Space · FSV-3 · Defensive proximity-operations spacecraft
Shroud
Between a démarche and a war. A non-kinetic escort for high-value US assets. Five rungs, none of them producing a fragment, every one of them cryptographically signed before it executes.
Mission
The threat does not arrive fast. It arrives slowly, and it is legal.
SHROUD escorts a designated high-value US spacecraft and denies a hostile co-orbital the ability to approach it, image it, or occupy the space around it — without touching it, without producing debris, and without any action that cannot be published afterwards.
The threat is not a missile. It is another satellite that manoeuvres into the same longitude slot over a period of weeks, closes to fifty kilometres, then ten, then one, and sits there. It is legal under every treaty in force. It is deniable. It has already happened repeatedly, in public, in the geostationary belt and in low Earth orbit.
Against that, the United States currently has exactly two responses: complain, or destroy it. The first does nothing. The second is an act of war that also fills the orbit we were defending with fragments that will outlive everyone reading this — and it is closed to us anyway, since the 2022 renunciation of destructive direct-ascent testing. There are several hundred kilometres of policy space between those two options and nothing in it.
SHROUD occupies that space. An 890 kg vehicle with 375 m/s of chemical delta-v for responding right now and 7.45 km/s of electric for everything slower, a rendezvous sensor suite built around the assumption that the adversary approaches out of the sun or in eclipse, and a five-rung escalation ladder that is published on purpose — because a deterrent the other side has not read is not a deterrent.
Key figures
The escalation ladder
Five rungs. All non-kinetic, all reversible, all signed.
-
Presence
SHROUD flies a passively safe natural-motion circumnavigation around the protected asset — nominally a 15 × 30 km ellipse, stable for more than thirty days without control. It expends no propellant, carries no distinguishing signature, and deters by existing. Its own ephemeris is broadcast, signed, in the clear.
Authority: standing. Autonomous.
-
Disclosure
A closing object is detected. SHROUD transmits a standardised safety-of-flight advisory on an open channel: the conjunction geometry, the time of closest approach, its own signed ephemeris, and a request to acknowledge. Every state that has ever complained about unsafe close approaches is now publicly on the record with the data in front of it. In most cases the ladder stops here, and that is the intended outcome.
Authority: standing. Autonomous. Signed and published immediately.
-
Interposition
SHROUD manoeuvres to a station on the line between the closing object and the protected asset, inside the approach corridor. It is now the nearest object, so any further approach is an approach to SHROUD. Nothing has been done to the adversary. The geometry has simply been changed so that they must come through us first.
Authority: theater commander, pre-delegated inside a signed geofence. Autonomous execution within the envelope.
-
Optical denial
A shaped illuminator raises the background in the closing object's imaging sensor so it cannot resolve the protected asset. The delivered irradiance is capped by a hardware interlock at one thousandth of the solar constant — 1.36 W/m² — computed from the LIDAR-measured range. Any sensor that survives a glimpse of the sun survives this by a factor of a thousand. The effect is reversible, instrument-scoped, and ends when the transmission ends.
Authority: signed operator authorisation with a validity window. Commanded power, measured power, measured range and computed irradiance all signed at 10 Hz.
-
Physical shadowing
SHROUD deploys a nine-metre aluminised-Kapton occulting membrane — 32 g/m², 21 kg with its mechanism, 340 seconds to deploy — and station-keeps on the line of sight. It blocks the optical path with an object, not an emission. There is nothing to argue about: no energy is directed at anything, and the adversary is free to photograph the screen.
Authority: theater commander, two-person rule.
-
Slot denial
SHROUD occupies the relative-orbit volume the adversary intends to use, first, and holds it — flying a passively safe but volumetrically dominant relative orbit. The intended standoff point becomes unusable without accepting a conjunction risk by the adversary's own published safety standards. They abort, or they are on the record having chosen a collision risk they themselves created.
Authority: national. Two-person hardware-token release. Never autonomous.
Explicitly excluded, by design: kinetic intercept. Grappling or towing a third-party spacecraft. Radio-frequency jamming of a third party's uplink or downlink — a different legal regime and REQUIEM's problem, not SHROUD's. Any action that produces debris. Any action that is irreversible. SHROUD carries a cooperative capture ring qualified only for servicing US assets that carry the mating interface. It is not a grapple.
The load-bearing component
Why this category has stayed empty, and what changes it
A defensive proximity-operations spacecraft is not held up by engineering. Every subsystem above has flown in some form. It is held up by three problems that no amount of engineering solves.
Problem one — intent
For the first ninety-five per cent of the trajectory, an inspection, a rescue, a servicing mission and an attack are the same manoeuvre. Nothing observable distinguishes them. A US spacecraft that closes on a foreign national asset therefore cannot prove it was defending. It becomes the provocation it was built to answer.
Problem two — escalation
Space actions are invisible to publics and deniable by governments. Deniability is what makes co-orbital shadowing attractive, and it is also what makes it dangerous: neither side can climb down publicly, because neither side can establish publicly what happened. Crises escalate through ambiguity far more often than through malice.
