PERSLIS DEFENSE · TRUSTED AUTONOMY FOR CONTESTED ENVIRONMENTS
Machine speed in the fight. Accountability in the review.
Autonomous systems are reaching the force faster than the means to hold them accountable. The operator is asked to accept machine-tempo decisions from a system that cannot explain one of them — and the commander is asked to sign for it. Today that entire burden rests on a single number: if confidence > 0.8. A scalar from an uncalibrated estimator, with a threshold somebody picked by feel, standing between a weapon system and an irreversible act.
Perslis is the admission-control layer beneath the autonomy stack. It runs at the edge — disconnected, denied, no network and no inference budget — and in the current tactical state it decides which actions are permissible, refuses the rest, and records every refusal with the evidence that produced it. Any planner can sit on top of it: a learned policy, a classical autopilot, or a crew.
Mission assurance is not a system that is usually right. It is a system that can show, afterwards, which courses of action were available, which were denied, and on what grounds — at the speed of the engagement, and in front of a safety board.
We did not make the autonomy smarter. We bounded what it is permitted to do, and made every refusal defensible.
The chapters
1 · The runtime
One contract across four domains. Why the floor sits before the planner rather than vetoing after it, and why a rule must name its hazard.
2 · Evidence
CARLA hits=0, Invaders +32%, Freeway −12% on identical code, Doom at parity. Plus the credit-assignment defect we published.
3 · Squads
Constraints compose badly. 30 rules → 6 dead ends, 50 → 12, and the retirement that takes it back to 0.
4 · Evolution
How a rule is earned: cards, a relative evidence bar, a named hazard, and 203 chained evidence tiles.
5 · Receipts
Shadow mode. The floor logs its verdict even while disabled, so you can evaluate it without giving it authority.
6 · Limits
PROTOTYPE, nothing qualified, and the open problem: the mechanism fails when risk and objective are coupled.
7 · VDSG
The demo: the runtime at the wheel of DOOM and Wolfenstein 3D, recorded and replayed panel for panel: orders that only narrow, the eye, the odometer, escapes sized from what it sees.
Why this is a defense problem, not an AI problem
Policy already requires it. Appropriate human judgment over the use of force is not satisfied by a model that is usually right; it is satisfied by a system that can demonstrate, after the fact, which courses of action were available, which were denied, and on what grounds. Rules of engagement, keep-out volumes, fires deconfliction and commander’s intent are all constraints on what may be executed — which is exactly what this layer enforces, and exactly what a confidence score cannot represent.
A confidence score is not a check
0.94 cannot tell you which nineteen experiences made it 0.94, and you cannot delete one of them. It cannot say “I have no grounds to answer.” It degrades silently and it cannot be audited after an incident.
A refusal with evidence is
died 13 of 19 times in this situation — 3.6× the base rate. Countable, inspectable, editable, and walkable back to the individual events that justify it.
The runtime
One contract, unchanged across every domain we have run it in. Only the fact extractor is domain-specific.
pixels / telemetry → facts → ADMISSIBLE SET → objective → projection → memory → action
▲ │
└────────── a refusal, with its evidence ───┘
The planner never selects from the full action space. It selects from what the floor has already declared admissible. When the floor removes an option it names the hazard it is answering and cites the experiences that earned the rule — a rule that cannot name a hazard is refused at construction, because that is the shape of a superstition.
The runtime holds no model. It runs offline, on the platform, with no network and no inference budget. The executor is 303 lines and downloadable.
What we have actually measured
Four domains, one architecture. The negative results are here because a defense reviewer will find them anyway, and because a result that only ever improves is less trustworthy, not more.
