SPEAR GLASS — Command & Control System Design
What GLASS is
GLASS (Global Layered Awareness & Shared Situation) is SPEAR's command-and-control system: every national contingent uploads its regional Common Operating Picture (COP), the regions fuse into one global COP, and every citizen on Earth can watch the same picture and the same chat that SPEAR's commanders see. A force that answers to the people cannot run on a system the people cannot see.
GLASS is built on three rules that no operator, commander, or nation can switch off:
One picture. There is no "classified COP" and "public COP". Commanders and citizens look at the same data, through the same servers, with the same delay.
Glass walls. Every upload, edit, deletion, message, and order is signed, timestamped, and written to a public append-only log. Nothing in GLASS can be quietly removed.
Units, never people. The COP tracks SPEAR units, hazards, events, and infrastructure. It never tracks or identifies individual persons, in keeping with the charter rule that NET may never surveil individuals.
The only exception to Rule 1 is the operational hold (section on civilian oversight): a time-boxed, logged blur on a unit's exact position while that unit is under fire. It expires on its own and is reviewed in public.
Federation model
Data flows upward only once: a contingent signs and uploads its COP, its Regional node merges it, the Global node fuses the regions, and the Public Deck, the command consoles, and the Oversight Assembly all read the result from the same feed. Every write at every level is also copied to the public audit log, which citizens can mirror.
The Common Operating Picture
The COP is a set of map layers, each a stream of signed objects in open formats, fused from every contingent and shown identically to every viewer.
| Layer | What it holds | Who writes it | Open standard |
|---|---|---|---|
| Units | SPEAR units by branch (Knights Templar, COBRA, Mercy, Forge, NET), status, readiness | Contingent operators | Cursor-on-Target (CoT) over TAK |
| Events | Incidents, attacks on civilians, disasters, outbreaks, requests for help | Operators, verified public reports | CoT + GeoJSON |
| Hazards | Fires, floods, radiation, contamination, unexploded ordnance, blocked routes | Operators, sensor feeds, Forge | GeoJSON / OGC |
| Infrastructure | Hospitals, shelters, airfields, ports, water, power, SPEAR bases | Forge, Mercy | GeoJSON / OGC |
| Sensors | Satellite passes, weather, seismic, radiation, AIS/ADS-B tracks of SPEAR assets | NET, automated feeds | OGC SensorThings, STAC |
| Orders | Standing orders, active missions, rules of engagement in force | Branch commanders | Signed JSON documents |
| Oversight | Flags, halts, questions, and audit findings from the Oversight Assembly | Oversight Assembly | Signed JSON documents |
What is never on the map. No named individuals, no faces, no phone or vehicle identifiers, no biometric data, no tracking of non-SPEAR persons. Public reports are geolocated to a hex cell, not a street address, before they enter the COP.
How a regional COP becomes the global COP. Each contingent node publishes its layers to its Regional node. The Regional node merges contingents and publishes to Global. Merging never rewrites: every object keeps its origin signature, so a viewer can click any unit or event and see which contingent reported it and when. Conflicting reports are shown side by side, not resolved by a central authority.
Upload paths. A contingent can feed its COP three ways: a live TAK server bridge (ATAK/WinTAK compatible), a REST/MQTT API for its own sensors and software, or a manual web console for low-tech contingents. All three produce the same signed objects.
100% civilian oversight
Oversight in GLASS is not a report delivered afterward; it is live, structural, and open to every person on Earth at three levels.
Level 1: the Public Deck. Anyone with a browser or the mobile app sees the full global and regional COP and every chat channel, live, with no login. No account is needed to watch. The Public Deck is served from the same data as the command consoles, so what the public sees is what commanders see.
Level 2: Citizen Observers. Any adult may register (one identity per person, verified through their national contingent's civilian registry, never through a government) to post in the public channels, file reports into the Events layer, and raise a flag on any unit, order, or event. A flag is a public marker that says "explain this"; the responsible commander must answer it in public chat within 24 hours.
Level 3: the Oversight Assembly. A standing body of citizens chosen by lottery (sortition) from the whole population of the people SPEAR serves, in proportion to population, serving staggered 18-month terms with no re-selection. The Assembly has every permission a commander has to see, question, and record, and one power no commander has: the halt. A halt is a signed public order that freezes a named mission; it stands until a public majority vote of the Assembly lifts it, and the Planetary Command Council must respond in public within 6 hours.
