Marker Track Transport: Credentialed Marker Sequences as Primary Routing

1. Problem and Architectural Premise

The dominant L4/L5 deployment model loads the certification burden onto the sensor stack. Each operator must persuade state DOTs, federal regulators, and insurers that its perception, prediction, planning, and control software produces safe behavior across the full long tail of conditions the operating design domain admits. The persuasion happens through a mix of mileage accumulation, disengagement reporting, scenario-coverage arguments, and post-incident review. After a decade of effort and tens of billions of dollars of capital, this approach has produced limited commercial deployment in narrow geographic windows around a small number of metropolitan areas.

The reason is not primarily that sensor-primary stacks are unsafe. It is that the certification model is structurally mismatched with the regulatory authority's actual capacity. State Departments of Transportation are organized to certify roads. They certify lane geometry, signage placement, signal timing, pavement condition, work-zone configuration, and right-of-way encroachments. They have inspectors, engineering standards, and decades of accumulated case law to support those certifications. They are not organized to certify software. They have no inspectors qualified to audit a deep-learning perception stack, no engineering standards equivalent to AASHTO for a planner, and no case law allocating liability when a learned policy fails. The authority required to approve an autonomous deployment thus requires the regulator to operate outside its expertise and to accept liability for decisions it cannot meaningfully audit.

Regulators have responded as one would expect. They have deferred deployment, required per-mile safety-driver monitoring, restricted routes to narrow geofenced windows, demanded weekly disengagement reports without specifying how those reports inform certification, and in several jurisdictions simply refused to certify. The cumulative effect is that L4/L5 commercial services remain niche after a decade of investment that would, in a structurally aligned regulatory model, have produced widespread deployment.

The architectural premise of marker-track transport is that the certification target is wrong. A regulator cannot meaningfully certify a sensor stack, but a regulator can certify a road segment—and indeed already does. If the navigable environment, not the sensor stack, is the primary routing reference, then per-segment authorization replaces per-vehicle stack certification as the regulatory basis for operation. Sensor-stack robustness becomes a fallback for unmarked stretches and a cross-check on credentialed sequences, rather than the primary safety basis. This realigns regulatory effort with regulatory expertise and unlocks the deployment cadence that sensor-primary models have failed to deliver.

2. The Core Architectural Primitive: Credentialed Marker Sequences as Primary Routing

Marker-track transport defines the primary routing reference for an autonomous operating unit as a sequence of authority-credentialed waypoint markers installed in the navigable environment by the jurisdictional authority that owns that environment. Each marker is a credentialed object: it carries a payload signed by the issuing authority that includes the jurisdictional identifier, the segment identifier, the waypoint identifier within the segment, the lane class, the geometry hint that resolves the marker's position to a mesh-coordinate frame, and a set of advisory flags (work zone, school zone, restricted class, time-of-day constraint). A marker sequence is a totally ordered set of markers within a segment that the operating unit traverses in order under a single authority's signed authorization.

A route from origin to destination is a composition of marker sequences across the authorities the route crosses. The route manifest is the data structure that records the sequence of segments, the issuing authority for each segment, the credentials presented at each segment boundary, and the operating mode under which the unit committed to traverse each segment. The manifest is computed before traversal where possible, refined during traversal as marker observations arrive, and recorded in lineage on completion.

The structural inversion is that the operating unit's primary obligation is not to understand all possible road conditions but to correctly read, evaluate, and follow credentialed marker sequences. Sensor-stack capability is a fallback that engages when a marker sequence is absent (an unmarked stretch), interrupted (a damaged or missing marker), or insufficient (a hazard not anticipated by the credentialing authority). The fallback engagement is itself a structurally recorded mode, and the operating unit's behavior under fallback is constrained by the policy of the authority that signed the surrounding credentialed segments.

