Skymesh demo — operator runbook

Sibling to MARS_DELAY_TOLERANT_TELEPORT.md. Where that doc teleports a cache key across a one-way light-time gap so a remote station replays cached compute, this one removes the link entirely: two air-gapped stations that never talk produce the same answer from a signal neither of them sent.

This is an operator runbook. The code is being built concurrently by other agents; this document references their modules by name and tells you how to run the demo once they land. Honest status is called out throughout (PROVEN / BUILT / NEEDED), matching the convention in R1_MESH_PROTOCOL69.md.

1. The pitch + the honest framing

The pitch

Two air-gapped stations. Each is an RTL-SDR receiver attached to a Rabbit R1 Android mesh node. There is no network between them — no WiFi, no cable, no Bluetooth, no shared clock beyond the sky. Both tune to the same always-on ambient RF broadcast. Each independently derives the same witness from the live signal. Each admits protocol69 (66 XOR 7 = 69) and serves the same geodesicLength:0 cached answer in lockstep. Nobody transmits — RTL-SDRs are receive-only.

The jaw-drop: two machines that never communicated produce the identical answer, driven by a signal neither of them originated.

The honest core (lead with this — non-negotiable)

We are not breaking the speed of light, and we never claim to. State this out loud at the start of the demo.

• The answer was computed once and cached. A tiny shared witness — a feature both stations independently hear from the sky — teleports which cached answer to serve.
• A cache HIT is required for the lockstep effect. A novel question is a MISS: it has no cached answer, so it would have to round-trip, and there is no link to round-trip over. The MISS beat (section 4f) demonstrates this honestly.

What is real in the demo:

• The RF reception on both stations (live ambient signal, no transmitter in the loop).
• The witness agreement (both derive the same value with zero data exchanged).
• The protocol69 fail-closed admission (66 XOR 7 = 69; a wrong witness is denied).
• The geodesicLength:0 cache replay (frozen amplituhedron volume, served locally).

What is precomputed:

• The cached answer itself. The witness selects it; it does not synthesize it.

The deep-space parallel is exact and not a metaphor: in real Mars / deep-space topology you listen, you do not pay the round trip. Receive-only is the regime, not a limitation we are working around.

2. Hardware setup + RF environment

What we have

• 2x RTL-SDR dongles (receive-only). No transmitter is used anywhere in this demo.
• 1 good antenna plus stock whip antennas.
• R1 Android devices running mesh nodes (one station per device).

Antenna placement

• Put the good antenna on the weaker-signal station (the one with the marginal copy of the witness). Equalizing the link budget is what makes the two witnesses lock reliably; the strong-signal station can run a stock whip.
• The other station(s) use stock whips.
• Keep the two stations physically separated enough that the air gap is obviously real to an audience, but both within copy range of the chosen broadcast.

Two dongles, two processes

The two RTL-SDRs must be claimed by separate processes / devices. On a single host they are addressed by device index:

• Station A: device index 0
• Station B: device index 1

On the R1 deployment each dongle is on its own device, so each is index 0 locally. Confirm enumeration before the run:

rtl_test -d 0    # station A dongle
rtl_test -d 1    # station B dongle

Choosing the ambient witness

The witness must be a stable, deterministically-decodable feature that both receivers independently agree on. It is the one thing both stations "hear from the same sky." Pick one of:

The witness is the shared input both stations hear; it is not the answer. Whatever stable feature you choose (RDS PI code, ISM device id, APT sync/telemetry feature), it must reduce to the same deterministic value on both stations independently.

3. Software pieces (reference — do not implement)

These modules are being built concurrently. Reference them by name; do not edit them.

Supporting (already in tree, referenced by the above):

• rtlsdr-mock-sim/rtl433.ts — parseRtl433JsonLine / loadRtl433Jsonl for the ISM witness path.
• distributed-inference/src/protocol69.rs, src/amplituhedron.rs, src/amplituhedron_wire.rs — the proven 66 XOR 7 = 69 arithmetic and the capture/replay of the frozen volume.

