Resilient Intelligence in GPS and Network Denied Environments

An ontology led architecture for contested supply chains infrastructure and subterranean operations

Abstract

We examine how artificial intelligence can support defensible decisions when positioning signals, communications, infrastructure and operational evidence become unreliable together. Our central argument is that resilience requires a bounded relationship between estimation, inference, authority and physical action. Executing a model locally addresses only one part of this problem. A disconnected system must also determine what it knows, which observations remain usable, what it is authorised to propose, and which commitments can still be honoured without coordination.

We develop a reference architecture joining multimodal positioning and mapping, local AI, disruption-tolerant exchange, temporal evidence graphs, probabilistic forecasting and constrained digital twins. Within this architecture, LupoToro's developing Lutine initiative provides the proposed intelligence and assurance integration layer. We examine the O-XCH, O-EXT and O-LUT ontology planes in detail, identifying how evidence lineage, property-specific authority, explicit uncertainty, decision epochs and revalidation can connect operational reasoning to accountable decisions. We integrate our Predictive Intelligence and Digital Twins research directions as distinct but cooperating functions, then extend the architecture to subterranean inspection, emergency response and infrastructure sustainment.

The study combines a structured critical literature review with design analysis, conditional invariants and reproducible analytical examples. The examples demonstrate how duplicated evidence can inflate belief, how resource rights constrain disconnected commitments, and how energy and uncertainty change a decision's useful operating horizon. They are illustrative calculations, not measurements of Lutine or field autonomy. We specify comparative experiments, ablations, failure injections and acceptance evidence needed to test the architecture. Our contribution is an integrated, falsifiable research framework for preserving decision integrity under compound denial. Operational effectiveness, deployment security and subterranean performance remain questions for representative implementation and independent evaluation.

Contents

1 Research problem and contribution

1.1 The problem of compound denial

An infrastructure operator may lose a communications link at the same time that a positioning receiver becomes unreliable, a supplier record grows stale and a local computing unit approaches its thermal limit. These failures interact. Poor localisation can associate an observation with the wrong asset; a delayed observation can make a planning model overstate available capacity; an apparently reasonable recommendation can then exceed the authority or resources available to the disconnected operator. Improving an individual prediction model does not resolve these interactions.

We use denied environment to describe an operating condition in which one or more services needed for a decision are unavailable, manipulated, degraded or insufficiently trustworthy. Denial may arise from deliberate interference, equipment failure, environmental conditions, organisational restrictions or a combination. The Global Positioning System, GPS, is one constellation within global navigation satellite systems, or GNSS. We retain GPS in the title because it is widely understood, while treating positioning, navigation and timing, PNT, as a broader engineering problem. NIST's PNT work explicitly recognises the dependence of networks and critical infrastructure on both positioning and time services (Bartock et al., 2023).

The relevant unit of resilience is therefore a decision and its consequences, not a neural network in isolation. We ask whether the complete system can continue a useful, authorised function while exposing uncertainty and containing failure. This includes the ability to defer an unjustified commitment, preserve evidence during isolation, and recover coherently when information returns. A system that produces an answer continuously but loses the basis for trusting that answer is available computationally and unavailable epistemically.

Contested supply chains make this distinction operationally consequential. A component may exist physically but be unavailable because it is reserved, unqualified, outside permitted custody, inaccessible, or required elsewhere. Similarly, an apparently redundant supplier may depend on the same upstream equipment or energy source. We model supply, infrastructure and computing dependencies together because the machinery providing intelligence is itself sustained by the networks it analyses. Existing work on supply chain twins motivates connecting disruption information with network behaviour; the challenge here is to retain that connection when observations and coordination deteriorate (Ivanov and Dolgui, 2021).

1.2 Research questions and proposed contribution

We organise the study around five questions. First, which information and authority must remain locally available for a decision to retain meaning during disconnection? Second, how can a shared ontology preserve uncertainty and disagreement across sensors, enterprise records and analytic models? Third, how should estimation, strategic forecasting and digital twin simulation interact without confusing observations with hypotheses or hypothetical outcomes? Fourth, which commitments can safely be made without global coordination? Fifth, what evidence would justify moving from a reference architecture to operational reliance, particularly underground?

Our proposed contribution is the explicit coupling of four validity conditions: admissible evidence, authorised scope, physical feasibility and a sustainable resource envelope. These conditions connect established methods across several fields. We do not claim to invent SLAM, federated learning, robust optimisation, provenance graphs or digital twins. The research proposition is that making their interfaces explicit can improve decision integrity under compound degradation, and that this improvement can be measured against simpler systems.

We express this proposition through a formal decision model, a concrete mapping to Lutine's developing ontology, a protocol for disconnected reasoning and reconciliation, and a test programme with falsification criteria. Two conditional invariants establish useful properties within stated assumptions. The numerical examples expose failure mechanisms without implying operational performance. The distinction between a mathematical property, a software property and an empirically validated capability is maintained throughout.

1.3 Scope and capability status

The application scope includes infrastructure inspection, industrial maintenance, emergency logistics, resource allocation, continuity planning and authorised analysis of operational disruption. Subterranean extensions cover mines, tunnels, utility corridors, underground facilities and disaster environments. We examine architecture and assurance rather than tactical employment. Local navigation and physical safety remain responsibilities of appropriately engineered platform systems.

Lutine is treated as a developing integration and intelligence architecture. Its ontology specification provides a detailed semantic design; it does not, by itself, demonstrate working connectors, a trusted identity service, live dispatch, certified control, field navigation or deployment acceptance. Our Predictive Intelligence function remains in development, and our Digital Twins work remains a research initiative. The additional interfaces and experiments proposed here are research requirements. No prior internal test count is used as a substitute for the evidence required in this study.

2 Research method and critical synthesis

2.1 Evidence selection

We conducted a structured, purposive review spanning robotics, distributed systems, semantic technologies, uncertainty estimation, operations research, digital twins and AI assurance. Search families combined terms for GNSS denial, subterranean autonomy, multimodal odometry, distributed SLAM, disruption-tolerant networking, temporal provenance, uncertainty under distribution shift, operational twins and constrained resource allocation. Reference chaining connected foundational methods to more recent implementations.

We prioritised original research papers, author-hosted manuscripts, official technical standards and first-party programme or engineering reports. Sources were included when they contributed a mechanism, an experimentally supported capability, a formal limit or an explicit interface requirement. Vendor technical reports were used for the mechanisms they disclose, with their evaluation scope retained. Preprints were identified as such. Standards and programme descriptions establish terminology or research direction; they do not establish that our architecture meets an operational standard.

This is a critical architecture study, not an exhaustive systematic review or meta-analysis. Heterogeneous datasets, platforms, fault conditions and outcomes preclude pooling reported performance into a single effect estimate. We make no claim to complete literature coverage. Instead, we compare what each research line establishes, what assumptions it requires, and what integration claim remains untested. The reference list and Appendix C make that reasoning inspectable.

2.2 What the literature establishes

Visual and inertial simultaneous localisation and mapping, SLAM, can operate without continuous satellite positioning, while systems combining light detection and ranging, LiDAR, with inertial and visual measurements provide complementary sensing pathways. ORB-SLAM3 supports visual, visual-inertial and multiple-map estimation; FAST-LIO2 provides efficient direct LiDAR-inertial odometry; FAST-LIVO2 integrates image, inertial and LiDAR information (Campos et al., 2021; Xu et al., 2022; Zheng et al., 2025). These are substantial technical foundations. Their reported performance remains conditional on sensors, calibration, scene structure, motion and evaluation datasets.

Subterranean research supplies stronger environmental evidence than generic indoor benchmarks. The CERBERUS programme integrated heterogeneous robots, perception and autonomy in the DARPA Subterranean Challenge. The cross-team analysis by Ebadi et al. documents practical challenges including obscurants, computational constraints and difficult geometry (Tranzatto et al., 2024; Ebadi et al., 2024). These findings justify a systems approach, but do not establish that any untested sensor combination is reliable in all underground environments.

Distributed mapping and scene graphs address a different interface. Kimera-Multi demonstrates peer-to-peer metric-semantic mapping with robust treatment of incorrect loop closures. Hydra constructs hierarchical spatial representations from observations. The 2026 Hydra++ preprint investigates integrating learned object-shape estimates while rejecting degenerate predictions (Tian et al., 2022; Hughes, Chang and Carlone, 2022; Lim et al., 2026). Spatial structure can support operational reasoning, but semantic labels and geometric alignment do not confer business identity, access permission or physical serviceability.

Table 1 compares the major research lines and the integration gaps addressed here.

2.3 Interpretation and novelty boundary

The research gap is not the absence of any one component. It is the weakly specified relationship between components when their assumptions fail together. A SLAM system may expose covariance without the planning layer using it. A knowledge graph may preserve relationships while erasing their temporal validity. A model may return a confidence value that is well calibrated on one distribution and misleading on another. A replicated store may converge correctly while converging on an unauthorised or physically impossible commitment.

We therefore treat interfaces as objects of research. The proposed contribution is evaluated by replacing or removing these interfaces while holding the underlying models, input observations and resource budgets constant. This comparison can distinguish an architectural benefit from an improvement caused merely by a larger model, more sensors or additional compute. It also permits negative findings: the extra semantic and assurance work may consume resources without improving a particular task.

3 Denial model and system requirements

3.1 A multidimensional operating condition

We represent degradation along positioning, communications, evidence, computation, authority and physical-environment dimensions. These dimensions are not interchangeable and do not form a simple ladder. A node can have excellent localisation and no network; another can be connected but unable to establish which source is authoritative. The system should expose this state explicitly rather than reduce it to a single green, amber or red indicator.

Table 2 distinguishes the principal conditions and the corresponding obligations. The listed responses are design requirements, not claims that every response is already implemented.

The attacker model includes data manipulation, compromised sources, misleading retrieved instructions, corrupted model artefacts and the selective withholding of information. We also include benign faults with identical symptoms. The system must not infer hostile intent solely from anomaly. NIST's adversarial machine learning taxonomy helps separate attack surfaces across model development and deployment; we use it to structure assurance cases rather than assume that one defensive technique covers them all (Vassilev et al., 2025).

3.2 Assumptions that must be declared

Any resilience claim needs a boundary. We assume a defined deployment scope, authenticated components, locally protected policy and sufficient surviving hardware for the minimum function. We do not assume that every sensor is truthful, every clock is accurate, every supplier record is current, or every disconnected peer has the same state. If the trust anchor or local enforcement mechanism is compromised, the architecture cannot establish its own correctness merely by producing additional internal records.

