A command post that moves without going dark.
Every doctrine says the command post should displace often; every network says each displacement will cost you your sessions, because the addresses change with the ground. This mission is about breaking that trade: sessions bound to cryptographic identity instead of addresses, so the CP can move and the units in the field never notice.
Deployed headquarters, incident command, exercise control — any operation whose control element relocates mid-mission.
The CP’s addresses change as it moves between networks; classically that resets every tunnel and stream at the worst possible moment.
Sessions bound to cryptographic identity, endpoint roaming across address changes, and make-before-break relay re-anchoring. All shipped.
The CP vehicle’s existing computer and the units’ existing kit — nothing added to either. One Linux binary, one configuration file.
The mission
A deployed headquarters runs the operation from a vehicle: the common picture on the screens, voice with every subordinate element, data feeds from sensors and teams spread across the area. Twice a day — or the moment its position is compromised — the CP packs, rolls and sets up somewhere else. The move is doctrine; survivability demands it. What doctrine does not say is that the network should punish the move, and yet that is exactly what conventional architecture does: the most dangerous minutes of the CP’s day are also the minutes it goes deaf.
What breaks
Almost everything in a conventional stack is bound to addresses, and the CP’s addresses are a property of where it is parked. Roll out of one network’s footprint into another’s and every address changes; every tunnel keyed to the old ones dies; every stream riding those tunnels resets. The units in the field see the headquarters vanish and reappear — re-authenticating, re-subscribing, reloading the picture — and the operators’ workaround is grim: either displace less often than doctrine wants, or script a teardown-and-rebuild ritual and accept the dark minutes in between.
The failure is at its sharpest mid-move. Between the old footprint and the new one the vehicle crosses ragged ground where cells come and go every few hundred metres — precisely the conditions under which address-bound sessions thrash worst, and precisely when a mobile headquarters most needs to be reachable.
The architecture on this mission
Atlas binds every session to what a node is, not where it is. Each endpoint is a cryptographic identity — the same key family as WireGuard and Signal, with automatic rotation every two minutes verified to lose zero packets during the swap — and traffic follows the identity across whatever addresses currently reach it. When the CP vehicle picks up a new network, the new path simply joins its bond; when the old one fades, it leaves. The sessions riding on top never see either event.
The CP bonds everything it can raise — cellular on the networks it passes through, a satellite terminal for the ground between them — so displacement is not a gap but a gradient: as terrestrial paths thin, the satellite leg carries the reserved floors, and as the new footprint firms up, capacity climbs back without a switchover event. Where the operation anchors through a relay for reachability, re-anchoring is make-before-break — the new anchor is established and carrying before the old one is released — so there is no moment when the headquarters has no home in the network.
None of this asks anything of the field units’ software or the C2 applications. They dial the same identity before, during and after the move; the classification and the floors ride underneath them unmodified.
How the displacement unfolds
- Established. The CP has been on this hill since dawn: bonded cellular plus satellite, the common picture flowing, every subordinate element’s session up. The dashboard shows each path’s measured state.
- The order to move. The CP packs and rolls. Nothing is torn down, no checklist of tunnels — the network state simply travels with the vehicle.
- Ragged ground. Between footprints, cells come and go by the minute. Probing at several times a second scores each path as it appears; traffic walks off each fading cell within roughly half to three-quarters of a second, and the satellite leg holds the voice and data floors through the worst of it.
- The new footprint. Network B’s cells join the bond one by one; the relay anchor re-elects make-before-break; throughput climbs back. The field units have been mid-session throughout — most operators never learn the CP moved.
- Set up and thickened. On the new position the crew raises the mast and adds the local links; the bond absorbs them the same way. Video and bulk feeds return to full quality.
- The debrief. The journal shows the whole displacement as data: every path’s lifetime, every reweighting, the depth of the thinnest minute — evidence that the sessions held, and a measured basis for choosing the next position.
What each mechanism contributes
- Identity-bound sessions — endpoints are keys, not addresses; the two-minute rekey swaps keys with zero packets lost. Shipped.
- Endpoint roaming — address changes on either end are absorbed without resetting anything above. Shipped.
- Make-before-break relay re-anchoring — the new anchor carries before the old one is released; the CP always has a home in the network. Shipped.
- Bonding with class floors — cellular and satellite as one measured fabric; command and voice hold reserved floors while bulk yields on the move. Shipped, opt-in.
- Continuous measurement and the journal — the displacement recorded path by path, for the after-action review and the next position estimate. Shipped.
The honest boundary: Atlas keeps the sessions alive across the move; it cannot move the antenna for you or conjure coverage on ground that has none — a displacement route with a genuine all-links hole is carried by the satellite leg or by queued delivery, and choosing routes and positions remains the staff’s craft. And plainly, because this page will be read carefully: the mechanisms respond to measured degradation whatever its cause, but resilience against deliberate interference is not a field-validated claim we make — our field record is controlled link-degradation trials.
What a pilot should prove
- A full displacement drill with every session instrumented: zero session resets from pack-up to re-establishment, timestamped by the journal.
- Mid-move continuity: voice and the common picture through the ragged ground between footprints, with the per-path record showing what carried each minute.
- Relay re-anchoring under observation: the anchor migrating make-before-break, with no unreachable interval.
- The control case: the same drill on the current architecture, so the committee sees the difference as data rather than argument.
One CP vehicle, one displacement route, one drill day. The evaluation format covers the structure.