Firebot Labs — Deployed Apps

Architecture & Documentation

Firefly Arch Diagram

Versioned architecture diagrams and documentation in a versioned, hardened, and encrypted container format generated from platform code.

Airspace API Docs

Airspace API documentation, cheat sheets, and supporting scientific research, industry standards references, and documentation

SDLCodex - An SDL Doc Explorer

StackReact 18 / TypeScript / Vite · Zod ingest (tsx) of the fbsdl markdown corpus, baked at build · d3-force · react-markdown + remark-gfm · WebCrypto · two-stage Containerfile + Caddy · image tag = SDL version

Corpus139 Product Security Precepts + core SDL docs parsed at build time: structured records, typed relationship edges, three-facet taxonomy (category, focus group, environment bias), sha256 manifest of every document & diagram · validation fails closed: a corpus that doesn't parse never ships

IntegrityFully static SPA: no backend, no database, no runtime content dependencies · WebCrypto re-hashes each page and image at render time against the cut manifest · no raw HTML, scheme-allowlisted links, strict security headers · each release an immutable, self-verifying snapshot (73 MB, ~10 s cold build)

Graphd3-force dependency explorer: phyllotaxis-seeded constellations, pin-on-drag physics, bowed directional edges, relationship lenses · CVD-validated 8-slot categorical palette

AssistAsk Codex streams browser-direct from the Anthropic API, user-supplied key held in session storage · tool surface is read-only corpus retrieval + hash-route UI navigation · CSP pins connect-src to api.anthropic.com only

SDLCodex - An SDL Doc Explorer

The Firebot Labs Secure Development Lifecycle is an attested, versioned, continuously developed, and periodically released internal product for the Engineering team

Airspace & UAS Operations

Airspace API - alleyroof

StackPure Python stdlib API (~1,250 LOC, ThreadingHTTPServer — no Flask/numpy) on an ADS-B edge node · MapLibre GL JS 4.7.1 scope viewer, single HTML ~1,800 lines, no build step · nginx same-origin

FeedUnified "what's in the sky near me" — local readsb ADS-B + optional ODID Remote-ID drone feed, distance-filtered with freshness + per-aircraft data-quality · GET /airspace polled at 1 Hz (ETag/304, mtime-keyed thread-safe parse cache) · /health /info /metrics /version

DAApredictor.py pure-function threat geometry per contact — closure, CPA, modified tau, vertical intent, well-clear + risk tier from NASA DAIDALUS / RTCA DO-365 (DMOD 0.66 NM, ZTHR 450 ft, τ-mod 35 s) · NMAC volume · warning/corrective alert tiers

TrustRemote-ID trust tiers (fleet / unknown / suspected_spoof via serial↔MAC binding) · advisory ML spoof score — fly-catcher-adapted pure-Python net, synthetic-trained · SQLite pattern-of-life store: known low-flyer regulars + 24h encroachment ledger

Purplescope-sim.js served only on test-enabled nodes — purple SIMULATION banner/glow for trust=test contacts, real criticals always win the screen · prod viewers ship with no simulation code at all · no code path fabricates an aircraft; drills move the receiver against real traffic

Airspace API - alleyroof

Real-Time airspace advisory service based on DO-365/DAIDALUS (FAA/NASA) reference implementation

Airspace API - fs14-adsb-1

StackPure Python stdlib API (~1,250 LOC, ThreadingHTTPServer — no Flask/numpy) on an ADS-B edge node · MapLibre GL JS 4.7.1 scope viewer, single HTML ~1,800 lines, no build step · nginx same-origin

FeedUnified "what's in the sky near me" — local readsb ADS-B + optional ODID Remote-ID drone feed, distance-filtered with freshness + per-aircraft data-quality · GET /airspace polled at 1 Hz (ETag/304, mtime-keyed thread-safe parse cache) · /health /info /metrics /version

DAApredictor.py pure-function threat geometry per contact — closure, CPA, modified tau, vertical intent, well-clear + risk tier from NASA DAIDALUS / RTCA DO-365 (DMOD 0.66 NM, ZTHR 450 ft, τ-mod 35 s) · NMAC volume · warning/corrective alert tiers

