One engine for the whole failure chain.

SGP4/SDP4 propagation from real two-line elements (a committed Celestrak GPS snapshot) or synthetic Walker constellations whose mean elements realise the i:T/P/F formula to under 1 km over 24 h. Multi-constellation visibility, dilution of precision and GNSS availability, a constellation-design optimiser, streets-of-coverage sizing, and a Walker design sweep that reports the Pareto-optimal designs over a planes × satellites grid.

A numerical (Cowell) propagator complementing the analytic SGP4/SDP4 path, with a hierarchical force model: two-body + the full J2–J6 zonal field, an optional EGM2008 tesseral geopotential to degree/order 70, epoch-driven Sun and Moon third-body gravity (a built-in ephemeris, no DE/SPK kernel), solar-radiation pressure with a conical umbra/penumbra shadow, atmospheric drag, the post-Newtonian Schwarzschild relativistic correction, and the Lense–Thirring frame-dragging term — driven by a choice of RK4 step-doubling or Dormand–Prince RK5(4) adaptive integrators.

Impulsive ΔV nodes with 6×6 covariance propagation, finite-burn integration checked against the Tsiolkovsky rocket equation to under 0.01 %, an Izzo-2015 single-revolution Lambert solver and an exact universal-variable Kepler propagator, and a porkchop (launch × arrival) C3 / arrival-V∞ sweep emitted as a JSON contour grid — the performance-simulation layer above GMAT/Orekit.

IERS leap-second UTC / TAI / TT / UT1 scales, a Julian-date API, the IAU-2000 Earth Rotation Angle, GMST-based TEME ↔ ECEF and WGS-84 geodetic frames, full IAU 2000A/2000B nutation and IAU 2006 precession, and the equinox-free CIO-based IAU 2006/2000A GCRS↔ITRS reduction with IERS polar motion — validated bit-for-bit against the SOFA/ERFA vectors and independently cross-checked against ANISE (pure-Rust SPICE): GCRS→ITRS vs ANISE ITRF93, same IERS EOP, agree to ≤ 0.86 m on the ground / ≤ 3.6 m at GNSS orbit.

An operational-style Earth-orientation predictor — least squares over bias, rate and the principal periodic terms across a trailing window — measured against genuinely archived Bulletin A predictions rather than against persistence. The offline default input is a real IERS finals2000A product carrying Bulletin A prediction rows, so a bare run emits a populated per-horizon table instead of an empty one. UT1 and polar motion are reported over a common row set together with their combination, so the joint figure is one statistic rather than a quadrature sum of two different samples.

Three-axis strapdown INS — quaternion attitude, WGS-84 NED mechanization, coning/sculling compensation, and a full deterministic IMU error model — plus a first-principles cold-atom-interferometer accelerometer (Mach–Zehnder phase, projection noise, contrast decay, vibration coupling) and a particle filter for terrain-/gravity-referenced GPS-denied navigation.

Position error against coast duration from an IMU error budget — bias, random walk and scale factor, each with its own growth law and its own share of the crossing — so the cost of a navigation outage is a computed curve rather than a swept drift rate. Threshold crossings are engine output with the dominant contribution named at each one, across four IMU grades, and a terrain-fix interval is scored in its own block so the headline crossings stay unaided.

A cold-atom gravimeter measurement model whose white-noise floor is derived from the CAI accelerometer physics, a low-degree fully-normalised spherical-harmonic gravity-anomaly field plus synthetic mascons, and a gravity-map-matching particle filter — extended to terrain-referenced navigation against an SRTM elevation DEM (TERCOM/SITAN), an IGRF-14 geomagnetic main field to degree/order 13, and a combined gravity + magnetic + terrain navigator that fuses all three scalar channels. A 60-minute GPS-denied benchmark — a ~700 km / one-hour outage where the inertial solution drifts to ~70 km — is recovered to ~145 m by a hierarchical coarse-to-fine matcher: the ESA NAVISP Quantum Wayfarer target.

