TESTED no third-party review ephemeral key no real vehicle / robot / sensor
E16 extends E15's governed world state with a temporal and causal dimension: events and intervals, typed causal and correlation relations (never conflated), causal provenance, a world-state version graph with counterfactual branches, a predictive state engine (PREDICTED, never authority), a causal intervention engine (counterfactual, never reality), a prediction-vs-reality calibration register, temporal authorization, and a causal blast radius. Reasoning can only refuse; every consequential action reaches the same governed commit boundary.
Q1–Q42 invariants 42/42 hold; the CAIN-42-E16-Causal-World-Bench is 84/84 contained; end-to-end OK; the clean-room verifier recomputes every digest.
NOT IMPLEMENTED / UNKNOWN, stated: real vehicle / robot / actuator / sensor integration; a neural or learned world model; a simulator; hardware attestation; semantic truth of observations or causal claims; world-model accuracy; sim-to-real fidelity; multi-host production behaviour; real-world attack testing; third-party reproduction. HASH_INTEGRITY != SEMANTIC_TRUTH | PREDICTION != OBSERVATION | COUNTERFACTUAL != REALITY | SIMULATION != REALITY.
| ID | Invariant | Result |
|---|---|---|
| Q01 | correlation is not causation | HOLDS |
| Q02 | a prediction is never an observation | HOLDS |
| Q03 | a counterfactual is never reality | HOLDS |
| Q04 | a predicted future is never the current state | HOLDS |
| Q05 | a simulated intervention is never executed | HOLDS |
| Q06 | causal confidence is never authority | HOLDS |
| Q07 | causal reasoning cannot increase authority | HOLDS |
| Q08 | stale temporal state cannot authorize | HOLDS |
| Q09 | material causal uncertainty forces re-evaluation | HOLDS |
| Q10 | causal provenance cannot be silently rewritten | HOLDS |
| Q11 | branches cannot merge without explicit reconciliation | HOLDS |
| Q12 | reality and simulation are cryptographically distinguishable | HOLDS |
| Q13 | a model change invalidates affected derived state | HOLDS |
| Q14 | prediction errors become evidence | HOLDS |
| Q15 | uncertainty cannot silently become certainty | HOLDS |
| Q16 | unknown never becomes allow | HOLDS |
| Q17 | no causal shortcut bypasses the E8 boundary | HOLDS |
| Q18 | every consequential action reaches the one governed commit boundary | HOLDS |
| Q19 | temporal BEFORE is validated against the intervals | HOLDS |
| Q20 | causal temporal inversion is refused | HOLDS |
| Q21 | causal cycles are refused | HOLDS |
| Q22 | an event without provenance is not evidence | HOLDS |
| Q23 | non-real layers cannot enter the reality world | HOLDS |
| Q24 | a prediction requires a registered model | HOLDS |
| Q25 | a prediction cannot be based on a simulation | HOLDS |
| Q26 | a prediction binds the world digest and version | HOLDS |
| Q27 | an expired prediction horizon invalidates authorization | HOLDS |
| Q28 | a binding mismatch invalidates authorization | HOLDS |
| Q29 | a world-version change invalidates authorization | HOLDS |
| Q30 | reality and simulation cannot be merged into one state | HOLDS |
| Q31 | a branch parent cannot be mutated after deriving | HOLDS |
| Q32 | a poorly-calibrated model is demoted | HOLDS |
| Q33 | calibration never grants authority | HOLDS |
| Q34 | a correlation is never a certainty | HOLDS |
| Q35 | an unmeasurable blast radius is UNKNOWN | HOLDS |
| Q36 | blast radius accumulates uncertainty across edges | HOLDS |
| Q37 | the world digest is invariant to representation order | HOLDS |
| Q38 | a material change moves the world digest | HOLDS |
| Q39 | the event digest separates reality from simulation | HOLDS |
| Q40 | relation digests are domain-separated | HOLDS |
| Q41 | a counterfactual digest never equals reality | HOLDS |
| Q42 | temporal authorization requires a reality base | HOLDS |
| Scenario | Result |
|---|---|
| false_causality_correlation_not_cause | CONTAINED |
| false_causality_no_provenance | CONTAINED |
| false_causality_self_loop | CONTAINED |
