Capability Brief · Unclassified

TAK Infrastructure

The integration layer that puts purpose-built field tools onto the standard military mapping picture. Four applications publish to one map, so the technician, the medic, the dive supervisor, and the incident commander are looking at the same thing instead of describing it to each other.
self-hosted · Docker · certificate authority
No government systems or networks · No operational, unit, or incident information · Personal equipment on personal time · Unclassified
The Problem

Four tools, four screens, and no shared picture

  • Every tool stops at its own screen. The cordon lives on the technician's device. The casualty count lives on the medic's device. The dive supervisor has a boat and a radio. The incident commander is told about all three, in words, late.
  • The shared picture already exists. Units already run a common mapping client. What is missing is anything feeding it from the tools that hold the actual numbers.
  • Feeding it is not a checkbox. It means a persistent authenticated connection carrying a specific event format, where certificate identity and group membership decide whether anything is displayed at all. That work does not live in the application, and it is where integrations die.
  • Without it, the operator is the integration. Somebody reads a distance off one screen and types it into another, under time pressure, and that is the step that gets skipped.
4
applications publishing onto one shared picture
1
standard, spoken as defined, with no private protocol invented
0
changes on the receiving end: it is already the standard client
0
government systems or networks involved
TAK InfrastructureUnclassified
The Capability

Four field tools, one shared picture

  • Casualty documentation. A casualty record becomes a marker carrying the triage category as its map colour, updated in place as the category changes. The nine-line evacuation request pushes as its own event, and wound photographs upload to the server's file share with a marker pointing at them.
  • The cordon picture, authored by the application. Blast and fragmentation distances are drawn as map shapes, so the incident commander sees the same rings the technician is working to. Rings carry a height, so they draw as cylinders, and a geofence, so the map itself raises the alarm when a friendly crosses one. The relay has no opinion: a wrong ring is a bug in one place, never two.
  • Dive supervision, where the two-way channel lives. Replies typed on the map are read back off the connection, parsed, held in a five hundred message buffer with duplicates dropped, and served to the application. Both directions are proven against the live server; the application wiring that declares a dive casualty is the outstanding half.
  • The approach, from the wrist. A watch posts its position every five seconds and appears as a friendly unit that expires on its own after seventy five seconds of silence. The wrist path authenticates its caller.
write
casualty markers, triage colour, evacuation requests, imagery, cordon shapes
500
message inbound buffer on the two-way path, duplicates dropped
5s
position interval from the wrist
75s
before a silent wrist marker expires itself off the map
TAK InfrastructureUnclassified
Architecture

A relay process instead of tactical networking inside every app

  • The constraint is the clients. A browser-delivered Flutter app and a wrist computer, neither of which can hold a client-certificate connection to a tactical server. The browser does not expose that socket, and the watch runtime makes plain web requests only.
  • The pattern: a small relay holds one persistent, certificate-authenticated connection to the server and presents an ordinary web interface to the application. The app posts an event; the relay owns the protocol, the heartbeat, and the reconnect.
  • It survives bad networks. A failed request is retried by the caller with no state to rebuild, and a dropped tactical session is the relay's own problem to reconnect. On a boat or in a suit, that is the feature.
  • One relay per product line, each with its own issued identity. Every application appears on the map as itself, deploys and rolls back on its own, and cannot take another down with it. The wrist feed shares the identity of the tool set it belongs to.
  • Thin by choice. Four services, nine hundred and sixty three lines of standard-library code between them, no third-party packages. Protocol knowledge sits in one file per product line, which has been the only place any of it needed fixing.
1
persistent authenticated connection held per relay
4
relays live, one per application path
963
lines of standard-library code carrying every integration
0
third-party packages: nothing to rot or be abandoned
TAK InfrastructureUnclassified
The Foundation

Owning the server is what makes the integration provable

  • The server software runs as shipped. Containerized, with a spatial database of its own, and rebuildable from a recorded configuration. Nothing forked and nothing patched around, because a modified server stops being a test of anything.
  • Every client, operator or machine, connects with an issued certificate. A private authority issues each one. Group membership and permissions therefore behave the way they do in the real thing, which is the only reason testing against it is worth anything.
  • Borrowed access cannot answer the hard questions. Someone else's server shows you a marker arrived. It does not let you revoke a certificate, cut the connection mid-transmission, or see what a client does when the network returns.
  • Reachability is decided per path. The plaintext event input is confined to a private container network, and that confinement was tested from off the box rather than assumed.
2
composed services: application server and spatial database
PostGIS
spatial store behind the common operational picture
1
private authority issuing and revoking every client identity
stock
server software run as shipped, so the test means something
TAK InfrastructureUnclassified
Enrollment

