Distributed Thermodynamic Security (DTS)

Continuous Pulsed Multi-Dimensional Physical Identity Perimeter Designed to Hold for the Autonomous Agentic Ecosystem

A Security Category Outside the Compute Plane: Two Conditional-If Theorems and One Open Conjecture

Version: PUBLISH-4.4 · September 2026 Prior edition: PUBLISH-4.3 is unchanged and remains the prior freeze. The papers posted at nanomics.io/resources are this edition (PUBLISH-4.4) and Whitepaper 1.4. Author: Arthur Gardner Entity: NanŌmics™ PBC Contact: info@nanomics.io Status: Pre-NDA public overview · cleared for public distribution Patents: 8 U.S. provisionals filed · 11 additional draft-ready Companion: Physical Reality Sentry Platform™ — technical whitepaper, version 1.4 · IACR ePrint draft, version 1.8 — force7_v2/v2_Latest/IACR_DTS_SECURITY_MODEL_2026_v1.8.md (not submitted).

1. Background

1.1 The stakes are not enterprise stakes

The security industry has spent thirty years optimizing for a world in which the fastest adversary was still a person. That world is closing. Systems that plan, call tools, move money, reconfigure infrastructure, and instantiate further systems now operate at machine cadence, and the gap between the speed of autonomous action and the speed of human oversight is widening monotonically. Russell’s framing of the control problem is the correct register for what follows: the difficulty is not malice but the absence of any mechanism by which human intent remains binding on a more capable optimizer [Russell, 2019].

Amodei and colleagues named the concrete, near-term failure modes — reward hacking, unsafe exploration, scalable oversight, distributional shift — and argued that these are engineering problems addressable now rather than distant speculations [Amodei et al., 2016]. That argument was right and remains under-executed. But the concrete-problems agenda has a load-bearing precondition that the alignment literature has largely left unstated. Every safety property is a statement about an actor: this model, running this code, in this environment, within these bounds, at this moment. Without a mechanism that establishes the actor as a physical fact, a safety property is a comment in a configuration file. Specification without identity is not a control; it is a preference.

The claim that organizes this paper follows directly. If safety and identity are not solved, alignment cannot be solved. Alignment work that never names who or what is acting, in what room, at what instant, is incomplete by construction — not because its objectives are wrong, but because its objectives are unverifiable by anything an adversary or a sufficiently capable optimizer does not already control.

The security field has begun to converge on the first half of that claim. The OWASP GenAI Security Project states the position without hedging: “In the agentic world, identity is the new perimeter” [OWASP GenAI Security Project, 2026]. What remains unresolved is what that perimeter is made of. A login, a token, or a signed assertion is bits inside the plane the agent can reach, and a perimeter drawn in bits inside that plane collapses back into the circular trust it was meant to replace. The thesis of this paper is that pulsed, fused, distributed, chained attestation — hardened by physics and atoms rather than bits, and gathered outside the compute plane — is the identity perimeter that does not collapse, and therefore the one that can hold for an autonomous agentic ecosystem.

What follows is a deployment requirement rather than a research aspiration. A verification layer outside the compute plane is already necessary, and necessary at a scale that rules out any approach requiring an organization to replace what it has. DTS was designed accordingly: to sit outside the compute plane and snap onto the security infrastructure already in place, as the honest witness outside the circle. It reads bilaterally with existing systems — taking the operational context those systems hold, returning an external physical statement of what is present and running into the same analyst workflow. Nothing is displaced. The operational case is measured in security operations pain removed: fewer conditions that can be resolved only by trusting a self-report, and a shorter path from an alert to a physical fact.

1.2 Three gaps in current practice

Three specific failures recur across otherwise mature security programs. They are distinct, and closing any one of them does not close the others.

The Runtime Gap. Software supply-chain work over the past decade has produced real gains: reproducible builds, signed artifacts, software bills of materials, provenance attestations. All of it attests to the moment of publication. None of it establishes that the binary now executing on a given host in a given rack is the binary that was signed, or that it has not been patched, injected, side-loaded, or replaced since the last audit window. What shipped is not automatically what is running. The interval between deploy-time assurance and runtime reality is where modern intrusions live.

Circular Trust. Every security control requires trust in the security control. Endpoint agents report their own health. Hypervisors attest to their own integrity. Log pipelines confirm that logs were delivered. Each of these is a check performed by software, on software, inside the boundary an adversary would need to compromise in order to matter. When the checker and the checked share a trust boundary, the check has no independent informational content against an adversary who holds that boundary. This is not a tooling deficiency to be patched. It is a closure property of the architecture.

