries: 17, coplanar to 180°
bracket: t_parabolic to 8 t_min-energy

Measured against the published anchor

results after bracketing: identical to the scan
closure miss: ≤ 0.4 m
solves per call: 100.9

VERDICT · Bracketing changed the cost, not a single answer.

ST-26 Foster probability of collision geodesic.conjunction ≤ 2.2σ

What the engine computes

encounter plane from the relative velocity
P₂ = B^T P B 3×3 covariance projected to 2×2
then polar integration over the hard-body disc

— Source-verified as genuine Foster: encounter-plane basis built from relative velocity, degenerate case handled when Δr is parallel to Δv, correct covariance projection. This is the method NASA CARA uses.
— The anchor is sampled, not integrated: draw the relative position from the encounter-plane Gaussian and count how often it lands inside the hard body. No quadrature, no conditioning, and no shared code path with the engine.
— Integration runs in the covariance's principal axes, where the Gaussian separates and the hard body — being a circle — is unchanged. The second axis is then an exact erf difference, so an elongated covariance never has to be resolved by a grid. A degenerate or rank-deficient covariance is handled in closed form rather than scored as zero risk.

Example input

input: relative state + combined covariance + HBR
output: P₂, risk tier

Measured against the published anchor

Monte Carlo draws: 4×10⁷ per case
worst deviation: 2.2σ
correlated ρ=0.9 case: 1.3σ

VERDICT · Agreement with sampled truth across the operational envelope, including correlated and near-degenerate covariances.

WHAT “BOUNDED MATHEMATICS” MEANS HERE

Every routine states the domain on which it is valid and what happens outside it. A Chebyshev series refuses an epoch beyond its table rather than extrapolating. The low-thrust solver reports whether its quasi-circular assumption held. Force recovery publishes the cancellation limit that caps its along-track resolution. The order-8 integrator publishes its roundoff floor. None of those bounds make the engine look better — they are the part a reviewer needs, and an engine that hides them is asking to be trusted rather than checked.

NON-CONSERVATIVE FORCES — DRAG AND RADIATION PRESSURE

ST-27 Drag acts on the co-rotating atmosphere geodesic.nonconservative 1e-12

What the engine computes

a = −½ ρ (C_dA/m) |w| w
w = v − ω × r velocity relative to the rotating air

— The atmosphere rotates with the Earth, so drag opposes w, not v. For a prograde equatorial orbit that removes 12.5% of the drag magnitude and adds a cross-track component a purely anti-velocity model cannot produce.
— A retrograde orbit meets the air head-on and must see MORE drag — measured 1.2946× the prograde case, which is the sign the rotation term carries the right sense rather than merely the right size.

Example input

orbit: 7000 km circular, equatorial
ω: 7.292115e-5 rad/s
C_dA/m: 0.02 m²/kg

Measured against the published anchor

|a| ratio vs inertial air: 0.875246
predicted (v_rel/v)²: 0.875246
cos angle to w: −1.000000000000

VERDICT · Exactly anti-parallel to the relative velocity, and the magnitude matches the closed form to machine precision.

ST-28 Drag magnitude and its unit conversion geodesic.nonconservative 1.4e-16

What the engine computes

|a| = ½ ρ (C_dA/m) v²
ρ kg/m³ · m²/kg · (km/s)² → km/s² carries a 1e3 factor

— The unit conversion is the single most likely thing to be wrong in a drag implementation, and it fails silently by a clean power of ten. It is therefore pinned three ways rather than once.
— Doubling the ballistic coefficient must exactly double the acceleration, and climbing one scale height must cost a factor of e — two independent constraints the conversion factor cannot satisfy by accident.

Example input

ρ: 1.0e-11 kg/m³ at 400 km
scale height: 60 km
C_dA/m sweep: 0.02 and 0.04 m²/kg

Measured against the published anchor

|a| vs closed form: 1.41e-16 rel
linear in C_dA/m: exact to 1e-12
one scale height: 0.36465155 vs 1/e · (v₂/v₁)²

VERDICT · The conversion is correct and constrained from three directions at once.

