1. Problem and Architectural Premise

Autonomous and unmanned systems resolve position through the same recipe almost universally: a GNSS receiver supplies absolute coordinates, an inertial measurement unit dead-reckons through brief outages, and an optional aiding sensor (lidar, visual odometry, RTK correction stream) tightens the solution where infrastructure is present. The recipe is robust in benign conditions and collapses outside them. Urban canyons degrade the solution through multipath. Forest canopy attenuates the signal. Indoor environments lose lock entirely. Tactical jammers produce denied bubbles around their emitters. Commercial spoofing has been demonstrated against ships, drones, and timing infrastructure with off-the-shelf software-defined radios.

Each existing fallback presupposes specific pre-installed and uncompromised infrastructure. Real-time-kinematic GNSS requires a surveyed base station within correction range whose corrections the rover trusts implicitly. Ultra-wideband (UWB) localization requires anchor beacons surveyed to known positions and powered for the operating window. V2X cooperative perception messaging requires roadside units along the route. Bluetooth fingerprinting requires a calibrated radio map. None of these scale to expeditionary deployment, disaster response, contested logistics, indoor warehouse robotics without infrastructure investment, or operations across geographies that simply lack the prerequisite installations.

The deeper architectural gap is that no current coordinate primitive is anchorless. Every system in production assumes it can resolve to a global frame through external authoritative anchors. When the anchors are absent, jammed, spoofed, or politically unavailable, the system either degrades to dead-reckoning (which drifts unboundedly) or fails outright. There is no production primitive in which a coordinate frame can be bootstrapped from peer observations alone, populated with credentialed positions, used for navigation and actuation in that bootstrapped state, and later reconciled with an absolute frame when one becomes available. There is also no production primitive in which range observations are individually authenticated by their originator, so that a spoofed pseudorange or fake beacon is rejected at the credential layer rather than admitted to the multilateration solution.

The premise of mesh-derived coordinates is that a coordinate frame is itself a credentialed observation. The frame is constructed from credentialed range observations between credentialed peers. The frame's origin, axes, and scale are signed observations. The frame can be relative-only and remain useful, and it can promote to absolute through a credentialed alignment observation when the alignment becomes available. Authentication, anchorlessness, and densification are jointly addressed by a single primitive rather than bolted on top of an architecture designed around assumed-good GNSS.

2. Core Architectural Primitive

The primitive consists of three jointly defined elements: a credentialed range-observation type, an anchor-less coordinate-frame observation, and a multilateration observation that consumes the first two and produces a position with declared uncertainty. Each is signed under credentials issued by one or more authorities and recorded with full lineage.

A range observation is a credentialed measurement between two participating mesh agents produced through one of the fifteen-plus ranging modalities the primitive admits into a single coordinate graph. Each observation declares its modality, its claimed range with declared ranging precision, the originator and target identifiers, the timestamp under mesh-time, and the originator's credential signature.

A coordinate-frame specifier defines the frame type, origin, orientation, scale, and temporal association of the coordinate system. The first participating unit declares the origin frame; subsequent units adopt the frame by referencing the origin observation. A coordinate-frame federation mechanism aligns two or more independent mesh-derived coordinate systems, so that a relative-only frame can be aligned with an absolute frame when an authoritative external anchor (a unit with admitted GNSS, a surveyed RTK base, a credentialed monument) joins the mesh and contributes its admitted anchor position.

The multilateration observation is the position produced by a cooperative localization engine that determines agent positions from admitted range observations and admitted anchor positions against the current coordinate frame. The position is signed by the producing unit and references the contributing range observations by lineage. A precision-and-uncertainty propagator propagates ranging precision and ranging-covariance through the localization chain to produce a per-position uncertainty estimate, and an ambiguity-resolution mechanism selects among solutions when the multilateration admits more than one. Where direct-anchor ranging is insufficient, a transitive localization extender produces positions through neighbor references.

The cooperative property is structural rather than optional. A unit does not position itself by passively receiving anchor broadcasts; it positions itself by exchanging credentialed range observations with whichever credentialed peers it can reach, where the peers may be other operating units, infrastructure devices, fixed monuments, deployable beacons, or vehicles of opportunity. The resulting position is grounded in the credential graph of the contributing peers rather than in the assumed authority of any single anchor.

3. Anchor-Less Bootstrap and Frame Federation

Anchor-less operation is the operating mode that distinguishes the primitive from every prior fallback. When no authoritative absolute-frame anchor is reachable, no admitted GNSS, no surveyed RTK base, no credentialed monument, no admitted survey database, an anchor-less bootstrap mechanism produces a relative-only coordinate frame from zero-anchor conditions. The first participating unit publishes a frame observation declaring itself the origin, with axes oriented per a declared convention (typically gravity-aligned z-axis from the unit's IMU and an arbitrary x-axis from the unit's heading). Subsequent units publish their own credentialed range observations to the origin unit and to each other, and each unit's multilateration produces a position in the bootstrapped frame.