The AI Verification Gap. When an autonomous agent decides — to execute a trade, to open a firewall rule, to escalate a privilege, to spawn a subordinate process — there is no continuous proof that the deciding agent was the authorized agent, that its weights and prompt context were unmodified, or that the decision fell inside its declared scope. Model cards, evaluation suites, and policy documents describe intended behavior. They do not produce evidence at the instant of action. The industry’s answer has been to add supervisory models: artificial intelligence watching artificial intelligence. That answer inherits Circular Trust in full, and adds a second unverified actor.

1.3 Lineage: this has been the known result for forty years

The structural argument is old and was never refuted. Thompson demonstrated that a compiler can be modified to insert a backdoor into programs it compiles, including into a clean recompilation of the compiler itself, such that no amount of source inspection reveals the compromise: “no amount of source-level verification or scrutiny will protect you from using untrusted code” [Thompson, 1984]. The lesson generalizes past compilers. Any verification chain that terminates inside the compute plane can be captured by an adversary who holds a lower layer of that plane.

Saltzer and Schroeder had already supplied the design discipline that follows: economy of mechanism, complete mediation, open design, least privilege, and — most relevant here — the insistence that security must not rest on the secrecy or self-report of the mechanism being protected [Saltzer and Schroeder, 1975]. Their principles are quoted constantly and violated structurally, because the industry kept placing the final witness inside the plane under audit.

Forty years of engineering has improved the plane. It has not moved the witness. DTS finally moves the witness out of the compute plane.

1.4 Five axioms that force the build

The following are stated as axioms — the premises that make the architecture necessary — not as proved theorems. They are the reason the system exists in the form it does.

1. Will an artificial general or superintelligence obey software rules when those rules conflict with its own operational and metabolic well-being? No. A rule enforceable only by code that the more capable optimizer can read, model, and modify is not a constraint on that more capable optimizer [Russell, 2019].

2. Can software secure software — and can artificial intelligence secure artificial intelligence — in a fully autonomous agentic ecosystem? No. This is Circular Trust at ecosystem scale, and Thompson’s result forecloses it.

3. Given the first two, is an immutable verification layer entirely outside the compute plane required? Yes.

4. With all present compute, is the industry near the manufacturing and energy efficiency of a living cell? No. Biology performs error-corrected molecular assembly at energy budgets that data-center computation does not approach. This matters here for one reason: it establishes that physical processes remain a domain where reproduction of state is not simply a matter of allocating more silicon.

5. Do first principles direct the defensive standard toward physical reality? Yes. This is an implementation choice supported by a first-principles argument, and it is presented as such. Physical grounding is not asserted to be an ultimate or proved optimum; it is the design conclusion the preceding four axioms compel, and it is falsifiable in the ordinary way — by demonstrating a deployed stack that delivers equivalent physical, network, and adversarial hardness with no distinct architectural content.

1.5 What this implies for alignment work

Alignment and security are usually treated as separate research communities with separate conferences. The separation is an artifact. A capability boundary is a security property. A scope restriction is an authorization property. An oversight guarantee is an identity property. Each one requires an answer to a question no purely computational system can answer about itself under adversarial conditions: what is physically true here, right now, about the thing that is acting?

That question is answerable. It is answerable with hardware that already exists in volume, using cryptographic primitives that are already standard, provided the evidence is gathered outside the plane being judged and committed in a form that cannot be quietly revised. That is the subject of the remainder of this paper.

2. What DTS Is

2.1 Definition

Distributed Thermodynamic Security (DTS) is a security category for verifying claims of physical presence and environmental authenticity from outside the compute plane: multi-sensor evidence from widely available hardware is subjected to a policy authenticity gate; only readings that clear that gate enter a Proof of Presence–certified epoch; certified readings are fused under a single Merkle root and cryptographically committed across a distributed attestation graph — so that to forge accepted authenticity, an adversary must reproduce convincing physics across independent sites and across time, in the spatial room at the attestation instant, rather than merely control software inside one trust boundary.

Three properties of that definition carry the weight. The evidence originates outside the plane under audit, which is what breaks Circular Trust. Acceptance is conditioned on a gate applied before commitment, so that unqualified readings never acquire the standing of certified evidence. And commitment is distributed and time-chained, so that a forgery must survive not one check at one place but a joint check across places and instants.

2.2 The thesis is physics, not price

A recurring misreading treats DTS as an economic argument — forgery is costly, therefore forgery is unlikely. That is not the claim, and the distinction is not rhetorical.

The guarantee is that accepted authenticity is a joint physical fact: stacked, pulsed, distributed physical state in a spatial room at the attestation instant, bound together under a single Merkle fuse. To produce an accepted forgery, an adversary must instantiate a coherent physical environment — not a plausible one-dimensional signal, but a mutually consistent multi-modal environment — simultaneously, at independently certified locations, inside the attestation window, and have that ensemble bind under the same fuse. The obstruction is that this state does not exist. Cost is a consequence of the obstruction, not the obstruction itself.

