Don't build a phone. Make a good one do everything.
The whole stack already runs on a rugged commercial Android phone — because the differentiator is the software, not the handset. The phone is the End User Device (display, input, ATAK, the app); the TOC box is the base station (compute, relay, HF, TAK server, power). This is exactly how the field does it — the military runs ATAK on commercial Samsung phones as the EUD. No custom silicon, no certification, no lock-in.
01
Recommended handsets
Any modern Android works; a rugged, IP68 / MIL-STD device with a programmable button earns its place in the field. Pick one and standardise on it.
Handset
Why
Notes
Samsung Galaxy XCover (6 Pro / 7)
Rugged, removable battery, programmable XCover key, huge ATAK track record
The de-facto ATAK EUD. Best default.
Ulefone Armor (24-series)
IP68/69K, very large battery, some models add a built-in DMR/LoRa radio
Big battery = long field days.
CAT S‑series / Sonim XP
MIL-STD-810, glove-friendly, loud PTT
Toughest; smaller ecosystems.
Pixel (for a de‑Googled build)
The only phones that run GrapheneOS cleanly
Not rugged — needs a case. Best privacy posture.
Privacy option: a Pixel on GrapheneOS gives a hardened, de‑Googled EUD — sandboxed or no Google Play, verified boot, per‑app network control. Trade‑off: it isn't rugged, so it lives in a case. For most site work a Samsung XCover is the pragmatic pick.
02
The setup — what to install
A one-time build. Do it once per device, then image the rest.
Install the app. Open satisomnibus.com in Chrome → menu → Install app / Add to Home Screen. It's a proper PWA — installs like an app, works offline, and receives hazard push (no App Store, no review). The console, map, Early Warning and dashboard all live here.
ATAK (CivTAK). Install ATAK from tak.gov (or Play). Point it at your self‑hosted TAK server on the box; our Aquilla and drone CoT bridges feed tracks straight in.
Offline maps. Import the ready‑made source pack from the Field Maps page (lawful, cacheable sources) and pre‑cache your area of operations.
Meshtastic. Install the Meshtastic app and pair it over Bluetooth to your LoRa node. Apply the safe defaults from Comms Security (rotate off the default key, position/telemetry off).
Secure comms. Signal (or Session) for person‑to‑person; the crypto field sheet and rolling‑key scheme live on Comms Security.
GPS & location. Leave it opt‑in. The Early Warning layer ranks by your position only when you tap "My location" — computed on‑device, never sent.
03
What pairs, and how
The phone is the hub for what a phone does well; everything else clips on over a standard link.
Peripheral
Link
Role
Meshtastic LoRa node
Bluetooth
Off‑grid text/position beacon; ATAK messaging over mesh.
HaLow / Wi‑Fi backbone
Wi‑Fi
Join the box's HaLow AP for ATAK‑over‑multicast, PTT, video.
RTL‑SDR (ADS‑B / RDF / scanning)
USB‑C OTG
Passive receive only — aircraft, signals awareness. Add‑on, not core.
HF radio (IC‑705 etc.)
via the box
Winlink/JS8 long‑haul lives on the box, not the phone.
Starlink / cellular
Wi‑Fi / SIM
Backhaul when available; the app degrades gracefully without it.
04
Box vs phone — the division of labour
Keep the heavy, power‑hungry, licensed, and always‑on parts on the box; keep the phone light and replaceable.
📱 The phone (EUD)
The app — console, map, Early Warning, dashboard (PWA)
ATAK display & input; marks, chat, the picture
Meshtastic app (BLE to the node)
Opt‑in GPS; secure person‑to‑person comms
Cheap, rugged, replaceable — lose it, grab another
▣ The box (base station)
Compute & local AI (Ollama), the research/trading engines
Self‑hosted TAK server; the CoT bridges
Mesh backbone (HaLow) + relays; HF radio (Winlink/JS8)
Power (LiFePO4 + solar); storage; backhaul routing
Rolling‑key crypto, keyless relays, the hardening defaults
05
The "Consilium field phone" — a bundle, not a build
If there's demand, package it — never fabricate it.
What it is: a rugged commercial Android, optionally de‑Googled (GrapheneOS), pre‑loaded with the whole stack — the PWA, ATAK, Meshtastic, offline maps, the comms‑security defaults — shipped ready‑to‑run with a kit.
Why it's fine: it's assembly of commodity parts — zero silicon, zero certification, zero lock‑in. The same move as an "ATAK‑ready" phone vendor.
What we will not do: design a phone. Modems, basebands, antennas, EMC and type‑approval per market are a multi‑year, multi‑million trap that adds nothing our software doesn't already give a $400 handset.
The discipline: validate demand with real operators first; this is a Consilium (Track‑B) SKU, and the FMA licence stays the priority.
Comms Security & Cryptothe defaults to load on every deviceOpen ↗
Build one "golden" device to the checklist above, then replicate it. Two paths: manual clone for a handful, or an MDM for a real fleet.
Build & verify the golden device. Do section 02 once. Confirm the PWA opens offline, ATAK pulls tracks from the box, Meshtastic pairs, and maps render with no signal. This is your reference image.
Write the device manifest. Record exactly what's on it: app list + versions, the ATAK server address, the map extent cached, and which config is shared vs per‑device. Shared = the Ops channel + maps. Per‑device = the device name, the operator, and any keys that must stay unique.
Clone the comms config the fast way. Meshtastic: export the channel as a QR / URL and scan it on each handset — instant, identical keying. Never put a private channel key on a node you'll leave unattended (that's a relay, not an EUD). ATAK: export a data package (preferences + maps + markers) and import it on each device.
Copy the heavy bits over Wi‑Fi/USB, not radio. Map caches and ATAK data packages are big — move them device‑to‑device on the box's Wi‑Fi or by cable. Never push a multi‑GB tileset over a weak mesh link.
Install apps repeatably. Keep an adb install list (or an MDM app‑push) so every device gets the same APKs. The PWA is the one manual step per device: open the site → Add to Home Screen (it can't be side‑loaded as an APK).
Lock it down before it leaves. Screen lock + biometric, full‑disk encryption confirmed on (default on modern Android), auto‑updates set to your policy, and a remote‑wipe / kill plan registered for every device (Find My Device, or the MDM). Full‑disk encryption is what makes a lost handset a non‑event.
Label & inventory. Asset‑tag each device, log its name, assigned operator and IMEI, and keep a spare imaged and charged. Losing an EUD should mean "grab the next one," not "we're compromised."
For a real fleet, use an MDM. Android Enterprise (zero‑touch enrolment) or an open‑source manager like Headwind MDM lets you enrol a device by QR, push the exact app set + config, and remote‑wipe — imaging becomes "scan and go." Overkill for three phones; essential for thirty. GrapheneOS trades this convenience for hardening: each device is set up individually, scripted over adb.
Don't clone what must be unique. The shared Ops channel and maps are fine to copy; per‑node PKC keypairs are generated on‑device and should stay unique, and the one‑time‑pad material is distributed in person, never imaged. Clone the setup — not the secrets that identify or protect a single node.