Network Working Group                                       L. Melegassi
Internet-Draft                                              Catellix
Intended status: Informational                          24 May 2026
Expires: 24 November 2026


   Multi-Vantage Path Snapshot Profile for Satellite-Segment Paths:
        Mapping and N-Vantage Error-Exponent Scaling
              draft-melegassi-ippm-mvps-orbital-coherence-00

Abstract

   This document defines a mapping from the Multi-Vantage Path Snapshot
   (MVPS) framework [I-D.melegassi-ippm-mvps-bundle] onto network paths
   that traverse satellite constellations and other orbital segments.
   The mapping reuses, without alteration, the bundle wire format, the
   coherence axes (C_1, C_2, C_3), the Hamiltonian H, and the
   Mahalanobis detection statistic D^2 of base MVPS.  Two adaptations
   are introduced:

     (1) The causal lower bound C_1 admits a vacuum propagation speed
         on space-segment legs and fiber refractive index on
         terrestrial legs.

     (2) The topological coherence C_3 admits a predicted-topology
         component derived from publicly available Two-Line Element
         (TLE) sets via the SGP4 propagator [SGP4], in addition to
         the actual-topology component of base MVPS.

   This document is informational and intentionally minimal.  It states
   only those claims which reduce, by a finite chain of substitutions,
   to either (a) base MVPS theorems, or (b) classical results in
   special relativity and orbital mechanics.  Numeric thresholds,
   phase-centroid values, detection latency claims, bearing-estimation
   accuracy, and any "X% improvement" claims are NOT made.  Such
   results require experimental validation and are listed as Open
   Problems.

   OPERATIONAL PREREQUISITE.  The predicted-topology component C_3^pred
   is exercised only when per-hop satellite identity is observable at
   the vantage (Hypothesis H-5).  No major LEO operator currently
   publishes such mappings; in their absence the framework degenerates
   to a single-axis (C_1) detector.  A path-identity exposure protocol
   is a candidate companion specification (Open Problem OP-2).

   MATHEMATICAL CORE.  Under conditional independence of vantages, the
   joint missed-detection error exponent equals the sum of per-vantage
   Kullback-Leibler divergences (Appendix A; Stein's Lemma plus KL
   chain rule).  The non-trivial multi-vantage gain is information-
   theoretic: for attack classes where a single vantage has zero
   divergence, only the joint detector achieves beta below 1 - alpha.

   The document is intended for use by network operators of LEO ground
   segments, by national telecommunications regulators considering
   independent verification of foreign-operated constellation traffic
   over their territory, and by the IETF community.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six
   months and may be updated, replaced, or obsoleted by other documents
   at any time.  It is inappropriate to use Internet-Drafts as
   reference material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 24 November 2026.

Copyright Notice

   Copyright (c) 2026 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with
   respect to this document.

Table of Contents

   1.  Introduction
   2.  Terminology
   3.  Mapping from MVPS-Bundle to Orbital Segments
       3.1.  Vantage types
       3.2.  Path objects and path identity
       3.3.  Coordination window T_w
   4.  Hypotheses on which the Mathematics Depends
   5.  Theorems
       5.1.  T-1: Vacuum lower bound for RTT
       5.2.  T-2: TLE-determined predicted topology
       5.3.  T-3: Inherited coherence axes
       5.4.  T-4: Inherited Mahalanobis statistic
       5.5.  T-5: Multi-vantage discrimination is necessary
       5.6.  T-6: Predicted-topology coherence component
       5.7.  T-7: Boundedness
   6.  Coherence Axes for Orbital Paths (Definitions)
       6.1.  C_1 with mixed-medium causal bound
       6.2.  C_2 over path identifier distributions
       6.3.  C_3 with actual and predicted components
       6.4.  D^2 detection statistic
   7.  Phase Taxonomy (Qualitative Only)
   8.  Conjectures (Empirical; Not Theorems)
   9.  Open Problems
   10. Limitations
   11. Sovereign Monitoring as a Use Case
   12. Security Considerations
   13. IANA Considerations
   14. References
   Appendix A.  N-Vantage Information Advantage (Classical Result)


