<!-- SPDX-License-Identifier: Apache-2.0 -->
# Capability map — what Kshana does, partially does, and does not do
Kshana is a **PNT-performance-and-resilience simulator**, not a full space-systems
toolkit. This page is the honest scope map: for every capability area a procurement or
research reviewer might check, it states the status, what actually exists in the code,
what is missing, and where it sits on the roadmap. Status is one of:
- **yes** — implemented and validated to a stated level;
- **partial** — a real but limited model (scope explicitly bounded below);
- **none** — not modelled (out of scope today).
Nothing here is aspirational: "partial" never means "almost done", it means "this much
and no more". See also [`VALIDATION.md`](VALIDATION.md), [`INTEGRITY.md`](INTEGRITY.md),
[`QUANTUM-MODELS.md`](QUANTUM-MODELS.md), and the overclaim closure ledger
[`CLAIMS-VS-REALITY.md`](CLAIMS-VS-REALITY.md) (every historical overclaim, how it was
resolved, and a CI guard that keeps it resolved).
## Core PNT (where Kshana actually plays)
| Capability | Status | What exists | What is missing | Roadmap |
|------------|--------|-------------|-----------------|---------|
| **Orbit determination & propagation** | partial | Dependency-free **SGP4/SDP4**, validated to 4.12 mm vs all 666 AIAA 2006-6753 vectors; analytic Keplerian + J2-secular; inertial velocity exposed. A **numerical (Cowell) propagator** (`src/propagator.rs`) integrates a configurable **zonal-gravity** force model — the **full Earth zonal field through degree 6** (`forces::zonal_accel`, the published EGM-96 `J2..J6`) — with a choice of adaptive driver — RK4 **step doubling** or the **Dormand–Prince RK5(4)** embedded pair (`integrate_dopri` / `propagate_dopri`, a cheaper 7-eval embedded error estimate that clears the same Kepler gate and agrees with the RK4 path to <1 m on a J2..J6 orbit) — pinned against **analytic truth stronger than a numerical cross-tool**: the unperturbed orbit reproduces the **exact universal-variable Kepler solution to sub-metre over 24 h** (a tighter gate than the milestone's "vs reference < 10 m"), energy + angular momentum conserve to ~1e-9 relative, the J2 nodal regression matches the closed-form secular rate to first-order theory, the zonal acceleration is verified to be the **exact gradient of its own potential** (and to reduce to the 666-vector-validated J2 closed form), and `solve_kepler_checked` **returns `Err` rather than a wrong answer** when Newton fails to converge (e.g. near-perigee e = 0.999). **Epoch-driven third-body (Sun and Moon)** gravity is **wired into the time-varying integrator** (`ForceModel::third_body` / `accel_at`, with the `src/ephem.rs` Montenbruck & Gill low-precision Sun and Moon ephemerides — no DE/SPK kernel needed): each RHS evaluation samples the perturber positions at the advanced epoch `epoch_jd_tt + t/86400`, so the Sun/Moon move along their orbits during the integration. The perturbation is verified as the exact gradient of its disturbing potential, vanishes at the geocentre, and has the textbook LEO magnitudes (~5e-7 m/s² Sun, ~1.1e-6 m/s² Moon); the Sun ephemeris hits hand-derived J2000 anchors (perihelion distance, ~−23° solstice declination, ~1°/day motion) and the Moon ephemeris its perigee/apogee envelope, ~384 400 km mean distance, ≤ 5.3° inclination bound, and sidereal-month direction return; and the integration wiring is proven **bit-exact** (RHS term equals `third_body_accel` at the sampled position at t = 0 and t = 1 day) with a quarter-year epoch shift yielding a different trajectory. **Solar-radiation pressure** rides the same epoch-driven RHS (`forces::srp_accel` / `ForceModel::solar_radiation`): the cannonball model `ν·P☉·cᵣ·(A/m)·(AU/d)²·d̂` with a `forces::conical_shadow` umbra+penumbra eclipse factor (smooth ν ∈ [0,1], verified to taper through a monotonic penumbra that extends beyond the umbral cylinder), verified against the textbook 1-AU pressure (≈ 4.54e-6 N/m²), the ~1.36e-7 m/s² LEO magnitude pushing away from the Sun, the inverse-square fall-off (doubling Sun distance quarters it), an **exactly-zero** acceleration in the umbral cylinder, and a propagated displacement that scales ~linearly with A/m. **Atmospheric drag** is the first velocity-dependent term (`forces::drag_accel` / `ForceModel::drag` + the new `accel_rv` / velocity-passing RHS): quadratic drag `−½·ρ(h)·(C_D·A/m)·\|v_rel\|·v_rel` against the co-rotating atmosphere `v_rel = v − ωₑ ẑ × r`, with `ρ` the Vallado piecewise-exponential `forces::atmospheric_density` — verified by the 1.225 kg/m³ sea-level anchor, a strictly monotonic LEO decay with a physical ~58 km scale height, the ~2e-6 m/s² drag magnitude opposing the relative velocity, and the **dissipation signature** (a 300 km orbit loses specific energy monotonically and its semi-major axis decays a bounded ~km/day, where the vacuum orbit conserves energy). The **post-Newtonian (Schwarzschild) relativistic correction** is the second velocity-dependent term (`forces::relativistic_accel` / `ForceModel::relativity`): the IERS `β = γ = 1` form `a = (μ/c²r³)·{[4μ/r − v²]·r + 4(r·v)·v}`, the leading driver of the relativistic perigee advance — verified against its closed-form circular value `3μ²/(c²r³)·r̂` (radial, outward), its textbook `≈1.9e-9` LEO ratio to two-body, the hand-simplified radial-velocity form, and the **conservative signature** (it perturbs the orbit but holds the semi-major axis to under a metre/day, the structural opposite of drag) | No high-degree EGM **tesseral** field (200×200 + loader); drag density is the **static** Vallado piecewise-exponential (solar-activity-independent), **not** NRLMSISE-00 (the < 5 % thermospheric-density clause); SRP is the **cannonball** model with a geometric **conical umbra+penumbra** shadow (no solar limb darkening, no oblate-Earth shadow, no satellite shape/attitude); relativity is the **Schwarzschild** term only (no Lense–Thirring frame-dragging, no PPN-parameter tuning); **third-body/SRP use the low-precision ephemerides (~0.005° Sun, ~0.3° Moon), not DE/SPK-kernel accuracy**; no external GMAT/Orekit cross-validation of a high-fidelity orbit run; no orbit *determination* (fit from observations) | high-degree tesseral gravity + NRLMSISE-00 drag + solar limb darkening + Lense–Thirring + DE-grade ephemeris + GMAT cross-val: P2+ |
| **Time systems** | partial | `src/timescales.rs`: Julian-date API (civil↔JD, MJD), UTC↔TAI via the full IERS leap-second table (10→37 s, 1972→2017), TAI→TT, UT1 via DUT1, and the IAU-2000 **Earth Rotation Angle** | Single-`f64` JD (~50 µs resolution near 2020; two-part JD on the roadmap); pre-1972 rubber-seconds not modelled; DUT1 not predicted | **done** (foundation); two-part JD: P2 |
| **Reference frames** | partial | `src/frames.rs`: GMST-based TEME↔ECEF, WGS-84 geodetic↔ECEF (exact + iterative inverse, machine-precision at all altitudes), and a geodetic ground-station observer (azimuth/elevation/range) | Polar motion (PEF→ITRF) and sub-arcsecond nutation not applied (GMST-only, sub-km on the ground track); full IERS/CIO chain on the roadmap | TEME↔ECEF + geodetic: **done**; ITRF-precise: P2 |
