Lineage-Bound Multilateration

Mechanism

The lineage-bound multilateration solver accepts as input a candidate set of credentialed range observations, each of which is itself a signed, lineage-stamped record produced by a participating ranging modality. Before any geometric computation is performed, the solver executes an admission pass over the candidate set: each observation is verified for signature integrity against the issuing unit's published key, for lineage continuity from the modality of origin through any intermediate aggregation steps, and for freshness against the solver's declared validity window. Observations that fail admission are excluded from the solution and recorded as rejections in the position record's provenance section, so that the absence of an observation is itself an auditable fact rather than a silent omission.

Once the admitted set is fixed, the solver performs the geometric computation under a declared uncertainty model. Each admitted observation contributes a range and an uncertainty term derived from the credentialed observation record itself; the solver does not substitute, smooth, or override these terms with internally generated values. The position estimate emerges from a weighted least-squares formulation in which the weighting is fully derived from observation-supplied uncertainties. The solution covariance, the per-observation residual, and the geometric dilution of precision are computed as structural by-products of the same solve and are bound into the resulting position record.

The solver then constructs the position record. The record contains: the position estimate itself in the declared coordinate frame; the contributing observation set, listed not by value but by reference to the credentialed observation records, so that the lineage chain remains traversable; the solution covariance derived from observation uncertainties; the per-observation residuals identifying observation-quality patterns; the rejection list with admission-failure reasons; the declared uncertainty model; the solver identity; and a signature binding the entire record to that solver identity. The record is the unit of distribution. Downstream systems do not receive the coordinates alone; they receive the structured claim from which the coordinates are recoverable along with the evidence that warrants them.

The cryptographic binding is the load-bearing element. Because every contributing observation is itself a signed record, and because the position record references those observations by their lineage identifiers and is itself signed, an auditor presented with a position record at any later time can independently verify three things: that the named solver produced the record, that the named observations are the ones that participated, and that those observations were themselves the genuine, unaltered output of their respective ranging modalities. Any attempt to alter an observation, substitute a fabricated observation, or rewrite the residual structure invalidates the chain at a structurally detectable point.

Operating Parameters

The solver operates under several declared parameters that govern admission and solution behavior. The validity window establishes the maximum age, measured against the solver's reference clock, that an observation may have at the moment of admission; observations older than the window are rejected as stale regardless of signature validity. The minimum observation count establishes the smallest admitted set that may proceed to solution; below this count, the solver emits a no-solution record with the admitted-set listing rather than a degraded position. The geometric quality threshold establishes a maximum admissible dilution-of-precision figure; geometries that would yield ill-conditioned solutions are rejected at the geometry stage and reported as such.

The uncertainty model is itself a declared parameter, not an implementation detail. The solver publishes which uncertainty model it applied, so that downstream consumers performing admissibility evaluation against operational requirements can determine whether the declared model is acceptable for their use. A consumer that requires conservative bounding may admit only position records produced under a worst-case model; a consumer that operates with looser tolerances may accept records produced under a maximum-likelihood model. The model itself does not change the verification path; it changes only the meaning of the covariance term that the verification path certifies.

The lineage-depth requirement is a further parameter. A consumer may require that contributing observations carry lineage not merely back to the issuing unit but back through the issuing unit to the originating sensor element. The solver records the available depth for each observation; consumers performing admissibility evaluation can then accept or reject the record based on whether the available depth meets their policy.

Alternative Embodiments

The disclosure contemplates several embodiments of the lineage-bound multilateration mechanism. In a homogeneous embodiment, all contributing observations originate from a single class of ranging modality, such as time-of-flight radio ranging among a fixed mesh of units; the lineage chain is short and the uncertainty model is uniform. In a heterogeneous embodiment, contributing observations originate from a mixture of modalities — radio, acoustic, optical, inertial-derived — each with its own uncertainty characteristics; the position record retains per-observation modality identification so that downstream consumers can perform modality-aware admissibility evaluation.

In a hierarchical embodiment, intermediate aggregators consume credentialed observations from a local cluster of units, produce intermediate range or pseudo-range claims, and forward those intermediate claims to a higher-tier solver. The lineage chain in this embodiment is correspondingly longer and the position record records each tier of the chain. In a flat embodiment, the solver consumes only observations directly produced by ranging units, and the lineage chain is correspondingly short.