1.  Introduction

   Low-Earth Orbit (LEO) constellations carry a growing share of
   Internet traffic.  Their distinguishing properties are:

     o  Inter-satellite links (ISLs), where applicable, propagate at
        vacuum speed-of-light c, in contrast to terrestrial fiber
        legs which propagate at approximately 2/3 c.

     o  The ISL topology graph at any future time t is computable in
        advance from publicly available Two-Line Element (TLE) data
        and a standard propagator [SGP4].

   PROBLEM.  Single-probe measurement (e.g., a single traceroute or
   ping) cannot, in general, distinguish among:

     (a) a Kepler-predicted ISL topology change ("orbital handover"),
     (b) an unrelated routing change in the ground segment, and
     (c) an attempt to manipulate the path through an unauthorized
         intermediary.

   Cases (a)-(c) can produce indistinguishable RTT signatures at a
   single vantage.  Multi-vantage measurement, plus the predicted-
   topology trajectory derivable from TLE, is sufficient to break this
   degeneracy in principle (Theorem 5).

   APPROACH.  This document defines a MAPPING from base MVPS
   [I-D.melegassi-ippm-mvps-bundle] onto orbital paths.  The mapping
   is minimal and reuses the existing wire format, coherence axes,
   Hamiltonian, and detection statistic.  The two adaptations are:
   (1) a mixed-medium causal lower bound for C_1, and (2) a
   predicted-topology component for C_3.

   SCOPE.  This document does NOT redefine MVPS, does NOT introduce
   new wire fields, does NOT define a new detection algorithm, and
   does NOT make numerical claims about detection latency, false-
   alarm rates, or improvement factors over single-probe methods.
   Such claims require experimental validation and are listed as
   Open Problems (Section 9).


2.  Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in
   BCP 14 [RFC2119] [RFC8174].

   LEO       Low Earth Orbit, typically 340-2000 km altitude.

   ISL       Inter-Satellite Link.  Direct optical or RF link between
             two satellites, bypassing the ground segment.

   TLE       Two-Line Element set.  Standard format for encoding
             satellite orbital parameters [TLE-FORMAT].

   SGP4      Simplified General Perturbations 4, a deterministic
             orbital propagator [SGP4].

   GV        Ground Vantage.  An MVPS vantage implemented as a ground
             station capable of measuring path properties to a target
             through the satellite segment.

   T_orb     Orbital period of a satellite shell, derived from TLE.

   T_w       MVPS coordination window (inherited from base MVPS).

   c         Speed of light in vacuum, 299,792,458 m/s.

   c_f       Effective speed of light in single-mode optical fiber,
             approximately 2 * 10^8 m/s.  Vendor-dependent.

   E_v       The directed edge set observed by vantage v: ordered
             pairs of path-identity tokens (e.g., satellite IDs)
             along the path.  Identity tokens are vantage-side
             observable; see Section 3.2.

   E_pred(t) The directed edge set of the Kepler-optimal path between
             a given source-destination pair at time t, computed from
             TLE via SGP4 and an ISL-graph rule (Section 5.2).

   C_1, C_2, C_3   MVPS coherence axes, inherited from base MVPS.

   H         Hamiltonian, inherited from base MVPS:
             H = -(log C_1 + log C_2 + log C_3).

   D^2       Mahalanobis statistic on C(t), inherited from base MVPS.


3.  Mapping from MVPS-Bundle to Orbital Segments

3.1.  Vantage types

   Two vantage types are defined:

   GV (Ground Vantage):
     A ground station with traceroute-class measurement capability
     toward a target via the satellite segment.  Requirements
     (REQUIRED for the math to apply):

       - Known geodetic coordinates (WGS-84) to within +/- 10 m.
       - UTC-synchronized clock with skew tau_clk much smaller than
         the coordination window T_w (Section 4, H-3).
       - Ability to participate in the MVPS bundle coordination
         protocol of [I-D.melegassi-ippm-mvps-bundle].

