Anchorless Time Bootstrap

Mechanism

The bootstrap procedure begins at deployment time, before any external time signal has been acquired. Each participating unit emits time-stamped beacons against its own local oscillator and receives the beacons of its neighbors. Each pair-wise exchange produces a four-tuple — local-emit, remote-receive, remote-reply, local-receive — from which propagation delay and clock offset can be jointly extracted under the assumption of reciprocal channel delay. The four-tuples accumulate across the mesh; once the observation set spans a connected graph of peers, a least-squares solver resolves a time frame in which every contributing unit's offset is consistent with every observed exchange.

The solver is anchorless because the system of equations is singular by one degree of freedom: any uniform shift of all per-unit offsets satisfies the observation set equally. The architecture closes the singularity by gauge — by selecting one peer's local clock as the reference epoch, by selecting the median of contributing offsets, or by selecting any other rule declared at deployment. The selected gauge is recorded as a credentialed property of the consensus frame so that downstream operations can audit which rule was applied. Internal coordination — formation flight, inter-unit handoff, sensor-fusion timing, scheduled radio slots — operates against this relative frame without waiting for absolute binding.

Frame promotion handles the transition from relative to absolute. When a unit acquires an external time observation (a GNSS fix, a received broadcast time, a contacted time-authority), the observation enters the consensus solver as a credentialed binding constraint annotated with its source, its declared uncertainty, and its admissibility credential. The solver re-resolves the consensus with the binding constraint applied; the result is a frame whose internal structure is preserved (per-unit offsets remain mutually consistent) but whose gauge has shifted from the deployment rule to absolute time. Multiple binding observations accumulate as a weighted overdetermined system, each weighted by its declared uncertainty.

Promotion is non-disruptive to in-flight coordination because the relative-frame offsets among contributing peers are not perturbed by gauge change; only the global shift parameter is rewritten, and the rewrite is applied atomically through a credentialed promotion record that downstream consumers read as a single transition rather than as a continuous drift. Coordination tasks that have already locked to the relative frame need not re-acquire timing; their schedules continue against the same per-peer offsets, with absolute timestamps now interpretable in external terms. Where a binding observation is later revoked (a GNSS spoofing event detected, a broadcast source repudiated by its authority chain), the solver demotes the affected constraint and re-resolves; the promotion-and-demotion history remains in lineage so that any operation conducted under a since-revoked binding can be retrospectively re-evaluated.

Operating Parameters

Beacon cadence is configurable per declared mission profile. Higher cadences produce more observations per unit time and faster convergence at the cost of channel utilization; lower cadences conserve channel at the cost of slower drift tracking. Typical deployments run beacon cadences in the one-to-ten Hertz range, with ranging-piggyback information embedded in the same exchange to amortize channel cost across both the time-consensus and position-consensus pipelines.

Convergence time depends on graph connectivity and oscillator quality. A fully-connected mesh of high-stability oscillators converges to sub-microsecond relative consistency within tens of beacon intervals; a sparsely-connected mesh with mixed oscillator quality converges over hundreds of intervals. The solver exposes a residual-norm metric that downstream operations can gate on: coordination tasks requiring tight time alignment wait for residual-norm to fall below a declared threshold; tasks tolerant of looser alignment proceed earlier.

Admissibility credentials govern which observations enter the consensus. Each peer's beacons carry the peer's declared identity and oscillator-quality credential; the solver weights each peer's contribution by its credential. External time observations carry source credentials — a GNSS-derived time carries the receiver's authority chain, a broadcast time carries the broadcaster's authority chain — and the solver admits or rejects each binding constraint according to the deployment-declared admissibility profile.

Oscillator quality classes are declared in advance as credentialed parameters: a chip-scale atomic clock, an oven-controlled crystal oscillator, a temperature-compensated crystal oscillator, and a baseline crystal oscillator each carry distinct declared stabilities and drift profiles, and the solver consumes these declarations as weighting inputs. The deployment-declared admissibility profile additionally specifies the maximum acceptable beacon-exchange asymmetry, the minimum acceptable peer-degree for a unit's offset to be included in the consensus, and the maximum acceptable age of any contributing four-tuple before it is retired from the active observation set. Profiles may be revised through credentialed amendments during a deployment; revisions enter lineage and the consensus re-resolves under the amended profile without disturbing prior consensus records.

