- The paper presents a four-stage pipeline that integrates schema validation, policy evaluation, IR generation, and artifact rendering for ground-side mission planning.
- It leverages tools like Pydantic, OPA/Rego, and Kubernetes-native platforms to enforce robust safety and structural integrity pre-uplink.
- Evaluation shows near-linear compilation performance and a defense-in-depth approach that meets the safety standards for cloud-native satellite operations.
Introduction
The evolution of onboard cloud-native runtimes for satellites—exemplified by projects such as ORCHIDE, AxDCU-1, and Kepler's distributed Jetson Orin platform—has shifted mission planning architectures. These orbit-resident stacks, typically grounded on K3s, Argo Workflows, containerized engines, and hardware abstraction for accelerators, expect structured, validated workflow artifacts from ground operations. Critically, no standardized, open-source ground-side toolchain exists for compiling human-authored mission plans into these artifacts, with strong semantic guarantees enforced pre-uplink. This paper systematically addresses this tooling gap with a principled pipeline integrating type-safe schema validation, policy-as-code safety guardrails, and compilation into Argo and Kueue workflows targeting heterogeneous satellite execution environments (2607.14798).
The work is centered on the ORCHIDE onboard runtime, which orchestrates containerized AI workloads via lightweight Kubernetes distributions and supports operational flexibility under stringent SWaP constraints. The mission plan abstraction is a temporally-ordered event sequence over multiple orbits, describing acquisition and download activities with rich resource-class metadata and AI-service decompositions. Publicly available consortium documentation (e.g., ORCHIDE D3.1) provides guidance on structural invariants and interface intent, but the consortium omits a formal compilation toolchain for the ground-to-space handoff.
Existing mission-planning environments in the ground-segment (GMV FlexPlan, OpenC3 COSMOS, EOEPCA) provide partial solutions—such as constraint-based validation or data-processing pipeline compilation—but none offers the synthesis required for policy-driven, satellite-specific, container-workflow production. Operator practices at NASA/JPL further illustrate the maturity of rule-based preflight validation; however, architectures like RP-check remain focused on command sequence languages outside the mission-plan-typed DAG domain and lack integration with policy-as-code approaches suitable for modern Kubernetes-driven platforms.
Compiler Pipeline Design
The proposed Satellite Mission Compiler enforces rigorous pre-uplink validation and transformation through a four-stage pipeline:
- Schema Validation: Leveraging a Pydantic v2 schema reflecting ORCHIDE’s mission plan model, the pipeline applies structural integrity checks, including instrument presence, download-event constraints, and service/step cardinalities. This phase statically rejects malformed plans.
- Policy Evaluation: OPA/Rego policies (ten explicit deny rules, separating ORCHIDE-inherited from author-imposed constraints) encode semantic invariants exceeding static typing—such as explicit fallback requirements for GPU/FPGA steps, priority-range validation, and logical coherence between declared accelerators and resource classes.
- Intermediate Representation (IR) Generation: The compiler synthesizes a typed IR (WorkflowIntent), maintaining resource hints, event metadata, and structural normalization.
- Artifact Rendering: The IR is transformed to both Argo Workflow DAGs (maintaining execution order, resource hints, and accelerator affinities) and Kueue Job manifests, supporting full DRA integration and accurate device-class quota tracking.
Layered validation emulates defense-in-depth best practices from the safety-engineering community, overlapping schema and policy enforcement by design for select rules. This stands in contrast to prevalent security-oriented approaches focused on runtime admission control (e.g., OPA Gatekeeper), ensuring hazards intrinsic to satellite scheduling semantics are mitigated before uplink [NASA-STD-8739.8B].
Policy-as-Code and Safety-Critical Enforcement
The policy corpus captures both direct ORCHIDE constraints (e.g., proper assignment of download-event fields) and domain-specific safety policies advocated by the authors, independent of platform implementation. The latter include mandatory fallback classes for accelerator steps and resource-class–acceleration coherence checks—reflecting system-level expectations for robust, fault-tolerant scheduling in an environment where missed fallback declarations could stall an entire deferred phase.
Such policies are documented with explicit provenance, aiding auditability and future replacement if official schemas or flight-rule packages are published. The OPA/Rego environment is invoked as a standalone binary, intentionally decoupling rule evaluation from the primary compiler to support external review and governance.
Artifact Targeting: Argo Workflow and Kueue Admission
The rendering phase translates the validated IR to artifact formats native to satellite onboard runtimes:
- Argo Workflow: Missions surface as DAGs conforming to Argo v1alpha1, with detailed annotations for priority, resource requirements, and execution mode. The pipeline supports deterministic priority mapping (0–100 user scale to ORCHIDE's 1–4 operational scale), soft device-affinity hints, and explicit step ordering.
