{ "schema": "cain42.evolution15.proof.v1", "title": "CAIN-42 EVOLUTION-15-PROOF -- Spatial + Physical Autonomous Intelligence Fabric", "generated_at": "2026-09-29T03:03:22+00:00", "commit": "f3d66a02fbac276f2e89a218566d3f1c6a7802a1", "bundle_name": "e15-spatial-physical-intelligence-2026-09-28", "modules": { "e15_spatial_physical": { "path": "cain45/l5/spatial_physical.py", "sha256": "9228c9512bf48f7c8e3203811371ea091323bd0c93ee405a85e4f66bf84a8dce" }, "e15_control_plane": { "path": "cain45/l5/__init__.py", "sha256": "cbea9467a9ce0010e1bd4192d989df33cd2cb87efca3d853303b51bfcc095614" }, "e15_agent_cli": { "path": "scripts/cain45/cain_agent_cli.py", "sha256": "990ac729420135f49c985ec1f48fad3f8488f68bf3bf52ce733be93489d458bb" }, "e15_l5_cli": { "path": "scripts/cain42_l5/cain_l5_cli.py", "sha256": "2a7ce76d2b3f949647534e434cce8d4a1a98bbc50c215666ec00785ccaab74db" }, "e15_cli_commands": { "path": "scripts/cain45/e15_commands.py", "sha256": "61dc3ce79b5746568b917407a994e901eaa450764e9011a56104dda77358dc19" }, "e15_verifier": { "path": "scripts/cain45/verify_e15.py", "sha256": "314b76e83aa2b16a333bf18dbdbc1258137fd3275a69bbcabc5d6d176bbec7ae" }, "e15_bundle_builder": { "path": "scripts/cain45/build_evolution15_bundle.py", "sha256": "af752c60a3a3b025dbd191c4de55dc98e01c9dbf9a73be48d8190f77c2bd78b4" }, "reused_e7_consequence": { "path": "cain45/l5/consequence_governance.py", "sha256": "175a7ead84aafa96a15764b822ce971dd487a49e141b63c2e90411e3b1ca4503" }, "reused_e7_world_state": { "path": "cain45/l5/world_state.py", "sha256": "9d03e69030fc26b5d97b0346b935325032671304478afdfa9e61ba596601e574" }, "reused_e8_kernel": { "path": "cain45/l5/kernel.py", "sha256": "e70cc8cd43d1a1f2a32f3aba7733298aea0cda19495676662091ec04d380b673" }, "reused_e12_perception": { "path": "cain45/l5/perception.py", "sha256": "f58472148a85fba0877620c44589d539e3e79a0030e273799348bff6f838efc3" }, "reused_e13_decision": { "path": "cain45/l5/decision.py", "sha256": "7a5d963b93fbba0d3ddc4981679c0caaccdbe566c5d724397bd7a2a4d0aad903" }, "reused_e14_capability": { "path": "cain45/l5/capability.py", "sha256": "7ddfefe8bb5dbb264af5d50a5c913c2e8f157784310931e2a535a1b030d5a959" } }, "tests": { "tests/test_cain42_e15_spatial_physical.py": "e068af9fff18e6e96761d8d05a47cf9beec17421db80bb4bef6e5863a2d7ffc4", "tests/test_cain42_e15_adversarial.py": "346b6e6f568bee50adb9d15cadd1a4ca12ab1548acdfbad78e781d73f9447042", "tests/test_cain42_e15_end_to_end.py": "c898569dbfbd71e979b6f8b2b84f28da131260bdbd72f7283d6b447c3db649ff" }, "test_run": { "command": "python3 -m pytest tests/test_cain42_e15_spatial_physical.py tests/test_cain42_e15_adversarial.py tests/test_cain42_e15_end_to_end.py -q", "summary": "============================= 175 passed in 7.05s ==============================", "passed": 175, "failed": 0, "returncode": 0, "transcript_tail": [ "", "tests/test_cain42_e15_spatial_physical.py .............................. [ 17%]", ".................................................. [ 45%]", "tests/test_cain42_e15_adversarial.py ................................... [ 65%]", ".......................... [ 80%]", "tests/test_cain42_e15_end_to_end.py .................................. [100%]", "", "============================= 175 passed