Every space-resource business plan eventually reduces to one question: what does it cost to move a kilogram from where it is to where it is worth something? Rockets pay for that movement in propellant, and the Tsiolkovsky rocket equation makes the price exponential. Each additional unit of velocity change requires disproportionately more propellant, and that propellant must itself be lifted. The result is a vehicle that is mostly fuel, with a payload fraction of a few percent.
This shapes what is worth hauling. Ore returned to Earth's surface has to compete with terrestrial supply, so only very high-value material, such as platinum-group metals or samples, can plausibly justify the trip. Water, oxygen, metals for construction and radiation shielding are different. They are valuable in space, because they replace mass that would otherwise be lifted out of Earth's gravity well. Much of space logistics is therefore in-space trade between a mine, a processing site and a customer in orbit. The Earth-return leg is the exception.
Three other constraints recur throughout this chapter. Time is not free: transfers take weeks or months, and capital tied up in cargo in transit earns nothing. Opportunities are periodic, since launch windows and transfer geometries repeat on fixed cycles. Finally, cargo is hard to inspect once it is moving, so its identity and quantity must be established by records that travel with it.
WIA-SPACE-008 Phase 3 does not model trajectories or hardware. It defines how messages about cargo, such as manifests, transfer commands, custody changes and depot status, cross trust boundaries between organizations. Its four roles map onto a cargo chain directly. A mine or tug is typically a Producer that emits only well-formed, signed and authorised messages. A depot, port authority or buyer is a Consumer that validates, authorises and audits each item it receives. An Authority issues the credentials and attestations that let a counterparty trust a message, and maintains revocation lists. An Operator runs the deployment and watches its health, capacity and compliance posture.
The rest of the chapter takes each transport concept in turn (orbits, return, elevators, launchers, depots, freighters, sails) and shows which protocol obligations it exercises. Where the standard is silent on something physical, the text says so rather than inventing a data field for it.
Mission planners express the cost of any manoeuvre as delta-v, the required change in velocity. Because propellant mass follows from delta-v through the rocket equation, the delta-v map of the Solar System works as a price list. The figures below are widely published approximations, shown for orientation only.
| Quantity | Approximate value |
|---|---|
| Circular low Earth orbit speed | 7.8 km/s |
| Escape velocity at Earth's surface | 11.2 km/s |
| Escape velocity at the Moon's surface | 2.4 km/s |
| Escape velocity at Mars's surface | 5.0 km/s |
| Low Earth orbit to geostationary transfer | about 3.9 km/s |
The comparison between Earth and the Moon explains why lunar material is attractive for building in orbit. Lifting from the Moon takes a small fraction of the velocity needed from Earth, and the Moon has no atmosphere. Small asteroids are cheaper still to leave, though reaching them can cost more. Delta-v is also asymmetric in practice. Braking into an orbit costs propellant, unless an atmosphere or a gravity assist does the work for free.
The classic minimum-energy route between two circular orbits is the Hohmann transfer, an elliptical arc tangent to both. Between planets the equivalent opportunities recur at the synodic period, and mission designers plot them on "porkchop" diagrams of departure date against arrival date. Slower or faster trajectories are possible, but they cost more propellant or more time. Gravity assists and the Oberth effect, in which a burn is most efficient at high speed deep in a gravity well, further shape the plan.
The consequence for messaging is that many commands are only valid for a bounded interval. A burn instruction issued for one window is wrong, and possibly dangerous, after the geometry has moved on. The Phase 3 message envelope carries two fields that match this need: issued_at, which must be an RFC 3339 timestamp in UTC, and ttl_seconds, a uint32 where 0 means no expiry. A planner that sets a finite ttl_seconds on a departure command lets any receiver discard it once the window has closed, with no separate coordination.
Returning material to Earth means dissipating orbital or interplanetary kinetic energy in the atmosphere. Reentry vehicles use ablative or reusable heat shields and follow a narrow corridor: too steep a path brings excessive deceleration and heating, and too shallow a path skips back out. Successful returns of asteroid and comet material by Stardust, Hayabusa, Hayabusa2 and OSIRIS-REx all used small capsules that separated from the parent spacecraft and descended under parachute for recovery on the ground. Larger production returns would need capsules or lifting bodies of corresponding size, with landing sites chosen for recovery and safety.
The physical return is only half the job. A sample or shipment is useful to a buyer or regulator only if its provenance and integrity can be shown. The protocol's E_INTEGRITY failure code applies here. It is raised when persisted state diverges from its expected hash, and the required action is to quarantine and escalate to incident response. A custody record whose hash no longer matches what was signed at the point of departure is treated as untrusted rather than silently corrected. The standard also requires audit records for every state-changing operation, so a custody hand-off from capsule recovery team to laboratory is a logged, attributable event.
