Mechanism

The disclosed mechanism rests on a strict ordering of evidentiary sources. Markers physically embedded in or on a credentialed road segment carry signed payloads identifying the issuing jurisdictional authority, a unique segment identifier, the lane class and geometry of the marker's position, applicable speed and behavioral envelopes, and time-bounded advisory flags such as construction, weather degradation, or emergency reroute. Each marker payload is signed under a credential chain anchored at the segment-issuing authority, and the chain itself is bound to a publicly auditable jurisdictional registry. As the vehicle traverses the segment, its marker reader consumes the stream and emits credentialed observations into the vehicle's composite admissibility evaluator.

The marker-sequence-primary navigation engine treats the governance-credentialed sequence of marker reads as the primary routing reference. The route manifest, an authorized-route manifest composed across one or more authority-credentialed track segments, carries the segments, lane assignments, speed envelopes, and permitted vehicle classes the unit is authorized to execute. Sensor-derived observations from the vehicle's sensor suite operate in parallel, consumed through the cross-domain coherence evaluator for obstacle detection, human-driven vehicle interaction, and conditions not represented in the track topology. When a sensor observation conflicts with the track topology, the unit applies multi-source conflict resolution and a graduated response to select an admissible action rather than silently promoting the sensor observation over the credentialed reference.

A governed fallback is disclosed through progressive-density operational control for conditions in which marker coverage is sparse or absent. On fully marker-equipped segments the unit operates at the segment's rated density with marker-primary navigation. On partially marker-equipped segments with sparse markers and intermittent infrastructure-agent coverage, the unit operates at reduced speed with increased sensor reliance and elevated confidence thresholds for sensor-detected conflicts. On unmarked segments, the unit operates as a governance-credentialed autonomous unit under the applicable operator-class governance with sensor-primary navigation and governed-conservative parameters until marker coverage resumes. The progressive-density controller transitions across these regimes through the confidence governor, and each transition is governance-chain-preserving and recorded in lineage.

Operating Parameters

Linear-segment markers are spaced along track segments and encode segment geometry including curvature, grade, speed envelope, lane assignment, and permitted vehicle classes. The disclosure contemplates denser marker placement at decision points such as switch-points, junctions, and regulatory-zone entry and exit markers, where the route manifest and topology require finer-grained authority. On fully marker-equipped segments with dense markers and continuous switch-point and junction coverage, the unit operates at the segment's rated density.

Credential freshness is bounded by each marker's temporal-validity specification, including an issuance timestamp and a governance-policy-defined expiration. A marker-temporal-consistency evaluator verifies that a marker's temporal validity is consistent with mesh-derived time, and a credential freshness evaluator produces observations of credential validity. A marker whose credential has expired or fails admissibility does not silently authorize routing. The governance chain includes a revocation governed mechanism marking a specific device, credential, or credential class as no longer authoritative, and a marker-revision evaluator verifies that a marker's revision version is the most recent admitted version.

The cryptographic attestation format is not constrained to a single primitive. The disclosure contemplates a digital signature algorithm, a zero-knowledge attestation, a post-quantum attestation, or any equivalent cryptographic attestation mechanism supporting the governance-chain properties, with the format selectable under governance policy. Where a route spans multiple authorities, cross-authority route composition admits joint-authority composition in which route segments are jointly credentialed by two or more authorities under governance-policy-defined contribution rights, alongside sequential, delegated, federated, and escalated authority composition patterns.

Progressive-density transition criteria are governance-policy-defined rather than fixed in vehicle firmware. They include, without limitation, marker-density thresholds, marker-age and marker-health thresholds from health monitoring, sensor-capability thresholds from the capability envelope, infrastructure-agent-coverage thresholds, weather and environmental-condition thresholds, adversarial-condition thresholds, and governance-policy-defined composite thresholds. Because these criteria and the segment's speed envelope, lane assignment, and regulatory overlay are carried in the credentialed topology, a segment can be tuned through governance policy without per-unit modification.

Alternative Embodiments

The disclosure contemplates multiple physical realizations of the credentialed marker. A first embodiment uses passive RFID transponders embedded in the road surface, energized by a vehicle-mounted reader and returning a signed payload. A second embodiment uses optical markers, including retroreflective patterns and machine-readable codes embedded in lane striping, read by a vehicle-mounted camera under controlled illumination. A third embodiment uses magnetic markers whose field signatures encode the credentialed payload, read by a vehicle-mounted magnetometer array. A fourth embodiment uses short-range radio beacons mounted on roadside infrastructure rather than embedded in the surface. The credentialing logic is independent of the physical modality; any modality that can deliver a signed payload to a vehicle reader at the required rate is within scope.

