The ground station transmits once, then goes quiet
A continuously commanded drone needs a link that is both jam-resistant and quiet, and the ground control station radiates continuously, which is how GCSs are located and struck. The UAS profile replaces the leash with authority the aircraft enforces itself.
- For
- UAS units
- Removes
- The continuously radiating GCS
- Adds
- Tamper-evident ROE provenance
- Needs
- No radio replacement
Capabilities
Authority, not a leash
A signed, time-boxed, geofenced, ROE-constrained authorisation to act. The aircraft enforces every constraint and fails closed: an expired capsule, a geofence exit or a signature not from the quorum-bound identity all stop it. Link loss becomes the designed steady state.
No ground arbiter
Aircraft are each other's custodians. Admission and expulsion need a quorum of airframes and rotate the swarm epoch, so a downed aircraft's replayed identity is rejected in flight with no ground link involved.
A record that holds up
Every command and sensor frame is hash-chained and signed, and the head hash is witnessed by the formation. "What was the aircraft told, and who authorised it?" has an answer that is defensible rather than asserted.
Every minute of link is a minute of exposure for the operator
Because the capsule is signed by a quorum-bound identity, a single captured staff tablet cannot task an aircraft at all. And because constraints are enforced by the aircraft rather than by operator discipline, a jammed link no longer forces a choice between losing the aircraft and losing control of it.
After a strike goes wrong, the mission ledger turns a contested account into a verifiable one. Altering any historical entry breaks every hash after it, so even total compromise of the aircraft cannot rewrite history the formation has already witnessed.
| Capsule | Signed; time window; geofence polygon; ROE constraints; task |
|---|---|
| Enforcement | On the aircraft; fail-closed on any failed check |
| Signing identity | Quorum-bound (Sigilcore); no single device can sign |
| Swarm membership | Quorum of airframes; epoch rotation on admission or expulsion |
| Ledger | SHA-256 hash chain, Ed25519 / ML-DSA signatures, formation-witnessed head |
| Status | Ledger real · tested Capsule checks in lab |
Stated plainly
The profile's own limits are the swarm's: a quorum of airframes captured together inside one epoch is a compromise, so swarm size and threshold are design decisions. Whether a capsule may ever authorise weapon release is a policy question for the user, not a default in the software.
The binding constraint is a signals regiment willing to run a trial.
Not capital. If you can open that door, or want the architecture note and the runnable prototype to take apart yourself, we would like to hear from you.