Mission Foundry

A local, model-centered conceptual mission engineering workbench. Six versioned discipline roles propose a wildfire-monitoring CubeSat concept, deterministic tools size resources, and a human approves an immutable concept baseline.

Run with Docker Compose

cp .env.example .env
docker compose up --build

Open http://localhost:5173. Compose runs PostgreSQL 16, applies Alembic migrations, and starts the API and React workbench. Only the frontend port is published, bound to localhost. The default mock workflow requires no API key. The development database password in Compose is public and local-only; do not deploy this configuration publicly.

Run without Docker

From this directory, Python 3.12+ and Node 22+:

python3 -m venv .venv
.venv/bin/pip install -r backend/requirements.lock
.venv/bin/pip install -e './backend[dev]'
npm ci --prefix frontend
cd backend
../.venv/bin/alembic upgrade head
../.venv/bin/uvicorn app.api.main:app --host 127.0.0.1 --port 8000

In a second terminal from the repository root:

npm run dev --prefix frontend

After installing dependencies, ./scripts/dev.sh is a single-command alternative that starts both services.

Open http://127.0.0.1:5173. This path uses SQLite in backend/mission-foundry.db; set DATABASE_URL to use PostgreSQL. API documentation: http://127.0.0.1:8000/docs. Schema creation is performed by migrations, never implicitly at production startup.

Demonstrate the vertical workflow

1. Create the prefilled reference mission. Review the scope and other assumptions, enter a decision rationale, and approve them.
2. Advance, inspect and approve the requirement proposal. Advance, inspect and approve the architecture proposal.
3. Advance to run orbit, mass, power/energy, data and RF/downlink tools for both alternatives. Candidate A produces 43.2 Gbit/day but can downlink only 1.68 Gbit/day. Candidate B produces 8.64 Gbit/day and has 16.8 Gbit/day capacity under the approved assumptions.
4. Open Trades. Inspect estimated scores and adjust weights (nonnegative, sum to one). Select candidate B. A is not selectable because it violates the downlink constraint; its dissent and failed analysis remain in the model.
5. Return to Overview. Run independent review. Propose the evidence-defect resolution, then verify it independently.
6. Open Baselines & replay. Acknowledge residual risks and explicitly approve the immutable conceptual baseline.
7. Export Markdown, JSON and CSV. Load the replay timeline, inspect an earlier snapshot, compare changed objects, or restore as a new revision.

Click any model object to inspect attributes, classification and both directions of traceability. Budget details link to their analysis execution, units, inputs, tool version and source revision. Proposal content has a separate pending presentation. Rejected proposals remain in history and can be regenerated by advancing. Challenges remain pending until explicitly reviewed.

Validation

.venv/bin/ruff check backend
.venv/bin/ruff format --check backend
.venv/bin/pytest backend/tests -q
npm run build --prefix frontend
npm test --prefix frontend
npm run format:check --prefix frontend
npm run e2e --prefix frontend

Playwright uses installed Google Chrome by default; set CHROME_PATH if needed. Its configuration starts both development servers and migrates a separate temporary browser-test database. Tests use separate SQLite databases; the browser acceptance test creates a new uniquely named mission.

scenarios/run_reference.py creates a complete reproducible acceptance run and writes sample model/report artifacts to scenarios/output/. Its human actions are explicitly simulated test inputs, not autonomous production approvals:

.venv/bin/python scenarios/run_reference.py

Security and model-provider configuration

The default is a single-owner, public local demo. For non-public data set DEMO_MODE=false and provide MISSION_OWNER_TOKEN through the process environment. Enter that token in the workbench access panel. It is held only in browser memory; requests use an Authorization header, including event streams and exports. This is not multi-user identity or tenant authorization.

The provider-neutral Provider interface has a deterministic mock and an optional OpenAI-compatible adapter. To opt in, set LLM_PROVIDER=openai-compatible, LLM_BASE_URL, LLM_MODEL, LLM_API_KEY, LLM_MAX_PRICE_PER_MILLION, and a positive MAX_RUN_COST_EUR. The real adapter can refine proposal rationale only; it cannot change scenario operations. It has a 30-second timeout, a fixed output limit, and a conservative per-call cost preflight. The optional adapter is not a general autonomous mission designer; its HTTP contract is mock-tested but has not been exercised against a paid provider. Aggregate billing/token accounting is deferred. Compose intentionally defaults to the mock; pass optional provider environment variables explicitly if using the real adapter.

No generated code is executed. Tools are an allowlisted collection of pure functions with Pint dimensional validation. Imported mission text is stored as data, never used to redefine agent instructions. Agent proposals cannot become calculated conclusions or impersonate human decisions. The API has no arbitrary SQL, shell, code execution, or evidence-fetching endpoint.

Scope and limitations

This is a working reference-scenario vertical MVP, not completion of every Must in the long-term specification. See requirement traceability for per-ID status and architecture.

• Natural-language text is retained, but deterministic patterns identify reference constraints and missing information; the mock proposes a fixed reference sizing basis and explicitly requests approval of that scope. General extraction, custom mission sizing and clarification editing are deferred.
• All hardware, contacts, detection performance, scores and costs are labelled assumptions/estimates. Circular-orbit eclipse is a worst-case geometric estimate, not a propagated mission-access solution.
• Daily capacity does not establish 30-minute delivery. Independent review catches this defect. Resolution adds an explicit verification obligation and retains the residual mission risk; it does not certify latency feasibility.
• The user approves a conceptual study, not flight readiness. Coverage, revisit, lifetime, cost closure, thermal and pointing analyses remain open.
• Common entity metadata is typed and selected entity payloads require key fields. A fully discriminated schema for every engineering payload is deferred.
• No graph database, arbitrary import, branch merging, multi-user editing, supplier retrieval, high-fidelity orbit simulation or autonomous baseline approval.
• Revision snapshots prioritize auditable correctness over storage efficiency. No 10,000-object performance claim is made.
• Workflow steps are short synchronous transactions run in FastAPI's worker pool. SSE reports committed progress. Pause controls future steps, not interruption of a calculation already running. Durable distributed jobs and full elapsed/token/cost accounting are deferred.

The original mission-foundry-requirements.md is preserved unchanged.

See the validation record for executed checks and explicit limits, and the JSON schema for the versioned export format.