Open PNT resiliencevalidated to the millimetre,reproducible to the bit.

SGP4/SDP4 matches all 666 AIAA 2006-6753 verification states to a worst-case 4.12 mm — near-Earth, deep-space, and resonant. This is the model TLEs are defined against.

The Cowell propagator's unperturbed orbit matches the exact universal-variable Kepler solution to sub-metre over 24 h, with energy and angular momentum conserved to ~1e-9. The J2–J6, third-body, SRP, drag and relativistic perturbations each match a hand-derived closed-form signature.

Force-model validation by ephemeris fitting against real agency precise orbits: a full-arc Galileo MEO post-fit residual of 0.61 m (24 h, degree/order 70, force-only) and Swarm-A LEO 0.10 m (reduced-dynamic — an empirical-tier bound, not a measure). The lunar LRO fit is 6.6 m, reported honestly above the 5 m target, and a DE440/ANISE cross-validation leaves it unchanged. This fits the force model to published ephemerides; it is not measurement-level orbit determination.

Allan-family deviations (ADEV/MDEV/TDEV/HDEV) computed by the standard overlapping estimators with confidence intervals — validated against the NIST SP 1065 reference deviations (Riley / Stable32 on NBS14), and calibrated to published clock datasheets, with a full IEEE-1139 five-coefficient power-law fit. The estimators are also validated on real measured hardware against Stable32: a 5071A caesium clock vs a hydrogen maser (556,990 samples, 16 averaging factors) and the canonical Stable32 PHASE.DAT series, both reproduced to ≤ 1e-3 (observed ≤ 3e-5).

The CIO-based IAU 2006/2000A GCRS↔ITRS reduction is validated bit-for-bit against the SOFA/ERFA vectors, and independently cross-checked against ANISE (pure-Rust NAIF/SPICE): GCRS→ITRS vs ANISE's ITRF93 from JPL's high-precision Earth kernel, the same IERS Earth-orientation parameters fed to both, agree to ≤ 0.86 m on the ground / ≤ 3.6 m at GNSS orbit across 2020–2023.

The tightly-coupled GNSS/INS UKF navigator holds 0.77 m RMS over a 30-minute curving LEO pass that includes a 120-second GNSS outage, on a force-model orbital coast — pseudorange + Doppler with fewer than four satellites.

The spherical-harmonic gravity-functional kernel — the "map reader" a gravity-aided navigator matches against, loading any ICGEM model — reproduces the GRS80 normal-gravity standard (closed-form Somigliana, with the published equator/pole values) to 3.5e-12 across all latitudes, and produces a physically-bounded gravity-disturbance map from the real ICGEM EGM2008 field (RMS ≈ 26 mGal at degree/order 70). The map-reader code is validated; gravity-aided fix accuracy stays modelled — no public gravimeter-on-a-platform trajectory exists.

Real observations in, a real position out: the pvt solver turns a station's RINEX code pseudoranges and the GPS broadcast ephemeris into a receiver position by iterated weighted least squares — Sagnac correction, broadcast satellite clock, the dual-frequency L1/L2 ionosphere-free combination, and the Saastamoinen/Niell troposphere. Run on real IGS data (station ABMF, Guadeloupe, 2018-05-13) it recovers the surveyed coordinate to 5.7 m 3-D RMS (1.1 m horizontal). Code single-point positioning, not carrier-phase PPP/RTK.

Snapshot and solution-separation (ARAIM) RAIM with HPL/VPL, an MHSS integrity-risk budget, and the dual-/multi-constellation constellation-wide fault mode (EU ARAIM / DO-316), with Stanford integrity diagrams.

Modulation power spectral densities, anti-jam spectral separation, RMS (Gabor) bandwidth, DLL code-tracking jitter and the multipath error envelope, checked against closed-form anchors: unit-area PSDs, the BPSK self-spectral-separation identity 2/(3R_c), sub-metre coherent early–late C/A jitter at 45 dB-Hz, and BOC > BPSK Gabor bandwidth. The spectral-separation coefficient now derives the anti-jam Q the jamming model uses from the actual signal and jammer spectra. Signal-performance analysis, not RF-payload or antenna hardware design.

A 6×6 state-transition-matrix single-shooting differential corrector produces exactly periodic Earth–Moon halo / near-rectilinear halo orbits: it reproduces the published L2 southern 9:2 NRHO (the Gateway orbit) at a period of ~6.57 days (published ~6.56) and a perilune of ~3,250 km (published ~3,370). The STM is validated against finite differences and corrected orbits close to machine precision. This is a circular restricted three-body (Sun-free) solution — not validated against a real Gateway ephemeris or DSN tracking.

On real ESA OPS-SAT housekeeping telemetry (the OPSSAT-AD dataset, CC BY 4.0) the ROC/AUC detector-evaluation reproduces scikit-learn to < 1e-9, and a transparent peak-count detector separates the labelled anomalies at AUC ≈ 0.85. This reproduces the labelled separation on real mission data — not the source paper's own published model score.

Three runnable application areas behind the open engine — trusted quantum time transfer, GNSS-free quantum navigation (cold-atom interferometer vs nav-grade INS), and quantum-system fault/anomaly detection — each emitting a machine-checked representativeness + gaps-to-flight record, bundled into one reproducible study. Modelled demonstrations (validated-by-reuse where they ride a validated kernel); no TRL > 3, no flight heritage.

Deterministic from scenario + seed + engine version. A CycloneDX SBOM and SLSA build provenance ship on every release; the release toolchain is pinned to CI.

Optical-clock figures are space goals on ground hardware — no strontium optical clock has flown. See VALIDATION.md and CAPABILITY.md before citing any number.