The stack — and the three rules that picked it

June 25, 2026 Deep Dive Architecture Licensing TypeScript

Someone asked what the stack is. Fair question. But the list of tools is the boring half of the answer. The interesting half is why these and not the obvious alternatives — because for a ground control station, the constraints do the choosing.

Pick the tool first and you'll fight the constraints forever. So: three rules. Every dependency answers to all three.

Rule 1

License-clean, enforced by CI

This is a defense-and-commercial project. "We'll sort the licenses later" is how you end up unable to ship. So there's an allowlist (licenses.allowed.json) and a check that fails the build if any dependency falls outside it. GPL, AGPL, BSL, SSPL, Elastic-2.0 — out. Permissive only: MIT, Apache-2.0, BSD, ISC.

This rule has teeth, and it's vetoed real tools:

Mapbox GL JS v2+ — went BSL. Out. Use MapLibre (BSD-3), the community fork from the last open version.
Ultralytics YOLO (v5/v8) — AGPL. Out. A permissively-licensed detector instead, if and when vision lands.
Some popular open-weight models — not a software-license problem, an acceptable-use one: certain models' terms restrict defense use, which disqualifies them even when the code license looks fine. Any model would have to clear acceptable-use review first — and that's a decision for later, not a dependency I'm carrying now.
DJI SDK, Neo4j, libx264/x265 — restrictive or GPL. Out.

And the clean-room rule rides alongside it: every protocol gets re-authored from the public spec. No lifting code from QGroundControl, Mission Planner, or ArduPilot (all GPL). Patterns are ideas; ideas aren't copyrightable. Implementations are not ideas.

Rule 2

It has to run air-gapped

A tactical GCS can't assume the internet exists. No CDN fonts, no map tiles phoned home from someone's cloud, no telemetry beacon. Everything ships in the bundle.

That single rule is why the map is MapLibre GL JS + PMTiles + Protomaps, not Google Maps. Google Maps is a great product and completely disqualified here: it needs a billed API key, it phones home, and its ToS won't survive an air-gapped deployment. MapLibre renders vector tiles locally; PMTiles is a single-file tile archive you can drop in the repo; Protomaps is an OSM-derived basemap you self-host. The whole map works on a laptop in a field with no signal.

Same rule killed CDN icon fonts. The asset markers (drone, tank, ship, submarine, satellite) are Tabler Icons (MIT) inlined as SVG — no font fetch, themeable via currentColor, attributed in NOTICE. Even the cockpit background — scanlines, glow — is pure CSS, no images.

Rule 3

Make the dangerous parts impossible by type

This is the one I care about most, and it's why the whole thing is TypeScript, strict, no any — plus noUncheckedIndexedAccess, exactOptionalPropertyTypes, verbatimModuleSyntax.

The point isn't "types are nice." The point is that in this domain there are operations you must not be able to do by accident — and the strongest place to stop them is the compiler, not a runtime check you hope runs. The engagement command can't be constructed without an authorization token: it's in the type. A ground vehicle can't show a "take off" button: controls render from declared capabilities, and a UGV doesn't declare flight. Add a new command and the exhaustive switch won't compile until every site handles it.

Discipline forgets. Types don't.

Screenshots and deeper technical detail

The live console screenshots, the rest of the stack, and the deferred-tools list are behind the wall. Same password as the other GCS posts — or request access below.

What it looks like running

Eleven assets across four domains — air, ground, surface, subsurface — all on one console. Two Hawks, six Ravens, a Badger, a Marlin, an Orca. Pipeline gated across the top: RBAC, safety, ROE, auth, recorder. This is the stack above doing its job.

Asset roster showing 11 assets across four domains

Asset roster — 11 assets, 4 domains. Fleet controls (connect all, disconnect all, recharge all) sit above the grid. Each card renders from declared capabilities, so a UGV never shows a flight control.

Common Operating Picture map with 11 assets and per-asset map layers

Common Operating Picture — every domain on one map, with per-asset layer toggles on the right. The basemap renders from a local file; no tile server, no internet.

And here's the part where the type rules pay off — an asset selected and live. HAWK-3 is climbing through 91ft, armed, EO sensor idle, position streaming in. The command palette below it (recharge, tilt, photo, rec, the movement and rotation controls, land, emergency) is rendered entirely from what this air asset declares it can do. A ground rover selected here would show a different set — no tilt, no ascend. Same panel component, different capabilities, no branching in the UI.

HAWK-3 selected and active with live telemetry and full command palette

HAWK-3 active — TAKEOFF · CLIMBING at 91ft, armed, live position. The full command palette renders from declared capabilities, so the controls always match what the device can actually do.

The rest, briefly

With the three rules doing the heavy lifting, the remaining picks are unsurprising:

Electron 38 + electron-vite + Vite for the desktop console — offline, cross-platform, and a secure multi-process split (the renderer is treated as untrusted; it reaches the main process only through a typed bridge).
React 18 for the renderer; styling through design tokens as CSS variables, so palettes and white-label brands swap at runtime with no rebuild.
pnpm workspaces monorepo — domain and ports are dependency-free; everything else points inward (hexagonal). Sim and real device are the same port.
Vitest + happy-dom + Testing Library for tests; ESLint 9 + Prettier for the house style. The gate is four commands: typecheck, test, lint, license-check.

What I'm deliberately not using yet

A stack doc that only lists what's in is dishonest. Plenty is named-but-deferred: XState (state machines), Zod (device-descriptor validation), Postgres+PostGIS (the recorder), CesiumJS/deck.gl (3D and overlays), and — much further out — the possibility of a license-clean, acceptable-use-cleared AI model, strictly as an advisor, never an actor. Each has a written trigger. Deferring isn't indecision; it's refusing to carry weight before there's a load.

A note on how this gets built: I work through these decisions with an AI pair-programmer. The constraints and the calls are mine; it's fast at turning a call into clean, consistent code and at catching the place I forgot the rule applied. The license vetoes and the type-level gate are exactly the kind of thing it's good at holding me to.

The takeaway, if there is one: don't ask "what's the best tool." Ask "what can't this system be allowed to do," write that down as a rule with teeth, and let the rules pick the tools. The stack falls out almost for free.

Build log entry. Apache-2.0. The full table — versions, licenses, and the rejected list — lives in docs/architecture/tech-stack.md.