arXiv:2607.28756v1 [cs.NI] 30 Jul 2026
Sovereign Cognitive Digital Twins: Fusing 6G ISAC, AI-RAN, and Zero-Trust Edge Grids for National Resilience in the Global South Zoe Aiyanna M. Cayetano
George M. Gichuru
Taijuo T. Morris
Amini Bridgetown, Barbados [email protected]
Amini Bridgetown, Barbados [email protected]
Amini Bridgetown, Barbados [email protected]
Abstract—Climate-hazard-prone archipelagic and small-island developing states (SIDS) confront an existential risk profile— accelerating sea-level rise, intensifying tropical cyclones, and storm surge—while simultaneously suffering the sparse groundbased instrumentation that makes timely hazard perception difficult. This paper argues for a paradigm shift from passive cellular connectivity to the Network as a Sensor (NaaS), realized through a Sovereign Cognitive Digital Twin (S-CDT): a federated national digital twin whose perceptual substrate is the 6G radio interface itself. Rather than deploying expensive, disjoint environmental sensing systems, a vulnerable nation can reuse the Integrated Sensing and Communication (ISAC) waveforms of its own network as a distributed radar mesh, feeding a closedloop cognitive orchestration engine for real-time state estimation, predictive hazard forecasting, and automated mitigation. We ground the architecture in the federation lessons of existing national and urban digital twin programs, Virtual Singapore and Destination Earth, and in the Gemini Principles governance framework; we specify a six-layer S-CDT stack in which ISAC structurally collapses the boundary between the dynamic-data and communication layers; we map the physical layer to the ETSI GR ISC 001 and 3GPP Release 19 sensing frameworks; and we formulate a belief-state control loop—an Extended Kalman Filter feeding a Proximal Policy Optimization agent—designed to absorb O-RAN telemetry delay. The control loop is specified but not evaluated here; it is a design contribution, not a deployed or simulated result. Beyond the reference architecture, we implement a reproducible, CPU-only geodata-to-ray-tracing pipeline over a 2 km study area at the Barbados Heritage District, Newton Plantation: 576 LiDAR-height buildings, a 70×70 terrain grid, and the government tower register are transformed through Blender into a Sionna RT scene. On identical geometry, median best-server path gain decreases from −106 dB at 1.8 GHz to −122 dB at 10 GHz, and concrete-only 28/60 GHz runs yield −130/ − 136 dB with coverage contracting to line-of-sight lobes. Ground-following maps additionally resolve ridge shadowing that a horizontal receiver plane cannot represent, though we quantify this effect at under 1 % of the study area and correct an earlier receiver-plane discretisation that overstated it. These uncalibrated, 1×1 V-polarized simulations are explicitly framed as a towards-6G site model of Hbackground , not as an operational ISAC deployment. Finally, we treat data sovereignty and physical-layer zero-trust security as first-order design constraints, proposing subsystem disaggregation, cross-layer anomaly detection, and privacy-tiered waveforms. Barbados (166 km2 , ∼280k population) is used as a tractable reference deployment, with the Philippines as an archipelagic generalization.
Index Terms—digital twin, 6G, integrated sensing and communication (ISAC), AI-RAN, deterministic ray tracing, radio propagation, climate resilience, small island developing states, zero-trust, data sovereignty.
I. I NTRODUCTION A. The Climate Existential Threat Archipelagic and small-island developing states occupy the sharp edge of anthropogenic climate change. For nations such as Barbados in the Caribbean and the Philippines in the western Pacific, sea-level rise, coastal erosion, and the intensification of typhoons and storm surge are not distant projections but presenttense determinants of national survival, economic continuity, and population safety [1], [2]. These same nations are, in general, the most weakly instrumented: dense networks of tide gauges, weather radar, and hydrological sensors are capitalintensive to deploy and, critically, fragile precisely during the extreme events for which they are most needed. The result is a perception gap—decisions with hours-to-minutes stakes made on data with hours-to-days latency. Our prior work addressed the complementary problem of keeping the bearer network itself alive through such events, via database-free TV white space sensing for disaster-resilient connectivity in SIDS [20]; the present paper asks what that network, once it exists, can be made to perceive. B. A Paradigm Shift: The Network as a Sensor We propose closing that gap not by multiplying dedicated sensors but by re-conceiving infrastructure the nation is already motivated to build. The transition from fifth- to sixthgeneration mobile networks introduces Integrated Sensing and Communication (ISAC), in which the radio interface that carries data simultaneously performs radar-like sensing of its environment [7], [9]. Under this Network as a Sensor (NaaS) paradigm, every base station is also an environmental instrument, and the coverage footprint of the network becomes the sensing footprint of the nation. C. Thesis and Contributions Our thesis is that vulnerable nations can deploy a unified Sovereign Cognitive Digital Twin (S-CDT) that uses the 6G
radio interface as a continuous perceptual nervous system, providing real-time modeling, predictive hazard forecasting, and closed-loop disaster mitigation, under national sovereign control of models and data. This paper contributes: (i) a federated S-CDT reference architecture aligned with established nationaldigital-twin governance (§II); (ii) a six-layer stack in which ISAC collapses the dynamic-data and communication layers (§III); (iii) a standards-grounded treatment of the physical sensing layer (§IV); (iv) the integration of an established beliefstate control pattern [21] into a sovereign twin, formulated to tolerate RAN telemetry delay and constrained to on-territory execution (§V); (v) a sovereign, physical-layer zero-trust security and privacy design that composes published multidomain-security [24] and ISAC-privacy [22] primitives into a national access-control boundary (§VI); and (vi) a reproducible CPU-only, authoritative-geodata-to-Sionna pipeline with quantified simulation results that upgrades the deployed RF layer from stochastic national planning to deterministic site studies (§VIII-I). We are explicit about where the novelty in this list does and does not lie. Contributions (iv) and (v) claim no new estimator, policy, or cryptographic primitive: the belief-state formulation is due to Tiwari et al. [21], the privacy-level taxonomy to Günlü et al. [22], the multi-domain security framing to Keskin et al. [24], and the compression theory that §V defers to, to Pan et al. [23]. What is ours in (iv) and (v) is the composition— placing those mechanisms under a single national sovereignty boundary—and that composition is specified here, not evaluated. The contributions that rest on work performed for this paper are (i), (ii), (vi), and the sovereignty argument that motivates them. II. G ROUNDING THE BASELINE : T HE NATIONAL D IGITAL T WIN PARADIGM A. The Federated Architecture The single most consequential design decision is to reject the monolith. The UK National Digital Twin Programme’s central, hard-won lesson is that a national twin is not one model of everything but a federated ecosystem of domain-specific twins, connected through shared identifiers, open standards, and a common trust framework [3], [4]. Federation is what makes the system buildable incrementally, governable across institutional owners, and resilient to the failure or replacement of any single component. B. Governance via the Gemini Principles We structure S-CDT governance around the nine Gemini Principles [4], grouped as: • Purpose—public good, actionable insight, and measurable economic and climatic value. • Trust—security by default (here elevated to zero trust), transparent data provenance, and high-quality validation. • Function—federated interoperability, scalability, and longterm evolutionary capability. For a sovereign deployment the “trust” cluster is load-bearing: the twin’s outputs must be defensible enough to justify
