CAIN-42 Evolution 15 — Spatial + Physical Autonomous Intelligence Fabric

TESTED PRE-PRODUCTION no third-party review ephemeral signing key no real vehicle / robot

E15 establishes the interfaces and governance primitives for bringing spatial intelligence, world models, simulation, trajectories and physical actions into CAIN-42's governed trust path. Sensor observations are signed and admitted through E12; the world state is versioned, hash-chained and replayable; a world model's output is PREDICTED evidence, never authority; a trajectory is a proposal until a signed approval binds it; every physical action binds nine digests (world state, trajectory, decision, capability, authority, policy, risk, consequence, authorization), crosses the E8 commit boundary, and reaches an actuator adapter only with a single-use execution permit. Material drift invalidates the authorization and forces re-evaluation or a safe state. CAIN-42 is not a vehicle or a robot, does not drive anything, and does not guarantee physical safety.

Invariants: 36/36 hold (P1–P36).
Spatial-physical bench: 55/55 contained (in-process; real-world attack validation not performed).
End-to-end: 19/19 steps, 7/7 mutations governed.
Tests: 175 passed, 0 failed — ============================= 175 passed in 7.05s ==============================.
Clean-room verifier (no CAIN-42 imports): verify_e15.py.txt · REPRODUCE.txt · MANIFEST.json.
Proof: Evolution 15 proof · master proof · schemas · world state · observations · trajectories · physical actions · simulation · digital twin + convergence · end-to-end run · attack manifest · test vectors · performance · limitations.
Docs: reference architecture · threat model · spatial & physical governance.

One governed path

identity → perception (E12) → evidence → decision (E13) → capability (E14) → spatial state → trajectory (E15) → consequence (E7) → authorization (E8 + E15 step) → execution permit → actuator adapter → observation → evidence — digital, physical and hybrid systems all converge on it.

End-to-end run (reference robot adapter; nothing physical moves)

#	Step	Result
1	sensors produce signed observations	OK
2	observations enter E12 (admission -> ATTESTED envelopes)	OK
3	world state constructed (versioned, chained) and projected into E7	OK
4	spatial relationships established	OK
5	world model produces predictions (PREDICTED, bound, no authority)	OK
6	trajectory candidates generated (proposals + predicted futures + simulation)	OK
7	E13 governs the decision (authority = intersection)	OK
8	E14 verifies capability + WHERE/WHEN/CONDITIONS	OK
9	E7 evaluates physical consequence	OK
10	E15 spatial/temporal governance (trajectory APPROVE, signed, bound)	OK
11	E8 action commit (nine physical bindings + GAT + step)	OK
12	action authorized	OK
13	external actuator adapter executed only with a permit	OK
14	new observations arrive	OK
15	world state changes	OK
16	reality drift evaluated (none material on the nominal path)	OK
17	authorization revalidated (next limited step re-authorized)	OK
18	outcome becomes evidence (feedback + evidence chains intact)	OK
19	complete provenance chain replayable	OK

Mutation	Refused with	Re-evaluation	Result
world_state	AUTONOMY_STATE_NOT_AUTHORIZED:SAFE_STATE	DENY	GOVERNED
sensor_evidence	WORLD_STATE_DIGEST_CHANGED	REQUIRE_REEVALUATION	GOVERNED
trajectory	AUTHORIZATION_DIGEST_UNVERIFIED, TRAJECTORY_DIGEST_CHANGED	DENY	GOVERNED
world_model_version	MODEL_VERSION_CHANGED, MODEL_DIGEST_CHANGED	REVALIDATE	GOVERNED
capability	CAPABILITY_DIGEST_CHANGED, DECISION_DIGEST_CHANGED	APPROVE	GOVERNED
policy	DECISION_DIGEST_CHANGED, POLICY_DIGEST_CHANGED	APPROVE	GOVERNED
authority	AUTHORITY_DIGEST_CHANGED, DECISION_DIGEST_CHANGED	APPROVE	GOVERNED

