From evidence to consequence, without hiding the transitions.

01 · Model structure

Path ontology

A record contains one vulnerability assessment. A record contains one or more paths. A path contains ordered causal steps: entry or boundary, capability or transition, terminal consequence, and recovery. Every step declares its epistemic basis and any evidence references.

The public families are authority, perception, privacy, safety, systemic, and recovery. Terminal types remain more specific than families.

• DEVICE_CONTROL_SAFETYPhysical action or therapy
• PERCEPTION_TO_ACTIONFalse perception drives action
• FIRMWARE_TRUST_ROOTFirmware, signing, or trust root
• FLEET_CONTROL_PLANECloud, account, or fleet authority
• ACCOUNT_AUTHORITYAccount or administrative authority
• DATA_PRIVACYData or privacy only
• PERCEPTION_PRIVACYSensor or representation privacy
• DEVICE_AVAILABILITYAvailability or recovery
• OBSERVABILITY_RECOVERY_ONLYObservability or forensic recovery only

02 · Explained values

Metric fields

The nine design requirements on the About page are not metrics. These thirteen fields are the public vector vocabulary. On each record, every value is presented as a separate visual fact with a human-readable rationale specific to that path. The compact technical vector remains available as secondary machine notation.

03 · Aggregation

Scoring rules

EX = min(RE, EC). The intrinsic band is the maximum of the physical/safety, data/perception, and authority matrix results. Perception-to-action uses its own data matrix. Active exploitation may promote once; bounded caps and a separately justified systemic uplift are then applied.

The explanation layer does not change the published scoring rules. It makes the stored metric judgments and the base-to-final decision trail inspectable; it is not a new scoring input or an independent validation of those judgments.

04 · Bounded behavior

Caps and bounded modifiers

• Observability-only cap. A recovery/observability deficiency with no meaningful physical or authority path is capped at ELEVATED.
• Low-exposure cap. EX 0–1 is capped at CRITICAL unless fleet execution or active exploitation changes the evidence.
• Privacy-only cap. A privacy terminal without perception-to-action, material authority, or scale is capped at HIGH.
• Deployment realizability. An independently bounded physical path may be capped at MONITOR or HIGH.
• Systemic uplift. SYS 3–4 can add at most one band, and only with active exploitation, fleet-recovery evidence, or another explicit strong condition.

05 · Record verdict

Dominance

The record verdict is the highest path band. If one path reaches that band, its role is dominant. If several paths tie at the top band, all are co-dominant. Every other path is supporting. The corpus stores dominant_path_ids and a plain-language dominance reason; array order never breaks a tie.

06 · Claim boundaries

Evidence semantics

EV expresses evidence strength in the vector. Review state separately records whether citations, path reasoning, or the complete record received independent human review.

07 · Worked record

Worked example: CPATH-2026-0023

The fleet-control-plane path is dominant because documented peer scanning can reuse the shared key across in-range robots, producing the only fleet-scale EMERGENCY path; motion and privacy remain supporting CRITICAL paths.

1. 01
   Source-backed

   Seed robot compromised over BLE

   The cited records describe BLE-adjacent access that can cross the shared-key authentication boundary and obtain root on an affected seed robot.

2. 02
   Source-backed

   Reusable peer propagation

   The research record describes a compromised robot scanning for in-range peers and reusing the shared key to infect them; this is peer propagation across nearby robots, not proof of Unitree cloud control.

3. 03
   Model inference

   Repeatable root across peers

   Automated peer scanning removes the need for the attacker to approach every robot personally, so the model assigns fleet-scale reuse and execution to an in-range deployment.

4. 04
   Model inference

   Fleet control plane

   Repeated root compromise can aggregate control, sensing access, and safety exposure across multiple mobile robots. EMERGENCY denotes that reachable deployment consequence, not confirmed exploitation in the field.

5. 05
   Operational assumption

   Fleet-wide remediation

   Recovery requires fleet-wide firmware remediation and coordinated verification because any unpatched peer left in range can preserve the propagation condition.

08 · Claim boundary

Validation status

v1.0-candidate is not an accuracy claim. The human-readable rationale explains the candidate assessment; it does not prove the path or revalidate the band. The public scorer packet and review template make the next validation work executable.