O.R.B.I.T.

Orchestrated Routing and Ballistic Incident Tracking A multi-agent ADK fleet that autonomously detects, negotiates, and dodges space debris.

Comment

Inspiration

Debris in low Earth orbit moves at roughly 7.6 km/s. One collision produces thousands of fragments, and each fragment becomes a new projectile. A single uncontrolled collision in a populated orbital shell can strand hundreds of satellites worth billions of dollars and render the orbit unusable for decades. Donald Kessler described that cascade in 1978 and it has only become more plausible since.

What pushed me to build this was the asymmetry underneath it. A university CubeSat programme carries exactly the same collision-avoidance duty as a national agency, and none of the staffing to discharge it. Screening a conjunction means parsing element sets, propagating both objects, computing a collision probability, working out whether you or the other operator should move, agreeing it with them, and executing a fuel-budgeted burn, all against a time of closest approach that does not wait for office hours.

Every one of those steps is well understood in isolation. Joined up, automated, and safe enough to trust without a control room, they are not. That gap is what O.R.B.I.T. fills.

The twist: O.R.B.I.T. negotiates with rival operators and evolves its own judgment — while being constitutionally unable to compromise safety.

What it does

An alert enters POST /api/conjunction_alert and a fifteen-agent pipeline runs to a terminal decision without further input:

  1. Triage turns a messy inbound alert into a validated mission dossier.
  2. Screening propagates both objects with SGP4 and refines the time of closest approach in three stages. Where 18th Space Defense Squadron has published a CDM for the pair, the CDM overrides our own propagation.
  3. Risk assessment computes collision probability with Chan's first-order Gaussian method and bands it against NASA CARA and ESA thresholds.
  4. Debate replaces the single specialist recommendation on HIGH-risk cases with three strategists arguing under a deterministic moderator.
  5. Coordination asks the counterparty to move, where a counterparty exists and can actually move.
  6. Safety gates the manoeuvre twice: an LLM Safety Officer verdict, then four deterministic Model Armor checks that run after the verdict and before anything is persisted or uplinked.
  7. Execution signs the command with HMAC-SHA256, debits fuel, persists the record, and renders a debrief.

Above the pipeline sits a Fleet Admiral that owns the one thing a single mission cannot see: a fragmentation event hits many assets at once, and fuel couples them. Spending 12 m/s on a satellite at 8 percent fuel to clear an encounter a sibling at 90 percent could also clear spends the wrong vehicle's remaining life.

Every stage emits audit events under one mission-scoped trace ID, replayable in full.

How I built it

Google ADK 2.7.1 for agent orchestration, Gemini 3.7 Flash and 3.5 Flash through Vertex AI for reasoning, Gemma 4 as an edge autopilot, Veo 3 and Lyria 2 for debrief media. FastAPI and Cloud Run for the backend, Firestore for the Memory Bank, React with CesiumJS for the command center.

The design rule I kept returning to: let models reason, never let them be the gate.

The debate moderator is an ADK BaseAgent, never an LLM. Four checks police every argument: a hallucination cross-check where each cited Pc, miss distance, TCA and delta-v must match the real screening; a physics check; a policy-envelope check; and SHA-256 loop detection that freezes any strategist repeating itself verbatim. If nothing valid survives, the classic single-specialist recommendation is emitted with fallback_used=True. The debate can fail. The mission cannot fail because the debate did.

The same shape governs self-improvement. A Learning Analyst proposes changes to the screening policy from resolved mission outcomes, citing counts. Five deterministic heuristics inspect the proposal before any LLM sees it. An adversarial Meta-Critic at temperature 0 assumes the proposer is guilty. Then a hard envelope clamp applies to everything, approved proposals included: each parameter bounded to its safe range, limited to 20 percent of that range per cycle. No LLM output is ever saved raw. Three consecutive rejections freeze evolution until a human unfreezes it.

Testing is hermetic. The real pipeline, Model Armor, Memory Bank and audit trail run unmodified while the four specialist LLMs are swapped for schema-valid scripted agents. No network, no credentials, no cost. Latest run is 126 of 126 checks green across 21 scenarios, alongside a destructive chaos suite and a benchmark harness.

Challenges I ran into

Negotiating with debris. The original design had an LLM negotiate with the counterparty on every HIGH-risk conjunction. Asking a model to negotiate with a fragment of Cosmos 2251 reliably produces a standoff, a deadlock with an object that holds no position, which then escalates for an arbitration no human can perform either. The fix was structural, not prompt engineering: when the counterparty cannot manoeuvre, the stage is skipped and audited as NEGOTIATION_SKIPPED / COUNTERPARTY_CANNOT_MANOEUVRE, with every safety gate still in force.