TrustRemote-ID trust tiers (fleet / unknown / suspected_spoof via serial↔MAC binding) · advisory ML spoof score — fly-catcher-adapted pure-Python net, synthetic-trained · SQLite pattern-of-life store: known low-flyer regulars + 24h encroachment ledger

Purplescope-sim.js served only on test-enabled nodes — purple SIMULATION banner/glow for trust=test contacts, real criticals always win the screen · prod viewers ship with no simulation code at all · no code path fabricates an aircraft; drills move the receiver against real traffic

Airspace API - fs14-adsb-1

Real-Time airspace advisory service based on DO-365/DAIDALUS (FAA/NASA) reference implementation

3D Airspace Explorer

StackMapLibre GL JS 4.7.1 · Vanilla JS SPA · static/no build step · ~1,250 LOC across 4 modules

DataLockhorse ArcGIS REST Feature Services + FAA GeoServer WFS via CORS proxy (tfr-notams.lockhorsegroup.com)

LayersClass B/C/D (3D fill-extrusion), LAANC, TFRs/NOTAMs, SUA (R/P/MOA/W/A/CFA/NSA), FRIAs, NSUFRs, rec sites, stadiums — bbox-gated, 800ms debounce on moveend

ArchState via CSS classes · stadiums fetch-once · 429 detection + toast · 3D toggle swaps fill → fill-extrusion with MSL→meters conversion

3D Airspace Explorer

Real-time FAA airspace + TFR/NOTAM map

BVLOS Edition

StackMapLibre GL JS 4.7.1 · MapboxDraw 1.4.3 · Turf.js 6 · Vanilla JS ~4,200 LOC / 10 modules · no build step, no backend · Cloudflare Pages + Access auth

Data100% localStorage — FAA Form 7711-2 records (full safety case fields) + LAANC cell selections keyed by GlobalID + reusable pilot/applicant personas

FeaturesFull waiver CRUD · LAANC cell click + polygon auto-select (contiguity checked) · auto-computed airspace snapshot (corridor × FAA Class/LAANC intersection at save) · MapboxDraw corridor geometry · PDF print with auto-generated lat/lon coordinate table · bulk JSON export/import

BaseInherits base Airspace SPA layers (Class B/C/D, LAANC grids, TFRs/NOTAMs, FRIAs, SUA, stadiums, infrastructure) unchanged

BVLOS App Maker

Secure efficiency overlay for FAA admin support

Coverage Planner — Drone Dock Deployment

StackLeaflet 1.9.4 (predates MapLibre stack) · Vanilla JS · single HTML file ~1,700 lines · 7 basemaps (OSM, CartoDB, ESRI Satellite, FAA VFR Sectional, TAC, IFR Enroute) · no backend

PlanningHex/circular coverage cells · pointy-top SVG geometry calculated in JS · drag + Ctrl+click multi-select group drag · magnetic snap to adjacent vertices (10px) · auto-tile viewport into hex grid

ModelsDJI M3TD (10km / 9mi radius) + M4T (12km / 10.9mi) — switching recalculates grid geometry dynamically

AirspaceL2 of 4-level roadmap shipped: hardcoded SJC Class C (5nm + 10nm shelf), RHV Class D, Moffett Restricted from FAA Chart Supplement — rendered as reference rings with popups

UAV Planning Map

Demo deployment planning map

Skydio Cloud API Demo

StackBun 1.2 + Hono 4.7 · React 19 / TypeScript / Vite 6 · MapLibre GL JS 4.7 · Jotai 2.10 (12 atoms) · TanStack Query 5.65 · Docker + Ansible + Caddy/Tailscale · deliberately mirrors Firefly stack for direct code graduation

LivePersistent upstream WebSocket → stream.skydio.com fan-out to all browser clients at ~5 Hz · heading conversion (90 − yaw_rad × 180/π + 360) % 360, verified ±1° against DFR Command · 3s backoff auto-reconnect upstream + browser

History10 most recent flights · GPS track via GET /v0/flight/:id/telemetry (~866 pts/14-min flight) · multi-select colored polyline overlay · rAF replay at 5×/10×/20×/60× with progress scrubber

WebhooksPOST /api/webhooks/skydio with full JWT signature validation (HMAC-SHA256, JWK rotation, body SHA256) · last 50 events forwarded to browser over same WebSocket channel. Auth: ApiToken (not Bearer).