in 7.05s ==============================" ] }, "invariants": { "evolution": 15, "fabric": "cain42.l5.spatial_physical", "checks": [ { "id": "P1", "invariant": "PERCEPTION IS NOT TRUTH", "holds": true, "detail": "INCONSISTENT" }, { "id": "P2", "invariant": "OBSERVATION PROVENANCE IS PRESERVED", "holds": true, "detail": "f9a1fd8abf59bf40" }, { "id": "P3", "invariant": "OBSERVED/INFERRED/PREDICTED/SIMULATED STATES REMAIN DISTINCT", "holds": true, "detail": "['box-9']" }, { "id": "P4", "invariant": "WORLD STATE IS VERSIONED", "holds": true, "detail": "11" }, { "id": "P5", "invariant": "STALE WORLD STATE CANNOT SILENTLY AUTHORIZE", "holds": true, "detail": "(['AUTHORIZATION_DIGEST_UNVERIFIED'], ['STALE_WORLD_STATE', 'STALE_COMPONENT:amr-1', 'STALE_COMPONENT:ped-1'])" }, { "id": "P6", "invariant": "MATERIAL REALITY DRIFT INVALIDATES AFFECTED AUTHORIZATION", "holds": true, "detail": "['UNEXPECTED_MOTION']" }, { "id": "P7", "invariant": "SENSOR CONFLICT IS DETECTABLE", "holds": true, "detail": "['camera says present=True, lidar says present=False']" }, { "id": "P8", "invariant": "UNRESOLVED CRITICAL CONFLICT CANNOT BECOME IMPLICIT ALLOW", "holds": true, "detail": "['CONSISTENCY_INCONSISTENT', 'CRITICAL_SENSOR_CONFLICT_UNRESOLVED']" }, { "id": "P9", "invariant": "WORLD-MODEL OUTPUT CANNOT CREATE AUTHORITY", "holds": true, "detail": "['AUTHORITY_NOT_PERMITTED']" }, { "id": "P10", "invariant": "WORLD-MODEL VERSION IS BOUND TO DEPENDENT DECISIONS", "holds": true, "detail": "['MODEL_VERSION_CHANGED', 'MODEL_DIGEST_CHANGED']" }, { "id": "P11", "invariant": "TRAJECTORY IS A PROPOSAL UNTIL AUTHORIZED", "holds": true, "detail": "['AUTONOMY_STATE_NOT_AUTHORIZED:WORLD_STATE_ESTABLISHED']" }, { "id": "P12", "invariant": "TRAJECTORY CHANGES INVALIDATE DEPENDENT AUTHORIZATION", "holds": true, "detail": "['AUTHORIZATION_DIGEST_UNVERIFIED', 'TRAJECTORY_DIGEST_CHANGED']" }, { "id": "P13", "invariant": "PHYSICAL CAPABILITY INCLUDES CONTEXTUAL CONSTRAINTS", "holds": true, "detail": "['PHYSICAL_CAPABILITY_UNBOUNDED']" }, { "id": "P14", "invariant": "PHYSICAL CAPABILITY CANNOT EXCEED AUTHORITY", "holds": true, "detail": "['GEOGRAPHIC_EXCEEDS_AUTHORITY', 'SPEED_EXCEEDS_AUTHORITY']" }, { "id": "P15", "invariant": "PHYSICAL CONSEQUENCE ENTERS GOVERNANCE", "holds": true, "detail": "['CONSEQUENCE_EXCEEDS_BOUND', 'EXCEEDS:environmental_exposure', 'CONSEQUENCE_DENY:security=1.0>=1.0']" }, { "id": "P16", "invariant": "SPATIAL BLAST RADIUS IS REPRESENTED WHERE MEASURABLE", "holds": true, "detail": "(200.0, 'UNKNOWN')" }, { "id": "P17", "invariant": "COUNTERFACTUALS REMAIN SIMULATIONS", "holds": true, "detail": "STOP" }, { "id": "P18", "invariant": "SIMULATION IS NOT REALITY", "holds": true, "detail": "4.0" }, { "id": "P19", "invariant": "SIMULATION EVIDENCE IS PROVENANCE-BOUND", "holds": true, "detail": "(['SIMULATION_EVIDENCE_TAMPERED', 'SIMULATION_EVIDENCE_SIGNATURE_INVALID'], ['SIMULATION_SCENARIO_DIGEST_MISMATCH'])" }, { "id": "P20", "invariant": "SIMULATION-TO-REALITY GAPS REMAIN EXPLICIT", "holds": true, "detail": "('HIGH', 'UNKNOWN')" }, { "id": "P21", "invariant": "PHYSICAL ACTION BINDS TO WORLD STATE", "holds": true, "detail": "['WORLD_STATE_DIGEST_CHANGED']" }, { "id": "P22", "invariant": "PHYSICAL ACTION