An unsafe default is worse than no default. When the catalogue could not identify a counterparty, the lookup returned "manoeuvrable" rather than "unknown". Against live data that produced a signed command asserting a Cosmos 1867 coolant fragment would move aside. The failure was not that the lookup missed — the public CDM feed rotates, misses are expected — it was which way the miss fell. Unidentified now degrades to not-manoeuvrable, so an unknown counterparty costs us a unilateral burn instead of fabricating someone else's consent. The two cases are also distinguished in the reasoning the fleet records: catalogued debris has no operator and no propulsion, an unknown object simply could not be identified.

Consent is not authentication. One signature-shaped field was quietly carrying two different claims. ack_signature asserts the counterparty agreed. command_signature asserts the command is ours and unaltered. On the common path, debris, there is no counterparty to consent, so the fleet now leaves the acknowledgement empty instead of forging an agreement that never happened.

Graceful degradation is where the silent failures hide. Every fallback I added, Space-Track, embeddings, Firestore, media, could serve plausible fiction under a banner claiming live data. Provenance became a first-class value on screen and a deploy-time refusal in deploy.sh, not a log line.

Session bleed. The pipeline writes screening and verdict payloads to fixed session-state keys, so a shared ADK session would let mission N+1 read mission N's screening. Each Admiral-assigned mission now runs in its own session.

Accomplishments I am proud of

The system degrades honestly. A dead provider trips the circuit breaker after exactly three attempts into structured human dispatch with zero fuel touched. Corrupt vehicle state, negative, NaN or garbage, is sanitised at the Memory Bank read boundary and the repair is audited. 100 concurrent missions all reach a terminal state with a unique trace each, at around 160 missions per second of orchestration throughput.

A complete SGP4 screen costs 0.61 ms and the entire four-check safety gate costs 0.09 ms, which means production latency is dominated by LLM inference, exactly where it should be.

What I learned

  • The hard problem is not screening, it is coordination. Conjunction data is standardised and machine-readable: CDMs in documented CCSDS format, served through Space-Track. "Will you move, or shall we" is still email and phone calls between assessment desks. None of it is a protocol a small operator can call.
  • The catalogue does not carry the fact you need. OBJECT_TYPE = PAYLOAD says nothing about manoeuvrability. STELLA is a passive laser-ranging sphere and DMSP 5D-2 F9 is defunct, yet that live pair screened HIGH at Pc 6.3e-4. Payload-versus-payload conjunctions are roughly one in ten, and even those are usually not negotiable.
  • A published CDM beats your own propagation, badly. One live pair screened LOW at 195.9 km from my SGP4 and HIGH at 71 m from the 18 SDS CDM. The encounter in the demo video makes the same point from the other side: CSTB 1 against a Cosmos 2251 fragment, 366 m at Pc 7.98e-4, taken from CDM 1671528657 rather than from anything I computed. Any system that quietly prefers its own numbers will be confidently wrong.
  • Chaos testing found a bug the unit tests could not. A NaN fuel value slid through the original clamp chain. That is why sanitisation happens at the read boundary now.
  • Self-improvement needs an adversary and a hard clamp, not one or the other. The Meta-Critic catches narrative-level gaming that pattern matching misses; the deterministic envelope catches what a persuasive proposal talks the critic into.

Bonus: Three Additional Google AI Models

This submission claims the full 0.6 bonus points by integrating three Google AI models beyond Gemini:

  • Gemma 4 for onboard edge autonomy: a satellite-side agent that takes over when ground contact is lost, making split-second collision decisions with one tool and stricter physics than the ground policy applies.
  • Veo 3 for mission debriefs: when a mission terminates, a background task generates a video summary of the encounter and attaches it to the conjunction record.
  • Lyria 2 for mission-control audio: five event classes own generated audio identities, so an operator hears the difference between an authorised manoeuvre and a blocked one.

Both Veo and Lyria degrade to clearly labelled deterministic simulations when credentials are absent, so the demo works anywhere and never presents a mock as a real render.

What's next for O.R.B.I.T.

The coordination path is the honest gap. Against two manoeuvrable payloads it does not reliably converge, and I would rather say that than ship a demo which hides it behind a counterparty that was never going to argue back. Everything downstream of that stage is finished. The stage itself is an open research problem, and it is the same open problem the industry has.

Nearer term: swapping the geap_sim layer for the managed Gemini Enterprise Agent Platform, one module at a time, since the seams are already isolated. Quantised on-device Gemma, so edge autonomy survives with zero connectivity and no Vertex round trip. Conjunction storms, using a LoopAgent for continuous monitoring and multi-object deconfliction, for when one manoeuvre creates new conjunctions downstream. And production hardening: Terraform, a frontend build step in CI, OIDC end to end, and Firestore-backed sessions for multi-instance deployments.

Further out, the thing I most want to exist is the part no prototype can supply alone: a machine-readable coordination endpoint other operators could actually answer. channel: "protocol" exists in the code today and describes the future state this project is arguing for.

https://github.com/Juniorlcsss/O.R.B.I.T.

Built With

Share this project:

Updates

Submission history