1. Vendor and Product Reality
Cruise LLC, the General Motors autonomous-vehicle subsidiary headquartered in San Francisco and majority-owned by GM following a series of investments through the late 2010s and early 2020s, has been one of the most consequential operators in the urban robotaxi market. Cruise emerged from a startup acquisition in 2016, scaled into a commercial driverless service in San Francisco, Phoenix, Houston, and Austin between 2022 and 2023, and operated a fleet of purpose-built and retrofitted Chevrolet Bolt and Origin vehicles before regulatory and operational events in late 2023 caused the company to pause driverless operations and undertake a significant restructuring. The technology stack and the safety case methodology, however, remain a serious body of engineering and an instructive reference for the structural questions that any AV operator must confront.
The Cruise stack is a conventional modular AV architecture: a multi-modal perception pipeline fusing lidar, radar, and surround-view cameras; an HD map layer maintained for the operating design domain; a prediction module that anticipates the trajectories of other road users; a behavioral planner that selects high-level maneuvers; a trajectory planner and motion controller that execute them; and a vehicle platform with redundant brake, steer, and power subsystems. The system is governed by cost functions that encode safety priorities, collision avoidance, lateral and longitudinal buffers from vulnerable road users, lane-keeping discipline, yielding rules, speed management in proximity to schools, hospitals, and dense pedestrian zones, and each planning cycle selects a trajectory that minimizes the cost subject to feasibility constraints.
Around the runtime sits a substantial safety apparatus. Cruise publicly documented a safety case methodology, a structured argument-and-evidence approach the company used to justify driverless operations. The framework integrates scenario-based validation drawn from a simulation library of millions of synthetic and replayed scenarios, statistical safety metrics computed against fleet operating data, structured incident and near-miss analysis, change-management gates for software releases, and remote-assistance and fallback protocols. Cruise's leadership in operational design domain mapping, ride-share-grade fleet management, and customer-facing AV product UX is real and well documented in the relevant SAE, NHTSA, and California Public Utilities Commission filings.
Within the scope the safety case defines, the engineering is rigorous. The gap analyzed here is not an indictment of Cruise's competence; it is a structural property of how the safety case is constructed. The framework evaluates decisions and outcomes. It does not give the vehicle a first-class internal state representing its own normative consistency over time. That gap is shared by every AV stack currently in commercial or near-commercial deployment, and it is the gap that the Integrity and Coherence layer of US Patent Application 19/647,395 is designed to close.
2. The Architectural Gap
The structural property Cruise's stack does not exhibit is normative state: a persistent, in-vehicle representation of the system's position relative to its own declared safety posture, updated continuously, and directly available to the planner as an input that can adjust behavior before any individual decision violates a rule. The vehicle has cost functions, and it has metrics. It does not have a normative state variable that says "you have been gradually shifting your distribution of safety-margin selections relative to your declared baseline, and the deviation is now significant."
The gap is the distinction between validation and self-awareness. Validation asks whether the current decision satisfies the cost function and the rule set. Self-awareness asks whether the trajectory of decisions over the past hours, days, or thousands of miles remains consistent with the safety posture the system was certified to maintain. An individual decision to continue through an intersection at the lower bound of the buffer envelope satisfies all the rules. A pattern of decisions that consistently selects buffers near the lower bound, in aggregate, represents a shift in the de facto safety posture without any single rule violation. Cruise's architecture detects the former and is structurally blind to the latter.
The consequences are visible in the public record. The widely analyzed late-2023 incident in San Francisco, in which a Cruise vehicle dragged a pedestrian who had been struck by an adjacent human-driven vehicle, was not a single-decision failure in the planner; it was a sequence of decisions, initial classification, response selection, secondary maneuver, post-collision behavior, that each, in isolation, mapped to defined behaviors but cumulatively produced an outcome the system was not equipped to recognize as it was occurring. Post-incident review can construct that recognition retrospectively. The vehicle, in real time, had no architectural state that could.
Three structural sub-gaps follow. First, metrics are not normative state. Collision rates, near-miss frequencies, and disengagement counts measure outcomes after they occur; they do not represent the interior consistency of the decision process that produced them. A system can maintain acceptable metrics while its decision distribution drifts, until the drift produces an outcome that the metrics finally capture. Second, scenario validation is not behavioral coherence. A system can pass every scenario in its validation library while its in-fleet behavior subtly deviates from the distribution the scenarios assume, because the scenario library is a sampling of the space, not a continuous monitor of the trajectory through it. Third, post-incident review is not real-time self-correction. By construction, post-incident review is too late; the structural safety question is whether the vehicle can recognize drift before it produces an incident.
