NORMALIZATION FABRIC
LEVEL ZERO · TRL-4 DEMO · for ground-station networks & nano-sat operators

Every sensor, a different format. No way to prove any of it.

A ground-station or nano-sat operator collects observations in incompatible native shapes - downlink frames, EO/SAR scene metadata, live-track state, human reports - so every source is bespoke parser glue, and a shared file carries no proof it wasn't altered or who produced it. Level Zero conditions four representative / synthetic source types into one cryptographically signed, tamper-evident canonical product that a partner, funder or auditor can verify themselves - no account - against a published trust anchor.

Verify a bundle yourself
4
source types, one canonical product
0
accounts needed to verify a bundle
100%
forged signatures rejected
SAT-04 · NANO
AOS00:04:17
FRAMES2,184
OUTsigned product
DOWNLINK · FRAME
MODEreplay · synthetic
FRAMEhex · byte-counted
48°51'30"N · 02°18'43"E · Paris
ORBITAL TELEMETRY
/ LANE 01 · CCSDS · AX.25 · beacons

Frame in. Signed record out.

A representative downlink frame is stored as its raw hex frame and frame-byte counted - never demodulated - then normalised into a canonical record, cryptographically signed with a tamper-evident chain of custody. Declarative, reproducible, independently verifiable against a published trust anchor.

EARTH READY. EARTH READY. CCSDS · APID 0x64 AX.25 · CRC OK
canonical product · signed
idLZ_PASS_T1147Z_SAT04
geomGeoJSON · bbox poly
signedEd25519 ✓
Canonical JSON GeoJSON JSON Schema OGC SensorThings xwalk Ed25519 signed
RADIO FRAMES
/ LANE 02 · AX.25 · KISS · CCSDS

Hex frame in. Canonical JSON out.

Deterministic normalisation of representative frames. A frame is stored as its raw hex and frame-byte counted, then normalised into a canonical record, cryptographically signed and appended to a tamper-evident chain of custody. Outputs are canonical JSON, GeoJSON & a machine-readable JSON Schema your team can read, audit & verify. (Live TCP/KISS ingest is roadmap.)

CH-01 · KISS · TCP 80011,200 fr/s
CH-02 · DEFRAME · AX.25CRC OK
CH-03 · DECODE · CCSDSOK · 41,820 pkts
FRAMES41,820
MODEreplay
CHAINhash-linked
OUTsigned JSON
TRACKS & NAVIGATION
/ LANE 03 · AIS · MAVLink · CCSDS NDM

Four sources. One canonical product.

Live-tracking inputs (ADS-B/AIS-style state) are ingested as track state and explicitly flagged spoofable, then normalised into the canonical product with GeoJSON geometry. Co-observed products of distinct source types within the 75 km / 30 min gate surface as bounded corroboration candidates - not fusion, not a common operating picture. (CCSDS NDM / AIS / MAVLink parsing is roadmap.)

4
representative source types
75km
corroboration gate · 30-min window
OEM · ECEF · J2000
NORAD59842U
epoch2026-144T14:22Z
frameEME2000
AIS · VESSEL
MMSI227·006760
SOG12.4 kn
trackGeoJSON · 1,204 pts
DEVELOPER PLATFORM
SDK · API · WEBHOOKS · one documented REST API, any HTTP client

A documented REST surface for the demonstrator.

A documented REST surface: ingest, products, feeds, corroboration events, a public verifier & published trust anchor, JSON Schema and an OGC SensorThings crosswalk. A generic signed outbound webhooks module ships at the platform level. A published TypeScript/Python/Go SDK is roadmap.

11
documented REST routes
$ node - normalize.ts
200 OK · SIGNED RECORD CREATED
01 / 05
NORMALIZATION
/01 - THE PROBLEM

Every source is bespoke parser glue.
Every shared record is “trust me.”

A ground-station or nano-sat operator aggregates downlink frames, EO/SAR metadata, track state and field reports - each in its own native shape. Integration cost scales with every new source, and when you hand an observation to a customer, funder or auditor who wasn't there, nothing proves it wasn't altered or who produced it.

INBOUND RAW
  • Radio downlink - SatNOGS-style telemetry frame (hex, byte-counted)
  • EO/SAR - Sentinel-1-style SAR scene metadata + bounding box
  • Live tracking - ADS-B-style track state (flagged spoofable)
  • Operator report - human field observation
  • each tagged with how it was sourced - synthetic, replayed or live
  • representative / synthetic / replayed open datasets only
OUTBOUND READY
  • one signed canonical product (signed JSON)
  • GeoJSON Point / Polygon geometry + feature feeds
  • machine-readable JSON Schema
  • OGC SensorThings 1.1 alignment crosswalk (mapping table)
  • append-only, tamper-evident chain of custody
  • independent public verifier + published trust anchor
  • documented REST API · generic signed webhooks (platform)
/02 - WHAT IT DOES ABOUT IT

One contract. Provable integrity. Explainable corroboration.
Three jobs, one canonical product - so integration collapses and every record can be checked.

01

One contract, not N parsers

The pain: every new station, radio or feed is one-off glue that rots. One permission-gated ingest step normalises all four source types into a single documented canonical product - a frame is stored as raw hex and byte-counted (never demodulated), then cryptographically signed with a tamper-evident chain of custody.

