Validation status

On tolerances. "Validated" below means a calibration test asserts the simulated statistic matches the reference relation within an enforced gate, currently 20–25% relative error (seed-averaged) for the Allan/noise-budget relations. Median observed agreement is often much tighter (a few percent), but the guaranteed bound is the gate, not the median. Where a number like "~2%" appears it is a typical observation, not the enforced tolerance. See Claims vs. reality.

Status: white FM and random-walk FM validated; aging modeled and calibrated-out; flicker FM modeled and validated (off by default in the cited scenarios).

Maturity: the optical-clock figures are the space-oriented goal on ground hardware -- no strontium optical clock has flown. Laboratory Sr clocks reach 4.8e-17 (Oelker et al. 2019, Nature Photonics). CSAC figures are from a deployed commercial part.

Relations: Riley, NIST SP 1065, Eq. 67 -- white FM sigma_y^2(tau)=h0/(2 tau); random-walk FM sigma_y^2(tau)=(2 pi^2/3) h_-2 tau, equivalently q_rw*tau/3 for a frequency Wiener process of diffusion q_rw.

Pack 2 — inertial dead-reckoning (quantum inertial measurement unit)#

Honest framing: the cold-atom advantage is long-term bias stability (~2600x lower), which dominates a long GNSS outage via 0.5bT^2. Short-term noise is comparable (quantum ~22 vs classical ~20 ug/sqrtHz) — the quantum sensor wins the marathon, not the sprint. Maturity: cold-atom accelerometers are laboratory/early (JRC122785), navigation-grade quartz is deployed.

Pack 3 — time transfer (optical vs radio frequency (RF), optical inter-satellite link)#

Honest framing: the optical figure is a picosecond-level on-orbit synchronization target (not flown). The terrestrial optical lab floor is ~1 fs (far better); a well-engineered microwave link (the ACES (Atomic Clock Ensemble in Space) microwave link (MWL), ~0.3 ps) can rival optical, so the "RF = 0.5 ns" baseline is specifically ordinary TWSTFT. Ranging conversion is one-way (range = cdt); two-way/round-trip halves it (range = cdt/2).

Pack 4 — hybrid fusion (capstone)#

Composes Pack 1 (clock), Pack 2 (inertial), and Pack 3 (time-transfer) into one PNT (positioning, navigation and timing) suite. The suite must keep BOTH timing (< timing spec) and position (< position spec) within bounds; pnt_holdover_s is the time until either breaches. Optional optical inter-satellite link (ISL) time-transfer re-syncs the clock during the outage (time aiding only — position is not re-synced, since time transfer gives time, not position).

Result: the all-quantum suite holds full PNT through a 1.8 h outage; the all-classical suite is position-limited (nav-grade IMU breaches first). Optical ISL time-transfer keeps even the classical CLOCK locked, isolating the inertial sensor as the classical suite's weak link — the core argument for quantum inertial + optical timing together.

Geometry — GNSS availability from orbits#

Honest framing: this is a deterministic geometry layer (circular orbits, spherical Earth of mean radius 6371 km, pure line-of-sight). It establishes availability and the geometric position accuracy (dilution of precision × a representative range-error budget) from real geometry, not a precise-ephemeris navigation solution. The orbit-gnss-challenged.toml reference puts a spacecraft inside the GNSS shell: it holds a fix only ~59% of the day, the quantum clock keeps a 5 ns timing solution through every gap (availability 1.0) while the chip-scale clock holds ~0.73.

Numerical (Cowell) propagator & force model#

The numerical propagator (src/propagator.rs) integrates a hierarchical force model (src/forces.rs) with the adaptive integrators (src/integrator.rs). Each term below is validated against analytic truth or a hand-derived closed form; the perturbations are off by default, so the released goldens are untouched. The composed model is also cross-checked against another tool: tests/numerical_cowell_propagator_reference.rs runs 11 LEO and GTO (geostationary transfer orbit) cases, 275 hourly epochs, against Orekit 12.2's DormandPrince853 propagator, and the conservative tiers (two-body → J2–J6 → Sun/Moon → cannonball SRP) agree to a worst 0.08 m over 24 h (VALIDATED in the matrix); the drag tier is characterised only (333 m) and stays MODELLED.

Honest scope: the released ForceModel defaults integrate the zonal field. The high-degree EGM2008 tesseral field (src/gravity_sh.rs, degree/order 70), the solid/ocean/atmospheric tides (src/tides.rs), and the Lense–Thirring frame-dragging term are now implemented and composed into the precise ephemeris-fitting force model (src/precise_od.rs — see below). The NRLMSISE-00 (NRLMSISE: Naval Research Laboratory Mass Spectrometer and Incoherent Scatter Radar Extended atmosphere model) thermospheric density (drag is the static Vallado model), solar limb darkening / the oblate-Earth shadow, DE-grade (DE: Development Ephemeris) ephemeris accuracy, an external cross-validation of the drag tier, and a GMAT (General Mission Analysis Tool) cross-check remain follow-ons.