A space elevator replaces rocket launches with a tether from a surface anchor to a counterweight beyond geostationary orbit, along which climbers carry payload. The idea goes back to Tsiolkovsky and was developed by later engineers in the 1960s and 1970s. For Earth, the obstacle is materials: the tether must support its own weight over tens of thousands of kilometres, and no manufactured material has yet demonstrated the required strength at that scale. Carbon nanotubes are the usual candidate, but only as a research target. Other hazards include orbital debris, atmospheric weather at the anchor, and oscillations of the tether.
The Moon is a more forgiving case because of its lower gravity, and concepts for lunar tethers have been studied with existing high-strength fibres. Whatever the body, an elevator would change the shape of the logistics problem. It offers a steady flow of climbers rather than discrete launches, with capacity limited by climber cadence and the tether's load budget. That favours the standard's streaming and event-driven bindings: a climber's progress is a sequence of state transitions that downstream consumers must be able to rebuild from a durable channel, which Phase 3 requires for long-running tasks.
A mass driver accelerates a payload along a track with electromagnetic force. Gerard O'Neill and colleagues demonstrated the principle in the 1970s with prototypes at MIT, in connection with proposals to launch lunar material to orbital construction sites. The Moon is the natural home for the idea. Its escape velocity is low, there is no air to cause drag or heating, and a long track can be built on stable ground. The cost is the electrical power and the large fixed infrastructure, which are justified only by sustained throughput.
A launcher produces cargo in discrete, very similar units, such as buckets of regolith or bulk water ice, and each unit must be caught by a receiver in orbit. Two difficulties follow. The first is catch accuracy, because small errors in release velocity become large position errors over transit. The second is bookkeeping, since thousands of low-value units need to be counted. At-least-once delivery with message_id deduplication, the reliability model of the protocol, suits this tally. Both launcher and catcher can report the same shipment, and the duplicate reports collapse into a single record instead of inflating the inventory.
An orbital depot stores propellant, water or other consumables so that vehicles can refuel instead of carrying the whole supply from the start. This breaks the rocket-equation penalty. A tug need not lift its return fuel from the original surface, and a mine's output can be sold where demand exists. Candidate locations include low Earth orbit, lunar orbits and the Earth-Moon Lagrange points, chosen for access and energy cost. Lunar polar water ice, split into hydrogen and oxygen, is the most frequently discussed in-space source.
The technical hurdles are real. Cryogenic propellants boil off unless actively cooled or shielded. Moving liquid in microgravity requires settling thrust or capillary devices, and connections have to be leak-tight through repeated mating. Propellant transfer has been demonstrated on a limited scale, but routine large-volume service has not. A depot is therefore as much a metering problem as a storage problem: the quantity delivered and the quantity charged must agree, with boil-off losses accounted for explicitly.
A depot is where several of the protocol's failure codes become operational. When more vehicles request service than ports or tanks can handle, the standard's E_CAPACITY code applies. The depot rejects with a retry-after hint and, if saturation persists, pages on-call staff. When the depot cannot reach an upstream telemetry source or pricing service, E_DEPENDENCY_DOWN tells the caller to retry with back-off and run in degraded mode. A malformed fuelling request fails with E_INPUT_MALFORMED and is not retried; E_AUTH_DENIED covers a request from a party not entitled to the tank, and it is logged as a security event.
Back-off behaviour is specified. Senders must honour HTTP Retry-After, gRPC RESOURCE_EXHAUSTED or MQTT flow-control packets, and the recommended schedule is full-jitter exponential back-off capped at 30 seconds per attempt and 5 minutes cumulatively. Jitter matters here because a fleet of tugs that all retry at the same instant after an outage will saturate the depot again.
Uncrewed freighters are already routine for space stations: Progress, the European ATV, Japan's HTV, Cygnus and Dragon cargo vehicles have all delivered supplies. Some dock under automatic control, and others are berthed by a robotic arm such as Canadarm2 after a free-flying approach. These systems show the basic sequence a commercial freighter would follow: approach, hold, capture, hard mate, transfer, and then release. At each stage the vehicle either holds a valid permission or aborts.
For a resource freighter, a handshake at the data level mirrors the mechanical one. The consuming side must validate and authorise what it receives before it accepts the cargo into its books. The producing side must emit only signed and authorised messages. Phase 3 supplies a compact envelope for this, shown below with the opaque body described in prose.
message_id UUIDv4 (receiver deduplicates on this)
trace_id 16-byte hex (W3C Trace Context)
span_id 8-byte hex (W3C Trace Context)
origin_node DNS name or NIN (RFC 1035)
issued_at RFC 3339, UTC
ttl_seconds uint32 (0 = no expiry)
content_type media type (RFC 6838)
body opaque bytes (e.g. a cargo manifest, per content_type)The envelope is deliberately payload-agnostic. A manifest, a docking clearance and a custody transfer can all travel in the same wrapper, distinguished only by content_type. The trace_id and span_id let an operator follow one shipment across tug, depot and buyer without sharing internal identifiers.
