Tower→Air→Edge

End-to-End

Ontology & Shapes (OaaS)

  • Context: schemas/contexts/ucls-endpoint-context.jsonld now includes BroadcastSite, BaseStation, Antenna, RFLink, SpectrumBlock, plus geo (lat/lon/alt), tech (NR/LTE/Wi-Fi/BLE/GNSS/SATCOM), and IDs (gnbId/enbId/tac/pci/nrArfcn, ssid/bssid).
  • SHACL:
    • BroadcastSiteShape.ttl — site code, coordinates, regulator/license.
    • RFLinkShape.ttl — freq range, tech, RX/TX levels, timing bounds.

Policy Packs (ValaaS) + Gates

  • RF-Emissions-Policy@1.0.0 — license validation (FCC/Ofcom-style IDs), emission mask by tech, EIRP/ERP safety envelopes.
  • Spectrum-Policy@1.0.0 — band-plan selection by locale (CLDR→regional allocations), flags out-of-band.
  • Broadcast-Site-Policy@1.0.0 — sanity on geo/antenna (azimuth/tilt/gain) for macro sites.
  • Gates:
    • gate:rf-link (fail-open + PRaaS escalation).
    • gate:broadcast-site (fail-open + PRaaS).

Adapters (InteropaaS)

  • adapters/sdr-collector/ — SDR IQ/PSD → RFLink (NR/LTE/Wi-Fi/BLE/GNSS), with site/endpoint edges.
  • adapters/cellmapper-adapter/ — operator/NMS exports → BroadcastSite/BaseStation (azimuth/tilt/gain, band, ARFCN, IDs).
  • adapters/wifi-collector/ — controller telemetry (RRM/DFS) → RFLink + site records for APs.
  • adapters/bt-collector/ — BLE adv scans → RFLink (manufacturer hashes).
  • adapters/satcom-collector/ — gateway/NOC summaries → RFLink + ground-station BroadcastSite.
  • adapters/gnss-collector/ — receiver locks/ephemeris pins → RFLink (GPS/Galileo/BeiDou/GLONASS).

These sit beside your existing android-parser, net-collector, and powerlink-collector, so every path—grid→site→air→IP→domain→app—is covered.

Telemetry & Dashboards

  • ClickHouse (appended in telemetry/clickhouse_schema.sql):
    • rf_links_ch(link_id, endpoint_id, site_id, tech, band, freqFromMHz, freqToMHz, rxLevelDbm, txPowerDbm, out_of_band, license_valid)
    • sites_ch(site_id, siteCode, regBody, licenseId, lat, lon, alt, azimuth, tilt, gainDbi)
  • Grafana (dashboards/ucls-observability.json) adds:
    • RF Links (ClickHouse) — live table of air links.
    • Broadcast Sites (ClickHouse) — inventory with licensing/geo.

Samples you can load

  • samples/rf-and-sites.json — example NR/LTE/Wi-Fi/BLE/GNSS RFLinks and two BroadcastSites (macro & AP).
  • Your handset sample remains at samples/mobile-endpoint-s918u-2025-07.json, and we already tied its network/Power/Domain links.

How “everything that broadcasts or receives” is unified

  1. Power → Site: PowerLink traces substation→meter→rack→PSU→radio. Provenance is signed (ProvAaaS), and safety/standards checked at the Power-Chain gate.
  2. Site → Air: BroadcastSite + RFLink encode where/what/how (geo, license, band, ARFCN/PCI, SSID/BSSID, beam). Spectrum-Policy ensures legal band use per locale.
  3. Air → Network: RF links correlate to AddressLink (IPv4/IPv6/MAC), DomainLink (IDN/ICANN bundles, DNSSEC/CT/DMARC), and back to controller proofs (LEI/ORCID/DID) for same-controller sets.
  4. Every endpoint (phones, laptops, IoT) enters via the Mobile-Endpoint or a sibling device shape; compliance gates enforce attestation, patch currency, and locale script allowlists.

SLOs & alerts worth watching

  • Out-of-band rate (must be 0), missing-license rate (0), RPKI invalid contact rate (0), RDAP p99 ≤ 300 ms, Patch currency p95 ≤ 30 days.
  • Provided Prometheus rules slot into your existing alerting; ClickHouse retains posture facts for forensics.

Drop-in run

cd /mnt/data/ucls-dns-packs/adapters
docker compose up -d
# Add Grafana data sources (PROM_DS, CLICKHOUSE_DS) and import dashboards in /dashboards

Key terms in plain language

Open a term for a concise explanation of language used on this page.

Fiber Internet

Internet delivered through strands of glass using light. Fiber commonly supports high capacity, low latency, and strong upload performance, but availability must be confirmed for the exact address.

Cybersecurity

The practices and controls used to protect identities, devices, networks, applications, and data from unauthorized access, disruption, or manipulation.

Zero Trust

A security model that does not automatically trust a user or device because of its location. Access is continuously verified and limited to what is necessary.

SASE

Secure Access Service Edge combines networking and security capabilities in a cloud-delivered architecture so users and locations can receive consistent policy wherever they connect.

Identity and Access Management (IAM)

The systems and policies that determine who a user is, what resources they may access, and how that access is authenticated and reviewed.

Multi-Factor Authentication (MFA)

A login control requiring more than one form of verification, such as a password plus an authenticator app, security key, or biometric factor.