CARVE：基于包络的交互式驾驶中被否决操控的认证经济性修复

摘要

交互式驾驶暴露了一种在规则感知的自动驾驶系统中容易忽视的失效模式：即使无优先权的代理做出微小的合法让步可以恢复可行性，自车候选动作的硬规则裕度仍可能为负值。现有的规则手册、防护屏障和可达性过滤器能有效否决不安全动作，而基于预测的规划器则用于建模最可能的响应。但两者均无法返回运行时证明对象，该对象需说明：哪些有界多方编辑可修复机动操作、编辑归属于谁、请求是否具有路权可负担性、以及若请求未被遵守时自车可执行何种冗余方案。我们将这一缺失对象形式化为**交互修复认证**，并提出**CARVE**——一种基于有限格结构（由自车和他人所有战术算子构成）且无需预测的证书层。他人所有请求仅在合作包络 \(B_j(s) = β(π_j)α_j^{\max}(s)\) 内允许，该包络将运动学可达性与规范性优先级分离。生成的证书记录了绑定规则、修复类别、修复集合、责任加权成本分摊及冗余方案。在589个基于Lanelet2几何的INTERACTION回放场景中，CARVE-Greedy接受了98.64%最初被否决的机动动作，恢复了370/378个人类判定的错误否决，同时保持589/589次路权尊重、零优先代理误报和400/400次负压力否决。我们证明了证书的可靠性、结构性路权尊重、精确有限格极小性、冗余应急方案及责任一致性条件。CARVE不预测也不要求他人司机遵守规则；它仅认证在声明假设下，所提议的交互是否具有有界性、可归因性及规范性可接受性。

English

Interactive driving exposes a failure mode that is easy to miss in rule-aware autonomous-driving stacks: a hard-rule margin can be negative for an ego candidate even though a small lawful accommodation by a non-priority agent would restore feasibility. Existing rulebooks, shields, and reachability filters are strong at vetoing unsafe actions, while prediction-based planners model likely responses. Neither returns a runtime proof object that states which bounded multi-agent edit repairs the maneuver, who owns the edit, whether the request is right-of-way affordable, and what ego fallback remains if the request is not observed. We formulate this missing object as *interactive repair certification* and introduce *CARVE*, a prediction-free certificate layer over a finite lattice of ego-owned and agent-owned tactical operators. Agent-owned requests are admissible only inside \(B_j(s) = β(π_j)α_j^{\max}(s)\), a cooperation envelope that separates kinematic reachability from normative priority. The resulting certificate records the binding rule, repair category, repair set, responsibility-weighted cost split, and fallback. On 589 Lanelet2-geometry-grounded INTERACTION replay episodes, CARVE-Greedy accepts 98.64% of initially vetoed maneuvers and recovers 370/378 human-resolved false vetoes, while preserving 589/589 right-of-way respect, zero priority-agent false positives, and 400/400 negative-stress vetoes. We prove certificate soundness, structural right-of-way respect, exact finite-lattice minimality, fallback contingency, and blame-consistency conditions. CARVE does not predict or require another driver's compliance; it certifies whether a proposed interaction is bounded, attributable, and normatively admissible under declared assumptions.