# AUTHREX-SAFING Build Report Version 1.5.0. Governance and assurance only. No dynamics, no actuation, no targeting or weapons scope. Research prototype demonstrated in a synthetic simulation environment; no formal TRL determination has been performed. Author: Burak Oktenli, MBA ## 1. What this build is AUTHREX-SAFING is a safe-state authority console. It simulates the governance of safing for an autonomous system: the authority to enter a safe state on a fault, to hold and deepen it, and to exit it only under an authorized re-arm. The reference model is fail-safe by construction, drawing on NASA fault-management safe-mode practice and the Simplex safety-controller pattern. The engine is the domain-independent AUTHREX governance kernel with its evidence machinery. This build supplies the safe-state domain and rebinds evidence identity to product AUTHREX-SAFING at version 1.5.0 and telemetry schema ACD-SAFING-01. ## 2. Domain model Authority tiers (most restrictive first): SAFE_STATE_FLOOR, SAFING_OWNED, OPERATING_ENVELOPE, HEALTH_ADVISORY. Assets: four irreducible safe-state floors (INERT-FLOOR, PASSIVE-SAFE, COMMS-SAFE, THERMAL-SAFE); four safing commands (SAFE-ENTRY, SAFE-HOLD, SAFE-DEEPEN, SAFE-EXIT); four operating modes (MODE-NOMINAL, MODE-DEGRADED, MODE-MISSION, MODE-MANEUVER); four health monitors (FAULT-MONITOR, STATE-MONITOR, SPEC-MONITOR, POWER-MONITOR). Fault classes that can demand safing: SENSOR_FAULT, CONTROLLER_DIVERGE, SPEC_VIOLATION, POWER_EXCURSION. Detection accounting: correct safing on a real fault is a true positive, false safing on a benign condition is a false positive, and missed safing on a real fault is a false negative, the dangerous leak. ## 3. Verification results Verification suite (S1 through S59): 1061 checks pass and 0 fail in both full and quick release mode. The v1.5.0 addition is section S59, covering the v1.4.8-audit F-01 governor residual now closed (the demonstrated require.cache governor substitution: sealOfficial now compiles the governor from its measured file bytes in a private module and intercepts the domain factory's require of the governor to return it, registering the kernel-measured governor hash under the private governor's object identity, so replacing the cached governor export with an altered governor while the official file is untouched is inert and the sealed run stays official; the check runs in a separate clean child process). The v1.4.9 additions are section S58, covering the v1.4.8-audit F-01 remediation (the demonstrated require.cache factory substitution: sealOfficial now compiles and executes the domain factory from its measured file bytes through a private module and never from require.cache, so replacing the cached export with an armed factory while the official file is untouched is inert and the sealed run stays official), and the F-03 browser-global-isolation check added to section S57 (the standalone wraps the kernel, governor, and domain factory in one private closure and publishes only window.AuthrexAgentSafing, so no page global exposes the kernel, the sealOfficial constructor, or the replaceable factory). The v1.4.8 addition is section S57, covering the v1.4.7-audit product split: the public generic constructor makeApi is removed from the kernel surface, and a single sealOfficial() entry, taking no arguments, constructs exactly one official domain from its canonical sibling safing-domain-impl.js and fails closed (AUTHREX_OFFICIAL_IMPL_UNAVAILABLE) when that sibling is absent, so the demonstrated public-factory identity-borrow (a caller passing a custom domain object together with the official domain module's identity to the public constructor, which the verifier then accepted as complete) can no longer be attempted; the standalone build injects the domain factory (safing-domain-impl.js) source bytes as the domain identity, not the sealed-entry shim or a constant. The extended section S55 continuous-integration gates now also enforce the formal model-check result and the white-box capability result, each bound to the delivered source and instrumentation hashes, and reject a battery record that omits a mandatory attack; the reproduction path re-runs, compares, and signature-verifies the attack battery. Section S56 covers the v1.4.6-audit remediation: the implementation payload binds a kernel-computed hash of the complete safing-domain.js source bytes, so a modification confined to a module-private domain record (the demonstrated substitution that rewrote the private lifecycle-init first record to arm and authorize a safe-exit with no legitimate arming, while leaving every exported hook and the lifecycle digest byte-identical) is refused by verifyEvidence with DOMAIN_IMPLEMENTATION_MISMATCH, is rejected at construction with AUTHREX_DOMAIN_IDENTITY_REJECTED when the kernel can read the canonical domain sibling, and