Problem: Fourteen Primitives Need One Umbrella

The preceding fourteen disclosures describe spatial-mesh primitives that solve specific problems, perception distribution, actuation gating, route authorization, intent fusion, coordinate establishment, time consensus, settlement, coordination, marketplace, disruption sensing, cascade response, health monitoring, federation, skill loading. Each primitive can be described on its own. But each, described in isolation, shows only part of the picture, because the surrounding architecture is what gives the primitive its shape. A tolling gantry resembles authority-credentialed actuation. A grid demand-response controller resembles admissibility. An aviation black box resembles lineage. A Byzantine consensus protocol resembles evidential weighting. A federated identity scheme resembles credential continuity. Each of these systems exhibits features that resemble individual properties of the umbrella, and the umbrella is the structure in which all five properties operate together under closure.

The fourteen primitives are not really separate. They share an architecture, and the architecture is the actual invention. A system that implements one primitive without the others exhibits that primitive's elements alone. A system that implements all of them, or any meaningful subset, under the shared architecture exhibits a structural property that the individual elements do not carry on their own. The architecture is what allows a marker-track route to be admitted by the same authority chain that admits a settlement, allows a disruption observation to flow into a cascade response without an out-of-band channel, and allows a health degradation event to be weighted alongside a coordination directive in a single composite admissibility evaluation. The fourteen primitives interoperate because they all conform to the umbrella; that interoperability is itself the structural property under disclosure.

The umbrella primitive captures this structural property. Every mutation in the conforming architecture passes through the same five-property chain. The disclosure is broad in the architectures it describes but specific in its structural test: a system either exhibits the chain or it does not, and the test is deterministic from the system's own observable behavior. This combination, breadth of description with a specific structural test, is the property that the umbrella primitive provides and that the fourteen specific primitives, taken individually, do not.

The remainder of this paper develops the umbrella primitive in eight stages: definition of the five properties; the recursive closure that turns the properties from a flowchart into an architecture; hierarchical composition across unit, building, campus, zone, regional, and global scopes; technology neutrality as a longevity property; operating parameters; alternative embodiments demonstrating breadth without abandoning the structural test; composition with the fourteen specific primitives; distinctions from adjacent architectures; and the disclosure scope as filed.

1. Core Primitive: The Five Properties

Property 1: Authority-Credentialed Observation. Every input that can affect system state arrives as an observation signed by an authority within a published taxonomy. In the described architecture, uncredentialed observations are not admitted. Inputs without explicit credentials are either rejected or downgraded to a lower-authority class, advisory, peer, adversarial, anonymous, for which a credential is structurally implied by the channel and class assignment itself. The taxonomy is published in the sense that any participating party can resolve a credential to its issuing authority and verify the authority's right to issue credentials of that class. Observation here is broad: a sensor reading, a peer report, a regulatory directive, an actuation acknowledgment, a clock tick, and a lineage record from another chain are all observations, each carrying the credential of its origin.

Property 2: Evidential Weighting. Each admitted observation is weighted by composite factors: authority class, credential continuity (trust slope over a defined window), corroborating observations, governance policy, operational context, and observation-specific reliability priors. The weighting produces a structured contribution rather than a binary admit/reject. Weights are not scalars in the strong sense; they are tuples that preserve the dimensions along which weighting was computed, so that downstream stages can re-weight or audit the contribution if necessary. Weighting is explicit and auditable: the weighting function, its inputs, and its output are all recorded in lineage so that any composite decision can be deconstructed back to the individual observations and the weights they carried.

Property 3: Composite Admissibility Evaluation. Weighted observations contribute to a composite admissibility decision against a proposed mutation, an actuation, a settlement, a coordination, a state update, an authority handoff. The decision produces a graduated outcome selected from a defined mode set: admit, gate (admitted at reduced evidential weight or permitted subject to additional governance-policy-defined constraints), defer (deferred pending corroboration conditions, with a deferral-expiration parameter), solicit (the evaluator emits a governed discovery query requesting additional observations to resolve uncertainty), reject (not admitted or not permitted, with a rejection-reason classification), or escalate (a cross-domain escalation upon detection of emergent conditions). Graduated outcomes are essential because the binary permit/suppress alternative fails at safety-margin boundaries: a system that must either fully execute or fully reject cannot represent the case where constrained execution under a gate outcome is the operationally correct response.

