1. Problem and main claim
Ontological fusion integrates explicitly aligned local contexts, records and evidence. The system studied here lets custom virtual machines propose updates to such a fused context. A trusted capability interface confines their ordinary operations. Validators check the admissibility of proposed updates, and a commit gate accepts only authorized transitions with sufficient endorsements.
The main claim is conditional and has a finite horizon. With $n$ signing identities and quorum size $q>n/2$, an invalid certificate requires at least $q$ effectively compromised identities, and conflicting certificates require at least $2q-n$, except on shared-premise or cryptographic failures. Sequential conditional bounds on compromise give a Poisson-binomial upper bound, even when the observed outcomes are dependent. A separate term bounds violations of the modeled worker boundary.
2. Higher-topos semantics
Let $\mathcal E$ be an $\infty$-topos and let $D:I\to\mathcal E$ be a small diagram of local contexts $X_i$, their overlaps and alignment maps. Write $X=\operatorname{colim}_I X_i$ and $j_i:X_i\to X$. A provenance object is a map $V\to X$. A witness over $u:U\to X$ is a map $U\to V$ in the slice. The alignment maps are part of the input. A semantic identification is relative to these declared maps and gives no new authority to a principal.
Proposition 1. Pullback induces an equivalence
$$ \mathcal E_{/X}\simeq\lim_{i\in I^{\mathrm{op}}}\mathcal E_{/X_i}. $$
In particular, the space of witnesses over $U$ is the limit of the spaces of local witnesses between the respective pullbacks of $U$ and $V$.
Proof. Colimits in an $\infty$-topos satisfy descent [1, Proposition 6.1.3.9]. Mapping spaces between two objects of a limit of $\infty$-categories are limits of their local mapping spaces. The result is natural under base change since colimits in an $\infty$-topos are universal. $\square$
For example, the homotopy pushout $*\amalg^h_{\{0,1\}}*$ is a circle. Take two-element fibers over the two points being glued and transport by the identity on one overlap point and the transposition on the other. A section would have to choose $x,y$ with $y=x$ and $y=1-x$. Each local fiber has a point, while the global section space is empty. This is the nontrivial double cover of the circle. Propositional truncation should be applied to the coherent witness space when the intended assertion is existence.
Proposition 2. Let $P_i\hookrightarrow X_i$ be operation-specific local restrictions, which may disagree on overlaps. If $j^*$ denotes pullback on subobjects, write $\forall_j$ for its right adjoint. The greatest fused subobject restricting below each $P_i$ is
$$ R=\bigwedge_i\forall_{j_i}P_i. $$
If the $P_i$ agree under pullback along all alignments, then $j_i^*R=P_i$. For any $f:Y\to X$, the restriction $f^*R$ is the analogous meet for the pulled-back diagram and policies.
Proof. Adjunction and the meet give $Q\le R$ precisely when $j_i^*Q\le P_i$ for all $i$. Compatible $P_i$ descend by Proposition 1. The descended object is a subobject since its diagonal is locally an equivalence, and restriction to the slices is jointly conservative. The universal property of $R$ and order reflection by descent identify it with that subobject. Pullback preserves meets, and Beck–Chevalley for dependent products identifies the pullbacks of the individual right adjoints. $\square$
For the finite fragment in spaces, truncate the colimit of a finite diagram of finite sets to sets. This gives the quotient of the disjoint union by the equivalence relation generated by alignment edges. A class $z$ satisfies $R$ exactly when every representative belongs to its local $P_i$. For each representative $v$, a finite registry specifies allowed evidence records $D_v$. Each declared edge $a:v\to w$ has a compatibility relation $C_a\subseteq D_v\times D_w$. A witness is a tuple $(d_v)_{v\in z}$ with $d_v\in D_v$ and $(d_v,d_w)\in C_a$ for each edge. A checker enumerates the class from the trusted registry, rejects missing or repeated indices, and checks all memberships. It accepts precisely the admissible witnessed classes with correctly encoded tuples, and exhaustive finite search decides witness existence. The general higher semantics retains transport data that the finite set quotient can lose.
