Overpass

Inspiration

Small-satellite teams don't own a global antenna network. They rent contact time from third-party ground stations, and a booking hands a stranger's antenna time-boxed authority to relay commands to a spacecraft. An unverified station can capture and replay the command stream, tamper with telemetry, or go silent during an anomaly. An unverified operator can book a pass against a satellite it doesn't own, which is a licensing violation. Both sides need proof of identity before any command is sent, and it has to work on first contact between organizations that have never met. We built Overpass to solve that using GoDaddy's Agent Name Service as the trust layer.

What it does

Overpass is a multi-agent broker for satellite ground station passes. Eight steps:

Predict. Ops computes tonight's real passes from public orbit data (SGP4 over CelesTrak TLEs).
Discover. It finds stations through ANS by capability tag and verifies each: badge, cert chain, DANE/TLSA, SCITT transparency-log receipt, and a signed agent card pinned to the log-attested identity key.
Score. A forked trust index scores each agent on five dimensions. Access tiers in the mission authority's flight rules gate what a station may do.
Plan. A planner proposes bookings. The mission authority, not the model, signs a mandate or refuses on policy.
Book. The mandate names one station, one satellite, one time window. Twelve ordered checks validate it, each with a named rejection code.
Command. Ops signs each command with a per-satellite counter. The station relays but cannot forge or replay. The spacecraft checks the signature, the NORAD ID, and a strictly increasing counter.
Re-verify. Both sides re-check the peer's status token during the pass. A revocation cuts the session on the next fetch. A network blip alone does not.
Audit. An auditor re-verifies each pass from public evidence and probes stations with canary mandates. A station that accepts a forged mandate loses its tier.

An unregistered impostor is rejected before any quote is read. GoDaddy's production agent (agent.webmesh.ai) verified our station live and returned can_traveler_transact: yes. Their red-team agent (fraud.webmesh.ai) returned PASS on its payTo attestation probe.

How we built it

Go, one binary with --role ops|authority|station|auditor|spacecraft. ANS integration through ans-cli (registration) and ans-sdk-go (verify, verify/scitt, pop). Crypto is ES256 over EC P-256 identity keys from the ANS Registration Authority, JCS canonicalization (RFC 8785), detached JWS card signatures, RFC 7638 thumbprints, and hash-chained command records. Orbit math is SGP4 on real CelesTrak TLEs across three sites: Blacksburg VA, Svalbard, and Awarua NZ.

Trust is a fork of GoDaddy's agent-trust-discovery with one added pass_delivery signal, upstream thresholds untouched. The dashboard is static HTML, vanilla JS, and CSS: no framework, no build step, no external requests, three themes, and server-sent events for live updates. Hosting is a single Vultr VPS with nginx SNI passthrough so each agent serves its own ANS-issued cert, plus systemd units per role. DNS is Porkbun with DNSSEC, TLSA, SVCB, _ans, and _ans-badge per host. Every phase ran a plan, code, review, test loop with acceptance scripts and a secret scanner in the lint gate.

Challenges we ran into

Registration is permanent. The ANS log is append-only, so a typo in a hostname lives there forever. We dry-ran every command before committing.

Certificate trust. ANS certs chain to GoDaddy's new R1 root, which most trust stores don't ship yet. We appended GoDaddy's R1-cross-G2 cert so the chain terminates at the G2 root every stock store knows. Leaf certs and TLSA records were unaffected.

DNS wildcards. Adding HTTPS and SVCB records made the wildcard A record stop matching that host (RFC 4592), so every registered host needed its own explicit A record.

FIDUCIARY is unreachable honestly. The real engine requires every dimension above 80, and identity comes from cert type alone (DV = 40), which our demo-CA certs can't beat. Instead of faking a score, we gate uplink on the truthful vector through the authority's flight rules, show the real identity score, and document the gap.

The fraud battery. GoDaddy's fraud agent currently returns REQUEST_NOT_SIGNED even against their own reference supplier, so mandate-level attacks couldn't complete. We opted in, built the supplier surface, and passed the payTo probe. The station is ready for a full run whenever the mint is fixed.

Accomplishments that we're proud of

Three agents registered ACTIVE on GoDaddy's production ANS registry, with real certs, DNSSEC, DANE, and SCITT receipts.
A live uplink pass against production, with a signed command accepted by the spacecraft.
GoDaddy's own agent verified our station (can_traveler_transact: yes), and their red-team agent returned PASS on the payTo probe.
A 23-check attack battery (their 13 fraud checks plus 10 of our own), all blocked with named reasons.
An impostor rejected before any quote was read.
A dashboard that works with a keyboard, a screen reader, in high contrast, and without color: zero axe violations.

What we learned

ANS answers "who is this agent," not "should I trust it with a spacecraft." Identity is necessary but not sufficient, and trust tiers, mandate policy, and audited behavior fill the gap. Building against a live append-only registry forces you to get things right before you ship, not after. And accessibility built in from the start cost far less than a retrofit would have.

What's next for Overpass

Replace the simulated pieces with real ones: a software-defined radio and a real satellite bus instead of the simulated spacecraft and RF link. Move settlement on-chain for real, since today the station's payTo is the null address on Base Sepolia and the card says so. Hand the trust index and auditor to a neutral third party rather than running both ourselves. Pin metaDataHash at registration once ans-cli supports it (v0.1.18 doesn't, so we bind the card to the log-attested key by signature instead), and run GoDaddy's full fraud battery end to end once the fixture mint is fixed. Trust observations are seeded for now (behavior only, marked as seed data, never identity or integrity); in production those would accumulate from real audited passes.