The Barycenter runtime.
A software layer that lets autonomous missions act under explicit, auditable human authority. It preserves five properties across every component it governs: authority, uncertainty handling, resource feasibility, safety, and evidence.
What it is
The runtime is a layer, not an application. It sits above flight software, spacecraft buses, ground systems, and the autonomy components a mission already uses, and it decides what an autonomous system is allowed to do, proves the action was authorized, and records the evidence to reconstruct every decision. It is not an autopilot and it is not an AI model. Adaptive intelligence can propose actions inside it. It cannot approve its own.
What it does not replace
The runtime does not replace the software your mission already depends on. It provides common semantics and control contracts across those components. Flight and mission teams keep the tools they trust.
- Flight controllers and attitude control systems.
- AutoNav, Terrain-Relative Navigation, and other domain-specific autonomy.
- Instrument-side algorithms, including learned perception models.
- Existing mission planning and command sequencing tools.
- Ground software, deep-space link scheduling, and operations tooling.
Each capability is small enough to explain in a paragraph.
Intent compilation
Authorized mission intent, the desired outcomes, priorities, prohibitions, permitted risk, and approval requirements, is compiled into formal, machine-checkable goals and constraints. Natural language can be a source, but it is never executable on its own. Intent is versioned and immutable: any change creates a new version bound to a content hash.
Authority and delegation
The runtime models who may create, approve, activate, and delegate mission decisions. Delegation only attenuates: a delegate can never gain more scope, duration, or power than the delegator held. An approval binds to the exact content and hash it approved. Revocation is a first-class event that propagates, including to nodes that were disconnected when it happened.
World model under uncertainty
A provenance-aware, uncertainty-bearing estimate of mission, asset, and environment state. It strictly separates belief, the estimate, from ground truth, and keeps unknown and contradictory information representable rather than forcing a false answer. Every belief carries provenance: which instrument or algorithm produced it, when, and with what estimated error. Provenance is a safety property, not a debugging aid.
Capability and resource awareness
The runtime represents what each asset can actually do, and treats capability as something that degrades over time rather than a fixed number. Resources, power, thermal, propellant, data, bandwidth, and time, are first-class state carried with margins, not afterthoughts checked at the end.
Planning and decision
Courses of action are generated and evaluated against goals, constraints, resource margins, and uncertainty as one coupled problem rather than a cascade of independent optimizers. When conditions change or authority is revoked, the runtime re-plans, and where it can it repairs the existing plan rather than restarting. Where more than one vehicle is involved, coordination is carried as contracts that survive intermittent communication.
Independent assurance and permits
This is the difference. An independent assurance function gates every consequential action, and nothing executes without a permit. Each permit is checked against granted authority and safety invariants by a component kept deliberately small, verifiable, and separate from the planning and learned components it supervises. Learned components are wrapped in explicit operating-domain contracts, and one that drifts outside its qualified domain loses trust automatically. Adaptive intelligence can propose actions; it cannot approve its own.
Execution mediation
Only permitted actions are dispatched, through adapters, to the flight or ground systems that actually carry them out. The runtime records the acknowledgement and the observed outcome of each one, closing the loop between what was authorized and what happened.
Evidence and the digital thread
The system is event-sourced. The immutable event log is the source of truth, and current state is a projection of it. Deterministic replay, full decision reconstruction, counterfactual simulation, and audit are therefore properties of the substrate, not features bolted on afterward.
Ground, onboard, disconnected
The same runtime, with the same meaning, runs in three modes: on the ground, onboard the vehicle, and fully disconnected. Loss of communication changes how quickly authority can be refreshed. It never changes who holds it.
The doctrine
Learned components are bounded services, never the trust boundary.
Machine learning has a role in flight software: perception, anomaly detection, model-based prediction, adaptation. It does not have a role in deciding what may execute. The mechanism that grants a permit is separate from the mechanism that proposes an action, and it is small enough to verify.
Status
The runtime has a working reference implementation, currently in a private beta with a small number of design partners who are shaping it against real missions ahead of general availability.