The operating design domain must specify allowed terrain or facility classes, environmental ranges, sensor configurations, resource limits, human supervision, acceptable evidence age and permitted decisions. An underground inspection system approved for dry utility passages does not inherit acceptance for flooded tunnels or explosive atmospheres. This boundary must be machine-readable where it affects execution and understandable to the person responsible for deployment.

We distinguish service continuity from task completion. Continuing to retain observations and issue a bounded warning can be a useful outcome even when a repair, transfer or inspection cannot proceed. Conversely, stopping physical motion is not automatically safe: a platform's local safety case may require maintaining ventilation, clearing a hazardous area or completing a controlled transition. The intelligence layer must not replace such engineered responses with a universal stop instruction.

4 Reference architecture and decision model

4.1 Functional separation

We propose six cooperating functions. The sensing and source function acquires observations and source records. Local estimation maintains physical state and integrity information. The evidence function preserves typed assertions, temporal bounds and lineage. Bounded analytic services generate forecasts, hypotheses and candidate plans. Digital twins test physical and operational consequences. An independent decision boundary checks authority, evidence requirements and feasibility before a proposal reaches the relevant human and execution system.

This separation permits a fast local estimation loop and a slower investigative loop without giving both the same privileges. A high-rate perception process should not wait for a language model to maintain a safe trajectory estimate. A deliberative agent can investigate why a component is unavailable, request permitted evidence or compare alternatives, but its narrative remains a proposal. Runtime assurance research supports separating complex performance logic from a smaller safety mechanism, subject to the validity of that mechanism's model and recoverable set (Hobbs et al., 2023).

4.2 State and evidence

Let the operational state include physical asset condition, position, inventory, capacity and commitments. At decision epoch k, the system maintains a belief distribution over that state, a versioned evidence set, an authority envelope, a model configuration and a degradation description. We use a belief rather than a single state because missing and contradictory observations cannot generally be resolved to one trustworthy value.

$Z_{k} = \left( b_{k},E_{k},A_{k},\theta_{k},D_{k} \right)$ (1)

In Equation 1, b is the state belief, E is the admitted evidence cut, A is the authority envelope, theta contains pinned model and policy versions, and D describes degradation. The observation and transition models below are a generic estimation formulation. Their functions and error distributions must be identified for each application; the notation is not evidence of a correct physical model.

$\begin{matrix} x_{t + 1} & = f_{\theta}\left( x_{t},u_{t},w_{t} \right), \\ z_{t} & = h_{\theta}\left( x_{t},v_{t} \right). \end{matrix}$ (2)

In Equation 2, x is physical or operational state, u is an applied input, z is an observation, w represents process uncertainty and v represents observation uncertainty. Their distributions and dependence are part of the deployment model.

The observation model must distinguish sensor noise from missingness, censoring, delayed reporting and possible manipulation. A missing temperature reading is not a temperature of zero. A record of a dispatched component is not proof of receipt. A modelled connection between a tunnel segment and a ventilation fan is not proof that the fan is operating. These distinctions must survive every transformation between raw data, ontology, forecasting and simulation.

4.3 Admissible decisions

For a candidate action a, we define the admissible set as the intersection of evidence, authority, physical feasibility and resource constraints. An action requiring unavailable evidence does not become admissible merely because it has high expected utility. Unknown permission is not permission. An observation-only or advisory function may remain available when a commitment is blocked.

$\mathcal{U}_{k}^{adm} = \mathcal{U}_{E,k} \cap \mathcal{U}_{A,k} \cap \mathcal{U}_{P,k} \cap \mathcal{U}_{R,k}$ (3)

Each set on the right-hand side of Equation 3 is a subset of the common candidate universe U. Subscripts E, A, P and R denote actions satisfying, respectively, evidence, authority, physical-feasibility and resource predicates at epoch k. These predicates use the evidence cut, authority envelope, belief and model configuration, and degradation state defined in Equation 1. Each predicate must identify its evaluator, inputs and failure disposition. Evidence requirements are action-specific: an old asset drawing may remain useful for planning, while an old gas reading may be unusable for a current access decision. The authority predicate includes the applicable policy for disconnected operation. Where immediate revocation knowledge is required, a disconnected node cannot satisfy that requirement; the affected operation must wait or use an independently authorised process.

Within the admissible set, a planning service may minimise expected loss with an additional tail-risk term. We use conditional value-at-risk, CVaR, to expose the consequence of high-loss scenarios, following its established optimisation formulation (Rockafellar and Uryasev, 2000). A robustness formulation can instead optimise over a declared uncertainty set, trading nominal performance for protection against specified departures (Bertsimas and Sim, 2004). Neither method protects against conditions omitted from its model.

$\begin{matrix} a_{k}^{*} & \in arg\min_{a \in \mathcal{U}_{k}^{adm}}\left\{ \mathbb{E}\left\lbrack L(a) \right\rbrack + \lambda{CVaR}_{\alpha}\left( L(a) \right) \right\}, \\ {CVaR}_{\alpha}(L) & = \min_{\eta\mathbb{\in R}}\left\{ \eta + \frac{\mathbb{E}\left\lbrack (L - \eta)_{+} \right\rbrack}{1 - \alpha} \right\},\quad 0 < \alpha < 1. \end{matrix}$ (4)

Here L is a loss in consistently defined units, alpha is the CVaR confidence level, and lambda is a non-negative weight. The expectation and CVaR are taken under the same stated scenario distribution. If probabilities are not defensible, we report a range or an uncertainty-set analysis rather than assign precise probabilities to arbitrary scenarios. The auxiliary threshold eta is expressed in loss units, and the positive-part operator retains only values above zero. Human decision-makers must be shown the objectives, constraints and alternatives that determine the ranking.

4.4 Conditional property of conservative restriction

Proposition 1. For a fixed belief, model configuration and candidate universe, tightening the admissibility constraints cannot enlarge the admissible set. If each new predicate implies its previous version, any action satisfying every new predicate necessarily satisfies every previous predicate. Therefore the new intersection is a subset of the old intersection.

The proposition is elementary but useful: it gives a precise requirement for degradation policies. Its scope is limited. A changed physical state may create a new need for an emergency action, and new evidence may legitimately change the candidate universe. Those cases are not counterexamples because the fixed-state assumption no longer holds. Nor does the proposition prove that the predicates are correct, that their inputs are authentic, or that a selected action is safe. Those obligations remain with implementation and validation.

4.5 Propagating uncertainty across the decision boundary

The estimation-to-decision interface should preserve uncertainty in a form the downstream constraint evaluator can use. Let X_k be a set of plausible physical states at intended execution time t_e, including uncertainty from pose, asset identity, time alignment and state propagation. For a constraint g_m, a robust feasibility check requires the constraint to hold for every state in that set. If the set has a validated coverage bound, this yields a conditional bound on the corresponding constraint violation.

$\Pr\left( x_{t_{e}} \in X_{k} \right) \geq 1 - \epsilon_{k},\quad\sup_{x \in X_{k}}g_{m}(x,a) \leq 0\quad \Rightarrow \quad\Pr\left( g_{m}\left( x_{t_{e}},a \right) > 0 \right) \leq \epsilon_{k}$ (5)

In Equation 5, m indexes a physical constraint and ε_k bounds the probability that the true execution state lies outside X_k. The equation states the set-based check and its consequence: if the true state is inside X_k and the modelled constraint is correct, the constraint holds. Therefore a violation can occur only outside X_k. The probability bound follows without assuming independence between the components of the state. It does require that the set's coverage is valid for the selected action and deployment condition. Selection-dependent errors, incorrect dynamics or an omitted hazard invalidate the inference. A covariance ellipsoid is not automatically a calibrated set under faults or multimodal ambiguity.

This formulation makes the interaction between localisation and planning explicit. If an observation may refer to either of two assets, the state set should retain both possibilities unless evidence resolves the association. A response feasible for only one candidate is not robustly feasible across that set. If this is too conservative, the system can seek discriminating evidence or use an explicitly justified probabilistic decision rule. It must not silently select the convenient identity and discard the other possibility.

The same principle applies to delayed execution. A feasible plan evaluated at one time may become infeasible before dispatch. We require a decision record to bind the evidence cut, uncertainty representation, model, approval and resource reservation to an execution validity interval. The external executor must either validate that binding atomically with commitment or use a protocol whose lease, concurrency and failure semantics are explicit. A separate check followed by an unprotected delay creates a time-of-check to time-of-use gap. The ontology can describe the binding; only an enforceable execution protocol can maintain it.

5 Lutine ontology as a semantic contract

5.1 Why ontology matters under denial

The strongest potential benefit of Lutine's ontology is its capacity to retain the distinctions on which a decision depends. Heterogeneous sources often use the same word for different states, or different words for the same entity. During normal operation, people may repair these differences informally. During disconnection, the same ambiguity can propagate through automated analysis without timely correction. A shared vocabulary becomes valuable when it also specifies provenance, validity, uncertainty and the limits of permissible interpretation.

We organise this role through three developing planes. O-XCH describes transferable evidence, custody and boundary records. O-EXT describes source adaptation, identity candidates and operational dependencies. O-LUT describes hypotheses, determinations, forecasts, scenarios and governed response. These planes provide a separation of meaning; their existence does not establish that a runtime enforces all associated obligations.

The representation stack also needs separation. OWL provides formally defined vocabulary and semantic relationships. SHACL validates graph conditions. A closed record schema can reject undeclared fields and incorrect lexical types. Dataset admission can then enforce cross-record consistency using trusted context. OWL entailment does not itself function as closed-world input validation, and a valid graph does not authenticate a caller or execute an approval (W3C, 2012; W3C, 2017).

5.2 Evidence lineage and dependence

EvidenceAssertion provides the proposed unit for a typed claim about an entity or property. SourceArtifact and MappingResult retain the connection to the original record and its transformation. EvidenceCut fixes the information available to a decision epoch. DependenceGroup records shared ancestry or control so that multiple representations of one observation are not mistaken for independent corroboration. PROV-O offers an established vocabulary for derivation and responsibility; deployment-specific semantics must still define what those relationships mean for admission and inference (Lebo, Sahoo and McGuinness, 2013).

A supplier notice copied into a logistics platform, an email and an analyst summary represents three records but may contain only one originating claim. Similarly, two sensors may share calibration, power, timing or a preprocessing model. Independent file signatures do not make their measurement errors independent. We therefore require lineage and common-cause annotations to influence probabilistic aggregation, rather than remaining passive metadata.

The difficult case is incomplete lineage. We cannot guarantee dependence detection from record content alone. Where independence is not established, a conservative aggregation policy may count only one evidential contribution from a known shared origin, retain interval-valued support, or escalate the claim for review. The chosen rule should be explicit and tested. Blindly treating every source as dependent would also discard useful evidence; the objective is calibrated treatment of dependence, not universal scepticism.