evacuations and to underwrite climate finance, which demands auditable provenance rather than best-effort data hygiene. C. The Design Brackets Two operational national/urban twins bracket the design space. The built-environment bracket is Virtual Singapore (Dassault Systèmes with GovTech, SLA, and NRF): a semantically rich 3D model fused with live smart-nation sensor feeds, driving micro-mobility, solar-potential, and flood simulation [5]. The earth-system bracket is Destination Earth (DestinE) of the European Commission, with ESA, EUMETSAT, and ECMWF: planetary climate-adaptation and extreme-events twins running on high-performance-computing architectures over a multisource data lake [6]. The S-CDT merges the brackets—islandscale built-environment fidelity coupled to earth-system climate dynamics—and adds the 6G shift that neither exemplar yet exploits: the connecting network is itself the primary real-time sensor, redefining the boundary of “live data.” III. T HE U NIFIED S-CDT L AYERED S TACK AND THE ISAC T RANSFORMATION A. The Core Stack The S-CDT is organized as six layers over a vertical trustand-governance spine: 1) Geospatial Ground Truth—high-resolution terrain, bathymetry, building envelopes, and critical utility networks. Barbados’s 166 km2 area and ∼280k population make complete, high-fidelity national modeling extraordinarily tractable relative to a large state. 2) Systems of Record—dynamic registries of land, business, population, and infrastructure assets. 3) Dynamic Data / Nervous System—fusion of satellite Earth Observation, IoT telemetry, and the 6G ISAC radio-sensing network. 4) Simulation and Surrogates—physics-based hydrology and coastal hydrodynamic models, statistical agent-based evacuation models, and deep-learning surrogate models for real-time ray-tracing and wave propagation. 5) Synchronization Engine—reconstruction of current-time state estimates from dynamic physical telemetry. 6) Interaction and Orchestration—generative-AI naturallanguage query interfaces, executive dashboards, and automated control-API pipelines. B. The ISAC Structural Fusion In the classical layered view, the communication infrastructure is plumbing that transports data produced by a physically separate sensing layer. ISAC dissolves this separation: the physical radio waves of the network double as a distributed radar mesh, so the Dynamic-Data Layer and the communication infrastructure become one substrate [8], [9]. Sensor deployment as a distinct capital program becomes largely obsolete; instead, sensing is a software-and-spectrum function of the network the nation deploys for connectivity. For an operator-integrator this collapses three roles into a single asset—the network is simultaneously (a) physical infrastructure the twin models,
(b) the backbone that carries twin data, and (c) the distributed sensor that feeds the twin. IV. T HE N ETWORK AS THE P ERCEPTIVE N ERVOUS S YSTEM : P HYSICAL L AYER AND S TANDARDS A. Dual-Function Radar-Communication At the physical layer, ISAC is realized as Dual-Function Radar-Communication (DFRC): a 6G base station uses shared spectrum and shared hardware to transmit a waveform that simultaneously delivers high-throughput data and yields radargrade observables—range, angle (angle-of-arrival), radial velocity (Doppler), and micro-structure—by processing echoes and multipath. The ISAC propagation channel is conveniently decomposed as
normal UT–aerial UT, vehicle UT–vehicle UT, and aerial UT– aerial UT [13]. The two enumerations are complementary rather than competing: the ETSI modes classify sensing geometry by where the transmitter and receiver sit relative to one another, while the 3GPP links enumerate the node-type pairings a channel model must cover. Sensing spans FR1, the emerging FR3 mid-band, and FR2 mmWave, trading coverage against range/velocity resolution. Release 20 continues the architecture study. C. Climbing the Sensing Maturity Ladder
Each environmental sub-twin climbs the maturity ladder independently—Descriptive → Diagnostic → Predictive → Prescriptive → Autonomous—with the predictive-and-above rungs driven natively by edge AI and network sensing. Three HISAC = Htarget + Hbackground , (1) exemplar capabilities: a) Moving-object detection.: Coordinated, multi-static where Htarget captures returns from dynamic sensing targets tracking of non-cooperative aerial hazards (unregistered drones and Hbackground models the quasi-static environment [12], over critical infrastructure) and prioritization of emergency [13]. Estimating and subtracting a learned background is vehicles, using Doppler signatures without requiring the target precisely what lets the network isolate a moving hazard— to carry a device. b) Environmental and weather mapping.: Hyper-local or a weather cell—from clutter. This additive form is a deliberate simplification for architectural exposition, and we rainfall estimation inferred from frequency-specific attenuation. use it only as such. The Release 19 model is substantially Specific attenuation follows the ITU-R power law richer: the target term is built from concatenated sub-channels γR = k Rα [dB/km], (2) over monostatic and bistatic radar-cross-section scattering points, and the background term from a reference-point-based with rain rate R and band-dependent coefficients k, α [14]; the geometry-based stochastic model carrying its own angular path integral of γR is observable as excess attenuation in the and delay spreads [13]. Nothing in the architecture below channel state, so mmWave/FR3 links act as a dense mesh of depends on the simplified form; a Release 19-conformant virtual rain gauges [15], enabling flash-flood and track-washout implementation would substitute the full extended-GBSM prediction well below the resolution of sparse ground radar. formulation without structural change. c) Radio-environment analysis.: Continuous RF fingerprinting and multipath-delay-profile indexing dynamically B. Standardization Milestones update the local clutter map that constitutes Hbackground , ETSI. The ETSI ISG ISAC group’s first report, GR ISC 001 both improving sensing and providing a change-detection (April 2025), establishes 18 advanced use cases, three inte- channel in its own right. The Newton implementation in §VIII-I gration levels (tight, intermediate, and loose), and six sensing instantiates the static, site-specific baseline for this quantity: modes for 6G sensing [9]; subsequent reports (e.g. GR ISC 003, deterministic geometry, material labels, terrain, tower locations, 2026) address system and RAN architectures [10]. (We note a and resolved paths become the background model against which common mis-citation: the 18-use-case report is GR ISC 001, not future CSI/ISAC observations can detect change. GR ISC 004.) The six modes are defined by transmitter/receiver D. Path Loss and Material-Aware Attenuation placement: In Sionna RT, path loss in the SCOPE model uses free• Monostatic: TRP-based (Tx/Rx co-located at a space path loss (FSPL) as a baseline for each individual ray transmission-reception point) and UE-based. to determine its attenuation, and combines this with material • Bistatic: TRP→TRP, TRP→UE, UE→TRP, and UE→UE. reflections to calculate total path loss: Where this paper refers to “the six sensing modes,” it is this ETSI taxonomy that is meant. P Ltotal = F SP L + Lmaterial + Lother (3) 3GPP. Release 19 (study concluded May 2025) specifies wireless sensing use cases in TR 22.837 and extends the where P Ltotal is the total path loss, Lmaterial is the loss TR 38.901 channel model for ISAC [11], [12]. Its channel- introduced by the ray interacting with a material, and Lother model work does not adopt the ETSI six-mode taxonomy. is any additional loss the ray experiences. All terms are in dB. It instead categorizes ISAC transmitters and receivers into FSPL is calculated as [25]: four node types—TRP, normal UT, vehicle UT, and aerial F SP LdB = 20 log10 (d) + 20 log10 (f ) + 32.44 (4) UT—and enumerates the nine propagation links these pairings generate: TRP–TRP, TRP–normal UT, TRP–vehicle UT, TRP– where d is the distance in kilometers and f is the frequency aerial UT, normal UT–normal UT, normal UT–vehicle UT, in MHz.
