Global Privacy Control detected. We have honored it as your request to opt out of the sale and sharing of your personal information and of targeted advertising.Signal Global Privacy Control détecté. Nous l'avons respecté comme une demande d'opposition à la vente et à la communication de vos renseignements personnels ainsi qu'à la publicité ciblée.
سياسة ملفات تعريف الارتباطPolitique relative aux témoins سياسة الخصوصيةPolitique de confidentialité Do Not Sell or Share My Personal InformationNe pas vendre ni communiquer mes renseignements personnels
أرسل متصفحك إشارة التحكم العالمي بالخصوصية. نعاملها كرفض للأغراض المبيّنة أدناه، وتبقى مفاتيحها متوقفة.Votre navigateur a envoyé un signal Global Privacy Control. Nous le traitons comme un refus pour les finalités indiquées ci-dessous, et ces interrupteurs restent désactivés.
Needed for the site to work, to keep you signed in, to protect it from attacks and to remember your privacy choices and the settings you pick. Always on.Nécessaires au fonctionnement du site, pour vous garder connecté, le protéger contre les attaques et retenir vos choix de confidentialité et les réglages que vous choisissez. Toujours actifs.
Remember optional settings beyond the ones you pick yourself. Off until you allow it.Retenir des réglages facultatifs autres que ceux que vous choisissez vous-même. Désactivés tant que vous ne les autorisez pas.
Count visits and see how pages are used, so we can improve the site. Off until you allow it.Compter les visites et voir comment les pages sont utilisées, afin d'améliorer le site. Désactivés tant que vous ne les autorisez pas.
Show videos, maps and live data layers from other providers. They receive your IP address and may set their own cookies. Off until you allow it, or load a single item once.Afficher des vidéos, des cartes et des couches de données en direct d'autres fournisseurs. Ceux-ci reçoivent votre adresse IP et peuvent déposer leurs propres témoins. Désactivés tant que vous ne les autorisez pas, ou chargez un seul élément une fois.
Measure campaigns and personalise advertising. We use none today. Off until you allow it, and refused when your browser sends Global Privacy Control.Mesurer les campagnes et personnaliser la publicité. Nous n'en utilisons aucun actuellement. Désactivés tant que vous ne les autorisez pas, et refusés lorsque votre navigateur transmet le signal Global Privacy Control.
Nexus Observatory Inc. keeps a record of each choice as proof: a random consent ID, the time, your region and the rules applied, the choices, the notice shown, the page, a shortened IP address, a one-way code of your browser type and, if you are signed in, your account. Records are kept while your choice applies and for 3 years after, then deleted.Nexus Observatory Inc. conserve un registre de chaque choix à titre de preuve : un identifiant de consentement aléatoire, l'heure, votre région et les règles appliquées, les choix, l'avis affiché, la page, une adresse IP abrégée, un code à sens unique du type de navigateur et, si vous êtes connecté, votre compte. Les registres sont conservés tant que votre choix s'applique et pendant 3 ans par la suite, puis supprimés.
Untick to choose for this site only. You can change either at any time in Privacy choices.Décochez pour choisir pour ce site seulement. Vous pouvez modifier l’un ou l’autre à tout moment dans Vos choix de confidentialité.
UNENROLLED
DISCOVERED
ATTESTING
IDENTITY_ISSUED
POLICY_BOUND
PLAN_STAGED
LOCAL_READY
DEGRADED
QUARANTINED
REVOKED
Plan v2 · signed, immutable
Instrument · observing
Site · journal, lease
Fleet controller
10 km
20 km
30 km
40 km
Mast
Building the scene…
Software · Explainer
A node agent that enrols, attests and updates every node. A fleet view that shows each node with its state, its plan and its evidence. Signed plans that roll out in waves and roll back on their own. A journal that keeps observing when the link drops.
01 · Enrolment
A node boots with nothing but its hardware. It is discovered, attests with measured boot evidence, receives an identity, binds a signed policy and stages a plan before it may run anything. Pick an outcome and run it; each move shows the guard that allowed it.
Outcome
Run
02 · Fleet
The fleet view is a projection built from evidence, not from labels nodes report about themselves. Filter by state and watch nodes move as plans land and links come and go.
Show
03 · Signed plans
A release is built from controlled source with an SBOM and provenance, signed, compiled into an immutable plan and rolled out in waves inside a blast-radius limit. Every node verifies the plan, applies it, checks health and keeps its last known-good state.