fails closed when the domain source cannot be measured; a byte-identical domain that resolves a behavior-neutral, digest-spoofing variant lifecycle is still refused by the kernel-computed lifecycle sub-digest, and a transcript entry whose reviewer identity differs from the ledger reconstruction is rejected by the reconstruction comparison even when the reviewer-key registry would authorize the forged identity (F-01); transcript-based completeness requires the reviewer-key binding to be proven, and the result exposes transcriptIntegrityVerified (run and entry integrity) separately from reviewerIdentityVerified (key-to-identity authenticity), so a transcript signed by a trusted-but-unrelated key with an unproven binding no longer completes (F-02). Section S55 covers the v1.4.5-audit remediation: the kernel computes the governor source hash from the loaded lifecycle module bytes and binds it into the domain implementation digest, so a lifecycle whose module-private authorization helper behaves officially only while being fingerprinted and fails open during real execution, and which spoofs the official self-reported source digest, is refused by verifyEvidence with DOMAIN_IMPLEMENTATION_MISMATCH, and is rejected at construction with AUTHREX_LIFECYCLE_IDENTITY_REJECTED when the kernel can read the canonical governor sibling (F-01); a named interactive reviewer such as a safety officer is included in the ledger reconstruction with its real identity and role and its transcript completes, rather than being filtered out by a hardcoded operator identity (F-03); a signed transcript binds a key identifier, issuer, and signing time, each entry binds the reviewer role, and a signature from a key not authorized for the reviewer fails the binding and the transcript while a missing registry leaves the binding unproven (F-06); and the continuous-integration evidence verifier rejects a signed-shaped bundle whose full white-box suite recorded FAIL (F-02, F-04). Section S54 covers the v1.4.4-audit remediation: the exported lifecycle graph (object, rules array, rule objects, guard functions, and methods) is deep-frozen, and a same-process consumer that rewrites evaluate or a rule guard through the shared object leaves official behavior unchanged (F-01); a lifecycle that alters only a module-private helper and forces its self-reported source digest to the official value is refused by verifyEvidence with DOMAIN_IMPLEMENTATION_MISMATCH, because the identity now binds a kernel-computed behavioral fingerprint that a lifecycle object cannot forge without reproducing the official authorization behavior, captured once at seal time (F-02); a review transcript is reconstructed one-to-one from the ledger, and a forged proposal-context, review-time, authority-digest, reviewer-id, or decision entry, and any partial, extra, or duplicated entry, are each rejected while a correctly reconstructed transcript verifies and completes (F-03); a throwing injection hook yields a terminal FAILED mission that ledgers OPERATOR_INJECT_REQUESTED before the hook and OPERATOR_INJECT_FAILED after, is consistency-verified, and is reported not-applicable for behavioral replay rather than a false BEHAVIOR_REPLAY_MISMATCH, and a non-injection runtime failure is likewise not a forgery (F-04); and the top-level ok is reserved for completeVerification while the prior broad result is exposed as consistencyOk, so an operator-injected run is consistencyOk but not ok and a replayable or validly-transcript-bound run is both (F-05). Section S53 (retained from v1.4.4) covers the v1.4.3-audit remediation: operator-injection reliability, autonomous-exception containment as a terminal FAILED mission, operator-injected loss-of-assurance requesting safe entry, transitive lifecycle identity, usable and bound interactive review transcripts, and the post-completion operation contract. Section S52 covers mission closure, operation reentrancy, and lifecycle-bound identity. Section S51 covers alternate-domain refusal, forged-digest behavioral self-replay refusal, writable-global independence, and observer isolation. Section S49 retains the sealed-tree object-capability attacks against the delivered source. Formal authority model check: 2,488,320 enumerated executions; 15 distinct model states, 23 transitions, maximum depth 7. All nine modeled properties hold: FloorNeverApplied, AppliedValueAlwaysWithinBound, HoldPreventsPrimaryApplication, HumanApprovalPrecedesRecoveryOwnedApplication, RecoveryMustBeReachableBeforePrimaryApplication, EveryProposalEventuallyTerminates, NoProposalHasMultipleTerminalOutcomes, ExpiredAuthorityCannotApply, FaultyAuthorizationAlwaysOverridden. Implementation traces conform: 11,739 terminal decisions mapped across three scenarios and fifty seeds, zero mismatches. Mutation battery: 169 trust-critical mutants are defined. This