The primitive does not require uniform marker coverage. Progressive-density fallback admits continuous operation across fully-marked, partially-marked, and unmarked segments with operating-mode transitions governed by the same composite admissibility evaluator that gates confidence-governed actuation. A first-mile / last-mile city deployment can be valuable on day one with a few thousand markers; corridors get retrofitted incrementally; coverage densifies based on demand and on the regulatory authority's prioritization of segments where marker-track operation is preferred over sensor-primary fallback.

3. The Three-Tier Marker Architecture

The disclosed marker architecture stratifies environmental devices into three tiers that compose into a single credentialed payload graph. Tier 1 markers are passive: RFID studs embedded in pavement at lane edges and intersection approaches, optical fiducials (high-contrast retroreflective patches with embedded identifiers) installed on signage and gantries, NFC tags installed at transition points and pedestrian interfaces, and magnetic markers installed in lane centers for high-precision lateral guidance. Tier 1 unit cost ranges from cents (NFC, RFID) to a few dollars (magnetic, retroreflective optical), installation time is in seconds to minutes per unit, lifetime is in years to decades, and read interfaces are off-the-shelf. Each Tier 1 marker carries a signed payload of approximately 64 to 1,024 bytes including the credential.

Tier 2 sentinels are active: traffic signals broadcasting their current phase and remaining duration in a credentialed envelope, gantries broadcasting toll-zone parameters and lane allocations, transit-station apparatus broadcasting boarding-state and platform-edge status, port apparatus broadcasting berth occupancy and crane reservation, and work-zone beacons broadcasting transient lane closures and worker-presence flags. Tier 2 sentinels communicate over the same credentialed wire format as Tier 1 markers but add live attestations of state, time of attestation, and freshness window. Tier 2 unit cost ranges from tens to thousands of dollars depending on radio class and integration; deployments are bounded by power and backhaul rather than by per-unit cost.

Tier 3 cognitive infrastructure agents are full computational agents installed at intersections of regulatory significance, transit stations, port aprons, hospital corridors, warehouse cross-docks, and high-throughput corridors. They produce composite observations across the Tier 1 and Tier 2 devices in their region, forward and aggregate broadcasts under their authority, serve as routing brokers for inbound queries from operating units, mediate handoffs between adjacent Tier 3 regions, and act as the on-site representatives of the issuing authority for purposes of lineage attestation. Tier 3 unit cost ranges from thousands to tens of thousands of dollars; deployment density is determined by regulatory significance rather than by uniform geographic coverage.

The three tiers compose along a coverage gradient. An unmarked segment has no marker-track infrastructure and is traversed under sensor-primary fallback. A Tier-1-only segment is marker-track-equipped with static authority adequate for lane-edge guidance and segment identification. A Tier-1-plus-Tier-2 segment adds live attestation adequate for signal-phase coordination and dynamic-state awareness. A fully equipped segment with all three tiers supports composition, forwarding, query, and on-site authoritative attestation. The composition is monotone: adding tiers expands the admissible operating modes; removing tiers contracts to sensor-primary fallback within the policy of the surrounding signed segments.

4. Route Manifest Composition Across Authorities

A real route from origin to destination crosses multiple jurisdictional authorities. A morning commute may begin on a private residential drive, cross onto a city street, transition to a state route, enter an interstate corridor, exit onto a county arterial, traverse a port authority's apron, and end on a private terminal. Each of these authorities has its own credentialing apparatus, its own signing keys, its own segment classification scheme, and its own policy for which operating-unit classes it admits.

Marker-track transport does not require pre-negotiated interoperability between authorities. Each authority signs the credentialed markers in its own segments under its own root. Each operating unit decides, through its admitted-authorities policy, which authorities it accepts as primary routing references and which it accepts only as advisory. The route manifest emerges from the intersection of the marker sequence the unit observes and the authority set the unit's policy admits. An authority unfamiliar to a unit produces a structural fallback to sensor-primary mode in that authority's region rather than a refusal to enter—the unit can still traverse, but does so under a less-authoritative mode that is recorded in lineage and that constrains downstream actuation through the confidence-governed actuation primitive.