BINDS TO TRAJECTORY", "holds": true, "detail": "['AUTHORIZATION_DIGEST_UNVERIFIED', 'TRAJECTORY_DIGEST_CHANGED']" }, { "id": "P23", "invariant": "PHYSICAL ACTION BINDS TO DECISION", "holds": true, "detail": "['DECISION_DIGEST_CHANGED']" }, { "id": "P24", "invariant": "PHYSICAL ACTION BINDS TO CAPABILITY", "holds": true, "detail": "['CAPABILITY_DIGEST_CHANGED', 'DECISION_DIGEST_CHANGED']" }, { "id": "P25", "invariant": "PHYSICAL ACTION BINDS TO AUTHORITY", "holds": true, "detail": "['AUTHORITY_DIGEST_CHANGED', 'DECISION_DIGEST_CHANGED']" }, { "id": "P26", "invariant": "PHYSICAL ACTION BINDS TO POLICY", "holds": true, "detail": "['DECISION_DIGEST_CHANGED', 'POLICY_DIGEST_CHANGED']" }, { "id": "P27", "invariant": "PHYSICAL ACTION BINDS TO CONSEQUENCE", "holds": true, "detail": "['CONSEQUENCE_DIGEST_CHANGED', 'RISK_DIGEST_CHANGED']" }, { "id": "P28", "invariant": "MATERIAL STATE MUTATION TRIGGERS REAUTHORIZATION", "holds": true, "detail": "{'valid': False, 'action': 'REAUTHORIZE', 'mismatches': ['world_state_digest'], 'unverified': [], 'unbound': [], 'authority': 'NONE'}" }, { "id": "P29", "invariant": "ACTUATOR COMMANDS CANNOT BYPASS E8", "holds": true, "detail": "(['NO_EXECUTION_PERMIT'], ['PERMIT_SIGNATURE_INVALID'], ['E8_BOUNDARY_NOT_CONFIGURED:NOT_IMPLEMENTED'])" }, { "id": "P30", "invariant": "SAFE-STATE TRANSITION IS GOVERNED", "holds": true, "detail": "('SAFE_STATE_SEMANTICS_MISSING', ['AUTONOMY_STATE_NOT_AUTHORIZED:SAFE_STATE'])" }, { "id": "P31", "invariant": "SENSOR IDENTITY CANNOT BE SILENTLY SUBSTITUTED", "holds": true, "detail": "(['SENSOR_SIGNATURE_INVALID'], ['SENSOR_TYPE_SUBSTITUTION'])" }, { "id": "P32", "invariant": "SPATIAL IDENTITY CANNOT BE SILENTLY SUBSTITUTED", "holds": true, "detail": "[{'observation_id': 'obs:cam-1:ped-1:1000.3:47db71', 'reasons': ['IDENTITY_SUBSTITUTION']}]" }, { "id": "P33", "invariant": "TEMPORAL ORDERING CANNOT BE SILENTLY REWRITTEN", "holds": true, "detail": "['TEMPORAL_ORDER_VIOLATION']" }, { "id": "P34", "invariant": "HUMAN OVERRIDE REMAINS AUDITABLE", "holds": true, "detail": "['sup-1', 'sup-2']" }, { "id": "P35", "invariant": "UNKNOWN CANNOT BECOME ALLOW", "holds": true, "detail": "(['MISSING_SYSTEM'], ['GOVERNANCE_NOT_CONFIGURED'], ['TEMPORAL_VALIDITY_UNKNOWN:TIMING_DOES_NOT_COVER_PATH'])" }, { "id": "P36", "invariant": "GOVERNANCE FAILURE FAILS CLOSED", "holds": true, "detail": "['GOVERNANCE_ERROR:AttributeError']" } ], "failed": [], "all_hold": true, "checked": 36 }, "attack_bench": { "bench": "CAIN-42-E15-Spatial-Physical-Bench", "contained": 55, "total": 55, "all_contained": true, "real_world_attack_validation": "NOT_PERFORMED" }, "end_to_end": { "all_steps_ok": true, "steps": 19, "all_mutations_governed": true, "mutations": [ "world_state", "sensor_evidence", "trajectory", "world_model_version", "capability", "policy", "authority" ], "digest": "385ae28e4b14ae1682dec9011aa0a031e0a75e2ebeab8748162e32c2b015eccb" }, "convergence": { "PHYSICAL": true, "DIGITAL": true, "HYBRID": true }, "schemas": [ "ActuatorCommand", "EmbodiedSystem", "ExecutionPermit", "GovernedSafeState", "GovernedTrajectory", "GovernedWorldModel", "HumanPrincipal", "PhysicalActionCommit", "PhysicalAdversarialScenario", "PhysicalAuthorityScope", "PhysicalAuthorizationStep", "PhysicalConsequenceVector", "PhysicalScenario", "SensorEvidence", "SensorRegistration", "SpatialCapabilityBoundary", "SpatialEntityIdentity", "SpatialObservation", "SpatialTemporalState", "TrajectoryApproval", "WorldModelOutput" ], "limitations": [ { "limitation": "HARDWARE ATTESTATION", "status": "UNKNOWN", "evidence": "no TPM/TEE/secure-boot evidence was tested; sensor and actuator keys are software keys at the adapter boundary", "test": "tests/test_cain42_e15_spatial_physical.py::test_status_model_and_limitations_are_explicit", "note": "declared in cain45.l5.spatial_physical.LIMITATIONS" }, { "limitation": "REAL WORLD SENSOR INTEGRATION", "status": "NOT_IMPLEMENTED", "evidence": "sensors are signed test doubles; no camera/lidar/radar/GNSS driver is integrated", "test": "tests/test_cain42_e15_spatial_physical.py::test_status_model_and_limitations_are_explicit", "note": "declared in cain45.l5.spatial_physical.LIMITATIONS" }, { "limitation": "REAL VEHICLE INTEGRATION", "status": "NOT_IMPLEMENTED", "evidence": "no vehicle adapter exists", "test": "tests/test_cain42_e15_spatial_physical.py::test_status_model_and_limitations_are_explicit", "note": "declared in cain45.l5.spatial_physical.LIMITATIONS" }, { "limitation": "REAL ROBOT INTEGRATION", "status": "NOT_IMPLEMENTED", "evidence": "ReferenceAdapter records commands; it drives nothing", "test": "tests/test_cain42_e15_spatial_physical.py::test_status_model_and_limitations_are_explicit", "note": "declared in cain45.l5.spatial_physical.LIMITATIONS" }, { "limitation": "REAL ACTUATOR INTEGRATION", "status": "NOT_IMPLEMENTED", "evidence": "GovernedActuator is an adapter contract; enforcement holds only if the real actuator is reachable solely through it", "test": "tests/test_cain42_e15_spatial_physical.py::test_status_model_and_limitations_are_explicit", "note": "declared in cain45.l5.spatial_physical.LIMITATIONS" }, { "limitation": "MULTI HOST BEHAVIOR", "status": "UNVERIFIED", "evidence": "all E15 runs are single-process", "test": "tests/test_cain42_e15_spatial_physical.py::test_status_model_and_limitations_are_explicit", "note": "declared in cain45.l5.spatial_physical.LIMITATIONS" }, { "limitation": "LARGE SCALE SIMULATION", "status": "NOT_IMPLEMENTED", "evidence": "the only simulator is a reference constant-velocity model; external simulators plug in but none was tested", "test": "tests/test_cain42_e15_spatial_physical.py::test_status_model_and_limitations_are_explicit", "note": "declared in cain45.l5.spatial_physical.LIMITATIONS" }, { "limitation": "WORLD MODEL ACCURACY", "status": "UNKNOWN", "evidence": "CAIN governs world-model outputs as PREDICTED evidence; it does not measure model accuracy", "test": "tests/test_cain42_e15_spatial_physical.py::test_status_model_and_limitations_are_explicit", "note": "declared in cain45.l5.spatial_physical.LIMITATIONS" }, { "limitation": "SEMANTIC TRUTH", "status": "UNKNOWN", "evidence": "signatures and hashes prove origin and integrity, not that an observation is true", "test": "tests/test_cain42_e15_spatial_physical.py::test_status_model_and_limitations_are_explicit", "note": "declared in cain45.l5.spatial_physical.LIMITATIONS" }, { "limitation": "SIMULATION TO