   RV (Relay Vantage, OPTIONAL):
     A station with operator-side telemetry access (ISL neighbor
     tables, ground-routing tables).  When available, an RV provides
     ground truth for the topology graph and reduces dependence on
     externally observable path identity.  RVs are not required for
     the framework; they strengthen it when present.

   The minimum deployment is N = 3 GVs at geographically separated
   sites.  N = 3 is the minimum imposed by base MVPS Operational
   Contract OC1 (geometric-median Byzantine bound).

3.2.  Path objects and path identity

   The MVPS path fingerprint of base MVPS is a finite-alphabet
   identifier of the path observed by a vantage within a coordination
   window.  In the orbital setting, the natural identifier is

      F = (id_entry, hop_1, hop_2, ..., hop_k, id_exit, GW_ASN)

   where each id_i is a satellite identifier (e.g., NORAD catalog
   number) when exposed by the path-discovery mechanism in use, and
   GW_ASN is the autonomous system number of the ground gateway
   when determinable.

   PATH IDENTITY OBSERVABILITY (REQUIRED for E_v to be non-trivial).
   The fingerprint F is meaningful only if the underlying mechanism
   exposes per-hop identity tokens at the vantage.  For some
   constellations and configurations this is currently not the case
   (Section 10).  When path identity is not observable at the vantage,
   the C_3 axis collapses to a coarse signal and the mathematics of
   T-6 is not exercised; the framework degenerates to a single-axis
   (C_1) detector.

3.3.  Coordination window T_w

   T_w is inherited from base MVPS unchanged.  Implementations SHOULD
   set T_w small relative to the expected ISL topology change rate
   for the constellation under study, so that within a single window
   the topology is approximately stable.  No specific numeric value
   is mandated by this document.


4.  Hypotheses on which the Mathematics Depends

   The theorems in Section 5 are conditional on the following
   hypotheses.  Implementations and reviewers should assess whether
   each hypothesis is satisfied in the deployment under study.

   H-1   TLE accuracy.
         The TLE in use, after SGP4 propagation to the measurement
         time, gives satellite positions whose error is small enough
         that the predicted topology graph G_pred(t) (Section 5.2)
         differs from the true topology only at link transitions
         within a bounded uncertainty window.  Civilian TLE at epoch
         age <= 24 h is commonly cited as having sub-kilometer
         positional accuracy; this is an empirical assumption, not
         a theorem.

   H-2   Truthful path-fingerprint reporting.
         Each vantage reports the (RTT, F, E_v) it actually observes,
         without intentional alteration.  Adversarial vantages are
         handled by the geometric-median bound of base MVPS Theorem 9.

   H-3   Vantage clock synchronization.
         The pairwise UTC clock skew across vantages, tau_clk,
         satisfies tau_clk much smaller than T_w.  This is REQUIRED
         for the joint causal bound (T-1) to be meaningful and for
         Mahalanobis stationarity (T-4).

   H-4   Distributional assumption for D^2.
         Base MVPS Theorem 2 (chi^2 null) holds under a Gaussian
         null on C(t).  In the orbital setting, C(t) is multimodal
         due to handover periodicity, so this hypothesis is NOT
         expected to hold globally.  Production deployments MUST
         use empirical FAR calibration (base MVPS Operational
         Contract OC3) over a baseline that excludes predicted
         handover windows.

   H-5   Path-identity exposure.
         Theorem 6 (predicted-topology component) applies only when
         per-hop identity is observable at the vantage (Section 3.2).
         Where it is not, the framework reduces to base MVPS without
         the orbital extension.


