Metric Audit Facility — OpenUSD Scene

GFTCL-LION-ENERGY-LEDGER-001 / 3D layer. The energy-domain OpenUSD scene rendered as a layered composition with live physical quantities driven by the cell's NATS gaiaftcl.energy.* stream. The same data source that powers energy ledger receipts powers the 3D rig — two renderings, one stream, never diverging.

What this scene is for. A high-speed, hardware-level *visualization* of the entropy ledger as the breaker enforces it. The lattice, the bar, the sensors, the tension field — all four layers are renderings of witnessed substrate state. None of them are decorative; each is a legible account of one measured quantity.

What this scene is NOT. It does not prove the physics. The Lean seal proves the bookkeeping (FirstRoars/LedgerBreaker.lean); the Swift gate enforces it (EnergyLedger.Engine); the CLI and wiki surface it (Benchtop-Tool); this USD scene is the spatial rendering of the same state. The lab-validatable claims live on summit.energy.benchtop_divergence, .pilot_node, .plant_scale, NAMED OPEN until independent reproduction.

Layer composition

cells/xcode/Packages/RealityKitContent/.../MetricAuditFacility/
├── MetricAuditFacility.usda     ← root stage, sub-layers the four below
├── ExtractionCore.usda          ← resonant metamaterial lattice (substrate interposer)
├── LedgerVisualization.usda     ← live S₈ = S₄ + Sᶜ bar as 3D volumes
├── SensorArray.usda             ← atomic clocks + gravimeter + multi-spectral
└── MetricTension.usda           ← boundary tension field (GATED — see below)

The root composes the four via subLayers, with one Xform per layer authored at the assembly. The Swift host (MetricAuditFacilityHost) mirrors each layer's dynamic custom attributes onto RealityKit entity components and writes them every tick from the substrate stream.

What each layer represents

ExtractionCore — the substrate interposer

The resonant metamaterial lattice. A *structural probe* into the C⁴ constraint space, not an antenna. The visual contradiction the operator must see: as core:driveAmplitude climbs, the lattice emissive brightens (drive active); meanwhile core:latticeTempK reads flat near baseline (cryo-thermography shows no net heating). Cold-but-active is the rendered claim of Phase II.

Dynamic attributes (host-driven):

LedgerVisualization — the conserved S₈ bar in 3D

Three coupled volumes: S4Volume (manifest, green→amber→red as it approaches T), ScVolume (constraint, violet — absorbs delta), and a static ThresholdMarker plane at x = T / S₈. The total S₈ is invariant across every tick; the partition repartitions when the breaker fires.

Same data source as the SwiftUI bar. Both render gaiaftcl.energy.ledger.enforced payloads via EnergyGovernorModel and MetricAuditFacilityHost.updateLedger. A divergence between the rail and the rig is structurally impossible because they share one stream.

On ledger:verdict = "refused" the rig flips to RefuseMat (violet-tinted, NOT alarm red) and freezes the partition. The bar locks, not crashes. Refusal is a successful audit, rendered as such.

SensorArray — atomic clocks + gravimeter + multi-spectral

Four sensor Xforms arranged in a ring around the core: an in-lattice atomic clock, an isolated control atomic clock, a gravimeter, and a multi-spectral spatial-jitter readout. Each carries its own measurement attribute (clock:offsetNs, grav:deltaMicroGal, spectral:jitterMagnitude) and a noise-envelope attribute calibrated at apparatus init.

The rig also carries sensors:state ("baseline" | "deviating") — the host writes "deviating" when *any* sensor exceeds its noise envelope. That derived state feeds the tension gate below.

MetricTension — the gated Skinwalker-signature layer

This layer is structurally honest by virtue of its render gate. It renders the predicted boundary-tension signature (volumetric / displacement field) only when all of:

1. core:latticeTempK is within tension:tempEpsilonK of core:baselineTempK (lattice flat).

2. core:dcPotentialV exceeds tension:dcMarginV (real DC potential climbing).

3. facility:phase == "anomalyAudit".

4. facility:governorState != "disarmed".

