Metric Audit Facility — OpenUSD Scene

GFTCL-LION-ENERGY-LEDGER-001 / 3D layer. The energy-domain workbench scene rendered as a layered OpenUSD composition with the live physical quantities driven by the cell's NATS gaiaftcl.energy.* stream. The same data source that powers the SwiftUI conserved-bar in EnergyDomainPanel powers the 3D rig — two renderings, one stream, never diverging.

What this scene is for. A high-speed, hardware-level visualization of the entropy ledger as the breaker enforces it. The lattice, the bar, the sensors, the tension field — all four layers are renderings of witnessed substrate state. None of them are decorative; each is a legible account of one measured quantity.

What this scene is NOT. It does not prove the physics. The Lean seal proves the bookkeeping (FirstRoars/LedgerBreaker.lean); the Swift gate enforces it (EnergyLedger.Engine); the SwiftUI panel surfaces it (EnergyDomainPanel); this USD scene is the spatial rendering of the same state. The lab-validatable claims live on summit.energy.benchtop_divergence, .pilot_node, .plant_scale, NAMED OPEN until independent reproduction.

Layer composition

cells/xcode/Packages/RealityKitContent/.../MetricAuditFacility/
├── MetricAuditFacility.usda     ← root stage, sub-layers the four below
├── ExtractionCore.usda          ← resonant metamaterial lattice (substrate interposer)
├── LedgerVisualization.usda     ← live S₈ = S₄ + Sᶜ bar as 3D volumes
├── SensorArray.usda             ← atomic clocks + gravimeter + multi-spectral
└── MetricTension.usda           ← boundary tension field (GATED — see below)

The root composes the four via subLayers, with one Xform per layer authored at the assembly. The Swift host (MetricAuditFacilityHost) mirrors each layer's dynamic custom attributes onto RealityKit entity components and writes them every tick from the substrate stream.

What each layer represents

ExtractionCore — the substrate interposer

The resonant metamaterial lattice. A structural probe into the C⁴ constraint space, not an antenna. The visual contradiction the operator must see: as core:driveAmplitude climbs, the lattice emissive brightens (drive active); meanwhile core:latticeTempK reads flat near baseline (cryo-thermography shows no net heating). Cold-but-active is the rendered claim of Phase II.

Dynamic attributes (host-driven):

Attribute	Source	Meaning
core:resonanceFreqGHz	operator config	pump baseline (default 1.6 GHz)
core:driveAmplitude	gaiaftcl.energy.core.telemetry	0..1 input pump
core:dcPotentialV	gaiaftcl.energy.core.telemetry	extracted rectified DC (the work)
core:latticeTempK	gaiaftcl.energy.core.telemetry	cryo-thermography reading
core:baselineTempK	apparatus init	reference baseline (default 293.15 K)
core:resonant	gaiaftcl.energy.core.telemetry	in target resonant mode?

LedgerVisualization — the conserved S₈ bar in 3D

Three coupled volumes: S4Volume (manifest, green→amber→red as it approaches T), ScVolume (constraint, violet — absorbs delta), and a static ThresholdMarker plane at x = T / S₈. The total S₈ is invariant across every tick; the partition repartitions when the breaker fires.

Same data source as the SwiftUI bar. Both render gaiaftcl.energy.ledger.enforced payloads via EnergyGovernorModel and MetricAuditFacilityHost.updateLedger. A divergence between the rail and the rig is structurally impossible because they share one stream.

On ledger:verdict = "refused" the rig flips to RefuseMat (violet-tinted, NOT alarm red) and freezes the partition. The bar locks, not crashes. Refusal is a successful audit, rendered as such.

SensorArray — atomic clocks + gravimeter + multi-spectral

Four sensor Xforms arranged in a ring around the core: an in-lattice atomic clock, an isolated control atomic clock, a gravimeter, and a multi-spectral spatial-jitter readout. Each carries its own measurement attribute (clock:offsetNs, grav:deltaMicroGal, spectral:jitterMagnitude) and a noise-envelope attribute calibrated at apparatus init.

The rig also carries sensors:state ("baseline" | "deviating") — the host writes "deviating" when any sensor exceeds its noise envelope. That derived state feeds the tension gate below.

MetricTension — the gated Skinwalker-signature layer

This layer is structurally honest by virtue of its render gate. It renders the predicted boundary-tension signature (volumetric / displacement field) only when all of:

1. core:latticeTempK is within tension:tempEpsilonK of core:baselineTempK (lattice flat).
2. core:dcPotentialV exceeds tension:dcMarginV (real DC potential climbing).
3. facility:phase == "anomalyAudit".
4. facility:governorState != "disarmed".

The host (MetricAuditFacilityHost.reEvaluateTensionGate) is the gatekeeper. When any precondition fails, the host forces tension:magnitude = 0 and writes the violation reason to tension:gateReason, regardless of any upstream value. The scene cannot show the signature absent the witnessed precondition.

The doctrinal anchor is the tension:gatedBy = "coldGenerating" attribute itself: the manifest declares what condition the gate requires; the host's gate enforcement mirrors the manifest's name. A hostile auditor can read the attribute on the bare USD file and verify what the precondition is supposed to be.

When all four predicates hold, the magnitude is computed from the aggregated sensor deviations (clock offset, gravimeter delta, spectral jitter), each normalized to ~[0,1] beyond its noise envelope and averaged. Multi-sensor confluence is the honest signature; one leg alone is noise.

