AUTHREX-RTA
The Run-Time Gate Between a Complex Controller and Its Safety Floor
A complex controller is fast and capable, and hard to fully verify. AUTHREX-RTA places a run-time-assurance gate in front of the authority it exercises: an independent invariant monitor evaluates each proposed authorization against configured invariants before it is applied, and either admits it, holds it, or reverts to the safety floor. Every admitted decision is written to a SHA-256 hash-chained ledger, and the whole run replays deterministically from its seed. Governance and assurance only. Synthetic data.
Evaluate the Authorization Before It Is Applied.
- The complex controller issues an action, and correctness is assumed from testing
- No independent check stands between a proposed authorization and the system that carries it out
- An out-of-distribution input can drive an authorization no reviewer ever saw
- After the fact there is no tamper-evident record of what was authorized, or why
- Each proposed authorization is evaluated by an independent invariant monitor first
- Configured invariants decide the outcome: APPLIED, HELD, or REVERT-TO-SAFE
- A proposal that would cross an invariant is held or reverted to the safety floor, not applied
- Every admitted decision is written to a SHA-256 hash-chained ledger and replays deterministically
An Established Safety Shape, Applied to Authority.
Run-time assurance is not a new idea in safety engineering. AUTHREX-RTA reuses two established reference models and moves their subject from control signals to authority decisions.
ASTM F3269
ASTM F3269 describes a run-time-assurance architecture that bounds the behavior of a complex or insufficiently verifiable function using a run-time monitor and a recovery path, rather than requiring the complex function itself to be fully verified. AUTHREX-RTA treats the authority a controller exercises as the bounded behavior, and the invariant monitor as the run-time bound.
The Simplex Model
The Simplex reference model pairs a high-assurance safety controller with a high-performance complex controller and a decision module that reverts to the safety controller before a safety boundary is crossed. Here the decision module is the invariant monitor, and the safety floor is the reversion target when a proposed authorization does not pass.
What Is Governed
The gate governs authority, not vehicle dynamics. It decides whether a proposed authorization may be applied, at what tier, and whether it must be held or reverted. It does not compute actuation, fly a platform, or drive a live controller. The demonstration runs entirely on synthetic, seeded scenarios in the browser.
Three Outcomes, One Independent Check.
The invariant monitor is independent of the controller it screens. For each proposed authorization it evaluates the configured invariants and returns one of three outcomes, then records the result.
APPLIED
The proposed authorization satisfies the configured invariants at its requested tier. It is admitted and applied, and the decision is appended to the hash-chained ledger with its evidence.
HELD
The proposal cannot be confirmed against the invariants as presented. It is held rather than applied, and the holding condition is recorded for review instead of being resolved by assumption.
REVERT-TO-SAFE
The proposal would cross an invariant. The gate reverts to the Simplex safety floor rather than apply it, and records the reversion. Across the packaged scenarios the demonstration shows no observed unsafe authority transitions.
REPLAY DETERMINISM
The console runs from a seeded pseudo-random generator, so a scenario replays the same decisions every time. The ledger and the replay together make each run auditable after the fact within the packaged simulation.
A Tamper-Evident Trail of Every Admitted Decision.
The gate is only as useful as the record it leaves. AUTHREX-RTA writes each admitted decision to an append-only ledger whose entries are chained by hash, so a later reviewer can check that the sequence has not been altered.
Each entry carries the proposed authorization, the invariant outcome, and a SHA-256 link to the entry before it. Canonical serialization keeps the hashing stable across runs, and the in-browser verification suite checks the chain, the outcomes, and the replay against the seed. The trail is an illustrative research artifact, not a certification, an Authorization to Operate, or an agency release decision.
Run the Governor Console Yourself.
The full console runs offline in the browser, with no network calls and synthetic data only. Step a controller through five stress scenarios, from a nominal command stream to an out-of-distribution command storm, and watch the invariant monitor admit, hold, or revert each proposed authorization while the ledger records the result. Illustrative simulation of the gate logic, not operational validation.
All scenarios are synthetic. No real controller, platform, or autonomous system is exercised, and no actuation is produced.
What This Rests On, and What It Is Not.
ASTM F3269, run-time assurance for bounding complex functions with a monitor and a recovery path (author-mapped to authority governance, not an endorsement) · the Simplex reference model, a high-assurance safety controller with a decision module that reverts before a safety boundary is crossed · part of the AUTHREX authority-governance research program. Governance and assurance only, with no weapons, targeting, or kinetic effects.
Standalone research console, self-assessed at approximately TRL 2 to 4: specified and demonstrated in simulation, not fielded or operationally validated. It governs authority decisions only, with no vehicle dynamics, actuation, or live system. The invariant-to-outcome mapping is one researcher's analytical judgment, released openly for independent review. Related methods are the subject of provisional patent applications (unexamined), not granted patents, and no agency adoption or endorsement is implied.