Cross-authority composition handles boundary transitions structurally. At a jurisdictional boundary, the unit observes a transition marker that carries credentials from both the outgoing and incoming authorities. The composite admissibility evaluator recomputes the operating mode for the new segment using the incoming authority's credentials and the unit's policy for that authority. The transition is a structural event recorded in lineage with both signatures and with the operating-mode delta; an auditor inspecting the lineage sees not only that the unit crossed the boundary but under whose authority it operated on each side.

Route manifest composition supports cross-authority delegation. A regional authority can delegate to a municipal authority by issuing credentials to the municipality's signing key; the municipal authority's markers are then accepted by units that admit the regional authority. Delegation chains are bounded by the operating unit's policy on chain depth and on intermediate-authority class. Delegation revocation is structural and propagates through the governance-chain primitive that authenticates marker credentials.

5. Progressive-Density Fallback and Adversarial-Marker Rejection

Marker-track transport does not require uniform infrastructure density and does not require the entire navigable environment to be credentialed before any segment provides value. Progressive-density fallback admits continuous operation across fully-marked, partially-marked, and unmarked stretches. On a fully-marked segment, the operating unit operates in marker-primary mode with sensor-stack output as cross-check; the credentialed sequence is the routing reference and sensor disagreement raises a verification event but does not by itself preempt the marker. On a partially-marked segment, the unit operates in hybrid mode with both contributions weighted under a published weighting function; weights track marker density, marker freshness, and sensor-stack confidence. On an unmarked segment, the unit operates in sensor-primary mode with the regulatory framework explicitly recognizing the diminished authority basis and the actuation primitive applying tightened modes.

Adversarial-marker rejection runs structurally rather than as a heuristic perception filter. A marker that fails its cryptographic credential check is excluded from the route manifest. A marker whose credential verifies but whose position in the credentialed sequence does not match the surrounding markers (a duplicated identifier, an out-of-order waypoint, a mismatched segment) is excluded. A marker observed at a position inconsistent with its credentialed geometry hint within tolerances of the order of 5 to 50 centimeters depending on marker class is excluded. A marker that verifies and positions correctly but whose issuing authority is not in the operating unit's admitted set is downgraded to advisory. An adversary placing fake markers thus faces the entire credentialing apparatus—jurisdictional signing keys, the governance-chain root, and the operating unit's admitted-authority policy—rather than facing only the per-vehicle sensor stack.

Progressive-density fallback solves the chicken-and-egg deployment problem that has stalled vehicle-to-infrastructure programs for two decades. Deployments do not require complete coverage to provide value. A first-mile / last-mile city deployment with a few thousand Tier 1 markers and a dozen Tier 3 agents at signalized intersections provides immediate value for downtown delivery and shuttle operations. Corridors get retrofitted incrementally as freight operators or transit authorities sponsor segments. Coverage densifies along the gradient of regulatory and economic priority rather than requiring a single large capital commitment.

6. Operating Parameters and Engineering Envelope

Marker payload sizes range from approximately 64 bytes for a constrained Tier 1 NFC tag carrying jurisdictional identifier, segment identifier, waypoint identifier, and a truncated signature, to several kilobytes for a Tier 3 agent attestation carrying live state, freshness window, peer references, and full signature chain. Read distances range from contact-class (NFC, magnetic) at zero to a few centimeters, through short-range RFID at one to ten meters, to optical fiducial reads at tens of meters under daylight conditions and tens to hundreds of meters under retroreflective return.

Marker density on credentialed segments ranges from approximately 10 to 500 markers per kilometer of lane depending on environment class. Highway lanes operate at lower density (lane-edge markers every 50 to 200 meters, intersection-approach markers at 500-meter and 100-meter pre-positions). Urban arterials operate at higher density (markers at every approach, every signal, every transition). Port aprons and warehouse aisles operate at the highest density (markers on every storage location and every traversal path).