5.  Theorems

   This section states the mathematical claims of this document.
   Each is either trivially derivable, inherited from a base MVPS
   theorem, or follows from classical relativity / orbital mechanics.

5.1.  T-1: Vacuum lower bound for RTT

   STATEMENT.  Consider a path P between a source vantage and a
   destination, decomposed into legs i = 1..L, each with effective
   one-way propagation speed c_i, where c_i <= c (special relativity).
   Then the round-trip time satisfies

      RTT_min(P)  =  2 * sum_{i=1..L} (d_i / c_i)        <=  RTT_obs(P)

   in the absence of clock-skew error.

   PROOF SKETCH.  By special relativity, the one-way time for any
   signal traversing a leg of length d_i is at least d_i / c_i.
   Summing over legs and doubling for round trip yields the bound.
   The bound is realized only in the absence of queueing,
   serialization, and processing delays.

   APPLICATION.  In a mixed-medium path, c_i = c on space-segment
   legs (uplink, downlink, ISL) and c_i = c_f on terrestrial fiber
   legs.  The composite RTT_min thus reflects the actual physics of
   the path.

5.2.  T-2: TLE-determined predicted topology

   STATEMENT.  Given a set of TLEs in scope at time t_0 and the
   SGP4 propagator, the predicted ISL graph

      G_pred(t)  =  { (i, j) : d_ij(t) < R_ISL_max
                      AND elev_ij(t) > elev_min }

   is a deterministic function of the TLE set and t, for any choice
   of constellation-specific R_ISL_max and elev_min.

   PROOF SKETCH.  SGP4 is a deterministic propagator; ECI position
   vectors are deterministic functions of TLE and t.  The Boolean
   edge predicate is a deterministic function of those positions.
   Composition of deterministic functions is deterministic.

   CAVEAT.  T-2 establishes computability, not accuracy.  The
   accuracy of G_pred(t) relative to the true on-orbit topology is
   bounded by H-1 (TLE accuracy) and any operator-specific routing
   rules unknown to the vantage.

5.3.  T-3: Inherited coherence axes

   STATEMENT.  When an MVPS bundle in the orbital setting carries
   per-vantage RTT, fingerprint, and edge-set, the coherence axes
   C_1, C_2, C_3 of base MVPS [I-D.melegassi-ippm-mvps-bundle, D1+D3+
   F1-F4+I1] are well-defined functionals of the bundle.

   PROOF.  Inheritance.  No new mathematics introduced.

5.4.  T-4: Inherited Mahalanobis statistic

   STATEMENT.  The Mahalanobis statistic D^2(t) on C(t) inherits the
   base MVPS Theorems 2 and 3'.  Under the Gaussian null on C(t),
   D^2 ~ chi^2(3).  Under the non-Gaussian C in [0,1]^3, FAR is
   calibrated empirically with quantified precision under base MVPS
   Operational Contract OC3.

   PROOF.  Inheritance.

   ORBITAL CAVEAT.  Per H-4, the Gaussian null is NOT expected to
   hold globally in LEO; empirical FAR calibration over a
   handover-excluded baseline is REQUIRED in production.

5.5.  T-5: Multi-vantage discrimination is necessary

   STATEMENT.  Let externally observable signature at a vantage v be
   the tuple (RTT_v, F_v_external) where F_v_external excludes any
   identity tokens not exposed at the IP layer.  There exist pairs
   (T, T') of distinct topologies such that the externally observable
   signature is identical between T and T' for a single vantage v.
   Therefore, no measurable function of single-vantage data can
   distinguish T from T' at v.

   PROOF SKETCH.  Construct T and T' that differ only in interior
   ISL hops while preserving entry, exit, and total propagation
   delay; the externally observable signature is identical by
   construction.  N >= 2 vantages with disjoint observation geometry
   resolve the ambiguity by providing distinct externals for the
   same internal events.