ST-29 Energy: conservative models cannot decay an orbit geodesic.nonconservative + geodesic.propagator 0.250%

What the engine computes

ε = ½v² − μ/r
dε/dt = a_drag · v = −½ ρ B v³

— This is the decisive test of the whole engine. A potential-derived force cannot change the orbital energy; a non-conservative one must lower it, monotonically, every step.
— The strict comparison runs on pure two-body, where ½v² − μ/r IS the invariant. Under the full zonal field that expression oscillates at ~1.8e-3 because J₂ is not central — that is J₂ itself, not integrator error, and measuring it against the full model would indict a correct engine. The full model is instead checked by DIFFERENCING two runs of the same initial state, with drag and without, which cancels J₂ exactly.

Example input

orbit: 300 km, 51.6°
arc: 5400 s at 1 s
comparison: drag-on minus drag-off

Measured against the published anchor

two-body conservation: max |dε/ε| = 1.024e-14
loss vs −½ρBv³t: 0.250%
monotone every step: yes
semi-major axis: −295.7 m in 90 min

VERDICT · Energy is conserved to integrator noise without drag, and removed monotonically with it.

ST-30 A refusing atmosphere poisons rather than vanishes geodesic.nonconservative NaN

What the engine computes

ρ < 0 → a = NaN
ρ = 0 → a = 0 a real vacuum is a real answer

— A density model that cannot answer returns a negative number, never zero — zero density is physically meaningful at high altitude and would be absorbed silently into the drag term.
— Losing drag at 300 km does not produce a slightly worse orbit. It produces a satellite that never decays: a confident wrong answer. NaN is loud; a silent skip is not. This is deliberately the OPPOSITE of the third-body policy, where an out-of-range ephemeris is a hard skip, because there the missing term is small and the trajectory stays broadly right.

Example input

unlinked model: returns −1.0
true vacuum: returns 0.0
probe: called before the run

Measured against the published anchor

negative ρ → acceleration: NaN on all three axes
zero ρ → acceleration: exactly 0.0
probe catches it first: yes, before any propagation

VERDICT · The failure is impossible to mistake for an answer, and is caught before the run rather than after.

ST-31 Geodetic altitude and Earth orientation geodesic.nonconservative 5.2e-10 km

What the engine computes

Bowring 1976, then two fixed-point refinements
tanφ = z / (p (1 − e²N/(N+h)))

— Geodetic and geocentric altitude differ by up to 21 km at mid latitudes. Against a 60 km thermospheric scale height that is a factor of 1.4 in density, so the ellipsoid is not a refinement here — it is the difference between a right and a wrong drag force.
— The round trip is checked through the FORWARD ellipsoid formula rather than through the inverse of the routine under test, so a shared algebraic error cannot cancel itself out.

Example input

points: 64, 200 km to 2700 km altitude
GMST: IAU 1982 series
ellipsoid: WGS84

Measured against the published anchor

worst round-trip: 5.2e-10 km (0.001 mm)
GMST at J2000.0: 0.0004 s vs 18h 41m 50.548s
one sidereal day closes: 5.8e-12 rad

VERDICT · Sub-micrometre over the whole spacecraft altitude range, against an independently derived formula.

ST-32 Opting in costs nothing when the terms are off geodesic.propagator bit-identical

What the engine computes

config with C_dA/m = 0, C_rA/m = 0
≡ no config at all, byte for byte

— Existing callers who never touch the new field, and callers who attach a config with zero coefficients, must both get exactly the trajectory they had before this engine existed — not close, identical.
— Compared with memcmp on the full state, not with a tolerance. A tolerance would hide a small systematic change, which is precisely what a regression of this kind looks like.

Example input

arc: 4000 s at 2 s
model: J₂–J₈ + 1PN + Lense-Thirring
comparison: memcmp on the state

Measured against the published anchor

separation after 4000 s: 0.000e+00 km
byte comparison: identical

VERDICT · The extension is inert until it is switched on.