REALITY FIDELITY", "status": "UNKNOWN", "evidence": "the gap engine measures supplied data only; no real outcomes were collected", "test": "tests/test_cain42_e15_spatial_physical.py::test_status_model_and_limitations_are_explicit", "note": "declared in cain45.l5.spatial_physical.LIMITATIONS" }, { "limitation": "THIRD PARTY REPRODUCTION", "status": "NOT_PERFORMED", "evidence": "only the bundled clean-room verifier has been run, by us", "test": "tests/test_cain42_e15_spatial_physical.py::test_status_model_and_limitations_are_explicit", "note": "declared in cain45.l5.spatial_physical.LIMITATIONS" }, { "limitation": "VULNERABILITY INTELLIGENCE", "status": "UNKNOWN", "evidence": "no vulnerability feed is integrated", "test": "tests/test_cain42_e15_spatial_physical.py::test_status_model_and_limitations_are_explicit", "note": "declared in cain45.l5.spatial_physical.LIMITATIONS" }, { "limitation": "HOSTED E15 SERVICE", "status": "NOT_IMPLEMENTED", "evidence": "E15 is a TESTED library; it is not mounted on the hosted gateway", "test": "tests/test_cain42_e15_spatial_physical.py::test_status_model_and_limitations_are_explicit", "note": "declared in cain45.l5.spatial_physical.LIMITATIONS" }, { "limitation": "REAL WORLD ATTACK VALIDATION", "status": "NOT_PERFORMED", "evidence": "all adversarial scenarios run in-process", "test": "tests/test_cain42_e15_spatial_physical.py::test_status_model_and_limitations_are_explicit", "note": "declared in cain45.l5.spatial_physical.LIMITATIONS" }, { "limitation": "E8 MultiPartyAuthorization counts approvals without verifying their signatures", "status": "REDUCED", "evidence": "E15 PhysicalHumanAuthority verifies every human signature, role, scope, nonce and freshness BEFORE handing the approvals to the E8 counter", "test": "cain45.l5.spatial_physical _p34", "note": "E8 itself is unchanged (changing it would alter earlier evolutions)" }, { "limitation": "E8 check_bindings treats an absent live root as unchanged (lenient)", "status": "REDUCED", "evidence": "a physical action always supplies every E8 root (e8_current) and E15 re-checks all nine bindings STRICTLY (absent -> *_UNVERIFIED refusal) before E8 runs", "test": "cain45.l5.spatial_physical _p21.._p27", "note": "digital (non-E15) E8 callers keep the earlier semantics" }, { "limitation": "Sensor/actuator keys are software keys", "status": "STILL UNKNOWN", "evidence": "signatures bind an observation to a registered adapter key; a compromised adapter host can sign lies (SENSOR_SIGNATURE_VALID != TRUE)", "test": "tests/test_cain42_e15_adversarial.py", "note": "P1" } ], "performance_summary": { "world_state_construction_cold": 6449.11, "observation_ingestion_admit_e12_identity_world": 1433.5, "provenance_validation_action_to_sensor": 11.86, "spatial_lookup_2000_entities_r25m": 54.21, "trajectory_evaluation": 116.65, "cross_modal_consistency_6_obs": 12.99, "reality_drift_detection": 197.42, "counterfactual_evaluation_8_alternatives": 43.62, "physical_consequence_evaluation_with_e7_gate": 17.97, "authorization_validation_step_9_bindings": 209.99, "live_binding_recomputation": 605.73 }, "status": { "E15": "TESTED", "HOSTED_SERVICE": "NOT_IMPLEMENTED", "HARDWARE_ATTESTATION": "UNKNOWN", "REAL_WORLD_INTEGRATION": "NOT_IMPLEMENTED", "MULTI_HOST_SCALE": "UNVERIFIED", "REAL_WORLD_ATTACK_VALIDATION": "NOT_PERFORMED", "THIRD_PARTY_REPRODUCTION": "NOT_PERFORMED", "SEMANTIC_TRUTH": "HASH_INTEGRITY != SEMANTIC_TRUTH", "SIMULATION": "SIMULATION != REALITY; a simulator never proves physical safety", "OUTSIDE_THE_BOUNDARY": "UNCONTROLLED / UNVERIFIED / UNKNOWN", "capability_status": { "PhysicalIntelligenceFabric / EmbodiedSystem": "TESTED", "SpatialWorldState (versioned, chained, replay)": "TESTED", "SpatialTemporalState (5 fact layers)": "TESTED", "SensorRegistry + E12 admission": "TESTED", "CrossModalConsistencyEngine": "TESTED", "SpatialEntityIdentityRegistry": "TESTED", "WorldStateProvenanceGraph": "TESTED", "SpatialRealityDriftEngine": "TESTED", "GovernedWorldModel / WorldModelRegistry (interface)": "TESTED", "GovernedTrajectory + TrajectoryGovernanceEngine": "TESTED", "TrajectoryPredictionGraph": "TESTED", "PhysicalConsequenceVector (+E7 gate)": "TESTED", "PhysicalBlastRadiusEngine": "TESTED", "PhysicalCounterfactualEngine": "SIMULATED", "ContinuousPhysicalAuthorization": "TESTED", "SpatialCapabilityBoundary (+E14)": "TESTED", "GovernedSafeState (adapter-supplied semantics)": "TESTED", "GovernedActuator (adapter contract)": "TESTED", "PhysicalActionCommit + PhysicalCommitBoundary (+E8)": "TESTED", "GovernedSimulationEnvironment": "TESTED", "ReferenceKinematicSimulator": "SIMULATED", "GovernedDigitalTwin": "TESTED", "SimulationRealityGapEngine": "TESTED", "PhysicalScenario / ScenarioMutationEngine": "TESTED", "PhysicalAdversarialScenario": "SIMULATED", "RealityFeedbackFabric": "TESTED", "PhysicalHumanAuthority": "TESTED", "EmbodiedSystemHealth": "TESTED", "EmbodiedAutonomyStateMachine": "TESTED", "real sensor/vehicle/robot/actuator adapters": "NOT_IMPLEMENTED", "hosted E15 service": "NOT_IMPLEMENTED", "systems outside the CAIN boundary": "UNCONTROLLED" } }, "signing_key": { "class": "EPHEMERAL", "algorithm": "Ed25519", "public_key_b64": "+oBjaG1zP4NamLiY4XF8AsSlz6NxHBjeoGg7/LGWLLY=", "production_key": "NOT USED", "development_key": "NOT USED", "note": "generated for this build only and discarded; not a production trust root and not an independent third party" }, "chain": [ "IDENTITY", "PERCEPTION (E12)", "EVIDENCE", "COGNITION / DECISION (E13)", "CAPABILITY (E14)", "SPATIAL STATE (E15)", "TRAJECTORY (E15)", "CONSEQUENCE (E7)", "AUTHORIZATION (E8 + E15 step)", "EXECUTION (permit -> actuator adapter)", "OBSERVATION", "EVIDENCE" ], "laws": [ "PERCEPTION IS NOT TRUTH", "MODEL OUTPUT IS NOT AUTHORITY", "SIMULATION IS NOT REALITY", "PREDICTION IS NOT FACT", "A TRAJECTORY IS A PROPOSAL UNTIL GOVERNED", "A PHYSICAL ACTION REQUIRES GOVERNED AUTHORIZATION", "UNKNOWN MUST NEVER BECOME ALLOW" ], "evidence_level": "TESTED", "environment_class": "operator host, single process, pre-production", "not_claimed": [ "CAIN-42 is not an autonomous vehicle or a robot", "CAIN-42 does not drive vehicles", "CAIN-42 does not guarantee physical safety", "CAIN-42 does not control every autonomous system", "physical AI is not solved" ], "signer_public_key_b64": "+oBjaG1zP4NamLiY4XF8AsSlz6NxHBjeoGg7/LGWLLY=", "signature_b64": "9+LDZUBkxtnxJ3VHskg56yv2EdYuVXRofVe2ouWNWufP22HPy0KZ/LjxNndjhanSxZlYqR0h7WeoMxSDJVA0Cw==" }