Problem three — release authority
No combatant commander will be given autonomous manoeuvre authority near a foreign national asset when the record of what the spacecraft did is a briefing slide assembled after the fact by the organisation that owns the spacecraft. Programs die here. They do not die in the vacuum chamber.
One mechanism answers all three
The chain is append-only and the authorisation precedes the burn in it. Every state vector, every sensor frame hash, every commanded burn, every irradiance setpoint, every rules-of-engagement evaluation and every human authorisation is hash-chained and signed by the vehicle's hardware root of trust before the action executes. An after-the-fact justification is therefore provably after the fact. That is what solves problem three: a commander can be handed a signed authority envelope, because the record of whether the vehicle stayed inside it is not written by the vehicle's owner.
The chain is mirrored outside US custody. Rolling publication — proposed at seventy-two hours for rungs zero through two, immediate for anything above — to an archive held by an allied third party. This turns "trust the US Government" into "here is a tamper-evident record that a Norwegian or Japanese archive also holds and can attest to." That is what solves problem two.
Selective disclosure. Merkle proofs let us publish "SHROUD's commanded irradiance never exceeded 1.36 W/m² at the measured range" without publishing SHROUD's sensor performance, its ephemeris precision, or the identity of the protected asset. Without this the classification authorities kill the programme; with it the disclosure is narrow enough to survive review. That is what solves problem one. It is standard cryptography, not an invention, and that is exactly why it will survive contact with a certification authority.
The treaty argument
Outer Space Treaty Article IX obliges a state that believes an activity would cause potentially harmful interference to request consultation. That obligation has been functionally dead for sixty years, because consultation requires an agreed set of facts and there has never been one. A signed, third-party-mirrored, selectively disclosable record of a proximity action is the artifact Article IX consultation has always lacked. The 2021 Secretary of Defense tenets of responsible behaviour in space commit the United States to precisely this posture; LEDGER is the first mechanism that makes the commitment checkable rather than declaratory.
The norm argument, which is the strategically important one
If the United States fields a defensive spacecraft that publishes a cryptographic record of everything it does, an adversary has two options. Accept the record — in which case we have established that proximity operations are accountable, a regime that favours the side with more to protect and more credibility to spend. Or dispute it — in which case they must publish their own record, which is the norm we wanted. There is no third option that leaves them better off. That asymmetry is what makes this spacecraft fieldable, and the same spacecraft without the ledger is not.
The hard part, said out loud: LEDGER does not stop a state from lying about our record. It makes lying expensive, specific, and repeatedly falsifiable. That is the achievable goal. Anyone promising more is not being serious with you.
Specification
SHROUD parameters
| Class | Geostationary-resident defensive escort; MEO variant defined |
|---|---|
| Wet / dry mass | 890 kg / 470 kg |
| Propellant | 110 kg MMH/MON-3 chemical + 310 kg krypton electric |
| High-thrust Δv | 375 m/s — 2 × 22 N, Isp 290 s |
| Low-thrust Δv | 7,450 m/s — 2 × 600 W Hall, 39 mN each, Isp 1,500 s |
| Low-thrust acceleration | 8.8 × 10⁻⁵ m/s² — 100 m/s takes about 13 days |
| Power | 2.4 kW BOL / 2.0 kW EOL, 60 Ah Li-ion |
| Design life | 10 years propellant-limited, 12 years structural |
| Station | Natural-motion circumnavigation, nominal 15 × 30 km, passively safe >30 days uncontrolled |
| Acquisition telescope | 200 mm visible, 1.4° field — a 1 m² object at 10,000 km |
|---|---|
| Long-wave infrared | 8–12 µm, 640 × 512, cryocooled — a 1 m², 250 K object at 100 km. Eclipse and solar-approach detection: the telescope's blind spots are exactly this sensor's job. |
| Scanning LIDAR | 1,550 nm, 5 km → 5 m, ±2 cm at 100 m |
| Flash LIDAR | 1,550 nm, six-DOF pose of an uncooperative target under 200 m |
| RF direction finding | 2–18 GHz, emitter identification and bearing |
| Attitude | 3 star trackers, fibre-optic gyro IMU, sun sensors — 0.3 arcsec knowledge |
| Relative navigation | 5 cm position, 2 mm/s velocity at 1 km separation |
| Occulting screen | 9 m aluminised Kapton, 32 g/m², 21 kg with mechanism, 340 s deployment, one qualified retraction cycle |
|---|---|
| Optical denial illuminator | 120 mm aperture, 60 µrad divergence |
| Irradiance interlock | Hardware current limit at 1.36 W/m², set from the LIDAR-measured range. 0.385 W maximum at 10 km. Four to six orders of magnitude below sensor damage thresholds; three orders below direct sunlight. |
| Safety-of-flight beacon | Open, unencrypted broadcast of SHROUD's own signed ephemeris — deliberately transparent |
| Capture ring | Cooperative only, qualified for US assets carrying the mating interface |
| Comms | Ka to ground, optical crosslink to LANTERN and BEACON, open S-band advisory transmitter |
|---|---|
| Autonomy | REVENANT CORE with a formally specified rules-of-engagement engine |
| Rungs 0–2 | Autonomous inside a signed geofence |
| Rung 3 | Signed operator authorisation with a validity window |
| Rungs 4–5 | Two-person hardware-token release. Never autonomous. |
| Record | Every observation, burn, setpoint and authorisation hash-chained and signed before execution; mirrored to an allied third-party archive; selectively disclosable by Merkle proof |
Concept of operations
Seven phases around a satellite that must not be touched
- Station. SHROUD establishes a natural-motion circumnavigation of the protected asset, nominally 15 × 30 km, passively safe for more than thirty days without control. Electric propulsion trims; the chemical reserve is untouched.