Property 4: Governed Actuator Execution. The selected mode produces a governed actuator commitment with reversibility evaluation, harm minimization under credentialed configuration, and post-actuation verification. Execution is structurally distinct from intent: the system can decide to do, decide to gate, decide to defer, or decide to reject, and each decision is itself a credentialed event. Reversibility is evaluated before commitment: if an actuation is irreversible, the admissibility threshold is structurally higher than for a reversible one, and the credential required to issue it is structurally stronger. Post-actuation verification is the checkpoint where the system confirms that the actuator did what the commitment said it would do; a deviation between commitment and verification is itself an observation that re-enters the chain.

Property 5: Lineage-Recorded Provenance. Every observation, every weighting, every admissibility decision, every actuation commitment, every post-actuation verification is recorded in lineage with credentials. The lineage admits forensic reconstruction of any state under any past time, supports cross-authority audit, and is structurally tamper-evident. Tamper-evidence does not require a particular cryptographic scheme; it requires that any modification to a recorded event be detectable by a party holding only the lineage and the public credentials of the authorities that signed it. Lineage is not a log file in the operational sense; it is a first-class data structure whose integrity is part of the system's correctness contract.

Together, the five properties define what every mutation passes through. They are not stages in the sense that a request must visit them sequentially in real time, implementations may pipeline, parallelize, or pre-stage portions, but in the described architecture every mutation is expressible as a path through all five before it is durable in the system's lineage. A mutation that bypasses any property is outside the architecture described here.

2. Mechanism: Recursive Closure

The five properties form a chain: observation → weighting → admissibility → actuation → lineage. The chain is closed: every actuation produces actuation-state observations that re-enter the chain at Property 1 as inputs to downstream evaluations. Every lineage record is itself a credentialed observation that downstream consumers can admit, weight, and respond to. Every rejection, deferral, or escalation is an observable event that other parts of the system, and other chains in the hierarchy, can consume. Closure is the load-bearing structural element of the umbrella.

A system that implements Properties 1 through 5 in isolation, observe, weight, decide, execute, log, is not the umbrella primitive. A system that implements them with output recursion is. The recursion produces self-stabilizing behavior: errors at any property produce observable downstream observations that other parts of the system respond to. A weighting anomaly produces an admissibility deviation that is itself observed and admitted as evidence at the next cycle. An actuator failure produces a verification mismatch that re-enters as a high-weight observation, raising the admissibility threshold for related actuations until corroborating evidence stabilizes the picture. A lineage gap produces an observability deficit that is itself an observation, triggering escalation to a higher chain.

Closure is what distinguishes the umbrella from a flowchart of operations. Operations can be arranged in any sequence; recursive closure forces a specific architectural shape. In particular, closure makes the chain fault-detecting in a way that open-loop sequences are not. An open-loop pipeline that observes, decides, and executes can fail silently, the actuation may not occur, the observation may have been stale, the decision may have been miscalibrated, and nothing in the pipeline notices unless an external monitor is bolted on. In the closed chain, the actuation's own consequence is admitted as evidence; the absence of a consequence becomes a high-weight observation in its own right; the calibration of the decision is itself measurable by comparing predicted to observed downstream state.

Recursion also produces multi-scale stability. At short time scales (milliseconds to seconds), the chain stabilizes individual actuations against sensor noise and transient credential failures. At medium scales (seconds to minutes), it stabilizes coordinated actuations against drift in evidential weighting. At long scales (minutes to hours and beyond), it stabilizes authority structure itself: a credential issuer that begins issuing inconsistent credentials produces, through the recursion, a weighting deficit that downstream chains observe and respond to, eventually triggering escalation up the hierarchy. Stability emerges from the closure, not from any one property in isolation.