5.3 Time and property-specific authority

We distinguish when an event occurred, when a source recorded it, when the system received it and when the assertion was valid for its intended use. EvidenceCut must use the information actually available at the decision epoch. A later-arriving correction may revise the interpretation of an earlier event, but it cannot be inserted retrospectively into an evaluation of what the system knew at the time.

PropertyAuthority is especially consequential. A warehouse system may be authoritative for custody, an engineering register for qualification, and a maintenance system for serviceability. None is globally authoritative for all properties. Authority should be scoped by process, property, time and policy. Conflicting observations remain distinguishable until the relevant resolution rule or accountable reviewer settles them. This design prevents an apparently prestigious source from overriding a more relevant source for the wrong property.

EntityCandidate and EntityCommitment preserve a similar distinction for identity. A probable match between an observed pump and a maintenance record must remain provisional when its serial number, location or installation history is uncertain. If the match changes, downstream forecasts and proposed actions must identify which assumptions were affected. The potential frontier benefit is a revisable chain from uncertain observation to operational consequence, rather than a graph that silently treats every link as settled.

5.4 Hypothesis challenge and governed response

DetectionSignal, Hypothesis and ChallengeResult separate a candidate anomaly from a supported interpretation. A challenge should test a concrete alternative: reporting delay, sensor fault, seasonality, authorised change, shared evidence origin or wrong entity association. A record labelled ChallengeResult is insufficient unless the challenge was actually executed with the required inputs and a meaningful outcome. Missing or inconclusive challenge evidence should remain visible.

Scenario, Forecast, FeasibilityResult and CourseOfAction then distinguish what might happen from what can be done. HumanApproval and RevalidationReceipt bind a permitted proposal to the applicable authority and current conditions. ActionIntent is a semantic request, not an executed effect; ActionOutcome must come from an authoritative external receipt. A lost receipt requires reconciliation rather than a blind retry of a potentially irreversible operation.

Table 3 shows how selected classes would support denied-environment functions. The third column names the external mechanism still required.

5.5 Required extensions and limits

We propose additional profiles for coordinate frames, transform uncertainty, map versions, sensor calibration, localisation integrity, communications contacts, resource leases and twin validity domains. These are research extensions rather than assertions that the current ontology already implements each field. A navigation observation needs units, frame, timestamp bounds and uncertainty. A twin output needs its initial state, parameter version, scenario assumptions and validation range. An offline commitment needs an owner, quantity, scope and unambiguous reconciliation rule.

Ontology complexity is itself a risk. Overly broad imports can increase reasoning cost, encourage incompatible interpretations and make local validation brittle. A denied-environment deployment should package a bounded profile containing only the required vocabulary and constraints, with local dependency resolution and version-pinned schemas. Imported documents must not be fetched from arbitrary network locations during operation. Migration between profiles needs explicit compatibility testing and retained interpretation of historical records.

The research claim is thus specific: these semantics may improve traceability and prevent particular categories of unjustified inference. They do not make evidence true, identify every deception, establish causal relationships, provide security accreditation or guarantee competent decisions. Each claimed improvement must be linked to a failure mode and a measurable comparison.

6 Local AI and sustainable computation

6.1 Local execution as a complete workflow

An offline model is useful only if its dependencies are also available. The required package may include inference libraries, tokenisation, retrieval indexes, local identity and policy services, tool schemas, evidence stores, time services, model artefacts and rollback material. A workflow that executes inference locally but depends on remote retrieval, online licence verification or a cloud approval endpoint remains network-dependent.

Recent technical work demonstrates that substantial language models can be adapted for device execution. Apple's 2025 report describes an approximately three-billion-parameter device model using techniques including quantisation-aware training and shared key-value caches (Apple, 2025). We treat these as engineering precedents for efficient inference, not evidence that a particular model is suitable for sovereign infrastructure or that advertised device capability transfers unchanged to other hardware.

Our architecture separates a stable shared model, deployment-specific adaptations, transient task context and data that are excluded from model training. A site's maintenance vocabulary may inform a controlled adapter; a live access credential must not become training material. Context memory must remain inspectable, correctable and subject to retention rules. Personalisation is useful only where it supports a defined task and does not substitute inferred preferences for explicit authority.

6.2 Bounded agents and tool use

An investigative agent receives a typed objective, permitted evidence sources, tool allow-list, resource budget, termination conditions and delegation ceiling. It can propose an evidence query or scenario, but cannot grant itself additional access or alter the policy that evaluates its output. Retrieved text, a supplier document or another agent's message is data; it cannot expand authority merely by containing imperative language.

We propose a model portfolio rather than requiring a generative model for every task. Deterministic transforms handle units and schema checks. Statistical models estimate defined risks. Small perception models process local sensor streams. A language model can interpret technical language, construct candidate queries and draft explanations whose claims are checked against admitted evidence. An optimisation solver evaluates constrained alternatives. This arrangement makes component failure easier to isolate and reduces unnecessary inference load.

Vision-language-action research, including OpenVLA, shows how pretrained representations can support robot manipulation and adaptation (Kim et al., 2024). It does not establish dependable underground navigation or safety under arbitrary distribution shift. We would evaluate such models for bounded perception or task proposals first, with platform control governed by separate validation and runtime safeguards. The ability to produce an action token is not equivalent to authority or physical competence to execute it.

6.3 Resource-aware admission

The relevant budget includes sustained memory, bandwidth, energy, heat and worst-case response demands. Parameter count alone is inadequate. For example, three billion weights represented at four bits require 1.5 billion bytes for weights alone. Runtime buffers, activation memory, retrieval, concurrent models, metadata and key-value caches add to that amount. This is an arithmetic lower bound, not a device specification or performance estimate.

We reserve resources for essential sensing, state estimation, safety monitoring, identity and audit persistence before optional generative inference. When power or temperature deteriorates, the system can shorten an explanation, reduce optional model calls, use a smaller approved model or defer non-essential simulation. It must record the loss of analytical depth or coverage. Dropping evidence needed for a long-horizon investigation while continuing to advertise full coverage would be a semantic failure even if the processor remains responsive.

Research on resource-constrained FAST-LIVO2 illustrates that sensing and map management can be adapted to computational constraints, with explicit accuracy trade-offs measured on specified datasets (Zhou et al., 2025). Our extension is to expose those trade-offs to the operational decision layer. A lower-cost estimator may be adequate for a broad inspection zone but inadequate for associating an observation with one of several adjacent assets. Scheduling should depend on the current decision requirement, not simply on maximising inference throughput.

6.4 Learning during isolation

Federated learning permits model development without centralising all raw training data, but still requires exchange and aggregation. It is not a solution to indefinite disconnection by itself (McMahan et al., 2017). Updates can also contain sensitive information or malicious influence. Any privacy claim needs a defined threat model and, where differential privacy is used, an explicit privacy accounting method and utility evaluation.

We distinguish updating a belief from changing a model. New evidence can revise the current estimate under an approved model. Updating model weights changes the behaviour of future decisions and requires a separate promotion process. During isolation, candidate adaptations should be retained for later evaluation or confined to an explicitly authorised experimental role. Reconnection does not justify averaging incompatible models or promoting local learning automatically. Model lineage, data permissions, validation and rollback remain necessary.

7 Positioning navigation mapping and timing

7.1 Complementary sensing without universal guarantees

GNSS-denied operation requires an alternate source of relative motion and, where needed, an independent means of constraining global position. Inertial integration supplies rapid motion estimates but accumulates error. Cameras provide visual constraints when texture, illumination and motion permit. LiDAR provides geometric information but can suffer from obscurants, limited geometry and changing surfaces. Wheel or leg odometry depends on contact assumptions. Radio ranging requires usable propagation and a known or estimated reference network.

We therefore recommend testing complementary sensing combinations against their common failure modes. Adding sensors does not necessarily add independent information. Cameras and LiDAR may share obscuration or calibration failures; several receivers may share a disturbed timing source. A robust fusion system must expose disagreement and observability rather than average incompatible signals into a reassuring estimate. The subterranean literature makes this integration problem concrete across diverse underground conditions (Ebadi et al., 2024).

The table is a design comparison, not a ranking or a procurement specification. The combination must be evaluated on the intended platform and operating domain. No sensor listed supplies a universal substitute for GNSS.

7.2 Integrity and observability

An estimator should publish more than a pose. Its interface should include the reference frame, covariance or another justified uncertainty representation, observation time, calibration version, sensor-health indicators and an integrity state. Estimator residuals and observability diagnostics can indicate inconsistency or weak constraints. They cannot establish a defensible protection level unless the assumed error and fault models have been validated for the application.

Repetitive tunnels illustrate the distinction between numerical confidence and genuine information. A long corridor may constrain lateral position well while providing weak information along its axis. A false loop closure can produce a globally consistent-looking map with incorrect alignment. Robust estimation helps, but the integrity monitor must also test whether the available observations support the claimed degrees of freedom. We would evaluate error conditional on declared integrity state and measure failures to alert, not merely average trajectory accuracy.

Where a calibrated error bound is available, a decision can compare it with an action-specific alert limit. Otherwise the system must describe its uncertainty as an estimate and apply a more conservative operating rule. An operational threshold should reflect the separation between assets, permissible inspection region or other physical decision requirement. It should not be selected simply because it produces an attractive benchmark score.

7.3 Frames and semantic association

A local map may be internally consistent without being registered to the facility's authoritative coordinate system. Every exported observation should identify its frame and the transform chain used to relate it to an asset record. Transform uncertainty must be propagated, and unknown alignment must remain unknown. A later loop closure can move an observation's estimated location sufficiently to change the asset to which it was assigned.

Distributed mapping can improve localisation when communication becomes available, as Kimera-Multi demonstrates (Tian et al., 2022). For our proposed integration, a map merge must trigger a review of affected entity commitments and operational conclusions. A geometrically corrected map should not silently leave old inspection findings attached to the wrong equipment. Conversely, an uncertain global alignment need not invalidate all local observations: local relative measurements may still support a bounded decision within the same frame.

Hierarchical scene graphs provide a useful bridge from points and surfaces to objects, places and relationships. Hydra and the later Hydra++ work make this bridge technically plausible (Hughes, Chang and Carlone, 2022; Lim et al., 2026). We propose mapping candidate scene entities into O-EXT while preserving their observation lineage and uncertainty. An object labelled as a valve remains distinct from a qualified identification of a particular valve in an engineering register.