Alternative Embodiments

The mechanism applies to any mesh of peers capable of timestamped pair-wise exchange. Embodiments include unmanned-aerial-vehicle swarms operating in GNSS-denied airspace, subterranean sensor meshes lacking sky view, indoor robotics fleets where multipath corrupts external time signals, naval surface formations operating under emissions-controlled conditions, and rapidly-deployed disaster-response meshes whose deployment outpaces external-infrastructure availability.

The exchange medium is not constrained. Radio-frequency exchanges, optical exchanges, acoustic exchanges, and wired-link exchanges all support the four-tuple observation as long as channel delay is reciprocal at the relevant timescale. Hybrid embodiments admit observations from multiple media simultaneously, with each medium's channel-delay characteristics expressed as a credentialed property of the contributing peer.

The gauge-selection rule is configurable. Deployments that include a single high-stability anchor peer can select that peer's clock as the reference; deployments without any privileged peer can select the median or trimmed-mean offset; deployments with mission-specific requirements can select arbitrary rules expressible as functions over the per-peer offset vector. Each rule is declared as a credentialed deployment parameter.

A staged-deployment embodiment supports phased ingress in which initial peers establish the relative consensus, subsequent peers join by contributing observations against the existing peer set without re-bootstrapping the entire frame, and departing peers withdraw their offsets from the consensus through a credentialed exit record that prevents stale observations from anchoring the gauge. A partitioned-mesh embodiment admits temporary network partitions: each partition continues to operate against its own coherent sub-consensus, and on rejoin a credentialed reconciliation procedure merges the sub-consensuses under a declared rule that preserves the longer-running gauge or applies a residual-weighted average, with the merge event entered into lineage so that operations conducted under either pre-merge sub-consensus remain auditable.

Composition

Anchorless bootstrap composes with the per-agent learned drift model: each peer's contribution to the consensus is weighted by its drift-model maturity and uncertainty bound, so that early-deployment peers with immature drift models contribute with appropriately reduced weight, and the consensus quality improves monotonically as drift models mature. The composition is structural rather than ad-hoc; the consensus solver reads each peer's drift-model credential as an input parameter.

The bootstrap also composes with the ranging-piggyback channel: time observations and range observations share the same beacon exchanges, so the joint time-and-position consensus solves over a single observation set rather than two independent sets. Cross-validation between time residuals and range residuals surfaces oscillator anomalies and channel anomalies that either pipeline alone would mis-attribute.

A further composition arises with the credential chain itself. Each peer's contribution to the consensus is signed by its credentialing authority, and each external binding observation is signed by the source authority that produced it. The consensus solver is therefore not only a numerical procedure but a credential-aware procedure: admissibility decisions, weight assignments, and gauge selections are all recorded against the credential chain so that the resulting consensus frame is auditable end-to-end, from the deployment-time relative bootstrap through every subsequent absolute-binding promotion. Downstream consumers of the consensus — coordination tasks, mission-planning subsystems, post-mission analysis — read both the resolved time and the credential trail by which it was resolved.

Composition with cascade-propagation primitives admits the consensus solver's residual-norm output as a first-class observation: a sudden rise in residual norm, indicating that the observation set has become internally inconsistent, propagates as a credentialed event to coordination tasks that may then elect to widen tolerance windows, defer time-critical maneuvers, or fall back to peer-degree-restricted sub-consensuses. Composition with health-monitoring composites permits aggregate fleet attestation of time-consensus quality: a formation may declare to a superior authority that its internal time consensus is bounded under a declared residual norm without disclosing the underlying per-peer offsets. Composition with revocation primitives ensures that a peer whose credential is revoked mid-deployment is structurally removed from the consensus rather than continuing to influence the gauge through stale four-tuples; the revocation enters lineage and the solver re-resolves with the affected peer's contributions retired. Composition with the bilateral primitive admits credentialed time-consensus exchange across formation boundaries: two adjacent meshes whose gauges differ may settle a relative offset under a credentialed bilateral observation that admits cross-mesh coordination without merging the underlying consensuses.

Prior-Art Boundary

Conventional time-distribution architectures gate on an external master: GNSS-disciplined oscillators wait for sky view, NTP and PTP networks wait for upstream-server reachability, broadcast-time consumers wait for transmitter coverage. Each architecture treats the absence of the master as a fault condition. Mesh-internal time-synchronization protocols of the prior art (such as reference-broadcast synchronization and timing-sync protocol for sensor networks) reduce dependency on a master but still presume an eventual external reference for absolute binding, and do not structurally distinguish relative-coherent operation from absolute-bound operation.