3. Mechanism: Hierarchical Composition

The chain composes hierarchically. A unit-level chain processes observations within a single operating unit, a vehicle, a robot, a drone, a workstation, an industrial cell. A building-level chain processes observations within a single building or place. A campus-level chain processes observations across a plurality of buildings. A zone-level chain processes observations across a bounded geographic or logical zone, an intersection, a port, an airspace sector, a substation, a hospital wing. A regional-level chain processes observations across a plurality of zones. A global-level chain processes observations at the top of the composition. Each level operates the five-property chain on inputs from its own scope and produces summary observations consumed by the enclosing level, each summary observation preserving the lineage of its contributors.

Hierarchical composition means primitive scaling. A small-scale deployment, such as a single warehouse with a single fleet of autonomous mobile robots, operates the chain at unit and building levels only; the higher levels exist but reduce to identity transforms. A larger deployment adds zone-level and regional-level chains that admit observations from many lower-level chains and produce directives that flow back down. The broadest deployments add a global-level chain. The architecture is the same at every level; only the configurations grow. Critically, the recursion property holds at every level: a regional-level actuation produces observations that re-enter regional-level Property 1 as well as flowing down to zone, building, and unit levels.

Hierarchy is bidirectional. Observations and directives flow up the hierarchy as well as down, with each level's chain admitting inputs from above (governance directives) and below (peer-level observations, sensor reports, actuation acknowledgments) symmetrically. A unit-level disruption observation is weighted, admitted, and acted upon at the unit level, and is also exported as a credentialed observation to the building level, which weights it against other building-level observations. The exported observation carries its origin credential; the receiving level applies its own weighting. This produces a property essential for cross-boundary operation: an observation does not lose its provenance when it crosses a boundary; the receiving authority reweights but does not forge.

The hierarchy is also not strictly tree-shaped. A unit may participate in multiple zones (a vehicle crossing zone boundaries); a zone may participate in multiple regions (a port subject to both maritime and customs authority). The hierarchy is a directed graph of credentialed channels; tree shape is a special case. The five-property chain operates identically regardless of graph topology, because its definition is intrinsic to a node, not to the graph.

4. Mechanism: Technology Neutrality and Future-Proofing

The chain is technology-neutral. Property 1's authority credentials can be expressed in any signature scheme: ECDSA over the NIST curves today, post-quantum lattice schemes (CRYSTALS-Dilithium, Falcon) when migration becomes mandatory, hash-based signatures (SPHINCS+) for long-lived archival credentials, threshold signatures for distributed authority, attribute-based credentials for fine-grained authority decomposition. Property 2's weighting can use any algorithm: Bayesian update, Dempster-Shafer evidence combination, fuzzy logic, formally verified rule sets, learned weighting (supervised, online, or reinforcement), or hybrid combinations of these. Property 3's admissibility can be deterministic, learned, or hybrid. Property 4's actuators can be any physical, virtual, or computational mechanism, from a robotic arm to a firewall rule update to a financial settlement. Property 5's lineage can use any signature scheme, any storage substrate (append-only log, Merkle tree, distributed ledger, content-addressed object store), and any distribution model (replicated, sharded, federated, hub-and-spoke).

Technology neutrality is essential because the architecture must outlive any specific technology generation. The patent's commercial life is twenty years; the technologies that implement the chain will turn over multiple times within that period. ECDSA may be deprecated for critical infrastructure during the patent's life; specific learned-weighting models will be retrained dozens of times; lineage substrates will migrate from local append-only logs to distributed structures and back. Specifying the architecture as a property set rather than a technology stack provides the longevity that a stack-specific specification cannot.

Technology neutrality also keeps the disclosure anchored in practical application under §101. The architecture is the practical-application hook, not the specific algorithms. As §101 jurisprudence evolves, and it has been evolving rapidly since Alice v. CLS Bank: the architecture's anchor in physical actuation, cryptographic credential, and audit-grade lineage remains stable. The described architecture is not an algorithm for anything; it is a system whose mutations exhibit a defined structural property, and whose execution produces real-world physical or cyber-physical effect through governed actuators. The structural test reduces to observable behavior of the system, not to inspection of its internal algorithms.