COVARIANCE — STATE TRANSITION MATRIX AND UNCERTAINTY REALISM

ST-33 Gravity gradient: Laplace and symmetry geodesic.covariance 2.3e-16

What the engine computes

G = −∂²Ψ/∂x∂x
tr(G) = A_nr⁻⁽ⁿ⁺³⁾[n(n+1)P_n − 2uP′_n + (1−u²)P″_n] ≡ 0

— That bracket IS Legendre's differential equation, so the vanishing trace is not a numerical coincidence to be checked with a tolerance — it is an algebraic identity forced by the recursion. A wrong second derivative, or a wrong coefficient in it, shows up immediately as a non-zero trace.
— Symmetry is exact for the same structural reason: G is a Hessian. Neither of these checks involves a finite difference, so neither can be fooled by an error the engine and its verifier share.

Example input

positions: 4, equatorial to GEO
n_max: 8
J: EGM96

Measured against the published anchor

worst |trace| / |G|: 2.27e-16
worst |Gᵢⱼ − Gⱼᵢ|: 0.00e+00
vs finite differences: 1.18e-10

VERDICT · Two structural identities hold exactly, and the finite-difference check agrees at its own truncation floor.

ST-34 Φ against the trajectories it predicts geodesic.covariance 1.7e-10

What the engine computes

dΦ/dt = A(t)Φ, Φ(t₀,t₀) = I
A = [[0, I], [G, D]] G = ∂a/∂r, D = ∂a/∂v

— Every column of Φ is the answer to a physical question: perturb one state component and propagate. So each column is checked against a perturbed run of the full nonlinear propagation.
— The state and the matrix advance as ONE 42-dimensional system through the same stepper. Integrating them separately — a common shortcut — freezes A at the step start and silently degrades Φ to first order in dt.

Example input

orbit: 500 km, 51.6°
arc: 30 min at 10 s
step: |state| × 6e-6, balancing truncation against round-off

Measured against the published anchor

worst column: 1.67e-10 relative
Φ(t,t): exactly I
composition: 1.02e-15

VERDICT · One 3000 s arc equals two 1500 s arcs multiplied, and every column reproduces a real perturbed trajectory.

ST-35 Symplectic structure — and its deliberate failure geodesic.covariance 1.4e-14

What the engine computes

Φ^TJΦ = J, J = [[0, I], [−I, 0]]
Hamiltonian flow only. Dissipation must break it.

— A conservative force model gives a symplectic flow. This is a property of the DYNAMICS, not of the code, so it cannot be satisfied by a coding error that happens to be self-consistent.
— The same test run WITH drag must FAIL, and does — by a factor of 3.9 million. A test that passes in both cases is measuring nothing at all, so the failure is as much a part of the evidence as the pass.

Example input

orbit: 300 km, 51.6°
arc: 90 min at 10 s
normalisation: relative to |Φ|²

Measured against the published anchor

conservative: 1.36e-14 relative
with drag: 5.28e-08 — 3.9e+06× larger
det Φ, conservative: 0.999999999863842

VERDICT · Symplectic where the physics says it must be, and decisively not where the physics says it must not.

ST-36 Abel's identity ties det Φ to the Jacobian trace geodesic.covariance 8.1e-06

What the engine computes

det Φ = exp ∫ tr A dt exact for any linear system
tr A = tr(∂a/∂v) = −2ρB|w| drag only

— The right-hand side is built from the Jacobian alone and never touches Φ, so this ties the drag Jacobian to the STM integration with no shared arithmetic anywhere.
— Physically it is Liouville: phase-space volume contracts at exactly the rate dissipation removes it. It also catches a specific and easy mistake — dropping the w⊗w outer product from ∂a/∂v gives a trace of −1.5ρB|w| instead of −2ρB|w|, a 25% error this test resolves at the 2% level.

Example input

orbit: 300 km, 51.6°
arc: 90 min at 10 s
ρ: exponential, 60 km scale height

Measured against the published anchor

det Φ: 0.999974238
exp ∫tr A dt: 0.999974238
relative agreement: 8.09e-06

VERDICT · Six-digit agreement between a determinant and an integral that share no code.

