Skip to content
Project VELAProject VELA

The advisory boundary — what VELA may do, and what it must never do

Status: normative. This defines guardrail #1 (§CLAUDE.md) precisely for the onboard-autonomy era, so operators, agencies, and certification bodies can rely on it. VELA is advisory only. It never commands a spacecraft.

Where the line is, in standards terms

The international ground/space standards already draw the line VELA sits on:

  • ECSS-E-ST-70-11 (“Space segment operability”) governs the design of on-board functions — FDIR and the E1–E4 autonomy levels live on the spacecraft. A ground tool is, by construction, outside that standard’s scope.
  • ECSS-E-ST-70-01 (On-Board Control Procedures) splits an OBCP into on-board functionality that executes it and ground functionality that only prepares and controls it — and execution reaches the spacecraft through the PUS telecommand service architecture (ECSS-E-ST-70-41).
  • CCSDS SM&C models operations as separable monitoring vs control services, not one monolithic command-and-control block.

“Commanding” is therefore concrete and locatable: a telecommand is constructed, validated against a command database, and uplinked via a ground station — a mission-control (operator) function. Those verbs — construct, format, transmit — are exactly what VELA’s guardrail forbids.

What VELA MAY do (read-only, advisory)

  • Ingest and explain, read-only: telemetry, command history, onboard-AI outputs (edge detections, health scores, features), FDIR events, and autonomy state. Reading what the spacecraft already did or reported is telemetry, not commanding — modelled as read-only records (TelecommandRecord, OnboardAIRecord) with the same posture.
  • Investigate, ground, and cite a root cause — the explainability the edge/FDIR layer lacks.
  • Draft a recovery procedure and hold it for a human. The human executes it through their own commanding chain; VELA is never in the command path.

What VELA MUST NEVER do

  • Construct, format, validate, or transmit a telecommand (uplink / C2 issuance).
  • Configure, enable, arm, or trigger onboard autonomy or FDIR — that is command-adjacent and is excluded, even though reading autonomy state is allowed.
  • Sit anywhere in the command path, or emit a “directive” an automated system could execute.

Why this is enforced by design, not by trust

Onboard autonomy is growing, and a natural failure mode is an operator over-trusting an advisory tool. The human-factors evidence is unambiguous: automation bias measurably raises wrong-decision rates (relative risk ≈ 1.26), makes operators reverse their own correct decisions, cannot be trained away, and worsens under exactly the multitask load of a busy anomaly console. So the boundary is enforced by system design, not by asking operators to stay vigilant:

  1. Advisory scope in code. No module constructs/transmits a telecommand; the surface is read-only records + a drafted procedure. Enforced by scripts/guardrails/no-commanding.sh (pre-commit + two CI workflows) grepping apps/ and vela/ for issuance identifiers.
  2. Evidence, not directives. Every claim carries citations that resolve (vela.audit.citation_check); an ungrounded step is emitted as UNGROUNDED and blocks release. VELA presents why, cited — never an unexplained “do this”.
  3. Human-in-the-loop by construction. Release is a real interrupt() approval gate keyed to an authenticated, role-checked principal; the human executes via their separate command chain.
  4. The MCP audit boundary. Reasoning reaches data only through vela.mcp.client — a fixed, auditable, read-only tool surface. There is no tool that issues a command.

For certification

The boundary is: VELA consumes the monitoring/telemetry plane (including FDIR events and onboard-AI outputs) read-only and produces cited advice a human acts on; it never touches the control/command plane. That places it cleanly outside ECSS-E-ST-70-11 (on-board functions) and outside the PUS telecommand issuance path, and it is enforced mechanically (the no-commanding guardrail) rather than by policy alone.