Flight Studio

The safety boundary comes first

Flight Studio produces simulation and engineering-screening estimates. It is not flight control, not launch authorisation, not legal advice, not airworthiness approval and not certification. It has no physical-vehicle transport, no arming, no firmware flashing, no live command and no mission-upload surface at all. Bundled demonstration data is illustrative or explicitly maturity-labelled.

That boundary is not a disclaimer page visited once. It is rendered on the project hub, pinned in the footer of every screen — “Local-First · Simulation Only · Not Flight Control” — stated in the README, and written into the header of every artifact the tool exports, including the Pre-Flight Brief that closes with “not launch authorization or a safety certification”. A simulation output that escapes into a real launch decision without its provenance attached is the failure mode that matters in this domain.

Four vehicle classes, one solver surface

Model rockets, multirotors, fixed-wing aircraft and VTOL share the integrator, telemetry contract and screening disclaimer in src/engine/solvers/shared.ts and diverge only at the force model — fixed-wing.ts, multirotor.ts and vtol.ts beside the original rocket core. Around that surface sit the multiphysics labs (src/engine/multiphysics: planar-channel flow, linear truss, structural dynamics, electro-thermal), airfoil polars and a Prandtl lifting-line wing screen, a control-system lab and a sensor estimator. Every trajectory ships with Monte Carlo uncertainty bands — the brief reports P10, P50 and P90 apogee next to the nominal run.

The frontend renders trajectories, stability margins and envelope screening in WebGL2 (src/webgl-flight-scene.tsx, with the replay and assembly-inspection viewports carrying their own GLSL programs). The same React 19 / Vite build runs as an offline-capable PWA — a hand-written service worker registered through src/platform/service-worker-coordinator.ts — and inside Tauri 2, where the flight-studio-native Rust crate holds the allowlisted IPC boundary. That crate also carries the heavy solvers: a solid FEA suite (linear, buckling, modal, thermal-stress, heat-conduction and load-path modules), planar-channel CFD, an automatic solid mesh kernel, and GeoTIFF/MBTiles terrain for offline world data.

Reproducibility as a feature

Every run writes a content-addressed artifact in src-tauri/src/storage.rs — inputs, solver version and outputs hashed together with SHA-256, atomically deduplicated and verified on read, so an identical run resolves to an identical address and a changed assumption is visible as a changed hash. Metadata lives in SQLite through rusqlite, and jobs.rs persists execution checkpoints so an interrupted solve can be recovered automatically.

A Review Pack bundles a run with its inputs and signs it locally with an Ed25519 key (src-tauri/src/review.rs). Private keys sit behind DPAPI at rest, portable backups use Argon2id and XChaCha20-Poly1305, and a per-project policy can require one to four trusted approvals before Review Complete unlocks — browser-created reviewers are explicitly untrusted and never count. Self-asserted signer identity claims are integrity-bound to the signed payload and labelled “Not Independently Verified” wherever they render, so a result handed to someone else arrives with a verifiable statement of exactly what produced it and no claim about who vouched for it beyond what the keys prove.

A screening estimate that escapes into a real launch decision without its provenance attached is the failure mode that matters in this domain. Every number this tool emits carries the assumptions that produced it.