ST-37 Mapped covariance against Monte Carlo geodesic.covariance within noise

What the engine computes

P₁ = ΦP₀Φ^T + Q
symmetrised explicitly before returning

— The reference samples from P₀, propagates each draw NONLINEARLY, and forms the sample covariance. No state transition matrix appears anywhere in that path.
— The result is symmetrised on the way out. Round-off makes the raw triple product asymmetric at the 1e-16 level, and an asymmetric covariance eventually produces a negative eigenvalue in a downstream Cholesky — failing far from the place that caused it.

Example input

initial σ: 100 m position, 0.1 m/s velocity
arc: 30 min
samples: 20 000

Measured against the published anchor

worst axis: 3.43e-03
sampling error at N: 5.0e-03
asymmetry: 0.00e+00

VERDICT · The linear map agrees with sampled nonlinear truth to inside the Monte Carlo noise floor.

ST-38 When the linear map stops meaning anything geodesic.covariance calibrated

What the engine computes

a curvature index from symmetric ±1σ probe pairs
a linear map sends symmetric in to symmetric out; departure from that is the signal

— Along-track uncertainty in LEO becomes banana-shaped, and a Gaussian probability built on a linearly mapped covariance can then be wrong by orders of magnitude while looking perfectly healthy. The index measures the curvature the linear map cannot represent, for the cost of two extra propagations rather than a Monte Carlo run.
— The threshold is calibrated against the departure of the true distribution from the propagated nominal, because a collision probability measures the miss from that mean. Metrics that are rotation-dependent, or that are rotation-invariant but blind to shape, were evaluated and rejected before this one was adopted.

Example input

cases: 100 m / 1 km / 10 km initial σ
arcs: 6 h to 240 h
criterion: 5% mean shift

Measured against the published anchor

worst still-acceptable: 1.21e-02
best already-degraded: 2.42e-02
threshold: 2e-02, placed between them
aspect-ratio spread: 4× — a flag, not a probability

VERDICT · A well-tracked object stays linear for ten days; a newly detected fragment is outside the envelope within six hours.

CONJUNCTION — SCREENING, PROBABILITY AND AVOIDANCE

ST-39 Closest approach against a closed form geodesic.screening 7.1e-09

What the engine computes

|D|² = 2R²[1 − ½cos(δu)(1+cos i) − ½cos(2u−δu)(1−cos i)]
minimised at u = δu/2 → |D|_min = R δu cos(i/2)

— Two equal-radius circular orbits sharing a node, one offset in phase. The closest approach is NOT at the node where the planes cross — it is midway, and the cos(i/2) factor is the whole content of the check.
— A prediction of R·δu alone is wrong by a constant 4.47% at every separation. A constant ratio is the signature of a missing factor rather than an engine defect, which is exactly what makes this a useful anchor.

Example input

radius: 7078.137 km
inclination: 0.6 rad
phase offsets: 1e-4 to 4e-4 rad

Measured against the published anchor

worst relative error: 7.12e-09
cos(i/2): 0.955336
Δr · Δv at TCA: 2.96e-16

VERDICT · Agreement to nine digits with an independently derived geometry, and TCA is a true stationary point.

ST-40 Nothing is stepped over in silence geodesic.screening 8 of 8

What the engine computes

g(t) = Δr · Δv, minima are the −→+ crossings
g′(t) = |Δv|² + Δr · Δa

— A root-find can only refine a bracket it was given. Step over a minimum and the following maximum together and the approach is INVISIBLE — no error, no warning, just a conjunction that was never reported. The failure direction here is silence, which is the worst one available.
— The reference is EXHAUSTIVE rather than a finer version of the same sweep: propagate the pair at 0.05 s and take the running minimum directly, with no derivative and no bracketing. It cannot share the engine's failure mode. The test is not that a coarse step never loses approaches — it must — but that the engine has already flagged its sampling INADEQUATE whenever it does.

