Systems That Run Where Nothing May Leave the Building

Doctrine, standing orders and instructions accumulated over decades decide the action. The people who can navigate them are few, and are posted out every couple of years.

Everything here is designed for a disconnected environment. If a capability needs an external service to work, it is not offered.

The Constraint That Comes First

AssumedNo outbound network

The system is built to run with no connection to anything outside the enclave. Not "can be configured offline". Offline is the design point.

▲ built on ▲

ConsequenceThe heavy work happens before deployment

Structuring, indexing and validation are done at build time. What is installed is data and deterministic code, so the running system needs no external call to answer a question.

▲ enables ▲

ResultYour hardware, your control

Runs on infrastructure the organisation owns. Models, where used at all, are ones that run locally. Nothing phones home, because there is nothing to phone.

This is the same architecture we use elsewhere, for a different reason. Doing the expensive work offline and shipping deterministic artefacts is how the government portals stay cheap to run. In a defence context, that same choice is the only reason it can be deployed at all.

Doctrine and Standing Orders, Made Answerable

Thousands of pages of doctrine, instructions, orders and amendments. The practical question is never "what does the manual say" but "which paragraph applies to this situation, in the current amendment state, and what does it require of me". We model instruments the way we model regulation: obligations, thresholds, conditions, authorities and amendment state, each anchored to its clause. Superseded material is marked superseded rather than deleted, so an officer can see both what applies now and what applied at the time of an incident under review.

Assessment With Provenance Intact

Assessment means combining reports of differing reliability. The failure mode is that confidence gets averaged into a single number and the reasoning becomes unrecoverable. So the ontology records two things separately and never merges them: how reliable the source has proven, and how solid this particular report looks. An assessment can then be unwound to what each source said, and to what that source has been worth in the past.

A reported observationis asserted bya source with its own reliability recordThe claim and the source's track record are stored separately. A confident claim from an unreliable source never quietly becomes a confident fact.

Two reportscorroborateeach other, or do notCorroboration is only recorded where the sources are genuinely independent. Two reports derived from the same origin are marked as one, not two.

An assessmentrests onan ordered chain of evidenceEvery conclusion can be unwound step by step to the reports beneath it, so a reviewer can see exactly where a judgement entered and who made it.

Independence is the rule doing the work here, exactly as it does in the verification work. Evidence that confirms a reading must come from a source independent of it, or a single origin ends up confirming itself through three channels.

Two Things That Must Never Be Averaged

	Report looks solid	Report looks doubtful	Report cannot be judged
Source has a good record	Act on it	Worth chasing	Hold
Source has a poor record	Corroborate first	Set aside	Set aside
Source is new	Corroborate first	Hold	Hold

Scroll the table sideways →

These are separate properties of separate things. How reliable a source has proven over time is a fact about the source. How solid a particular report looks is a fact about that report. Collapse them into one confidence score and the top-left and the middle-left cells become indistinguishable, which is precisely the distinction an analyst needs to keep.

Where Else It Applies

Area	The ontology problem underneath
Maintenance and fleet readiness	Platforms, subsystems, parts and their interchangeability, service life and inspection intervals, modelled so a readiness figure is derived from records rather than assembled by hand each week.
Logistics and stores	The same physical item catalogued differently by different formations. Alias resolution is what turns several local names into one item with one true stock position.
Procurement and qualification	Requirements written as conditions with the evidence that satisfies each, so trial outcomes and vendor claims can be checked against the specification rather than read against it.
Training and lessons	After-action material structured so a recurring failure is countable across years and formations instead of being rediscovered by each new commander.
Archives and history	Unit records, war diaries and photographic collections structured, described and preserved on the same basis as any other archive, at the classification the material requires.

What We Will Not Claim

We build knowledge infrastructure. We do not build targeting systems, we do not offer autonomous decision-making in the use of force, and we do not present a machine's output as an assessment. Every system described here surfaces what the record says, with provenance, so a responsible officer decides faster on better evidence. Where the record is silent, the correct output is that it is silent.