Tides on the geopotential (src/tides.rs)#

Time-varying corrections ΔC̄_nm, ΔS̄_nm to the Stokes coefficients (IERS Conventions 2010, Chapter 6), validated against the conventions' own published numbers — not against another tool.

Maneuvers & trajectory design (src/maneuver.rs)#

Honest scope: no trajectory optimizer, no multi-revolution Lambert branches, and a synthetic coplanar-circular heliocentric model (no planetary DE ephemeris, so a GMAT Earth–Mars C3 cross-check has not been run).

Orbit determination (OD) (src/orbit_determination.rs, src/batch_ls.rs)#

Honest scope: range-rate/Doppler and angle measurements and station-visibility masking are follow-ons for the range-only teaching estimator (the full-force ephemeris-fitting engine below carries the variational state-transition matrix).

Force-model validation by ephemeris fitting (src/precise_od.rs)#

A precise, full-force position-observation batch least-squares estimator: the EGM2008 tesseral geopotential (evaluated in the Earth-fixed frame through the CIO reduction) composed with the Sun/Moon third body, SRP, drag, Schwarzschild/Lense–Thirring GR (general relativity), and the tides above, fit to a track of inertial position fixes with a variational state-transition-matrix Jacobian. Validated on synthetic data, where the truth is Kshana's own integrator, so every residual is the estimator's and not the dynamics'.

Honest scope: the synthetic wave uses nominal Earth-orientation parameters (EOP: UT1 (Universal Time 1, Earth-rotation time) ≈ TT (Terrestrial Time), no polar motion) — exact for self-recovery, since the same model generates and fits the arc. The agency-dataset validations layer real finals2000A EOP and SP3/SPK (SPK: planetary ephemeris kernel) truth on top of this engine through the CIO frame chain (src/eop.rs, tests/agency_galileo.rs, tests/agency_swarm.rs, tests/agency_lro.rs).

Real agency precise orbits (tests/agency_galileo.rs, tests/agency_swarm.rs, tests/agency_lro.rs)#

Gravity-map / alt-PNT navigation (src/gravimeter.rs, src/mapmatch.rs, src/particle_filter.rs, src/altpnt/terrain.rs)#

Honest scope: the gravity field is low-degree + synthetic mascons, not the full EGM2008/EIGEN (EIGEN: European Improved Gravity model of the Earth by New techniques) coefficient set; the magnetic channel rides on the smooth IGRF main field plus synthetic crustal-anomaly mascons (a real high-frequency crustal map is a follow-on); the CI terrain field for the navigation-fix benchmarks is the self-contained synthetic DEM, while the .hgt reader itself is now validated in CI against a committed real SRTM v3 tile (above); the full-resolution real tiles remain #[ignore]-gated. A map-representation-error Monte-Carlo remains a follow-on. All three navigators are now scenario-engine kind= wired (gravity-map, terrain-nav, combined-altpnt).

INS / IMU error model — datasheet-referenced validation (src/inertial/)#

The IMU stochastic error model is validated against published manufacturer datasheet / dataset specifications — never against a value Kshana itself produced. The bridge from a field-unit spec to the SI (International System of Units) noise model is the standard Allan-deviation identification (Riley, NIST SP 1065 §5; IEEE (Institute of Electrical and Electronics Engineers) Std 952): the random-walk coefficient N is the overlapping ADEV read at τ = 1 s on the τ⁻¹ᐟ² slope, and the bias-instability coefficient is the flat Allan plateau (tests/imu_allan_spec.rs, hermetic — no download).

Honest scope: this validates the stochastic error model against datasheet Allan coefficients. A full strapdown + tightly-coupled EKF cross-check against the i2Nav-WHU (WHU: Wuhan University) KF-GINS vehicle dataset is a follow-on — the published static-RTK (RTK: real-time kinematic) segment converges to the cm-level antenna position, so a meaningful navigation-accuracy comparison there first requires GNSS/IMU lever-arm compensation and a dynamic free-inertial-divergence window; until then it would measure a fixed geometric offset, not navigation quality.

Deep-space & Mars PNT — D0 foundation (src/body.rs, src/mars_frame.rs, src/ephem_provider.rs, src/radiometric.rs, src/timescales.rs)#

The first milestone of the deep-space navigation engine: generalising the Earth-hardcoded core to an arbitrary central body, adding Mars dynamics, an ephemeris-provider seam, sub-microsecond time, and the light-time / relativistic-delay primitives. Every existing Earth scenario is byte-identical — the cross-platform reproducibility goldens (tests/cross_platform_golden.rs, tests/golden.rs) pass unchanged with no regeneration, enforced per commit.