The web app is a future follow-up. aeon-monitor --skymesh is the demo surface now.

4. The staging script (the live run)

Run order matters — each beat sets up the next. Build aeon-monitor first if needed (pnpm run aeon-monitor:build from open-source/gnosis), and have gnosis-foil-control reachable from both stations' admission step (each station validates locally; the foil gate is not a network link between stations — it is the protocol69 admission logic each station runs against its own witness).

All commands below assume the single-host two-dongle layout (device index 0 / 1). For the R1 deployment, run station A's commands on R1 #1 and station B's on R1 #2; each dongle is index 0 on its own device. See section 6.

(a) PROVE the air gap

Make the absence of a link undeniable to the audience.

# Disable WiFi / unplug Ethernet on both stations, then prove no route exists:
ping -c 3 <station-B-ip>      # from station A — MUST fail (no route / 100% loss)
ping -c 3 <station-A-ip>      # from station B — MUST fail

The expected, demo-correct result is failure. Leave the failing ping on screen. If a ping succeeds, the air gap is not real — stop and fix it before continuing.

(b) Both RTL-SDRs tune the same ambient broadcast

Capture raw IQ from each dongle at the chosen witness frequency. Examples use FM-RDS at 98.5 MHz; substitute 433.92 MHz (ISM) or ~137 MHz (NOAA) per section 2.

# Station A (device 0): capture ~10 s of IQ at the witness frequency
rtl_sdr -d 0 -f 98500000 -s 2048000 -n 20480000 /tmp/skymesh-A.u8

# Station B (device 1): SAME frequency, independent dongle, independent file
rtl_sdr -d 1 -f 98500000 -s 2048000 -n 20480000 /tmp/skymesh-B.u8

Both stations are now holding independent captures of the same broadcast. No bytes moved between them.

(c) Witness LOCKS on both (same value, no data exchanged)

skymesh-run.mts extracts the witness from each capture via skymesh-witness.ts and asserts they match. Each station derives its witness in isolation.

# from open-source/gnosis
node_modules/.bin/tsx rtlsdr-mock-sim/skymesh-run.mts \
  --station-a-iq /tmp/skymesh-A.u8 \
  --station-b-iq /tmp/skymesh-B.u8 \
  --witness fm-rds \
  --center-hz 98500000 --iq-rate 2048000 \
  --foil-url http://127.0.0.1:8787/.aeon/protocol69 \
  --cert-out .qa-artifacts/rtlsdr/skymesh-certificate.json

Expected: the orchestrator prints the witness value derived independently for A and for B and confirms witnessMatch: true. The witness is the shared sky-derived value; it is not transferred between stations — each computed it from its own dongle.

For the ISM witness path, use --witness ism433 and --center-hz 433920000; for NOAA, --witness noaa-apt and --center-hz 137100000 (time to the pass).

(d) The teleported answer appears on BOTH panes in lockstep

Launch the monitor in skymesh mode. It renders both stations side by side and lights the match indicator when both serve the identical geodesicLength:0 answer.

# from open-source/gnosis/distributed-inference (after pnpm run aeon-monitor:build)
./target/release/aeon-monitor --skymesh

Each station admits its witness via protocol69 (66 XOR 7 = 69), and distributed_inference::teleport replays the frozen volume locally on each. Expected: both panes show the same answer, geodesicLength: 0, and the match indicator lights under the "NO LINK BETWEEN THESE STATIONS" banner. This is the headline beat.

(e) TAMPER beat — wrong witness is DENIED (fail-closed)

Feed station B a wrong witness and show admission refuses it; no answer is served.

node_modules/.bin/tsx rtlsdr-mock-sim/skymesh-run.mts \
  --station-a-iq /tmp/skymesh-A.u8 \
  --station-b-iq /tmp/skymesh-B.u8 \
  --witness fm-rds --center-hz 98500000 --iq-rate 2048000 \
  --tamper-station-b \
  --foil-url http://127.0.0.1:8787/.aeon/protocol69

Expected: station B's projection no longer validates (66 XOR 7 != 69), the foil gate denies admission, and station B's pane serves no answer. The match indicator stays dark. This proves the gate is fail-closed: a station cannot be tricked into serving by a forged witness.