For instance, two sites align aliases of one calibration instrument. Both require approved units and one also requires current calibration. Two individually permitted records may disagree on the calibration profile. The fused class can satisfy the policy predicate while lacking a compatible witness for the requested export. The caller's permission to export is checked independently.
3. Worker interface and commit semantics
A worker state consists of local store, control, fuel and an outbox. Its sandbox interface permits pure local computation, scoped reads of immutable snapshots, bounded candidate emission and halt. The broker checks the executing worker, handle and snapshot against a trusted capability table on each read. Emission copies a format-checked value to the worker's outbox. Invalid operations and exhausted fuel trap. The abstract machine executes at most its initial fuel count in instructions.
Confinement lemma. Along a worker trace, every returned broker read is authorized, emissions use only the worker's outbox, and worker steps preserve the protected state and capability tables.
Proof. Each case follows from the corresponding transition premise. Pure steps only change local state. Reads return authorized bytes or a distinguished denial. Emission changes only the declared outbox. Halt and trap leave the protected state and the capability tables intact. Induction over finite interleavings proves the result. A concrete runtime inherits this property from a trace refinement preserving the boundary events and their authorities. $\square$
For a deterministic worker, equal initial local state, equal authorized read responses and equal scheduling decisions imply equal sequences of emissions and terminal outcomes by the same induction. Timing and other observations require an additional model. Results about formal bytecode and microkernel models illustrate the importance of stating the implementation assumptions [4–5].
An epoch $e$ fixes its membership registry, quorum $q_e$, ontology diagram, evidence rules and effect rules in an authenticated snapshot. A canonical slot is the tuple (deployment, epoch, protected resource log, sequence). A candidate carries the slot, snapshot commitment, operation, principal, predecessor, proposed effect, context reference and evidence. All fields are bound by an injective typed encoding and an authenticated commitment for the endorsement protocol.
Let $\mathsf{Valid}_e(m)$ mean that the context reference and supplied evidence satisfy the declared semantic relation and the proposed effect equals the declared interpretation against the predecessor. The validator's trusted checker satisfies
$$ \mathsf{Check}_e(m)=1\ \Longrightarrow\ \mathsf{Valid}_e(m). $$
An honest validator endorses only a checked candidate and durably records one commitment per canonical slot before endorsement. The record is preserved by concurrent updates and recovery. A certificate needs at least $q_e$ distinct authenticated endorsements from the active registry. The commit gate checks the certificate, authenticated principal and its operation scope, active snapshot, canonical slot and predecessor, and atomically applies the protected update. The certificate rules concern safety. Progress requires coordination and suitable network assumptions, and membership changes require an authenticated handoff that anchors the new epoch at the committed head.
4. Deterministic certificate thresholds
Write $B_e$ for the set of effectively compromised signing identities in epoch $e$. This includes control of an identity's endorsements at any time during the period when they are usable, including control carried into the epoch. Local checker or persistent-lock failures that permit improper endorsements are charged to those identities or to a designated shared failure. Let $G_e$ be the event that a shared premise fails, such as failure of a common checker, trust root, registry or gate. Let $K_e$ be accepted cryptographic binding failure. Outside $G_e\cup K_e$, endorsements accepted for an uncompromised identity match the exact message it authorized.
Let $I_e$ be acceptance of a certificate for an invalid candidate in an authorized slot, and $C_e$ the existence of two verified certificates for distinct canonical candidates in the same authorized slot and epoch. Conflicting certificates delivered to different readers can realize $C_e$ even if a correct gate serializes its own writes.
Proposition 3. Outside $G_e\cup K_e$, $I_e$ implies $|B_e|\ge q_e$, and $C_e$ implies $|B_e|\ge k_e:=2q_e-n_e$.
Proof. Any honest signer of an invalid candidate would contradict checker soundness, so all signers of such a candidate belong to $B_e$. Two signer sets of size at least $q_e$ in a universe of size $n_e$ intersect in at least $2q_e-n_e$ identities. Every identity in the intersection endorsed two distinct candidates for the same slot and therefore belongs to $B_e$. $\square$
These thresholds can be attained under the abstract signature rules when the corresponding proposals exist. The cardinal conditions for tolerating $f$ compromised identities while permitting a quorum of the remaining ones are $(n+f)/2<q\le n-f$. An integer $q$ exists exactly when $n\ge3f+1$. The threshold proof has the familiar Byzantine quorum structure [6].
