SHIELD/ATLAS — Complete System Architecture OV-2 v1.3 · 2026-07-12

1 · The system in one story

Any unit — from a private with a phone to a theater commander to a county EOC — gets one screen that shows everything happening around them, tells them what it means, and helps them decide what to do next. Devices and partners plug in through one front door. Data from any sensor fuses into one picture. AI drafts analysis grounded in doctrine; humans make every kinetic decision. Everything is audited. The screen works in a bunker with no internet. The platform watches its own health and names its own failures.

2 · Universal connection — FLOW-9 (how anything plugs in)

One workflow replaces six fragmented onboarding doors. Register once — identity token, permission template, and your exact ingest endpoints come back in a single response. Whole units onboard in one call from their MTOE.

MTOE bulk unit onboarding

POST /api/connect/register-unit
{ "unit": { "name": "A Co, 3-15 IN", "uic": "WABCA0", "echelon": "company" },
  "equipment": [
    { "lin": "U09517", "nomenclature": "RQ-11B Raven SUAS",       "qty": 3  },
    { "lin": "R67890", "nomenclature": "AN/PRC-163 leader radio", "qty": 12 },
    {                  "nomenclature": "Smart Shooter SMASH 2000L","qty": 2  },
    {                  "nomenclature": "ATAK EUD",                "qty": 24 } ] }
→ 201: unit token + 41-item roster (each item: own token, party class, exact ingest endpoint)

Auto-classifier: Raven/SUAS→sensor · PRC/JBCP→unit (CoT) · SMASH/Coyote/jammer→effector · ATAK EUD/TAK server→partner-c2 · ESP32/Pi→sensor (heartbeat+acoustic). Declared values always win. 500-item cap per call; loop yields every 25 items. Unit-level revocation kills the whole UIC. Full detail: /connector/architecture

3 · External sources (what feeds the picture)

4 · Processing layers L1–L7

5 · The 9 technical flows + latency budgets

Full hop-by-hop detail: /api/architecture/ov2/flows · measured witness: /flows/benchmark (26 hops probed against production, honest pass/fail per hop)

6 · The human decision gate (why this is doctrine, not marketing)

• IRON RULE 5 / DoDD 3000.09: no Defeat-class action executes without explicit human approval — POST /api/useif/killchains/:id/approve logs operator identity + timestamp
• Effector-class connections registered through FLOW-9 receive cue scope only — the chassis structurally cannot grant automatic engagement
• Decision Symphony (7 tools: autonomy classifier, GPS spoof detector, sensor-effector matcher, cost-exchange, attrition planner, adversary tracker, AI compliance) returns hitlGate on every response — options presented, never executed
• AI is bounded: corpus floor (min 2 docs) before AI answers; GREEN/AMBER/RED grounding tags; Anthropic blocked in DEFENSE_CONTRACT_MODE (compliance endpoint live)

7 · Self-healing & observability chassis (built from the 2026-07-12 outage)

The platform now names its own failures instead of guessing. Every claim below is a live endpoint you can hit right now.

8 · Deployment topology & full-stack congruence

One revision, every layer: dev → git → deploy → EC2 runtime → nginx/TLS → served frontend. Harmony conductor re-audits every 6h. Templates cached at boot; production prefers server_dist/templates.

9 · Honest live audit (Iron Rule 10 — claims require evidence)

• LIVE (29 endpoints verified): full list with per-endpoint notes at /api/architecture/ov2/live-audit — includes all 5 new connection-chassis endpoints as of v1.3.0
• PLANNED adapters (honest): AFATDS NFFI (FY2027 roadmap), GCCS-A NIEM, DCGS-A GENESIS, JADC2 CBM theater registration — architecture ready, cleared infrastructure required
• Group-2 now LIVE (v1.3.1, 2026-07-12): scope enforcement is runtime-flippable (attribute/warn/enforce via POST /api/connect/enforcement) and returns 403 on missing identity or insufficient scope; PKI X.509 client certs issued by the ATLAS Connection CA (?pki=1) and verified on every call; MTOE CSV/TSV upload (/api/connect/register-unit/csv) alongside JSON
• Remaining staged: transport-layer mTLS (app-layer cert verification is live), per-connection rate limits, XLSX parse (CSV covers the S4 export path)
• Excluded by doctrine: USASpending/SAM.gov are commercial BD lane only — never on the operational COP

10 · URL map (where everything lives)