| **Timing & frequency** | partial | Exact van-Loan-Q two-state Kalman clock (NIST SP 1065) with a **Joseph-stabilised covariance update** (positive-semidefinite under extreme Q/R ratios, Cholesky-checked in CI) and a **filter-consistency health monitor** (`src/filter_health.rs`): a Monte-Carlo NIS/NEES assessment against χ² confidence bands, surfaced as `filter_health` in the result JSON and a green/amber card in the playground, with a Q/R-mismatch sweep test proving the monitor flips to *inconsistent* when the tuning is off (Bar-Shalom §5.4); overlapping **ADEV, MDEV, TDEV, HDEV** estimators + χ²-based confidence intervals with **noise-type-specific effective degrees of freedom** (NIST SP 1065 Table 5 closed forms for WPM/FPM/WFM/FFM/RWFM, the set Stable32 uses; the exported ADEV curve identifies the record's power-law type from its MDEV slope and attaches a 95% band per τ — `src/allan.rs`), **numerically validated against the Stable32 reference deviations for the canonical NBS14 dataset to 1e-4** (`tests/allan_reference.rs`) and the edf cross-checked by a Monte-Carlo white-FM ensemble; honest grid-bounded holdover FoM; clock ensembles; **two-way time-transfer model** with reciprocal-delay cancellation + a non-reciprocal random-walk-FM differential-delay floor (`src/timetransfer.rs`, Allan signature reported) | full Greenhall-algorithm edf (the simple closed forms are bias-bounded but coarser than the exact BasicSum), and multi-noise-mixture identification | exact-edf + mixed-noise ID: P2 |
| **GNSS / PNT processing** | partial | A **measurement-domain pseudorange simulation** (`gnss-sim` kind, `src/gnss_sim.rs`): per visible satellite it synthesises `ρ = geometric range + c·δt_rx − c·δt_sv + I + T + noise + multipath` and the L1 Doppler, with the **Klobuchar single-frequency ionosphere** (IS-GPS-200 §20.3.3.5.2.5) and the **Saastamoinen zenith troposphere** (Davis 1985) projected by the **Niell (1996) mapping function** — each model unit-tested against hand computation — then feeds the residuals to **snapshot RAIM** for per-epoch HPL/VPL and emits a `gnss_measurements[]` array (pseudorange, Doppler, C/N₀, iono/tropo corrections per SV). Plus DOP/availability and solution-separation RAIM from orbits; **RINEX 3 multi-GNSS NAV ingestion** (GPS/Galileo/QZSS/BeiDou via IS-GPS-200, GLONASS state-vector) parsed → SV ECEF position & clock bias, usable as a first-class `Propagator` source AND as an inline constellation `rinex` block (`scenarios/orbit-rinex.toml`); **RINEX 3/4 OBSERVATION ingestion** and SP3 precise-orbit read/write | A **forward simulator, not a receiver/solver**: it generates pseudoranges from a known truth, it does not estimate a position from real measurements — no PPP/RTK, no carrier-phase ambiguity resolution, no dual-frequency iono-free combination; the observation parser reads real measurements but there is no *solution*; single-frequency iono only; BeiDou-GEO excluded | real-signal processing / PPP-RTK: use RTKLIB/gLAB |
| **Sensor fusion / INS dead-reckoning** | full | **3-axis strapdown library** (`src/inertial/{attitude,mechanization,imu_errors}.rs`): quaternion attitude with coning/sculling compensation, full NED mechanization (Earth-rate + transport-rate, WGS-84 Somigliana gravity), and a deterministic IMU error model (**scale-factor, misalignment, g-sensitivity, quantization, rate-ramp** modelled). The strapdown navigator is now **wired into a runnable loosely-coupled GNSS/INS pack** with a figure of merit (`src/fusion/pack.rs`, `kind = "gnss-ins"`): the three-axis mechanization is disciplined by the **15-state error-state EKF** (`src/fusion/{gnss_ins_ekf,closed_loop}.rs`, position/velocity/attitude/bias feedback) while GNSS is up, then coasts through the outage — replacing the truth-snap reset with genuine fusion, and reporting the fused horizontal error vs the open-loop free-INS coast. The separate legacy `inertial` pack still runs the **1-DOF scalar** budget with truth-snap reset. A **tightly-coupled pseudorange** update (`update_tightly_coupled` / `fuse_tightly_coupled`) is also implemented: it forms the innovation in the range domain (line-of-sight Jacobian on δp) and keeps correcting with **fewer than four satellites**, where a loosely-coupled PVT fix does not exist. A **full 17-state tightly-coupled