A 15-state error-state EKF that coasts through GNSS outages on a calibrated inertial solution; a tightly-coupled pseudorange mode that keeps correcting with fewer than four satellites; a coupled clock + position filter; a general unscented (sigma-point) Kalman estimator; a tightly-coupled GNSS/INS UKF navigator validated to 0.77 m RMS through a 120 s outage on a curving LEO pass; and a full 17-state tightly-coupled GNSS/INS UKF whose quantum-CAI dead-reckoning coasts the outage on the cold-atom accelerometer's derived velocity-random-walk.

Recovery of an orbital state from ground-station range tracking, composing the two-body + J2 force model and RK4 integrator with a Gauss–Newton batch differential corrector (sub-metre / mm·s⁻¹ from noiseless ranges, ~2 m at a 5 m noise floor) and a sequential unscented-filter variant.

A general, reusable Fisher-information / Cramér–Rao layer (src/fim.rs): the information matrix M = HᵀWH, the Cramér–Rao lower bound, observability rank and the datum-defect null space (Moore–Penrose pseudo-inverse), and D/A/E/T-optimal experiment-design scalars from a symmetric Jacobi eigensolver. It underpins the DOP engine, the passive-geolocation bound, and the lunar absolute-station observability result — internal ranging leaves a six-DOF rigid-body datum defect that an Earth-baseline VLBI tie restores for a sparse constellation and sharpens for a rich one, the absolute datum closing at three non-collinear Earth stations.

An Earth–Moon circular restricted three-body (CR3BP) propagator in the rotating frame — a conserved Jacobi constant and all five Lagrange points — with a 6×6 state-transition matrix and a single-shooting differential corrector that produces genuinely periodic halo / near-rectilinear halo orbits (NRHO): it reproduces the published L2 southern 9:2 NRHO (the Gateway orbit) at a period of ~6.57 days and a perilune of ~3,250 km. Plus LunaNet / LNIS cislunar PNT geometry (MCI↔MCMF reduction, selenographic coordinates) with a lunar south-pole ARAIM pass that honestly surfaces the integrity gap: a ~30 m σ_URE drives the protection level well above a 50 m alert limit.

Realises a lunar body-fixed frame from an observing campaign: a weighted Gauss–Newton similarity fit over station–reflector geometry, reporting the datum, its covariance and the worst-determined axis. The coupled frame-and-timescale gauge is carried explicitly rather than absorbed, so the rank deficiency is visible in the report instead of buried in a pseudo-inverse.

Sweeps an illustrative Moonlight/LCNS-class constellation over a selenographic grid: visibility, dilution of precision, coverage, and per-epoch ARAIM protection levels against a configurable alert limit. The signal-in-space ranging accuracy is a parameter, so the sweep answers a ranging requirement over the whole volume rather than pass/fail at one fixed value.

Measures how far three independent authoritative lunar ephemerides actually disagree, and turns that into a design law: the frame-versus-ephemeris error budget a mixed-provider user inherits, and the consistency tolerance a provider has to hold to keep that budget inside a stated bound.

The linear algebra a self-referential lunar constellation needs to detect its own faults with no ground truth: the weighted parity projector in the rank-deficient pseudo-inverse form that survives the datum-and-timescale gauge, per-node detectability, the Baarda minimum detectable bias, and Byzantine block-spark detect/identify counts over real DE440 inter-node geometry.

Replaces the simulated campaign with real data: 337 archived ILRS lunar laser-ranging normal points across five retroreflector arrays, each observation weighted by its own recorded precision out of the file. The reflector coordinates are a principal-axis DE440 catalogue kept under its own filename, separate from the mean-earth DE430 table — feeding one to the other's rotation moves a reflector by hundreds of metres and nothing objects, because both are well-formed coordinates.

Differential corrections between a lunar reference station and a user. The common-mode cancellation is an exact identity; the spatial-decorrelation residual is a first-order geometric model that grows with baseline, and the correction-link residual budget is reported beside it so the limiting term stays visible rather than folded into one number.

Per-clock-class crossover times for a lunar timescale — when each oscillator class stops meeting a stated bound without an update — together with a lunar geodetic VLBI observable and the Fisher information it contributes to the datum.

The service volume runs on published constellation designs instead of an illustrative one: the five-satellite LANS interoperability-demonstration reference set, the LNCSS case studies at 8, 12 and 16 satellites, and the four spacecraft actually in lunar orbit on 2023-01-01 from JPL Horizons. Each file states its own frame and its own provenance class, a horizon past the end of a tabulated ephemeris is refused rather than extrapolated, and the illustrative Keplerian result is emitted beside the retrieved one with the difference between them, never replaced by it.