- Kueue Job: Each pipeline yields Kueue-compliant batch Jobs, leveraging DRA-backed device claims (including explicit GPU and, in extended experiments, CPU device classes). The artifact structure is consistent with admission, quota, and preemption semantics critical for multi-tenant, resource-constrained orbital compute.
Exploiting recent advances in Kueue (v0.17.3+, v0.18.3), the compiler supports unified device-class quotas, scheduler-level accelerator fallback (via firstAvailable claims in vanilla Kubernetes), and empirical demonstration of quota-counted contention and admission cascades. The operational separation between exactly device requests (admissible and quota-counted under Kueue) and prioritized fallback (scheduler-only, not Kueue-admitted) is identified, with rendering strategies aligned accordingly.
Evaluation
Validation Depth and Numerical Results
Case studies across three plan categories (valid, structural errors, and semantic errors) demonstrate the defense-in-depth effect of the combined schema-policy pipeline. Out of key constraints, five exhibit overlapping enforcement (e.g., mission ID non-emptiness), while four rely exclusively on policy for safety-relevant semantic violations. In ablation, pure schema validation would miss critical accelerator-fallback and logic coherence defects; conversely, policy, though more expressive, is complemented for type and cardinality integrity by the schema.
Compilation performance is reported as near-linear in workload size, dominated at scale by YAML and Pydantic operations: 1.5 seconds for a plan with 1000 events and 3000 steps, with OPA evaluation (fixed process spawn cost) remaining sublinear. Live-cluster submissions confirm correctness of resource claims, device assignment, and prioritized admission enforcement (e.g., validated end-to-end under realistic quotas and DRA drivers, including explicit GPU and CPU claim integration) [(2607.14798), Table 3-4].
Agent Interface, Robustness, and Security
The Model Context Protocol (MCP) interface exposes pipeline stages and validation feedback to AI agents, supporting safe diagnosis–repair–verify automation loops through path-traversal-protected interfaces (CWE-22 tested). Security evaluations include OPA subprocess DoS mitigation and validation of directory isolation for agent-provided plan files.
Loss Event Classification and Theoretical Safety
Pre-uplink loss events are categorized into four operationally-defined tiers: malformed plan (T1), accelerator stall (T2), contact-window loss due to download mis-specification (T3), and loss of mission-objective efficacy (T4). Each is traced to specific schema or policy countermeasures, informing subsequent risk models for ground-side compilation admission gates. This classification lays the foundation for future STPA-style hazard analysis within satellite mission assurance frameworks.
Limitations and Future Directions
Several constraints are identified:
- No empirical validation on external operator workloads (all test plans author-constructed).
- Lack of FPGA/mixed-accelerator policy enforcement in the current pipeline.
- Architecture is not a full safety-assurance (per NASA-STD-8739.8B) or security (per NIST SP 800-53) program, nor does it enforce OTA update semantics.
- The decoupling of firstAvailable (scheduler-level) fallback and Kueue quota accounting is a limitation of upstream Kueue, not the presented compiler.
- The schema-policy-artifact pipeline is modular and can generalize to alternative runtimes, flight rules, or schema evolutions (e.g., MicroShift/AxDCU-1 or EOEPCA/Calrissian replacement paths), but practical validation is limited to the ORCHIDE-inspired archetype.
Implications and Future Developments in AI
Practically, the compiler enables verifiable, automated mission plan gating and artifact generation, a prerequisite for operationalizing AI-driven satellite automation at scale. The robust audit trail and agent interface establish a foundation for closed-loop planning, repair, and dynamic adaptation with LLM or RL-based agents in the control stack. Future developments may target dynamic policy composition derived from in-orbit feedback, integration with constraint-based onboard schedulers, generalized cross-platform schema ingestion, and enriched safety-case tying schema/policy artifacts to verifiable hazard models.
Theoretically, the pipeline’s layered model bridges contemporary safety engineering and modern Kubernetes ecosystem policy practices, informing both reliability-centric and autonomy-centric satellite operation architectures. Aggressive policy-as-code adoption in this critical niche both raises the standard for independent mission validation tooling and codifies a template for heterogeneous, multi-modal workflow targeting in space computing contexts.
Conclusion
The Satellite Mission Compiler represents a rigorous, open-source solution for ground-side satellite mission plan validation, policy enforcement, and artifact generation tailored to the needs of cloud-native orbital environments. By combining defense-in-depth validation (schema and policy), clear safety provenance, thorough evaluation, and integration with modern job admission controllers, the compiler closes a critical gap between operator-authored plans and the operational requirements of contemporary onboard runtimes. The tool substantiates robust, verifiable mission plan deployment, providing a strong baseline for future research and development in satellite AI operations and autonomous orchestration (2607.14798).