  • in radio downlink · hex frame · how it was sourced
  • out one signed canonical product · tamper-evident
  • via JSON Schema · GeoJSON · OGC crosswalk (for review)
latency (demo)seconds tenantshared / private
02

Explainable corroboration, not a black box

The pain: a lone track can be spoofed and a black-box “fusion” score can't be defended. ADS-B/AIS-style state is auto-flagged spoofable and reports carry a low confidence, so weak sources never dominate. A candidate forms only when ≥2 different sensor types coincide within 75 km / 30 min, and it ships its score, gate and source IDs - a bounded corroboration candidate at TRL-4, not a track.

  • in live track state (flagged spoofable) · operator report
  • out GeoJSON · explainable corroboration candidate
  • via spatial + time gate · 75 km / 30 min · ≥2 sensor types
latency (demo)streaming · <500ms tenantprivate
03

Prove it yourself - no account

The pain: “tamper-proof” is unfalsifiable, so integrity claims stall procurement. Every product is appended to an append-only, tamper-evident chain of custody, and an independent verifier - no account needed - pins to a published trust anchor and returns exactly one of three outcomes: verified, tampered or untrusted_key. A record re-signed with an attacker's own key is rejected, not trusted.

  • in Any canonical product or evidence bundle
  • out verified / tampered / untrusted_key · trust anchor (hex / PEM / fingerprint)
  • via public verifier + trust anchor · reproducible demo (tamper + forged-key checks)
account to verifynone demoreproducible · golden bundle
/03 - READ ONE SHAPE, NOT N PARSERS

Your tools shouldn't need
a parser per source.
Every source normalises into one canonical product - published as an open JSON Schema, GeoJSON geometry, and an OGC SensorThings alignment crosswalk. Alignment for review, not conformance certification.

schema plane · JSON Schema / REST
data plane · canonical JSON / GeoJSON
trust plane · signed / tamper-evident / verifier
/05 - THE DATA PLANE

From representative input
to a signed, verifiable product in one DAG.

Every stage is a declarative step. Every artifact is immutable. Every transition is observable. Hover a node - see what it does, what it emits, and what it runs.

ingest process catalog deliver
/06 - NOTHING YOU CAN'T INSPECT OR HOST YOURSELF

No black box. No hyperscaler.
The whole stack is standard, auditable open-source you can read and run yourself - self-hosted on a single server you control, with no hyperscaler and no US-cloud dependency, so there's no third party who can be compelled to hand over your data. Nothing here is a black box - here's what that means for you.

OPEN SOURCE
Standard & auditable
Proven, well-understood open-source your engineers can read - nothing exotic, no black box.
SELF-HOSTED
On your hardware
Runs on a single server you control, air-gappable - not a service you rent.
SOVEREIGN
No hyperscaler
No AWS, Azure or US cloud - no third party who can be compelled to hand over your data.
PORTABLE
No lock-in
Open schema, GeoJSON and an OGC SensorThings crosswalk - your data stays portable.
4
representative source types
685
backend tests passing · CI
100%
forged signatures rejected
1
sovereign bare-metal server · no hyperscaler
/07 - HOW TO ENGAGE

No price list - it's a TRL-4 demonstrator.
Evaluate it yourself for free, or run a scoped pilot with DOMSELARDI.

Level Zero has no customers, no availability SLA and no productized pricing yet - and we won't pretend otherwise. Verify the demonstrator yourself with no account, or start a scoped, paid evaluation with DOMSELARDI against your own representative inputs. Cost is set per engagement once the scope is clear; operational deployment is on the roadmap.

EVALUATE IT YOURSELFnow
Freeno account
See the proof before you talk to anyone - everything here is public and self-service.
  • Run the independent public verifier - no account, no session
  • Reproduce the golden demo bundle (built-in tamper + forged-key checks)
  • Read the canonical JSON Schema & OGC SensorThings crosswalk
  • Fetch the published trust anchor and pin verification yourself
Verify a bundle yourself
where most start
SCOPED EVALUATIONdesign partner
Scopedpriced per engagement
A hands-on, paid evaluation with DOMSELARDI against your representative inputs. A small founding-partner cohort.
  • Condition your source shapes into the canonical product
  • Signed provenance, chain of custody & corroboration on your data
  • Schema-per-tenant isolation · direct work with the company that built it
  • Time-boxed, fixed scope · no SLA (it is a demonstrator)
OPERATIONAL DEPLOYMENTroadmap
Roadmapbeyond TRL-4
For when Level Zero moves past the demonstrator - shaped with early design partners.
  • Live, licence-clean source connectors (today: representative / synthetic)
  • Availability SLAs, support tiers & on-call coverage
  • Single-tenant · air-gapped · sovereign on-prem deployment
  • Standards certification & formal accreditation work
[ VERIFY IT YOURSELF ]

Don't take the claim on faith.
Run the public verifier yourself.

A record re-signed with a forger's own key is internally consistent - and is still rejected, because the verifier pins to a published trust anchor loaded server-side, never from your request. Reproduce it end to end with one demo run: 8 signed products across 4 domains, one bounded corroboration candidate, and built-in tamper and forged-key negative controls. No account needed. Your evaluation is handled directly by DOMSELARDI, the company that built the signing pipeline and the verifier.

See the public verifier

[ TRL-4 demonstrator · no operational deployments or customers · sovereign OVH bare-metal, France-hosted target · no hyperscaler by default · 1 business-day reply ]