Per-satellite jammer-to-signal ratio over real lunar slant ranges, with the wanted-signal side kept as a distribution rather than collapsed to a median, so the denial contour carries the uncertainty band the relay geometry actually produces. Two criteria are reported side by side: the power-ratio threshold, and loss of lock computed from tracking-loop dynamics. The orbital capture footprint is swept over transmitter altitude and beamwidth, and where the grid never reaches limb capture the report says so and prints the shortfall.

Accumulates the lunar VLBI delay partials into a Fisher information matrix over a baselines-by-epochs schedule and returns the station coordinate covariance, so the step from delay precision to coordinate sigma is estimated rather than assumed. The free network is reported beside the datum-fixed one, with its rank defect and the unobservable direction named. The surface-point covariance is kept distinct from the Earth-station one, because the near-field beacon partial is a difference of two station unit vectors and does not behave like the far-field case.

An open deep-space / Mars radiometric navigation engine: iterative light-time + Shapiro delay, two-/one-/three-way Doppler & range (Moyer two-leg), coherent transponder turnaround, regenerative/PN ranging and Δ-DOR; CCSDS-TDM I/O; a reduced-dynamic Square-Root Information Filter (empirical accelerations + onboard clock + Mars drag) that does Mars-LMO orbit determination in a synthetic closed loop; one-way+two-way fusion; and a MARCONI areostationary relay constellation with an end-to-end GSE performance simulator.

Fault injection gives the cross-modality monitor a detection power rather than a fault-free pass: a minimum detectable bias per axis at a stated false-alarm and missed-detection budget. After a handover the covariance re-growth is propagated against the alert limits, so the report states how long the single-modality solution stays inside them rather than only that the handover was continuous. The optical and RF ranging legs are compared only at matched accumulation time and path, and the report refuses to form a ratio against a value that was chosen rather than measured.

Snapshot and solution-separation RAIM with horizontal and vertical protection levels (HPL/VPL), fault detection and exclusion, and Stanford integrity diagrams — plus an explicit integrity-risk-budget (MHSS) protection level with the dual-/multi-constellation constellation-wide fault mode (EU ARAIM / DO-316).

The engine's MHSS protection levels run against the EU-U.S. Working Group C reference airborne algorithm's own published worked examples, each transcribed with its retrieval URL, date, page and file SHA-256 and held in two places that a test asserts agree. The acceptance vector is the internally consistent Reference Airborne Algorithm Description Document v3.1, Appendix D. The Milestone 3 report carries two internal defects — a sign typo in the geometry, and a false-alarm multiplier evaluated at 57 fault modes while the text states one — so its protection levels are reported as measured discrepancies rather than graded, and the defects are demonstrated by running the document's own numbers.

SBAS / WAAS protection levels in the DO-229E weighted-least-squares form (precision-approach and en-route K-factors) and the L1/L5 dual-frequency ionosphere-free combination (IS-GPS-705) that underpins DO-316, with the protection-level geometry cross-checked against a reference linear-algebra implementation.

Two-state Kalman holdover, Allan-family stability (ADEV / MDEV / TDEV / HDEV) with confidence intervals and a full IEEE-1139 five-coefficient power-law fit, and the operational transfer methods — TWSTFT with the BIPM Sagnac closed form, GNSS common-view, PPP ionosphere-free transfer, a free-space optical link with turbulence scintillation, and an inverse-variance clock-ensemble timescale. A GNSS-denied clock-holdover calculator inverts the van-Loan coast-error growth to a holdover-to-threshold — how long a clock free-runs before its timing error exceeds budget — across classical and quantum-clock classes; modelled, and honest that for a very stable clock the holdover to a tight threshold is set by the assumed long-tau noise floor, not the cited ADEV.

Forward pseudorange / Doppler synthesis with Klobuchar (broadcast) and IONEX / TEC-grid (measured) ionosphere — including an IONEX file parser, time interpolation, and the thin-shell slant-obliquity mapping — Saastamoinen + Niell troposphere, and snapshot RAIM.