Example input

window: 4 revolutions
sweep: 128 down to 2 samples per orbit
reference: exhaustive at 0.05 s

Measured against the published anchor

default step: 64 / orbit, finds 8 of 8
flag when losing: INADEQUATE in every case
nearest approach: 3.080963 vs 3.081298 km
TCA: 0.017 s vs a 0.05 s grid

VERDICT · Every minimum found at the default density, and the adequacy flag never reads clean on an incomplete list.

ST-41 Avoidance manoeuvre against brute force geodesic.avoidance 0.1%

What the engine computes

minimise |ΔV| s.t. |m̃ + ÃΔV| ≥ d_req
solved in a whitened encounter plane, so the constraint is a circle rather than an ellipse

— The reference uses no model at all: sweep burn directions over a dense grid of the sphere and bisect the magnitude of each against the real probability engine, on a fully re-propagated and re-screened trajectory.
— Both the engine and the reference must score the SAME PHYSICAL ENCOUNTER, matched by epoch. The approach list is sorted by miss distance and the geometry repeats once per revolution, so taking the nearest entry silently promotes the NEXT conjunction as soon as the burn pushes the first one away.

Example input

conjunction: 8.4 km/s crossing, 10.7 km miss
covariance: 4 km combined, 50 m HBR
reference: 684 directions, magnitude bisected

Measured against the published anchor

engine: 0.61467 m/s
brute force: 0.61408 m/s
difference: 0.1%
P_c achieved: 2.197e-06 → 1.000e-07

VERDICT · The engine finds the model-free minimum to a tenth of a percent, and meets the threshold it was given.

ST-42 The optimiser rediscovers “burn early, burn along-track” geodesic.avoidance 1.60×

What the engine computes

in-track impulse → along-track drift ≈ 3τΔV secular
radial / cross-track → bounded oscillation ≈ ΔV/n

— Nothing tells the optimiser that in-track is efficient or that lead time is valuable. It is given a geometry and a threshold, and the structure falls out of the state transition matrix on its own.
— Because the secular term grows with τ while the oscillatory ones do not, cost should fall as roughly 1/τ. Across a sixteen-fold range of lead time the product |ΔV|·τ varied by a factor of only 1.60.

Example input

lead times: 600 s to 9600 s
threshold: P_c ≤ 1e-7
burn frame: reported in RIC

Measured against the published anchor

in-track component: 0.5748 m/s
radial: 0.1156 m/s
cross-track: 0.0156 m/s
|ΔV|·τ spread: 1.60× over 16× of lead

VERDICT · The Clohessy-Wiltshire structure emerges from an optimiser that was never told about it.

ST-43 Execution error can make the cure worse geodesic.avoidance 23×

What the engine computes

σ_v = ε|ΔV| → Φ_rv σ_v² Φ_rv^T added at TCA
the burn's own uncertainty opposes the miss it buys

— A burn is not applied perfectly, and a proportional execution error adds velocity variance that the same state transition matrix carries to the encounter as extra position covariance — working directly against the separation just purchased.
— Omitting this is not conservative. It produces a manoeuvre that reduces the probability on paper while leaving it unchanged, or worse, in reality.

Example input

lead: 1800 s
execution error: 0% to 50%
threshold: P_c ≤ 1e-7

Measured against the published anchor

at 0% error: 1.34203 m/s
at 20%: 1.44461 m/s
at 50%: 31.15794 m/s
target met throughout: yes, or reported unreachable

VERDICT · Between 20% and 50% execution error the cost rises 23-fold: most of the propellant is spent overcoming the operator's own noise.

BALLISTIC COEFFICIENT AND ORBITAL LIFETIME

ST-44 Recovering a known ballistic coefficient geodesic.ballistic 0.001%

What the engine computes

ds(t) = c₀ + c₁t + c₂t² + c₃(1−cos nt) + c₄ sin nt
B = 4c₂ / (3ρv²)

— Both arcs are fully propagated — the reference drag-free, the observation with a known C_dA/m — so the residual carries the real dynamics rather than a kinematic sketch the estimator would trivially reproduce.
— Drag shrinks the orbit, a shorter period runs ahead, and the lead grows quadratically. That is the signal; the quadratic coefficient is the estimate.