a) MAPL and model connection.: While total path loss with Ft = ∂f /∂x|x̂t−1|t−1 . To absorb a measurement delay captures the loss incurred over a link, whether that link is τ , the update fuses the delayed observation zt−τ against the actually usable depends on the system’s tolerance for loss— correspondingly retrodicted state, captured by the maximum allowable path loss (MAPL). A link −1 ⊤ remains viable only where P Ltotal ≤ M AP L; beyond this Kt = Pt|t−1 H⊤ , (7) t Ht Pt|t−1 Ht + Rt threshold, connectivity between UEs fails due to insufficient x̂t|t = x̂t|t−1 + Kt zt−τ − h(x̂t−τ |t−1 ) . (8) signal strength. For the distributed radar mesh, this threshold effectively sets a maximum node spacing and determines where The resulting belief st = (x̂ , P )—the mean estimate t|t t|t coverage gaps emerge. together with its covariance—is a sufficient statistic that explicitly carries the controller’s uncertainty into the decision. V. C LOSED -L OOP C OGNITIVE O RCHESTRATION : AI-RAN AND B ELIEF -S TATE C ONTROL C. Reinforcement-Learned Orchestration Scope note. This section specifies the cognitive layer of the A Proximal Policy Optimization (PPO) agent would map the reference architecture. None of it is deployed: the belief-state belief state to control actions at —beamforming power, sensing estimator, the reinforcement-learned orchestrator, and the edge dwell/scan allocation, and mode selection across the six ISAC compression stage are roadmap Phases 3 and 4 (§VIII-M), and modes—maximizing the clipped surrogate objective the equations below are design formulations that have not been h i evaluated on the Barbados deployment. Section VIII reports CLIP L (θ) = E min ρ (θ) Â , clip(ρ (θ), 1 − ϵ, 1 + ϵ) Â , t t t t t what is actually running. (9) with probability ratio ρt (θ) = πθ (at | st )/πθold (at | st ) and A. AI-RAN Convergence advantage estimate Ât . The reward balances the competing Perception without timely action is merely telemetry. The objectives of a shared sensing/communication resource, design distributes intelligence into the Radio Access Network itself: model training via federated learning across sites (keeping rt = α Asens + β Tcomm − γ E − δ Rsec , (10) raw observations local), and inference at the O-RAN NearReal-Time and Non-Real-Time RAN Intelligent Controllers rewarding sensing accuracy Asens and communication through(RICs) [16]. The Non-RT RIC would host the digital-twin put Tcomm while penalizing energy E and residual security models and policy learning; the Near-RT RIC would execute risk Rsec . The intended behavior is that under an active-hazard low-latency control (beam and resource allocation) as an xApp. regime the learned policy shifts resource toward tracking, while under nominal conditions it favors throughput. No policy has B. Belief-State Control under Telemetry Delay been trained; verifying that this reward shaping induces the The central control obstacle is delay: O-RAN telemetry can intended behavior is future work. reach the controller tens of milliseconds late (up to ∼100 ms), so the instantaneous measurement is a stale view of a fastmoving hazard field. The design therefore controls on a belief state rather than raw observations. The belief-state pattern for this problem is established prior work, and we adopt it rather than propose it. Tiwari et al. give a digital-twin-assisted belief-state reinforcementlearning formulation for latency-robust ISAC in the same ∼100 ms O-RAN telemetry-delay regime, pairing a filtered state estimate with a learned policy, and—unlike this paper— report a quantitative evaluation of it [21]. What we set out below is that formulation placed inside a sovereign twin: the estimator and the policy are constrained to execute on onterritory compute (§VI), the observation vector is a national hazard field rather than a vehicular or cellular scene, and the reward carries an explicit sovereignty and security term. The formulation itself is theirs. An Extended Kalman Filter (EKF) hosted inside the twin would maintain an estimate of the latent environmental and network state xt . The prediction step is x̂t|t−1 = f (x̂t−1|t−1 , ut ),
(5)
Pt|t−1 = Ft Pt−1|t−1 F⊤ t + Qt ,
(6)
D. Edge Observation Compression Multi-static sensing produces high-dimensional 3D point clouds that would saturate rate-limited emergency backhaul exactly when links are degraded. The design applies an autoencoder (AE) at the gNodeB for dimension reduction: an encoder fϕ maps a point cloud P to a compact code z = fϕ (P), transmitted in place of the raw cloud and reconstructed by gψ at the core, trained to minimize LAE = dCD P, gψ (fϕ (P)) + λ∥z∥1 ,
(11)
where dCD is the Chamfer distance and the ℓ1 term encourages a sparse, low-rate code. The intent is to preserve hazard-relevant geometry under a strict backhaul budget; the achievable ratedistortion trade-off is left to future work. We note that the theory this defers to already exists: Pan et al. characterize observation compression in rate-limited closed-loop distributed ISAC systems, carrying the analysis from signal reconstruction through to control performance [23]. Their results, rather than a fresh derivation, are the appropriate baseline against which any S-CDT compression stage should be evaluated.
