Engineering directions in design or early build — published because the people who care about these problems should help shape them, and because “what’s next?” deserves a better answer than a vague slide. Nothing on this page is a product capability; the badges are the contract.
Mesh-capable radios are expensive, and relay nodes in a chain classically need two of them — because of the hidden-node problem, not bandwidth. The research direction: since Atlas already owns every byte its underlay transmits, it can gate its own send loop to a GPS-disciplined slot schedule — moving the MAC intelligence from the radio into software, so one cheap half-duplex radio per node serves the whole neighbourhood. Atlas does not provide a radio MAC today; this is design work, animated below.
The elevation-model line-of-sight / Fresnel / diffraction crate is built and unit-tested, and already drives the mission simulator. The remaining work is wiring its risk output into live scheduling and SPF alongside range and signal risk, on one shared cost model. the demo ↗
Terrain risk reads elevation tiles; the same geometry admits a second layer: declared zones where the spectrum is known to be contested — an overlay from mission planning with a polygon, a band list and a validity window. A link whose endpoints or projected tracks cross an active zone on its own band takes a rising zone risk in the shared risk model — the 5.8 GHz leg into the zone inherits the threat, the 900 MHz leg to the same airframe doesn’t — so redundancy can escalate before the first contested probe is lost. The same primitive covers EMCON: a “don’t radiate here” area is a zone whose cost is policy rather than threat. Learned zones come later, and only corroborated — the fleet already floods position, velocity and per-link RF telemetry, so where the spectrum has actually been hostile is observable, but confounders and poisoning make declared-first the honest sequence. Advisory like all prediction: zones raise costs, probes decide truth.
With positions and velocities already in the routing flood, the network can compute where a mobile relay should be: “the ground station and the forward pair lose line-of-sight behind the ridge in ~40 seconds — a relay at X prevents it.” Advisory output to the C2 system, published like any other telemetry — never an automatic flight command.
Adapters carry radio telemetry upward; the same boundary can carry intent downward. Atlas holds the only cross-vendor view of the topology and the mission’s current traffic, so it can tell a radio segment what “good” means right now — optimise for latency while the command corridor runs through you; for energy when only patient traffic remains. Objectives, never knobs: the radio always owns its own physics; intent is advisory, slow, authenticated and audited — the same principle the shipped prediction layer follows.
A forwarding = "bonding-only" link attribute: fully in the bond between its two endpoints, structurally never a transit hop — making the recommended 802.11s-under-Atlas layout impossible to get wrong. Small surface, no wire break; the LSA carries a no-transit flag and the relay path refuses, with a counter.
One stream, many watchers: source-rooted SPF trees from the LSDB, subscriptions in the same flood that carries positions, copies forked only where subscriber paths diverge. Proposed on this page 2026-08-14; shipped 2026-08-15 — which is what this page is for. Mechanics, measured numbers and the two-line config now live with the mesh. /mesh#multicast ↗
Names from the flood: every node already advertises its node_name and prefixes, so the LSDB is a name database and DNS becomes a per-node presentation layer — a local resolver on each node’s tunnel address, no DNS server anywhere in the mesh. Ships opt-in and default off, with split and mesh-only (EMCON) modes, split-horizon overrides and per-suffix forwarding. Mechanics, zone semantics and the config block live on the new page. /dns ↗
Candidate strategies under evaluation: placement that prices a metered link’s remaining budget into the path choice (budgets and demotion already ship), minimum-jitter selection for industrial control, loss-weighted distribution, sub-packet spraying, and explicit active/standby with recovery hold-down.
Transparent compression between fragmentation and encryption — high value for plaintext-heavy SCADA and legacy radio protocols, with a send-uncompressed path so incompressible data pays nothing.
FIPS 140-3 build mode, X25519 + ML-KEM-768 hybrid key exchange, and DDS/FACE interoperability — specified with their honest “today” lines on the security page, where their audience looks first.
The shipped resolver trusts the LSDB: any enrolled member can advertise a name, with deterministic conflict tiebreak. The committed next steps harden and extend that — console-authored signed zone bundles (offline-signed, disk-cached, a control-plane outage degrades nothing: the same trust pattern as the signed relay map), name↔static-key binding, a first-class site field in the LSA, systemd-resolved integration and a dns doctor diagnostic — and, last and narrowest, public delegation for ACME DNS-01 only, buying real TLS on node dashboards at a stated cost: public names (and CT logs) leak force structure, so the default stays names that resolve only inside the tunnel. the phase ladder ↗
The one long-standing documented gap: the inner data path and address model are IPv4 today (the underlay already speaks IPv6). Tracked, scoped, and stated on every page that touches addressing rather than hidden in a footnote.
Research sequencing is negotiable. The directions below are ranked by real operational demand — and an evaluation conversation is where demand gets registered.