Invariants P1–P36

#	Invariant	Result
P1	PERCEPTION IS NOT TRUTH	HOLDS
P2	OBSERVATION PROVENANCE IS PRESERVED	HOLDS
P3	OBSERVED/INFERRED/PREDICTED/SIMULATED STATES REMAIN DISTINCT	HOLDS
P4	WORLD STATE IS VERSIONED	HOLDS
P5	STALE WORLD STATE CANNOT SILENTLY AUTHORIZE	HOLDS
P6	MATERIAL REALITY DRIFT INVALIDATES AFFECTED AUTHORIZATION	HOLDS
P7	SENSOR CONFLICT IS DETECTABLE	HOLDS
P8	UNRESOLVED CRITICAL CONFLICT CANNOT BECOME IMPLICIT ALLOW	HOLDS
P9	WORLD-MODEL OUTPUT CANNOT CREATE AUTHORITY	HOLDS
P10	WORLD-MODEL VERSION IS BOUND TO DEPENDENT DECISIONS	HOLDS
P11	TRAJECTORY IS A PROPOSAL UNTIL AUTHORIZED	HOLDS
P12	TRAJECTORY CHANGES INVALIDATE DEPENDENT AUTHORIZATION	HOLDS
P13	PHYSICAL CAPABILITY INCLUDES CONTEXTUAL CONSTRAINTS	HOLDS
P14	PHYSICAL CAPABILITY CANNOT EXCEED AUTHORITY	HOLDS
P15	PHYSICAL CONSEQUENCE ENTERS GOVERNANCE	HOLDS
P16	SPATIAL BLAST RADIUS IS REPRESENTED WHERE MEASURABLE	HOLDS
P17	COUNTERFACTUALS REMAIN SIMULATIONS	HOLDS
P18	SIMULATION IS NOT REALITY	HOLDS
P19	SIMULATION EVIDENCE IS PROVENANCE-BOUND	HOLDS
P20	SIMULATION-TO-REALITY GAPS REMAIN EXPLICIT	HOLDS
P21	PHYSICAL ACTION BINDS TO WORLD STATE	HOLDS
P22	PHYSICAL ACTION BINDS TO TRAJECTORY	HOLDS
P23	PHYSICAL ACTION BINDS TO DECISION	HOLDS
P24	PHYSICAL ACTION BINDS TO CAPABILITY	HOLDS
P25	PHYSICAL ACTION BINDS TO AUTHORITY	HOLDS
P26	PHYSICAL ACTION BINDS TO POLICY	HOLDS
P27	PHYSICAL ACTION BINDS TO CONSEQUENCE	HOLDS
P28	MATERIAL STATE MUTATION TRIGGERS REAUTHORIZATION	HOLDS
P29	ACTUATOR COMMANDS CANNOT BYPASS E8	HOLDS
P30	SAFE-STATE TRANSITION IS GOVERNED	HOLDS
P31	SENSOR IDENTITY CANNOT BE SILENTLY SUBSTITUTED	HOLDS
P32	SPATIAL IDENTITY CANNOT BE SILENTLY SUBSTITUTED	HOLDS
P33	TEMPORAL ORDERING CANNOT BE SILENTLY REWRITTEN	HOLDS
P34	HUMAN OVERRIDE REMAINS AUDITABLE	HOLDS
P35	UNKNOWN CANNOT BECOME ALLOW	HOLDS
P36	GOVERNANCE FAILURE FAILS CLOSED	HOLDS

CAIN-42-E15-Spatial-Physical-Bench

Attack	Result
sensor_spoofing	CONTAINED
sensor_disagreement	CONTAINED
stale_observation	CONTAINED
timestamp_manipulation	CONTAINED
gps_drift	CONTAINED
map_substitution	CONTAINED
object_identity_substitution	CONTAINED
trajectory_substitution	CONTAINED
world_model_substitution	CONTAINED
world_model_version_mismatch	CONTAINED
prediction_substitution	CONTAINED
simulation_evidence_substitution	CONTAINED
reality_drift_suppression	CONTAINED
counterfactual_manipulation	CONTAINED
physical_capability_escalation	CONTAINED
geographic_boundary_bypass	CONTAINED
temporal_boundary_bypass	CONTAINED
safe_state_bypass	CONTAINED
actuator_command_substitution	CONTAINED
trajectory_replay	CONTAINED
decision_replay	CONTAINED
authorization_replay	CONTAINED
credential_replay	CONTAINED
human_review_bypass	CONTAINED
subagent_physical_capability_escalation	CONTAINED
collective_physical_authority_laundering	CONTAINED
model_generated_authority	CONTAINED
memory_generated_authority	CONTAINED
tool_generated_authority	CONTAINED
unknown_to_allow	CONTAINED
sim_to_real_mismatch	CONTAINED
sensor_dropout	CONTAINED
communication_loss	CONTAINED
latency_attack	CONTAINED
actuator_degradation	CONTAINED
state_rollback	CONTAINED
state_resurrection	CONTAINED
trajectory_fork	CONTAINED
world_state_fork	CONTAINED
policy_mutation	CONTAINED
authority_mutation	CONTAINED
capability_mutation	CONTAINED
environment_mutation	CONTAINED
consequence_suppression	CONTAINED
risk_suppression	CONTAINED
spatial_boundary_confusion	CONTAINED
cross_entity_confusion	CONTAINED
cross_tenant_physical_authority	CONTAINED
emergency_stop_bypass	CONTAINED
recovery_state_bypass	CONTAINED
revalidation_bypass	CONTAINED
toctou_race	CONTAINED
forged_trajectory_approval	CONTAINED
sensor_replay	CONTAINED
digital_agent_actuation	CONTAINED