GNSS/INS UKF** (`src/fusion/tightly_coupled17.rs`) carries position, velocity, attitude error, accelerometer and gyro biases, and the receiver clock (bias + drift), with **quantum-CAI dead-reckoning** — the velocity-random-walk process noise is the cold-atom accelerometer's derived `q_va` — coasting a 120-second outage bounded to a few hundred metres (vs the kilometres of a navigation-grade free INS). The deterministic IMU error model is **configurable per sensor from the `gnss-ins` TOML** (`[imu_*.error_model]`: scale-factor, misalignment, g-sensitivity, quantization, rate-ramp), defaulting to a pure constant-bias source when omitted | Tightly-coupled is **pseudorange-only** (carrier-phase and an explicit receiver-clock state are roadmap) and reachable via the navigator API but **not yet surfaced in a scenario pack**; a single deterministic driving trajectory; the loosely-coupled accel-bias/tilt pair is weakly separable so per-bias calibration is not claimed; IMU error model omits vibration rectification, temperature-gradient drift; the 17-state UKF and the tightly-coupled paths are **self-validated** (analytic CV integration, GNSS-aiding convergence, bias recovery, the CAI-limited 120-s outage bound) — an external **NaveGo / KF-GINS cross-validation** has not yet been run | carrier-phase tight coupling, tight-coupling pack surfacing, trajectory library, NaveGo/KF-GINS cross-validation: **P2** |
| **Integrity / RAIM / ARAIM** | partial | **Real snapshot RAIM** in `src/raim.rs`: least-squares solution + residual χ² fault detection (exact threshold from a dependency-free incomplete-gamma χ²) and **slope-based HPL/VPL** (pbias from a non-central χ² for the configured P_fa/P_md); **solution-separation (MHSS) RAIM** with fault detection/identification; **ARAIM integrity-risk (P_HMI) budget** (`araim_raim`) that solves the smallest HPL/VPL whose summed `P_HMI = Σ_k p_fault,k·Q((PL−T_k)/σ_k)` meets an explicit integrity-risk allocation, plus a **Stanford(-ESA) integrity-diagram** (exported by the user-runnable `integrity` scenario kind from a seeded no-fault error realization, with availability against alert limits and the region/HMI counts in the JSON result and CLI summary). Plus the scenario FoM's filter self-consistency (k-σ bound) | RAIM is reachable via the `integrity` scenario kind but **not yet folded into the clock/holdover FoM** (those still report self-consistency); the ARAIM budget is **single-fault MHSS** — simultaneous multi-SV-subset faults, the constellation-wide fault mode, and **FDE** beyond identification are not modelled; the snapshot/MHSS/ARAIM cores are exercised on **real IGS precise-orbit (SP3) geometry** (`tests/igs_real_data.rs`), but receiver-domain gLAB parity over a full RINEX arc needs a pseudorange solution Kshana lacks; not DO-229/ARAIM-certified | multi-fault ARAIM + receiver-domain gLAB parity + FoM wiring: **P2** (see [`INTEGRITY.md`](INTEGRITY.md)) |
| **Spoofing / jamming threat modelling** | partial | A **stochastic time-spoof detector** (`spoof` kind, `src/spoof.rs` + `src/detection.rs`): four injection shapes (linear ramp, step jump, meaconing, replay) against a clock-aided monitor with a two-sided **χ²₁ energy / Neyman–Pearson test**, the detection threshold set from a target false-alarm budget `P_fa`, and the **missed-detection probability `P_md` reported both closed-form and by Monte-Carlo** (the two agree to a few ×1/√N) — the Security figure of merit is `1 − P_md`. Plus a **link-budget jamming model** (`jamming` kind, `src/jamming.rs`): jammer-to-signal ratio from geometry (free-space path loss + per-direction receive-antenna gain), the standard **anti-jam effective-C/N₀ equation** (despreading processing gain + spectral-separation factor `Q`; Kaplan & Hegarty §9.4), per-satellite loss-of-lock at a configurable