5.6.  T-6: Predicted-topology coherence component

   STATEMENT.  Define

      C_3^pred(t)  =  mean_v  Jaccard(E_v, E_pred(t))

   where E_pred(t) is from T-2.  When the observed edge set
   E_v(t) equals the Kepler-optimal predicted edge set E_pred(t)
   exactly, C_3^pred(t) = 1.  When E_v(t) deviates from E_pred(t),
   C_3^pred(t) < 1, with the magnitude of the drop bounded by the
   Jaccard distance between the two edge sets.

   PROOF.  Direct from the definition of Jaccard similarity and
   T-2.

   APPLICATION.  C_3^pred provides a discriminator independent of
   historical baseline: a topology change that matches Kepler
   predictions has C_3^pred ~ 1; a topology change that does not
   match has C_3^pred < 1.

5.7.  T-7: Boundedness

   STATEMENT.  C_1, C_2, C_3 in [0,1].  H = -(log C_1 + log C_2 +
   log C_3) >= 0.

   PROOF.  Direct from definitions.  Inherited boundedness from
   base MVPS Theorem 1.


6.  Coherence Axes for Orbital Paths (Definitions)

6.1.  C_1 with mixed-medium causal bound

   For a path P decomposed into legs (uplink, ISL_1..ISL_k, downlink,
   plus optional terrestrial fiber legs), the orbital-segment causal
   component is

      C_1^Einstein  =  max(0, 1 - max(0, RTT_min(P) - RTT_obs(P))
                                / RTT_obs(P))

   where RTT_min is from T-1.  C_1^Einstein equals 1 whenever
   RTT_obs >= RTT_min, which is the physically realizable regime.
   Values strictly less than 1 indicate a measurement inconsistency
   (clock skew or other instrumentation issue) and are NOT
   interpreted as a security signal in this document.  The fingerprint-
   entropy component C_1^tau is inherited from base MVPS.

   C_1  =  min(C_1^Einstein, C_1^tau).

6.2.  C_2 over path identifier distributions

   Inherited from base MVPS, with the alphabet of identifiers being
   the satellite-identity tokens of the path fingerprint
   (Section 3.2).

   C_2  =  1 - JSD_norm({p_v}_{v=1..N}).

6.3.  C_3 with actual and predicted components

   Two components are defined:

      C_3^actual  =  mean Jaccard over the observed edge sets
                     {E_v}_{v=1..N}.        (base MVPS, unchanged)

      C_3^pred    =  mean Jaccard(E_v, E_pred(t)) over vantages,
                     with E_pred(t) from T-2.   (this document)

   Implementations report both components in the bundle.  A combined
   scalar may be formed for monitoring purposes; this document does
   not mandate a fixed combination.  Recommended practice is to
   monitor the two components independently and to declare an
   anomaly only when BOTH drop, which is the signature implied by
   T-6.

6.4.  D^2 detection statistic

   Computed identically to base MVPS, on the vector C(t) =
   (C_1, C_2, C_3^actual) (or, equivalently, on (C_1, C_2,
   C_3^pred), or on a 4-axis extension).  Implementations report the
   choice of axes and the calibration baseline.  Per H-4, the
   baseline MUST exclude predicted handover windows.


7.  Phase Taxonomy (Qualitative Only)

   The MVPS Layer-3 phase taxonomy is extended for the orbital
   setting with QUALITATIVE labels.  Numeric centroids for these
   phases are NOT specified in this document; they are an Open
   Problem (OP-1) and require empirical study before normative
   specification.

   ORBITAL_HANDOVER         Predicted topology change consistent
                            with Kepler dynamics.  Defined by
                            T-6 (C_3^pred remains close to 1
                            during the change).

   LINK_MARGIN_DEGRADATION  Gradual change in C_1 within vacuum
                            bounds; topology stable.

   PATH_INTEGRITY_BREACH    Topology change inconsistent with
                            Kepler predictions:  C_3^actual
                            drops AND C_3^pred drops.