VI. S OVEREIGN DATA P ROTECTION AND P HYSICAL -L AYER Z ERO T RUST A. The Sovereign Compute Grid A twin that governs evacuations and underwrites climate finance is national critical infrastructure. Climate-vulnerable nations must therefore retain sovereign control of AI weights, models, and spatial telemetry rather than renting perception from external cloud monopolies. The S-CDT is designed for an on-territory sovereign compute grid—edge inference at the RAN, national core for training and archival—so that both the raw sensing of the population and the learned models derived from it remain under domestic jurisdiction. This is also a resilience property: sovereign edge autonomy keeps the twin operating when international connectivity is severed by the very disaster it must manage. The CPU-only propagation workflow in §VIII-I demonstrates this principle concretely: its Mitsuba LLVM backend requires neither CUDA nor an external cloud service, while a GPU runbook remains an optional scale-up path. B. Zero-Trust Subsystem Disaggregation Because a network that senses the nation makes its own compromise a national-security event rather than a service outage, the design adopts a disaggregated trust model in the spirit of OPPO’s “Minimized Kernel + N Subsystems” 6G architecture [17], [18]: a minimal, formally hardened kernel would provide base connectivity, while sensitive functions—nationalsecurity sensing, emergency services, and the environmentalsensor plane—would run as isolated subsystems with independent trust domains. The intended property is that no plane implicitly trusts another, so that the environmental-sensing plane cannot be pivoted into from a compromised consumerdata plane. No such subsystem isolation exists in the current deployment, which runs as a single trust domain; §VIII-D reports what is enforced today.
D. Privacy-by-Design Waveforms NaaS sensing is powerful and politically sensitive: the same channel that maps topography can, at fine resolution, read human behavior. We adopt the three-level classification of privacy-sensitive ISAC data introduced by Günlü et al. [22], who organize it into location and environment data, behavioral data, and physiological data, and survey the corresponding mitigations. Using their levels as our privacy tiers—L1 Environmental (terrain, hydrology, weather), L2 Behavioral (aggregate mobility, presence), and L3 Physiological (fine micro-Doppler, e.g. respiration/gait)—we attach escalating consent and access controls to each and bind them to the sovereignty boundary of §VI. The taxonomy is theirs; what we add is its use as an access-control boundary inside a nationallygoverned twin. To enforce the boundary at the physical layer, the design injects calibrated noise into the reported CSI, H̃ = H + N,
N ∼ P σbeh ,
(12)
where P is designed to destroy the high-frequency microDoppler components that carry behavioral/physiological signatures while preserving the low-frequency structural returns needed for topography and weather sensing. The design goal is a network that delivers high-resolution environmental perception at L1 while being unable to export L2/L3 signatures without explicit, tier-appropriate authorization. We state this as a design target rather than a guarantee: establishing the leakage bound for a given P, and the resulting privacy-versus-sensingutility trade-off curve, is future work (§VIII-M). In the current deployment only L1 data is served, so no L2/L3 export path yet exists to gate. VII. D EPLOYMENT B LUEPRINT: BARBADOS AND THE A RCHIPELAGIC G ENERALIZATION
We propose a minimum viable twin that proves the full vertical slice on a single existential question before federating outward. Its components: (1) a national basemap C. Cross-Layer Anomaly Detection bootstrapped from Earth-observation foundation models; (2) Physical-layer observables are themselves a security sensor. at least one network-derived live feed—microwave-link/CSI The general case for this is made by Keskin et al., who set out rainfall—designed ISAC-ready, alongside a tide/weather feed; a multi-domain security framework for 6G ISAC spanning the (3) one predictive model (coastal inundation under a parametric cyber-physical, physical-layer, and protocol domains, and argue storm scenario) driven by the live rainfall field; (4) a generative that cryptographic protocol mechanisms alone cannot detect natural-language query interface for decision-makers; and lower-layer attacks [24]. We follow that framing and apply it (5) node and sensor attestation plus data provenance on a to a national environmental-sensing plane rather than to their sovereign ledger to make outputs finance- and evacuationtransportation setting: fusing angle-of-arrival (AoA), Doppler grade. Federation then proceeds domain by domain—economy shift, and channel state information (CSI) with higher-layer and tourism next, coupled to the climate twin through networkprotocol state to detect physical-layer attacks that are invisible derived mobility—while every newly deployed base station above the PHY—signal spoofing, GNSS/GPS jamming, and is specified ISAC-ready so the sensing mesh densifies as tampering with Reconfigurable Intelligent Surfaces (RIS). A a byproduct of connectivity roll-out. Barbados serves as a spoofed transmitter that is protocol-correct but geometrically bounded, high-fidelity reference; the Philippines generalizes the impossible (inconsistent AoA/Doppler for its claimed identity) design to a multi-thousand-island archipelago where inter-island would be flagged by such a cross-layer detector. No detector non-terrestrial (satellite) ISAC and edge autonomy become of this kind is implemented in the current deployment. decisive.
Fig. 1: The S-CDT reference architecture: a six-layer stack over a vertical zero-trust and integrity spine. This figure depicts the target architecture, not the current deployment. In the target design, sensing (Network-as-a-Sensor) would feed the Amini GeoPackage engine producing spatio-temporal data cubes; cubes would be sharded across the Amini Cloud (decentralized compute infrastructure) node network and anchored on Amini Chain (a private, off-chain ledger for content hashing, provenance, and node attestation); a zero-trust integrity gate would admit only verified cubes to the Amini Origin national sovereign data lake (termed “Bajan-X” in the Barbados deployment); and orchestration would close the loop back to the sensing layer. Of these elements, the ingest, cube-store, catalog, and interaction paths are built; the ISAC feed, the ledger anchoring, the cryptographic admission gate, the belief-state synchronization engine, and the AI-RAN control loop are not yet implemented. Table I and Table III state the built/designed split precisely, and §VIII-M gives the phasing.
VIII. BARBADOS I MPLEMENTATION AND T OWARDS -6G P ROPAGATION R ESULTS The preceding sections describe the target S-CDT. This section reports what has actually been built to date on the Barbados deployment, inside the Ulap SCOPE application (a connectivity network planner built on Sionna RT). Terminology. Two distinct systems in this work are both properly called digital twins, and we name them separately throughout. The national twin is the infrastructure and hazard twin built by twin_ingest and served by twin_service over /api/v1/twin/*: authoritative government layers,
buildings, utilities, and vulnerability grids. The RF scene twin is the deterministic ray-tracing scene twin: Blender geometry solved in Sionna RT to produce propagation predictions. They share the same sovereign source contract and the same provenance chain, but they are different artifacts with different maturity levels, and a claim about one is not a claim about the other. Measured against the sensing-maturity ladder of §IV, the national twin sits at the descriptive/diagnostic rungs: it renders the nation and its exposure and joins hazard return-periods to assets. The Newton propagation component now adds an
uncalibrated predictive simulation rung through deterministic ray tracing, but the deployment does not yet ingest ISAC measurements or run the EKF/PPO cognitive loop. Figures 3–9 provide compact visual evidence of the implemented planning, provenance, inspection, interaction, and multi-source fusion workflows; Figures 10–14 report the deterministic propagation outputs. A. Mapping the deployment to the reference stack Figure 1 shows the end-to-end sovereign dataflow; Table I maps the conceptual six-layer stack of §III to the deployed system. The build realizes geospatial ground truth, systems of record, conventional dynamic feeds, deterministic RF simulation, and the interaction surface. Belief-state synchronization, active ISAC sensing, ledgered trust, and closed-loop orchestration remain scheduled (§VIII-M).