Phase gating — the integrity mechanism in the scene

The facility:phase attribute gates which layers actively animate, mirroring the three-phase lab testing methodology:

Phase	Animation	What the scene shows
baseline (Phase I — Thermal Baseline)	core thermal-haze proportional to driveAmplitude × latticeTempK delta	Classical lab: heat is the entropy tax, rendered as expected waste
rotation (Phase II — Dimensional Rotation)	S4Volume shrinks, ScVolume grows, lattice glows but stays cold	The breaker firing — the rendered claim of S₄ → Sᶜ shunt
anomalyAudit (Phase III — Anomaly Audit)	MetricTension layer un-gated if preconditions hold	Boundary tension visible only when cold-generating

Switching phase via MetricAuditFacilityHost.setPhase(_:) forces the gate to re-evaluate immediately; leaving anomalyAudit slams the tension field shut even if telemetry would otherwise allow it.

Host binding contract

The host writes USD custom attributes — it never edits geometry. Static structure is authored once; live state flows through these binding points:

NATS subject	USD attribute(s)
gaiaftcl.energy.ledger.enforced	ledger:s4, ledger:sC, ledger:s8Total, ledger:verdict, ledger:lastReceiptHash
gaiaftcl.energy.core.telemetry	core:driveAmplitude, core:dcPotentialV, core:latticeTempK, core:resonant
gaiaftcl.energy.sensors.clock	clock:offsetNs (in-lattice + control)
gaiaftcl.energy.sensors.gravimeter	grav:deltaMicroGal
gaiaftcl.energy.sensors.spectral	spectral:jitterMagnitude
gaiaftcl.energy.governor.arm	facility:governorState
gaiaftcl.energy.facility.phase	facility:phase

The host is the only writer; the scene never reads the substrate directly. That keeps every USD attribute a function of a witnessed NATS publish — same audit discipline as every other layer of the cell.

Composition into the existing workbench

The root MetricAuditFacility is added as a referenced child under the existing WorkbenchStage at runtime by the GaiaFTCLApp scene host. Same pattern as the existing tools (SectorNode, VQbitGauge, WorldLane, MeaningLine) the workbench loads via RealityProWorkbenchState.placeTool(). The facility shares metersPerUnit=0.01 (note: the lab-scale assembly is in cm; the workbench root is in meters; the host applies a 0.01 scale at the parent transform to bridge units cleanly).

The SwiftUI EnergyDomainPanel and the USD scene are two renderings of one data source. Operator sees: - The conserved bar in the 2D rail (SwiftUI, embedded in WorkbenchHomeView.railsBody). - The same partition as 3D volumes (USD, mounted under WorkbenchStage).

Both driven by the same gaiaftcl.energy.ledger.enforced stream. They cannot diverge because there is no second source.

Verification

swift run M8MetricAuditGateTest exercises the gate doctrine end-to-end without rendering:

1. ✓ Baseline: governor disarmed, tension = 0.
2. ✓ Phase=rotation: tension = 0 (anomalyAudit required).
3. ✓ Lattice warming: tension = 0; reason names the temperature violation.
4. ✓ Cold but no DC potential: tension = 0; reason names the DC margin.
5. ✓ Cold + generating + noise-floor sensors: gate open, tension ≈ 0.
6. ✓ Cold + generating + deviating sensors: gate open, tension > 0.1 (clear, non-noise signal).
7. ✓ Mid-anomaly disarm: gate slams shut immediately, tension = 0.
8. ✓ Gate invariant: tensionGateOpen=false ⇒ tensionMagnitude=0 (always).

The test is the runtime witness that the scene cannot lie about Ring-1 evidence absent the precondition.

What this commit refuses to do

• It does not claim Ring 1 has been observed. The scene renders a predicted signature; the gate ensures it renders only when the data satisfies the predicate. Until an independent lab reproduces the protocol and seals a lab_submissions row against summit.energy.benchtop_divergence, the summit stays NAMED OPEN.
• It does not connect Skinwalker-class field phenomena to the cell. The MetricTension layer renders the boundary tension the framework's own ledger model predicts when energy is rotated out of S⁴ — and only when the witnessed thermal + DC state earns that rendering. Tying it to contested field phenomena is out of scope.
• It does not centralize control. The host has one job (binding telemetry to USD attributes); the gate has one job (enforcing the precondition); the substrate has one job (recording the receipts). Each is testable in isolation; each is replaceable without touching the others.

Constitutional posture

• No new external dependency. OpenUSD ships with RealityKitContent; the binding host is pure Swift over the actor model.
• All NATS subjects spelled gaiaftcl (verified by the pre-commit guard).
• The gate is in source code, with thresholds exposed as USD attributes so a hostile reader sees the values without reading the host.
• Same single-source-of-truth doctrine as everywhere: the 2D bar and the 3D rig are renderings of one substrate row; the scene cannot disagree with the rail.

© 2026 Richard Gillespie. All rights reserved. USPTO patent applications 19/460,960 and 19/096,071.

---

Federation-cosigned

This page's source is sealed in the GaiaFTCL federation manifest — page SHA-256 c70d3716ae0161a2…, manifest witness a090592e0609adc8…, signed 2026-06-02T18:58:22Z by cell gaiaftcl-mac-cell. Verify with gaiaftcl wiki sign --all and compare wiki-all-signatures.json.