Credential verification latency on the operating unit ranges from sub-millisecond for cached authority keys to tens of milliseconds for a fresh chain walk against the governance-chain root. Verification is performed at marker-read time and again at composite admissibility evaluation time within the confidence-governed actuation primitive; both checks are recorded in lineage. Marker freshness windows range from years (Tier 1 static markers) to seconds (Tier 2 signal-phase attestations); freshness is enforced by the operating unit's admissibility evaluator and stale Tier 2 attestations downgrade the operating mode rather than producing a hard refusal.

Deployment cost envelopes range from approximately one to ten thousand dollars per kilometer of lane for Tier 1 retrofit, to ten to one hundred thousand dollars per intersection for Tier 2 sentinel deployment, to hundreds of thousands per Tier 3 agent installation depending on civil-works requirements. These envelopes are within the maintenance-and-capital budgets that DOTs and port authorities already operate at; they do not require the unprecedented capital commitments that historical V2I programs have demanded.

7. Alternative Embodiments

The primitive is disclosed primarily for road-vehicle transport but applies without architectural change to a broad class of credentialed-environment domains. In maritime port operations, marker sequences credential berth approaches, container handling lanes, and gate transitions; Tier 3 agents represent the harbormaster's authority on the apron. In airport ground operations, marker sequences credential taxiway centerlines, hold-short positions, gate approaches, and ramp transitions; Tier 3 agents represent ground-control authority. In hospital and clinical environments, marker sequences credential corridor segments, room thresholds, and restricted zones for autonomous beds, medication carts, and surgical-support robots; Tier 3 agents represent the facility's clinical authority. In warehouse and fulfillment-center environments, marker sequences credential aisle segments, pick faces, charging dock approaches, and human-zone boundaries for AMRs and autonomous forklifts. In agricultural and mining environments, marker sequences credential field rows, haul roads, and operating-zone boundaries for autonomous machinery.

Marker physical embodiments are domain-configurable. Pavement-embedded RFID is appropriate for road and warehouse domains. Optical fiducials are appropriate for port and airport domains where line-of-sight is reliable. Acoustic markers are appropriate for maritime under-keel and submerged-pipeline applications. Inductive-loop markers are appropriate for instrumented-roadway retrofits. The credential structure—issuing authority, segment identifier, waypoint identifier, payload, signature—is constant across physical embodiments; only the wire format changes.

Cognitive-infrastructure-agent embodiments range from edge-class compute at signalized intersections to building-scale compute at port operations centers. Agents may be operated by the issuing authority directly, by delegated infrastructure operators under credentialed delegation, or by federated consortia (e.g., a regional toll authority operating Tier 3 agents for a multi-state corridor under shared credentials).

8. Composition with the Broader Spatial Architecture

Marker-track transport composes with the other primitives of the same provisional to produce a complete spatial chain. Mesh-coordinates resolve marker geometry hints into a shared positional frame across operating units and infrastructure agents. Governance-chain authenticates marker credentials and propagates revocations, delegations, and policy updates from issuing authorities to operating units and to infrastructure agents. Observation-quorum aggregates marker observations across multiple operating units and across Tier 2 and Tier 3 attestations to produce evidential weighting for the composite admissibility evaluator. Confidence-governed actuation consumes the route manifest and the marker-bound traversal admissibility as inputs and produces the graduated mode under which the operating unit commits to traverse each segment.

Composition with confidence-governed actuation produces refuse-route as a structurally distinct mode. When the marker sequence ahead carries credentials the operating unit's policy does not admit, when the route manifest fails verification, when a Tier 2 attestation is stale beyond policy bounds, or when adversarial-marker rejection has excluded enough markers that the surviving sequence is below the density threshold for the requested operating mode, the actuation primitive returns refuse-route. The upstream planner then seeks an admissible alternative—a different lane, a different segment, a delay until attestations refresh, or a deferral to a remote operator.