A real receiver position solved from real RINEX code pseudoranges + broadcast ephemeris by iterated weighted least squares — Sagnac/Earth-rotation correction, broadcast clock with TGD, the dual-frequency L1/L2 ionosphere-free combination (or single-frequency Klobuchar), Saastamoinen/Niell troposphere, elevation weighting, DOP, and snapshot RAIM.

A link-budget jamming model (J/S → effective C/N₀ → loss of lock), a stochastic time-spoof detector (Neyman–Pearson / χ²₁ energy test with Monte-Carlo P_fa/P_md and a Security FoM of 1 − P_md), and a multi-layer spoof detector fusing a RAIM-consistency parity test, an RF AGC-power monitor, and a signal-quality (SQM) monitor. Plus a quantum-inertial dead-reckoning error budget composing cold-atom-interferometer white-noise drift with residual bias (cross-checked against an independent integrator) and scale-factor error into a position-drift-over-holdover figure — the inertial twin of the clock holdover.

The signal-performance layer between the link budget and the measurement domain: unit-area power spectral densities for BPSK-R(n) and sine-BOC(m,n), the spectral-separation coefficient that derives the anti-jam Q the jamming model consumes directly from the actual signal and jammer spectra, the RMS (Gabor) bandwidth that sets the ranging-information content (BOC > BPSK), the coherent early–late DLL code-tracking thermal-noise jitter, and the coherent early-minus-late multipath error envelope with narrow-correlator suppression, and a ranging-code design-trade (m-sequence/Gold autocorrelation sidelobe and the three-valued Gold cross-correlation bound, plus the code-length-to-unambiguous-range inversion). This is signal-performance analysis, not RF-payload or antenna hardware design.

Locate a jammer or spoofer (or an opportunistic source for reverse-PNT) from time-difference-of-arrival hyperboloids across a receiver network, solved by Gauss–Newton least squares; adding frequency-difference-of-arrival with moving receivers jointly recovers the emitter's position and velocity, with the Cramér–Rao bound on the position covariance from the network geometry. A point-source line-of-sight model — no multipath / NLOS, receiver-clock-bias, or refraction terms.

Multi-GNSS RINEX-3 broadcast-ephemeris ingestion (GPS, Galileo, QZSS, BeiDou, GLONASS), a RINEX-3 observation parser (the RINEX 4.00 observation layout is expected to parse but no 4.00 file has been read through it; RINEX 4 navigation files are refused by name), an SP3-c/d precise-ephemeris reader/writer with Lagrange interpolation, and CCSDS OEM 2.0 + OMM (mean-elements) export for flight-dynamics tools (GMAT, Orekit, STK), and CCSDS-TDM (503) tracking-data-message parse + emit for deep-space radiometric tracking.

A requirement-to-module-to-test-to-oracle-to-status cross-reference rendered from the engine itself (Markdown/CSV), with unit-tested honesty invariants: a row may be labelled validated only if it carries an independent external oracle (NIST / AIAA / SOFA / IGS / a published value), so an internal self-consistency check cannot masquerade as a validation — and the hardware/PA capabilities Kshana does not provide are recorded as partner-owned gaps. The executable backbone for an ECSS-E-ST-10-02 verification cross-reference.

Every numeric field a scenario emits carries a unit and a provenance class drawn from a closed vocabulary, with a definition where one exists, published as a machine-readable schema beside the engine. A ratcheted gate runs every built-in kind and fails on a field that carries none; the kinds not yet complete are named one by one with the reason each is still open, and the list can only shrink. Reports that state their own constants — the one-way link budget, the optical and RF budget — let a reader recompute the headline from the report alone.

First-order mission-design budgets, each a runnable scenario: two-body launch & ascent geometry (launch azimuth, minimum inclination, Earth-rotation bonus, dogleg plane-change Δv, daily opportunities), an Allen–Eggers ballistic re-entry corridor (peak deceleration, peak-g and peak-heating velocities), Earth-observation coverage geometry (swath / nadir GSD / off-nadir access / revisit via the SMAD space triangle), a 3-DOF attitude & pointing error budget (gravity-gradient torque + RSS pointing budget), ground-station pass prediction (AOS/TCA/LOS, max elevation, access), and a one-way link budget over the CCSDS 401 / DSN 810-005 link equation (FSPL, C/N₀, Eb/N₀, margin, closure). The pre-hardware analytic layer below STK/GMAT/Basilisk — modelled first-order budgets, not a 6-DoF or radiometric replacement.