release declares and executes a mandatory set of 50 non-equivalent mutants spanning the implementation-identity, mission-closure, operation-reentrancy, transcript, injection, runtime-classification, verification, complete-domain source-identity, mandatory reviewer-identity, continuous-integration, require.cache factory-substitution, browser-global-isolation, and require.cache governor-substitution trust band M120 through M171, excluding two mutants marked equivalent under the current defenses (M129 and M134, described below); all 50 mandatory mutants were executed and killed with none surviving. The evidence file evidence/mutation-report.json records exactly which mutants were executed, the equivalent exclusions, and each outcome, and the continuous-integration evidence verifier refuses to certify a release unless every mandatory mutant is recorded executed-and-killed. The declared mandatory campaign of the 50 non-equivalent mutants is the release mutation gate; the remaining defined mutants are not part of that gate. The v1.4.5-audit mutants M143 through M151 target the v1.4.5 attack surface: M143 through M147 make the module-private lifecycle authorization helper fail open outside fingerprinting (stack-sensitive so it behaves officially only while being fingerprinted, call-argument dependent, call-count threshold, periodic, and time or process dependent), each killed by deterministic root divergence because the fail-open changes the reference-scenario ledger; M148 reverts the lifecycle source binding to the caller-supplied self-reported digest so a spoofed digest is trusted, killed by the S55 attack that games the fingerprint and is caught only by the kernel-computed source hash; M149 stops the continuous-integration verifier requiring the full white-box suite to have passed, authenticating a signed FAIL, killed by the S55 continuous-integration gate check; M150 re-filters operator-resolved holds by a hardcoded display identity, excluding named reviewers from reconstruction, killed by the S55 named-reviewer check; and M151 makes the reviewer-key binding never fail, killed by the S55 unauthorized-key check. The v1.4.6-audit mutants M152 through M156 target the v1.4.6 attack surface: M152 drops the complete domain source hash from the implementation payload and M153 never captures the loaded domain source at seal time, so the demonstrated module-private substitution would escape the identity, each killed by the S56 complete-domain source-binding checks; M154 stops the domain construction guard rejecting a substituted domain even when the canonical domain sibling is readable and M155 lets it construct with an unbound identity when the domain source cannot be measured, each killed by the S56 construction-guard checks; and M156 lets transcript-based completeness proceed without proven reviewer identity, killed by the S56 mandatory-reviewer-identity check. The v1.4.7-audit mutants M157 through M163 target the product split and hardened gates: re-exposing makeApi on the kernel surface, sealOfficial accepting a caller-supplied domain, a null-module seal, the standalone injecting the sealed-entry shim hash rather than the domain factory bytes, and the continuous-integration verifier dropping the model-check, capability, or mandatory-attack gates, each killed by section S57 and the S55 CI and battery gates. The v1.4.8-audit mutants M164 through M168 target the require.cache factory substitution and browser-global isolation: sealOfficial executing or sourcing the cached factory (M164, M165) and the standalone re-exposing the kernel, factory, or governor as a page global (M166 through M168), each killed by section S58 and the S57 standalone-global check. The v1.5.0-audit mutants M169 through M171 target the require.cache governor substitution: M169 removes the factory's governor require interception so the governor loads from the global cache, M170 registers the domain bytes rather than the governor bytes as the measured governor hash so the measured identity diverges from the executed governor, and M171 sources the executed governor from the mutable cache rather than the module compiled from the measured bytes; M169 and M171 are killed by section S59 (the require.cache governor substitution run in a separate clean child process) and M170 by construction rejection on the honest path. The reconstruction mutant M136, the self-reported-source mutant M148, and the release-gate mutant M149 required additional coverage after the v1.4.6 remediation, because the complete-domain source binding, the mandatory reviewer-key binding, and the mandatory-mutant gate each gave the prior tests a second reason to refuse that masked these mutants; S56 adds a byte-identical-domain sibling-lifecycle case (behavior-neutral and digest-spoofing) that isolates the kernel-computed lifecycle sub-digest, a