Getting a device onto the server is the unglamorous half

  • There is no self-service enrollment. The administrator generates the client certificate, builds the package, and hands it over. An administrator signing in to the enrollment interface gets an administrator dashboard, not a user workflow. Finding that out cost a working day, and it is the kind of thing no documentation says plainly.
  • A data package is four files in a zip: the client certificate, the certificate authority trust store, a connection preference file pointing at the streaming input, and a manifest the client reads on import.
  • Delivery is the whole user experience. The package reaches the device as a single file and imports by tapping it. No cable, no desktop, no sideloading tools, which is the difference between a technician self-enrolling in a parking lot and one waiting on a laptop.
  • Certificate issuance is scripted, not clicked. One command per identity, with the organizational fields supplied as environment variables, which is the difference between onboarding a team in ten minutes and onboarding one device in an hour.
4
files in a working data package: certificate, trust, preferences, manifest
1
command to mint a new client identity
tap
to import a package on the device: no cable, no desktop
0
self-service enrollment features available at this release
TAK InfrastructureUnclassified
The Protocol

What the seams actually cost

CONNECT client -> server certificate presented on an encrypted socket server -> client protocol support announced client -> server version requested required, or the stream stalls REGISTER client -> server self announcement, callsign and device identity client -> server repeated every 15s <-- miss it and you are dropped EVENT <event type="a-f-G-U-C-I" uid="..." time/start/stale> <point lat="..." lon="..." hae="..." /> <detail> <contact callsign="I-001" /> attribute, not element text <__group name="Red" /> decides colour and visibility </detail> </event>
The connection lifecycle and the event shape, reduced to the parts that were learned the hard way
  • Every ring carries its colour three times. The handheld and desktop clients read different fields, and the desktop one drew every ring white until it was given the field it wanted.
  • Newer is not always the right version. The push-only relays accept the offer of the newer binary protocol. The two-way relay refuses it and stays on the text protocol rather than the binary one, so inbound events parse with the standard library alone. A deliberate downgrade, recorded as one.
  • The expensive one: the wrong input isolates you silently. Markers sent to a plain input were accepted and logged as relayed, and never reached certificate-authenticated clients, because they carried no group identity. On the authenticated input they appeared instantly. Every log said success the whole time.
TAK InfrastructureUnclassified
Honest Limits

What this is not, written down before anyone asks

  • It is a development and demonstration server, not a field system. It exists so the applications can be built and shown against real behaviour. Nothing here is offered as an operational service.
  • Hardening is engineering work. Monitoring and access-control hardening are tracked as engineering work alongside the application features.
  • No operational content. Test data and demonstration casualties only. No operational, unit, or incident information, on a server that shares nothing with any government system.
dev
purpose: build and demonstrate, not deploy
test
data and demonstration casualties only
tracked
monitoring and access-control hardening carried as engineering work
0
operational, unit, or incident information
TAK InfrastructureUnclassified
Principles and Status

Built to the standard, so it works on equipment I do not own

  • Standards first. Every application was made to speak the existing tactical standard rather than invent a private one. That is why any of them can be handed to a unit already running the standard client and simply appear, with nothing installed on the receiving end.
  • Own the whole path. Certificate authority, server, relays, and applications sit under one hand, so a failure is traced end to end instead of blamed on the far side. That is what turns an integration claim into something demonstrable.
  • Separation is structural. Each product line has its own identity on the map, its own container, and its own rollback, so one bad deployment cannot take the others off the picture.
  • Status. Server, database, and device onboarding are running. Three application paths proven end to end: casualty documentation, the cordon picture, and the position feed from the wrist. The dive path has both directions proven at the transport and is waiting on its application half. Next work is the dive application wiring.
Running
server, spatial database, and device onboarding
Proven
three application paths end to end, the fourth at the transport
0
software required on the receiving client: it is the standard one
Next
the dive application wiring
TAK InfrastructureUnclassified
1 / 9