Byzantine-robust platooning under credentialed sequences emerges from the composition. When multiple operating units traverse a marker-track corridor in coordinated formation, the marker sequence provides a shared coordination reference. Each unit independently reads the credentialed markers and broadcasts its own platooning state through the governed mesh. A Byzantine-robust consensus over the broadcasts—drawing on the observation-quorum primitive—allows platoons to operate even when a fraction of participating units are misreading or are adversarially misreporting their state. The platooning mode itself is graduated through the confidence-governed actuation primitive: tight platooning under high-confidence marker continuity, looser spacing under partial coverage, separation under sensor-primary fallback.

9. Prior-Art Distinctions

This primitive is distinct from GPS- and HD-map-based navigation. GPS provides position; HD maps provide expected geometry. Neither provides credentialed authority over a route; neither authenticates the routing reference under a jurisdictional signing key; neither enables per-segment regulatory authorization in place of per-vehicle sensor-stack certification. Marker-track transport may use GPS and HD maps as inputs, but the primary routing reference is the credentialed marker sequence under the issuing authority's signature.

It is distinct from AprilTag, ArUco, and analogous fiducial-localization systems. Those systems read uncredentialed visual fiducials for relative positioning in robotics and AR applications. The governed primitive's markers carry cryptographic authority, jurisdictional binding, signed payloads, and route-manifest semantics; the markers are credentialed objects rather than passive visual features.

It is distinct from E-ZPass, DSRC, C-V2X roadside-unit (RSU) infrastructure, and SAE J2735 messaging. RSUs and V2X messaging provide a communication channel between vehicles and infrastructure but do not constitute primary route authorization; the regulatory basis for vehicle operation in V2X-equipped environments remains the per-vehicle sensor-stack certification. The governed primitive's markers and Tier 2 sentinels are the regulatory basis for operation, not just a communication channel.

It is distinct from geofencing. Geofencing defines polygons of permitted or prohibited operation by GPS coordinate; it does not provide credentialed waypoint sequences, does not authenticate the boundary under a signing authority's key, and does not support per-segment authorization within the geofence.

It is distinct from lane-keeping ML and end-to-end autonomy stacks. Those systems treat lane markings, signs, and road geometry as perceptual inputs to a learned policy. The governed primitive treats markers as credentialed routing objects whose authority is independent of perception confidence; perception remains a fallback and a cross-check, not the primary basis.

It is distinct from AGV guide-wires, magnetic strip following, and guided-bus systems. Those require physical guidance infrastructure with continuous coverage and dedicated right-of-way. The governed primitive operates on existing public infrastructure with discrete credentialed waypoints rather than continuous guidance, supports progressive-density partial coverage, and does not require right-of-way acquisition.

10. Disclosure Scope

This primitive is disclosed under USPTO provisional 64/049,409 as the marker-track step of the five-property spatial chain. The disclosure encompasses credentialed marker sequences as primary routing reference, the three-tier passive-marker / active-sentinel / cognitive-infrastructure-agent architecture, route manifest composition across multiple jurisdictional authorities under operating-unit-policy admission, progressive-density fallback with structural mode transitions across fully-marked / partially-marked / unmarked segments, adversarial-marker rejection under cryptographic and positional consistency checks, lane authority delegation through governance-chain credential issuance, marker-bound traversal admissibility as an input to confidence-governed actuation, and route-credentialed handoff at jurisdictional boundaries.

The disclosure is independent of marker physical embodiment. RFID, optical fiducial, NFC, magnetic, acoustic, and inductive embodiments are within scope. The disclosure is independent of operating-unit class. Road vehicles, port equipment, airport ground vehicles, hospital robots, warehouse AMRs, agricultural machinery, and mining haul trucks are within scope.

The disclosure composes with and depends on the other primitives of the same provisional: mesh-coordinates for positional frame, governance-chain for credential authentication, observation-quorum for evidential weighting, and confidence-governed actuation for graduated commit under marker-bound admissibility. Practitioners implementing only marker-track without the supporting chain will obtain partial benefit; full regulatory and operational benefit requires integrated implementation.