The operational hold. The one allowed exception to the one-picture rule:
| Rule | Limit |
|---|---|
| What it hides | Only the exact position of a unit, blurred to a 10 km cell. Its existence, status, mission, and chat stay visible. |
| Who can place it | The unit's branch commander, by signed order, with a stated reason |
| How long it lasts | 72 hours maximum, then auto-expires. Renewal requires a public Assembly vote. |
| Who sees it | Everyone. The hold itself is on the map as a visible marker; the Assembly sees the true position throughout. |
| Where it is logged | The public audit log, at placement, renewal, and expiry |
A hold cannot be placed on Mercy or Forge units, which are unarmed and never in combat roles, and cannot be placed on any order or rules-of-engagement document.
What oversight can never be reduced to. No tier of GLASS may be made private by a nation, a commander, or the Council. The code that enforces these rules is public and reproducibly built, so any citizen can verify that the deployed system is the published one.
Chat
All SPEAR chat is public to read. Channels differ only in who may post, and every channel is anchored to the map: a message can carry a pin, a unit, or an event, and clicking it jumps the COP there.
| Channel | Scope | Who posts | Who reads |
|---|---|---|---|
| GLOBAL | Planet-wide command net; Council decisions, cross-region tasking | Planetary Command Council, branch commanders, regional commanders, Oversight Assembly | Everyone |
| REGION-xx | One per region (e.g. REGION-AF-E, REGION-SA-N); regional ops | Regional commanders, contingent operators, Assembly | Everyone |
| CONTINGENT-xxx | One per national contingent; internal coordination | That contingent's personnel | Everyone |
| BRANCH-xxx | Knights Templar, COBRA, Mercy, Forge, NET; doctrine and specialist traffic | That branch's personnel | Everyone |
| MISSION-nnnn | Opened per mission, closed and archived when it ends | Assigned units, their commanders, Assembly | Everyone |
| OVERSIGHT | Flags, halts, and commander answers | Assembly, Citizen Observers (flags), commanders (answers) | Everyone |
| PUBLIC-GLOBAL and PUBLIC-REGION-xx | Open floor for citizens; reports and questions | Any Citizen Observer | Everyone |
Rules that hold in every channel.
Messages are signed by the poster's identity and cannot be edited or deleted; a correction is a new message that references the old one.
Moderation is limited to hiding spam and illegal content behind a "hidden" marker; the original stays in the audit log and any Assembly member can unhide it.
Automatic translation runs on every message so a Regional net in one language is readable by all.
Tactical voice (radio) is bridged into MISSION channels as recorded, transcribed audio with a maximum 5-minute delay.
There is no private direct messaging inside GLASS. Personal matters go through personnel systems outside C2, which hold no operational data.
Roles and permissions
Every role can see everything. Roles differ only in what they may write, and every write is public.
| Role | How it is granted | May write |
|---|---|---|
| Viewer | Nobody; no account | Nothing |
| Citizen Observer | Self-registration, one per verified adult | PUBLIC channels, Event reports, flags |
| Oversight Assembly | Lottery from the population, 18-month staggered terms | Flags, halts, halt votes, audit findings, any channel |
| Operator | Contingent personnel, assigned by their contingent | Unit, Event, Hazard, Infrastructure, Sensor layers for their contingent; CONTINGENT, BRANCH, MISSION channels |
| Branch commander | Appointed under the charter | Orders and rules of engagement for their branch; operational holds; GLOBAL, REGION, BRANCH channels |
| Regional commander | Appointed under the charter | Regional tasking; opens MISSION channels; REGION and GLOBAL channels |
| Planetary Command Council | The five branch commanders under the charter | Council decisions; responses to halts; GLOBAL channel |
| Auditor | Rotating teams drawn from at least five nations | Audit findings against any layer or channel |
| Node administrator | Contingent NET personnel | Node configuration only; no ability to write or hide COP data |
Two permissions exist nowhere: delete and make private. They are absent from the code, not merely withheld from users.
Trust, identity, and safeguards against capture
GLASS assumes that some nation, faction, or officer will one day try to blind it, flood it, or seize it. The design makes each of those attempts visible and reversible.
Identity. Every operator, commander, and Assembly member holds a hardware key issued by SPEAR's own certificate authority, never by a national government. The CA's root is split across the five branches and the Oversight Assembly with a 4-of-6 threshold, so no branch or nation can mint or revoke identities alone. Citizen Observers hold lighter keys issued through contingent civilian registries.
The audit log. Every object and message is hashed into an append-only, publicly mirrored log. Any citizen can run a mirror; mirrors cross-check each other, and a divergence between the official log and the mirrors is itself a public alarm on the OVERSIGHT channel.