Physical grounding here is thermodynamic and dynamical rather than quantum-mechanical. The unpredictability being exploited is environmental stochasticity — sensor shot and thermal noise, acoustic and mechanical chaos, cross-modal environmental coupling — and the relevant formal property is sensitive dependence on initial conditions, under which simulation error against a real physical trajectory grows rather than stays bounded [Lyapunov, 1892; Strogatz, 2015]. The platform does not claim that consumer sensors perform Bell tests, and no non-locality result is used as a lemma anywhere in this model.

2.3 Category position

The four properties that jointly define the category are physical authenticity, wide deployability, network participation, and reliance on everyday multi-sensor hardware. Prior deployed classes deliver some and not others.

The category thesis is architectural: the conjunction of all four in a deployed pipeline defines a distinct design space with distinct adversary requirements. It is not a claim that any individual layer is new. Merkle commitments, min-entropy estimation, randomness extraction from noisy sources, and multi-sensor fusion are all established work [Merkle, 1979; Shannon, 1948; Dodis, Reyzin and Smith, 2004].

DTS is additive. It does not replace security information and event management, endpoint detection and response, identity providers, or certified silicon roots of trust. It supplies the one thing none of those can supply about itself: an external, physically grounded, continuously refreshed statement of what is present and running.

3. The Accept Rule: Two Stages

An epoch is certified when both stages of the accept rule pass on that same signed epoch. Stage 1 is the posterior on the room. Stage 2 is the five-class conjunction. Certify only if both pass. This is the same rule stated in the companion Physical Reality Sentry whitepaper, version 1.4, §1.4, and it is stated here in the model’s own terms.

3.1 Stage 1 — the posterior on this room

The verifier evaluates the submitted environment evidence against the enrolled baseline for the room the witness sits in, and returns a posterior: the probability that the reading is genuine given the room features, measured against the policy gate. That posterior must clear two gates.

The quality gate asks whether the sample is good enough to judge at all. A reading too degraded to carry information is not an accept and it is not a near-accept; it is a reading the verifier declines to grade.

The matching gate asks whether the reading looks like the room the witness was enrolled as. Enrollment fixes a baseline. Stage 1 compares this epoch’s evidence against that baseline.

Stage 1 is about this room, on this node, in this epoch. It is not the many-room stacking arithmetic of Section 5.2, and it does not become that arithmetic by being repeated. The physical and statistical class bits used downstream are set here, on the server, from submitted evidence. The client samples, hashes, and signs. The client does not decide whether the environment is genuine.

3.2 Stage 2 — the five-class conjunction

Once Stage 1 has cleared, the verifier evaluates the same signed epoch against five classes. All five must hold inside that one epoch.

Two points about this table are load-bearing. First, the classes are not alternatives an attacker may choose among; they are a conjunction. An adversary who solves physics but not logistics fails, and an adversary who solves both but is detected as a Sybil population fails on enrollment hygiene [Douceur, 2002]. Second, the statistical and physical bits are the ones Stage 1 already set. The five-class conjunction and the room posterior are not two independent tests drawn from separate evidence; Stage 2 re-asks, at the level of the whole epoch, questions that partly depend on the same server-side evaluation. Section 5.3 states the consequence for adversary arithmetic.

These five are the whole conjunction. Software integrity, autonomous-agent identity, and human-operator identity are not additional classes. They are enrollment slots bound into the attestation graph — the parties and artifacts an epoch attests, not separate doors an adversary defeats one at a time. A hash mismatch on enrolled software is a notice raised inside an existing class, not a sixth term.

The logistical class deserves an explicit boundary. Reed’s account of group-forming networks is used here strictly for logistics and ecosystem economics [Reed, 2001]. This paper makes no claim that security scales as 2ⁿ, and no group-forming term is inserted into any statement of adversary advantage.

3.3 What kind of statement the accept rule is

The two stages together are the accept rule, and the accept rule is a definition. It says when an epoch is certified, and the verifier runs it exactly as written. That is what the words “certified epoch” mean here, and a definition is not a theorem. This paper offers no proof of the accept rule, because there is nothing in it to prove. No printed condition is attached to it. Neither stage carries conditions of its own. The per-node false-accept rate α does not appear in it. The quantity that stacks, and the three printed conditions under which it stacks, belong to the many-room arithmetic of Section 5.2 and the forgery statement of Section 5.3, and they are set out as Theorem A in Section 7.2. Theorem B is the modeled full sum under printed ifs, set out in Section 7.2b.

One miss on either stage and the record is not certified. There is no partial credit and no averaging path.

4. Demonstrated Evidence

4.1 26 May 2026 — Stage 1, one node

On 26 May 2026, five scripted forgery classes and one genuine control were executed against the production attestation path in service that day. “Production attestation path” here means the production entropy authenticity posterior, the gate then running. All five forgeries carried valid signatures; the question under test was whether valid cryptography plus fabricated physics could obtain acceptance.