The disclosed architecture treats master-less operation as the nominal condition rather than as a fault, and structurally separates relative-coherence from absolute-binding so that operations can declare which property they require and proceed as soon as that property is satisfied. The credentialed admissibility profile that governs external-observation admission is a structural element of the consensus rather than a configuration option of the time client.

Prior-art consensus-clock approaches that operate without a master (gradient time-synchronization, average time-synchronization, flooding time-synchronization protocol) produce a coherent mesh-internal time but typically do not carry a structural credential over each contributing peer's identity, oscillator quality, or admissibility status; the resulting consensus is not directly auditable against a credential chain, and external-source admission is treated as a client-level configuration rather than as a consensus-level structural element. Distributed-fault-tolerant clock-synchronization algorithms (Lamport-style logical clocks, Marzullo-style intersection algorithms, Byzantine clock-synchronization) address adversarial peer behavior but do not address the relative-to-absolute promotion problem as a structural transition; a corrupted upstream source is treated as a fault rather than as a credential-revocation event, and the resulting clock cannot be retrospectively re-evaluated against the credential history. The disclosed architecture differs in carrying credential history through every consensus event, so that admissibility, gauge, and binding decisions remain auditable for the lifetime of the deployment.

Disclosure Scope

This article describes the anchorless time bootstrap mechanism disclosed in Provisional Application 64/049,409. Forward-deployed defense formations gain time consensus at the moment of deployment without waiting for sky view or for radio-link establishment to a rear authority. Disaster-response meshes gain the same property in environments where external infrastructure has been damaged or has not yet been established. Subterranean and indoor robotics gain a structurally-coherent time approach in which internal coordination uses the relative consensus and external coordination waits only for absolute binding to accumulate. Maritime formations operating under emissions-controlled conditions gain a covert internal-time mechanism that does not require any active emission outside the mesh.

The scope of the disclosure encompasses the bootstrap procedure itself, the gauge-selection rules that close the anchorless singularity, the credentialed admissibility profile that governs external-observation admission, the residual-norm convergence metric that downstream operations gate against, the credentialed promotion mechanism that advances the consensus from relative to absolute without disturbing in-flight coordination, and the composition with adjacent mesh primitives including per-agent drift modeling and ranging-piggyback consensus. The disclosure further encompasses the deployment-declared admissibility profile under which external observations enter the consensus, the credentialed peer-identity records that weight per-peer contributions, and the audit trail that records gauge-selection and binding-admission decisions for downstream verification.

Embodied properties of the disclosed architecture include the absence of any architectural fault state for the master-less condition, the structural separation of relative-coherence from absolute-binding such that operations declare which property they require and proceed when that property is satisfied, the symmetric treatment of every peer as both a contributor and a consumer of the consensus, and the verifiability of the consensus frame's gauge and admissibility history against the credential chain. These properties are presented as part of the architectural disclosure rather than as performance claims of any particular implementation.

The disclosure further encompasses the four-tuple observation format and its joint extraction of propagation delay and clock offset under reciprocal-channel assumptions; the least-squares resolution procedure and its declared singularity-closure rules; the credentialed gauge-selection record that names the rule applied at each resolution; the residual-norm convergence metric exposed to downstream gating; the credentialed promotion record by which the consensus advances from relative to absolute without disturbing in-flight coordination; the credentialed demotion procedure by which a since-revoked binding observation is retired and the consensus re-resolved; the staged-deployment ingress and exit procedures that admit phased peer set evolution without re-bootstrapping; the partition-and-rejoin reconciliation procedure under declared merge rules; and the multi-medium hybrid embodiment that admits radio, optical, acoustic, and wired observations under medium-specific channel-delay credentials. Specific implementations of solver algorithms, beacon waveforms, oscillator hardware, credential signing schemes, and lineage storage formats are admitted as substitutable components within the disclosed structure rather than as essential features; substitution preserves the disclosed properties of master-less nominal operation, structural relative-to-absolute promotion, credential-aware admissibility, and end-to-end gauge auditability so long as the substituted component honors the declared admissibility profile and produces lineage entries compatible with the credential chain.