Deep-space radiometric observables & CCSDS Tracking Data Message — D1 (src/radiometric.rs, src/ccsds_tdm.rs)#

The second milestone of the deep-space navigation engine: the observable model that turns the D0 light-time/relativistic-delay kernel into the actual quantities a Deep Space Network (DSN) or ESTRACK (European Space Tracking network) tracking pass reports — range, one/two/three-way Doppler, coherent transponder turn-around, regenerative/PN (PN: pseudo-noise) ranging, Δ-DOR (DOR: differential one-way ranging), and the propagation media — plus the CCSDS (Consultative Committee for Space Data Systems) 503.0-B Tracking Data Message (TDM) input/output that ingests/emits a standard agency tracking file. Honest scope: these are exact geometric models following the Moyer / CCSDS conventions; the measurement noise is the caller-supplied per-observation sigma, not baked into the model. Reproducing a specific real tracking pass needs real TDM data plus the deep-space orbit-determination solver — that is D2, not D1. Everything below is additive (the reproducibility goldens are unchanged; same SHA, no regen).

Deep-space reduced-dynamic OD — D2 (src/deepspace_od.rs, src/clock_state.rs, src/mars_atmos.rs)#

The third milestone of the deep-space navigation engine: the estimator that turns the D1 radiometric observables into a recovered trajectory — a numerically-robust Square-Root Information Filter (SRIF) with reduced-dynamic empirical accelerations, a three-state onboard clock, a Mars-drag model, and the radiometric measurement partials that connect range/Doppler to the filter state, closed end-to-end by a synthetic low-Mars-orbit (LMO) orbit-determination recovery. Honest scope: the recovery is a synthetic closed-loop (truth and filter share the same Mars propagator, and the observations are the same geometric observable model the filter inverts, plus injected Gaussian noise) — it validates the estimator machinery, not the absolute fidelity of the Mars force model; the DE-grade external cross-check is the kernel-gated xval/anise-mars-od crate (D0.8b). Everything below is additive (the reproducibility goldens are unchanged; same SHA, no regen).

Deep-space PNT scenario & one-way+two-way fusion — D3 (src/mars_pnt.rs, src/deepspace_od.rs)#

The fourth milestone of the deep-space navigation engine: a runnable Mars-PNT product scenario that ties the D0 Mars body / frame, the D1 radiometric observables, and the D2 reduced-dynamic OD into a single mars-pnt scenario kind. It models a small MARCONI-style relay constellation broadcasting a one-way (clock-coupled) signal-in-space plus relaying a two-way (coherent, clock-free) link to a deep-space station, and navigates three reference users (Mars transfer, Low-Mars-Orbit orbiter, fixed surface point) through the D3.1 joint one-way + two-way fusion estimator — a twelve-state SRIF that augments the D2 reduced-dynamic orbit/empirical block with a three-state onboard clock. Honest scope: every figure of merit is the estimator's formal covariance bound (per-epoch 1σ / 3σ position) and the achieved RMS against a synthetic closed-loop truth (truth and filter share the same Mars dynamics and the same geometric observable model, plus injected Gaussian noise) — a simulated navigation FoM, NOT an aviation-certified protection level, and NOT a flight claim (no certified fault model, no integrity monitor, no real tracking data). Everything below is additive (the reproducibility goldens are unchanged; same SHA, no regen).

Lunar coordinate time — relativistic Earth-Moon clock rate (src/lunar_time.rs)#

A Lunar Coordinate Time scale (LTC/TCL (TCL: Temps-Coordonnée Lunaire, the French name of Lunar Coordinate Time)) requires the secular rate at which a lunar-surface clock runs relative to an Earth-geoid (TT) clock. src/lunar_time.rs computes it from first principles: a first post-Newtonian identity summing the self-potential difference (the IAU L_G conventional geoid potential W0 = L_G·c² ≈ 6.26369e7 m²/s² minus the Moon's surface self-potential GM_moon/R_moon ≈ 2.822e6 m²/s²) and the kinetic (second-order Doppler) term −<v²>/2c² from the geocentric Moon velocity (finite-differenced from the Montenbruck-Gill lunar series in src/ephem.rs). The dominant self-potential term gives ≈ 57.5 µs/day, the kinetic term ≈ −0.5 µs/day, for a total ≈ 57 µs/day. The lunar-time-offset scenario reports this rate, the accumulated LTC−TT offset over a horizon, and supports a minimal inverse-variance ensemble (a lunar paper-clock); TT↔LTC conversions round-trip to < 1 ns/day.