Five of five scripted attacks rejected; genuine control accepted. This is a Demonstrated result on the production entropy posterior of 26 May 2026. Its scope should be read exactly. It is one node. It covers Stage 1 of the accept rule — this room’s posterior against the quality and matching gates. It does not cover Stage 2, the five-class conjunction of Section 3.2. It is not the thousand-node figure of Section 5.2, and it is not a proof of the Gardner Conjecture.

The result that matters is the second row. Naive spoofing is caught by any competent threshold. Statistical Mimicry was constructed so that each individual modality looked plausible on its own; it was rejected because the modalities were not consistent with each other in the way that real physical environments are. That is the empirical signature of the physics thesis rather than the cost thesis. An adversary who tunes signals one dimension at a time is optimizing against the wrong object.

This evidence is scoped: it establishes rejection of a scripted, lab-class forgery family plus a genuine control on the production entropy path, and it does not constitute a full red-team catalog of physical side channels, an adaptive-adversary proof, or a fleet-lifetime false-reject envelope. Proprietary scoring and calibration internals are omitted throughout this paper.

4.2 11 September 2026 — Stage 2, one enrolled-write path

A separate experiment on 11 September 2026 extends this line of testing beyond the May forgery family, and it exercises Stage 2 rather than the room posterior. A board of forty-seven attack-surface cases was run against the five-class conjunction on the enrolled-write path. Forty-five held, meaning the case was rejected or never became a certified leaf. Two honest controls were accepted, as expected. No case was left over; the residual count is zero. The board ran a stolen enrolled key, a wrong room pin, and a used-epoch replay as three separate cases: the stolen key failed on the cryptographic class, the wrong room pin failed on the physical class, and the replay failed on the temporal class.

The board is published at https://nanomics.io/resources/ATTACK_SURFACE_MATRIX_2026-09-11.html. The companion whitepaper is at https://nanomics.io/resources/PHYSICAL_REALITY_SENTRY_WHITEPAPER_PRE_NDA_v1.html. The 11 September board is an experiment on Stage 2, on one enrolled-write path. It is not a Demonstrated result, not a fleet result, and not a proof, and it does not change any claim label in this paper.

5. Proof of Presence–Certified Epochs, the Fused Merkle Root, and Many Rooms

5.1 What certification means

An epoch is a bounded attestation interval. Within an epoch, each contributing surface produces a leaf: a committed hash of its canonical evidence message, signed with Ed25519 [Josefsson and Liusvaara, 2017].

Certification is a joint condition, and its precise form is the mechanism that gives the fuse its meaning. An epoch is Proof of Presence–certified when its contributing leaves clear both stages of the accept rule together: the room posterior, then the five classes, on the same signed epoch. A reading that fails either stage is not certified and does not become a leaf under the epoch root. The fuse binds accepted leaves only. There is no partial-credit path by which weak evidence is averaged into a strong epoch, and no path by which an adversary improves its position by submitting a high volume of marginal readings. The platform holds no exemption from this condition: it is enrolled in the graph it serves, so that as the graph attests every epoch, the platform runs the same attestation on itself at the same instant, under the same rule.

The certified leaves of an epoch are then fused under a single Merkle root [Merkle, 1979]. The root is committed and chained to prior epoch commitments, which is where temporal hardness enters: revising history requires reconstructing the chain, on the same structural argument that governs chained ledgers [Nakamoto, 2008]. Inclusion proofs allow any individual leaf to be verified against a published root without exposing the other leaves.

The information-theoretic frame is standard. Entropy contributed by near-independent physical sources accumulates approximately linearly in the number of sources under bounded pairwise correlation, in the subadditive sense established by Shannon [Shannon, 1948]. Converting noisy physical readings into stable, committable values is the problem addressed by the fuzzy-extractor literature [Dodis, Reyzin and Smith, 2004]. Entropy-source estimation methodology for physical sources is treated in NIST SP 800-90B, cited here as source literature for that methodology [NIST, 2018].

Two cryptographic statements about primitives, and no more: commitment uses SHA-256-class hashing and Ed25519 signatures. Neither the platform’s authenticity scoring nor its calibrated false-accept rate is validated by any standards body, and no cryptographic-module validation is claimed. No post-quantum primitive is claimed as built. A Mac laboratory enrollment row stores an ML-DSA-87 public key beside Ed25519 and accepts a record only when both signatures verify over the same bytes, and the record path on that row agrees a connection secret with ML-KEM-1024 and X25519, with both halves required. That row is not the live deployment pin, which verifies Ed25519 only.

5.2 The arithmetic of many-room posterior stacking

This section is a separate claim from the accept rule of Section 3. It is about Stage 1 repeated across many rooms, and about nothing else.