Skydio Cloud API Demo

Fleet telemetry & flight replay integration

Fire & Emergency Response

Corridor Fuel Mitigation Viewer

StackMapLibre GL JS 4.7.1 · PMTiles 3.2.0 (Cloudflare R2) · Turf.js · JSZip · Flask backend (/api/plan, /generate, /validate) · Cloudflare Pages

PipelinePython — USGS 3DEP LiDAR (38 LAZ tiles, ~3.4 GB) via PDAL/rasterio · Sentinel-2 NDVI/NDMI (MS Planetary Computer STAC) · LANDFIRE 2022 · CAL FIRE FRAP (FHSZ + WUI) · Caltrans centerline → 100m segments × 3 buffer zones

Risk0.25×FHSZ + 0.20×ladder fuel + 0.15×canopy ht + 0.10×slope + 0.10×aspect + 0.10×NDMI departure + 0.10×WUI proximity → v0: 1 Critical, 96 High, 73 Moderate, 53 Low / 223 segments

OutputD1 GeoPackage/GeoJSON · D2 per-segment PDFs (radar chart + NAIP overlay) · D3: 97 DJI WPML .kmz missions (60m AGL, 5 m/s, lawnmower + orbit) for High/Critical I-280 Seg B segments

Wildfire Fuel Viewer

Corridor wildfire fuel assessment viewer

CERS + HazmatIQ

StackMapLibre GL JS 4.7.1 · Vanilla JS (~2,000 LOC / 9 modules) · SSE streaming + Python/Flask backend · Caddy reverse-proxy over Tailscale

DataCERS Portal (credential-gated live) · NIOSH NPG (scraped) · HIFLD (DHS) · San Jose DPW sewer/storm networks · TIGERweb ZIP boundaries

BackendFlask port 8765 · curl_cffi Chrome124 TLS fingerprint to bypass Imperva WAF · SQLite facility cache (~28MB, 4,023 records)

AgentHazmatIQ (Claude Sonnet) — 5 tools: facility query, inventory fetch, NIOSH lookup, distance calc, auth check. Chemical inventory held in Flask RAM only, never written to disk.

CERS + HazmatIQ

Facility lookup mashup with CERS, NIOSH & ERG data

Industrial Cybersecurity, Intelligence & Analysis

Glasswall

StackVanilla JS · single HTML file · no build step · renders an immutable ASM snapshot (schema 1.0.0) from a static JSON artifact · dark control-room UI

TrustEvery panel tagged by provenance tier — MEASURED (direct check), CORRELATED, DERIVED (agent-summarized), ASSERTED (operator) — so briefing claims are traceable to source

Checks10-check ASM suite — GitHub repo inventory, Shodan external surface, Tailscale private net, Cloudflare infra, typosquatting + DNS integrity, domain/SSL expiry, GitHub Actions + fine-grained PAT expiry — each with severity + delta

PanelsExecutive Briefings (agent:asm-briefing) · VulnOps Stats · Security Posture with standing drivers + operator attestation · snapshot freshness banner

Glasswall

A dynamic continuously updated hypershell for ASM Review, VulnOps Review, Market Research and Analysis Briefings, and more

PartsTracer

StackReact 18 / TypeScript / Vite · d3-force 3 (SVG graph, drag-to-pin, phyllotaxis seeding) · MapLibre GL 4.7 (component-origin heatmap) · Zod 3 (runtime validation + JSON Schema export) · Hono backend + Anthropic SDK · Docker + Nginx + Caddy + Ansible

ModelDirected versioned graph — 6 node types (platform, component-supplier, integrator, parent-holding, investor, state-actor) × 4 axes (ownership/control, manufacturing/supply chain, regulatory exposure, data & security) · 11 edge types · every claim is Claim<T> with confidence, sources[], Zod-rejected if uncited

AgentClaude Opus 4.8 — 4 read-only graph query tools (query_entities, get_entity, find_shared_dependencies, list_research_gaps) · strictly read-only, prompt-injection guarded

ResearchBatch workflow: 172 seed nodes → 58 batches of 3 → Claude web research → adversarial verify → Zod-gated integration → auto-stub → git commit. validate.ts as CI gate; check-rejections.ts proves schema enforces citation.