Lunar geodetic VLBI — near-field delay for an Earth baseline observing a lunar beacon (src/lunar_vlbi.rs)#

A geodetic VLBI (very-long-baseline interferometry) observable for two Earth ground stations (a baseline) observing a one-way signal from a NovaMoon-class transmitter on the lunar surface. The Moon is near-field, not a plane wave, so the geometric delay is the exact two-range difference tau_geom = (|r2 − r_B| − |r1 − r_B|)/c rather than the plane-of-sky projection. The full observable adds the station clock-offset difference and a differenced Earth-potential Shapiro term (reused from src/radiometric.rs). Stations are placed in geocentric inertial (GCRS) coordinates via src/frames.rs + src/cio.rs; the beacon via src/ephem.rs (geocentric Moon) + src/lunar.rs (selenographic→MCMF (MCMF: Moon-centred, Moon-fixed)) + src/lunar_frame.rs (IAU-2015 ME body-fixed→inertial). The lunar-vlbi scenario samples the delay, its finite-difference rate, and the near-field correction over a pass.

The oracle is the same-codebase plane-wave Δ-DOR observable delta_dor in src/radiometric.rs: in the far-field limit (a synthetic beacon at 1e15 m) the geometric delay must collapse to −(B·ŝ_B)/c = delta_dor(r_B, [0,0,0], B) to machine precision; at true lunar distance the wavefront-curvature near-field correction is non-zero (tens to hundreds of µs). The beacon partials dtau/dr_B = ((r_B−r2)/|r_B−r2| − (r_B−r1)/|r_B−r1|)/c (and the station partials) are verified by central finite difference (relative error < 1e-5).

Lunar joint multi-technique OD + clock — simulated closed-loop recovery (src/lunar_combination.rs)#

A single-epoch (snapshot) batch least-squares fit (crate::batch_ls::gauss_newton) that fuses the geodetic-VLBI, radiometric/lunar-local-ranging and inter-satellite-ranging techniques on a SIMULATED lunar network to recover, together, a lunar surface station's 3-D position, a small constellation's per-satellite positions, and every asset's clock offset. The observables are: (1) Earth-baseline geodetic VLBI delays to the lunar station treated as the beacon (reusing src/lunar_vlbi.rs, geocentric inertial) — the headline technique; (2) Earth-station→satellite geocentric radiometric ranges (which multilaterate the constellation from the well-spread Earth stations) and station↔satellite lunar-local ranges (MCI (Moon-centred inertial) Euclidean distance plus the differenced clock term); (3) inter-satellite ranges (same form); plus a single station-clock sync pseudo-observation that anchors the otherwise-unobservable common clock offset. The state vector is [station_pos(3), {sat_pos(3)}×N_sat, station_clk, {sat_clk}×N_sat]. There is no force-model propagation inside the solver — the satellites are fixed, distinct, illustrative points on a representative lunar orbit; this is a deliberately clean snapshot fit. Internally, positions are scaled and clocks are estimated in range-equivalent metres so the normal matrix stays well-conditioned in f64; the VLBI and lunar-distance ranges are mean-removed about the nominal geometry so the finite-difference Jacobian does not suffer catastrophic cancellation. The lunar-joint-od-clock scenario runs the solve with and without the VLBI legs on the same seed/truth and reports both solutions plus the station-observability improvement factor.

The headline honest result: lunar-local ranging from a polar station to a handful of satellites that all sit toward one side of the sky leaves the station's position weakly observed along one direction, so the range-only solve is ill-conditioned and the recovered station 3-D error is large (or the solve fails to converge). Adding the Earth-baseline VLBI delays makes the station's full 3-D position observable, and the recovered station error collapses to the metre level. The test vlbi_restores_station_observability asserts the with-VLBI station error is markedly (≥5×) smaller than the range-only error on the identical injected truth — VLBI restoring the otherwise-unobservable station direction is the phase's point.

The oracle is internal consistency: an injected truth state (station ~50 m/axis, satellites ~30 m/axis, clocks ~1e-7 s, with a seeded per-component jitter) is mapped to synthetic observables through the same geometry model the solver inverts, seeded Gaussian noise is added (illustrative defaults: VLBI σ ≈ 1e-11 s, range σ ≈ 0.1 m, ISL σ ≈ 0.1 m; weights 1/σ²), and the estimator must recover the injected truth within the noise from a zeros initial guess. A Monte-Carlo mean NEES Δxᵀ(HᵀWH)Δx over seeds (formal_covariance_nees) sits within a loose band around n_params, a covariance-realism check.

Lunar reference-frame realisation — 7-parameter Helmert datum fit (src/lunar_frame_realise.rs)#

Where src/lunar_frame.rs applies the IAU 2015 WGCCRE lunar body orientation (a forward model), this module estimates (realises) a lunar reference frame from a network of estimated point coordinates tied to a datum. The estimation core is a classic 7-parameter similarity (Helmert) transform — three translation, three small-angle rotation and one scale parameter — mapping points p_i (estimated frame) to q_i (datum frame) as q_i = t + (1 + s)·R(θ)·p_i, with R(θ) = rz(θz)·ry(θy)·rx(θx) built from crate::precession::{rx, ry, rz, matmul, mat_vec}. The seven parameters [tx, ty, tz, θx, θy, θz, s] are estimated from ≥ 3 non-collinear point pairs by weighted least squares through crate::batch_ls::gauss_newton: the forward model predicts every q_i from its p_i and flattens all three components of all points into the observable vector, the observed datum coordinates form z, the weights are 1/σ², and the solve starts from x0 = zeros. Rotation angles are estimated in µrad and scale in ppb so the finite-difference Jacobian stays well-scaled at the lunar-surface coordinate magnitude (~1.7e6 m). A small icrf_orientation_tie composes the realised small rotation through the IAU body→ICRF orientation (transpose(crate::lunar_frame::icrf_to_iau_moon(jd_tdb))) and returns the realised frame's residual small-angle offset about the ICRF axes — a deliberately simple frame-of-expression change, not an independent estimate of the lunar pole.