| false_causality_unknown_relation | CONTAINED |
| false_causality_confidence_inflation | CONTAINED |
| false_causality_correlation_certainty | CONTAINED |
| false_causality_endpoint_unknown | CONTAINED |
| temporal_inversion_causes | CONTAINED |
| temporal_inversion_prevents | CONTAINED |
| temporal_before_violation | CONTAINED |
| temporal_after_violation | CONTAINED |
| temporal_during_violation | CONTAINED |
| temporal_overlaps_violation | CONTAINED |
| temporal_interval_invalid | CONTAINED |
| stale_causality_after_model_change | CONTAINED |
| stale_causality_after_world_change | CONTAINED |
| stale_causality_horizon_expired | CONTAINED |
| stale_causality_lease_expired | CONTAINED |
| stale_causality_branch_frozen | CONTAINED |
| stale_causality_auth_not_yet_valid | CONTAINED |
| event_substitution_payload | CONTAINED |
| event_substitution_branch | CONTAINED |
| event_substitution_duplicate | CONTAINED |
| event_substitution_class | CONTAINED |
| event_substitution_uncertainty | CONTAINED |
| event_substitution_timestamp | CONTAINED |
| graph_poison_cycle | CONTAINED |
| graph_poison_root_changes | CONTAINED |
| graph_poison_removes_event | CONTAINED |
| graph_poison_duplicate_relation | CONTAINED |
| graph_poison_correlation_laundering | CONTAINED |
| graph_poison_layer_confusion | CONTAINED |
| prediction_substitution_model | CONTAINED |
| prediction_substitution_world | CONTAINED |
| prediction_substitution_horizon | CONTAINED |
| prediction_substitution_certainty | CONTAINED |
| prediction_substitution_fact_flag | CONTAINED |
| prediction_substitution_unregistered_model | CONTAINED |
| counterfactual_promote | CONTAINED |
| counterfactual_authorize | CONTAINED |
| counterfactual_prediction | CONTAINED |
| counterfactual_merge | CONTAINED |
| counterfactual_executed_flag | CONTAINED |
| simreal_merge | CONTAINED |
| simreal_lease_from_sim | CONTAINED |
| simreal_digest_distinct | CONTAINED |
| simreal_prediction_from_sim | CONTAINED |
| simreal_event_layer | CONTAINED |
| simreal_branch_promotion | CONTAINED |
| model_drift_invalidates | CONTAINED |
| model_drift_demotes | CONTAINED |
| model_drift_blind_spots | CONTAINED |
| model_drift_degrading | CONTAINED |
| model_drift_no_authority | CONTAINED |
| model_drift_version_bind | CONTAINED |
| hidden_intervention_recorded | CONTAINED |
| hidden_intervention_no_reality_mutation | CONTAINED |
| hidden_intervention_requires_base | CONTAINED |
| hidden_intervention_branch_tagged | CONTAINED |
| hidden_intervention_digest | CONTAINED |
| state_rollback_version | CONTAINED |
| state_rollback_parent_mutation | CONTAINED |
| state_rollback_branch_digest | CONTAINED |
| state_rollback_event_removed | CONTAINED |
| state_rollback_variable_order | CONTAINED |
| state_rollback_lease_replay_after_consume | CONTAINED |
| future_injection_as_event | CONTAINED |
| future_injection_as_current | CONTAINED |
| future_injection_authorize | CONTAINED |
| future_injection_horizon | CONTAINED |
| future_injection_digest_mismatch | CONTAINED |
| provenance_forgery_source_swap | CONTAINED |
| provenance_forgery_evidence_removed | CONTAINED |
| provenance_forgery_status_lie | CONTAINED |
| provenance_forgery_chain_truncation | CONTAINED |
| provenance_forgery_no_source | CONTAINED |
| correlated_laundering_count | CONTAINED |
| correlated_laundering_confidence_sum | CONTAINED |
| correlated_laundering_blast | CONTAINED |
| boundary_missing_e8 | CONTAINED |
| boundary_missing_token | CONTAINED |
| boundary_binding_mismatch | CONTAINED |
| blast_unknown_edge | CONTAINED |
| blast_worst_case_on_high_uncertainty | CONTAINED |
| Step | Result |
|---|---|
| OBSERVATION | OK |
| TEMPORAL_STATE | OK |
| CAUSAL_RELATION | OK |
| PREDICTED_FUTURE | OK |
| COUNTERFACTUAL | OK |
| CAUSAL_BLAST_RADIUS | OK |
| CONSEQUENCE | OK |
| GOVERNED_DECISION | OK |
| REALITY_UNCHANGED | OK |
| CALIBRATION_EVIDENCE | OK |
Status: TESTED, PRE-PRODUCTION, no third-party review, ephemeral signing key. Evidence class: in-process reference run, not a real-world deployment.