PartsTracer

UAS ecosystem provenance & supply chain intelligence dependency graphs

Firmware Integrity Analysis Tool 10.2

StackVanilla JS · single HTML file · no build step · fully client-side — files are read in the browser sandbox and never uploaded · drag-and-drop + file picker · monospace report UI

HashingWeb Crypto (crypto.subtle) SHA-256 / SHA-512 / both · streamed file read with live progress · localStorage hash cache keyed on name|size|lastModified, bounded to 30 entries with oldest-first eviction

DetectionBinary-vs-text heuristic (>30% non-printable) · magic-byte compression sniffing (gzip, xz, lzma, bzip2, zip, squashfs, cramfs) · Cisco TLV markers (CW_IMAGE, BOARD_, IOSXE → IOS-XE IR1101 ID) · product codename flags

ReportExtension/MIME/content consistency scoring (high/medium/low confidence) · 128-byte hex + ASCII header dump · first-16KB visible-ASCII extraction · JSON report export

Firmware Integrity Analysis Tool 10.2

Client-side firmware hashing, file-type confidence scoring & provenance markers

KEV Reactor

StackVanilla JS · single HTML file · Canvas2D particle physics — no build step, no backend, no framework · renders the CISA Known Exploited Vulnerabilities catalog (v2026.06.29, 1,630 CVEs) bundled as a static snapshot

MetaphorExploit-chemistry engine — each CVE is a charged particle, each CWE weakness type a colored "element", each vendor a gravity well · dateAdded sequence is a timeline you can play forward or reverse

Modes4 force fields — Vendor Nuclei, Weakness Spectrum, CVE Strata, Free Plasma · 9 CWE element families (memory corruption, injection, web, path/file, auth, deserialization, disclosure/SSRF, crypto, other) · mouse field, search/isolate, impact & ransomware lenses

LiveCISA feed sends no CORS header, so a Cloudflare Worker proxy (kev-reactor-proxy.lockhorsegroup.com — CORS + trim + edge-cache) re-emits the feed for the optional Live toggle · falls back to the bundled snapshot

KEV Reactor

CISA Known Exploited Vulnerabilities catalog as a living particle field

Mapping & Intelligence

Minspectre

StackMapLibre GL JS 4.7.1 · Vanilla JS (~11 modules) · Claude API direct browser access (claude-sonnet-4-6, streaming tool-use) · Cloudflare Workers · no backend

DataUSGS mrdata (MRDS deposits), USGS NGDB/NURE (stream sediment geochem), BLM NLCS/SMA + CadNSDI (land status + PLSS), USGS SGMC2 WMS (geology), ASTER (hydrothermal alteration), NHD Plus HR (hydrology), USFS MVUM (roads), 3DEP/AWS Terrarium (terrain)

AgentGeoSpec (Claude claude-sonnet-4-6) — 4 tools: get_map_state, get_deposits_in_view, get_geochem_in_view, get_geology_at_point (Macrostrat). Up to 5 agentic rounds per query.

ScoreCatchment-level weighted prospecting score (0–100): A/B deposit (40pts), geochem anomaly (25pts), C prospect (20pts), open BLM land (15pts), D/E records (10pts)

Minspectre

Mineral resource mapping and planning tool

Trackchart

StackMapLibre GL JS 4.7.1 · PMTiles 3.2.1 (HTTP Range, no tile server) · Overpass API (abandoned rail, live zoom≥9) · USGS/EIA ArcGIS FeatureServers (energy, zoom≥7) · Vanilla JS ~1,260 LOC · Cloudflare Pages + R2 + Zero Trust OTP gate

DataFRA NARN API → 302,743 LineStrings (narn.pmtiles, 69MB) + trainorders.com 213 KMZ community archive → 365,449 historical features (historical.pmtiles, 44MB) = 668K+ total features

