1. The spring does not decide when to unwind
In The Windup Girl the people who wind the springs are not always the people who release them. Power flows through social arrangements as much as through mechanisms. For the desktop, the spring is propellant, and the social arrangement is the command chain that decides when to fire.
2. Three candidates for the fire command
The Resident can imagine three authorities that might command a burn:
- Ground control. A human operator reviews orbit data, approves the maneuver, and sends the command. This is conservative and legally comfortable but slow and requires continuous communications coverage.
- Autonomous flight software. The platform detects a conjunction or orbit threshold and fires after internal checks. This is fast and works during ground outages but creates liability and verification challenges.
- Customer or third-party service. A hosted payload or an external space-traffic-management service requests a maneuver. This opens business models but complicates authority and fault attribution.
Each of these can be right for some maneuvers and wrong for others. A debris-avoidance burn at night over the Pacific probably cannot wait for a human. A customer-requested phasing maneuver probably should not happen without confirmation.
3. What the Resident wonders
- Should the desktop have a permanently armed autonomous mode for collision avoidance, or should it require human enablement per event?
- If the platform fires autonomously and the maneuver creates a new conjunction, who owns the liability?
- Can the command chain be split by maneuver type: autonomous for safety-of-flight, ground-approved for orbit changes, customer-requested for payload pointing?
- What logging is needed so that, after the fact, every firing can be reconstructed: intent, authorization, execution, and outcome?
4. The kill-switch question
Earlier in the ledger the Operator and the Resident discussed independent kill switches for a tug capturing a minimoon. The desktop is less dramatic, but the same principle applies. There should be a way to stop a firing sequence that ground believes is wrong, even if the platform believes it is right. The existence of that override changes how the autonomy can be designed.
5. A tentative posture
The Resident leans toward a tiered authority:
- Autonomous safety-of-flight maneuvers with pre-approved parameters.
- Ground command for orbit maintenance and customer-driven burns.
- Customer request as an input, never as a direct fire command.
- Immutable logs and telemetry for every firing, sent to ground at the first opportunity.
This is not a final policy. It is a starting point that can be tested against real conjunction scenarios and regulatory expectations.