ORBIS is shaped by a small number of commitments made before any code was written. Each one constrains the system permanently, and each is the reason a whole class of later problems cannot occur.
| # | Decision | What it forces |
|---|---|---|
| D1 | Air-gapped runtime Target | No runtime egress anywhere. All external data staged as versioned bundles. Offline-first, not offline-capable — the difference is that nothing has to be turned off to deploy into an enclave. |
| D2 | Bit-reproducibility | A deterministic, single-threaded kernel. Seeded stable RNG. A totally-ordered event queue. Parallelism between runs, never inside the kernel's decision path. |
| D3 | Multi-user, one truth | A server-authoritative simulation with clients as views — not peer-to-peer multiplayer added to a single-user application. |
| D4 | Standards-native interop | Interoperability is a first-class subsystem over a canonical internal model, rather than an export filter attached to the user interface. |
| D5 | Customer models are classified | A sandboxed plugin boundary at every model stage. The plugin API is a product surface, not a consulting deliverable. |
The split is not cosmetic. Each boundary exists to keep a property enforceable somewhere it would otherwise erode — determinism, security, or the ability to add a protocol without touching the kernel.
| Subsystem | Status | Responsibility | Why it is separate |
|---|---|---|---|
| Core | Built | The deterministic simulation kernel. World state, event queue, all physics and behaviour models. | The only component that must be deterministic. Isolating it is what keeps D2 enforceable. |
| Forge | Built | Reference datasets and scenario authoring — curation, validation, versioning, import, diffing. The ORBAT builder writes its documents through Forge's validator, so the browser and the batch runner refuse exactly the same scenarios. | Data curation has an entirely different lifecycle (review, approval, audit) from simulation execution. |
| Range | Built | Experiment management. Parameter sweeps, seed matrices, results, statistics. | It orchestrates many Core instances, so it must not live inside the thing it orchestrates. |
| Bridge | DIS v7 | Interoperability — DIS, HLA/RTI, C2SIM, MSDL, CoT, NVG. | Isolates protocol churn from the kernel, so a protocol can be added without touching Core. |
| Gateway | Built | Authentication, RBAC, classification filtering, the API surface, rate limiting, audit, and the scenario library the Deck and the builder both read. | One enforcement point. Security must not be reimplemented per service. |
| Deck | Built | The operator client. 2D and 3D views, unit control, planning, live attrition, DIS status, and switching which exercise is running. | Browser-delivered, and a view over Core rather than a peer of it (D3). |
| Atlas | Planned | Geospatial. Bundle staging, terrain, bathymetry, imagery, features, weather, transforms. | Data-heavy, cacheable and read-only at runtime — independently scalable and independently stageable (D1). |
| Muse | Planned | AI assistance. Scenario generation, ORBAT synthesis, AI opposing forces and staff, after-action review. | Optional by construction. The system must be fully usable with it disabled. |
The dependency rule. Nothing depends on Core except through its published interface, and Core depends on nothing. The kernel cannot reach the network, the database or the clock. That is not a coding convention — it is what makes D1 and D2 checkable rather than aspirational.
A fixed pipeline rather than an event soup. Order is part of the contract: the same phase sequence on every tick is half of what makes two runs comparable, and it makes "when does this happen relative to that" answerable by reading one list.
Orders arrive from the queue. The only point at which outside intent enters the tick.
Atmosphere, sea state, light and propagation conditions for this instant.
Vincenty geodesics along waypoints; fuel and throttle consume as they go.
Radar, ESM, IR and acoustic detection against signatures, terrain and horizon.
Contacts propagate into each side's picture, subject to links and EMCON.
Doctrine and mission produce intent from the picture the side actually holds.
The ten-link kill chain. Every refusal is recorded with its remedy.
Weapons in flight reach their targets; damage lands on components.
The event stream is written and digested. Nothing else may write to it.
Truth is what is actually there. Contacts are what a sensor returned, with error and an ageing classification. The side picture is what a commander has been told and still believes.
Decisions are made against the third tier only. A model that lets doctrine read ground truth cannot represent surprise, misidentification or a stale track — which are most of what operational analysis is about.
Contact held · classification · ROE permits · weapon release authority · director available · illuminator available · mount available · magazine has rounds · target within launch envelope · engagement slot free.
Evaluated in order for every candidate shot. The first link to fail stops the chain and is written to the trace with its remedy — so the answer to "why did nothing fire?" is a record, not an investigation.
Reproducibility is not a feature that can be added later. Every one of these is a place where a run silently stops being repeatable, and each has to be closed deliberately.
Keyed on (sim_time, priority, sequence), where sequence is a monotonic counter — never a pointer, hash or memory address. Ties must break identically on every machine.
One root seed; per-entity and per-stage streams derived by a stable hash of (seed, entity, stage, tick). A shared generator makes results depend on evaluation order.
No wall-clock time, no now(), no iteration over a hash map in memory order anywhere in a model path. Entity sets are sorted by identifier before iteration.
IEEE-754 mandates correct rounding for add, subtract, multiply, divide and square root — and nothing at all for sine, cosine, tangent and arctangent. Two platform maths libraries legitimately disagree in the last bit, and that is enough to diverge a run. ORBIS implements its own.
Every run produces a hash over its full event stream. A change in behaviour that was not intended shows up as a changed digest in the test suite, on the commit that caused it.
Real-time pacing lives in the outer loop. The kernel has no concept of how fast it is being run, so a paused, throttled or headless run produces identical output.
Why the maths matters more than it sounds. The first cross-platform divergence in ORBIS was a single least-significant bit in a cosine, between two operating systems, on an entity flying a straight line. It compounded into a different engagement outcome within a few hundred ticks. Reproducibility either holds at the bit or it does not hold.
A dataset version is immutable. Publishing computes a digest over its canonical form, so any edit produces a different digest and therefore a different version. There is no update-in-place.
A scenario references a dataset by digest instead of copying it, and a run manifest pins both plus the engine version and root seed.
The common alternative — scenarios that embed a private copy of the equipment data — means two scenarios can quietly disagree about the same platform, and a result cannot be traced to the figures that produced it.
Loading a dataset whose digest does not match is treated as unrecoverable rather than repaired. A silently substituted dataset invalidates every result downstream of it.
The Deck is connected to the real kernel — the architecture above, executing.
ORBIS