D. Zero-trust governance: target versus enforced The governance model follows §VI and the Gemini Principles: sources untrusted by default, provenance mandatory rather than best-effort, tiered privacy, and sovereign custody. Table III states honestly what is enforced today against the target. Source attribution, structural integrity validation (CRS enforcement, null and degenerate-geometry drops, non-finite sanitization), propagation-stage validation, and labeled graceful degradation are shipped; cryptographic content-hashing and on-chain node attestation are the first governance work item on the roadmap. Today the twin serves only L1 (environmental) data, so no L2/L3 export path yet exists to gate — the privacy tiering is the schema the future ISAC feed will be born into. E. Reproducibility
a) National ingest.: The served store is fully regenerable from the committed shapefiles by a single idempotent pipeline (twin_ingest). Per layer it reprojects to EPSG:4326, reB. Data provenance: authoritative layers moves null or degenerate geometry, applies a declarative All 19 static layers derive from a single authoritative source, rename/keep specification, writes barbados_twin.gpkg, the Barbados Geoportal of the Lands & Surveys Department, emits PMTiles for high-count layers, and records source, CRS, received as 19 ESRI shapefiles constituting a national infrastruc- count, and bounding box in catalog.json. Re-running ture, hazard and vulnerability database [19]. Two facts govern deletes and rebuilds the store rather than performing an every transformation. First, source geometry is EPSG:21292 undocumented manual merge. b) Propagation build.: A second one-command workflow (Barbados 1938 / British West Indies Grid) and is reprojected in ulap-digital-twin/ulap-scope executes ten outto EPSG:4326 for web mapping, while propagation scenes of-process stages across three pinned environments: GeoPandeliberately remain in EPSG:21292 so ray lengths and terrain das/GDAL preparation, Blender 4.4 construction/export, and elevations are expressed in true meters; a correctness invariant Sionna RT 2.0.1 solution. The solve uses the Mitsuba LLVM is that the building bounding box must reproject to the whole island (verified at [−59.650, 13.045] to [−59.422, 13.335]). backend on CPU; CUDA is not required. Stage contracts are Second, critical-asset layers carry hazard return-period fields carried by scene_manifest.json, and automated tests (rainfall and coastal flood, landslide, seismic), which is what plus continuous integration exercise the pipeline. Thus both the lets the twin join assets to the climate-risk models. Table II is served geodata and the propagation scene are rebuildable on the ingested inventory. The government vulnerability_* commodity sovereign hardware. The Phase 1 work item extends grid is treated as authoritative and supersedes the earlier both manifests with SHA-256 hashes, ingest/build timestamps, census-derived parish proxy; the service degrades to the lower- license, and privacy tier. The public release described in §X provenance proxy only when the grid is absent, and carries will package these workflow and environment contracts with the source label either way. For the Newton radio study, this the paper’s derived artifacts. c) Claims register.: Every quantitative claim in this paper provenance chain extends through the physics: each simulated is bound to the artefact that produces it in a machine-checkable cell is tied to a national-grid coordinate, LiDAR-derived register (claims/claims.yaml), and a single command AVG_HEIGHT/AVG_DTM attributes, the August 2023 national re-executes the producers and compares each reported value antenna register, and an explicit propagation-material label. against its artefact within a declared tolerance. Claims that cannot be verified from the public release — those derived C. Live feeds from non-redistributable government data, such as the islandBeyond the static export, typed connectors hydrate live layers, wide layer counts — are recorded in the register as unverifiable one documented ingress per source: 3D-PAWS weather stations with the reason stated, rather than omitted. via CHORDS, Open-Meteo, OpenSky flights, CelesTrak TLEs (NTN constellations), Sentinel-2 L2A and Copernicus DEM F. Computational cost and sovereign-hardware feasibility The sovereignty argument of §VI rests on a practical claim: via the CDSE STAC, ESA WorldCover, Microsoft Global Building Footprints (fallback only), Hansen forest change, Ge- that the deterministic workflow runs on hardware a national ofabrik/OSM, OpenCellID, TeleGeography submarine cables, institution can procure and operate, without CUDA and without and PeeringDB. A strict provenance rule governs overlap: the a commercial cloud. That claim is only meaningful if it carries government export always wins where both exist (for example, numbers, so we report them. government building footprints over Microsoft’s), and live feeds Every propagation stage was executed on two deliberately serve enrichment, hotspots and layers the export does not cover. dissimilar machines — an NVIDIA GB10 (aarch64, 20
TABLE I: Reference-stack layers mapped to the Ulap SCOPE deployment. [B] = built, [D] = design. S-CDT layer
Deployed in Ulap SCOPE today
State
1. Geospatial ground truth 2. Systems of record
Authoritative buildings, terrain/elevation, utilities, hazards, vulnerability grids, and tower inventory; national web layers plus EPSG:21292 propagation scenes. twin_ingest builds the GeoPackage/PMTiles store and asset registries; catalog.json and scene_manifest.json carry source and transformation metadata. 3D-PAWS/CHORDS weather, OpenSky, CelesTrak, Sentinel/Copernicus, Open-Meteo and OpenCellID connectors. ISAC radar/CSI sensing is not yet a feed. Island-wide stochastic planning plus deterministic Sionna RT site studies, terrain-following maps, frequency/material sweeps, interference, transect and mobility solves.
[B]
3. Dynamic data / nervous system 4. Simulation and surrogates 5. Synchronization engine 6. Interaction/orchestration Zero-trust spine
Live layers are hydrated independently; no EKF belief-state estimator, uncertainty propagation, or cross-domain temporal state history yet. SCOPE 3D map, KPIs, inspect/hazard dashboards, Amini Akili (LLM assistance) and live UE-Sim ray-traced snapshots; no automated control loop. Per-output source attribution, graceful degradation, structural/physics validity checks and CPU-only sovereign execution; no signed hash ledger or node attestation yet.