In a streaming embodiment, the solver continuously updates a position estimate as new observations arrive, emitting a sequence of position records each bound to the observation set valid at that emission instant. In a batched embodiment, the solver consumes a fixed observation set captured over a declared interval and emits a single position record per batch. The structural form of the position record is identical across these embodiments; the scheduling and observation-aggregation policy differs.

Composition

The position record composes with the broader mesh-coordinates architecture as a credentialed positional claim. Its consumers — path planners, geofence evaluators, actuation governors, regulatory data recorders — admit the position record under their own admissibility policies before integrating its content. The admissibility evaluation is structurally identical to the evaluation that the solver itself applied to the contributing observations: signature integrity, lineage continuity, freshness against a consumer-declared validity window, and uncertainty against operational requirements. The architecture is recursive in this respect; positions are admitted exactly as observations are admitted, and the consumer of a position-derived decision admits that decision exactly as the position is admitted.

The position record also composes with the lineage retention substrate. The architecture retains position records alongside the contributing observation records they reference, preserving the full chain for a declared retention period. A subsequent audit, conducted weeks or months after the operational decision, can reconstruct the full evidentiary chain from the actuation event through the position record through the contributing observations to the originating modalities to the originating units. Each step is structurally supported by the records themselves; no engineering reconstruction or implementation knowledge is required.

Prior Art

Conventional multilateration systems treat the position estimate as a numeric output. The contributing observations are consumed, the solver runs, and the coordinates are emitted; the observation set is typically discarded, retained only in volatile logs, or summarized in aggregate statistics. Where audit is required, the audit reconstructs the observation set from external logs, correlates it with the solver implementation by engineering inspection, and infers the chain by which the position must have been produced. This reconstruction depends on the integrity of the external logging pipeline and the accuracy of the engineering inference.

Existing schemes that bind observations cryptographically typically bind only at the observation layer; the position emerging from the solver is a fresh quantity disconnected from the observations that produced it. An auditor in such schemes can verify that observations existed and were genuine, but cannot structurally verify that those specific observations produced this specific position. The lineage gap between observation and solution is the failure mode that lineage-bound multilateration closes: by binding the position record to the contributing observation records cryptographically and by reference, the scheme makes the position itself a verifiable claim rather than an unverifiable consequence.

Prior Art (continued)

Approaches that retain observation logs for post-hoc reconstruction are similarly insufficient. A retained log establishes that observations existed and that the solver was running; it does not establish that the position emitted at a given moment was the structural consequence of those specific observations under the declared uncertainty model. A solver implementation defect, a silent observation substitution within the solver, or a transient deviation from the published uncertainty model would not be detectable from a retained observation log alone. Lineage-bound multilateration closes this gap by binding the solver's output to its inputs at the moment of solution, so that the output is not interpretable except in terms of those specific inputs and that specific model.

Schemes that emit tamper-evident position telemetry without a contributing-observation reference are likewise narrower than the disclosed mechanism. Such schemes establish that the position telemetry was not modified after emission; they do not establish what produced the position. The auditor can confirm that the solver claimed a coordinate but cannot independently confirm that the coordinate is consistent with verifiable evidence. Lineage-bound multilateration provides both bindings — output integrity and input pedigree — as a single structural record.

Disclosure Scope

The disclosure of Provisional 64/049,409 covers the mechanism by which a multilateration solver produces position records bound by signed reference to the lineage of contributing range observations, including the admission pass that excludes tampered or unstamped observations, the structural composition of the position record, the recursive admissibility evaluation by which downstream consumers admit positions as they admit observations, and the alternative embodiments that vary in modality composition, lineage depth, and emission scheduling. The scope encompasses any system in which a position estimate emitted by a multilateration solver carries cryptographic lineage to its contributing observations sufficient for independent reconstruction and verification by an auditor distinct from the solver and from any contributing unit.

The scope further encompasses the recursive application of the same admissibility pattern at each consumption stage, such that a position record consumed by a path planner is admitted on the same structural basis on which the planner's own outputs are admitted by an actuation governor, and on which the actuation governor's outputs are admitted by a regulatory recorder. The disclosure contemplates that this recursive admissibility, taken together with the lineage retention substrate, yields an end-to-end evidentiary chain from sensed reality through admitted observation, admitted position, admitted plan, admitted command, and admitted actuation, with each link verifiable independently of the others and the entire chain reconstructable by an auditor with no implementation knowledge of any link.