OAK Relay 0.1.0 — Verification & Validation report

97/97 checks pass. EO-1 4/4 · EO-2 4/4 · EO-3 14/14 · EO-4 7/7 · EO-5 15/15 · DO-1 23/23 · DO-2 13/13 · DO-3 9/9 · DO-4 8/8

Each check is traced to a Challenge-17 Essential (EO) or Desired (DO) Outcome and records the measured value. Unclassified · representational · generated by relay_vv.py.

OutcomeClaimMeasuredExpectedResult
EO-1pure-stdlib library + HTTP service dispatch answers /health200 200PASS
EO-2catalogue domains cover LAND/AIR/MARITIME/SPACE/CYBER['AIR', 'CYBER', 'JOINT', 'LAND', 'MARITIME', 'SPACE'] ⊇ 5 domainsPASS
EO-2functional services covered['C2', 'FIRES', 'INTEL', 'LOGISTICS', 'MEDICAL'] ⊇ C2/INTEL/FIRES/MEDICAL/LOGISTICSPASS
EO-2message types in catalogue9 ≥ 9PASS
EO-3MTF-XML export→import round-trips every message type losslessly9/9 allPASS
EO-3NIEM export→import round-trips every message type9/9 allPASS
EO-3NCDF object binds a confidentiality label and round-trips9/9 allPASS
EO-3NCDF label tamper is detectedTrue TruePASS
EO-3documented interfaces: ICD generator + endpoint tableTrue TruePASS
EO-3NIEM 6.0 components used (nc: + mo: + usmtf:)26 ≥ 20PASS
EO-3NIEM instances validate against the OASIS NIEM 6.0 schemas (niem-core, structures, mo, usmtf + OAK extension)9/9 allPASS
EO-3NIEMOpen CMF tool (cmftool 1.0): x2m → CMF model, mval, xval on all sample instancesPASS (docs/CMF_REPORT.md) PASSPASS
EO-3NCDF NIEM-NDR-style XML form round-trips with the bound label intact9/9 allPASS
EO-4COIE text form round-trips every message type9/9 allPASS
EO-4COIE ↔ MTF-XML transcoding is lossless9/9 allPASS
EO-4formats registered on one catalogue6 ≥ 6PASS
EO-4new format added via register() without core changeTrue TruePASS
EO-4new message type loads from a catalogue file (GFI seam) and works in every codecTrue TruePASS
EO-4every format pair bridges every message270 translations allPASS
EO-5messages produce COP tracks / alerts / taskings10 ≥ 10 tracksPASS
EO-5CoT events rendered for positioned elements10 = tracksPASS
EO-5CoT events validate against the MITRE public-release CoT 2.0 schema10/10 allPASS
EO-5TAK Protocol (protobuf) payloads for TAK-class consumers191 B vs 384 B XML smaller than XMLPASS
EO-5DIS 7 Entity State PDUs for simulation federates (opendis)2 PDUs ≥ 1PASS
EO-5every track carries a MIL-STD-2525 / APP-6 symbol identification codeTrue TruePASS
EO-5every track also carries a 20-digit NATO APP-6(E) / MIL-STD-2525E code (symbol set + entity)10/10 allPASS
EO-2cyber-domain message exports as a STIX 2.1 bundle and imports back losslessly6 objects round-tripPASS
EO-3confidentiality label renders in the ADatP-4774.1 XML shape and parses backPROTECTED B PROTECTED BPASS
EO-5seeded bearer model degrades deterministically for wargaming(1.0, 0.0) (1.0, 0.0)PASS
DO-1packed payload vs MTF-XML compaction (worst case)×4.1 ratio≥ ×3PASS
DO-1largest packed message292 bytes≤ 320 BPASS
DO-1MTU fragmentation + reassembly (VLF 48-B MTU)8 frames reassemblesPASS
DO-1CRC-16 detects single-bit corruptionTrue TruePASS
DO-1precedence queue drains FLASH→ROUTINEFLASH FLASH firstPASS
DO-1store-and-forward delivery on HF at BER 1e-3 with selective repeat100% 100 %PASS
DO-1STANAG 5066 SIS model: S_BIND_ACCEPTED returns the 2048-byte general-node MTU (AComP-5066 Annex A)2048 2048PASS
DO-1STANAG 5066 SIS model: FLASH MEDEVAC submitted at SIS priority 15 and confirmed (ARQ)S_UNIDATA_REQUEST_CONFIRM S_UNIDATA_REQUEST_CONFIRMPASS
DO-1STANAG 5066 SIS model: ARQ out-delivers non-ARQ (EMCON) at BER 3e-3ARQ 33% vs non-ARQ 11% ARQ ≥ non-ARQPASS
EO-4COIE text rides HFCHAT / COSS (IA5, CR/LF lines ≤ MTU) — AComP-5066 Annex O / P10 lines all ≤ 2048 BPASS
DO-1undeliverable payload is held (store) for the next contact window1 1PASS