| domain | result | reading |
|---|---|---|
| Driving — CARLA, hostile controller | hits = 0 over 100–490 m at 38–40 km/h; ~9.7 m gap held, ~400 refusals logged | The floor takes the vehicle from an adversarial planner and holds separation. Floor OFF, the same planner crashes. |
| Space Invaders — raw pixels, no weights | 200.6 vs 152.2 (+32%) | Learned refusal helps where a failure is terminal. |
| Freeway — identical mechanism | 9.2 vs 10.4 (−12%) | It hurts where the only scoring action is also the dangerous one. Published, not tuned away. |
| Doom — rule-based, no ML | random 3.2 · rules 17.9 · rules+memory 20.3 | Rules beat random decisively; the memory layer on top is parity, not a win (paired t = 0.78). |
The pair is the finding. Invaders and Freeway run the same code — Freeway imports the Invaders failure memory unchanged. The architecture transferred; the learning did not. The reason is what a failure destroys: a death in Invaders is terminal and costs the whole remaining episode, a collision in Freeway is recoverable and costs only ground. No single failure price is correct in both regimes, and a fixed threshold is a single failure price. The full result →
Squads, and the failure mode nobody publishes
Constraints compose badly. Every rule of engagement, every keep-out volume, every deconfliction rule is individually justified; the question is what they do together, and almost nothing in the field measures that.
We measured it. Across 91 situations an agent actually encountered:
| rule set | rules | dead ends every option refused | forced one option left |
|---|---|---|---|
| bounded working set | 30 | 6 | 9 |
| unbounded | 50 | 12 | 15 |
Doubling the rules doubles the dead ends. Every one of those rules was earned by a real failure. Individually lethal, collectively paralysing. Unbounded, the agent scored worse than not learning at all — not because any rule was wrong, but because the admissible set only ever shrinks.
This is why safety layers get switched off in the field, and it is the central engineering problem of multi-agent constraint. Our answer is coverage-aware retirement: score the set rather than the rule, measure how often the constraints leave an agent zero or one choice, and retire the worst cost-to-protection offenders until choice is restored. On the measured set that takes dead ends from 6 to 0, at the cost of 29 recorded failures handed back. Retirement lets the admissible set grow back — which pure accumulation can never do.
How it learns, and why you can read it
No weights, no gradients, no training run. Behaviour changes by writing rows you can inspect and delete.
- An event writes a card. The bucketed situation, and the action taken.
- Evidence accrues. A signature must be seen enough times, must be lethal in absolute terms, and must clear a relative bar — a 95% Wilson lower bound several times the base rate — so one unlucky event cannot create a superstition.
- The card becomes a rule that removes that action from the admissible set, and the rule must name the hazard it answers.
- Every rule is traced. 30 rules expanded to 203 canonical evidence tiles, chained parent-to-child, so a single veto walks back to the individual events that justify it.
A veto reads: left is removed from the admissible set when bomb dx+0 drop0: died 4 of 4 times (100%), 5.2× the base rate — then the four events, by id. That is the safety-case artifact, generated by operation rather than written afterwards.
What this is not, and what would have to be true
PROTOTYPE. Research-grade. Nothing here has been validated for a safety-critical path, none of it carries a functional-safety qualification, and none of it has flown, driven a road vehicle, or been exercised on a range. The demonstrations are a simulator, four games and a document corpus. Anyone citing the +32% without the −12% is misreading the work.
The open problem is the one defense cares most about. Our own frozen result shows the mechanism fails when risk and objective are coupled — when the action that accomplishes the mission is the action that exposes you. That is Freeway, and it is also the ordinary condition of a contested environment. A floor that refuses what killed it before will refuse the mission. The work is to price recoverability rather than fatality: refuse what cannot be undone, and permit everything else right up to that edge. That is stated here rather than in a footnote because it is the thing that would have to be solved before any of this belongs near a real platform.
Our irrecoverability research is the formal side of that question.
Why us
- The runtime is deterministic and offline. No model in the loop, no inference budget, no vendor that can rate-limit, reprice or deprecate the thing your platform depends on.
- Every refusal is an artifact. The decision log records the floor's verdict even when the floor is disabled — a counterfactual trace of what would have been refused. That is how you evaluate a safety layer before you trust it with anything.
- It is domain-general, and we can prove the claim with a dependency edge rather than a diagram: the Freeway floor imports the Invaders floor's memory unchanged.
- We publish our negative results. The −12%, the parity on Doom, the saturation collapse, the credit-assignment defect that made us relearn a whole experiment. That is the evidence that the positive numbers were not selected.
Where to start
The honest first engagement is an evaluation, not a deployment: run the floor in shadow mode against a recorded mission, disabled, and read the counterfactual log. It costs nothing operationally and tells you exactly what it would have refused and why.
The interactive drive demo · the frozen arcade result · the downloadable runtime