Example input

arc: 2 h at 30 s
ρ: 2.0e-12 kg/m³, constant
B sweep: 0.005 to 0.080 m²/kg

Measured against the published anchor

worst relative error: 0.001%
range covered: 16× in B
SNR: 1.4e+07 and above

VERDICT · Exact recovery across a sixteen-fold range, from propagated truth rather than a formula.

ST-45 The oscillatory term is a bias, not noise geodesic.ballistic 19.82%

What the engine computes

y(t) = −(3/2)ft² + (4f/n²)(1 − cos nt)
Clohessy-Wiltshire, constant tangential f

— The second term is bounded, so it disappears against t² on a long arc — but on a short one it is systematic. Fitting a bare quadratic therefore reports every ballistic coefficient high by the same factor, with no symptom to notice.
— Measured against propagated arcs at 400 km over 7200 s (nt = 8.145 rad), the ratio of true drift to the pure secular prediction is 0.94825; the closed form above predicts 1 − 0.0532 = 0.9468. The engine fits the whole solution, so the bias never enters.

Example input

arc: 2 h at 30 s
true B: 0.020 m²/kg
comparison: full model vs bare c₀+c₁t+c₂t²

Measured against the published anchor

full model: 0.020000 (−0.00% error)
pure t² fit: 0.023964 (19.82% error)
predicted bias: 5.3% at this nt, growing as the arc shortens

VERDICT · Fitting the bounded response removes a systematic error a quadratic-only fit cannot even detect.

ST-46 A manoeuvre must not be absorbed into drag geodesic.ballistic flagged

What the engine computes

drag → quadratic in t
in-track impulse → linear, c₁ = −3ΔV

— Drag cannot produce a secular linear term. If a burn is swallowed by the fit, the object silently acquires a wrong ballistic coefficient and therefore a wrong lifetime — measured, a 0.1 m/s in-track impulse drove a true B of 0.020 to a reported −0.108.
— A statistical test alone is useless on a clean arc: as the residual scatter falls so does σ(c₁), and |c₁|/σ diverges on a term that is numerically nothing. The detector therefore requires the linear term to be significant in magnitude as well as in statistics.

Example input

burns: 0.0 to 0.3 m/s in-track
burn epoch: mid-arc
true B: 0.020 m²/kg

Measured against the published anchor

clean arc: classified drag only
every burn ≥ 0.1 m/s: MANOEUVRE SUSPECTED
B under a 0.1 m/s burn: −0.108 — refused, not reported

VERDICT · Every burn is caught and handed on; a clean arc is not falsely accused.

ST-47 Only the product ρB is observable geodesic.ballistic 1e-9

What the engine computes

ds ∝ ρ B the arc constrains the product, nothing more

— Nothing in a single arc separates a dense atmosphere from a draggy satellite. Told a density twice as large, the same data yields a ballistic coefficient exactly half as large, fitting precisely as well.
— This is why the fit uncertainty and the total uncertainty are reported as separate fields. On a clean arc they were 0.00% and 25% — quoting the first alone would claim a precision the answer does not have, and an empirical atmosphere carries 15–30% of its own.

Example input

arc: identical in all three runs
ρ told: 0.5×, 1×, 2× the truth
declared ρ uncertainty: 25%

Measured against the published anchor

B reported: 0.040 / 0.020 / 0.010
ρ × B: identical to 1e-9
fit σ: 0.00%
total σ: 25.0%

VERDICT · The degeneracy is exact, is stated rather than hidden, and drives the uncertainty that is actually reported.

ST-48 Lifetime is dominated by the sun, not the spacecraft geodesic.ballistic 25.6×

What the engine computes

da/dt = −ρ(h) B v a
secular decay; bounds by re-integrating at the corners

— A 25-year decay propagated step by step is billions of RK4 steps integrating short-period detail that cancels out of the answer. The secular equation is the same physics with the fast angles removed.
— Bounds come from re-integrating at the edges of the declared uncertainties rather than from differentiating: lifetime goes as roughly 1/ρB, and a linear error bar badly understates the slow end.
— The same hardware at the same altitude passes or fails a five-year disposal rule depending entirely on an assumption about solar activity. That is why the flux is reported with every answer.

