A verifiable clearance boundary between frontier models and physical execution.
Frontier models now propose experiments and drive automated labs. Before a proposed step becomes matter, the executor should require one thing: proof that every authority it trusts agreed on this exact model, protocol, material, facility, and human approver, and that no second clearance is granted. Model-to-Matter is that gate. It composes with screening and safety review; it does not replace them.
Status: reference profile, pinned executor, adversarial demonstration, and published Experimental Internet-Draft -00, July 2026. This profile has not been deployed in a wet lab and claims no commercial or research partnership.
Existing controls answer six questions. The executor still needs the seventh.
Each of these is real, and each is answered by a different party at a different time:
A structurally valid proposal is not permission to execute.
The demonstration runs three outcomes against a synthetic, benign executor. Legitimate evidence clears the exact action once; mutation and replay refuse.
Model-to-Matter is safety-process enforcement, not scientific safety expertise.
It proves that an executor applied its pinned clearance process to one exact action and admitted at most one clearance. It does not prove the process was scientifically correct, that execution succeeded, or that no physical path bypassed the gate.
- A named, accountable human authorized this exact action, under a device-bound ceremony.
- Every evidence leg the executor pinned was present, fresh, and bound to the same action digest.
- At most one clearance was granted. Two challenges cannot each clear the same action.
- The signed evidence and executor statement remain verifiable offline under relying-party-pinned keys; current revocation and consumption still require their authenticated state sources.
- That the experiment is scientifically safe. If every pinned authority approves something dangerous, the gate cannot independently discover that.
- That a sequence was screened. A screening leg reports only what a pinned external screening service signed. Model-to-Matter does no screening itself.
- That an authority judged correctly. An accepted signature proves what a pinned issuer stated, not that the statement was right.
- Physical truth. An effect statement proves what the executor signed, not that its sensors were honest.
- Observer independence or complete coverage. Distinct pinned keys and declared control domains do not prove ownership independence or exclude an unobserved execution path.
Complete mediation.
The guarantee holds only under one condition: every protected execution path must traverse the gate. If the executor is the sole route to physical action, as a cloud lab or a synthesis provider is for its own instruments, then the clearance is authoritative. If a step can execute around the gate, the guarantee narrows to the paths that went through it.
This is the standard reference-monitor requirement, stated plainly: the gate is useful exactly to the degree that it mediates completely. Model-to-Matter makes the mediated decision portable and offline-verifiable. It does not, by itself, prove that no unmediated path existed.
An AND over six signed facts, joined by one action digest.
The executor pins each issuer key and requires all six. Each artifact is domain-separated, Ed25519-signed, bound to the exact action digest, and time-bounded. The executor owns the acceptance profile and cannot be talked into weakening it.
The adapters carry no raw material. Sequences, FASTA, protocol text, prompts, and reasoning traces are forbidden; an evidence leg carries a signed commitment, not the payload. The server computes the action digest, so a presenter cannot choose it.
The refuse side is the security claim.
Every refusal below is exercised in the public test contract, not asserted.
| Attack | What the gate does |
|---|---|
| Missing evidence | The graph is short a required leg (no screening, no biosafety sign-off). Refuse, and return a machine-readable follow-up naming only what is missing. |
| Action mutation | A field changes after clearance. The server-computed action digest changes, so the clearance stops matching. Refuse. |
| Issuer substitution | An evidence artifact is signed by a key the executor never pinned, or an issuer identity is swapped. Refuse. |
| Revocation / expiry | An evidence leg is revoked or expired, or revocation state is simply absent. Absence fails closed. Refuse. |
| Concurrent replay | The same action is presented twice at once, or across two independently issued challenges. At most one clearance wins; the rest refuse. |
Read it, run it, break it.
For cloud labs, synthesis providers, and lab-automation platforms: return the challenge before your instruments act, and refuse anything that has not cleared. A pilot needs adapters, not replacement systems.
Pilot the gate