tracking threshold, and an `availability_under_jamming` figure of merit over a Walker constellation | Jamming model is a **link budget** — no multipath, terrain shadowing of the jammer, near/far AGC, adaptive nulling, or acquisition-vs-tracking hysteresis; the spectral-separation `Q` values are representative, not per-PSD-derived. The spoof detector is **single-clock** (a time-discrepancy monitor, not multi-satellite RAIM); the monitor statistic is modelled as Gaussian with the clock's PSD-derived σ (no real signal-level cross-correlation or multipath); `P_md` is reported at the operationally-harmful (spec) magnitude | finer jamming effects + multi-SV spoof cross-checks: P2 |
| **Quantum PNT sensor physics** | partial | Quantum sensors as **published Allan/noise-budget coefficients** (CSAC, optical, cold-atom) | No first-principles physics (Mach-Zehnder phase, projection/shot noise, systematics) | first-principles models: P2+ ([`QUANTUM-MODELS.md`](QUANTUM-MODELS.md)) |
| **Constellation design** | partial | Synthetic Walker (both analytic Keplerian **and SGP4 mean-element**, the latter propagated through the 4.12 mm-validated core — `src/walker.rs`) + real-TLE multi-constellation visibility & DOP (GPS+Galileo to 100%), validated against a **real Celestrak gps-ops snapshot** (`tests/igs_real_data.rs`); a **PDOP design sweep** over the `{planes × sats × inclination}` grid and **coverage-fraction / revisit-time** figures of merit; a **gradient-free design optimiser** (`optimize_walker_design`) that searches the grid for the best design under a chosen objective (`MinSatellitesForCoverage` / `MaxCoverage` / `MinWorstPdop`), validated to return the brute-force winner; and **analytical streets-of-coverage geometry** (`coverage_half_angle_rad`, `street_half_width_rad`; Rider/Beste closed forms, hand-verified — GPS at a 5° mask: λ ≈ 71.2°, 4-sat street half-width ≈ 62.8°) | The full Rider **minimum-satellite global-coverage solver** (the seam-sensitive plane count) is not yet implemented; no 3-D playground globe view; multi-constellation DOP is not yet cross-checked against an external reference tool (gnss-rtk); geodetic vs geocentric "up" in the DOP frame | streets-of-coverage min-sat solver + 3-D globe + gnss-rtk DOP cross-check: P2 |
| **Verification & validation** | partial | One world-class island (SGP4 vs 666 AIAA vectors); deterministic Allan checks | Golden tests pin few exact numbers; calibration on single seeds (see V&V roadmap) | golden numerics + calibration ensembles: P1 (M17/M18) |
## Broader space-systems domains (out of scope today)
These are **none** — listed so the scope is unambiguous, not implied by silence. Each is
a deliberate non-goal for now; Kshana is a PNT simulator, not GMAT/STK/Orekit.
| Capability | Status | Note / roadmap |
|------------|--------|----------------|
| Mission design / trajectory optimization | partial | `src/maneuver.rs`: impulsive ΔV nodes with 6×6 covariance propagation (ECI/LVLH execution-error frames), finite-burn integration checked against the closed-form **Tsiolkovsky** equation to < 0.01 %, an **Izzo-2015 single-revolution Lambert** solver + an exact universal-variable **Kepler propagator** (Lambert outputs round-tripped against two-body truth), and a **porkchop** (launch × arrival) C3 / arrival-V∞ sweep emitted as a JSON contour grid whose minimum is checked against the analytic Hohmann floor. **No trajectory optimizer, no multi-revolution Lambert, no planetary ephemeris** (the porkchop uses a synthetic coplanar-circular heliocentric model; a GMAT Earth–Mars C3 cross-check needs a shared DE-ephemeris and has not been run) — the performance-simulation layer above GMAT/Orekit, not a replacement. P3 |
| AOCS / GNC / attitude | none | no attitude representation; the IMU "gyro" is a scalar tilt channel |
