ORBIS is a multi-domain constructive simulation for operational analysis, wargaming and training. Every run is bit-reproducible, every engagement is traceable to the rule that decided it, and every result is tied to the exact dataset that produced it.
ORBIS models air, surface, subsurface, land and space forces at the operational level: sensors detect on physics rather than on a lookup, weapons are released only when a full engagement chain permits it, damage lands on individual components, and each side acts on the picture it actually holds rather than on ground truth.
That much is table stakes. What ORBIS adds is the discipline around it — reproducibility, explainability, versioned data and open interfaces — because in analysis the number is worth only as much as the account you can give of it.
The kernel is single-threaded with a totally-ordered event queue and seeded per-entity RNG streams. The same scenario and seed produce a byte-identical event stream on any machine — including the transcendental maths, which ORBIS owns rather than inheriting from the platform libm.
A ten-link chain is evaluated for every shot — contact, classification, ROE, weapon release authority, director, illuminator, mount, magazine, launch envelope, engagement slot — and the link that failed is recorded with the remedy. "Why did that weapon not fire?" is answered by the system, not reconstructed by the analyst.
Batch execution over a derived seed matrix returns proportions with Wilson score intervals and continuous measures with Student-t intervals. Each batch re-runs a seed and compares digests, so a batch that was not reproducible says so instead of quietly reporting noise.
Datasets are immutable and content-addressed. Scenarios reference a dataset by digest rather than copying it, and a run manifest pins both — so a result can always be traced to the exact equipment figures that produced it, and an edit produces a new version rather than silently changing an old one. An exercise authored in the browser is validated against the loaded dataset before it can be saved, and refused rather than repaired when it does not fit.
Interop is a subsystem over the canonical internal model, not an export filter bolted to the UI. DIS v7 over multicast ships today with dead-reckoning transmit gating and unmapped-entity diagnostics. HLA with RPR-FOM and NETN-FOM follows.
One simulation, many views. The operator client runs in a browser with no install, the server holds the single truth, and role-based access and classification filtering are enforced at one gateway rather than in each service.
Evaluated for every shot. The link that failed is recorded with its remedy — which is what turns “why did that weapon not fire?” from an investigation into a lookup.
ORBIS is under active development toward v1.0. This is what is built and running right now — not the roadmap. Nearly all of it is covered by the automated suite; anything newer than the suite is marked, because a capability list that quietly counts untested work is the first thing a technical evaluator checks.
On verification. ORBIS grades its own checks. An EXACT case has a closed-form answer and must match it; a LAW case must obey a physical relationship such as inverse-fourth-power radar range; a SANITY case only has to be plausible. Publishing the grade alongside the result is the point — a suite that reports 100% without saying what was actually pinned is telling you very little.
Three columns, updated as work lands. A product page that lists only what works tells you nothing about the shape of what is coming — and the second column is usually the one a technical evaluator wants.
On the air-gap column. Nothing ORBIS wrote reaches the network: the API is same-origin, fonts and code are bundled, and the kernel has no socket. The gap is geospatial — in the default development posture the map fetches basemap and elevation tiles from public endpoints, which the client labels LIVE TILES · DEV on screen. Staged bundles and a network-denied CI job close it, and until they land this is listed as in progress rather than done.
The closest comparable product is Command: Professional Edition (Matrix Games / Slitherine), the de-facto standard for operational-level constructive simulation and a genuinely strong physics model with a large curated equipment database. ORBIS is not trying to out-model it on sensor physics — that ground is well held.
The difference is everything around the model: whether a run can be reproduced, whether a result can be explained, whether data can be versioned, and whether the system can be integrated with rather than exported from.
| Capability | Comparable (Command PE) |
ORBIS | What the difference means in practice |
|---|---|---|---|
| Physics-based sensors, damage, doctrine | ✔ | ✔ | Comparable. This is the shared baseline, not a differentiator. |
| Curated equipment database | ✔ | ✔ | Both ship one. ORBIS additionally maps every platform to standards enumerations rather than to internal identifiers. |
| Immutable, versioned datasets | ✘ | ✔ | A result stays traceable to the exact figures behind it. Editing data produces a new version instead of changing history. |
| Explainable engagement traces | ✘ | ✔ | The system names the failed link and its remedy, instead of leaving the analyst to infer why a shot never happened. |
| Monte Carlo batch execution | ✔ | ✔ | Both run many iterations headlessly. |
| Experiment manager, DoE, results store | ✘ | ✔ | Sweeps, manifests and confidence intervals are first-class, so "71% ± 6%" is a product output rather than a spreadsheet exercise. |
| DIS | ◐ | ✔ | Full DIS v7 over multicast with dead-reckoning gating, rather than a limited broadcast subset tied to internal database identifiers. |
| HLA / RPR-FOM / NETN-FOM | ✘ | Planned | The requirement that most often decides a coalition exercise procurement. |
| REST / WebSocket API | ✘ | ✔ | ORBIS can be driven and observed by other systems. Integration does not require a file export. |
| Scenario authoring in the client | ✔ | ✔ | Both author scenarios. The difference is the shape: an ORBIS scenario is a small document that references the dataset by digest, so it is validated on save, refused rather than repaired when the data has moved on, and switched into a live server from a browser without a file changing hands. |
| Browser client, no install | ✘ | ✔ | A participant joins an exercise with a URL. No workstation build, no per-seat installation. |
| Linux and container deployment | ✘ | ✔ | Runs where the rest of the estate runs, including inside an accredited enclave. |
| Multi-user over one simulation | ◐ | ✔ | Server-authoritative from the first line of design, rather than multiplayer added to a single-user application. |
| Pluggable model overrides | ◐ | Planned | A documented, sandboxed plugin surface — so a customer's classified model is a supported extension, not a bespoke engineering engagement. |
| Air-gap capable | ✔ | ◐ | Command PE runs disconnected today. ORBIS is designed for it — no service reaches out, the API is same-origin and the kernel has no socket — but the map still streams tiles in the development posture, so this is honestly a partial until staged bundles land. |
| Bit-reproducible runs | ✘ | ✔ | The same scenario and seed give a byte-identical event stream on any machine — the foundation everything above rests on. |
Sourcing. The comparison column is drawn from the published Command PE v2.4.3 User Manual, the v2.4.0 Database Manual and the shipped database schema, and is recorded in full with citations in the project's internal teardown. Where a capability is marked partial it is because a limited form exists — not because it is absent.
Run a plan two hundred times and report a success rate with an interval, tied to a pinned dataset and a recorded seed. The finding can be re-run by someone else and reach the same answer.
Change one platform, one sensor or one rule of engagement and measure what actually moved. Immutable datasets make the comparison honest, because the only thing that changed is the thing you changed.
Drive or feed a wider federation over DIS today, HLA next. Participants join through a browser, and the umpire holds one authoritative picture.
Because every engagement records the link that stopped it, the effect of a rule change is visible directly rather than inferred from an outcome distribution.
The Deck is the live operator client, connected to the real kernel — plot courses, run the clock, switch layers and open the decision trace on any engagement. The guided demo walks through it.
ORBIS