Against blinding. A contingent that stops uploading is shown on the COP as a grey region with the time of its last update; silence is visible. A contingent that uploads less than its sensor feed should produce (compared against the raw-feed access the charter requires) is flagged automatically for audit.
Against flooding. Operator writes are rate-limited per identity; public reports are weighted by the reporter's history and corroboration, and shown in a separate "unverified" style until an operator or two independent reporters confirm them.
Against seizure. No single node is authoritative. If the Global node is cut off or compromised, any three Regional nodes can elect a new Global fuse point, and the public mirrors continue to serve the last agreed state. No node has a kill switch; a node that goes rogue is simply distrusted by the others and its signature marked.
Against quiet changes to the system itself. GLASS source code is public under an open licence. Every deployed build is reproducible, and its hash is posted to the audit log, so the running software can be verified against the published source by anyone.
Resilience: degraded, denied, and offline operation
GLASS must keep working where SPEAR deploys: under jamming, after infrastructure collapse, and with no internet at all.
| Condition | What keeps working | How |
|---|---|---|
| Normal connectivity | Everything | Internet, SPEAR satellite links, and contingent networks in parallel |
| Internet cut, satellite up | Full COP and chat, slower | Regional nodes carry SPEAR's own satellite constellation share (Article I, space category) |
| Local comms only | Regional COP and chat; global view is stale with a visible age stamp | Field mesh radios and TAK servers sync peer-to-peer; outbound queue drains when a link returns |
| Fully offline unit | Its own position, team, and mission data | Devices store-and-forward; every object is timestamped so late uploads merge correctly, never overwrite |
| Global node lost | Everything, with a new Global elected | Three Regional nodes elect a replacement; public mirrors keep serving |
Public access degrades the same way as command access, never faster: if commanders can see it, the Public Deck can too.
Reference technology stack
Every component is open source and already used in the field, so no nation owns the system and any contingent can audit it. Names below are the reference choice; the standards are what matter.
| Function | Reference choice | Why |
|---|---|---|
| Tactical data and field devices | TAK ecosystem (ATAK, WinTAK, open TAK Server) with Cursor-on-Target | Already fielded by militaries and disaster responders worldwide; open spec |
| Map rendering (web and mobile) | MapLibre GL with OpenStreetMap and SPEAR-hosted tiles | No vendor key, works offline with cached tiles |
| Geospatial services | GeoServer, PostGIS, STAC catalog for imagery | OGC standards; any GIS can read them |
| Message bus between nodes | NATS JetStream (MQTT bridge for sensors) | Lightweight, works over poor links, built-in store-and-forward |
| Chat | Matrix protocol, Synapse or Conduit homeservers, one per Regional node | Federated by design, public rooms, every message signed, open clients on every platform |
| Identity | Self-run certificate authority with FIDO2 hardware keys; threshold signing via open MPC libraries | No dependence on any national PKI |
| Audit log | Append-only transparency log (Trillian or Sigstore Rekor model), publicly mirrored | Proven design from certificate transparency |
| Public Deck | Static web app plus the same WebSocket feed the consoles use | Nothing to log in to; cacheable at the edge |
| Translation | Open machine-translation models hosted on Regional nodes | No message leaves SPEAR infrastructure for translation |
| Builds | Reproducible builds, hashes posted to the audit log | Citizens can verify the running code |
A Regional node is a single rack that runs all of the above and can be shipped in a container; a Contingent node is a ruggedised server or a laptop running a subset.
Build phases
Prototype (months 0–3). One Contingent node, one Regional node, the Public Deck, and GLOBAL plus one REGION chat. Demonstrate upload, fuse, public view, flag, and halt end to end with simulated units.
Pilot (months 3–9). Three contingents in one region, real sensor feeds, the audit log with public mirrors, Citizen Observer registration, and the first lottery-selected Assembly panel for the pilot region.
Regional rollout (months 9–24). One Regional node per region, mesh and satellite paths, operational hold logic, translation, voice bridge. Independent security audit published in full.
Global (months 24–36). Global fuse node with Regional election failover, full Assembly seated, reproducible-build verification open to the public.
Continuous. Quarterly public red-team exercises in which an outside team tries to blind, flood, or seize GLASS; results and fixes are posted to the OVERSIGHT channel.
Open questions to settle before the prototype:
Region boundaries: how many Regional nodes, and drawn by geography or by population?
Assembly size and lottery mechanism: who runs the draw, and how is the roll of eligible citizens built without a government list?
Hex cell size for public reports (1 km vs 10 km) and the operational-hold blur radius
Whether COBRA mission channels need a shorter voice-bridge delay or a longer one