Example input

altitude: 500 km
C_dA/m: 0.02 m²/kg
atmosphere: NRLMSISE-00 through the callback

Measured against the published anchor

F10.7 = 70: 28.35 yr — rule NOT met
F10.7 = 130: 5.23 yr — marginal
F10.7 = 190: 2.00 yr — met
F10.7 = 250: 1.11 yr — met

VERDICT · A factor of 25.6 across the cycle on identical hardware: a lifetime quoted without a stated flux is not an answer.

ST-49 Estimate, then predict, end to end geodesic.ballistic 4.46%

What the engine computes

residual arc → C_dA/m ± σ → lifetime [lo .. hi]

— The full chain on a realistic arc: J₂–J₈ in both trajectories, 10 m of position noise, and the estimate's own total uncertainty carried forward into the lifetime bracket.
— The test that matters is not whether the central estimate is close — it is whether the TRUE lifetime falls inside the bracket the engine quoted. A tight interval that excludes the truth is worse than a wide one that contains it.

Example input

arc: 2 h, 10 m position noise
true C_dA/m: 0.03500 m²/kg
declared ρ uncertainty: 20%

Measured against the published anchor

estimated B: 0.03344 (4.46% error)
fit / total σ: 0.00325 / 0.00744
lifetime quoted: 0.30 yr [0.21 .. 0.52]
lifetime from truth: 0.29 yr — inside the bracket

VERDICT · The estimate survives a realistic arc, and the quoted interval contains the truth.

SPACE DOMAIN AWARENESS — MANOEUVRE DETECTION

ST-50 Impulsive burn: was there one, when, how large geodesic.maneuver_detect 0.7%

What the engine computes

continuous: dv(t) = a t a line
impulsive: dv(t) = ΔV H(t − t_b) a step

— Both hypotheses are fitted and compared by residual sum of squares, so the verdict is a model comparison rather than a threshold on one statistic. The burn epoch is scanned as a nuisance parameter and then refined below the sample cadence.
— Truth comes from two fully propagated arcs. A kinematic residual — Δv = ΔV, Δr = ΔV(t−t_b) — is reproduced perfectly by the detector while testing nothing: real Clohessy-Wiltshire dynamics make the velocity residual oscillate, and the along-track drift −3ΔVᵢt, three times the naive value and opposite in sign.

Example input

burn: 0.5 m/s, in-track / radial / cross-track
epoch: 60 s into the arc
arc: propagated, not synthesised

Measured against the published anchor

in-track: 0.4965 m/s (0.7%) at 59.7 s
radial: 0.5071 m/s (1.4%) at 60.5 s
cross-track: 0.4964 m/s (0.7%) at 59.7 s
sensitivity: 20 mm/s at 1 mm/s noise

VERDICT · Magnitude within 1.4% and epoch within a second, in all three directions.

ST-51 A sustained force is not a manoeuvre geodesic.maneuver_detect 1e-4

What the engine computes

evidence = RSS_continuous / RSS_impulsive
>1 favours a burn, <1 favours a sustained force

— The continuous estimator fits a straight line to the velocity residual, and a least-squares line through a step has a slope of roughly ΔV/T — so a burn presented to it comes back as a sustained thrust that never existed, with high confidence and no recoverable epoch.
— The validity envelope is measured, not assumed. A radial burn degrades from 0.1% to 25.2% error as the arc grows from 0.8% to 16% of a period, and the bound is computed from the TOTAL arc rather than from the recovered epoch — a bound that depends on the estimate it is meant to bound is not a bound.