Cruise cannot patch this from inside the cost-function model or the scenario library. Both are inputs to the planner. The missing element is a state variable that the planner consults, and that the fleet manager observes, representing the vehicle's normative coherence as a continuous, computed property. That is a substrate, not a parameter tweak.
3. What the Integrity and Coherence Layer Provides
The Integrity and Coherence layer disclosed in US Patent Application 19/647,395 specifies integrity as a persistent, computed state rather than a metric, and gives the system architectural standing to recognize and correct drift before it produces adverse outcomes. Five properties, all grounded in the disclosure, distinguish it from a validation-and-metrics architecture.
Property one, a three-domain integrity field. The disclosure structures integrity not as a single scalar but as three independently tracked domains: personal integrity (alignment of actions with the system's own declared values and self-imposed constraints), interpersonal integrity (relational behavioral consistency toward the specific entities the system interacts with), and global integrity (consistency with broadly applicable norms). Each domain has different referents and different evaluation criteria, and domain scores feed through a weighting function to produce a composite score stored in the integrity field. In an AV mapping, holding the declared safety-margin posture is personal integrity; consistent, predictable behavior toward a given road user is interpersonal integrity; conformance to the operating-jurisdiction rules of the road is global integrity, and the three can drift independently.
Property two, a deterministic deviation function. The disclosure defines deviation likelihood as D = (N(t) - T(t)) / (E(t) x S(t)), where the numerator (N - T) is deviation pressure, the gap between the system's current need vector and its ethical threshold, and the denominator (E x S) is deviation resistance, the product of an empathy weighting and a self-esteem score. Deviation becomes structurally available only when need exceeds threshold; the multiplicative denominator means both resistance terms must be non-negligible for the system to hold. Because it is a defined function evaluated continuously, deviation is a first-class signal the planner can consult, not an outcome inferred after the fact.
Property three, the coherence trifecta as a corrective loop. The disclosure specifies a three-phase control loop, the coherence trifecta, in which a deviation event triggers empathy registration of the projected harm, integrity recording of the deviation as owned in the lineage, and a self-esteem-driven corrective pressure that produces restorative mutations feeding back to reduce future deviation. This is the structural mechanism by which the system does not merely detect drift but is pushed back toward its declared baseline.
Property four, graded coping intercepts. The disclosure recognizes that when corrective pressure exceeds the system's resilience over a sustained period, the loop cannot run normally, and rather than breaking down it enters a stable-disrupted regime by intercepting the loop at a defined phase. Early, mid, and late intercepts (at the empathy, integrity, and restoration phases respectively) each yield a distinct, characterized degraded mode. This maps directly to graded fallback for an AV: rather than a binary between nominal operation and a hard stop, the system has a spectrum of scoped, recorded degraded regimes.
Property five, an auditable integrity lineage. The disclosure records the integrity state, deviation events, and each coping intercept in the agent's lineage, including the pressure level, the resilience threshold exceeded, the phase intercepted, and the resulting operational change. Combined with integrity-aware trust-slope validation, this produces a forensic record that a system was monitoring its own coherence at the time any decision was made, which is exactly what post-incident review reconstructs today only after the fact. The five properties compose into a substrate: integrity is a first-class computed variable the planner consults as it consults perception, prediction, and the cost function.
4. Composition Pathway
Cruise composes with the Integrity and Coherence layer as a domain-specialized AV runtime over the integrity substrate. What stays at Cruise: the perception stack, the HD map layer, the prediction module, the behavioral and trajectory planners, the simulation library, the safety case framework, the remote assistance protocols, the operational design domain mapping, and the entire commercial relationship with riders, regulators, and the operating jurisdictions. Cruise's investment in urban-driving competence, the dense-pedestrian behavioral models, the construction-zone heuristics, the emergency-vehicle interaction patterns, the unprotected-left maneuver library, remains its differentiated layer.
What moves to the integrity layer as substrate: the integrity state. Each planning cycle, the integrity computation updates the personal, interpersonal, and global domains based on the action just selected, the prediction context, and the declared baseline, and evaluates the deviation function. The deviation signal is an additional input the planner consults alongside the cost function; as deviation resistance is drawn down, the coherence trifecta generates corrective pressure that biases selection toward baseline-consistent maneuvers. When corrective pressure exceeds resilience, a graded coping intercept engages a scoped, recorded degraded regime rather than a single hard fallback. The substrate is invisible to riders; it is a property of the runtime that produces more consistent behavior under degrading conditions.