[B] [B] conventional; [D] ISAC [B] RF; [D] calibrated climate/ISAC [D] [B] interaction; [D] orchestration [B] partial; [D] cryptographic gate
TABLE II: Ingested static layer inventory (real counts from catalog.json). Source: Barbados Geoportal, Lands & Surveys Dept.; CRS EPSG:21292 → EPSG:4326. track = serving strategy. Layer (twin name)
Geom
buildings polygon roads line bridges line ports polygon antennas point drinking_water_network line water_mains line wastewater_plants point desalination_plants point dams point reservoirs point pumping_stations point communal_wells point individual_wells point major_projects point vulnerability_global polygon vulnerability_population polygon vulnerability_environmental polygon vulnerability_equipment polygon
Count
Track
130,248 705 25 4 100 17,802 17,966 48 5 39 34 19 38 40 111 13,029 13,029 13,029 13,029
tiles geojson geojson geojson geojson tiles tiles geojson geojson geojson geojson geojson geojson geojson geojson tiles tiles tiles tiles
logical cores, 122 GB) and an NVIDIA H200 NVL (x86_64, Intel Xeon 6760P, 256 logical cores, 503 GB) — under a matched software stack (Sionna RT 2.0.1, Mitsuba 3.8.0, Dr.Jit 1.3.1). Each cell was run three times per backend; we report the median with the full observed spread, never a single timing. The Mitsuba variant selected at runtime was read back from every run rather than assumed, because Sionna attempts the CUDA variants first and will silently execute a nominally CPU run on a GPU if one is visible. A CPU-labelled measurement that selected a CUDA variant is treated as invalid rather than relabelled. Three observations follow. First, the complete study finishes in tens of seconds and peak resident memory never exceeds 1.25 GB on any host or backend. The binding constraint on reproducing this work is therefore neither compute nor memory but access to the authoritative geodata. Second, the GPU advantage depends strongly on sampling fidelity. At the settings of Table IV it is modest — roughly 2.5× on the coverage solves and close to unity on the lighter stages, which are dominated by process start-up and just-in-time
Twin role Island-wide 3D on terrain Road network Bridges (hazard-annotated) Ports & BGI airport hotspots Telecom / RF scene twin Potable mains Water mains Wastewater plants Desalination (critical) Dams Reservoirs Pumping stations Wells Wells Capital projects Authoritative gov. vulnerability grid Population exposure Environmental exposure Equipment / economic exposure
compilation rather than ray throughput — and it is this modest gap at survey settings that makes the CPU-only claim practical rather than merely technically true. At the raised sampling default the picture inverts (see below): the ray-bound solve dominates and the gap widens to ∼36×. Neither figure is a GPU throughput measurement and neither should be read as one. The claim also holds on aarch64, an architecture the original workflow did not target. The division of labour sharpens at high sampling fidelity: the 57-plane ground-following stack at 108 samples per transmitter solves in 7.3 s on the GPU against 262 s on the CPU backend (∼36×). CPU-only execution is what makes the pipeline sovereign; the GPU is what makes honest sampling cheap. Third, a portability caveat that cost us a full diagnostic cycle and is worth stating so others do not repeat it. On the H200 host every CPU cell initially failed with ImportError: ...the LLVM backend is inactive because the LLVM shared library ("libLLVM.so") could not be found. This is not an architectural limit: the distribution ships /lib64/libLLVM.so.20.1 but no unversioned libLLVM.so, which is the name Dr.Jit attempts
TABLE III: Zero-trust integrity gate: target versus what is enforced today. Control
Today in code
Gap to target
Source attribution
✓ source on every FeatureCollection plus catalog.json; scene_manifest.json carries projected geometry, height/elevation, tower, material, and solver metadata into RF outputs pending pending Structural checks plus projected-metre CRS, terrain/elevation, solver-stage, and frequency/material-validity checks ✓ gov-grid → census proxy, labeled; empty-but-valid catalog ✓ self-hosted store and CPU-only Mitsuba/Sionna solve; no cloud, CUDA, or GPU dependency
—
Content hashing Node attestation Integrity validation gate Graceful degradation Sovereign custody
SHA-256 per cube at ingest, on-ledger Requires Amini Chain backbone No cryptographic admission gate or fieldcalibration gate — Formalize multi-node operating policy
TABLE IV: Propagation-stage wall clock, seconds. Median of three runs, full spread in parentheses, Sionna RT 2.0.1 on both hosts. CPU rows use the Mitsuba LLVM backend with CUDA devices hidden. Timings correspond to the solver settings then in force (coverage at 5 m cells, 107 samples; ground-following at 106 ); the released defaults have since been raised for figure honesty, which lengthens those stages accordingly. Stage Coverage, flat Coverage, terrain Frequency analysis mmWave / SINR Ground-following Full pipeline
GB10 CPU
GB10 CUDA
H200 CPU
H200 CUDA
8.56 (8.47–8.69) 9.98 (9.79–11.23) 3.41 (3.31–3.77) 2.59 (2.00–2.80) 1.93 (1.91–2.05)
3.45 (3.41–3.61) 3.56 (3.48–3.56) 2.74 (2.62–2.93) 2.27 (2.24–2.28) 1.78 (1.70–1.83)
4.48 (4.27–4.48) 4.25 (4.11–4.46) 4.92 (4.91–4.95) 3.21 (3.21–3.28) 2.26 (2.25–2.39)
3.84 (3.81–3.87) 3.95 (3.90–3.96) 3.96 (3.94–3.96) 2.88 (2.86–2.90) 2.02 (2.01–2.04)
26.5
13.8
19.1
16.6
to load. Setting DRJIT_LIBLLVM_PATH to the versioned library makes all CPU cells pass. The CPU-only execution path therefore carries an undeclared dependency on LLVM being discoverable, and a deployment that assumes CPU portability without verifying it may silently acquire a GPU requirement. a) Determinism.: The pipeline’s only numeric artefact, link_metrics.csv, is byte-identical across both architectures, both backends and both solver versions tested. Because that file is written at two decimal places, this establishes agreement to 0.01 dB and 0.01 ns with identical path counts — not bit-identical floating point, a distinction we make explicitly. Concretely, the same artefact is byte-identical on an NVIDIA GB10 (aarch64), an NVIDIA H200 NVL (x86_64) and a Raspberry Pi 4 (§VIII-H): MD5 08afea6d... on all three and on the archived copy. Rendered figures are not byte-stable: PNG outputs differ across hosts and backends in 0.2–2.4 % of pixels with mean absolute difference below 0.04/255, concentrated at colormap boundaries and glyph edges. Reproduction of the numeric result is therefore verifiable by checksum; reproduction of the figures is not, and should not be claimed. G. Comparison against baseline propagation models §VIII-K argues that deterministic ray tracing is an upgrade on stochastic national planning. That is a comparative claim, and the preceding sections do not test it: the results in Table VII are reported against no external baseline. We therefore evaluate the solver against a closed-form reference on identical geometry, and quantify the internal ablation the earlier sections describe
qualitatively, and test the stochastic-planning claim directly. Metrics were fixed before any comparison was executed. a) Against a closed-form model.: On the Rising Sun transect a free-space plus two-ray model with knife-edge diffraction, evaluated on the same manifest, same tower and same fourteen receiver positions, tracks the ray tracer to 0.11 dB RMS with a mean signed bias of −0.05 dB, a fitted path-loss exponent of 1.739 against the ray tracer’s 1.732 (∆n = 0.007), and a Pearson correlation of 0.99991. We report this agreement plainly rather than concealing it, and we also report why it occurs, because the number is misleading on its own. That radial is rural line-of-sight; the median resolved path count is two — direct plus ground reflection — and the pipeline forms path gain as an incoherent sum of per-path powers. Under those conditions the deterministic solve reduces to the phase-averaged two-ray model by construction. The knife-edge diffraction term contributed exactly 0 dB at all fourteen points, so the analytical model’s only buildingaware mechanism never engaged. This is an easy case for the closed-form model, and it should be read as bounding where determinism is not required rather than as evidence against it. The material difference is multipath structure, which the closed-form model cannot represent at all. Where a third, building-reflected path appears, the ray tracer resolves an RMS delay spread of 361.1 ns at 450 m and 196.9 ns at 950 m against a median of 0.31 ns elsewhere; the analytical model returns no delay-spread estimate at any range. A planner using the closed-form model alone would site a link that is acceptable on path gain and exposed to inter-symbol interference at precisely those positions.