Finally, neutrality accommodates component substitution. Where a system uses a different signature scheme, a different weighting algorithm, or a different lineage substrate, the structural question is not whether the components are the same, but whether the chain exhibits the five properties under recursive closure. A system that has substituted lattice signatures for ECDSA still exhibits Property 1 if its substituted scheme functions as the authority credential. Substitution within a property preserves the structure; removing a property does not.

5. Operating Parameters

The umbrella is a structural primitive, but conforming implementations operate within parameter ranges that bound the chain's behavior. These ranges are illustrative of practical deployments and are not claim limitations; they support enablement and best-mode disclosure under 35 U.S.C. §112.

Authority taxonomy depth. Practical taxonomies range from a shallow set (a root authority and delegated authorities) to a deeper set (root, sector regulator, sub-regulator, operator, sub-operator, device, ephemeral). Deeper taxonomies increase delegation flexibility at the cost of credential-resolution latency.

Weighting window. Credential continuity is computed over a sliding window. Short windows (minutes to hours) are appropriate for high-tempo operational environments; long windows (days to weeks) are appropriate for slow-changing regulatory environments. Implementations typically support multiple concurrent windows, with weighting drawn from the window most relevant to the observation class.

Admissibility mode sets. The graduated mode set comprises admit, gate, defer, solicit, reject, and escalate. The evaluator admits new outcome classes and new rejection-reason classes through governance-policy update without architectural change. The exact set is configurable per chain.

Reversibility-aware commitment. Each chain classifies a proposed actuation into a reversibility class and modulates admissibility thresholds accordingly, elevating the threshold as an actuation approaches its irreversible commitment point and preferring reversible actuation paths where feasible. The disclosure specifies this behavior qualitatively rather than as a numeric rate.

Lineage retention. Lineage is retained for periods bounded by the applicable audit horizon. The umbrella does not specify a retention period; conforming implementations specify it per regulatory regime.

Cross-chain latency. Observation export from one chain to another (zone-to-regional, peer-to-peer) operates with bounded latency. Real-time deployments target sub-second propagation for high-priority observations; bulk lineage replication operates on minute or hour cadences. The chain admits observations at any latency provided the credential and timestamp survive the transit.

Verification cadence. Post-actuation verification operates on a cadence appropriate to the actuator. Mechanical actuators verify within their physical settling time (milliseconds to seconds); financial actuators verify on settlement cadence (seconds to days); regulatory actuators verify on reporting cadence (days to quarters). The chain holds an actuation as provisional in lineage until verification completes.

6. Alternative Embodiments

The umbrella primitive admits a wide range of embodiments, each preserving the five properties under recursive closure while varying technology, scope, and deployment.

Embodiment A, Autonomous vehicle fleet. Unit-level chains run on each vehicle, processing sensor observations and producing motion actuations. Zone-level chains run at intersections, ports, and corridor controllers, weighting peer-vehicle reports against infrastructure observations. Regional-level chains run at metropolitan and state authority gateways, admitting safety directives and fleet-wide policy updates. Lineage is replicated to a higher-level repository for incident reconstruction. Authority credentials use ECDSA today with planned migration to a post-quantum scheme.

Embodiment B, Smart-grid demand response. Unit-level chains run at substation controllers, weighting load observations and producing switching actuations. Zone-level chains run at independent system operators, admitting market signals and reliability directives. Regional-level chains run at NERC and FERC interfaces. Switching actuations are reversibility-classified at high admissibility thresholds; admissibility uses formally verified rule sets at the unit level and learned weighting at the zone level.

Embodiment C, Healthcare device network. Unit-level chains run on infusion pumps, ventilators, and monitors, admitting clinician orders as credentialed observations and producing medication or therapy actuations. Building-level chains run at care-unit gateways. Regional-level chains run at health-system and FDA interfaces for adverse-event reporting. Lineage retention is set per the applicable regulatory regime.