Example input

sustained forces: 0.01 N, 1 N, 10 N
noise-only arcs: included
envelope sweep: 0.8% to 32% of a period

Measured against the published anchor

sustained → verdict: CONTINUOUS, evidence 0.0001
noise only: QUIESCENT / AMBIGUOUS, confidence 0.000
outside the envelope: degrades to AMBIGUOUS, not a false burn

VERDICT · Sustained forces are referred on rather than claimed, and noise never manufactures a manoeuvre.

Limits and model boundaries

REQUEST CEILINGS

STEPS PER RUN: 100,000
THIRD BODIES: 8
CHEBYSHEV COEF: 32 / COMPONENT
RESIDUAL SAMPLES: 3 – 4096
COVARIANCE STEPS: 4,000,000
BALLISTIC SAMPLES: 12 – 8192
MANEUVER SAMPLES: 12 – 4096
MESH VERTICES: schema 30,000
MANIFOLD STATES: 100,000
PAYLOAD: 1 MiB

KNOWN NUMERICAL FLOORS

Order-8 integrator: Roundoff floor near 3 µm over 20 orbits; below that a smaller step stops helping.
Force recovery: Along-track resolution is limited by cancellation to about (ε/2)·|v|/|Δv|; cross-track is exact.
Low thrust: Edelbaum assumes quasi-circular and many revolutions. The response says whether that held.
Libration-point orbits: Non-dimensional throughout: distance in primary separation, time so the mean motion is 1. Nothing is converted to kilometres, because that needs your system's separation. The requested amplitude is a seed; the corrector returns the nearest member of the family and reports achieved_z0.
Monodromy conditioning: These orbits are violently unstable — ‖Φ‖ runs into the thousands — so symplectic_residual is normalised by ‖Φ‖². Read it as the transition matrix's own accuracy, not as an absolute error.

NOT MODELLED

De Sitter precession: Needs Earth's heliocentric state. Absent, and not claimed.
Tesseral harmonics: The gravity field is zonal. Commensurabilities are detected, not integrated.
Object catalogue: Not provided, and not screened on your behalf. Supply both objects, or the conjunction geometry directly.

Subscriptions

COMMERCIAL TERMS PENDING PUBLICATION

Pricing, service levels and contract terms are being finalised alongside the production deployment. Until then this section reads PENDING — the same rule the rest of the platform follows. An indicative price is a number we would be inviting you to plan against, and we do not publish numbers we cannot yet stand behind.

Burner and Dev are issued keys and will carry stated terms. Flight Ops service, Evidence service and the Engine Licence are quoted per engagement instead, because each is a deployment provisioned for one customer — the number depends on what is being provisioned, so there is no list price to publish.

BURNER

READINESS READY

Verified institutional domain. Terms pending.

DEV

READINESS READY FOR EVALUATION

40 B Steps. Terms pending.

FLIGHT OPS SERVICE

READINESS NOT READY

Uncapped compute, near 100 Hz stream. Dedicated servers. Terms pending.

EVIDENCE SERVICE

READINESS PILOT-READY, NOT PRODUCT-READY

Signed receipts and exportable audit chain, for compliance and underwriting. Under agreement. Dedicated servers. Terms pending.

ENGINE LICENCE

READINESS NOT READY

The attested execution layer beneath your own service. Not an API key. Annual, negotiated. Dedicated servers. Terms pending.

The first two are API keys and are described in full under Subscriptions. Flight Ops service, Evidence service and the Engine Licence are arranged rather than issued, and carry no step allowance of their own — a request-rate cap still applies — see Developers.

Trial keys for Flight Ops service and Evidence service are issued to prospective customers for testing. A trial runs on a shared subscription channel — same software, same engines, same attested enclave — where a contract on either service is deployed on a dedicated server instead.

ADVISORY CLASS NOTICE

Outputs are advisory computational products. Results are signed and independently verifiable; the system is not flight certified and carries no airworthiness, launch, or operational authority. All manoeuvre, avoidance, and station-keeping decisions require explicit Flight Dynamics Officer sign-off within the operator's own certified process. Simulated or unpopulated parameters are surfaced as -- or UNKNOWN and must never be interpreted as nominal values.