The marketplace

Most organizations that want an answer from orbit do not want to run a flight-software project to get it. The marketplace lets a developer publish an application once and a customer order a result without seeing a partition, a manifest, or a contact window.

Space Store is the share component of the Parsimoni Platform. It is a hosted service and is not required for local development or for an operator deploying to their own fleet.

Maturity

The publishing and ordering flow has been demonstrated end to end. It is a demonstration rather than a live commercial service.

Publishing and ordering

Publishing. A developer who has already packaged an application with Space CLI publishes it once and declares which architectures it supports. Space Store hosts the multi-architecture OCI artifacts and lists the application in the catalogue. There is no separate marketplace build: the artifact the developer tested locally is the artifact that gets listed, because both are the same signed OCI image resolved by digest.

Publishing consists of a release build followed by a push to a hosted context:

space build . -t ghcr.io/<your-org>/fire-detect:1 \
  --release --signing-profile release
space push ghcr.io/<your-org>/fire-detect:1

Build once per architecture you intend to support, or build a multi-architecture image; space build records the variants in one OCI index and the scheduler picks the one matching the target it selects.

Ordering. A customer browses the catalogue, picks an application, draws an area of interest on a map, and places the order. The Platform schedules the workload onto a satellite whose orbit covers that area, runs it in an isolated partition, and returns the result on a later contact.

An order runs when a satellite that can see the area has the power, the compute, and a contact window to send the result back. The order is durable because the next window may be hours away.

What gets published

A catalogue entry is a signed OCI artifact. Existing Earth-observation models have been packaged into the workflow rather than rewritten for it:

Application	What it does	Runs on
Fire detection	Segments active wildfire fronts from the infrared bands of a Sentinel-2 scene	FPGA
Ship detection	Locates vessels in a scene for maritime monitoring	CPU
Satellite detection	Detects and isolates objects in orbit imagery	CPU
Scene tiler	Splits large scenes into tiles that feed the detectors	CPU

An application that needs an FPGA is scheduled only onto a target whose profile grants one.

Publisher authority

A published application is not more trusted than a locally built one. It travels through the same admission path: a digest committed in a signed TUF bundle, verified on the node against a pinned root with no network. Marketplace publishing uses scoped sub-authorities under the targets role, limited by application identity, architecture, and release namespace, so a publisher can sign their own application and nothing else.

A third-party application runs under a resource limit the satellite operator issued, which caps its services, memory, CPUs, storage, and network reach. An order cannot raise that ceiling.