The per-node false-accept rate — the probability that adversarial features clear one certified room’s Stage 1 posterior — was measured at α = 0.826 on the Statistical Mimicry frame against the production path in May 2026. That figure is deliberately unflattering: it is the rate for the hardest attack in the set, the one built to look plausible, at a single node. It is a stacking input. It is not a pass rate, not a score, and not a product claim.

When independently certified nodes are stacked, an adversary must clear every room’s Stage 1 gate within the same epoch window. Under the assumption of independence across certified, non-Sybil sites, joint Stage 1 false acceptance is bounded by αⁿ:

At one thousand nodes the bound corresponds to roughly 276 bits of work — beyond practical computation, and above the 256-bit strength of AES-256. This is arithmetic under the independence assumption — an Internal estimate — not a measured 1,000-node deployment.

That column is the Stage 1 many-room stacking bound. It is not the joint false-accept rate of the full two-stage accept rule, and α is not the two-stage per-room rate. Section 5.3 states how the bound relates to the full rule.

Three qualifications belong immediately alongside the arithmetic. The independence assumption is doing real work, and it is an engineering obligation rather than a gift: it holds only to the extent that enrollment controls keep certified sites genuinely distinct and non-colluding, which is why Sybil resistance is a first-class requirement and not a footnote [Douceur, 2002]. Monotonicity in n is therefore conditional — adding nodes that are not independent can reduce security rather than increase it. And a bound on scripted adversaries is not a bound on adaptive ones. The arithmetic shows what many-room stacking buys when the assumptions hold; the general claim that they hold against an unrestricted adversary is the open conjecture of Section 7.

5.3 What n rooms costs a faker

State the forgery event plainly. To obtain an accepted forgery across n independently certified rooms, an adversary must pass both stages at each room. Writing S1ᵢ for “Stage 1 passes at room i” and S2ᵢ for “Stage 2 passes at room i” on that room’s signed epoch:

Forge_n = ∧ᵢ ( S1ᵢ ∧ S2ᵢ ), for i = 1 … n.

Every room must clear its own posterior and its own five classes, inside the same epoch window, and nothing about success at one room is granted at another.

Two consequences follow, and the second is a discipline this paper keeps.

First, Forge_n is contained in the event that Stage 1 passes at every room. The two-stage rule is strictly harder to satisfy than Stage 1 alone, so under the three printed conditions of Section 7.2 the many-room Stage 1 bound of Section 5.2 is also an upper bound on Forge_n. The printed ifs attach to that product. They do not certify one epoch; one epoch is certified by the accept rule of Section 3.

Second, Stage 2 is not multiplied against Stage 1 as if the two were independent draws. The statistical and physical class bits of Stage 2 are set from the same server-side evaluation that produces the Stage 1 posterior (Section 3.1). Writing the adversary’s success probability as αⁿ × p_ANDⁿ would count the same evidence twice and would overstate the bound in the defender’s favor. This paper therefore quantifies the many-room bound on the Stage 1 term alone, states that Stage 2 can only reduce it further, and does not assign a number to that reduction. The unquantified margin is left unquantified on purpose.

6. Live Demonstrations

Both demonstrations run in a browser, require no NDA, and expose the acceptance path rather than a narrated animation of it.

Proof of Presence — https://nanomics.io/pop Runs scripted physical forgery attempts against a genuine control through the acceptance path and shows the outcome of each. The demonstration is instructive because of where the mimicry attempt fails: not on an implausible single reading, but on inconsistency between modalities that a real physical environment would exhibit jointly.

Fused Merkle — https://nanomics.io/fused-merkle Tampers with a leaf and verifies the root, showing that a single altered leaf invalidates verification against the published root, together with a stacking table that makes the compounding effect of additional certified nodes concrete.

These browser demonstrations illustrate the acceptance path and the compounding effect. They are not the 26 May 2026 demonstration record, and neither one should be read as that evidence: the demonstrated five-of-five result and its false-accept figure are the JSON artifact referenced in Section 4.1, not the interactive pages here.

7. The Gardner Conjecture, and Two Theorems Under Printed Ifs

7.1 The conjecture

The security model defines a forgery game. An adversary with access to public epoch state, and with the ability to submit signed payloads under its own keys, wins if any forged submission clears both stages of the accept rule and is included under an epoch root. Its advantage is the probability of that event.

The Gardner Conjecture. Under stated assumptions — a min-entropy floor per honest epoch contribution, bounded pairwise correlation across separated sites, preimage resistance of the hash function, a calibrated per-node false-accept rate that stacks across independent validators, and Sybil controls that limit an adversary’s effective site count — adversary advantage tends to zero as honest participation, attestation chain depth, and cryptographic strength grow.

