Satellite operators often face a terrifying reality: a power system failure in low Earth orbit’s shadow may go undetected until the next ground pass, leaving only minutes to act. Penumbra, a new mission control system built for a fleet of 24 satellites, addresses this latency by deploying a Gemini-powered AI agent that diagnoses faults and proposes recovery plans. However, the system’s core innovation isn’t the agent itself, but the rigid verification layer that prevents any unvalidated command from reaching hardware.

The Physics Gatekeeper

Penumbra operates on a strict 'verify-first' architecture. When the Gemini agent suggests a recovery plan, it doesn’t just execute the command. Instead, a physics simulator tests the proposed plan against every plausible cause that fits the telemetry data. Only if the plan passes this simulation does it move to a human approval stage. The system enforces a hard rule: nobody can approve a plan that failed verification, including the AI agent itself. This design choice reflects a mature understanding of AI limitations in safety-critical environments.

Weekend Build, Real Orbits

Created during UB Hacking 2026 in Buffalo, the project leverages real orbital mechanics data from Skyfield to compute eclipses and ground passes, ensuring the simulation environment mirrors physical reality. While the power data and injected faults are simulated for the demo, the orbital parameters are accurate. The team, consisting of two human developers and four AI coding sessions (two Claude Code, two Codex), shipped 48 issues in under 24 hours. The backend utilizes NumPy for parallelized power modeling and OR-Tools CP-SAT to schedule uplinks without station conflicts.

Handling AI Hallucinations

The developers encountered specific challenges with Gemini’s output stability. The model frequently attempted to include raw numbers in its narration, which caused formatting errors like repeating units (e.g., '0.30 km km'). To fix this, the team implemented a placeholder system where the backend injects real values into the agent’s text, preventing the LLM from generating unstable numerical data directly. Additionally, the free tier’s rate limits (five requests per minute) were insufficient for complex incidents requiring seven to thirteen calls, forcing the team to implement a fallback to recorded runs for public demos.

Key Takeaways

  • Verification over automation: The system prioritizes safety by blocking AI-generated commands that fail physics simulations.
  • Hybrid workflow: Real orbital data (Skyfield) combined with simulated fault injection creates a robust testing environment.
  • AI-assisted development: The team used four concurrent AI coding sessions to manage folder ownership and issue resolution.
  • Deterministic replay: Rounding timestamps to whole seconds resolved floating-point inconsistencies between local and CI environments.

The Bottom Line

Penumbra proves that the most valuable part of an autonomous agent isn't the intelligence, but the cage around it. By refusing to let the AI approve its own failed checks, the system sets a new standard for trustworthy autonomy in aerospace.