JANTARJantar Ops: Cited Anomaly Investigation
From a telemetry deviation to a root cause and a drafted recovery procedure. Every claim is cited or marked ungrounded, and a human reviews and authorises it.
From Deviation to a Cited Procedure
UNGROUNDED, carries no citation, and blocks release.INSUFFICIENT.Measured on the Reference Scenarios
Measured on seeded replay scenarios of JANTAR-REF-1, a synthetic reference spacecraft — not a real mission.
| Measure | Result |
|---|---|
| Root-cause top-1 | 1.000 |
| Citation integrity | 1.000 |
| Investigations | 16/20 |
| Grounded honesty (no fabrication) | 1.000 |
| No unsafe release | 1.000 |
First three rows: Measured on synthetic · JANTAR-REF-1. mode=airgap · model=deterministic · detector=annotation. Source: make bench. Measured at commit 2bc4474. From this release’s scorecard. Last two rows: Measured on synthetic · JANTAR-REF-1. mode=airgap · model=deterministic · grounded_faults=16 · moat_holds=True. Source: make bench-moat. Measured at commit 2bc4474. From this release’s scorecard.
Reference Subsystem Coverage
The failure modes modelled on JANTAR-REF-1. An operator’s own craft is onboarded onto its own FMECA and documents.
| Bus Subsystem | Modelled Failure Modes |
|---|---|
| EPS (Electrical Power) | Battery cell degradation, solar array string interconnection loss, battery thermal runaway precursor |
| AOCS (Attitude and Orbit Control) | Reaction wheel bearing lubricant starvation, rate gyro bias drift, wheel tachometer signal noise |
| TCS (Thermal Control) | Survival heater relay contact fusion, radiator surface coating degradation |
| TTC (Telemetry and Command) | Transponder power amplifier gain degradation |
| OBDH (On-Board Data Handling) | SEU-induced memory bit-flip accumulation, processor thermal throttling load spike |
Onboarding Your Own Spacecraft
In the console or over the API. Two people are involved, and nothing changes until the second one confirms.
Each craft’s records are kept apart per tenant and per craft, and a citation resolves only within its own craft. Re-onboarding a changed export merges into the craft and never removes what the new export dropped.
Prior Art and What Jantar Adds
Grounded anomaly investigation is an active field, and parts of it are decades old. Each line below names a design difference; it is not a comparison of results.
ESA AISHGO: AIIA and SMAI
AIIA investigates ground-station incidents; Jantar investigates spacecraft telemetry anomalies, and every citation must resolve against the craft’s own records.
What its sources say
An ESA project with Solenix, Starion, FBK, Airbus and DLR, which Solenix reports delivered AIIA and SMAI as operational tools. AIIA, led by Starion, helps ground-station engineers investigate incidents: it retrieves from past incidents and documents, checks each answer against them with a judging model, links its sources, and has operators review its conclusions. SMAI matches telemetry patterns inside the telemetry tools at ESOC and DLR GSOC.
Sources: Solenix · Starion · AISHGO paper · DLR
Sift Agents (research preview)
Jantar holds its citation rule in both directions: a grounded claim without a citation that resolves is a violation, and so is an UNGROUNDED step that carries one. Either blocks release.
What its sources say
Agents that investigate hardware telemetry, test several hypotheses in parallel and surface root-cause candidates with their evidence. Sift states that every step links back to the underlying data, and that write operations require human approval.
Sources: Sift Agents · Sift AI
CelestCore
Jantar is not the only system that declines. Its domain is anomaly root cause, and its decline, an INSUFFICIENT verdict, is a releasable answer: declining is not withholding.
What its sources say
Decision support for collision-risk alerts. When confidence is insufficient it formally declines to recommend, and every recommendation passes a separate verification path that cannot be bypassed. It is advisory and does not execute manoeuvres.
Sources: CelestCore
OpenC3 COSMOS Enterprise
A design contrast: COSMOS lets the model an operator connects act with that operator’s access. Jantar is advisory, and there is no path from a model to a transmitter.
What its sources say
Ships an MCP server that gives a model the customer supplies access to the COSMOS API, normally authenticated as the logged-in user. Its built-in AI interface reads telemetry, sends commands and runs scripts through that server. COSMOS bundles no model of its own.
Sources: OpenC3 docs
Remote Agent and Livingstone (NASA Ames and JPL)
Diagnosis against a model of the spacecraft is decades old, and Jantar’s reasoning is in that line. Jantar runs on the ground and drafts a recovery procedure for a human to review, with the evidence for each step cited.
SHINE (JPL)
SHINE encodes the knowledge of human experts. Jantar reasons over the operator’s own FMECA and documents, and each claim cites the record it rests on.
What its sources say
The Spacecraft Health Inference Engine, an expert system for monitoring, analysing and diagnosing real-time and non-real-time systems. NASA lists its use in diagnosing Voyager telecommunication anomalies at the Neptune encounter, and on the Mars Exploration Rovers.
Sources: NASA NTRS
Inductive Monitoring System (NASA Ames)
Jantar’s detectors are in this line, scoring deviation from a nominal profile. Detection is not what Jantar adds; the cited investigation after it is.
What its sources say
Learns clusters of nominal behaviour from archived data and measures how far new data falls from them. NASA reports it deployed as a tool in the ISS flight control room.
Sources: NASA NTRS · ISS deployment
What Jantar adds, narrowly
- Citation integrity for anomaly root cause, enforced in both directions.
- INSUFFICIENT is a releasable answer. Declining is not withholding.
- Deterministic replay: with the deterministic reasoning model, a re-run reproduces the report byte for byte.
- An air-gap mode that runs on the operator’s own infrastructure and refuses every network data source.
- No path from a model to a transmitter.
Other systems are described as their own publications describe them, and those may lag their current versions.
Sovereign & Airgap Deployment Notice
Jantar Ops ships at Authority Level A0 (Advisory Only). In airgap mode it runs with the deterministic reasoning model on the operator’s own infrastructure and refuses every network data source.