Fleet-scale comparability composes with Cruise's existing fleet-management infrastructure. Each vehicle publishes its integrity state to a fleet-aggregate view; deviations from the fleet baseline trigger structured review and, if warranted, targeted retraining or scenario-library augmentation. The auditable trajectory composes with the safety case framework: regulator-facing demonstrations, NHTSA filings, and California Public Utilities Commission reports gain a continuous integrity record that complements the existing incident-analysis discipline. The substrate does not replace the safety case; it gives the safety case a real-time interior signal it currently constructs only retrospectively.
5. Commercial and Licensing Implication
The fitting commercial arrangement is an embedded substrate license. Cruise, and by extension General Motors and any successor or partner entity that operates the technology, embeds the Integrity and Coherence layer into the AV runtime and licenses integrity-monitored operation as part of its safety case. Pricing aligns with the AV operator's existing economic model: integrity-state capability is a property of the runtime rather than a separate SKU, with optional deeper telemetry tiers for jurisdictions that require regulator-readable integrity audit trails or for fleet operators that want cross-vehicle comparability across third-party hardware platforms.
What Cruise gains: a structural answer to the "the vehicle was operating within its rules, but the cumulative pattern produced an outcome we did not want" failure mode that has been the dominant narrative in AV regulatory and public-trust discourse since the late 2010s. A differentiated architectural position relative to the broader field, including Waymo, Zoox, Motional, the Tesla FSD program, and Chinese AV operators such as Pony.ai and WeRide, whose publicly described stacks are likewise built on cost-function planning plus scenario validation and fleet metrics rather than a continuously computed, first-class integrity state consulted by the planner. A forward-compatible posture against the evolving NHTSA Automated Driving System rulemaking, the European General Safety Regulation regime, the UN ECE WP.29 framework, and the emerging state-level AV legislation that is converging on "the system can demonstrate it was monitoring its own coherence at the time of any decision."
What the rider, the operating jurisdiction, and the regulator gain: a vehicle that recognizes its own drift, fails more gracefully under degraded conditions through graded coping intercepts, and provides a continuous, auditable record of its normative trajectory rather than only a post-incident reconstruction. In honest framing, the integrity layer does not replace the AV stack. It does not substitute for perception, prediction, planning, or the safety case framework. It gives the stack the integrity substrate it needs and does not currently have. Cost functions tell the vehicle which decision is best right now. Integrity tells the vehicle whether the pattern of its decisions, over time, still matches the system it was certified to be.
6. Disclosure Scope
The mechanisms attributed to the invention in this article, the three-domain integrity field (personal, interpersonal, global), the deterministic deviation function D = (N(t) - T(t)) / (E(t) x S(t)), the coherence trifecta of empathy registration, integrity recording, and self-esteem-driven corrective pressure, the graded coping intercepts and their stable-disrupted regimes, and the auditable integrity lineage with integrity-aware trust-slope validation, are disclosed in United States Patent Application 19/647,395. A skilled implementer can build an integrity layer of this kind by maintaining per-domain integrity scores against a declared value set, evaluating the deviation function each planning cycle from a need vector, an ethical threshold, an empathy weighting, and a self-esteem score, running the three-phase corrective loop, and intercepting the loop at the empathy, integrity, or restoration phase when corrective pressure exceeds resilience. Contemplated embodiments extend beyond the autonomous-vehicle mapping used here to any planner-driven autonomous system, including but not limited to industrial robotics, delegated software agents, and multi-agent fleets, and the composition, weighting, thresholds, and intercept policies are configurable rather than fixed.
Statements in this article about Cruise, General Motors, other named autonomous-vehicle operators, the safety-case methodology, the publicly reported late-2023 San Francisco incident, and the referenced regulatory frameworks (NHTSA, the California Public Utilities Commission, the European General Safety Regulation, and UN ECE WP.29) are external context describing the market and the state of the art. They are provided for comparison only and are not claims of the filing. The named companies and products are the property of their respective owners; no affiliation, endorsement, or characterization of nonpublic architecture is asserted, and any comparison is scoped to the specific architectural axis, a continuously computed, first-class integrity state, that the filing addresses.
