a11oy ·Mission Surfaces ·in-image · signed · re-verifiable console →
Five working surfaces · live on this Space

One platform.
Five mission answers.

Each surface below runs live inside this container and returns a real result — a governed decision with a signed, tamper-evident record you can re-verify on screen, a deployment package read live from the registry, a readiness dashboard, an instant trajectory picture, and the whole governed decision running on the device itself.

Surfaces live
0 / 5
Records signed
0
Re-verified
Registry

AI Oversight

Watch an autonomous system make a decision and catch the exact moment it crosses an authorized limit. Every run is sealed into a signed, tamper-evident record — press Re-verify to confirm it, then Tamper test to prove a single changed byte is detected.

Signed record idle

      

Deploy Posture

The signed, ready-to-ship deployment package — the same artifact deploys from cloud to a disconnected edge node with one command. Existence, digest and signature are read live from the public registry on each click, not asserted from memory.

Registry response idle

      

Mission Health

A live readiness dashboard that tells you who is ready to deploy and who needs review. Each verdict is computed in-image from concrete readiness criteria; missing data forces a review — the system never assumes a member is ready.

Computed in-image idle

      

Trajectory Picture

Paste any trajectory or orbit data — a JSON array or plain rows — and see it placed in an operational 3D picture instantly. The system auto-detects the fields, assesses each track against real orbital-regime envelopes, and flags anomalies. No bespoke per-source integration.

LEO MEO GEO anomalous drag to rotate
Assessment idle

      

Edge Run

The whole governed decision running on the device itself, with no connection required. The run executes fully in this container with no outbound call, the on-device model router picks a tier, and the result is signed and re-verifiable — the same container is the package that deploys to a disconnected node.

In-image governed run idle

      

What is real here. Every surface above runs live in this container. Governed decisions are sealed into real DSSE envelopes signed by an in-image ECDSA-P256 key (verifiable against /cosign.pub); change one byte and re-verify returns false. The advisory trust score (Λ) is a research conjecture, not a pass/fail oracle. Deploy posture is read live from the public registry. Attestation is SLSA Build L2 on the organ images (honest L1 + L2) — not the bundle, not L3, not an ATO. Readiness and trajectory use clearly-labelled sample inputs over real logic; plug a real feed into the same shape and they are live.