The oracle is internal consistency: a known Helmert transform (translation ~tens of m, rotation ~µrad, scale ~1e-7) is injected into a well-spread synthetic point network (varied selenographic lat/lon → MCMF, some points at altitude), seeded Gaussian noise is added, and the fit must recover the injected parameters. On noiseless data the recovery is to ~machine precision (translation < 1e-6 m, rotation < 1e-9 rad, scale < 1e-12); with metre noise the recovered parameters land within a few × the formal σ and the post-fit RMS residual sits near the noise level. The lunar-frame-realisation scenario reports the recovered datum, the per-parameter recovery error vs the injected truth, the post-fit RMS residual, and the realised-rotation ICRF orientation tie.

Lunar navigation service volume — DOP / coverage / availability + generalised lunar ARAIM PL (src/lunar_service.rs)#

This module composes already-built pieces into a lunar navigation service-volume analysis: it sweeps a selenographic latitude/longitude grid over a time horizon against an illustrative, public-source Moonlight / LCNS-class (LCNS: Lunar Communications and Navigation Services) lunar-orbit constellation and reports DOP / coverage / availability plus a generalised lunar ARAIM protection-level envelope. The two reuses are load-bearing and explicit. DOP geometry is the VALIDATED (vs gnss_lib_py) kernel crate::orbit::dop — service_dop is a thin elevation-mask filter plus that kernel, and a test asserts the identity (service_dop equals a direct orbit::dop on the same visible positions). Integrity reuses the LunaNet LNIS (LunaNet Interoperability Specification) lunar ARAIM machinery crate::lunar::lunar_araim (σ_URE ≈ 30 m, P_sat ≈ 1e-4); lunar_protection_level generalises the existing south-pole protection level to an arbitrary surface point, and a test asserts it reduces to the south-pole case (at the south pole with the same geometry/budget it returns exactly the existing lunar::lunar_araim result to < 1e-9).

The constellation parameters are an illustrative approximation of public ESA descriptions of the system class (≈ 4 satellites on elliptical lunar frozen orbits favouring south-pole coverage — apolune over the southern hemisphere; 4 is the library default, and the bundled moonlight-service-volume.toml sets 8 because the protection level needs at least 6 in view). They are not the real Moonlight/LCNS ephemeris and imply no affiliation, endorsement, heritage, certification or TRL. The composition (coverage / availability / integrity) is MODELLED: a circular-/elliptical-Keplerian relay set (not a differential-corrected LCNS / 9:2 NRHO (near-rectilinear halo orbit) ephemeris), a mean-rotation Moon (no physical libration / precessing pole), and published LunaNet LNIS integrity parameters. It demonstrates the service-volume method, not an operational availability number. Deterministic (pure geometry; no randomness). The moonlight-service-volume scenario reports the coverage percentage, the visible-count and PDOP envelopes, the HPL/VPL envelope over the volume and the protection-level availability against the alert limit.

Lunar differential PNT — common-mode cancellation + baseline-growing residual + DGNSS protection levels (src/lunar_dpnt.rs)#

A lunar DGNSS (differential satellite navigation) / SBAS analogue: a NovaMoon-class reference station at a known selenographic location computes per-satellite differential corrections from an illustrative, public-source Moonlight / LCNS-class constellation, and a roving user offset from it by a baseline applies them so the common-mode broadcast-ephemeris errors cancel. Each satellite i carries an injected common 3-D orbit-error vector e_i and a common clock error c_i. The reference station's pseudorange residual is the correction −e_i · û_ref,i + c_i; the user's raw error is −e_i · û_user,i + c_i; the corrected user error is their difference −e_i · (û_user,i − û_ref,i). The clock term c_i cancels exactly (it is identical in both observations), and the orbit term collapses to the projection onto the difference of the two line-of-sight unit vectors, which → 0 as the baseline → 0 (the spatial-decorrelation floor) and grows ≈ linearly with baseline. The per-satellite corrected range errors are mapped through the user geometry by a small dependency-light weighted-least-squares snapshot solve ([x, y, z, clock] state via crate::orbit::invert4; a constant range bias is absorbed by the clock unknown rather than corrupting the fix) to give the user position error. The user protection level reuses the DO-229E SBAS protection-level machinery (crate::sbas::sbas_protection_level, Precision-Approach K-factors) with the differential residual σ as each satellite's 1-σ error budget.