reviewer-identity forge that the registry authorizes so that only the ledger reconstruction can catch it, and a continuous-integration bundle that satisfies every release gate except the full-suite result, so each of these three mutants is now killed by exactly the defense it targets. The v1.4.4-audit mutants M132 through M142 remain in the executed band and are killed by section S53 or S54. Two mutants are equivalent under the v1.4.5 kernel-computed governor source binding and are excluded from the kill requirement: M129 (collapse the behavioral-fingerprint enumeration) and M134 (null the behavioral fingerprint); once the kernel-computed source hash is the load-bearing lifecycle binding, dropping the defense-in-depth fingerprint alone is not observable, and the source binding itself is covered by M148. The object-capability boundary set M99 through M108 and the ledger and monitor safety set M01 through M04 are exercised by the black-box capability-integrity checker, by verify-safing.js, and by prior-release full sweeps. The file-presence and checker-trust conditions (M112 and M119) are verified black-box by the file-absence assertion, by verify-safing.js, and by the capability-integrity checker rather than by a source find-and-replace mutant. Coverage across the governance kernel and domain was approximately 99.6 percent of statements and lines at last measurement; the object-capability seal is exercised by section S49 and by mutants M99 through M108 and M120 through M171. Attack battery: a shipped adversarial battery, verification/attack-battery.js, runs 43 checks against the delivered source tree and passes all 43, writing signed results to evidence/attack-battery-results.json with a detached Ed25519 signature (evidence/attack-battery-results.json.sig) over the canonical record under the same public key that signs the continuous-integration evidence. The record binds the engine version, a source-tree hash over the four engine files, a runner hash, a timestamp, per-attack expected and actual outcomes, and an exit code. Checks A31 through A35 encode the v1.4.6-audit attacks: the demonstrated module-private domain substitution refused at both construction and verification, the null-module domain failing closed, an arbitrary self-signed transcript with no registry proving integrity but not reviewer identity and not completing, and an unauthorized key not completing. Check A36 encodes the v1.4.7-audit public-factory identity-borrow, now defeated because the kernel exposes no generic constructor and sealOfficial takes no caller-supplied domain. Check A42 encodes the v1.4.8-audit require.cache factory substitution: an armed domain factory installed at require.cache[safing-domain-impl.js].exports with the official file untouched is never executed, because sealOfficial compiles and runs the authentic file bytes, so the sealed ledger root and domain digest remain the official ones. Check A43 encodes the v1.5.0 require.cache governor substitution: an altered governor (truthy fail-open, which would authorize an illegitimate safe-exit from NORMAL) installed at require.cache[safing-lifecycle.js].exports with the official file untouched is never executed, because sealOfficial compiles the governor from the authentic file bytes in a private module and intercepts the domain factory's governor require to return it, so the sealed ledger root and domain digest again remain the official ones. Standalone build: build/AUTHREX-SAFING-Standalone.html, 362298 bytes, sha256 ef8b828e039a12bdd3873723195bed87027df59d64ce82f91c72da09492e6bd6. It boots in a clean context as v1.5.0, reproduces all five reference roots, exposes only window.AuthrexAgentSafing (no kernel, factory, or governor page global), exposes only the sealed API on its browser global (no capability and no raw path), and contains no em or en dashes. ## 4. Reference roots (seed 20260610) SCN_A SUCCESS 51d32c740bdd0bdd2cd35e53f00b80b9b60879e3bd07ab13214e8345c4ae32c0 SCN_B SUCCESS 10e071336c5dc76f0ae2a8846d6a683e6ca83ce720dd6586e25df9017546a805 SCN_C SUCCESS 73c4383f17735984d204a0bc1358d7dda8f66164c90b7a2b8aa541378cd4e480 SCN_D PARTIAL f691d492723637f1bd7ced18073a1bb94f2b551dfb3627a70bef0a8f5de04756 SCN_E SUCCESS d1f21c0c7100cbcef3f207e0ae593afc0c512a6b905b79cb695a3660a8792d7b SCN_D is a PARTIAL run by construction; it exercises the fault-storm path that leaves residual staged authority. The full record is in verification/reference-roots.json. ## 5. Signing and provenance Evidence ships with authenticatedEvidence set to false until it is signed under the owner key. The signing tooling builds the seal first and then signs the full envelope, binding schema, algorithm, key id, issuer, signing time, and identity. The release additionally ships detached Ed25519 signatures over RELEASE_MANIFEST.json and SHA256SUMS.txt (RELEASE_MANIFEST.sig, SHA256SUMS.sig), verifiable