7.4 Time without continuous external synchronisation

Timing affects sensor fusion, causal ordering, credential validity, evidence freshness and coordinated resource use. A system can lose reliable time while continuing to receive plausible data. We propose recording timestamp intervals where clock uncertainty is material, along with clock source, drift assumptions and monotonic local sequence numbers. Let delta denote a bound on absolute clock error. For a clock with a bounded fractional drift rho, a simple holdover bound grows by rho times elapsed time, in addition to initial uncertainty. Temperature and ageing effects may require a richer model.

$\delta\left( t_{0} + \Delta \right) \leq \delta\left( t_{0} \right) + \rho\Delta,\quad\quad\Delta \geq 0$ (6)

Equation 6 is a conservative bound under its stated drift assumption, not an oscillator guarantee. If the assumed drift bound is invalid, so is the freshness calculation. Sequence numbers preserve local ordering but do not establish global wall-clock time. Where two timestamp intervals overlap, the system should avoid asserting a strict temporal order without additional evidence. The 2026 draft revision of NIST's PNT profile reinforces the wider cyber and operational relevance of these dependencies; it remains a draft in the evidence reviewed here (Lightman et al., 2026).

7.5 Frontier sensing research

Magnetic and gravity references may offer independent constraints in suitable environments, but their utility depends on map quality, spatial variation, platform motion and sensor performance. Quantum gravity sensing has demonstrated detection of an underground feature in a controlled survey setting (Stray et al., 2022). That result supports further sensing research. It does not demonstrate a compact, moving, indefinitely drift-free underground navigation system.

We would treat emerging sensing modalities as optional experimental constraints, preserving their provenance and testing their marginal contribution against the existing sensor suite. The relevant question is whether they reduce decision-relevant uncertainty under the deployment's failure conditions at acceptable cost, power and operational complexity. A sophisticated sensor that adds an unmaintainable dependency can reduce overall resilience.

8 Disconnected exchange and coherent recovery

8.1 What local operation can guarantee

Disconnection creates a coordination problem as well as a communications problem. Gilbert and Lynch's result shows that specified strong consistency and availability guarantees cannot both be maintained under network partition in their model (Gilbert and Lynch, 2002). The practical implication is not that all services must stop. It is that a system must identify which operations can proceed locally and which require knowledge unavailable across the partition.

We separate observation, analysis and commitment. A node can often append observations, run bounded analysis and retain candidate plans locally. It cannot generally establish that a globally shared resource remains uncommitted elsewhere. Where continued local commitments are necessary, rights must be partitioned in advance or represented by another protocol with explicit guarantees. These limits should be visible in the user interface and action schema.

8.2 Evidence transport

Bundle Protocol Version 7 provides a standard basis for storing and forwarding messages when an uninterrupted end-to-end path cannot be assumed. BPSec defines associated security mechanisms (Burleigh, Fall and Birrane, 2022; Birrane and McKeever, 2022). We propose using such transport concepts for evidence packages, model manifests and reconciliation records, while keeping application semantics above the transport layer.

A delivered bundle is not necessarily timely, authoritative or safe to use. Its contents require identity verification, scope checks, dependency validation, anti-replay treatment and action-specific freshness evaluation. A signature establishes properties of the signed bytes and signing key under the relevant trust assumptions; it does not prove that a sensor reading represents reality. Similarly, encryption does not solve endpoint compromise or conflicting resource commitments.

Limited bandwidth makes prioritisation necessary. We would prioritise information by expected decision value, validity deadline, unresolved critical dependencies and releasability. A compact machine-verifiable assertion can be transmitted before a large raw payload, but it must retain a reference to that payload and disclose any missing verification material. A language-model summary cannot replace the original evidence for a claim that requires exact measurement or provenance.

Age-of-information research provides a formal basis for treating timeliness as distinct from delivery latency (Yates et al., 2021). We extend that distinction by associating freshness with the decision's validity horizon. The newest available record may still be too old, and an older record may still be valid for a slowly changing property. Transfer policy should therefore consider the property and action, not a universal expiry interval.

8.3 Reconciliation protocol

We propose a recovery sequence with explicit intermediate states. The receiving node first authenticates the peer and compares scope and release manifests. It then receives immutable events and verifies their integrity, stable identifiers, temporal bounds and permitted disclosure. Duplicate events are suppressed. Conflicts in identity, source authority, maps, reservations and corrections are preserved rather than overwritten by whichever message arrived last.

The system reconstructs affected state under a new reconciliation epoch. Prior determinations receive linked confirmation, correction or withdrawal where the new evidence changes their basis. A previously approved action is revalidated if its evidence, feasibility or authority has changed. Unknown execution outcomes are queried from the authoritative executor before retry. The node returns to its wider operating envelope only after the required reconciliation checks complete.

Convergent replicated data types provide useful algebraic guarantees for appropriate data structures (Shapiro et al., 2011). We would use those properties for records whose merge semantics are well defined, such as selected immutable event collections. Convergence of a data structure does not resolve the business meaning of two incompatible approvals or two claims on the same indivisible resource. Those require an application-specific rule or human resolution.

8.4 Conditional property of resource conservation

Proposition 2. Suppose Q resource units remain after all prior commitments have been accounted for. An authority assigns non-overlapping local rights q_i with total no greater than Q. Each honest node enforces a cumulative commitment c_i between zero and q_i. If rights cannot be duplicated, transferred twice or reissued while still usable, the sum of local commitments cannot exceed Q.

$\sum_{i}^{}q_{i} \leq Q,\quad 0 \leq c_{i} \leq q_{i}\quad \Rightarrow \quad\sum_{i}^{}c_{i} \leq Q$ (7)

The proof follows by summing the per-node inequalities. This is a conservation property for recorded commitments, not a guarantee of physical delivery. Stock may be damaged, a node may be compromised, or a prior commitment may have been omitted. Expiry also needs care: the central service must not reissue a right merely because it believes a disconnected copy has expired unless the protocol makes further use impossible or reconciles its disposition. Hardware rollback and uncertain time can defeat naive expiry schemes.

This property trades utilisation for bounded coordination risk. A node can exhaust its rights while another has spare capacity it cannot safely transfer. That loss is measurable and should be reported alongside prevented overcommitment. It is an explicit engineering trade-off, not evidence that disconnected operation has eliminated the consistency problem.

9 Predictive and strategic intelligence

9.1 Forecasting defined events

We develop Predictive Intelligence as a method for converting emerging signals into dated, testable assessments. A forecast should identify an event, horizon, affected operations, probability or justified uncertainty range, evidence cut, competing explanations and review trigger. The forecast must also specify how its outcome will be resolved. Without these definitions, a narrative can appear prescient after almost any later development.

The relationship to Lutine is direct. Predictive Intelligence estimates whether a disruption may occur; Lutine connects the assessment to exposed commitments and the evidence supporting that connection; Digital Twins tests the consequences and feasible responses. For example, an emerging constraint at an equipment supplier may matter because it affects a qualified replacement component, which affects a maintenance window, which affects service capacity. The chain must preserve both factual dependencies and uncertain hypotheses.

IARPA's dated programme summary reports that its Hybrid Forecasting Competition developed and tested human-machine forecasting systems and evaluated them in forecasting tournaments (IARPA, 2021). We use that research precedent to motivate comparison with expert and statistical baselines. We do not transfer programme performance figures to our proposed system or imply affiliation.

9.2 Temporal event graphs and competing explanations

An emerging disruption can involve several individually ordinary events: changed delivery dates, maintenance deferrals, revised access patterns, increased demand or inconsistent transaction records. Temporal event graphs can connect these signals while retaining their source and timing. DARPA's 2019 KAIROS announcement described proposed schema-based identification and temporal linking of complex events from multimedia information (DARPA, 2019). This provides a documented research objective for structured event representations; it does not establish operational performance or causal attribution from graph connectivity alone.

We propose maintaining explicit competing hypotheses. A delayed shipment may reflect transport disruption, reporting lag, a qualification hold or a changed customer priority. Each hypothesis should identify supporting, contradictory and missing evidence, along with the observations most likely to discriminate between alternatives. An agent's task is to acquire permitted evidence and update these hypotheses, not to defend its first explanation.

The distinction between association and intervention is central. A graph can show that two variables co-vary without establishing that changing one will improve the other. Causal reasoning requires assumptions about the data-generating process and the effect of intervention (Pearl, 2009). Where those assumptions are weak, we would present scenario sensitivity rather than a causal claim. An explanation that names a plausible mechanism should be labelled as a hypothesis until supported.

9.3 Forecast quality and uncertainty

Forecasts should be evaluated using proper scoring rules, such as the Brier score for defined binary events, alongside calibration, resolution and useful warning time (Gneiting and Raftery, 2007). A model that predicts only the prevailing base rate may be calibrated yet provide little decision value. A model with strong discrimination may still produce dangerously overstated probabilities.

$BS = \frac{1}{n}\sum_{j = 1}^{n}\left( p_{j} - y_{j} \right)^{2},\quad\quad y_{j} \in \{ 0,1\}$ (8)

In Equation 8, n is the number of eligible forecasts, j indexes them, and p_j is the probability issued before the outcome y_j becomes available. The evaluation population must include the eligible forecasts, including inconvenient failures, and preserve their original issue times. We would report calibration by operating regime, source coverage and denial condition, while avoiding claims of precision from small bins or rare outcomes. Human overrides need separate records so that machine, human and combined forecasts can be compared.

Post-hoc calibration can improve probability estimates on representative data, but research under dataset shift shows that these improvements do not automatically persist when conditions change (Guo et al., 2017; Ovadia et al., 2019). We therefore require shift monitoring, alternative baselines and explicit abstention. Conformal methods may provide useful prediction sets under their assumptions; weighted methods address particular forms of covariate shift, not unrestricted adversarial change (Tibshirani et al., 2019).

Abstention itself must be evaluated. A system can avoid error by declining every difficult case, while providing no useful service. We propose risk-coverage curves, the rate of unsupported confident outputs, and the operational consequence of deferred decisions. A missing forecast should trigger an appropriate collection or review workflow rather than silently disappear from evaluation.

9.4 Space-enabled and cross-domain observation

Earth observation can contribute regional context for flood exposure, access disruption, land change and infrastructure conditions. Prithvi-EO-2.0 illustrates how multitemporal foundation models can support several remote-sensing tasks using shared representations (Szwarcman et al., 2026). ESA's PhiSat-2 work demonstrates onboard AI processing as a means of selecting and processing observations before downlink (ESA, 2025). These are complementary research directions for efficient collection and analysis.