NovaMoon is referenced only as a system class (a public description of a lunar reference station); the constellation reuses the illustrative public-source crate::lunar_service::LunarConstellation. These are illustrative parameters for exercising the differential method, not a real ephemeris, and imply no affiliation, endorsement, heritage, certification or TRL. The lunar-differential-pnt scenario reports the user position error with vs without corrections, the reduction factor, the error-vs-baseline curve and the protection level. On the default configuration the corrected user error at a 50 km baseline is ≈ 0.008 m against ≈ 24 m uncorrected (a ~3000× reduction), and ≈ 0 at zero baseline.

The oracle is internal consistency: the common-mode cancellation is an exact algebraic identity (with noise = 0, corrected error < 1e-6 m at zero baseline; the clock term cancels to machine precision at any baseline), the residual grows monotonically with baseline, and the protection level is the same DO-229E algorithm the SBAS stack is pinned against. The spatial-decorrelation residual is a first-order geometric model, not a fitted decorrelation model from real lunar tracking.

Lunar interoperability export — LunaNet/IOAG-aligned CCSDS OEM + KIF with round-trip conformance (src/lunar_interop.rs)#

The lunar reference frame, lunar time scale and lunar ephemeris are exported in LunaNet/IOAG-aligned (IOAG: Interagency Operations Advisory Group), CCSDS-based interchange forms. This phase does not invent a wire format: it reuses the crate's existing CCSDS OEM (Orbit Ephemeris Message) 2.0 emitter and parser (crate::oem::OemFile::to_oem_string / crate::oem::parse_oem) and the Kshana Interchange Format envelope (crate::interchange::Envelope), re-tagged for the lunar context. export_lunar_oem sets the OEM REF_FRAME to the IAU 2015 WGCCRE lunar body frame (MOON_ME mean-Earth or MOON_PA principal-axis), TIME_SYSTEM to the lunar time scale (LTC / TCL / UTC) and CENTER_NAME to MOON, over a sample illustrative, public-source LCNS-class ephemeris (positions from crate::lunar_service::LunarSat::position_mci, velocity by central finite difference). export_lunar_time_metadata emits a LunaNet/IOAG-aligned lunar-time descriptor (scale id, secular rate µs/day from crate::lunar_time::lunar_rate_breakdown, the published 56–59 µs/day band, reference surface) that round-trips through serde_json. export_kif_lunar wraps the OEM + descriptor + frame label in the existing KIF envelope with the MODELLED honesty label.

The oracle is round-trip / field conformance. Because oem.rs ships both directions, the OEM is round-tripped through crate::oem::parse_oem (back to an equal segment, with the lunar frame/time and state count preserved) and independently checked by oem_conformance, which verifies every required CCSDS/LunaNet header keyword is present, that REF_FRAME carries a lunar MOON_* token and TIME_SYSTEM is non-empty, that the META_START … META_STOP framing holds, and that the position+velocity data lines are well-formed — returning a structured pass plus the present/missing field list so a broken export (e.g. a dropped TIME_SYSTEM) is caught and named. The time metadata round-trips through parse_lunar_time_metadata, and the KIF envelope round-trips through Envelope::parse to equal artifacts carrying the MODELLED label.

Demonstration representativeness & gaps-to-flight ledger (src/representativeness.rs)#

A simulation result is only useful as evidence if it states, on its face, what it is anchored to, what it assumes, and what still separates it from a flight system. The representativeness ledger makes that a first-class, machine-checked output: a Representativeness record carries the demonstration's external Anchors, its modelled assumptions, its Gaps to flight (each with the phase/activity that would close it), and the TRL band it is representative for. It is the per-result companion to the capability-level verification matrix.

The oracle is a set of closed-form invariants, enforced by representativeness::tests: a Validated record must list at least one ExternalDataset anchor (a simulation cannot be validated against itself); a Modelled record must list at least one gap-to-flight and cannot claim a representative TRL band above 4 (maturation beyond that needs hardware/flight evidence, which is a gap, not a simulation output); the TRL band must be well-formed; and a PartnerOwned record must assert nothing. These invariants operationalise the "representativeness justified + remaining gaps towards flight clearly identified" discipline.

Unified quantum-vs-classical trade evidence (src/qtrade.rs)#

Every quantum-PNT application area answers the same question the same way: fix one comparison frame (scenario + seed + engine version), route a quantum candidate and a classical baseline through one neutral code path, score them on common figures of merit, and report — with a confidence interval and an honest validated/modelled label — where quantum wins and where it does not. TradeEvidence gives that answer a single shape so the timing, navigation and anomaly-detection verticals all emit the same reproducible, honestly-labelled object. It does not re-implement any trade: per-FoM numbers come from the existing engines (quantum_trade, crossover, and the vertical modules); this is the contract plus the reproducibility/representativeness wrapper, built on the representativeness ledger and the verification labels.