TABLE V: Coverage statistics by scene variant, best-server path gain in dB, on one common 8 m grid at 108 samples per transmitter — the raised default at which sample starvation no longer masquerades as shadow. Ground-following uses the corrected ceiling-plane construction (K = 57, receiver never below local ground); the superseded nearest-plane stack reported 28.1 % no-coverage, most of it discretisation. Variant Flat Terrain plane Ground-following
Median
p10
p90
No coverage
−113.56 −112.30 −116.51
−127.75 −125.71 −128.14
−93.61 −94.16 −93.86
0.38 % 0.13 % 1.16 %
b) The terrain ablation, quantified.: Table V replaces the qualitative claim that relief “isolates the effect” with magnitudes, computed on one common 8 m grid with three seeds per variant. The medians barely move — about −0.2 dB between adjacent variants — but that summary conceals the effect. 16.3 % of cells differ by more than 10 dB, p10 moves by −12.6 dB, and the serving cell changes in 10.0–22.3 % of cells depending on the pair compared, against a MonteCarlo noise floor of 0.99 % established by re-solving identical configurations — a 22.5× signal. We note that these figures are materially smaller than the same statistics computed at the solver’s former sampling default: at 106 samples per transmitter, more than half of the apparent serving-cell churn was estimator noise rather than terrain. Raising the default was what revealed it. Terrain therefore matters materially for association and celledge behaviour while being nearly invisible in an area median — which is an argument for reporting association statistics rather than medians in coverage studies. c) Correcting the ground-following construction.: Reexamining this map found that most of its dark area was measurement error rather than shadow, and we report the correction rather than the original figure. The construction stacked nine horizontal planes across 55.5 m of relief and selected, per cell, the plane nearest terrain + 1.5 m. Nine planes over that relief is 6.94 m spacing, so the selected plane sat a median 1.81 m from the intended height and, in 28.97 % of cells, below local ground — where the receiver is occluded by the terrain itself and returns no coverage. Selecting the nearest plane above the target instead of the nearest plane in either direction removes this entirely, and deriving the plane count from a stated height tolerance (K = ⌈relief/1 m⌉ + 1 = 57) bounds the residual offset to under a metre. Underground cells fall from 28.97 % to zero; with the sampling default also raised to 108 per transmitter, the no-coverage fraction falls from 28.12 % to 1.16 % — the remainder of the old dark area was sample starvation, not shadow. A second effect accounts for most of the remainder. A sweep of solver samples per transmitter shows the no-coverage fraction falling roughly tenfold per decade with no floor until 108 –109 : at the 106 this stage shipped with, 47 % of the map is unsampled rather than shadowed. Only at 109 does the residual
resolve into geometry. With both effects removed, genuine ridge shadowing is small. An independent pure-geometry line-of-sight test against the DTM — no ray tracer involved — puts it at 0.75 % of the map, and the ray tracer resolves less still because diffraction fills most of it in. The effect is therefore real and correctly attributed to relief, but roughly two orders of magnitude smaller than the uncorrected map suggests. We draw the honest conclusion: the quantitative case for the ground-following surface is not shadow area. It is that accounting for relief changes the serving cell in 22.3 % of cells against a 0.99 % Monte-Carlo noise floor — a 22.5× signal — and moves 16.3 % of cells by more than 10 dB. That is a planning-relevant result; the shadow area was largely an artefact of how we measured. d) Against a stochastic planning surface.: We implemented 3GPP TR 38.901 RMa and UMa from the standard — every constant as printed, nothing fitted — on the identical grid, towers and frequency, with spatially correlated shadow fading over 20 seeded realisations; the deterministic reference is the best-server map, both surfaces carry the same antenna correction, and 83,282 cells are compared per realisation. On the primary RMa cell the two surfaces measurably differ: RMS error 19.99 dB (ensemble median; 18.94–21.37 across realisations), mean signed bias −12.69 dB (TR 38.901 pessimistic), Pearson r of 0.648, and 55.8 % of cells more than 10 dB apart. The disagreement concentrates where planning decisions are made: 29.4 % of cells select a different serving mast — 135× the ray tracer’s own 0.217 % Monte-Carlo noise floor — and the cell-edge p10 levels sit 28 dB apart (−125.0 against −153.1 dB). Fig. 2 maps the disagreement; the full design matrix is in comparison/results/c2.json. Roughly half of the disagreement is one term. Substituting the ray tracer’s own LOS oracle — a visibility-only solve — for the standard’s distance-based LOS probability drops the RMS from 20.0 to 11.0 dB and the serving-mast disagreement from 29.4 % to 13.7 %: the stochastic surface’s largest single defect on this scene is not its propagation mathematics but that it does not know where the buildings are. That diagnostic deliberately violates the standard’s stochastic design and is not quotable as TR 38.901 performance. The verdict is deliberately narrow. These numbers establish that the two methods differ far beyond solver noise, and where the difference lands; they do not establish that the deterministic map is more accurate. Nothing in this study is calibrated against field measurement, and of the two models, TR 38.901 is the one with an empirical pedigree. What determinism demonstrably changes is serving-cell association and cell-edge behaviour; whether it improves them awaits calibration, which remains future work. H. How small can the machine be? Sovereignty that presupposes a data-centre GPU fleet is sovereignty contingent on export licences, foreign currency and a vendor relationship. The useful question is therefore not how fast the pipeline runs, but how small a machine still
a) What this costs.: The Pi is approximately 12× slower than the 20-core server-class ARM host on the same CPUonly work (310 s against 26.5 s for the full pipeline). That is the honest price of the sovereignty argument: the capability is affordable, not fast. We also note that the board reached 68–73 ◦ C and vcgencmd reported that the soft temperature limit had been reached, so these timings should be read as achievable on a passively-cooled board rather than as a best case, and that each stage was run once rather than as a median of three. I. Towards-6G deterministic propagation methodology
Fig. 2: Deterministic best-server path gain against the TR 38.901 RMa stochastic planning surface on identical geometry (83,282 cells, 20 shadow-fading realisations). Evidence: comparison/results/c2.json. TABLE VI: Full pipeline on a Raspberry Pi 4 Model B, CPUonly, no GPU. Stage
Wall (s)
Peak RSS (MB)
CPU
Coverage, flat Coverage, terrain Frequency analysis mmWave / SINR Ground-following
118.6 142.1 22.2 13.3 14.2
810 814 505 308 281
361 % 367 % 180 % 160 % 250 %
Full pipeline
310.4
814
runs it. We answer it on the smallest machine we could obtain rather than by extrapolation. The complete deterministic workflow was executed on a Raspberry Pi 4 Model B (4×Cortex-A72, aarch64, 8 GB, Debian 13, Python 3.13, microSD storage), CPU-only with CUDA devices hidden and the Mitsuba LLVM backend forced. The entire solver stack — Sionna RT 2.0.1, Mitsuba 3.8.0, Dr.Jit 1.3.1 — installed from stock PyPI wheels with nothing compiled from source. The complete study finishes in a little over five minutes. More consequentially, the resulting link_metrics.csv is byte-identical to the file produced on the NVIDIA GB10 and the NVIDIA H200 NVL, and to the copy archived with the code release: MD5 08afea6d... on all four. A single-board computer costing on the order of one hundred US dollars therefore reproduces the numeric result of this paper exactly, to the 0.01 dB at which that file is written. Peak resident memory was 814 MB on the Pi, essentially unchanged from every other machine tested: the workflow’s footprint is fixed by the scene, not by the host. Corroborating runs on aarch64 under hard cgroup limits completed at four cores with a 4 GB ceiling and again at two cores with 2 GB, with memory invariant throughout.