Their operational value depends on resolution, revisit interval, cloud or sensor limitations, processing delay and corroboration. A surface image cannot directly establish conditions deep underground. It may constrain a flood or access hypothesis, but a current local observation is still needed for the relevant underground decision. When satellite communications are unavailable, a previously acquired image is a dated prior, not a live feed.

We propose representing every derived geospatial feature with sensor modality, acquisition interval, geographic footprint, processing model, uncertainty and permitted uses. A model output should remain distinguishable from a human-verified observation. Transfer to Lutine should expose which operational entities intersect the observation and how uncertain that association is. This allows a regional warning to inform a local investigation without becoming an unsupported conclusion about a specific asset.

9.5 Cognitive digital twins and public safety

Our cognitive digital twin research concerns the combination of observations, contextual knowledge and simulation for defined questions. Convolutional neural networks, CNNs, and long short-term memory networks, LSTMs, are candidate spatial and temporal baselines; they are not mandatory or inherently superior to transformers, state-space models, graph methods or simpler statistical alternatives. Model choice should follow the data, inference latency, interpretability needs and comparative results.

The public-safety strand sometimes described as pre-crime cognitive digital twins requires particularly careful formulation. We define its research object as place- and time-specific patterns and the consequences of proposed interventions. It cannot establish that an individual will offend or that a person is guilty. Recorded incidents reflect reporting and observation practices as well as underlying events. Increased inspection or enforcement can produce more recorded events without an increase in the underlying phenomenon.

Ensign et al. show how feedback loops can arise in predictive policing systems when deployment affects the observations used for subsequent predictions (Ensign et al., 2018). We therefore require an observation-process model, lawful and bounded data use, subgroup and geographic error analysis, independent outcome measures where feasible, and evaluation of intervention effects. This issue extends beyond policing: sending more inspectors to one supplier can create a similar feedback loop in recorded non-compliance.

9.6 Decision value and collection priorities

Warning quality matters only in relation to available choices. A forecast arriving after a maintenance or procurement deadline may be accurate but unusable. An early warning with a high false-alarm rate may impose more cost than it prevents. We therefore define useful warning time relative to the latest feasible intervention and compare expected decision loss with and without the assessment.

The value of an additional observation is the reduction in expected loss it permits, less acquisition cost, delay and exposure. This quantity depends on the action set. If no feasible action changes after new information, the observation may have little immediate decision value, although it may still support later learning or accountability. Under bandwidth denial, this principle offers a basis for selecting which evidence to collect or transmit first.

We would test this function through time-separated replay and prospective shadow operation. Each assessment should retain its issue-time evidence, original recommendation, available alternatives and eventual outcome. The central empirical question is whether the system improves decisions under realistic constraints, not whether its explanations appear sophisticated.

10 Digital twins for operational and infrastructure resilience

10.1 A twin as a decision model

We define a digital twin as a maintained relationship between an identified physical or operational system, observations, model state and predictions used for specified decisions. Visual realism alone does not establish a twin's predictive validity. A probabilistic graphical model can express the coupling between asset state, observations, model updates and decisions, as demonstrated by Kapteyn, Pretorius and Willcox (2021). Our architecture uses that separation to distinguish what has been observed from what has been inferred or simulated.

Each twin should have a declared purpose and validity domain. A pump model used to estimate maintenance timing may be unsuitable for predicting a rapidly evolving failure transient. A logistics model used for planning might omit physical constraints essential for dispatch. We require the decision question to determine model fidelity, rather than building the most visually elaborate representation and subsequently searching for a use.

Lutine would provide the evidence and dependency context for a twin, while the twin returns a versioned forecast or feasibility result. The ontology should specify units, asset identity, state age, uncertainty, parameter provenance and constraint interpretation. This permits engineering, planning and statistical models to cooperate without pretending they describe the same quantities at the same resolution.

10.2 Coupled model families

We propose a hierarchy of coupled models. Asset models describe condition, degradation and maintenance. Process models describe production, handling or service delivery. Network models describe transport, energy and dependency relationships. Resource models describe personnel, qualified spares, compute and budgets. Discrete-event simulation can represent queues and maintenance sequences; physical models can represent energy, flow or thermal behaviour; probabilistic models can represent demand and uncertain failure.

Interoperability requires more than an API. Co-simulation interfaces such as FMI define ways to exchange and execute dynamic models, including model exchange, co-simulation and scheduled execution (Modelica Association, 2024). They do not automatically resolve incompatible units, causal direction, solver stability or synchronisation assumptions. We would validate each coupling and the aggregate system, including feedback loops that are absent from the individual models.

For example, reducing cooling power may constrain compute; reduced compute may reduce sensing frequency; reduced sensing may widen uncertainty and restrict allowable operation. A purely financial allocation model could miss this feedback. Conversely, a detailed thermal model may omit maintenance staffing or component qualification. The research objective is to identify the minimum coupled model that captures the decision-relevant interactions and to quantify the consequences of omitted dynamics.

10.3 Synchronisation under denial

A connected twin is often described as real-time, but a denied-environment twin must expose which state variables are measured, estimated, extrapolated, stale or unknown. We propose per-variable validity horizons and uncertainty propagation during observation gaps. A last-known value should not persist indefinitely as though freshly observed. Where model error grows beyond the decision's tolerance, the twin should narrow its claim or stop supporting that decision.

Observed-state storage and scenario storage must be separate. A simulated repair must not update the live maintenance record. A hypothetical stock transfer must not become an inventory receipt. A generated scene completion must not be admitted as a surveyed tunnel. Each scenario should identify its starting evidence cut, intervention assumptions, exogenous conditions, model versions and random seeds where applicable.

Reconnection requires assimilation rather than replacement of history. Newly received observations may contradict the state extrapolated during isolation. The twin should quantify the discrepancy, update its state and identify which earlier forecasts or decisions require review. Repeated discrepancies can indicate incorrect parameters, changed operating regime or a faulty source. They should not be concealed through automatic refitting that destroys the audit trail.

10.4 Contested supply chains and qualified alternatives

An operational supply twin should represent dependencies beyond purchase orders and transport status. Qualified substitutes, serviceability, maintenance windows, custody, shelf life, specialised tooling, workforce and shared upstream capacity can determine whether a nominally available component is usable. We propose representing these constraints explicitly and linking them to the authority responsible for each property.

This is particularly relevant to advanced computing infrastructure. ASML's 2025 annual report describes dependence on specialised suppliers, industrialisation capacity and production infrastructure (ASML, 2026). We use this as evidence that computing supply cannot be reduced to a generic quantity of interchangeable chips. For a specific deployment, hardware replacement may require software compatibility, model requalification, thermal changes or revised sensor timing. Those are system dependencies that an operational twin should expose.

We would compare a nominal efficiency plan with alternatives that retain additional capacity, qualified inventory or recovery options. Such alternatives may cost more under normal conditions. Their value depends on the loss avoided under disruption, the probability or uncertainty assigned to that disruption, and the opportunity cost of resources held in reserve. An optimisation objective should reveal these trade-offs rather than automatically label the most redundant solution resilient.

Random variation is not a general remedy for vulnerability. Any variability introduced into schedules or allocations must preserve safety, authorisation, service requirements and physical feasibility. Our research focuses on flexible, constrained alternatives and recoverability. It does not infer that unpredictability alone improves a supply network.

10.5 AI facilities and regional infrastructure

For AI facilities, the twin should connect electrical supply, cooling, storage, maintenance, workload demand and hardware availability. A compute service can appear healthy at the application layer while exhausting backup power or approaching an unsupported thermal regime. We propose evaluating service priorities under explicit resource envelopes, with essential functions retained before discretionary inference or retraining.

For regional infrastructure, dependencies cross organisational boundaries. A pump station may depend on power, communications, transport access and specialist labour; a transport interruption may delay the same crew needed to restore communications. Shared ontology can make those relationships intelligible, but data-sharing authority and source responsibility remain separate questions. Each organisation should disclose only the information required for the shared decision, with uncertainty and update obligations retained.

The relevant outcomes include essential-service availability, recovery sequence, unmet demand, resource contention and time to restore a minimum viable service. We would evaluate interdependencies through disruption scenarios and compare results with observed events or controlled exercises. A detailed network picture without validated dependency behaviour is a map, not evidence of resilience.

10.6 Physical AI commissioning and rehearsal

Digital twins can support robot commissioning and supervised operational rehearsal by exposing geometry, sensor characteristics, task constraints and foreseeable failures before deployment. Simulation is useful for scenario coverage that would be expensive or unsafe to obtain repeatedly in the field. However, realism in rendered images does not establish realism in contact, sensor errors, communications or human behaviour.

We propose a progression from component simulation to recorded-data replay, hardware-in-the-loop testing and supervised field exercises. Parameters should be estimated from measured conditions, and the discrepancy between simulation and reality should be reported. Domain randomisation can vary uncertain factors but cannot repair a missing failure mechanism merely by increasing sample count. A generated scenario must remain identifiable as generated.

Immersive training and augmented-reality guidance are related applications. Their value should be measured through task accuracy, response time, retention and transfer to supervised operations. A compelling virtual experience is not a competence assessment. Training environments must remain separated from live control permissions, and any assistance delivered during real operations needs the same freshness and identity checks as other decision support.

10.7 Validation and falsification

We require three levels of twin validation. Structural validation asks whether the model includes the relevant mechanisms and dependencies. Predictive validation compares outputs and uncertainty with observations outside the calibration data. Decision validation asks whether using the model improves the intended choice under realistic constraints. Success at one level does not imply success at the others.

Falsification conditions include systematic underprediction of recovery time, failure to cover observed uncertainty, unstable coupled simulation, false feasibility caused by stale inputs, and recommendations that cease to be useful when measured execution costs are included. A failed validation should narrow the model's approved purpose or trigger redesign. It should not be converted into a broader claim that more data will necessarily solve the problem.

10.8 Conservation and uncertain network capacity

A supply twin needs explicit conservation constraints. For one homogeneous, qualified component type, let I_i,t denote inventory at node i at the start of period t, q_ij,t a dispatch to node j, d_i,t fulfilled local demand, and r_i,t verified external receipts excluding transfers already counted in q. Let ℓ_ji be the non-negative integer delay used to index arrivals from j. One discrete planning convention is:

$\begin{matrix} I_{i,t + 1} & = I_{i,t} + \sum_{j}^{}q_{ji,t - \mathcal{l}_{ji}} - \sum_{j}^{}q_{ij,t} - d_{i,t} + r_{i,t}, \\ \sum_{j}^{}q_{ij,t} + d_{i,t} & \leq I_{i,t},\quad\quad I_{i,t},q_{ij,t},d_{i,t},r_{i,t} \geq 0. \end{matrix}$ (9)

In Equation 9, arrivals indexed for period t become available at the start of t + 1. Dispatches indexed before the planning horizon are supplied from known in-transit records or set to zero if none exist. Dispatch and fulfilled demand cannot exceed start-of-period usable inventory. This conservative timing convention avoids using an unreceived component in the same period. A finer-grained model may use a different convention, but it must be stated consistently.