5. Finite-horizon probability theorem
Fix $H$ epochs and a class of adaptive adversaries with bounded time, interactions and initial privileges. All budgets must apply uniformly to this class. Write $\mathcal F_{e-1}$ for the history at epoch start. Assume $\mathbb P(G_e\mid\mathcal F_{e-1})\le\beta_e$ and $\mathbb P(\bigcup_{e=1}^H K_e)\le\gamma_H$. The latter is a computational budget for the chosen signature and commitment model.
With one signing identity per failure domain, order the domains at epoch start and let $Z_{e,i}$ indicate their effective compromise. For each prefix with positive probability under the good baseline assume
$$ \mathbb P(Z_{e,i}=1\mid \mathcal F_{e-1},G_e^c,Z_{e,1},\ldots,Z_{e,i-1})\le p_{e,i}. $$
The bounds $p_{e,i}$ and $\beta_e$ are determined at epoch start. Let $T_{\mathbf p}(k)$ be the probability that a sum of independent Bernoulli variables with respective parameters $p_i$ reaches $k$.
Theorem. The probability of an invalid or conflicting certificate over the horizon is bounded above by
$$ \min\left(1,\gamma_H+\sum_{e=1}^H\mathbb E\!\left[\beta_e+T_{\mathbf p_e}(k_e)\right]\right). $$
For invalid certificates alone use $q_e$ in place of $k_e$.
Proof. Fix an epoch-start history and condition on $G_e^c$. Let $a_i(z_{<i})$ be the conditional probability that the next indicator is one, taking value zero on null prefixes. Generate $\widehat Z_i=\mathbf1_{\{U_i<a_i(\widehat Z_{<i})\}}$ using independent uniform $U_i$, and put $Y_i=\mathbf1_{\{U_i<p_{e,i}\}}$. The joint law of $\widehat Z$ is the conditional law of $Z$. Each $\widehat Z_i$ is bounded by $Y_i$ in this coupling, so the conditional threshold probability is at most $T_{\mathbf p_e}(k_e)$. Multiplying by the conditional probability of $G_e^c$ gives the same upper bound for the threshold event intersected with $G_e^c$. Proposition 3, the tower rule and the union bound give the result. The same argument at threshold $q_e$ bounds the invalid-only event. $\square$
If domain $i$ can control up to $w_i$ identities and all effective compromises are covered by the domain map, use the tail of $\sum_i w_iY_i$. The same coupling works for nonnegative weights. Its distribution has generating polynomial $\prod_i(1-p_i+p_i z^{w_i})$. A common administrator or software component can control several identities, so using the number of VM instances alone can overstate the protection [7].
For a general quorum family, the compromised identity set must contain a quorum to certify invalidity or a quorum intersection to certify a conflict. Both conditions are upward closed. The same coupling bounds either event by its probability under the independent comparison variables. A union bound over inclusion-minimal compromise sets $M$ gives $\sum_M\prod_{i\in M}p_i$. For shared domains, compute the minimal sets in terms of domains by taking the inverse image of the condition under the map from domains to affected identities.
If only conditional marginal bounds are available, the valid replacement for the comparison tail is $\min(1,\sum_i p_i/k)$. Indeed, the expected sum is at most $\sum_i p_i$ and is at least $k$ times its tail probability. For common cap $p$, this bound is sharp. With probability $\min(1,np/k)$ choose a uniform $k$-element subset to compromise, and otherwise compromise none. Each marginal is at most $p$, and the threshold is crossed with the claimed probability.
Let $J_e$ be a modeled worker boundary violation and $L_{e,w}$ failure of worker $w$'s local trace-refinement premise. With shared and applicable cryptographic failures accounted for in $G_e$ and $K_e$, confinement gives $J_e\subseteq G_e\cup K_e\cup\bigcup_w L_{e,w}$. If $\mathbb P(L_{e,w}\mid\mathcal F_{e-1},G_e^c)\le\delta_{e,w}$, add $\sum_w\delta_{e,w}$ within each epoch's expectation to bound any certificate or boundary violation. A bound on the worker event alone omits the quorum tail.