The bootstrapped relative frame is a first-class coordinate space, not a degraded fallback. Operating units carry positions in the frame; navigation, formation control, collision avoidance, and actuation proceed identically to absolute-frame operation. Mission tasking, geofencing, and rendezvous coordinates can all be expressed in the relative frame and remain operationally meaningful so long as the participants share the frame observation. The frame does not need an absolute alignment to support cooperative work.

Coordinate-frame federation is the credentialed mechanism that aligns the relative frame with an absolute frame. When an authoritative anchor later joins the mesh, a unit with admitted GNSS regains lock, a surveyed monument is brought into communication range, a credentialed survey vehicle deploys into the operating area, its admitted anchor position contributes to aligning the bootstrapped relative frame with the absolute frame. The federation event is recorded in the coordinate lineage, and positions in the relative frame can be re-expressed in the absolute frame once the alignment is admitted. Ongoing operations continue without disruption.

Federation is reversible under credential. When the absolute anchors fail (jamming onset, spoofing detection that invalidates the anchor's admissibility, monument loss), the alignment is no longer admissible and operation continues in the relative-only frame. The unit's positions remain valid in the relative frame; the absolute expression is suspended until alignment can be re-established. The architecture treats GNSS availability as a feature of the operating environment rather than a precondition for operation.

4. Credentialed Range Observations and Spoof Rejection

Adversarial range injection, spoofed GPS pseudoranges, fake UWB beacons, manipulated RTK correction streams, replayed time-difference-of-arrival fixes, defeats current localization stacks because the receiver has no architectural way to authenticate the originator of any individual range observation. The primitive rejects these attacks structurally by treating each range observation as a credentialed message rather than as a passive radio-frequency input.

Every range observation carries the originator's credential signature over the observation's content (modality, range, uncertainty, timestamp, target identifier). Receiving units verify the signature against the credentialing authority before admitting the observation into the multilateration computation. A spoofed GPS satellite produces a pseudorange whose signing identity does not match a credentialed GNSS authority; the observation is rejected at the admissibility gate, never reaching the coordinate-solution layer. A fake UWB beacon produces a range observation whose signing identity has not been admitted into the operating mesh; the observation is rejected. A replayed observation fails the timestamp freshness check against mesh-time and is rejected. A manipulated RTK broadcast fails its credential check at the admitting endpoint.

The architectural shift is that the adversary's required capability moves from "inject a plausible RF signal", which is cheap with software-defined radios, to "compromise a credentialed authority", which is structurally harder, leaves audit trace, and is detectable through credential-revocation flows in governance-chain. The economics of the attack invert. A successful spoofing campaign now requires obtaining or extracting a credentialed signing key from an authority's key management infrastructure, an attack class that is expensive, monitored, and reversible.

Detection-and-response semantics are also strengthened. When a credentialed range observation is later determined to be malicious (post-event analysis, key compromise disclosure), the credential is revoked and the lineage of every position that admitted observations under that credential is recomputable. Affected positions are flagged and recomputed from the surviving credentialed observations, or withheld where the surviving observations no longer support an admissible position. The audit-grade lineage that the primitive produces by construction is what enables this retroactive reconciliation; current localization stacks have no comparable mechanism because the contributing observations are not individually identified or signed.

5. Lineage-Bound Multilateration and On-Demand Densification

The position estimate produced by the multilateration step is itself a governed observation. The producing unit signs the position and references each contributing range observation by lineage identifier, and the precision-and-uncertainty propagator reports a per-position uncertainty estimate derived from the input ranging precision and ranging-covariance through the localization chain. A coordinate-lineage recorder records each range observation, localization event, frame definition, uncertainty update, ambiguity resolution, rejection event, and federation event in the governance-chain lineage. Position queries, current position, position at time T, position throughout interval [T0, T1], can be answered with full lineage from the position observation back to the contributing range observations and ultimately to the credentialing authorities of every contributor.

Lineage-bound positions enable cross-jurisdictional acceptance without re-survey. A position produced under one authority's anchors is accepted by another authority through credential verification of the underlying range observations rather than through re-computation against the second authority's anchors. The two authorities need only agree on the credential set, which is a governance-chain operation, not a re-survey operation. This is the underlying mechanism by which civilian and military airspace, federal-state highway boundaries, port-customs custody zones, multi-jurisdictional inspection regimes, and similar multi-authority spaces become navigable without pre-negotiated coordinate-frame interoperability.