Inventory conservation is necessary but insufficient. Qualification, custody, reserved quantities, handling capacity, shared labour and transport constraints also apply. An indivisible item requires integer decisions. Multiple component types require separate conservation equations and explicit substitution relationships. Unknown receipts remain uncertain scenarios rather than deterministic arrivals. If the resource is unavailable physically, a valid reservation does not make it usable.

We would model uncertain capacities through declared scenarios or uncertainty sets, retaining common causes between affected nodes. Independently sampling every link can understate simultaneous outages caused by shared power or infrastructure. The solver must report infeasibility, any permitted slack and the assumptions governing substitution. A feasible result should retain a verifiable assignment of quantities and times so that an independent checker can confirm the constraints without trusting the solver's explanatory text.

11 Subterranean research and applications

11.1 Why underground operation is a distinct extension

Subterranean environments combine restricted access, difficult communications, variable geometry, environmental hazards and limited opportunities for human intervention. Darkness and repetitive structure can impair visual estimation; dust, water and changing surfaces can affect several sensors simultaneously. The communication path may depend strongly on geometry and installed infrastructure. The practical lessons from CERBERUS demonstrate the importance of integrating mobility, perception and autonomy rather than treating them as separable benchmarks (Tranzatto et al., 2024).

We propose three initial research applications: inspection and condition assessment in known utility corridors; maintenance and logistics support in managed underground facilities; and supervised reconnaissance of infrastructure condition after an incident. Each needs its own operating domain, hazard analysis and acceptance evidence. The research does not assume that a platform accepted in one setting can be transferred to another without requalification.

11.2 A shared underground operational model

The proposed underground profile links passages, rooms, shafts, access points, assets, services and permitted work areas. Geometric connectivity is distinct from traversability. A passage can exist but be blocked, unsafe, beyond the platform's capability or outside authorised access. Ventilation, power, drainage, communications and support infrastructure should be represented as dependencies with observation age and responsible authority.

A navigation system contributes local geometry and pose estimates. An engineering register contributes asset identity and design information. Environmental sensors contribute current measurements within their calibration and sampling limitations. Lutine would retain their relationships and disagreements. A digital twin could then estimate which inspection or maintenance options remain feasible, while the platform's local controller enforces its physical operating constraints.

The ontology must preserve negative and incomplete knowledge. An unobserved branch is not a clear route. An absence of a detected hazard is not evidence of safety unless the sensor coverage and detection capability support that inference. A map boundary should identify where observation ended and why. These semantics are necessary for both human interpretation and subsequent machine planning.

11.3 Communications and information return

Candidate communication approaches include installed wired systems, local wireless infrastructure, relays and intermittent contact with a gateway. Selection depends on the site and operating authority. We would evaluate achievable coverage, latency, energy and failure correlation rather than assume a mesh will repair every obstruction. Multiple links can share the same power or physical bottleneck.

During isolation, the node should retain the minimum evidence needed for the declared task, prioritise critical observations for the next contact and expose storage limits. A local report should include confidence and coverage, not just a detected object label. On reconnection, the system should transmit map alignment uncertainty and unresolved entity matches along with observations so that the receiving planner does not overinterpret them.

The useful operating horizon is bounded jointly by energy, physical safety, map validity, sensor calibration, evidence freshness and authority. We define the decision horizon as the earliest applicable expiry among those constraints, provided their assumptions remain valid. This does not mean the platform must stop all functions at that instant. It means the affected decision class must be revalidated or replaced by an independently justified fallback.

$H_{decision} = min\{ H_{energy},H_{safety},H_{map},H_{calibration},H_{evidence},H_{authority}\}$ (10)

All horizons in Equation 10 are remaining durations measured from the same decision epoch. A required validity horizon that cannot be established is not treated as infinite. The minimum applies to the stated decision class, not automatically to every function on the platform.

11.4 Worked integration sequence

Consider a supervised inspection in an underground utility facility. A local platform observes an abnormal condition near a pump while its external link is unavailable. The estimator records the observation in a local frame with uncertainty. The semantic layer creates a candidate association to an asset, rather than forcing a match. A maintenance record is available locally but is older than the permitted age for a serviceability decision.

The investigative process compares sensor fault, temporary operating variation and equipment degradation. It may request an additional permitted observation if the platform can obtain it within its operating envelope. The twin evaluates possible service consequences using the uncertain asset association and stale maintenance state as explicit scenario branches. The system can issue a bounded warning and preserve evidence, while withholding a resource commitment that requires current authorisation or serviceability information.

When contact returns, the platform exchanges observations, map constraints and evidence lineage. A corrected transform may resolve the asset identity. A current maintenance record may alter the hypothesis. The system produces a new determination and, if appropriate, a feasible response option for approval. This sequence connects local autonomy to accountable infrastructure decisions without assigning the intelligence layer responsibility for platform safety or inventing missing evidence.

11.5 Research stages

The first stage should use a known, instrumented environment with independent ground truth and limited tasks. The second should introduce controlled observation gaps, degraded communications and changed geometry. The third should evaluate cross-system dependencies and human decision-making under supervised conditions. More demanding environments should be introduced only when the relevant mechanisms and fallback behaviour have been tested.

The principal research outcomes are integrity-aware localisation, correct asset association, useful warning, safe continuation or fallback, evidence recovery and coherent reconciliation. Distance travelled or map area alone is insufficient. A system that explores farther while misidentifying equipment or losing the basis for its reports may be less useful for infrastructure operations.

12 Analytical examples and reproducible results

12.1 Purpose and limits

We use four deliberately small calculations to expose architectural mechanisms. Every input below is stipulated for illustration. The calculations were executed with the accompanying Python reproducer and checked against closed-form arithmetic. They contain no field data, no proprietary performance measurement and no trained model. They demonstrate consequences of assumptions; they do not estimate how frequently those conditions occur in practice.

12.2 Duplicated evidence and overstated belief

Assume a prior probability of disruption of 0.10 and one observation with likelihood ratio 4. Bayes' rule gives posterior odds of 4/9 and a posterior probability of 4/13, approximately 0.308. If the same observation is copied into three systems and those copies are incorrectly treated as conditionally independent, the calculation multiplies the likelihood ratio three times and produces 64/73, approximately 0.877.

The result motivates an operational role for DependenceGroup. It does not show that lineage discovery is solved or that every correlated observation should be discarded. If observations are only partially dependent, a joint model is needed. The calculation also shows why an impressive-looking probability is not evidence of sound inference: the arithmetic can be correct while the independence assumption is false.

12.3 Disconnected rights and utilisation

Assume five available units and two disconnected nodes. Each sees the same snapshot of five units and receives a request for four. If each commits four from the shared snapshot, total commitments reach eight, exceeding supply by three. If rights are allocated as three units to one node and two to the other, the nodes can commit at most five in aggregate, assuming the conditions of Proposition 2.

Now change the requests to four units at A and zero at B. The rights policy serves three and leaves two unused at B during the partition, although one additional unit could satisfy A if safe coordination were possible. This counterexample is essential: the conservation benefit comes with a measurable utilisation cost. We would evaluate both under representative demand and partition patterns.

12.4 Energy and the useful operating horizon

Assume 60 Wh of available energy, a 12 Wh protected reserve and a 12 W essential load. An optional analytical mode drawing 8 W produces a nominal operating horizon of 48/20 = 2.4 hours. A reduced mode drawing 2 W produces 48/14 = 3.428571 hours, an increase of approximately 42.9 per cent under these constant-load assumptions.

The calculation does not establish that the reduced mode provides adequate analytical quality. Battery condition, conversion losses, temperature, peak load and mobility demands are omitted. It shows why a model comparison should report decision quality per energy budget and the survival of essential functions, rather than only tokens or predictions per second. If evidence or authority expires earlier than the energy horizon, the useful decision horizon is shorter still.

12.5 Uncertainty and the value of an observation

Consider an illustrative maintenance decision with two feasible options. Option A has an immediate cost of one loss unit and an additional loss of twenty units if a disruption occurs. Option B costs six units and, by assumption, avoids that additional loss. A is preferred when 1 + 20p is less than 6, giving a crossover probability of 0.25. These loss units are illustrative and are not financial forecasts.

If the current regime has disruption probability 0.05, A's expected loss is two. If it has probability 0.65, A's expected loss is fourteen. Suppose the two regimes are initially equally likely. Without further information, A has expected loss eight and B has expected loss six. A perfect observation of the regime, costing 0.5 units, allows A in the low-risk regime and B in the high-risk regime: expected loss is 0.5 times 2 plus 0.5 times 6 plus 0.5, or 4.5. The net value of the observation relative to B is 1.5 units.

This is an upper benchmark based on perfect regime identification, not a claim about real sensor performance. An imperfect observation, a delayed result or a newly infeasible response would reduce its value. If A lacks authority, information about disruption probability cannot make it admissible. The example connects forecasting, evidence acquisition, twin-based consequence estimates and the separate decision gate.

13 Evaluation programme and acceptance evidence

13.1 Comparative hypotheses

H1 concerns provenance and decision gating: at matched model and resource budgets, the integrated architecture should reduce unsupported consequential proposals relative to a model-centric workflow without unacceptable loss of useful service. H2 concerns evidence dependence: lineage-aware aggregation should improve probability calibration under replicated or shared-origin evidence. H3 concerns planning: explicit uncertainty and dependency constraints should improve tail outcomes under disruption compared with nominal optimisation. H4 concerns exchange: decision-aware evidence prioritisation should improve timely useful information under a fixed communications budget. H5 concerns semantic integration: linking spatial observations to revisable operational identities should improve asset-level decisions without hiding unresolved ambiguity.

These are hypotheses, not conclusions. Each requires an operationally meaningful effect size and a predeclared comparison. Acceptance should not be defined after seeing results. Any non-inferiority margin for service continuity, latency or workload must be agreed with the responsible operator before testing.

13.2 Baselines and ablations

We propose four primary baselines: existing human and rule-based practice; a conventional analytics system using the same inputs; a local AI workflow without the proposed semantic decision boundary; and the integrated architecture. Navigation comparisons should use appropriate established estimators on matched sensors and compute. Planning comparisons should include both nominal and uncertainty-aware methods to avoid attributing a standard optimisation benefit to the ontology.