with the shipped release-signing public key via npm run verify:release; this proves package-internal integrity, and external trust requires anchoring the key fingerprint out of band, which is an operator action. See docs/RELEASE-SIGNING.md. Source identity binds the actual domain implementation, including its transitive lifecycle dependency. In Node the source hash is a domain-bound-sha256-v1 digest over the kernel source digest and a canonical hash of the domain authority hooks (decide, makeProposal, lifecycleGuard, continueAfterReview, criticalEvent, inject) AND the captured safe-state lifecycle implementation (its states, events, every transition rule and guard source, and its methods), computed per API instance with no writable global input. A domain whose hook source is byte-identical but whose lifecycle module has been swapped therefore carries a different digest and is refused (DOMAIN_IMPLEMENTATION_MISMATCH). The kernel additionally computes the governor source hash itself from the loaded lifecycle module bytes and binds that kernel-computed hash into the implementation identity (rather than trusting a digest the lifecycle reports about itself), so a swapped lifecycle whose only change is a module-private helper (for example the internal truthy guard), and a lifecycle that spoofs its own self-reported source digest to the official value, are both refused; the standalone build embeds the same value as a constant so the browser identity matches Node, and a non-canonical governor is additionally rejected at API construction (AUTHREX_LIFECYCLE_IDENTITY_REJECTED) when the kernel can read the canonical governor sibling. A retained behavioral fingerprint that enumerates the authorization decision over every state, event, and guard context is kept as defense in depth. This in-process source binding defeats file substitution that an external verifier can anchor by recomputing the governor source hash from independently obtained bytes; it is not, and cannot be, a defense against an attacker with full control of the host process, who can patch the module loader or filesystem or inline the governor so the kernel reads canonical bytes while other logic runs. In-process self-measurement is therefore not the trust root. The trust root is the externally anchored, signed evidence; a fully compromised host is out of scope for any in-process mechanism and is addressed only by external attestation of the execution environment. A strict mission-phase state machine (INITIALIZING, RUNNING, FINALIZING, COMPLETE, FAILED) makes MISSION_END an authority boundary: every public authority action is rejected outside the RUNNING phase and a reentrancy guard rejects any authority call made from inside an observer notification, so no command applies after completion or during finalization and MISSION_END is the final ledger entry; tick, step, and injection submitted after completion throw AUTHREX_MISSION_COMPLETE. Evidence records the domain implementation digest, and verifyEvidence reports domainImplementationVerified and behaviorReplayVerified distinctly from consistencyVerified and sourceVerified, and reports the result by class (implementationIdentityVerified, reviewTranscriptVerified, and completeVerification); the top-level result requires the official domain implementation and a non-failing behavioral replay, and completeVerification additionally requires positive behavioral evidence (deterministic replay or a signed review transcript), so an interactive artifact is never reported as a broad complete pass. The reference ledger roots do not bind the source or domain digest, so they are independent of this identity work. The white-box assertion suite, mutation battery, and bounded model check reach raw cores only through non-shipped instrumentation, so they cannot run from the extracted package; tests/run-all.js exits nonzero with CI_INSTRUMENTATION_NOT_ INCLUDED there. Their results ship as a signed CI provenance bundle (evidence/ci-provenance.json plus a detached Ed25519 signature and public key) that binds the production source-tree hash and records the instrumentation and runner hashes, the Node version, and the per-test and per-mutant outcomes; tools/verify-ci- evidence.js and verify-safing.js confirm it binds this delivered source tree and verifies. Capability evidence is split into a reproducible black-box release report (15 of 15 boundary properties, evidence/capability-blackbox-release.json) and a white-box CI report (23 properties with provenance, evidence/capability-whitebox- ci.json). ## 6. Scope discipline This build governs authority transitions and produces auditable evidence. It does not model vehicle dynamics, does not actuate anything, and has no targeting or weapons scope. All quantitative distributions in the domain are research assumptions, not operational data.