On-demand densification is the operating mode that supplies coverage where the existing mesh is insufficient. A densification-need detector identifies regions where precision falls below governance-policy-defined thresholds, a candidate-deployment evaluator selects deployment locations and modalities appropriate to the detected need, and a deployment-admissibility evaluator gates the candidate deployments before additional reference nodes are deployed and self-integrate into the coordinate mesh upon activation. Deployment modes include airdrop (ruggedized beacons released from fixed-wing or rotary platforms with parachute or impact-attenuation), drone-positioning (multirotor placement at surveyed waypoints or at adaptive sites computed against the existing mesh's coverage gaps), hand-placement (operator deployment from a kit), and vehicle-mounted (beacons mounted on patrol vehicles, ships, or rail cars). Each deployable node carries a credential issued by the deploying authority, broadcasts an initial relative-frame position, and contributes credentialed range observations to its neighbors immediately upon activation.

Densification thresholds are governance-policy-defined rather than fixed. The precision of mesh-derived coordinates is bounded by ranging-modality accuracy and reference-node density within ranging distance of consuming agents, and densification raises reference-node density where precision falls below the policy-defined threshold. Each position carries its propagated per-position uncertainty estimate, and downstream consumers gate operations on the declared precision. Denser reference-node coverage yields tighter uncertainty; sparser coverage yields positions with larger declared uncertainty.

6. Operating Parameters

The primitive admits fifteen-plus ranging modalities into a single coordinate graph, with each modality contributing range observations of its own characteristic precision. Coordinate precision is bounded by ranging-modality accuracy and by reference-node density within ranging distance of the consuming agents, and the precision-and-uncertainty propagator carries that bound forward into each position's declared per-position uncertainty.

Densification is governance-policy-configurable per deployment. The densification-need detector raises reference-node density wherever precision falls below the governance-policy-defined threshold, and deployment intervals are bounded by the specific densification form: minutes for hand-placed and drone-positioned nodes, seconds for airdropped nodes, and longer for vehicle-deployed or survey-placed nodes.

Densification forms include, without limitation, pre-placed permanent reference nodes, deployable semi-permanent nodes, airdroppable expendable nodes, vehicle-deployable nodes, drone-positionable nodes, hand-placeable nodes, mobile reference nodes on authority-credentialed platforms, and ingested or worn reference nodes in human-factor applications. Each deployment, detection, and resulting precision improvement is recorded by the densification-lineage recorder in the governance chain.

7. Alternative Embodiments

Expeditionary defense embodiment. A dismounted unit operates in a jammed theater with no admitted GNSS. The unit's mesh bootstraps a relative frame from credentialed inter-unit ranging across UWB and acoustic modalities; airdropped beacons densify coverage across the operating area; a forward survey team's credentialed position observation, when admitted, promotes the relative frame to absolute. Throughout, every range observation is credential-verified, and any spoofed RF emission fails admission at the credential layer.

Disaster-response embodiment. First responders enter a collapsed structure with no GPS lock and no pre-installed UWB infrastructure. Hand-placed densification beacons establish a relative coordinate frame across the rubble field; responders' positions, equipment positions, and victim-locator-beacon positions are all expressed in the bootstrapped frame; when a credentialed survey vehicle deploys to the perimeter, the frame promotes to absolute and operations integrate with municipal mapping without disruption.

Indoor warehouse robotics embodiment. Autonomous mobile robots and forklifts operate in a warehouse with no GNSS coverage. Fixed UWB and BLE beacons, vehicle-mounted lidar, and overhead optical fiducials all contribute credentialed range observations. A relative frame anchored to the warehouse's surveyed monuments operates as the working frame; the frame is promoted to absolute under municipal survey when integration with outdoor pickup-and-delivery requires it.

Maritime and underwater embodiment. Surface vessels and underwater autonomous vehicles cooperate via acoustic time-of-flight ranging supplemented by surface-vessel GNSS. The acoustic mesh's relative frame is anchored to the surface vessels' admitted GNSS positions, promoted to absolute, and propagated to underwater units operating well below GNSS reach. Spoofed acoustic signals fail credential verification.

Critical-infrastructure timing-and-positioning embodiment. Substations, telecom point-of-presence sites, and data-center campuses use the mesh-coordinate primitive to provide assured position references resistant to GPS spoofing attacks documented against utility timing infrastructure. Surveyed monuments, fixed UWB anchors, and credentialed atomic timing sources cross-validate, and on spoofing detection the spoofed anchor's alignment is no longer admissible and operation continues in the relative frame.

Civil-aviation, port-custody, agricultural-fleet, and mining-equipment embodiments follow analogous patterns with domain-specific modality mixes and authority structures.

8. Composition with Broader Architecture

Mesh-derived coordinates compose with several adjacent primitives disclosed under the same provisional. The composition is what produces an end-to-end assured-PNT architecture rather than a point solution.