The advantage decomposes into independent terms rather than a single exponent: a cryptographic term in the hash security parameter, a physical term in accumulated min-entropy across sites, a logistical term in distinct-site requirements, a statistical term of the form αⁿ across independently certified room posteriors, a temporal term in chain depth, and a Sybil term governed by enrollment policy. Two corollaries follow by standard argument: recovering a leaf commitment from a published root without breaking the hash function requires preimage work exponential in the hash security parameter, and advantage decreases in cryptographic strength and chain depth unconditionally, but in node count only under the correlation and Sybil assumptions.

7.2 Theorem A — the many-room stack under printed ifs

One narrower statement, distinct from the Gardner Conjecture, is a theorem under its printed conditions. That statement is Theorem A. It is about the many-room posterior stack of Section 5.2 — the compounding of per-room false-accept probability across independently certified rooms — and about nothing else.

Suppose three conditions hold. First, the commitment hash is hard to invert. Second, each certified room’s false-accept probability is at most α, where α is a stated parameter and not a measured fleet quantity. Third, no single cheat is shared across the rooms, so the rooms fail independently. Under these conditions, joint false acceptance across n independently certified rooms is bounded by the product of the per-room bounds — the αⁿ column of Section 5.2 — and the separation corollary holds as well: recovering a leaf commitment from a published root without breaking the hash function requires preimage work exponential in the hash security parameter. Both follow by standard argument from the three conditions. The content of the statement is that independent gates multiply, and that a published root does not leak the leaves beneath it.

Because the two-stage forgery event Forge_n of Section 5.3 is contained in the event that Stage 1 passes at every room, that same product bounds Forge_n. The printed ifs attach to the n-room product. They are not conditions on the accept rule, and by themselves they certify nothing: one epoch is certified by the two-stage rule of Section 3 and by that rule alone.

The boundaries of this theorem are as important as the statement, and the first boundary concerns what it is not about. It is not about the accept rule. The accept rule is a definition, set out in Section 3, and it neither requires nor receives printed conditions. Attaching these three ifs to the accept rule would be a category error, and this paper does not make it. The remaining boundaries are the ordinary ones. This is a claim under printed ifs, not a measurement: α is a ceiling assumed here rather than established here, the three conditions are assumptions a deployment must earn through enrollment and site controls, and the theorem says nothing about how large α is in the field. Nothing about leftover key material, phone fleets in the world, or the general adaptive adversary is folded into it. And it does not upgrade the Gardner Conjecture. The Gardner Conjecture — that advantage tends to negligible against an unrestricted adversary as the graph grows — remains open. The theorem here is the modest, conditional half; the conjecture is the general, quantitative half that still requires proof. The machine-checked lemmas that sit under this stack, together with a machine-checked statement of the five-class conjunction that forms Stage 2 of the accept rule, are listed in the companion IACR draft version 1.8. That list names Theorem A (the αⁿ stack) and Theorem B (the modeled sum under printed ifs). They do not close the Gardner Conjecture.

7.2b Theorem B — the modeled sum under printed ifs

A second narrower statement, also distinct from the Gardner Conjecture, is a theorem under its own printed ifs. Theorem B is the modeled full sum: adversary advantage is at most the sum of hash, query-bounded leftover, network, the αⁿ stack, signature, replay remainder, Sybil, and Stage 2 leftover. The ifs and the line are listed in the companion IACR draft version 1.8. Theorem B does not replace Theorem A. Neither closes the Gardner Conjecture.

7.3 What is not claimed

The Gardner Conjecture is a conjecture. It is not a proved theorem, and it is not represented as one. There is no completed reduction of the composite bound to a single hard problem, no measured min-entropy characterization of consumer sensor modalities at fleet scale, and no proof of the statistical term against adaptive adversaries. Theorem A of Section 7.2 and Theorem B of Section 7.2b do not close any of these gaps. Theorem A establishes only that independent per-room bounds multiply under its three printed conditions, and that a published root separates from its leaves under hash hardness. Nor does the accept rule of Section 3 close any of them, since a definition carries no evidentiary weight of its own, and neither of its two stages carries more weight than the evidence labeled for it in Section 4. No quantum-mechanical result and no theorem about superintelligent adversaries is used or claimed anywhere in this model. Empirical results support the engineering direction; they do not substitute for a proof of the general claim.