04 · Store and forward
When the central path is lost, the site keeps operating inside its authority lease, journaling events with their identities unchanged. On reconnect it sends a replay batch; dispositions come back per event and conflicts stay explicit.
05 · the NXS Observatory app
the NXS Observatory app models a site as a team: where the mast goes, what it can reach, which instruments fall inside the radio horizon. Over a smooth Earth with standard refraction the horizon is d = 3.57 (√(k·h₁) + √(k·h₂)) km, k = 4/3; over real terrain, line of sight decides.
06 · Integrations
The runtime speaks the standards the observing world already uses, so SCADA, GIS and data platforms connect by contract, not by custom glue. Pick a standard to see the role the protocol gives it.
A node agent that enrols, attests and updates every node. A fleet view that shows each node with its state, its plan and its evidence. Signed plans that roll out in waves and roll back on their own. A journal that keeps observing when the link drops.
A node boots with nothing but its hardware. It is discovered, attests with measured boot evidence, receives an identity, binds a signed policy and stages a plan before it may run anything. Pick an outcome and run it; each move shows the guard that allowed it.
The fleet view is a projection built from evidence, not from labels nodes report about themselves. Filter by state and watch nodes move as plans land and links come and go.
A release is built from controlled source with an SBOM and provenance, signed, compiled into an immutable plan and rolled out in waves inside a blast-radius limit. Every node verifies the plan, applies it, checks health and keeps its last known-good state.
When the central path is lost, the site keeps operating inside its authority lease, journaling events with their identities unchanged. On reconnect it sends a replay batch; dispositions come back per event and conflicts stay explicit.
the NXS Observatory app models a site as a team: where the mast goes, what it can reach, which instruments fall inside the radio horizon. Over a smooth Earth with standard refraction the horizon is d = 3.57 (√(k·h₁) + √(k·h₂)) km, k = 4/3; over real terrain, line of sight decides.
The runtime speaks the standards the observing world already uses, so SCADA, GIS and data platforms connect by contract, not by custom glue. Pick a standard to see the role the protocol gives it.
The smallest unit is one node running one agent. A site is a few nodes sharing a journal and a clock; a cluster is several sites behind one controller; a region is clusters on a shared backbone; the global network is regions federated by contract. Each level reuses the same enrolment, plans and evidence, so growth adds copies of a known block rather than new kinds of system.
Sources Verma et al., “Large-scale cluster management at Google with Borg”, EuroSys 2015
Each agent emits metrics, logs and traces in the vendor-neutral OpenTelemetry format, tagged with the node’s identity and the plan it runs. A collector at the site batches and filters them before they cross the link, and the fleet keeps what operators actually query. Because the format is open, the same signals feed the console and any monitoring system a customer already runs.
Sources OpenTelemetry specification; OpenTelemetry Collector
A release comes from a scripted, hosted build that records what went in and how. Its provenance and a software bill of materials travel with the artefact, bound to it by the signature, and a node refuses anything that does not verify. The practice follows the secure software development framework and the SLSA levels for build integrity.
Sources NIST SP 800-218, Secure Software Development Framework, version 1.1; SLSA specification, version 1.0
At fleet scale the console works by exception. Service level objectives define what healthy means; an error budget decides whether a rollout may continue or must pause; routine work that grows with the fleet is automated rather than staffed. A fault opens one work order with its evidence attached, so the technician arrives knowing which part and which plan were involved.
Sources Beyer, Jones, Petoff and Murphy (eds.), Site Reliability Engineering, O’Reilly, 2016, “Service Level Objectives”; Beyer, Jones, Petoff and Murphy (eds.), Site Reliability Engineering, O’Reilly, 2016, “Eliminating Toil”
A node’s software life has five moves: it enrols, runs its plan, takes signed updates, recovers to its last known-good state after a fault and is finally retired, its identity revoked and its keys destroyed. Platform firmware resiliency guidance describes the same arc underneath: protect the image, detect corruption and recover, so a bad update never becomes a permanent outage.
Sources NIST SP 800-193, Platform Firmware Resiliency Guidelines
Can we leave and take our data? Records stay in open formats behind typed contracts, so they export without translation. What happens offline? The site keeps observing inside its lease. Who can change a node? Only a signed plan within policy. What will an auditor see? Signed receipts per node and per release. Supply chain risk guidance frames these as questions every acquirer should ask.