The host (MetricAuditFacilityHost.reEvaluateTensionGate) is the gatekeeper. When any precondition fails, the host forces tension:magnitude = 0 and writes the violation reason to tension:gateReason, regardless of any upstream value. The scene cannot show the signature absent the witnessed precondition.

The doctrinal anchor is the tension:gatedBy = "coldGenerating" attribute itself: the manifest declares what condition the gate requires; the host's gate enforcement mirrors the manifest's name. A hostile auditor can read the attribute on the bare USD file and verify what the precondition is supposed to be.

When all four predicates hold, the magnitude is computed from the aggregated sensor deviations (clock offset, gravimeter delta, spectral jitter), each normalized to ~[0,1] beyond its noise envelope and averaged. Multi-sensor confluence is the honest signature; one leg alone is noise.

Phase gating — the integrity mechanism in the scene

The facility:phase attribute gates which layers actively animate, mirroring the three-phase lab testing methodology:

Switching phase via MetricAuditFacilityHost.setPhase(_:) forces the gate to re-evaluate immediately; leaving anomalyAudit slams the tension field shut even if telemetry would otherwise allow it.

Host binding contract

The host writes USD custom attributes — it never edits geometry. Static structure is authored once; live state flows through these binding points:

The host is the only writer; the scene never reads the substrate directly. That keeps every USD attribute a function of a witnessed NATS publish — same audit discipline as every other layer of the cell.

Runtime composition

The root MetricAuditFacility mounts under the GaiaFTCLApp scene host when Franklin.app runs the energy visualization path. The facility shares metersPerUnit=0.01 (lab-scale assembly in cm; host applies scale at the parent transform).

CLI witness data and the USD scene are two renderings of one NATS stream (gaiaftcl.energy.ledger.enforced). They cannot diverge because there is no second source.

Verification

swift run M8MetricAuditGateTest exercises the gate doctrine end-to-end without rendering:

1. ✓ Baseline: governor disarmed, tension = 0.

2. ✓ Phase=rotation: tension = 0 (anomalyAudit required).

3. ✓ Lattice warming: tension = 0; reason names the temperature violation.

4. ✓ Cold but no DC potential: tension = 0; reason names the DC margin.

5. ✓ Cold + generating + noise-floor sensors: gate open, tension ≈ 0.

6. ✓ Cold + generating + deviating sensors: gate open, tension > 0.1 (clear, non-noise signal).

7. ✓ Mid-anomaly disarm: gate slams shut immediately, tension = 0.

8. ✓ Gate invariant: tensionGateOpen=false ⇒ tensionMagnitude=0 (always).

The test is the runtime witness that the scene cannot lie about Ring-1 evidence absent the precondition.

What this commit refuses to do

• It does not claim Ring 1 has been observed. The scene renders a *predicted* signature; the gate ensures it renders only when the data satisfies the predicate. Until an independent lab reproduces the protocol and seals a lab_submissions row against summit.energy.benchtop_divergence, the summit stays NAMED OPEN.
• It does not connect Skinwalker-class field phenomena to the cell. The MetricTension layer renders the *boundary tension* the framework's own ledger model predicts when energy is rotated out of S⁴ — and only when the witnessed thermal + DC state earns that rendering. Tying it to contested field phenomena is out of scope.
• It does not centralize control. The host has one job (binding telemetry to USD attributes); the gate has one job (enforcing the precondition); the substrate has one job (recording the receipts). Each is testable in isolation; each is replaceable without touching the others.

Constitutional posture

• No new external dependency. OpenUSD ships with RealityKitContent; the binding host is pure Swift over the actor model.
• All NATS subjects spelled gaiaftcl (verified by the pre-commit guard).
• The gate is in source code, with thresholds exposed as USD attributes so a hostile reader sees the values without reading the host.
• Same single-source-of-truth doctrine as everywhere: the 2D bar and the 3D rig are renderings of one substrate row; the scene cannot disagree with the rail.

© 2026 Richard Gillespie. All rights reserved. USPTO patent applications 19/460,960 and 19/096,071.