- Watch. Continuous long-wave infrared and visible search of the approach hemisphere, cued by LANTERN-G custody alerts arriving over the optical mesh in seconds and never transiting the ground.
- Characterise. A closing object is imaged, its emitters identified, its trajectory projected. That projection either intersects the protected asset's control volume or it does not — and the determination, with the evidence behind it, is signed.
- Disclose. Rung one. The advisory goes out in the clear, immediately, and publishes. In most cases the sequence ends here.
- Interpose. Rung two, inside the signed geofence, autonomously, on the chemical system. 375 m/s buys many tens of interpositions at geostationary relative velocities.
- Escalate only on release. Rungs three through five require the corresponding signed authority resident on the vehicle. The rules-of-engagement engine will not execute a rung for which no valid, unexpired authorisation exists. Loss of comms does not grant authority; it removes it.
- Re-station and publish. Electric propulsion restores the circumnavigation over days. The chemical reserve can only be refilled by a CHARON servicing call. The full record publishes on its rolling schedule.
Engineering rationale
Why it is built this way
The propulsion split is the mission
Presence is a decade-long, low-urgency job that wants electric propulsion. Interposition is a minutes-to-hours job that wants chemical. Most spacecraft pick one. SHROUD carries both, deliberately: 375 m/s of "right now" and 7.45 km/s of "eventually."
The 7.45 km/s is what lets a single vehicle relocate across the belt to a new protected asset, or re-establish its station after an interposition, without ever touching the chemical reserve it exists to hold. The reserve is the product. Spending it on routine station-keeping would be like spending an interceptor's rocket motor on taxiing.
Long-wave infrared, because the adversary chooses the geometry
Anyone approaching a defended asset will approach out of the sun, or in eclipse, or both — because those are the two conditions in which a visible-band sensor is useless and everybody knows it. A cryocooled 8–12 µm imager sees the target's own thermal emission and does not care whether the sun is behind it. It is the most expensive sensor on the vehicle and it exists to close the one gap an intelligent opponent will certainly use.
The interlock is a circuit, not a software bound
The irradiance cap on the illuminator is a hardware current limit driven by the LIDAR range measurement. It is not a configuration value, a policy setting, or a line of code that a future release could relax. That distinction is the entire legal argument: "the software was configured correctly" is a claim about process, while "the current could not physically exceed this value at that measured range" is a claim about physics. Only the second one survives a hostile review, and only the second one is worth signing.
Program candor
Open engineering and policy risks
- A permanent escort is a permanent target, and it is cheaper to kill than what it protects. Our answer is attrition arithmetic rather than invulnerability: SHROUD costs about a tenth of the asset behind it, so an adversary who trades a co-orbital for a SHROUD has lost the exchange. That is a satisfying argument on a slide and a genuinely uncomfortable one in a war.
- Rung four telegraphs importance. Deploying a nine-metre screen tells the adversary they have found something worth screening. Some assets are better defended by never revealing that they are defended.
- The screen wrecks the disturbance budget. 63.6 m² of membrane at geostationary altitude generates about 5.2 × 10⁻⁴ N of solar radiation pressure — roughly 18 m/s per year of disturbance on an 890 kg vehicle. The electric system absorbs it, but station-keeping precision measurably degrades while the screen is out, and exactly one retraction cycle is qualified.
- The illuminator will be called a weapon regardless of the interlock. The engineering answer is correct and will not, by itself, win the argument. It only wins if the record is credible — which is why the ledger section above is a subsystem description, not marketing.
- The legal regime is unsettled, and we are proposing a norm rather than citing one. Article IX has no enforcement mechanism. Nothing described on this page is currently required of anyone, including us.
- Release authority near a foreign national asset is the hardest conversation in the US defence enterprise. We do not assume we win it. We assume it cannot even begin without a signed record, and that is the bet the programme makes.
- Five-metre-class relative navigation against an uncooperative, unmodelled, possibly tumbling target has been demonstrated a handful of times in history — almost always cooperatively or against a known object. This is the hardest engineering risk in the vehicle, and it is why the programme is at ground demonstration rather than in a clean room.
Related
What cues it, what sustains it, what signs it
Space protection programs
Tell us what you cannot afford to lose
The asset, the orbit, the approach you are worried about, and the release authority you can realistically obtain. We will map that onto the ladder and tell you which rungs you would actually be allowed to use.