Defensive air‑picture fusion · warning · C2
EUROSHIELD
A simulation‑only prototype that fuses multi‑sensor observations into one authoritative air picture, distributes it over open standards, and turns it into ballistic impact/apogee warnings and motion classification — warning and estimation only, never targeting.
What it is
Federated air/missile‑defence experimentation needs an interoperable, standards‑correct fusion and warning layer that plugs into a wider system of systems — with disciplined evidence of what actually works. Most prototypes are demos without traceable verification. EUROSHIELD is the opposite: every capability is traced requirement → realisation → verification, with strict PASS / FAIL / SKIP.
Capability (validated in source / lab)
Sensor fusion & tracking
Multi‑sensor ingress, association, estimation and track lifecycle into one fused air picture — ballistic‑aware.
ASTERIX CAT048 · RustDefensive warning analytics
ECEF · J2 · drag impact & apogee warnings and motion classification from a single source of truth.
warning / estimation onlyStandards interoperability
DDS air‑picture distribution plus a federate that runs a full HLA federation on three independent RTIs from one source.
OMG DDS · IEEE 1516eEvidence discipline
135 requirements across 7 phases, plus an R&D model benchmark (5/5), an executable V&V campaign (6/6), a security self-test (6/6) and a real ADS-B feed-in-the-loop — nothing unrunnable is reported as passed.
measured, CI-gated3D / AR air picture · R&D
The same fused tracks in a live WebGL scene — ballistic arcs, impact points and a 1σ sphere, with WebXR VR/AR where the device supports it.
open R&D preview →Architecture & assurance maturity
One system, phased assurance. Green = accepted; amber = implemented in source, awaiting live acceptance; blue = external participants; red = external acceptance gates still open. Nothing that cannot run is claimed as done.
Decision records & R&D
Why each choice was made, what it costs, and how mature it is — the same honesty as the diagram. Full ADRs (Nygard format) live in docs/adr/; these are the recent platform and R&D decisions.
ADR 0007Infrastructure as Code · TerraformAccepted
DecisionA small, cloud-agnostic Terraform module provisions the platform bootstrap — the euroshield namespace (Pod Security “restricted”), resource quotas, a default-deny NetworkPolicy and config; workloads apply on top via kustomize.
WhyReproducible, reviewable, version-controlled provisioning that reduces vendor lock-in — aligned with sovereignty / EDF. Targets sovereign / EU or cloud-agnostic Kubernetes, deliberately not “multi-cloud AWS/Azure/GCP”.
StatusReal and validated (terraform init/validate pass); intentionally minimal.
ADR 0008ML augmentation of the analyticsR&D
DecisionExplore ML as an augmentation, never a replacement. The physics engine (ECEF/J2/drag) and rule classifier stay the authority; ML only raises a hand — starting with an unsupervised anomaly detector where every flag carries a per-feature reason.
WhyRules and closed-form physics miss the unknown (manoeuvres, residuals) — without eroding explainability or determinism.
HonestTrained on simulated data; now independently benchmarked (5/5) with a real ADS-B feed-in-the-loop. Deep variants (PINN, Transformer, GNN) and real-data training are the gated next step.
ADR 0009Federated Learning across the boundaryR&D
DecisionFedAvg — each node trains locally, only model weights are averaged; no raw data leaves a node.
WhyIn a multi-national federation raw radar/track data often cannot cross a border, yet participants still benefit from a shared model.
ResultFederated ≈ centralized and clearly beats best local-only on skewed data. Linear FedAvg today; deep FL + secure aggregation / DP are next.
ADR 0010RL for sensor-tasking priority requestsR&D
DecisionTabular Q-learning recommends which sector deserves more radar dwell under a limited budget.
SafetyA request / recommendation only — never a command, nothing kinetic. Resource optimization inside the warning boundary, not target assignment.
ResultThe learned policy beats greedy / round-robin / random by anticipating drift. Deep RL is the next step.
ADR 0011“AI mode” operator overlayExperimental
DecisionAn off-by-default toggle overlays an anomaly halo, a flight-profile badge and the re-entry dispersion ellipse — on both the 2D map and the 3D / AR view — served by a small local AI sidecar (IsolationForest anomaly · gradient-boosting profile · MLP dispersion surrogate). C2 proxies to it same-origin, so it works on the deploy with no CORS and no public endpoint.
HonestOff by default; every element tagged “AI · R&D”; warning only. With no sidecar reachable the overlay falls back to a labelled on-board rule (physics dispersion + a plausibility flag), clearly source-tagged — and upgrades to the real ML the instant the sidecar answers. Simulated-data models; no command path.
ADR 00123D / AR air pictureExperimental
DecisionAn off-by-default 3D WebGL view of the same tracks — ballistic arcs, ground impact markers, 1σ spheres — with WebXR AR: point the phone at a real surface and tap to place a holographic sand-table (hit-test), resize on screen.
HonestVisualisation only; AR headsets are not standard C2 kit, so it is stakeholder / demo value, labelled as such; it commands nothing.
ml/R&D ML suite & validationtested
Modulesanomaly · re-entry dispersion surrogate · flight-profile · ingress anti-spoofing · plot-to-track association · federated learning · RL sensor-tasking — each a real numpy/scipy/scikit-learn implementation with the deep variant named.
ValidationA labelled corpus (disjoint train/test seeds), an independent benchmark (5/5) with pre-declared thresholds, generated model cards, an executable V&V campaign (6/6) and a security self-test (6/6) — all CI-gated. Plus a real ADS-B feed-in-the-loop: 0 false alarms over ~600 live aircraft.
Full detail: ml/README.md · ml/validation/
SecSecurity & compliance posturedocumented
ControlsTLS + Istio strict mTLS + Postgres TLS; BCrypt + JWT (HS256, short-lived) + RBAC / OIDC; tamper-evident audit hash chain; security response headers (CSP · HSTS · frame-deny); External Secrets + cert-manager; default-deny NetworkPolicy; SBOM + signed-digest releases.
FailsafeNo command path (structural); graceful degradation; an operational kill switch (safe mode). Threat model, incident-response runbook and pentest scope are documented.
ComplianceConformance-readiness mapping to GDPR / NIS2 / ISO 27001 and EU data residency (sovereign-cloud IaC), continuously verified by executable compliance-as-code (10/10, CI-gated) — honestly not certified; an independent pentest and formal certification are named external gates.
Detail: SECURITY.md · docs/security/ · docs/compliance/COMPLIANCE.md
Earlier decisions (docs/adr/): 0001 HTTP/JSON transport · 0002 tamper-evident audit · 0003 typed gRPC · 0004 Kafka/Redpanda bus · 0005 transactional outbox · 0006 observability (Grafana · Prometheus · Loki).
EUROSHIELD contains no target assignment, firing, guidance, intercept‑solution generation or physical‑effector control — and none may be added. It exposes no command path.
Access on request
The working system is a controlled demonstrator. A live demo and the evidence dashboard are available under NDA to consortium partners, defence mentors and programme evaluators.
Request access →Contact: Francesco Malagrino · Francesco.malagrino@gmail.com · Source & evidence under NDA in a controlled data room.