Embodiment D, Cross-border logistics. Unit-level chains run on containers and conveyances. Zone-level chains run at ports, terminals, and border crossings. Regional-level chains run at customs and trade authorities, with a global-level chain at the top of the composition. Each chain admits observations from below and directives from above, with lineage providing chain-of-custody from manifest through delivery.

Embodiment E, Financial settlement network. Unit-level chains run at participating institutions, processing transaction observations and producing settlement actuations. Zone-level chains run at clearing houses. Regional-level chains run at central banks and regulators. Lineage is structured as an append-only ledger replicated across participants; cleared settlement is reversibility-classified as irreversible and held to elevated admissibility thresholds.

Embodiment F, Software-defined network policy. Unit-level chains run at network elements (routers, firewalls, switches). Zone-level chains run at SDN controllers. Regional-level chains run at security operations centers. Actuators are policy updates and traffic-shaping rules; observations are flow telemetry and threat intelligence. Verification compares post-update flow behavior to predicted behavior.

In each embodiment described above, the five properties are present and recursively closed. Substituting a property out, for example, removing Property 5 by abandoning lineage, leaves an implementation that no longer exhibits the five-property structure described here. Substituting any property's technology, exchanging ECDSA for a lattice scheme, or Bayesian weighting for fuzzy logic, leaves the structure intact.

7. Composition with the Fourteen Specific Primitives

The umbrella does not replace the fourteen specific primitives. It is the architectural condition under which they operate. Each specific primitive contributes structural detail in one or more properties of the chain. The mesh primitive contributes Property 1's distribution architecture for observations across geographic scope. The actuation primitive contributes Property 4's graduated mode set and reversibility evaluation. The marker-track primitive contributes a class of authority-credentialed observations specific to route authorization. The intent primitive contributes Property 2's evidential weighting under multi-source intent fusion. The coordinates primitive contributes the geometric substrate against which observations and actuations are referenced. The time primitive contributes the temporal substrate against which credential continuity and verification cadence are computed. The settlement primitive contributes Property 4's commitment semantics for value-bearing actuations. The coordination primitive contributes Property 3's composite admissibility under multi-actor proposals. The marketplace primitive contributes a class of admissibility evaluations specific to economic exchange. The disruption primitive contributes a class of high-weight observations specific to anomaly detection. The cascade primitive contributes Property 4's multi-stage actuation under graduated commitment. The health primitive contributes Property 2's weighting under degraded evidential channels. The federation primitive contributes Property 1's cross-authority credential semantics. The skills primitive contributes Property 4's actuator selection under capability constraints.

A disclosure anchored in the umbrella plus the fourteen specific primitives records both the architecture and its detailed instantiations. The umbrella description is structural: it describes the chain that a conforming system exhibits. The specific primitives are described in detail, each with its own structural elements operating within the umbrella. A system may exhibit one specific primitive without the umbrella, the umbrella without any specific primitive (an unusual case), or both at once, and the disclosure describes each of these configurations so that the architectural relationship between the umbrella and the specific primitives is on the record independently of any one of them.

8. Prior-Art Distinctions

The umbrella is distinct from prior architectural and security frameworks along the dimensions defined by the five properties under recursive closure.

Distinct from Zero Trust architectures. Zero Trust (NIST SP 800-207 and successors) specifies authentication of every access and least-privilege enforcement, which occupies the territory of Property 1. The described architecture additionally recites evidential weighting under composite factors, graduated admissibility modes, governed actuator semantics with reversibility evaluation, and recursive closure of audit lineage, and it operates all five properties under closure rather than access control alone.

Distinct from PKI and credential-based access control. PKI provides the cryptographic substrate for Property 1 in many embodiments, and PKI as such is a credential issuance and verification system: it specifies how credentials are issued, verified, and revoked. The described architecture builds weighting, admissibility, governed actuation, and lineage on top of that credential substrate.