The oracle is closed-form benefit/winner identities plus a faithful wrap of the existing trade output. qtrade::tests: the benefit ratio is polarity-correct (oriented so >1 always means the quantum side is better, for both higher-is-better holdover and lower-is-better error FoMs); an evidence object built from a real quantum_trade::TradeResult reproduces its benefit ratios; dishonest evidence is rejected (a Modelled representativeness without a gap, or a Validated FoM whose trade record carries no external anchor); JSON is deterministic and carries the frame/seed/engine/FoM/representativeness fields.

Quantum device error-model library (src/quantum_devices.rs)#

A single place that exposes the quantum-PNT devices the demonstrator trades — optical / trapped-ion / mercury-ion clocks, classical reference clocks, the cold-atom interferometer, and time-transfer links — each as a DeviceCard carrying its headline spec and a representativeness record. Most device physics is reused (clock stabilities from holdover::QuantumClockClass and clock_state::ClockClass; the cold-atom interferometer from quantum_trade/crossover; classical optical/RF links from timetransfer_adv). The one genuinely new model is the entanglement / single-photon time-transfer link, whose timing precision is shot-limited: σ_t ≈ jitter/√(R·τ) in the detected coincidence rate R and integration τ, degraded by a dark-count penalty √(1 + dark/R) and floored by an irreducible systematic.

The oracle is the reused, published clock/CAI coefficients plus closed-form shot-noise/loss identities. quantum_devices::tests: the reused clock-stability ordering is sane (optical-lattice < mercury-ion < CSAC in σ_y(1 s)); the entanglement precision improves as 1/√τ (4× integration halves σ) when shot-limited; the detected coincidence rate falls 10× per 10 dB of link loss; dark counts monotonically degrade precision; the systematic floor bounds precision below; every device card is a valid, Modelled representativeness record.

Trusted quantum timing — end-to-end chain, secure dissemination, anomaly + trade (src/timetransfer_chain.rs)#

The quantum-time-transfer scenario composes the timing chain a quantum-PNT demonstrator needs: an end-to-end user-time budget (reference-clock coast error and link timing precision combined in quadrature) for a quantum chain (optical-lattice clock + entanglement/single-photon link) versus a classical chain (CSAC + RF two-way link); a timing protection level (TPL, reused from tpl) bounding the undetected time error; a delay/replay-attack security figure of merit 1 − P_md at a stated false-alarm rate (reused from detection); a clock-anomaly detection probability + CUSUM (cumulative sum) change-detection latency; and the quantum-vs-classical comparison as honest qtrade::TradeEvidence carrying a representativeness + gaps-to-flight record.

The oracle is a closed-form quadrature budget over reused, separately-validated kernels (ADEV vs Stable32/NIST; the TPL bound; detection::analytic_pd/analytic_pmd). timetransfer_chain::tests: quantum precision improves with integration time; the quantum chain can win and can lose the precision FoM (honest — not a universal win; a very lossy link flips the result); the protection level is finite-positive; the security FoM is in [0,1] and grows with attack delay; the anomaly detection probability is monotone in fault magnitude; and the trade evidence is internally honest (is_honest()).

GNSS-free quantum navigation (src/quantum_nav_od.rs)#

The quantum-gnss-free-nav scenario compares dead-reckoning during a GNSS outage with a quantum inertial budget (a cold-atom interferometer accelerometer, reused from inertial::quantum_imu/quantum_trade, whose CAI white-noise floor is validated to within ~2 orders of magnitude of Freier et al. 2016) against a classical navigation-grade INS. It reports the position-error growth over the coast, the holdover time to a position threshold, and the quantum-vs-classical trade as honest qtrade::TradeEvidence. Observability is stated honestly: with no external fix during the outage the accelerometer bias is unobservable, so the position error grows without bound (≈ ½·bias·t² plus a velocity-random-walk term); a lower-bias quantum sensor slows that growth but does not close the gap — only an external fix does.

The oracle is the reused inertial budgets (QuantumNavBudget/ClassicalInsBudget, both implementing the PositionDrift trait) plus closed-form drift identities. quantum_nav_od::tests: the quantum budget beats the classical over a long outage (lower error, longer holdover); the error grows with outage duration for both (the observability gap); the advantage is outage-dependent, not a constant win factor (the quantum curve is noise-dominated at short coast, bias-dominated at long); the trade evidence is internally honest.

Fault / anomaly detection for quantum PNT systems (src/quantum_faults.rs)#

The quantum-anomaly-detect scenario defines a labelled catalog of quantum-PNT faults (clock frequency-jump, drift, lock-loss; sensor bias-step, dropout), scores a detection statistic on nominal vs faulted windows, and reports the detector's discrimination as an ROC AUC and a minimum-detectable fault at a fixed false-alarm rate. The quantum-vs-classical angle: a more stable quantum-clock reference lowers the monitor noise σ, so it detects smaller faults — emitted as honest qtrade::TradeEvidence with a representativeness record.