DO-1UDP link: FLASH MEDEVAC crosses a real socket between two relay stations at BER 1e-3 with selective repeatdelivered=True retries=7 frames=1 deliveredPASS
EO-3delivery receipt from the receiving station correlates originator + serial + DTGSTN-B RECEIVED serial 3 STN-B RECEIVED serial 3PASS
EO-3MSGID addressing: receiving station recognises itself as the action addressee (TO / INFO)True TruePASS
DO-1UDP link: undeliverable payload is held for the next contact window1 1PASS
DO-1multi-hop relay: FLASH MEDEVAC addressed to STN-C reaches it via STN-B on HF at BER 1e-3; originator gets an end-to-end receipt naming the pathDELIVERED via ['STN-B', 'STN-C']; C inbox 1; B consumed 0 DELIVERED via [STN-B, STN-C]; 1; 0PASS
DO-1duplicate suppression: the same message re-sent is refused at the first relay and not forwarded againDUPLICATE; C inbox 1 DUPLICATE; 1PASS
DO-1hop limit: a message with no hops left is not relayed and the originator is toldHOP_LIMIT HOP_LIMITPASS
EO-3MSGID addressing (TO / INFO / EXER-OPER / ACK-REQ) round-trips in every binding7/7 allPASS
EO-5fused picture correlates a second SITREP onto the same tracks (identity match, latest wins)3 updated / 0 added 3 updated / 0 addedPASS
EO-5fused picture: 2 SITREPs + 1 CTC → unique tracks with report counts5 tracks / 8 reports 5 tracks / 8 reportsPASS
EO-5fused picture: re-reported contact without its id merges by position gate (≤ 2 km)position 0.14 km positionPASS
EO-5fused picture flags tracks not re-reported within stale_min as stale; the fresh one is not4 stale of 5 4 of 5PASS
DO-2message-type detection on operator phrasing7/7 allPASS
DO-2drafts with every required field filled7/7 ≥ 5PASS
DO-2French trigger lexicon (multilingual)('RFI', 'fr') ('RFI','fr')PASS
DO-2abstains on non-message textTrue TruePASS
DO-2spoken-form normaliser turns a real STT transcript (phonetic callsign, spoken digits, homophones) into a complete MEDEVAC draftMEDEVAC missing=0 MEDEVAC, 0 missingPASS
DO-2voice → message: offline STT (Vosk EN) on a synthesized radio call → assured MEDEVAC draftASR 0.92, 36.09s in 12.63s → MEDEVAC conf 1.0 MEDEVACPASS
DO-2MGRS grids understood by the extractor (mgrs / GeoTrans)(44.65, -76.5) ≈ 44.65, −76.50PASS
DO-2every draft requires human confirmationTrue TruePASS
DO-3Prometheus exposition servedTrue TruePASS
DO-3CRITICAL alert opens a ServiceNow-shaped incident1 ≥ 1PASS
DO-3Splunk-HEC-shaped event batch served1 ≥ 1PASS
DO-3CRITICAL alert opens a ticket in a ServiceNow-compatible incident table (token-authenticated POST, sys_id + number returned)1 ticket(s): INC0000001 1 ticketPASS
DO-3events delivered to a Splunk-HEC-compatible collector (Authorization: Splunk <token>, NDJSON) and acknowledged code 01 events, HEC code 0 ≥ 1 event, code 0PASS
DO-3a refused push is held and delivered on the next flush (telemetry store-and-forward)held 1 → pending 0, tickets 2 held 1 → pending 0, 2 ticketsPASS
DO-3wrong HEC token is refused by the receiver (403) and reported, not swallowed403 403PASS
DO-3events pushed to a live third-party Splunk-HEC-compatible collector [Vector 0.58.0] are acknowledged (code 0) and written to its sinkHEC ok=True, 1 events in Vector's file sink acknowledged, ≥ 1 eventPASS
DO-3the third-party collector refuses a wrong token (as Splunk does)401 401/403PASS
DO-4prioritiser ranks FLASH MEDEVAC first and ROUTINE LOGSTAT last across the sample setMEDEVAC … LOGSTAT MEDEVAC … LOGSTATPASS
DO-4content breaks a precedence tie: IMMEDIATE call for fire outranks IMMEDIATE contact reportCFF #2 vs CTC #3 CFF above CTCPASS
DO-4staleness demotes a 10-hour-old FLASH MEDEVAC below a fresh IMMEDIATE contact report14.7 vs 104.0 old < freshPASS