Distinct from blockchain and distributed ledger systems. Distributed ledgers provide one possible substrate for Property 5. The described architecture supplies the remaining properties around such a substrate: an authority taxonomy extending beyond a consensus participant set (Property 1), composite evidential weighting of admitted observations rather than admission by consensus rule alone (Property 2), graduated admissibility modes rather than a binary consensus outcome (Property 3), and a governed actuator commitment with reversibility evaluation rather than a settled transaction treated as the effect itself (Property 4).

Distinct from policy-driven automation and orchestration. Orchestration systems (Kubernetes, Terraform, configuration-management frameworks) execute policy-defined actions and record action history. The described architecture credentials observations to authority taxonomies, weights them by credential continuity, produces graduated admissibility outcomes against composite evaluations, and exhibits recursive closure in the strong sense: actuation outputs re-enter the chain as credentialed observations available to arbitrary downstream consumers, which is a different loop structure from a reconciler operating on declared state within a single system.

Distinct from safety-instrumented systems and SCADA. Safety-instrumented systems implement layered protection in industrial settings and produce audit trails, which occupies the territory of Property 4 together with a constrained Property 5. The described architecture adds an authority taxonomy deeper than a flat operator, engineer, and maintenance set, composite evidential weighting across multiple authority classes, and recursive closure across hierarchical scopes, and it operates all five properties together.

Distinct from formal-methods control systems. Verified-control architectures (Simplex, runtime assurance) provide governed actuation with verification, addressing Property 4. The described architecture additionally recites evidential weighting under composite factors, graduated admissibility under heterogeneous observations, and recursive closure of multi-scale audit lineage.

The structural test for identifying the umbrella is therefore not feature presence but property completeness under closure: a system exhibits the described architecture when all five properties are present and recursively closed. The adjacent architectures surveyed above each occupy the territory of one or two properties, and some of three; closure across all five is the structure this disclosure describes.

9. Disclosure Scope

Disclosed under USPTO Provisional 64/049,409, the umbrella primitive is filed alongside the fourteen specific spatial-mesh primitives. The provisional describes and supports (a) the architectural umbrella as a whole, expressed by reference to the five properties under recursive closure with hierarchical composition; (b) each specific primitive, described individually with its specific structural elements; and (c) selected sub-combinations of primitives within the umbrella, described for embodiments where the sub-combination provides distinct utility.

The structural test for conformance with the umbrella architecture is observable from a system's audit lineage and operational behavior, without access to the implementing party's source code. A system under evaluation either exhibits authority-credentialed observation as the input gate, or it does not. It either weights observations through composite factors, or it does not. It either runs admissibility evaluation producing graduated outcomes, or it does not. It either produces governed graduated actuations with reversibility evaluation, or it does not. It either records audit-grade lineage with recursive closure, or it does not. The five binary determinations together produce a deterministic conformance criterion.

The umbrella primitive therefore describes the architecture that the next decade of cyber-physical systems is likely to adopt under regulatory and operational pressure, regardless of which company deploys it. UNECE R155 is converging on credentialed observation for vehicle cyber-systems; FDA Software Pre-Cert and the EU MDR are converging on lineage-recorded provenance for medical devices; NIS2 is converging on graduated admissibility for critical infrastructure; FIPS 140-3 and the post-quantum migration are forcing technology-neutral credential schemes; aviation and rail safety regimes have long required Property 4 verification with Property 5 lineage. The convergence is not coincidental; it reflects the structural demands that a governable cyber-physical architecture encounters at scale. The umbrella primitive captures those structural demands in advance of their full deployment, providing both the disclosure and the structural test by which conformance with the architecture is identified.

The disclosure of the umbrella is not a substitute for the fourteen specific primitives, and the umbrella description is not a substitute for their individual descriptions. It is the architectural condition under which the specific primitives operate, the structural test by which the architecture is identified, and the foundation on which the portfolio extends from individual primitives to the system-level architecture they instantiate.