   INTERFERENCE_SUSPECTED   Multi-vantage informational divergence
                            (C_2 drop) localized to a subset of
                            vantages.

   These names are CLASSIFICATION HINTS for operators; they do not
   imply a unique numeric region in (C_1, C_2, C_3) space.


8.  Conjectures (Empirical; Not Theorems)

   The following statements are EXPECTED to hold but have not been
   proven in this document and have not been validated by
   simulation or measurement.  They are listed for testability.

   CONJ-O-1   After excluding predicted handover windows, the
              residual C(t) distribution is sufficiently close to
              Gaussian that base MVPS empirical FAR calibration
              (OC3) converges within the same n_calib bound.

   CONJ-O-2   With path-identity exposure (H-5 satisfied), Jaccard
              between observed and TLE-predicted edge sets remains
              above some operationally useful floor under nominal
              orbital handover.

   CONJ-O-3   N >= 3 ground vantages with separation >= 500 km
              provide sufficient geometric diversity to expose
              informational and topological divergence at C_2/C_3
              levels distinguishable from measurement noise.

   CONJ-O-4   The bearing of an interfering source CAN be estimated
              from the spatial pattern of C_2 residuals across
              N vantages, given a beam-pattern model.  No estimator
              is proposed in this document.


9.  Open Problems

   OP-1  Reference simulation.  Implement a minimal simulator using
         (a) public TLE feeds, (b) an SGP4 propagator, (c) a
         constellation-specific ISL-graph rule, (d) >= 3 synthetic
         ground vantages, (e) injected perturbations of three
         classes (handover-only, interference-like, breach-like).
         Measure empirical FAR and characterize C(t) distribution.

   OP-2  Path-identity exposure protocol.  Define a JSON-signed
         IP-to-satellite-identity mapping that LEO operators MAY
         publish to enable interoperable monitoring.  This is a
         candidate companion I-D.

   OP-3  Bearing-estimation derivation.  Derive a bearing estimator
         from a beam-pattern model.  Quantify uncertainty.

   OP-4  Multimodal C(t) distribution.  Characterize the
         distribution of C(t) once handover periodicity is
         decoupled.  Determine when distribution-free quantile
         methods dominate parametric chi^2 approximations.

   OP-5  Timing-attack model.  If a credible attack on satellite
         timing oscillators is to be detected, derive the
         observable signature on (C_1, C_2, C_3) from the underlying
         physics.  This document does not address GNSS spoofing.

   OP-6  Relay-network extension.  Extend the framework to
         long-baseline relay networks (e.g., AU-scale propagation,
         hour-scale RTTs).  The algebra is unchanged; the constants
         and TLE replacements differ.

   OP-7  TLE integrity.  Cross-validate TLE feeds across independent
         publishers to defend against maliciously crafted TLEs that
         could mask a topology breach by inducing a matching
         predicted topology.


10.  Limitations

   This document explicitly notes the following limitations.

   L-1  No experimental validation has been performed for this
        extension.  All theorems are mathematical or inherited;
        empirical claims are deferred to OP-1.

   L-2  Path-identity exposure is required for the orbital-specific
        contributions (T-6, C_3^pred) to be exercised.  As of this
        document's date, several major LEO constellations do not
        publish stable per-satellite identity mappings.  In such
        cases the framework reduces to base MVPS; the orbital
        adaptation is dormant.

   L-3  TLE feeds for civilian use are public but unsigned.  An
        adversary capable of injecting falsified TLE could mask
        a topology breach (OP-7).

   L-4  No bearing estimator is proposed in this document
        (Section 8, CONJ-O-4; Section 9, OP-3).  Claims of
        interference geolocation are out of scope.

   L-5  No detection-latency or false-alarm-rate numbers are
        claimed.  Such numbers depend on the specific deployment
        and on the resolution of OP-1.