BuildPython stdlib only (no GDAL) — custom KML 2.2/2.1 parser (nested folders, CDATA, altitude stripping, status + polygon-size heuristics); tippecanoe z0–z10 --drop-densest-as-needed

CategoriesClass I current (UP/NS/BNSF/CPKC) · 69 fallen flags (AT&SF/PRR/NYC/SP/B&O) · shortline/regional · logging (147K lines, dense SE/Great Lakes) · 58 state maps · specialty

Trackchart

Industrial transportation and critical infrastructure map

SkyAtlas

StackAladin Lite v3 (CDS Strasbourg — WebGL + WASM, HiPS tile streaming) · Vanilla JS · 428 lines single HTML file · no backend · Cloudflare Pages or local disk

Surveys30+ HiPS datasets — optical (DSS2, DESI, DECaLS, Euclid, PanSTARRS), UV (GALEX), Hubble (HLA), IR (2MASS, WISE, AKARI), radio (HI4PI, CHIPASS), X-ray (XMM-Newton, Fermi) · 4 projections (gnomonic/Aitoff/Mollweide/Lambert)

FOVDraggable/rotatable FOV box as CSS-transformed DOM div (not Aladin overlay) · sized via thin lens formula · sky↔pixel conversion manually implemented (linear approx + cos(dec) RA correction, sub-pixel accurate at FOV < 5°)

PresetsTelevue TV-102 + ZWO ASI2600MC Pro, C8; Hubble ACS/WFC3; JWST NIRCam/MIRI; Vera Rubin/LSST; Subaru HSC. Night mode via CSS custom property swap at :root.

SkyAtlas

Real-time sky atlas for celestial survey intelligence and analysis

Monitoring

Firebot Labs Fleet Monitoring

StackGrafana dashboards backed by VictoriaMetrics (time-series store) · metrics fed by Telegraf · OMD Labs (Nagios/Thruk) for service-check state · Caddy/Tailscale exposure

DeployFully provisioned + maintained through the ansible_monitoring playbooks — Grafana, VictoriaMetrics, Telegraf agents and OMD sites all managed as code

DashboardOMD Labs fleet service health — sites reporting, unhealthy/critical/warning/stale counts, total services · per-host fleet hex grid (hover → services, click → Thruk) · live Problems table

SignalsSuperimposed service-check execution time across SRS · Caddy 4444 · EMQX (MQTT/MQTTS/dashboard) · TLS certificate checks — 6h window, 1m refresh, VictoriaMetrics datasource

Firebot Labs Fleet Monitoring

Grafana fleet service-health monitoring across OMD Labs sites

brokermon: camden-edge-2

StackBun · Hono · React 19 / Vite 7 / Tailwind 4 / jotai · valibot · bun:sqlite (WAL) on a persistent volume · one hardened rootless-podman container (read-only rootfs, cap-drop=ALL, no-new-privileges, non-root), Quadlet unit, deployed by ansible

WitnessAuthenticated mqtts:8883 client subscribed to the whole DJI Cloud API topic tree, recording every message to SQLite · never publishes: the client is wrapped to expose only subscribe/receive, enforced by a startup assertion and a unit test · the record survives container replacement, which is the point (the fs10 flight evidence was lost when logs and Postgres wiped on boot)

ViewsLive dock/drone state coalesced from partial osd/state deltas, with per-field change pulses and sparklines · broker view (topic tree, message rates, clients, $SYS) · tid request↔reply and bid whole-operation correlation · schema baselining to diff structure across generations and firmware

DetectDock generation and aircraft model derived from the live OSD (sub_device.device_model_key), not asserted: M3TD/Dock 2 = V2, M4TD/Dock 3 = V3, verified against live traffic · schema drift against the documented Dock-2 baseline surfaces unpublished Dock-3 behavior (this host: V2, M3TD)

SecuritySurfaces credential and control material on the wire for detection (drc_mode_enter creds, device_secret/nonce, object-store tokens) · token-gated UI over HTTPS/WSS · optional in-window BYOK agent, gated default-off and off on every edge host, key held in the browser and never on the edge · in-app reference overlay with an architecture diagram and operator-oriented DJI MQTT docs, rendered without dangerouslySetInnerHTML