Hybrid embodiments combine multiple marker modalities on the same segment to provide redundancy against single-modality failure. A segment may carry both RFID and optical markers, with the admissibility evaluator treating concordant readings across modalities as higher-confidence than single-modality readings. The fallback path is then triggered only when all modalities fail simultaneously, raising the bar for fallback entry and reducing the duration the vehicle spends in degraded operation.

The disclosure also contemplates embodiments in which the credentialed stream is supplemented by a credentialed wireless channel carrying segment-wide advisories that are not tied to a specific marker location. Such channel-borne credentials must satisfy the same cryptographic attestation and temporal-validity requirements as marker-borne credentials and remain subordinate to the marker-sequence-primary routing reference relative to sensor observations.

Composition with Vehicle Operation

The credentialed marker stream composes with the vehicle's existing perception, planning, and control stack without displacing it. The perception stack continues to detect and classify obstacles, road users, and environmental hazards. The planning stack continues to generate trajectories. The control stack continues to execute those trajectories. What changes is the source of authority for routing decisions: the route manifest that the planner consumes is now constructed from credentialed observations, and the planner is constrained to generate trajectories that lie within the manifest's authorizations.

This compositional structure preserves the manufacturer's investment in the sensor stack and its associated machine learning models. The sensor stack is not replaced; it is repositioned. Its outputs continue to drive obstacle avoidance, emergency braking, and fine-grained trajectory optimization, all of which operate within the envelope the credentialed stream has authorized. The vehicle remains fully autonomous in the sense that no human input is required during operation; it is the source of routing authority that has been inverted, not the operational autonomy itself.

Liability allocation follows the compositional structure. The jurisdictional authority that signs the segment credential is accountable for the correctness of the segment's geometry, lane class, and posted envelopes. The vehicle manufacturer is accountable for the correctness of the marker reader, the credential verification logic, and the admissibility evaluator. The fleet operator is accountable for keeping the unit's authority credentials current and for executing governed fallback correctly when it is invoked. Each party's accountability is recorded in the governance-chain lineage and admits post-hoc audit.

Prior-Art Distinction

Prior autonomous-vehicle architectures operate through sensor-primary navigation, producing path-by-inference routes without governance-credentialed attestation of an authorized route. The disclosed primitive instead operates through governance-credentialed marker sequences as the primary routing reference, so route authorization is provable through authority-credentialed attestation that admits regulatory and liability review.

Prior warehouse automated-guided-vehicle architectures operate on private infrastructure with guide-wire or magnetic-tape guidance and without public-road shared-use governance. Prior guided-bus systems require dedicated physical guidance infrastructure and dedicated right-of-way. The disclosed primitive operates on public infrastructure with shared-use governance differentiation and without physical guidance beyond passive markers, and without right-of-way acquisition.

Prior truck-platooning systems operate without marker-encoded topology and without governance-credentialed route authorization, whereas the disclosed primitive supports platooning within a governance-credentialed track topology with junction-aware routing. Prior rail freight and passenger systems require dedicated right-of-way, track construction, and rolling stock, whereas the disclosed primitive provides rail-analogous properties on existing public infrastructure.

Prior autonomous-vehicle services operate without regulator-reviewed per-segment approval. The disclosed primitive produces segment-by-segment governance-credentialed authorization that admits regulatory review prior to deployment, supports progressive-density operation with governed fallback across mixed infrastructure, and supports cross-authority route composition spanning multiple jurisdictional authorities. Existing V2X proposals, including DSRC and Cellular V2X, define cross-vehicle message formats but do not provide governance-credentialed per-segment routing authority of this kind.

Disclosure Scope

U.S. Provisional Application No. 64/049,409 discloses the marker-track transport primitive, including marker-sequence-primary navigation, route-manifest construction and cross-authority composition, the marker-read admissibility evaluator with adversarial-marker rejection, progressive-density operation with governed fallback, Byzantine-robust platooning, and multi-class operator parameterization. The scope reaches any transport unit that consumes a governance-credentialed marker sequence as its primary routing reference on a credentialed segment, regardless of the manufacturer of the sensor stack, the physical modality of the marker, or the cryptographic attestation primitive used to credential the payload.

Where a jurisdictional authority adopts marker-track per-segment approval as a precondition for commercial autonomous operation within its boundaries, fleets operating on those segments integrate with the marker-sequence-primary architecture. The disclosure aligns the approval model with the road-owning authority's own expertise, since the segment authority that signs the credentialed topology is the party accountable for that segment's geometry, speed envelope, and lane assignment.

The disclosure also reaches the approval process itself. A unit is approved to operate on credentialed segments by demonstrating that its marker reader correctly consumes a representative credentialed marker sequence, that its admissibility evaluator correctly applies marker-sequence-primary ordering and rejects inadmissible marker reads, and that its governed fallback is correctly triggered and bounded. The fleet operator's continuing obligation includes maintaining current authority credentials and reporting fallback and incident events through the governance-chain lineage record, supporting post-hoc audit of route authorization decisions.