Architecture

One Python package (aarcv), one container image, one data directory. The pipeline is CPU-only and deterministic for a given configuration.

The pipeline#

1. Ingest (aarcv/ingest): demux STANAG 4609, decode KLV, settle the marking, strip geolocation, align metadata to frames.
2. Presence and platform gate (aarcv/perception): analytics run only in windows where a receiver is present; the platform is classified against the allow-list and anything else is refused and purged.
3. Pose: a 3D template silhouette is fitted to each analysis frame (10 Hz by default) to recover 6-DoF pose; the boom is fitted from the image or taken from telemetry.
4. Track: per-frame fits are smoothed into a track with velocity and per-sample uncertainty.
5. Assess (aarcv/analytics): phases, events, category scores, the moment-by-moment score, pilot inputs and control surfaces.
6. Render and secure (aarcv/security, aarcv/debrief): sanitized and debrief videos, charts and the report; screening, marking, release and custody.

The web app#

FastAPI with server-rendered pages and a REST API (aarcv/web). One background worker processes uploads in order. Accounts use HTTP Basic with PBKDF2-SHA256 password hashes. Sorties, reviews and operations data live in SQLite; products live on disk under the data directory, one folder per sortie with its custody.json.

Data directory#

data/app/
  aarcv.db                 sorties, reviews, users, operations
  audit.jsonl              hash-chained audit log (+ signed checkpoints)
  keys/custody_ed25519.pem custody signing key (0600)
  sorties/S-XXXXXXXX/
    assessment.json        the result (see the assessment schema)
    sanitized.mp4          release video
    debrief.mp4            annotated video
    report.html            self-contained report
    screening.json         per-frame screen results
    custody.json           signed custody manifest

Configuration and models#

Everything that changes an assessment (perception parameters, gates, sanitizer settings, rubric) is part of a versioned system configuration. Promoting a model version writes a new configuration version, and every sortie records the release tag it was processed with. See configuration.

Deployment shapes#

• Demo: docker compose up demo.
• Hardened: Dockerfile.hardened, read-only root filesystem, non-root user, behind a TLS proxy on an internal-only network.
• Air-gapped: deploy/airgap builds a signed bundle and installer.