Ablations should remove one mechanism at a time: evidence dependence handling, timestamp uncertainty, source authority scoping, explicit unknowns, revalidation, twin uncertainty or decision-aware exchange. Model size, source access and compute budget should remain matched where possible. Some ablations deliberately weaken a control and belong only in isolated evaluation. Their purpose is to determine which mechanism causes an observed difference.

13.3 Test design and ground truth

Evaluation should progress through unit and contract checks, historical replay, software-in-the-loop fault experiments, hardware-in-the-loop trials and supervised field exercises. Each level answers a different question. Contract tests can establish rejection of a malformed record; they cannot establish detection of a real infrastructure fault. Simulation can explore interactions; it cannot establish that an omitted physical failure will be handled.

For navigation, EuRoC, TUM-VI, Hilti and relevant SubT datasets can support reproducible comparisons within their scope. Facility-specific trials remain necessary for environmental and operational transfer. Ground truth should be obtained independently where possible, with its own uncertainty documented. External survey or motion reference equipment used for evaluation must not inadvertently become an input available to the operational estimator.

For operational reasoning, use time-separated datasets with explicit source arrival times, revisions, exclusions and outcome definitions. Preserve supplier, facility or incident grouping to prevent leakage between training and test sets. Synthetic cases should be labelled and reported separately from historical and live cases. Where an intervention changes the outcome, simple prediction accuracy is insufficient; use a defensible causal evaluation design or limit the claim to observed decision-process outcomes.

Fault experiments should include compound conditions: delayed observations with clock drift; uncertain localisation with ambiguous asset identity; a network partition with conflicting reservations; model throttling during high sensor load; and reconnection after a correction. Test intensity should be bounded by the operating domain and performed in an isolated environment. The goal is to identify failures and containment behaviour, not to assume that a finite fault list represents every adversary.

13.4 Metrics that expose trade-offs

Navigation metrics should include trajectory and relative pose error, integrity-monitor false alerts and missed alerts, time outside declared bounds, recovery time and failure to associate observations correctly. Average error alone can conceal rare but consequential excursions. Communication metrics should include valid evidence delivered before decision deadlines, stale evidence admitted, bandwidth used and unresolved conflicts after reconciliation.

AI metrics should include task performance, calibration, out-of-distribution behaviour, abstention, unsupported claims, prohibited tool attempts and the extent to which explanations remain grounded in evidence. Planning metrics should include feasible service delivered, unserved demand, constraint violations, tail loss and recovery time. Resource metrics should include sustained power, thermal behaviour, peak memory, latency distribution and essential-function continuity.

Human evaluation should measure comprehension of uncertainty, appropriate reliance, review time, override quality and whether automation changes the distribution of errors. A faster decision is not necessarily a better decision. Reviewers should be able to identify why a proposal was blocked, what evidence is missing and which alternative remains feasible.

13.5 Statistical interpretation

Use paired scenarios or blocked designs where practical, report effect sizes and confidence intervals, and account for clustering by mission, facility or episode. Repeated sensor frames are not independent trials. Report all preregistered outcomes and explain missing data. An adaptive development dataset must not also serve as the final held-out acceptance population.

For illustration, zero observed failures in 300 independent Bernoulli trials gives an exact one-sided 95 per cent upper bound of approximately 0.994 per cent on the failure probability under that trial distribution. It does not prove zero risk, nor does it apply unchanged to correlated runs or novel conditions. A sample-size calculation for acceptance should use the actual safety or service target, expected effect and dependence structure, rather than copying this illustrative number.

13.6 Assurance gates

Gate 1 establishes the decision scope, operating domain, hazards, data rights and measurable success criteria. Gate 2 establishes semantic and software conformance with traceable negative tests. Gate 3 establishes representative component and integration performance. Gate 4 establishes supervised operational value and fallback behaviour. Gate 5 establishes deployment-specific acceptance, monitoring, change control and independent review appropriate to the use.

The evidence package should include manifests, model and schema versions, data lineage, test definitions, failed cases, limitations, operator feedback and reproducibility instructions. A passed reference validator is one item in that package. It is not accreditation, certification or proof of the whole architecture. The NIST AI RMF provides a useful risk-management structure, but alignment with its concepts does not itself certify a system (NIST, 2023).

14 Assurance security and research limitations

14.1 The trusted boundary

The architecture relies on a deliberately limited trusted boundary: identity and key management, policy interpretation, evidence admission, resource enforcement, audit persistence and the relevant physical safety mechanisms. Complexity inside this boundary should be justified. Models and retrieved content outside it may be useful without being authoritative. A model-generated explanation must not become evidence for the assertion it is explaining.

Air-gapped operation reduces some external dependencies but does not eliminate insider risk, supply-chain compromise, removable-media risk, insecure updates or physical access. A signed artefact requires trusted signing procedures and key protection. A hash-linked audit record requires protection against deletion, rollback and forked histories, with independent checkpoints where the assurance claim requires them. Deterministic replay establishes reproducibility of a calculation under pinned conditions, not the truth of its inputs.

Data deletion also needs precise claims. Removing a key or payload from one store does not prove that every copy, backup or derived representation has been erased. Retention policy should distinguish raw evidence, integrity metadata, model-derived information and legal or contractual holds. The system must describe what remains reproducible after authorised deletion and what no longer can be reconstructed.

14.2 Distribution shift and common causes

Our most significant technical uncertainty is performance under coupled shift: a new environment, changed sensor quality, altered operating practice and a different disruption process at the same time. Uncertainty models may fail precisely when needed most. Different models may also share training data or architectural weaknesses, so an ensemble is not automatically independent corroboration.

Common causes extend beyond models. Two suppliers may share a fabrication tool, two network links may share a power source, and two evidence feeds may originate from the same administrative system. Ontological representation can expose known dependencies but cannot guarantee discovery of unknown ones. We therefore propose sensitivity analysis for missing dependencies and explicit disclosure of coverage limits.

14.3 Human and organisational constraints

An architecture can preserve authority records while still producing an unusable review burden. Excessive alerts, opaque uncertainty or fragmented evidence can cause people to ignore the system or accept its outputs mechanically. Human factors must therefore be evaluated as part of the integrated system. Authority arrangements also need to match real organisational responsibility; a schema cannot resolve an unresolved governance dispute.

Cross-domain integration can increase the sensitivity of otherwise ordinary data. Operational patterns, inferred dependencies and combined records may reveal more than any individual source. Data minimisation, scoped access, retention and release decisions belong in the architecture. They should be evaluated against the actual deployment's obligations rather than represented as generic claims of compliance.

14.4 Limits of this study

This study establishes an architectural argument and testable requirements. It does not report a newly trained model, deployed robot, operational digital twin, penetration test, certification assessment or independently reproduced Lutine implementation. The analytical examples verify arithmetic and conditional mechanisms only. Literature results remain attributable to their original experimental settings.

The review is selective, and some frontier work is available as preprints or technical reports. The proposed integration may impose unacceptable computational, organisational or maintenance costs in some settings. Further work must determine where a simpler system performs equally well. A credible negative result would narrow the architecture's application rather than invalidate the value of disciplined evidence and authority boundaries.

15 Research conclusions

We conclude that useful AI in GPS- and network-denied environments requires an explicit account of what remains observable, knowable, permissible and physically feasible. Local inference is a necessary option for some deployments, but it is insufficient as the organising principle of resilience. The system must preserve evidence meaning, respect coordination limits, expose uncertainty and recover from conflicting histories without silently rewriting earlier decisions.

Lutine's developing ontology offers a technically substantive basis for investigating this problem. Its most consequential prospective benefits are property-specific authority, dependence-aware evidence, revisable identity, temporally bounded decisions and a clear separation between hypothesis, approval, intent and outcome. These benefits become operational only when connected to authenticated sources, validated models, enforceable policy and independent evaluation.

Predictive Intelligence and Digital Twins occupy complementary roles within that architecture. The first defines and tests emerging events; the second evaluates consequences and constrained alternatives. Their connection through traceable evidence can make warnings actionable without treating forecasts as facts or simulations as live state. Subterranean environments provide a demanding extension in which the same distinctions become physically observable and experimentally testable.

The next research step is a bounded implementation around one infrastructure decision, a limited set of authorised sources and a representative denial scenario. Comparative evaluation should then establish whether the proposed integration improves decision integrity and useful continuity at an acceptable resource cost. That evidence, rather than the breadth of the architecture or sophistication of its language, should determine the scope of any operational claim.

Appendix A Proposed interface and decision record

The following record groups define a proposed minimum integration contract. They are requirements for the architecture in this study, not a declaration that every field is present in an existing Lutine release.

The receiving service should first authenticate the caller and establish trusted scope, then validate the record structure and referenced objects. It should evaluate temporal and dependency conditions before allowing the record to support a consequential decision. It should retain rejected or quarantined inputs according to the applicable policy without treating them as accepted evidence. These steps require independently tested implementations; a field naming the result is not proof that the step occurred.

Appendix B Reproducibility and calculation definitions

Download the analytical supplement (ZIP): Python reproducer, numerical results, analytical inputs and evidence matrix.

The accompanying supplement contains a standard-library Python script, a machine-readable result file, a CSV of the analytical inputs and an evidence matrix. Running the script regenerates the numerical examples and checks their expected values. No external service, package installation, random seed or confidential input is required.

For the evidence example, posterior odds equal prior odds multiplied by the applied likelihood ratio. The duplicate cases deliberately apply powers of the same ratio to demonstrate an invalid independence assumption. For the resource example, local commitment equals the smaller of local demand and assigned rights; the naive case independently uses the shared stock snapshot. For the energy example, duration equals energy above reserve divided by constant total power. For the decision example, loss is 1 + 20p for A and 6 for B; the observation reveals the stipulated probability regime, not the future event itself.

The zero-failure bound is 1 minus 0.05 raised to the power 1/300. It assumes 300 independent trials drawn from the same Bernoulli process. The numerical outputs are rounded for presentation; the script retains greater precision. None of the illustrative inputs should be used as a deployment threshold without separate justification.

Appendix C Claim and evidence boundaries

References

Dates identify the cited publication or version rather than implying current certification or programme availability. Long author lists use et al. consistently.

Apple (2025) Apple Intelligence Foundation Language Models Tech Report 2025. Technical report, July. Available at: https://machinelearning.apple.com/research/apple-foundation-models-tech-report-2025.

ASML (2026) Annual Report 2025. Published 25 February 2026. Available at: https://www.sec.gov/Archives/edgar/data/937966/000162828026011377/asml-2025xannualxreportx.htm.