Composition with mesh-time. Range observations require time alignment between originator and target. Mesh-time supplies credentialed time without exclusive reliance on GNSS, bootstrapping a relative time frame analogous to the relative coordinate frame and promoting to absolute when an authoritative time source is admitted. The two primitives are jointly necessary: anchorless time supports anchorless space. The joint relative frame (time and position) is internally consistent and supports cooperative work indefinitely.

Composition with governance-chain. Every credential used to sign range observations, frame observations, multilateration observations, and densification deployments is issued, delegated, and revoked under governance-chain. Revocation propagates through the lineage of contributed positions, enabling retroactive recomputation of affected positions and audit-grade investigation of compromise events.

Composition with governed-actuation and cascade propagation. Position observations gate actuation policies, a unit cannot enter a restricted zone unless its position observation admits the geofence policy under composite admissibility. Position-driven refusals propagate upstream as cascade observations. Position uncertainty becomes a first-class admissibility input rather than a hidden assumption.

Composition with marker-track transport. Physical markers (surveyed monuments, deployed beacons, fiducial targets) are themselves credentialed reference nodes whose presence and integrity are tracked over time. Marker-track transport supplies the chain-of-custody for markers across deployments, retrievals, recalibrations, and retirements; mesh-coordinates consumes the credentialed marker observations as anchors when admitted. The two primitives jointly underwrite the matched-pair settlement and n-party coordination primitives that depend on physical proximity verification.

9. Prior-Art Distinctions

The primitive is distinct from GNSS, RTK GNSS, and NTRIP correction networks. Those are absolute-frame, anchor-bound systems with un-credentialed broadcast streams and no architectural defense against spoofing at the receiver. The mesh-coordinate primitive can consume GNSS and RTK as one of many credentialed range modalities, with admissibility gating on credential verification rather than on signal authenticity heuristics.

The primitive is distinct from centralized UWB and ultra-wideband fingerprinting systems. Those require pre-surveyed anchor grids and a central server that fuses observations on behalf of clients. The mesh-coordinate primitive is peer-to-peer, anchor-optional, and does not require a central fusion server; multilateration occurs at the producing unit against the credentialed mesh.

The primitive is distinct from single-agent SLAM. SLAM is a single-vehicle map-and-locate computation that does not represent multi-agent credential structure, does not propagate refusals, and does not support cross-jurisdictional position acceptance. Visual or lidar SLAM correspondence can be one of the contributing range modalities, but the architectural unit of analysis is the cooperative mesh, not the single agent.

The primitive is distinct from collaborative SLAM research. Collaborative SLAM aggregates observations across robots through shared map structures with implicit trust between participants. The mesh-coordinate primitive is medium-agnostic, credential-bound, and operates without implicit trust; participants are admitted under credential, observations are individually signed, and the architecture defends against a compromised participant by credential revocation.

The primitive is distinct from trilateration with central reference, beacon-based indoor positioning systems, and passive RF fingerprinting. Each of those presupposes a specific infrastructure that the mesh-coordinate primitive treats as one of many contributors without privileged status.

The primitive is distinct from assured-PNT programs (DARPA STOIC, Air Force NavWar, Army APNT). Those programs harden against jamming and spoofing within the GNSS-dependent architecture, adding alternative sensors and anti-spoof receivers. The primitive changes the architecture: ranges are individually authenticated, operation is anchorless when needed, coordinate-frame federation aligns relative and absolute frames under credential, and densification is a deployable operating mode.

10. Disclosure Scope

This article describes architectural primitives and embodiments disclosed under USPTO provisional patent application 64/049,409. The disclosure includes credentialed range observations across fifteen-plus ranging modalities, anchor-less coordinate-frame bootstrap with a relative-only first-class frame, credentialed coordinate-frame federation aligning relative and absolute frames, lineage-bound multilateration with a precision-and-uncertainty propagator producing per-position uncertainty, on-demand reference-node densification across airdrop, drone-positioning, hand-placement, and vehicle-mounted deployment modes, and cross-jurisdictional position acceptance through credential cross-recognition rather than re-survey.

The disclosure spans expeditionary defense, disaster-response, indoor warehouse robotics, maritime and underwater, critical-infrastructure timing-and-positioning, civil aviation, port-custody, agricultural-fleet, and mining-equipment embodiments without limitation to those domains. Composition with mesh-time, governance-chain, governed-actuation, cascade propagation, and marker-track transport primitives is disclosed as part of the broader architecture, with the joint mesh-time and mesh-coordinate frame providing an end-to-end assured-PNT capability that does not depend on uncompromised GNSS or pre-installed external infrastructure.

The primitive is distinguished from GNSS, RTK GNSS, NTRIP, centralized UWB, ultra-wideband fingerprinting, single-agent SLAM, collaborative SLAM, trilateration with central reference, beacon-based indoor positioning, passive RF fingerprinting, and assured-PNT programs operating within GNSS-dependent architectures. Claim scope is reserved for the corresponding non-provisional and continuation filings.