Abstract: An operating-system overlay-control system obtains, for a synthetic overlay, a validation result produced by validating a Reality Receipt (R2) under a freshness policy relative to a current signed head of an append-only log, including verification of an origin signature, an inclusion proof, and append-only evolution on head advance. From the validation result, the system determines an egress-permit vector that enumerates downstream egress action identifiers and follow-on privilege identifiers and specifies permitted or denied states. Operating-system authorization gatepoints and privilege-control interfaces enforce fail-closed control so that requested downstream egress actions and follow-on privileges are allowed only when permitted by the egress-permit vector and otherwise are blocked, withheld, or refused with a Structured Precondition-Failure code.

Abstract: Systems and methods for receipt-gated, fail-closed sensor ingress at the OS/HAL boundary. A portion of acquisition executes in a trusted boundary; each event is deterministically canonicalized into a Sensor Receipt (S2), signed, and its commitment anchored to an append-only log that publishes signed heads and supports inclusion and append-only-evolution (consistency) proofs under a freshness policy. An ingress gate admits the event to an OS read/subscribe path only after successful validation within an admission latency budget; otherwise the system returns a Structured Precondition-Failure code and withholds the event. Optional active liveness (optical flicker, IR, ultrasonic) and multi-sensor consistency detect replay and spoofing. On PASS, a scope-bound, TTL-limited, single-use sensor-permit may be minted to authorize read/subscribe. A verifier may emit a digitally signed Certification Result and, optionally, a Sensor Integrity Score.

Abstract: Systems and methods for receipt-gated, fail-closed rendering and egress of synthetic overlays in AR/VR/camera pipelines. An OS-resident reality compositor admits an overlay only when a per-overlay Reality Receipt (R2) verifies, within the frame budget, to a current signed head of an append-only public log under a freshness policy, using an inclusion proof and, on head advance, append-only evolution (consistency); an anti-replay tuple prevents reuse. A view-permit latch binds time-of-check/time-of-use (TOCTOU) verify-to-pixels and returns a Structured Precondition-Failure (code) while dropping non-conformant draws; PASS draws are labeled in machine-readable (optionally machine-audible) form. The same predicates govern rendering and at least one of share, upload, record/capture, or clipboard. An attested boundary (TEE/secure element) may aggregate a device run-permit across apps.