AUTHORITY PIPELINE · LIVE DECISION FLOW
SYNTHETIC ESTATE · GOVERNED TOPOLOGY
EVENT FEED
Ten failure modes, each modeled with explicit cause, effect, detection, mitigation, and recovery. Toggle them live or let the scenario script drive them; detection and recovery latencies are measured into the mission report.
Scenario Script
| T+ | ACTION | ITEM | DETAIL |
|---|
0 ENTRIES
ROOT --
Every formal decision commits to the chain before its effect applies. The tamper test mutates one entry in a deep copy and re-verifies; the live ledger is never touched. During signer outage the pipeline safe-holds and nothing commits or executes.
| SEQ | T+ | TYPE | SUMMARY | HASH |
|---|
Replay · 30 s snapshots T+0
Run the mission, then scrub.
No report generated.
Concept of Operations
A black-box cyber-reasoning system proposes defensive patches (synthetic findings, SYN-2026-xxxx) against a synthetic utility estate: 4 live OT controllers (C1), 8 production services (C2), 8 corporate IT systems (C3), 4 isolated test replicas (C4). AUTHREX-AGENT governs only the action. Each proposal traverses SATA (provenance trust), ADARA (finding/action consistency), IFF (deny-by-default tool envelope), HMAA (tiers T3 to T0, capped by criticality: C4:T3, C3/C2:T2, C1:T1), MAIVA (4-of-5 quorum), FLAME (bounded window, expiry defaults to ABORT), CARA (pre-armed rollback), with ERAM risk and a session execution budget enforced at execution start. Every registered decision in this packaged simulation is committed to a SHA-256 hash-chained ledger before any effect. Same seed, same scenario, same ledger root.
Reading the diagrams
Top diagram: each moving token is one proposal traversing the seven gates; green reaches EXECUTE, cyan diverts to the watch officer (HANDOFF), amber parks in the DELAY hold above FLAME and re-enters, red drops to ABORT at the failing gate. The dashed bar above is ERAM: budget fill, throttle marker, and per-gate risk taps. Bottom diagram: the governed estate; cyan pulses are ledgered executions traveling from the governor to the target, expanding rings are remediations (green), rollbacks (amber), and degradations (red); red dots moving along dependency edges are cascade propagation; a dashed amber ring with an X is an unreachable asset.
Standalone build
This file is self-contained: open it from any folder with no server and no network call, and it uses the system font stack rather than fetching web fonts. The inline engine is the same v1.4.2 config.js and core.js as the packaged build, including the deterministic operator workload model (vigilance decrement plus queue-pressure effects on service latency and error rate) and the depth-first blast-radius term over the asset dependency graph that feeds the ERAM risk score (and is committed in every DECISION ledger payload), per-target execution serialization (one job per asset at a time; held jobs are ledgered as EXEC_HELD and resumed through the full guard path), and a strict success criterion requiring full closure at mission end. The full 55-test V&V suite is embedded in this file and runs in your browser from the Verification panel (it also passes headless under Node), so the headline number is reproducible from what you are looking at. Multi-seed evidence: test S-13 reruns a 40-seed hard-guard band inside this file. The full 1000-run sweep (200 seeds across all five scenarios, zero hard-guard or ledger failures) and the complete evidence set (traceability matrix, metrics dictionary, invariants register, stress and V&V reports, reproducibility guide, release hashes) are distributed in the offline packaged release available for structured review on request, which also carries this standalone at its root; this single file contains only what it can prove itself. AUTO officer mode is bit-reproducible; MANUAL console actions intentionally break replayability and are marked on the ledger. Engine provenance: the first script block in this file is the packaged config.js plus core.js byte for byte; its SHA-256 is 2bfbabb2a74830918391e34b446e28f3eb384e89f02b492cfe3152cbe465002e, recomputable from this file by hashing that block's contents; the sourceHash meta in the document head carries the same value, and the boot integrity line recomputes both this hash and all four CSP script-block pins at load, so [PASS] there is a computed result, not a label. Verification recipe: python3 -c "import re,hashlib,sys;d=open(sys.argv[1],'rb').read();print(hashlib.sha256(re.search(rb'<script>\n(.*?)</script>',d,16).group(1)).hexdigest())" thisfile.html
Limitations, stated plainly
- Self-assessed TRL 3 to 4 reference simulation of governance logic. Not an emulation of any real CRS, network, or OT protocol; not operational validation.
- The CRS and the watch officer are statistical models; gate latencies are sampled against the published 50 ms P95 budget, not hardware benchmarks.
- ADARA is modeled by explicit manipulation markers; defeating a real consistency screen remains an open research risk, stated openly.
Synthetic data only. Governance only, no offensive function. Independent research offered for technical evaluation, not a contract proposal or a claim of adoption. No agency endorsement implied.