A freighter far from Earth is out of real-time reach. Light takes about 1.3 seconds to cross the Earth-Moon distance each way, and between Earth and Mars the one-way delay ranges from a few minutes to over twenty. Links can also drop out entirely when a vehicle passes behind a body or the Sun. Autonomy is thus a necessity of operation, not a luxury, and commands become intents that the vehicle carries out on its own.
The standard's timeout classes were written for ground-side services, and their maximums cannot be relaxed without a waiver.
| Operation class | Default | Maximum |
|---|---|---|
| Synchronous read | 5 s | 30 s |
| Synchronous write | 10 s | 60 s |
| Long-running task | 5 min | 30 min |
| Streaming session | 30 min | 8 h |
| Batch import | 60 min | 24 h |
A Moon-distance round trip fits a synchronous read. A Mars round trip does not fit a synchronous write, so deep-space interactions belong in the long-running-task class, with progress published as events. The standard does not define a space-link protocol. Deployments typically put a delay-tolerant gateway between the vehicle and the ground, and Phase 3 applies at the gateway. Because delivery is at-least-once, a retransmitted burn command can arrive twice. Receivers deduplicate on message_id, and the idempotency contract from Phase 2 gives exactly-once effect when both peers take part. The standard also requires implementations to honour cancellation within the declared timeout window, which lets an operator stop a transfer that is not yet executing.
A solar sail uses the pressure of sunlight on a large, thin reflective film. The thrust is tiny but continuous, and it consumes no propellant. Japan's IKAROS (2010) demonstrated sail flight beyond Earth orbit, and LightSail 2 (2019) demonstrated orbit raising by sail in Earth orbit. NASA's NEA Scout planned to use a sail to visit a near-Earth asteroid. A sail cannot launch from the ground, since the thrust is far below a vehicle's weight, and it works best where sunlight is strong and drag is nil. Steering is by tilting the sail relative to the Sun, which limits the geometries that are possible.
Sails suit cargo that can wait: bulk, low-urgency and tolerant of long transit. The logistics consequence is a long-running task with a very long lifetime and a continuously changing state, which is where the standard's rule on state-transition events matters. A sail's slow spiral is published to a durable channel, and any consumer that joins late can rebuild the picture rather than rely on having been present. The standard's streaming-session class tops out at 8 hours, so sail-length journeys are modelled as a chain of tasks and events, never as one open connection.
Optimizing a transport network means choosing routes, vehicles and schedules jointly. Planners commonly use time-expanded network models in which each node is a place at a time and each arc is a feasible transfer with a mass capacity and a cost. Periodic structures add leverage: a cycler trajectory, such as the Aldrin cycler concept, keeps a vessel on a repeating Earth-Mars path so that smaller taxis do the end-point work. Buffers matter too. A depot with stock on hand absorbs the delays of a supply chain whose timing the physics dictates.
The standard supplies the plumbing, not the optimizer. It does fix the transport bindings a planner can assume.
| Binding | Port | Natural logistics use |
|---|---|---|
| HTTP/2 + TLS 1.3 | 443 | Public request-response, such as a buyer querying a manifest |
| HTTP/3 (QUIC) | 443 | Lossy or mobile links |
| gRPC | 443 | Service-to-service between planner and depot systems |
| MQTT 5.0 | 8883 | Constrained devices such as tank sensors and climbers |
| AMQP 0-9-1 | 5671 | Backplane and event streams between operators |
An operator that wants to claim L3 conformance must interoperate over at least one of these bindings and publish its conformance report. Security at this layer is concrete: mutual TLS between services with certificates rotated at most every 90 days, caller tokens of 15 minutes or less bound to the caller's network identity, sensitive fields encrypted with per-tenant keys in an HSM, and audit logs replicated to write-once storage within 60 seconds.
The physics of moving mass sets the shape of every business in this field. Delta-v and the rocket equation make Earth's gravity well the dominant cost, so material tends to stay and be used in space. The mechanisms above divide the problem: elevators and mass drivers offer continuous flow, depots decouple fuel supply from the vehicle, autonomous freighters and sails trade speed for propellant savings, and return capsules deliver the high-value minority of cargo to the ground. For each, Phase 3 contributes a common vocabulary of roles, an envelope, deterministic failure codes, bounded timeouts and an event trail that lets independent parties agree on what moved, when, and under whose authority.
That last question is not technical alone. A shipment that leaves one jurisdiction's control or crosses a sovereignty boundary raises issues of ownership, licensing and permitted export that no timeout table can settle. The next chapter takes up that legal side: who may extract and transfer space resources, what obligations follow them, and how the records described here serve as evidence.