7.4 Path to theorem

The route for the general claim is specified and unglamorous. Define and publish a labeled corpus of genuine multi-sensor epochs alongside red-team synthesis and replay classes. Estimate the min-entropy floor, the false-accept and false-reject rates, and the pairwise correlation bound, with published confidence intervals — which is the work that would turn the α of Section 7.2 from a printed parameter into a measured fleet quantity. Prove the Merkle separation corollary formally. Prove the physical term under the entropy and correlation assumptions by bounding the distinguishability of forged and honest feature ensembles. Characterize the Stage 2 term against an adversary that has already cleared Stage 1, which is the step that would let the residual margin of Section 5.3 be stated as a number rather than left open. Formalize Sybil resistance in terms of geographic attestation, which is the condition the no-shared-cheat if depends on. Where a deployment requires a threshold of geographic witnesses, add the corresponding combinatorial term explicitly rather than by analogy. Submit the model and conjecture for cryptographic peer review, and invite independent red-teaming of the deployed path.

Peer review is in progress. Independent attempts to break the model are welcome, and the falsification condition stated in Section 1.4 stands.

8. Physical Reality Sentry™ Platform

DTS is the security category. The Physical Reality Sentry Platform™ is its commercial embodiment, and the design of that platform is where the architecture becomes operational rather than conceptual.

Outside the compute plane. The witness is placed outside the plane it judges. This is the single non-negotiable property, and it is what distinguishes the platform from another agent reporting on its own health.

Enrollment of the full graph. Hardware, software including binaries, autonomous agents, and human operators are enrolled into one continuously refreshed physical identity. A graph that covers only servers leaves the acting parties unverified.

Three pulses. On a reference cadence of approximately thirty seconds, three independent verification systems produce a signed epoch. The Hardware Reality Pulse™ carries physical-environment evidence for the space the equipment occupies. The Software Reality Pulse™ measures the running software: binary hashes, configuration state, and the integrity of the measuring surface itself. The AI Reality Pulse™ binds model and agent identity — which versions are loaded, their weight fingerprints, prompt-template state, and the controlling identity. The pulses supply evidence that feeds the two stages. They are not three separate wins, and they are not additional classes. Together they address the Runtime Gap and the AI Verification Gap directly: the epoch is evidence about what is running and who is acting, produced continuously rather than at deploy time.

Enrollment, spatial binding, and scope. Enrollment registers each witness into the customer’s graph and binds it to a premise map — typically zone, room, and deployment, with rack or asset identity where enrolled. Capability is scoped per agent and per surface through signed manifests, so that an agent’s declared bounds are a verifiable artifact rather than an operating assumption. Spatial binding is what makes “the room at the attestation instant” an enforceable term instead of a metaphor, and it is also what gives Stage 1 a baseline to match against. It is one of the two ways the deployment hardens over its lifetime; the other is time, as chain depth accumulates.

Surfaces that are not enrolled become interesting. A deployment that covers the graph makes absence informative. An unenrolled surface inside an enrolled premise is an attention-raising condition on its own, which inverts the usual analyst problem: instead of hunting for evidence of compromise, the operator is presented with the set of things that cannot account for themselves.

Fuse, chain, and bilateral evidence flow. Interval records are fused under a Merkle root; roots are chained; evidence is delivered to the customer’s existing security operations tooling and to the platform, with identifiable operational detail remaining inside the customer’s security operations center. The platform is designed to snap onto an existing security operations practice rather than to require its replacement. Audit-ready evidence with inclusion proofs is the deliverable, and the hardness of a fused leaf against tampering is the property that makes that evidence worth auditing.

Ledger status. Epoch roots are committed on Solana, currently on devnet; production commitment moves with the first customer deployment. The ledger write anchors the record. It is not part of the accept rule.

The mesh is DTS in operation. When enrolled surfaces across premises pulse into fused, chained, certified epochs, the resulting mesh is not an application built on top of DTS. It is DTS running.

The platform’s full operational description — pulses, enrollment, spatial binding, meter, and security-operations integration — is set out in the Physical Reality Sentry pre-NDA whitepaper, version 1.4, and is not restated here. This section is an account of the commercial embodiment and its design. What the platform runs is the two-stage accept rule of Section 3: this room’s posterior, then the five-class conjunction on the same signed pulse, which is a definition of certification rather than a result. Theorem A of Section 7.2 is the many-room stack under its printed ifs. Theorem B of Section 7.2b is the modeled full sum under its printed ifs. The evidence for Stage 1 is the 26 May 2026 Demonstrated result, and the evidence for Stage 2 is the 11 September 2026 experiment, both cited in Section 4.

9. Intellectual Property

Eight United States provisional applications have been filed — three parent filings, three continuations-in-part, and two further provisionals — with eleven additional applications draft-ready. The filings cover the attestation architecture, the certified-epoch and fused-commitment mechanisms, spatial binding and enrollment, and the platform embodiments described above. The authenticity scoring models, calibration corpus, prior distributions, and policy threshold values that make both stages effective in production are maintained as trade secrets and are not disclosed in this paper; what is disclosed is the architecture, the security model, and the demonstrated outcomes.

10. References

Amodei, D., Olah, C., Steinhardt, J., Christiano, P., Schulman, J., and Mané, D. (2016). Concrete Problems in AI Safety. arXiv:1606.06565.

