Skip to content
Project VELAProject VELA

Scale Architecture — Project VELA

Principle: scale-by-trigger, not scale-by-anxiety. Every layer names its demo choice, its production choice, and the measurable trigger that authorizes the switch. Building the production choice before its trigger fires is a bug.

Why throughput is not the bottleneck (the physics)

Telemetry volume is capped by RF downlink budgets: smallsat housekeeping telemetry is MBs–low GBs per satellite per day. A 50-satellite fleet ≈ single-digit GB/day ≈ one well-tuned TimescaleDB node for years. The company-killing scale problems are elsewhere: (1) trust — false-alarm rate and citation integrity (already first-class in 02/06), and (2) KG ingestion cost per new spacecraft — the true unit economics of expansion (gated in 09-ROADMAP). Optimize those first, always.

Layer-by-layer

Telemetry storage & ingest

  • Demo: Parquet files + DuckDB for ESA-ADB replay (fast, zero ops).
  • Pilot/production: TimescaleDB (hypertables per tenant, continuous aggregates for baselines, native compression) fed by the Yamcs adapter; Yamcs’s own archive remains the system of record at the customer, VELA’s store is a working copy.
  • Trigger to add streaming (Redpanda/Kafka) + object-store lakehouse (Parquet/Iceberg): >3 concurrent tenant fleets, OR sustained ingest >50 GB/day, OR a customer requires multi-region. Not before.

Detection & MLOps

  • Demo: per-mission GAT + ECOD, offline batch scoring in the replay harness.
  • Production: model registry (MLflow) with per-satellite models fine-tuned from a fleet-family base; ONNX export for inference; drift monitors on channel distributions; new models run shadow-scored against incumbents before promotion (mirrors Gate-3 discipline); scheduled retraining with frozen eval sets.
  • Trigger: signing of the second customer fleet. Cold-start for brand-new satellites remains the TSFM research track — it graduates only by beating the ensemble on held-out early-mission windows.

Knowledge layer

  • Fact: a spacecraft KG is ~10⁴–10⁵ nodes — trivially small for Neo4j. Graph query scale is a non-issue; the scaling problem is ingestion labor.
  • Production investment (the one place to over-invest early): extraction eval harness (precision/recall vs hand-labeled gold spacecraft), active-learning review UI so human review touches only low-confidence triples, per-tenant graph namespaces, Qdrant collection-per-tenant.
  • Trigger: pilot #2 onboarding. Target (binds 09-ROADMAP Rung 3): new-spacecraft ontology ≤ 2 engineer-weeks, measured and charted per onboarding.

Reasoning layer

  • Demo: direct invocation, one investigation at a time.
  • Production: Postgres-backed job queue (Hatchet/Celery-class) with per-tenant concurrency caps and cost meters; prompt caching; agents remain stateless functions over InvestigationState, so horizontal scaling is “run more workers” — no re-architecture. Investigation SLO: triage < 60 s, full report < 10 min.
  • Trigger: >20 investigations/day across tenants, or first SLO breach.

Multi-tenancy & security — the one thing we do NOW

tenant_id and satellite_id enter every contract, table key, MCP request, Qdrant payload, and audit record from day one (cheap today, brutal to retrofit). RBAC (operator/reviewer/admin), per-tenant encryption at rest, audit-log retention policy, and a SOC2-lite control narrative before pilot #1 — Indian space customers will ask about ISRO/DPDP-adjacent data handling even when the framework name differs.

Fleet-level correlation (v2, feature-flagged)

Constellation-wide events (space weather, ground-segment faults hitting many satellites) = time-window joins across satellites on the event stream; design keeps AnomalyEvent satellite-scoped so a fleet correlator composes on top rather than reworking Layer 1. Trigger: first customer flying >10 satellites.

Observability (cheap now, do now)

OpenTelemetry traces spanning MCP calls and agent nodes; the trace IS the audit log’s backbone (one instrumentation, two products: debugging + review-board evidence). Grafana on docker compose. This is your DevOps home turf — a day’s work, do it in Week 1.

Explicitly deferred (with contempt for cargo-culting)

Kubernetes, microservices, Kafka, multi-region, event sourcing, service mesh. Monolith + docker compose until pilot revenue exists. Each item above unlocks only via its named trigger, recorded in the README decision log when fired.

The honest scorecard

Advanced where it must be (grounded agentic reasoning, citation-mechanical audit, airgap parity — none of which competitors ship today). Boring where it should be (storage, transport, deployment). Scalable by design where retrofit is deadly (tenancy, stateless agents, contracts), by trigger everywhere else.