6. Illustrative calculation and evidence
For $n=10$, $q=7$ and ten equal sequential caps $p=0.01$, the conflict and invalid-only tails are approximately $2.00128\times10^{-6}$ and $1.16878\times10^{-12}$ per epoch. At $H=100$ and with $\beta_e=10^{-5}$, the bound for any invalid or conflicting certificate is approximately $1.20013\times10^{-3}+\gamma_{100}$. Twenty workers per epoch at a stipulated local boundary budget of $10^{-6}$ each add $2.0\times10^{-3}$ to the joint bound. Marginal information alone gives a sharp $0.025$ one-epoch upper bound for reaching four compromises. One domain of weight four and six of weight one instead give a comparison tail of approximately $0.01000015$ at the same domain caps.
These exact-distribution calculations use stipulated inputs. A deployment needs a versioned semantic checker, concrete trace and commit refinements, authenticated configuration and a justification of its budgets against the declared adversary class. Source authenticity, availability and unmodeled channels require their own specifications.
7. Timestamped integer vectors in three QEMU guests
An oracle guest generates two streams. Two fuser guests exchange an observation at each logical tick and independently maintain the same provenance-indexed union. Let $\mathbb B=\{0,1\}$ and $D=\mathbb B\times\mathbb Z\times\mathbb B$. The alignment embeds $(g,x,y)\in D$ into two copies of $\mathbb Z^4$ as $(1,g,x,y)$ and $(7,2x+7,y,1-g)$. These are injective maps of discrete types, so the homotopy pushout in spaces is equivalent to the set pushout. It retains a copy of $D$ and the two source-specific residual subsets. Timestamps and sources remain attached to occurrences. Set union is idempotent under exact replay.
The fusers minimize label disagreement on a training prefix, with a fixed tie order over 30 Boolean rules built from $g$, thresholds on $x$, and conjunction or disjunction. The left stream has $g=1$ and signals on both sides of the true threshold. The right stream has signals at or above it and both gate values. In the noiseless case the two streams together identify the conjunction. The left-only fit can use a threshold alone, and the right-only fit can use the gate alone. Unrecognized tags are kept as residuals, and the oracle introduces some flipped labels.
The oracle accepts both fusers' rule declarations only if they match its own training-prefix fit. It freezes the declarations before sending any held-out features. It replaces each held-out label with a sentinel, checks each returned prediction against the frozen rule, and scores the prediction against its private original. Thus an accepted score is an exact evaluation of the frozen rule on the complete holdout, even if the fusers coordinate their submissions, under the trusted oracle and host assumptions. A missing or inconsistent reply prevents acceptance for that window.
The three Multiboot guests run under QEMU TCG with private serial FIFO links [8]. In the recorded three-window run, both fusers selected $y=g\land[x\ge8]$ every time. The oracle measured 709 explained, 30 contradicted and 29 residual records out of 768 held-out observations, for 92.32% coverage. The single-source fits explained 545 and 534 of the same 768 observations. Each fuser received 768 peer observations and 45 scheduled replays. The source bundle contains the two guest images, launcher, three console transcripts and independent verifier. The results concern this synthetic experiment and the declared hypothesis class.
The manuscript and implementation were prepared with assistance from OpenAI ChatGPT. The submitting researcher or group supplies the responsible byline.
References
1. Jacob Lurie, Higher Topos Theory, 2009. Author's text. 2. J. A. Goguen and R. M. Burstall, Institutions: Abstract model theory for specification and programming, 1992. DOI. 3. J. A. Goguen, Information integration in institutions. Author's manuscript. 4. Conrad Watt, Mechanising and verifying the WebAssembly specification, 2018. Author's paper. 5. T. Murray et al., seL4: From general purpose to a proof of information flow enforcement, 2013. Open paper. 6. M. Castro and B. Liskov, Practical Byzantine fault tolerance, 1999. USENIX. 7. J. C. Knight and N. G. Leveson, An experimental evaluation of the assumption of independence in multiversion programming, 1986. DOI. 8. QEMU Project, System emulator invocation. QEMU documentation.