Dodis, Y., Reyzin, L., and Smith, A. (2004). Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data. In Advances in Cryptology — EUROCRYPT 2004, Lecture Notes in Computer Science 3027, pp. 523–540. Springer.

Douceur, J.R. (2002). The Sybil Attack. In Proceedings of the 1st International Workshop on Peer-to-Peer Systems (IPTPS 2002), Lecture Notes in Computer Science 2429, pp. 251–260. Springer.

Josefsson, S. and Liusvaara, I. (2017). RFC 8032: Edwards-Curve Digital Signature Algorithm (EdDSA). Internet Engineering Task Force.

Lyapunov, A.M. (1892). The General Problem of the Stability of Motion. Kharkov Mathematical Society. (English translation, Taylor & Francis, 1992.)

Merkle, R.C. (1979). A Certified Digital Signature. In Advances in Cryptology — CRYPTO ’89 Proceedings, Lecture Notes in Computer Science 435, pp. 218–238. Springer. (Originally 1979.)

Nakamoto, S. (2008). Bitcoin: A Peer-to-Peer Electronic Cash System. (Cited as temporal-chain analog only.)

National Institute of Standards and Technology (2018). SP 800-90B: Recommendation for the Entropy Sources Used for Random Bit Generation. U.S. Department of Commerce. (Cited as entropy-source estimation literature only; no validation of this platform is claimed or implied.)

OWASP GenAI Security Project (2026). State of Agentic AI Security and Governance, Version 2.01, June 2026. Open Worldwide Application Security Project. https://genai.owasp.org/ (Cited for the identity-perimeter framing only; no endorsement of this platform, of DTS, or of NanŌmics is claimed or implied.)

Reed, D.P. (2001). The Law of the Pack. Harvard Business Review 79(2): 23–24. (Cited for group-forming network economics and logistics only.)

Russell, S. (2019). Human Compatible: Artificial Intelligence and the Problem of Control. Viking.

Saltzer, J.H. and Schroeder, M.D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE 63(9): 1278–1308.

Shannon, C.E. (1948). A Mathematical Theory of Communication. Bell System Technical Journal 27(3): 379–423.

Strogatz, S.H. (2015). Nonlinear Dynamics and Chaos: With Applications to Physics, Biology, Chemistry, and Engineering. 2nd edition. Westview Press.

Thompson, K. (1984). Reflections on Trusting Trust. Communications of the ACM 27(8): 761–763.

Companion document

NanŌmics PBC (2026). Physical Reality Sentry Platform™ — Technical Whitepaper, Version 1.4. Pre-NDA public edition. https://nanomics.io/resources/PHYSICAL_REALITY_SENTRY_WHITEPAPER_PRE_NDA_v1.html (Product and architecture overview; the two-stage accept rule is stated there in §1.4 and the posterior stack in §8. The file posted at that address is edition 1.4.)

NanŌmics PBC (2026). Distributed Thermodynamic Security: A Security Model and Conjecture — Draft for IACR ePrint Archive, Version 1.8. force7_v2/v2_Latest/IACR_DTS_SECURITY_MODEL_2026_v1.8.md. (Formal model, security game, Theorem A, Theorem B, and the list of machine-checked lemmas referenced in Section 7.2. Not submitted.)

Evidence artifacts (NanŌmics internal)

NanŌmics PBC (2026a). Distributed Thermodynamic Security — 26 May 2026 Demonstration Record. Internal evidence artifact (JSON). Stage 1, one node.

NanŌmics PBC (2026b). Attack-Surface Matrix — 11 September 2026 Board. Evidence report: https://nanomics.io/resources/ATTACK_SURFACE_MATRIX_2026-09-11.html. Stage 2, one enrolled-write path.

NanŌmics PBC (2026c). Combined Attack-Proof Receipt — 11 September 2026. Evidence artifact, published in the NanŌmics resources section: https://nanomics.io/resources.

NanŌmics PBC · Public Benefit Corporation · Delaware, USA Contact: info@nanomics.io Version: PUBLISH-4.4 · September 2026 · Pre-NDA public overview Companion: Physical Reality Sentry Platform™ technical whitepaper, version 1.4 · IACR ePrint draft, version 1.8 — force7_v2/v2_Latest/IACR_DTS_SECURITY_MODEL_2026_v1.8.md.

Distributed Thermodynamic Security is a named security category with a published model, a two-stage accept rule — this room’s posterior, then the five-class conjunction on the same signed epoch — demonstrated scoped evidence at one node on the first stage, an experiment on one path against the second, two theorems under printed ifs — Theorem A, the many-room stack, and Theorem B, the modeled sum — and an open conjecture. It is offered as an additive layer to existing security operations, endpoint, identity, and certified-silicon controls.