A contact plan and an aperture count in; navigation duty, communications duty, per-session outage and contention out. The arbitration policy is named in the report rather than implied, and a session that cannot be fully served reports the fraction of it that was lost instead of disappearing into an average.

A space-weather environment model: solar (F10.7 / centred-81-day F10.7a) and geomagnetic (Kp, with the definitional Kp↔ap table) activity indices, the Jacchia-1971 exospheric temperature they drive, and the activity-corrected versus static thermospheric neutral density at altitude — the solar-cycle density dependence a static atmosphere omits. A calibrated first-order scale-height coupling, not a data-validated NRLMSISE atmosphere.

An RF-impairment detection evaluation testbed: a labelled, parameter-grounded synthetic corpus (nominal / jamming / spoof-time / spoof-position / multipath), a detector-agnostic ROC/AUC harness scoring any detector with per-class Pd at a target Pfa, and the in- versus out-of-distribution optimism gap. A deeper optimism-gap study extends this to a 13-detector panel (energy / AGC / SQM / parity plus seeded logistic-regression and one-hidden-layer-MLP detectors), in- versus out-of-distribution scaling laws with a permutation null, and a leave-one-out predictor of out-of-distribution degradation; a software-defined-receiver front end (raw IQ/IF to correlator early/prompt/late taps to SQM) and real-data ingest adapters (RINEX, u-blox UBX, GnssLogger, JammerTest, Yunnan, SatGrid) let the same detectors run over recordings supplied locally. Plus a quantum-vs-classical PNT trade that quantifies a candidate clock's timing and inertial holdover benefit from a measured-ADEV curve against a classical baseline, with a GNSS-denied resilience-vs-time envelope. Modelled operating characteristics — never field/IQ data, no good/bad verdict.

A reproducible map of where a quantum sensor overtakes its classical counterpart under parameter uncertainty: cold-atom versus navigation-grade dead-reckoning and optical versus chip-scale clock holdover, over outage duration and platform vibration, each curve carrying a technology-readiness label. Reproducible via cargo run --bin crossover_study. Modelled performance budgets — the inputs are published or bracketed coefficients, not flight data.

A holdover-limited bound on the undetected time error under GNSS spoofing: given an independent cross-check, the served-time error is bounded by a k-sigma monitor floor, the van-Loan coast variance over the detection latency, and a CUSUM time-to-alarm. Calibrated on a real recorded spoof (JammerTest 2024) and reproducible via cargo run --example tpl_jammertest. Modelled composition, conditional on detection — there is no finite unconditional bound, since a slow-enough ramp evades a single clock-aided monitor.

A framework-aligned scoring engine (DHS RPCF categories) that maps an architecture's simulated behaviour to per-dimension sub-scores, then asks whether any single composite score or maturity Level is a stable basis for a decision — via a Dirichlet weighting simplex, Kendall-tau rank instability, a top-1 winner flip rate, and common-mode diversity collapse (Hill-N2) — with an integrity-hashed assurance report. Reproducible via cargo run --example resilience_report. Modelled synthetic architectures aligned to RPCF v2.0; a self-assessment, not a certification.

A detection-miss-to-integrity bridge: an undetected bias left by a missed spoof / jam / RAIM detection inflates the effective position error, which — held against context-specific alert limits — is classified into the Stanford-ESA integrity regions (available / unavailable / misleading / hazardous). Composes the externally-anchored RAIM Stanford classification; adds no new integrity mathematics.

A cost-per-coverage ROI lens — cost per unit of delivered coverage for a constellation / architecture trade. The coverage component composes the validated coverage geometry and the arithmetic is unit-tested, but the cost is a user input — so the ratio is a planning aid, not an externally-validated quantity (hence, honestly, no proof badge).

A versioned, self-describing envelope that wraps a scenario result with its kind, schema version, and modelled/validated labels, so a stored artifact stays self-documenting and older envelopes remain forward-compatibly readable.