OV-2 · Universal Connection Architecture v1.3.0 · FLOW-9 · LIVE
How any external device, sensor, effector, unit, or partner system connects to SHIELD/ATLAS — identity, permissions, schema, data flow, health, audit — in one workflow. Companion to the full OV-2 at
/evaluate/architecture · machine-readable:
/api/architecture/ov2/flows · live surface:
/connector1 · The problem this closes (Ideal vs. Real audit, 2026-07-12)
The platform always had a universal data core — one USEIF observation envelope, one protocol adapter catalog (CoT / Link-16 / VMF / GeoJSON), one event bus, one HITL gate. But it had six separate onboarding front doors (enterprise, zero-config, tactical 7-gate, EM jurisdiction, ESMS USB, ad-hoc open POST) with no shared identity, no permission templates, no schema negotiation, and no unified health registry. The Universal Connection Chassis is the missing front door; the six legacy doors now feed the same registry through glue hooks.
2 · FLOW-9: register → data flowing (the one workflow)
1 · ANNOUNCEPOST /api/connect/register
{name, partyClass, protocols}
— or a whole unit via MTOE manifest —
POST /api/connect/register-unit
→
2 · IDENTITYHMAC connection token issued per item
(atlas_conn_*)
registry row + append-only ledger row
→
3 · PERMISSIONSTemplate by party class:
sensor · effector · unit · partner-c2 · feed · citizen
effector = cue only, kinetic NEVER automatic
→
4 · SCHEMANegotiated in the same response:
cot→/api/integration/cot/ingest
useif-json→/api/observations/ingest
acoustic · adsb · mqtt · field-cue
→
5 · DATA FLOWSX-Atlas-Connection header = attribution
fusion → COP FUSION:* → TAK CoT → intel BLUF
< 20s first-obs-to-COP
→
6 · HEALTH + AUDITConductor 60s sweep:
ACTIVE → IDLE → STALE
revoke = one call; allowlist only shrinks
3 · MTOE bulk unit onboarding
One manifest, whole unit. Equipment rows are auto-classified from nomenclature (Raven→sensor, PRC-163→unit/CoT, SMASH→effector, ATAK EUD→partner-C2), qty expands to individually-tokened items, serials override suffixes. Unit-level revocation kills everything under the UIC.
POST /api/connect/register-unit
{ "unit": { "name": "A Co, 3-15 IN", "uic": "WABCA0", "echelon": "company" },
"equipment": [
{ "lin": "U09517", "nomenclature": "RQ-11B Raven SUAS", "qty": 3 },
{ "lin": "R67890", "nomenclature": "AN/PRC-163 leader radio","qty": 12 },
{ "nomenclature": "Smart Shooter SMASH 2000L","qty": 2 },
{ "nomenclature": "ATAK EUD", "qty": 24 } ] }
→ 201 { unit: { connectionId, token }, itemsRegistered: 41,
roster: [ { connectionId, token, partyClass, ingest }, ... ] }
MTOE manifestLIN + nomenclature + qty
(S4 export or hand-typed)
→
Auto-classifiernomenclature regex →
party class + protocols
declared values win when present
→
qty expansionRAVEN #1…#3, EUD #1…#24
each with own token + health row
cap 500/call, loop yields every 25
→
Distributiontokens → devices via ATAK data
package, provisioning script, or QR
4 · Party classes & permission templates
| Class | Scopes | Typical MTOE items | Guardrail |
|---|
sensor | observations:ingest · heartbeat | SUAS, SDR/EW, radar, acoustic, EO/IR, ESP32 beacons | — |
effector | cue:receive · heartbeat | SMASH, Coyote, jammers, C-UAS defeat | Kinetic never automatic — USEIF kill-chain HITL approve (IRON RULE 5) |
unit | cop:read · tak:stream · observations:ingest · heartbeat | Radios, JBCP/BFT, EM jurisdictions | COP scoped |
partner-c2 | cot:ingest · cot:stream · observations:ingest · heartbeat | TAK servers, ATAK EUDs, partner C2, Unity/XR | — |
feed | tracks:pull · heartbeat | Dashboards, viz consumers | read-only |
citizen | cue:ingest · heartbeat | Phone field cues, personal safety | rate-limited |
5 · How every door now feeds one registry
/api/connect/registerthe new universal door
/api/connect/register-unitMTOE bulk
tactical onboardingTAK sensor register → glue hook
EM federationjurisdiction register → glue hook
ESMS USB autodetectSDR connect → glue hook
sensor-bay heartbeatsESP32 beacons → glue hook
↓ all six paths converge ↓
atlas_connections registry (Postgres + memory) · data/connection-ledger.jsonl (append-only)GET /api/connect/registry · GET /api/connect/conductor · human surface /connector · conductor sweep every 60s instrumented via loop-forensics (any slow tick is NAMED)
6 · Where the data goes after ingest
Attributed ingestPOST /api/observations/ingest
X-Atlas-Connection token
→
Fusion enginemulti-modal correlate
per-tick cap + yields (post-outage)
→
COPFUSION:* contacts
inbound CoT layer
→
TAK outSSE stream · datapackage.zip
CoT / Link-16 / VMF / GeoJSON
→
Decide (human)BLUF + COA options
USEIF kill-chain approve
7 · Latency budgets & evidence (Iron Rule 10)
| Hop | Budget | Evidence |
|---|
| Register → token (single) | < 500ms | local E2E 2026-07-12: ~30ms |
| MTOE manifest → roster (15 items) | < 1s | local E2E: ~120ms, 15/15 items, correct auto-classification |
| First observation → COP | < 20s (one fusion cycle) | fusion cycle 15s prod / 3s dev; attributed 202 in ~40ms |
| Conductor sweep | 60s cadence | GET /api/connect/conductor ticks; transitions in ledger |
| Revocation | < 200ms | local E2E: token rejected immediately after revoke |
8 · What is real vs. staged (honest audit)
- LIVE: register (single + MTOE bulk), token issuance + verification, permission templates, schema negotiation, attributed ingest → fusion, conductor health sweep, append-only ledger, Postgres persistence + boot hydration, revocation, /connector surface, glue hooks from tactical/EM/ESMS/sensor-bay doors.
- LIVE as of v1.3.1 (2026-07-12 — Group-2 executed): scope enforcement is real and runtime-flippable —
attribute (default, track only) / warn (log violations) / enforce (403 on missing identity or insufficient scope), flipped live via POST /api/connect/enforcement with admin secret; PKI — X.509 client certs signed by the ATLAS Connection Root CA (register?pki=1), verified against the CA on every call, fingerprint stored server-side, CA at /api/connect/ca.pem (HMAC token still accepted; cert wins); MTOE CSV/TSV upload at /api/connect/register-unit/csv (header-row column mapping with aliases) alongside the JSON manifest.
- Remaining staged: transport-layer mTLS at nginx (app-layer cert verification is live and avoids lockout risk); per-connection rate limits; XLSX parse (CSV covers the S4 export path — every spreadsheet exports CSV).
- Honest note: the six legacy doors still work unchanged — the chassis unified visibility first, and enforcement is now available to flip on when the operator chooses. The allowlist-only-shrinks rule applies to revocations from day one.