(f) MISS beat — a novel/absent witness does not teleport

Ask for something that was never cached (or feed a witness that maps to no frozen volume).

node_modules/.bin/tsx rtlsdr-mock-sim/skymesh-run.mts \
  --station-a-iq /tmp/skymesh-A.u8 \
  --station-b-iq /tmp/skymesh-B.u8 \
  --witness fm-rds --center-hz 98500000 --iq-rate 2048000 \
  --novel-question \
  --foil-url http://127.0.0.1:8787/.aeon/protocol69

Expected: the witness may admit, but there is no cached answer for it → cachedReplay: false, no teleport. Narrate this honestly: a MISS is exactly the case that would need a round-trip, and there is no link to round-trip over. This is the limit, stated plainly — it is what makes the HIT case credible.

Certificate

Every non-rehearsal run writes a gnosis.skymesh.v1 certificate to --cert-out recording: the witness source + value (per station), witnessMatch, the protocol69 projection (66 XOR 7 = 69), geodesicLength, cachedReplay, and the admitted/denied/miss verdict for each station. Keep it as run evidence.

5. Rehearsal (zero hardware)

Dry-run the entire demo with no dongles, no R1s, no RF before the venue:

# from open-source/gnosis — synthetic captures, simulated witness lock
node_modules/.bin/tsx rtlsdr-mock-sim/skymesh-run.mts --rehearse \
  --cert-out .qa-artifacts/rtlsdr/skymesh-rehearsal.json

# from open-source/gnosis/distributed-inference — drives the two panes off canned frames
./target/release/aeon-monitor --skymesh --demo

--rehearse runs the orchestrator's logic against synthetic captures so the witness lock, the protocol69 admission, the HIT/lockstep, and the TAMPER/MISS beats all exercise without hardware. --demo drives the monitor panes off canned frames. Rehearse the full beat sequence (a → f) this way; only the live RF and the physical air gap differ on the day.

6. R1 deployment notes

Goal: each station is an RTL-SDR over USB-OTG on an R1 Android device, running a station process and a mesh node on the R1. This rides the existing R1 mesh path documented in R1_RESILIENT_MESH.md.

Honest status

What is proven vs aspirational here

• Proven: the mesh node on the R1, the protocol69 admission gate, and the geodesicLength:0 replay. The compute half of a station runs on the R1 today.
• Aspirational / unverified: the RTL-SDR receive path on the R1 itself over USB-OTG. Until dmesg | grep rtl / /dev/bus/usb confirm the dongle enumerates under the R1's kernel + SELinux policy (see R1_MESH_PROTOCOL69.md §4 step 5), do the RF capture on a host with the dongle and feed the IQ/witness to the R1 station process. This is a bridge-host fallback, exactly as the RF-to-gossip bridge is for the mesh: it keeps the demo runnable while the on-device USB path is being qualified.

For the demo today, the safe configuration is: capture + witness on a host per station, admission + replay + mesh node on the R1. The fully-on-R1 station is the target once USB-OTG RTL-SDR is confirmed.

7. Failure modes + FCC / safety note

Failure modes

FCC / safety note — receive-only is a feature

Nothing transmits. RTL-SDRs are receivers; there is no transmitter anywhere in this demo. That means:

• No transmit license is required to run Skymesh. Receiving ambient broadcasts you are already bathed in (FM, ISM, NOAA satellites) needs no FCC authorization.
• This is not a workaround — it is the same topology as real deep-space / Mars operation: you listen, you do not pay the round trip. Receive-only is the regime the demo is about, and it happens to also be the regime with zero licensing burden.

Contrast with the Mars teleport demo's Pluto TX leg (a 66 kHz tone), which does sit under transmit rules. Skymesh has no such leg by design.