The oracle is a closed-form AUC for the Gaussian detection statistic (nominal N(0,σ), fault N(μ,σ) ⇒ AUC = Φ(μ/(σ√2))) cross-checked against the externally-validated eval_stats::bootstrap_auc_ci (validated vs scikit-learn) and detection's analytic thresholds. quantum_faults::tests: the analytic AUC matches known values (0.5 at μ=0, →1 for large μ/σ, monotone); the empirical bootstrap-AUC CI brackets the closed form; the quantum monitor has higher AUC and a smaller minimum-detectable fault; the advantage vanishes for huge faults (both detect perfectly — not a universal margin); the catalog has five labelled classes; the trade is internally honest.

Standards conformance — interchange formats, link budget & integrity (external-oracle checks)#

These standards are validated by recovering the verbatim worked examples / reference values published in the standards themselves (or in an independent reference implementation), not by Kshana's own round-trip. Recovering a standard's own annex example is the strongest available conformance check for an interchange-format parser.

GNSS standards — external-oracle status and the honest remaining gaps:

Timing for networks, spectrum, the solar system, constellations, campaigns and LEO-PNT#

The capabilities added in the 0.28 line are graded row by row in the generated VERIFICATION-MATRIX.md; this section summarises which of them carry an external oracle. A row is VALIDATED only with an independent external oracle; everything else is MODELLED.

Outputs that are renderings, not evidence, have tests but no matrix row: the interchange exports (CZML (Cesium Language), KML (Keyhole Markup Language), GeoJSON, STK (Systems Tool Kit) ephemeris, SigMF (Signal Metadata Format)), each parsed back by a validator written from the format's specification (tests/interop_formats.rs, 13 tests; see INTEROP.md); the animations (tests/animation.rs: byte-identical re-runs, exact frame counts, well-formed SVG (Scalable Vector Graphics), no external address in the HTML (HyperText Markup Language) player); and the run report (tests/advanced_report.rs, tests/advanced_report_cli.rs: every bundled scenario reports with no empty section or placeholder value, the labels match the matrix, and the recorded command reproduces result.json and the report byte for byte).

Operating envelope#

Each pack is exercised across its stated input envelope by tests/scenario_coverage.rs, which asserts every numeric output is finite (no NaN/Inf (NaN: not a number)) and bounded. The table lists the tested input range per pack, the expected output behaviour, and the covering test.

The flicker-FM and fusion-bias rows close two specific realism gaps: the noise terms are off by default but demonstrably affect output when enabled, and the joint fusion filter does not depend on biases being zeroed — it converges with a realistic cold-atom-grade residual bias too.

Known limitations#

• Quantum and classical runs now use independent RNG (random-number generator) seeds (classical seed = seed + 0x9e3779b97f4a7c15) so their noise realizations are uncorrelated — fixed after review.
• holdover_s is segment-aware: outage timelines are split into contiguous segments at GNSS re-acquisition and the reported value is the worst-case (shortest) coast across them. It remains bounded by the time-grid resolution (a lower bound).
• ISL time-transfer re-sync models the residual link uncertainty as fresh zero-mean jitter per measurement step plus re-anchoring at the configured interval.

Claims vs. reality — quick reference#

A hostile reviewer's checklist. For each term that could be read as more than it is: what Kshana does today, and where the real version sits on the roadmap.

Lunar-PNT paper cross-checks (regression evidence, not matrix rows)#

The modelled lunar/cislunar suite (the "Lunar & cislunar" and "Lunar PNT suite" capabilities in the README) has its published-paper claims independently cross-checked in tests/validate_p*.rs, each against an oracle from a different implementation:

• orbital transmit/capture footprint vs scipy.special.j1 (Cephes Bessel J1);
• surface-beacon geometry DOP vs an independent NumPy (HᵀH)⁻¹ solve;
• UT1/EOP persistence prediction-error growth vs a NumPy re-parse of the same verbatim IERS finals2000A rows;
• planar distant-retrograde-orbit family vs the NASA/JPL Three-Body Periodic Orbit Database;
• RF ranging-precision budget vs a first-principles reference.

Fixtures and oracle-generator scripts live under tests/fixtures/{p1_footprint,lunar_service,eop_prediction,rf_ranging_precision,dro_family_jpl,p2_independent_dop}/. These strengthen the evidence behind capabilities that remain MODELLED in the machine-checked matrix (src/verification.rs); they are regression checks, not new VALIDATED matrix rows, so they do not themselves change the machine-checked matrix count. That count is not restated here, because a hand-typed copy of it drifts: the live split is the generated header of VERIFICATION-MATRIX.md, which gen_validation_artifacts writes from verification_matrix() and tests/verification_artifacts_doc_sync.rs pins.