DO-4every priority score carries factor evidence (precedence, content, staleness)3 ≥ 3PASS
DO-4scored queue pops the highest live score firstMEDEVAC MEDEVACPASS
EO-1service state (inbox, fused picture, incidents) survives a restart — SQLite write-through storeinbox 1, tracks 5 inbox 1, tracks 5PASS
EO-1API key enforced on the service: 401 without key, 200 with X-API-Key, /health and the console stay open401 / 200 / 200 401 / 200 / 200PASS
EO-3OpenAPI 3.0 description covers every documented endpoint (machine-readable ICD at /openapi.json)49 paths 49 pathsPASS
DO-2chat line over TCP becomes an assured MEDEVAC draft with nick as originator; small talk abstainsOK MEDEVAC 1.00 confirm-required | ?? abstain (no type 0.00) OK MEDEVAC … confirm-required | ?? abstainPASS
DO-12-FSK modem: FLASH MEDEVAC packed frame → 1200-baud audio → AWGN Eb/N0 14 dB → demodulated, CRC-valid1 frame, 102 B, SNR est 8.0 dB 1 frame, CRC okPASS
DO-1forward error correction (Hamming 8,4 + interleaver) decodes at Eb/N0 10 dB where the uncoded frame failsFEC 4/5 vs uncoded 0/5 FEC ≥ 3, uncoded ≤ 1PASS
DO-1complex-baseband I/Q (SDR / Proteus ARB) modulate → demodulate round trip70080 samples @ 48 kS/s decodesPASS
DO-1modem-in-the-loop store-and-forward on HF: 100 % delivery at Eb/N0 14 dB, degraded at 6 dB, tone jammer at J/S −10 dB tolerated14 dB 100% · 6 dB 0% · J/S −10 dB 100% 100 % · < 100 % · 100 %PASS
EO-5CoT streamed to a live TAK server [taky 0.10 (MIT, PyPI)] over the TAK streaming protocol is relayed to another TAK client (both contacts)3 events at the peer ≥ 2 (T1001, T1002)PASS
EO-5a hostile air track published by another TAK client is received by OAK Relay and correlated into the fused picturereceived 2 (incl. the peer's own SA), picture added 1 ≥ 1 / 1PASS
EO-5TAK server used for the live check (third-party taky, MIT, when installed; otherwise the stdlib relay — status, not a criterion)taky 0.10 taky preferredPASS
DO-2read-aloud script covers every message type in EN and FR plus must-abstain lines18 lines ≥ 18, 9 types, 2 abstainPASS
DO-2voice corpus evaluated: 12 recordings (0 real voice, 12 synthetic Windows voices), EN clean: type accuracy incl. correct abstention92% type acc, WER 0.16, abstain 17% ≥ 80 % type accPASS
DO-2under a 300–3400 Hz radio band-limit with noise at 10 dB SNR the drafting path still recognises most messages (degrades, does not break)92% type acc, WER 0.38 ≥ 50 % type accPASS
DO-2real (human) voice recordings present in the corpus — the relevant-environment evidence0 real — none yet: volunteers use the console Record button / testing kit ≥ 1PASS
EO-1independent V&V executions on other hosts (signed bundles, hash-bound to the source tree) — the TRL-5 evidence of reproducibility0 external run(s), 0 signed; 3 developer-host kit self-test(s) ≥ 1 external signed run (status)PASS
DO-1SIS over TCP: S_BIND_REQUEST → S_BIND_ACCEPTED with the general-node MTU (2048 B)S_BIND_ACCEPTED mtu 2048 S_BIND_ACCEPTED mtu 2048PASS
DO-1SIS over TCP: S_UNIDATA_REQUEST (FLASH, priority 15) delivered as S_UNIDATA_INDICATION at the destination SAP and confirmed (ARQ)S_UNIDATA_REQUEST_CONFIRM; B indications 1 S_UNIDATA_REQUEST_CONFIRM; 1PASS
DO-1SIS over TCP: U_PDU larger than the MTU is rejected by the nodeS_UNIDATA_REQUEST_REJECTED (U_PDU larger than MTU) S_UNIDATA_REQUEST_REJECTED (U_PDU larger than MTU)PASS
DO-1SIS over TCP: traffic to an unbound destination SAP is rejectedDestination SAP not bound Destination SAP not boundPASS
DO-4extraction result carries confidence + evidence + abstain (assurance contract)True TruePASS
DO-4audit chain detects an edited recordTrue TruePASS
DO-4MTF-XML encode+decode throughput (real-time headroom)5169 msg/s≥ 300 msg/sPASS