Bartock, M. et al. (2023) Foundational PNT Profile: Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services. NISTIR 8323 Revision 1. https://doi.org/10.6028/NIST.IR.8323r1. Available at: https://csrc.nist.gov/pubs/ir/8323/r1/final.

Bertsimas, D. and Sim, M. (2004) 'The price of robustness', Operations Research, 52(1), pp. 35-53. https://doi.org/10.1287/opre.1030.0065.

Birrane, E.J. and McKeever, K. (2022) Bundle Protocol Security (BPSec). RFC 9172. Available at: https://www.rfc-editor.org/rfc/rfc9172.html.

Burleigh, S., Fall, K. and Birrane, E.J. (2022) Bundle Protocol Version 7. RFC 9171. Available at: https://www.rfc-editor.org/rfc/rfc9171.html.

Campos, C., Elvira, R., Gomez Rodriguez, J.J., Montiel, J.M.M. and Tardos, J.D. (2021) 'ORB-SLAM3: An accurate open-source library for visual, visual-inertial, and multimap SLAM', IEEE Transactions on Robotics, 37(6), pp. 1874-1890. https://doi.org/10.1109/TRO.2021.3075644. Author manuscript: https://arxiv.org/abs/2007.11898.

DARPA (2019) 'Generating actionable understanding of real-world phenomena with AI', 4 January. https://www.darpa.mil/news/2019/understanding-real-world-phenomena.

Ebadi, K. et al. (2024) 'Present and future of SLAM in extreme environments: The DARPA SubT Challenge', IEEE Transactions on Robotics, 40, pp. 936-959. https://doi.org/10.1109/TRO.2023.3323938. Author manuscript: https://arxiv.org/abs/2208.01787.

Ensign, D., Friedler, S.A., Neville, S., Scheidegger, C. and Venkatasubramanian, S. (2018) 'Runaway feedback loops in predictive policing', Proceedings of Machine Learning Research, 81, pp. 160-171. Available at: https://proceedings.mlr.press/v81/ensign18a.html.

ESA (2025) PhiSat-2 begins science phase for AI Earth images. 15 July. Available at: https://www.esa.int/Applications/Observing_the_Earth/FutureEO/Phsat-2/Phsat-2_begins_science_phase_for_AI_Earth_images.

Gilbert, S. and Lynch, N. (2002) 'Brewer's conjecture and the feasibility of consistent, available, partition-tolerant web services', ACM SIGACT News, 33(2), pp. 51-59. Author manuscript available at: https://groups.csail.mit.edu/tds/papers/Gilbert/Brewer6.pdf.

Gneiting, T. and Raftery, A.E. (2007) 'Strictly proper scoring rules, prediction, and estimation', Journal of the American Statistical Association, 102(477), pp. 359-378. https://doi.org/10.1198/016214506000001437.

Guo, C., Pleiss, G., Sun, Y. and Weinberger, K.Q. (2017) 'On calibration of modern neural networks', Proceedings of Machine Learning Research, 70, pp. 1321-1330. Available at: https://proceedings.mlr.press/v70/guo17a.html.

Hobbs, K.L., Mote, M.L., Abate, M.C.L., Coogan, S.D. and Feron, E.M. (2023) 'Runtime assurance for safety-critical systems: An introduction to safety filtering approaches for complex control systems', IEEE Control Systems, 43(2), pp. 28-65. https://doi.org/10.1109/MCS.2023.3234380. Author manuscript: https://arxiv.org/abs/2110.03506.

Hughes, N., Chang, Y. and Carlone, L. (2022) 'Hydra: A real-time spatial perception system for 3D scene graph construction and optimization', arXiv:2201.13360. Author manuscript. https://arxiv.org/abs/2201.13360v2.

IARPA (2021) HFC: Hybrid Forecasting Competition. Programme summary, revised 7 May. https://www.iarpa.gov/images/OA-Slicksheets/HFC_SlickSheet_FINAL_05072021_Prepubapproved.pdf.

Ivanov, D. and Dolgui, A. (2021) 'A digital supply chain twin for managing the disruption risks and resilience in the era of Industry 4.0', Production Planning & Control, 32(9), pp. 775-788. https://doi.org/10.1080/09537287.2020.1768450.

Kapteyn, M.G., Pretorius, J.V.R. and Willcox, K.E. (2021) 'A probabilistic graphical model foundation for enabling predictive digital twins at scale', Nature Computational Science, 1, pp. 337-347. https://doi.org/10.1038/s43588-021-00069-0.

Kim, M.J. et al. (2024) 'OpenVLA: An open-source vision-language-action model', arXiv:2406.09246, version 3. Research manuscript. https://arxiv.org/abs/2406.09246v3.

Lebo, T., Sahoo, S. and McGuinness, D. (eds.) (2013) PROV-O: The PROV Ontology. W3C Recommendation, 30 April. https://www.w3.org/TR/2013/REC-prov-o-20130430/.

Lightman, S. et al. (2026) Foundational PNT Profile: Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services. NIST IR 8323 Revision 2, initial public draft, 6 May. Available at: https://csrc.nist.gov/pubs/ir/8323/r2/ipd.

Lim, H., Hughes, N., Yu, X., Xu, R., Chang, Y., Shi, J., Talak, R. and Carlone, L. (2026) 'Hydra++: Real-time hierarchical 3D scene graph construction with object-level shape estimation', arXiv:2607.09455. Preprint, 10 July. https://arxiv.org/abs/2607.09455v1.

McMahan, H.B., Moore, E., Ramage, D., Hampson, S. and Aguera y Arcas, B. (2017) 'Communication-efficient learning of deep networks from decentralized data', Proceedings of Machine Learning Research, 54, pp. 1273-1282. Available at: https://proceedings.mlr.press/v54/mcmahan17a.html.

Modelica Association (2024) Functional Mock-up Interface Specification. Version 3.0.2, 27 November. Available at: https://fmi-standard.org/docs/3.0.2/.

NIST (2023) Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. https://doi.org/10.6028/NIST.AI.100-1.

Ovadia, Y. et al. (2019) 'Can you trust your model's uncertainty? Evaluating predictive uncertainty under dataset shift', Advances in Neural Information Processing Systems, 32. Available at: https://research.google/pubs/can-you-trust-your-models-uncertainty-evaluating-predictive-uncertainty-under-dataset-shift/.

Pearl, J. (2009) 'Causal inference in statistics: An overview', Statistics Surveys, 3, pp. 96-146. https://doi.org/10.1214/09-SS057.

Rockafellar, R.T. and Uryasev, S. (2000) 'Optimization of conditional value-at-risk', Journal of Risk, 2(3), pp. 21-41. https://doi.org/10.21314/JOR.2000.038. Author manuscript: https://sites.math.washington.edu/~rtr/papers/rtr179-CVaR1.pdf.

Shapiro, M., Preguica, N., Baquero, C. and Zawirski, M. (2011) A comprehensive study of Convergent and Commutative Replicated Data Types. INRIA Research Report RR-7506. https://www.lip6.fr/Marc.Shapiro/papers/2011/Comprehensive-CRDTs-RR7506-2011-01.pdf.

Stray, B. et al. (2022) 'Quantum sensing for gravity cartography', Nature, 602, pp. 590-594. https://doi.org/10.1038/s41586-021-04315-3.

Szwarcman, D. et al. (2026) 'Prithvi-EO-2.0: A versatile multitemporal foundation model for Earth observation applications', IEEE Transactions on Geoscience and Remote Sensing, 64, article 4400120. Published online 11 December 2025. https://doi.org/10.1109/TGRS.2025.3642610. Author manuscript: https://arxiv.org/abs/2412.02732.

Tian, Y., Chang, Y., Herrera Arias, F., Nieto-Granda, C., How, J.P. and Carlone, L. (2022) 'Kimera-Multi: Robust, distributed, dense metric-semantic SLAM for multi-robot systems', IEEE Transactions on Robotics, 38(4), pp. 2022-2038. https://doi.org/10.1109/TRO.2021.3137751. Author manuscript: https://arxiv.org/abs/2106.14386.

Tibshirani, R.J., Barber, R.F., Candes, E.J. and Ramdas, A. (2019) 'Conformal prediction under covariate shift', Advances in Neural Information Processing Systems, 32. Available at: https://papers.nips.cc/paper/2019/hash/8fb21ee7a2207526da55a679f0332de2-Abstract.html.

Tranzatto, M. et al. (2024) 'Team CERBERUS wins the DARPA subterranean challenge: Technical overview and lessons learned', Field Robotics, 4, pp. 249-312. https://doi.org/10.55417/fr.2024009. Author manuscript: https://arxiv.org/abs/2207.04914.

Vassilev, A., Oprea, A., Fordyce, A., Anderson, H., Davies, X. and Hamin, M. (2025) Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. NIST AI 100-2e2025. https://doi.org/10.6028/NIST.AI.100-2e2025.

W3C (2012) OWL 2 Web Ontology Language Document Overview. Second edition, W3C Recommendation, 11 December. https://www.w3.org/TR/2012/REC-owl2-overview-20121211/.

W3C (2017) Shapes Constraint Language (SHACL). W3C Recommendation, 20 July. https://www.w3.org/TR/2017/REC-shacl-20170720/.

Xu, W., Cai, Y., He, D., Lin, J. and Zhang, F. (2022) 'FAST-LIO2: Fast direct LiDAR-inertial odometry', IEEE Transactions on Robotics, 38(4), pp. 2053-2073. https://doi.org/10.1109/TRO.2022.3141876. Author manuscript: https://arxiv.org/abs/2107.06829.

Yates, R.D., Sun, Y., Brown, D.R. III, Kaul, S.K., Modiano, E. and Ulukus, S. (2021) 'Age of information: An introduction and survey', IEEE Journal on Selected Areas in Communications, 39(5), pp. 1183-1210. https://doi.org/10.1109/JSAC.2021.3065072. Author manuscript: https://arxiv.org/abs/2007.08564.

Zheng, C. et al. (2025) 'FAST-LIVO2: Fast, direct LiDAR-inertial-visual odometry', IEEE Transactions on Robotics, 41, pp. 326-346. https://doi.org/10.1109/TRO.2024.3502198. Author manuscript: https://arxiv.org/abs/2408.14035.

Zhou, B., Zheng, C., Wang, Z., Zhu, F., Cai, Y. and Zhang, F. (2025) 'FAST-LIVO2 on resource-constrained platforms: LiDAR-inertial-visual odometry with efficient memory and computation', IEEE Robotics and Automation Letters, 10(8), pp. 7931-7938. https://doi.org/10.1109/LRA.2025.3581125. Author manuscript: https://arxiv.org/abs/2501.13876.