| Reference frames → Earth-fixed | none | **P1** brings TEME→ECEF/ITRF (listed above under frames) |
| Comms & link budgets | none | no RF/optical link, EIRP/G-T, access scheduling |
| Ground segment & operations | none | no ground-station entity, pass scheduling, or ops timeline |
| Telemetry / TT&C / CCSDS | partial | bespoke TOML-in/JSON-out; **CCSDS OEM (Orbit Ephemeris Message) export** (502.0-B KVN, for GMAT/Orekit/STK); other CCSDS message types (ODM/AEM/TDM) and SPICE interop remain a roadmap item (P2) |
| Interoperability & standards (RINEX/SP3/SPICE/CCSDS) | partial | RINEX 3 **multi-GNSS NAV** — GPS, Galileo, QZSS, BeiDou MEO/IGSO (IS-GPS-200) **and GLONASS** (PZ-90 state-vector RK4) — ingested + propagated + runnable as one mixed constellation; **RINEX 3/4 OBSERVATION parser** (pseudorange/carrier/Doppler/SNR by observation code, with LLI/SSI flags); SP3-c/d precise-ephemeris **read ↔ write round trip** (parse + export for Ginan/RTKLIB/gLAB) **and a 9th-order Lagrange propagator** (`Propagator::Sp3Precise`); SP3 export is **CLI-exposed** (`kshana <orbit.toml> --export-sp3 out.sp3`, or `export_sp3 = true`) and **round-trip-validated** against the real GPS constellation to <0.5 m over 24 h (`tests/sp3_export_roundtrip.rs`); **CCSDS OEM 2.0 ephemeris writer** (TEME state export for flight-dynamics tools). No BeiDou-GEO, no SP3 clock interpolation, no OEM reader, no observation *solution* (parse only), no SPICE/other-CCSDS yet — **P2** "annex adjacent domains via standard formats" |
| Space weather / environment (iono/atmo/radiation) | none | iono/TEC is a known GNSS error source omitted even in the PNT niche; P2+ |
| Gravity-map / alt-PNT navigation | partial | `src/gravimeter.rs`: a cold-atom **gravimeter measurement model** whose white-noise floor is derived from the CAI accelerometer ASD (`σ = ASD/√τ`), a low-degree **fully-normalised spherical-harmonic gravity-anomaly field** (validated against the closed-form Legendre functions and a hand-derived single-term anomaly) plus synthetic **mascons**, and a **gravity-map-matching particle filter** (composing `mapmatch` + `particle_filter`) that recovers a GPS-denied track from the anomaly sequence it flies through. The **60-minute GPS-denied benchmark** (`run_gps_denied_gravity_nav`, `scenarios/gps-denied-gravity-nav.toml`) flies a ~700 km / one-hour outage where the inertial solution drifts to **≈ 70 km**, and a **hierarchical coarse-to-fine** matcher with the gravimeter's deterministic seeded white noise recovers it to **≈ 145 m (< 500 m)** — stable across noise realisations, and provably refinement-limited (a single coarse grid stalls at ~2 km). **Missing: the full EGM2008/EIGEN coefficient set and its loader** (the field is low-degree + mascons, not a real high-resolution map), a Monte-Carlo over map-representation-error realisations, magnetic-anomaly map, terrain-aided SLAM, and scenario-engine `kind=` wiring with an SVG drift chart. P3 |
| Re-entry / EDL, Launch analysis, EO/payload | none | out of scope |
| Lunar / cislunar PNT (LunaNet) | none | SDP4 + multi-constellation + integrity make Kshana the *closest* open base, but no SPICE/LunaNet interface yet — P3 |
## Ecosystem & readiness (tracked honestly, not a code capability)
| Area | Status | Note |
|------|--------|------|
| Language bindings & packaging | partial | Rust + Python (abi3) + WASM on three registries; string-in/string-out bindings |
| Education / onboarding UX | partial | Browser playground (a real structural white-space); guided mode is roadmap |
| Community / governance | none | single-founder; no Zenodo DOI/JOSS/citations yet (founder-gated outreach) |
| Funding & procurement readiness | none | TRL ~3; no agency citations/contracts yet (see strategy notes) |
_Last aligned with the 2026-06-02 grand audit's 27-row capability matrix._