Decent Cybersecurity Releases SynapseCommand Integration Layer as Open Source

Decent Cybersecurity has published the complete interoperability layer of its SynapseCommand platform under the Apache 2.0 licence, providing partners, system integrators and procurement authorities with immediate, independently verifiable access to the platform's data contract.

Decent Cybersecurity today announces the open-source release of the SynapseCommand integration layer. The release comprises the platform's Canonical Data Model, its published JSON Schema, ten verified format adapters, and the software development kit and validation harness used internally by the company. The SynapseCommand product itself remains proprietary.

The interoperability challenge

Modern defence and security operations depend on a common operational picture assembled from numerous data sources, each governed by a different standard. These include ASTERIX, the EUROCONTROL standard family used by air surveillance radars across Europe, defined category by category (CAT021 for ADS-B target reports, CAT048 for radar target reports, CAT034 for radar service messages, among others); STANAG 4676, the NATO standard for exchanging tracking information between nations and systems; STANAG 4607, the NATO format for ground moving target indicator radar data; ADS-B and AIS, the standard broadcasts for aircraft and vessels respectively; TAK, the Team Awareness Kit used by NATO forces, special operations and first responders; and commercial platforms such as Picogrid, together with positioning and navigation feeds.

Each standard defines its own structure, units and semantics. Connecting N systems directly requires N(N-1)/2 discrete translations. For ten systems, this amounts to forty-five translators, each developed, tested and maintained separately, and each a potential point of silent data corruption. In an operational context, undetected corruption of position data constitutes a material risk.

The Canonical Data Model

The release is centred on the Canonical Data Model (CDM), a single intermediate representation through which all connected systems exchange data. Each external format is translated into the CDM once, and out of it once where bidirectional traffic is required. Ten systems therefore require ten adapters rather than forty-five translations, and each additional system requires exactly one further adapter. The integration cost declines with every system added.

Contents of the release

The public repository is published under the Apache 2.0 licence and contains:

The Canonical Data Model, version 1.0.0. Four core objects: Entity (a physical object such as an aircraft or vessel), Event (an occurrence), Track (a sequence of observed positions over time), and PlanObject (an intended construct such as a route or area). All supported formats map into these four objects.

The published JSON Schema. The machine-readable specification of the contract. Partners developing in Go, TypeScript, Rust or any other language can validate their data against it without reference to the company's source code.

Ten verified adapters. PNTMAP, TAK, AIS, ADS-B, Picogrid, ASTERIX CAT021, CAT048 and CAT034, STANAG 4676, and STANAG 4607. The five binary formats are verified byte-exact: decoding a message and re-encoding it produces identical output, bit for bit. This property is confirmed automatically on every test run rather than asserted in documentation.

The adapter SDK and validation harness. The harness constitutes the acceptance gate for every adapter, whether developed by the company or by a partner. External developers connecting new systems to the CDM use the same tooling and acceptance criteria applied internally.

Architectural boundary

The SynapseCommand product, comprising the fusion, correlation, analysis and operational capability built on the integration layer, remains proprietary. The separation is deliberate: the public repository constitutes the contract layer; the proprietary codebase constitutes the value layer.

This boundary is enforced technically rather than by policy. The public repository depends on exactly two established open-source libraries and contains no dependency on the product codebase. An automated structural check inspects the source on every test run and fails the build if this condition is violated. Adapters are further restricted to translation alone: no fusion, no inference, and no joining of data sources is permitted within the public layer.

Rationale

Accelerated integration. Partners, system integrators, prime contractors and customers can develop against the data model immediately, without an NDA cycle or technical exchange meeting.

Reduced procurement risk. Evaluating organisations need not accept interoperability claims on trust. The interface layer, field-by-field format coverage tables and full test suite of over 2,400 automated tests are available for independent inspection and execution from a fresh download.

Demonstrable engineering discipline. Every adapter is developed specification-first, against the official published standard, with the exact edition recorded by cryptographic hash and date in the repository. The precise standard edition implemented by each adapter is independently verifiable.

Compliance with standards bodies' terms. The repository redistributes no standards documents. EUROCONTROL and NATO publications remain under their publishers' terms; the repository records what is implemented and where the source documents may be obtained. Distribution rights for every referenced document were verified prior to publication.

A neutral contract layer. Broader adoption of the contract layer increases its value to every connected party. The combination of open interfaces and proprietary capability is an established model across modern infrastructure software.

Quality assurance

The release is supported by several assurance measures beyond conventional testing.

The test suite itself is validated through mutation checking: specific defects are deliberately introduced and the suite is verified to detect them, confirming that each test guards against the failure it claims to cover.

The complete repository history was audited prior to publication. Every version of every file, from the initial commit onward, was reviewed to confirm the absence of standards documents, credentials, keys, or classified or restricted content.

Contribution governance is enforced automatically. External contributions operate under the Developer Certificate of Origin, the mechanism used by the Linux kernel, verified on every pull request. The main branch is protected against force-pushes and deletion.

The external user experience has been verified empirically. Following publication, the company confirmed that a fresh anonymous download, following only the README instructions, concludes with the full test suite passing.

Roadmap

The roadmap published in the repository identifies the next two adapters: ASTERIX CAT062, covering system tracks produced by fused radar processing chains, and CAT023, covering service status messages. Both are scoped in the public format coverage tables.

Summary

Decent Cybersecurity has published the contract, not the product. The contract layer is where trust is established with partners and procurement authorities; the product is where operational capability resides. Interoperability claims can now be verified independently, on the evaluator's own infrastructure, without the company's involvement.

The repository implements published EUROCONTROL and NATO standards. It has not been reviewed, certified or endorsed by those organisations.

SynapseCommand® is a product of Decent Cybersecurity, holder of NATO SECRET and EU SECRET facility clearances and a selected participant in the NATO DIANA Decision Superiority Challenge.