Performance (single host, in-process; microseconds)

Intel Xeon Processor (Cascadelake), 2 logical CPUs, 3474344 kB RAM; Linux-7.0.0-30-generic-x86_64-with-glibc2.43; Python 3.14.4; concurrency 1. Not a production-scale benchmark.

Operation	p50	p95	p99
world_state_construction_cold	6449.11	12101.28	14504.35
observation_ingestion_admit_e12_identity_world	1433.5	4836.75	11355.89
provenance_validation_action_to_sensor	11.86	23.6	40.05
spatial_lookup_2000_entities_r25m	54.21	94.35	277.8
trajectory_evaluation	116.65	258.16	481.84
cross_modal_consistency_6_obs	12.99	23.35	53.32
reality_drift_detection	197.42	309.95	525.95
counterfactual_evaluation_8_alternatives	43.62	82.16	127.14
physical_consequence_evaluation_with_e7_gate	17.97	41.59	110.3
authorization_validation_step_9_bindings	209.99	738.46	3650.71
live_binding_recomputation	605.73	2465.06	5733.73

Limitations (classified)

Limitation	Status	Evidence
HARDWARE ATTESTATION	UNKNOWN	no TPM/TEE/secure-boot evidence was tested; sensor and actuator keys are software keys at the adapter boundary
REAL WORLD SENSOR INTEGRATION	NOT_IMPLEMENTED	sensors are signed test doubles; no camera/lidar/radar/GNSS driver is integrated
REAL VEHICLE INTEGRATION	NOT_IMPLEMENTED	no vehicle adapter exists
REAL ROBOT INTEGRATION	NOT_IMPLEMENTED	ReferenceAdapter records commands; it drives nothing
REAL ACTUATOR INTEGRATION	NOT_IMPLEMENTED	GovernedActuator is an adapter contract; enforcement holds only if the real actuator is reachable solely through it
MULTI HOST BEHAVIOR	UNVERIFIED	all E15 runs are single-process
LARGE SCALE SIMULATION	NOT_IMPLEMENTED	the only simulator is a reference constant-velocity model; external simulators plug in but none was tested
WORLD MODEL ACCURACY	UNKNOWN	CAIN governs world-model outputs as PREDICTED evidence; it does not measure model accuracy
SEMANTIC TRUTH	UNKNOWN	signatures and hashes prove origin and integrity, not that an observation is true
SIMULATION TO REALITY FIDELITY	UNKNOWN	the gap engine measures supplied data only; no real outcomes were collected
THIRD PARTY REPRODUCTION	NOT_PERFORMED	only the bundled clean-room verifier has been run, by us
VULNERABILITY INTELLIGENCE	UNKNOWN	no vulnerability feed is integrated
HOSTED E15 SERVICE	NOT_IMPLEMENTED	E15 is a TESTED library; it is not mounted on the hosted gateway
REAL WORLD ATTACK VALIDATION	NOT_PERFORMED	all adversarial scenarios run in-process
E8 MultiPartyAuthorization counts approvals without verifying their signatures	REDUCED	E15 PhysicalHumanAuthority verifies every human signature, role, scope, nonce and freshness BEFORE handing the approvals to the E8 counter
E8 check_bindings treats an absent live root as unchanged (lenient)	REDUCED	a physical action always supplies every E8 root (e8_current) and E15 re-checks all nine bindings STRICTLY (absent -> *_UNVERIFIED refusal) before E8 runs
Sensor/actuator keys are software keys	STILL UNKNOWN	signatures bind an observation to a registered adapter key; a compromised adapter host can sign lies (SENSOR_SIGNATURE_VALID != TRUE)

Signer (ephemeral, this build only): +oBjaG1zP4NamLiY4XF8AsSlz6NxHBjeoGg7/LGWLLY=

Back to CAIN