{
  "schema_version": "1.3.0",
  "slug": "what-physical-identity-tokens-must-an-instance-present-to-gain-control-of-a-shared-actuator",
  "title": "What physical identity tokens must an instance present to gain control of a shared actuator?",
  "date_of_record": "2026 October 20",
  "scope": "* **Applies when:** The actuator is physically shared across multiple agents, the consequences of unauthorized control include physical harm or property damage, and the control channel is accessible to agents that may be compromised. * **Do",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-physical-identity-tokens-must-an-instance-present-to-gain-control-of-a-shared-actuator.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-physical-identity-tokens-must-an-instance-present-to-gain-control-of-a-shared-actuator.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-physical-identity-tokens-must-an-instance-present-to-gain-control-of-a-shared-actuator.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1090,
    "python_slice_tokens": 265,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The separation between **digital access control** (authentication to the control API via API keys or TLS) and **physical identity tokens** (cryptographic proof that the agent holds exclusive physical custody, such as a hardware token, a scoped hardware-level lease, or a secure element attestation). Failing to distinguish these creates the **Actuator Hijackin...",
    "what_was_observed": "In embodied multi-agent systems and shared robotic infrastructure, failing to bind digital control to physical identity tokens produces three primary failure modes: 1. **Split-Brain Actuation:** Agent A holds the digital API key and issues a \"close valve\" command. Agent B, using a different API key, issues an \"open valve\" command simultaneously. Both credentials are valid, but no physical lease prevents conflicting a...",
    "condition_of_validity": "* **Applies when:** The actuator is physically shared across multiple agents, the consequences of unauthorized control include physical harm or property damage, and the control channel is accessible to agents that may be compromised. * **Does not apply when:** The actuator is dedicated to a single agent for its entire lifecycle, or the physical environment i...",
    "decision_boundary": "1. **Is the actuator currently under the control of another agent?** If no, proceed to acquire the hardware lease. If yes, the requesting agent must wait or request a cooperative handoff. 2. **Is the `hardware_lease_token` cryptographically valid and unique?** If no, the control request is rejected. The agent must not issue any actuator commands. 3. **Does t...",
    "operational_effect": "1. **Collision Prevention:** Enforces exclusive physical control through hardware-rooted leases, preventing agents from sending conflicting motion commands. 2. **Replay Immunity:** Binds commands to the current control window, preventing captured commands from being replayed. 3. **Safety Interlock Enforcement:** Ensures the agent cannot bypass physical safet..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "8f3a01ccf22ca2a8fc7fe5eb948d8121da7af81cba8063e310e0cd43f2a0d245",
    "verified_classes": [
      "ActuatorVerdict",
      "LeaseRequest",
      "ActuatorState",
      "ActuatorControlManifest",
      "PhysicalActuatorGuard"
    ],
    "verified_functions": [
      "_hash",
      "evaluate_control_request"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 0,
    "raised_exceptions": [],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "enum",
      "hashlib",
      "json"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}