   L-6  No claim is made about NASA, SpaceX, or other specific
        operators.  Where any deployment is mentioned, it is as a
        candidate use case, not as an existing implementation.


11.  Sovereign Monitoring as a Use Case

   The framework is consistent with passive multi-station monitoring
   by a national regulator.  An N >= 3 ground-vantage deployment over
   national territory, using public TLE and base MVPS bundles, can
   produce signed observations of (C_1, C_2, C_3, D^2) trajectories.

   The mathematics permits, but does not guarantee, that such a
   deployment can independently verify whether traffic over national
   territory follows the routing claimed by the constellation
   operator.  Whether this verification succeeds in any given
   deployment depends on Hypothesis H-5 (path-identity exposure) and
   on Limitation L-2.

   This document makes no policy or legal claim.  Operators of any
   sovereign deployment SHOULD verify compliance with national and
   international telecommunications law and ITU Radio Regulations.


12.  Security Considerations

   This document defines a monitoring framework.  No new wire format
   is introduced; security considerations of base MVPS apply
   unchanged.  Additional considerations specific to the orbital
   setting:

   Adversarial-evasion mitigation.  An adversary aware of this
   framework might attempt to mimic an orbital handover signature
   in order to evade T-6 detection.  Mimicry requires the adversary
   to compute, in real time, a topology change that matches both
   E_pred(t) and timing predicted by SGP4 from the public TLE feed.
   The cost of such mimicry depends on the adversary's compute
   budget and on the integrity of the TLE feed (OP-7).

   TLE integrity.  See L-3 and OP-7.

   Confidentiality.  MVPS bundles inherit confidentiality
   considerations from base MVPS; no orbital-specific exposure is
   introduced.

   Bundles SHOULD be cryptographically signed with vantage identity
   keys when used for sovereign monitoring (Section 11), to support
   forensic use.


13.  IANA Considerations

   This document requests no IANA actions.

   A future companion document might propose an IANA registry for
   constellation operator identifiers (mapping operator name to ASN
   range, TLE feed URL, and identity-exposure protocol version).
   That registry is out of scope for this document.


14.  References

14.1.  Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in
              RFC 2119 Key Words", BCP 14, RFC 8174, May 2017.

   [I-D.melegassi-ippm-mvps-bundle]
              Melegassi, L., "Multi-Vantage Path Snapshot Bundle
              Format and Coherence Framework",
              draft-melegassi-ippm-mvps-bundle-00, May 2026.

14.2.  Informative References

   [SGP4]     Hoots, F. R. and R. L. Roehrich, "Spacetrack Report
              No. 3: Models for Propagation of NORAD Element Sets",
              December 1980.  (See also Vallado & Crawford,
              AIAA 2006-6753, "Revisiting Spacetrack Report #3".)

   [Vallado-2013]
              Vallado, D. A., "Fundamentals of Astrodynamics and
              Applications", 4th edition, Microcosm Press / Springer,
              2013.

   [Cover-Thomas-2006]
              Cover, T. M. and Thomas, J. A., "Elements of
              Information Theory", 2nd edition, Wiley-Interscience,
              2006.  (Stein's Lemma:  Theorem 11.8.1, Chapter 11.)

   [CAIB-2003]
              Columbia Accident Investigation Board, "Report
              Volume I", NASA, August 2003.  Public domain.
              (Cited for the class-of-gap precedent in
              multi-source orbital observation.)

   [NASA-OIG-IG-23-016]
              NASA Office of Inspector General, "Audit of NASA's
              Deep Space Network", Report IG-23-016, 12 July
              2023.  Public domain.  In particular Recommendation
              R-4 (utilization of commercial and international
              partner networks as DSN backup), which is the
              operational opening for the framework defined in
              the present document.

   [TLE-FORMAT]
              CelesTrak, "Two-Line Element Set Format",
              https://celestrak.org/, accessed May 2026.

   [RFC9198]  Ciavattone, L., Morton, A., Linsner, M., and J. Seitz,
              "Advanced Unidirectional Route Assessment (AURA)",
              RFC 9198, May 2022.


Appendix A.  N-Vantage Information Advantage (Classical Result)

   This appendix records, for completeness, the classical detection-
   theoretic bound that motivates N >= 3 multi-vantage operation in
   base MVPS and inherited by this document.  The theorem and its
   proof are taken from [Cover-Thomas-2006], Theorem 11.8.1 (Stein's
   Lemma), with the standard extension to independent observers via
   the chain rule for Kullback-Leibler divergence.  No new mathematics
   is introduced.

A.1.  Setting

   Consider a binary hypothesis test on the state of an orbital path:

      H_0 :  the path is in nominal state.
      H_1 :  the path is in an anomalous state (handover-but-not-
             predicted, interference, or path-integrity breach;
             see Section 7).

   Each ground vantage v in {1, ..., N} produces an observation X_v
   drawn from P_v^0 under H_0 and from P_v^1 under H_1.

   Assumptions:
      A1.  X_1, ..., X_N are conditionally independent given the
           hypothesis.  This corresponds to instrumentally and
           geographically independent vantages.
      A2.  For each v, the Kullback-Leibler divergence
           D_v := KL(P_v^1 || P_v^0) is finite and positive.

A.2.  Stein's Lemma (single observer)

   For a single vantage v, with n independent samples drawn under
   H_1 and any test sequence whose Type-I error is bounded by
   alpha < 1, the optimal Type-II (missed-detection) error
   beta_n^v(alpha) satisfies:

      -(1/n) * log beta_n^v(alpha)  --->  D_v       (n --> infinity).

   ([Cover-Thomas-2006], Theorem 11.8.1.)

A.3.  N-vantage extension

   By A1, the joint distribution under hypothesis H_k is
   P_joint^k = P_1^k x P_2^k x ... x P_N^k.  By the chain rule for
   KL divergence on independent components:

      KL(P_joint^1 || P_joint^0)  =  sum_{v=1..N}  D_v.

   Applying Stein's Lemma to the joint observation:

      beta_n^joint(alpha)  =  exp(-n * sum_{v=1..N} D_v + o(n)).

A.4.  THEOREM A-1.  N-Vantage Information Advantage

   Under A1-A2, the asymptotic missed-detection error exponent of
   the joint N-vantage test exceeds the error exponent of the best
   single-vantage test:

      E_N  :=  sum_{v=1..N} D_v   >=   max_v D_v   =:   E_1,

   with strict inequality whenever D_v > 0 for at least two
   vantages.

   PROOF.  Sum over non-negative reals dominates max over the same
   set; strict inequality follows when at least two summands are
   positive.

A.5.  Operational interpretation

   Theorem A-1 is the mathematical content of the requirement
   N >= 3 imposed by base MVPS Operational Contract OC1.  It does
   NOT, by itself, predict the empirical error exponent achieved by
   any specific deployment, which depends on per-vantage D_v values
   (Conjecture CONJ-O-3 in Section 8).  It DOES guarantee that
   every additional independent vantage strictly improves the
   missed-detection bound at fixed false-alarm rate.

   This is the property by which radar arrays, GNSS spoofing
   detectors, and seismic event-location networks justify their
   multi-observer architectures.  The orbital-coherence framework
   inherits this property without modification.

A.6.  Limitations

   Theorem A-1 is asymptotic.  It assumes conditional independence
   (A1).  Vantages that share systematic biases (e.g., a common TLE
   feed compromised under OP-7) violate A1 and the bound does not
   apply directly to the compromised component.  Theorem A-1 is
   stated here for the orbital case for completeness; its proof is
   not original to this document.


Author's Address

   Leonardo Melegassi
   Catellix
   Andradina, SP, Brazil
   Email: melegassi@catellix.com
   URI:   https://catellix.com