The deterministic workflow groups its ten executable stages into four methodological phases: 1) Clip. clip_study_area.py extracts a 2 km box centered on The Barbados Heritage District at Newton Plantation (−59.5339◦ , 13.0881◦ ) while preserving EPSG:21292. Towers from the August 2023 national antenna register are captured with an 800 m margin. preprocess_scene.py emits 2) Preprocess. scene_manifest.json: 576 footprints with perbuilding LiDAR-derived height and ground elevation; a 70×70 terrain grid interpolated from the building DTMs (54.7–110.3 m, approximately 55 m relief); an ESRI satellite basemap warped from EPSG:3857 to EPSG:21292; and mast positions seated on sampled ground elevation. 3) Build/export. build_scene.py extrudes footprints to their measured heights and seats them on terrain (or z = 0 for the controlled flat variant). export_mitsuba.py writes Z-up Mitsuba XML and explicitly tags buildings as itu_concrete and terrain as itu_medium_dry_ground. 4) Solve. Sionna RT evaluates Newton (30 m monopole on 69 m ground) and Rising Sun (24 m monopole on 100 m ground) in-scene, with Boarded Hall and Oistins represented as external interferers where required. The same manifest drives flat, terrain, frequency, multi-tower, transect, and moving-receiver experiments. This construction is the deterministic upgrade of the stochastic island-wide planning surface in Figure 3. Standard mapderived workflows often begin with generic OSM geometry; here, footprints, LiDAR heights, ground elevations, terrain, and the tower inventory remain traceable to sovereign government data through the propagation solve. J. Newton propagation results Table VII reports the common-scene experiments; the maps in Figures 10–14 show representative outputs. All values are deterministic simulation results rather than field measurements. K. Methodological novelty and limits a) A provenance-preserving physics ladder.: The RF scene twin now spans a flat approximation, a stochastic nationalplanning surface, and deterministic site studies under one sovereign source contract. Measured head-to-head (§VIII-G), the deterministic surface changes serving-cell association and
TABLE VII: Newton towards-6G propagation studies on the authoritative scene. Path-gain and delay values are simulated and not yet field-calibrated. Solver settings are stated per row: they differ between studies, and quoting one row’s configuration against another’s numbers will not reproduce them. Study
Setup
Result
Best-server coverage
3.5 GHz; TR 38.901-style transmit pattern; depth 5; 8 m cells; 108 samples/transmitter 1.8/3.5/6/10 GHz; Newton and Rising Sun; depth 5; 8 m cells; 106 samples/transmitter
Building shadowing is resolved in the dense settlement southwest of Newton; controlled flat and terrain-draped variants isolate the effect of relief. Median best-server path gain is −106.2/ − 112.6/ − 117.2/ − 121.5 dB, a 15.3 dB penalty from 1.8 to 10 GHz on identical geometry. The sweep stops at 10 GHz because itu_medium_dry_ground is defined only over 1–10 GHz. Median path gain is −130/ − 136 dB and useful coverage contracts to line-ofsight lobes around the masts, directly illustrating the densification pressure at FR2. Best-server association exposes a cell-edge interference zone west of Newton and SINR pockets above 25 dB near Newton and Rising Sun. Path gain declines from −98.9 to −123.8 dB. Most locations have two paths (LoS and ground); a third building-reflected path produces 361 ns RMS delay spread at 450 m and 197 ns at 950 m. Produces a true 1.5 m-above-ground-level map and reveals ridge shadowing absent from a single horizontal receiver plane. The moving_rx.gif artifact records live best-server gain and handover events along the route.
Frequency sweep
mmWave Multi-tower association Link transect
Ground-following map Drive test
28/60 GHz; scene explicitly retagged concreteonly Four towers; 33 dBm/sector; 100 MHz; interference-limited Rising Sun to scene center; 50–1350 m; receiver at 1.5 m Nine receiver planes span the 55 m relief; per cell choose the plane nearest terrain+1.5 m 60-step road route; fresh path solve at each step
cell-edge behaviour materially — a different serving mast in 29.4 % of cells and cell-edge p10 levels 28 dB apart — but whether it improves on the stochastic surface is not established: neither map is calibrated against field measurement, and calibration remains future work. Consequently, a coverage pixel can be traced to its EPSG:21292 coordinate, government feature, height/elevation attributes, material assumption, solver configuration, and output run. This gives layer 4 of the SCDT a physics engine and provides the concrete Hbackground surrogate that a later EKF/ISAC loop can calibrate. b) Terrain and material validity.: Sionna’s radio-map receiver surface is horizontal; over 55 m of local relief, that does not maintain a constant above-ground receiver height. sionna_terrain_ground.py works around this limitation using a stack of horizontal receiver planes whose count derives from a stated height tolerance (K = ⌈relief/1 m⌉+1 = 57 here), selecting per cell the nearest plane at or above the target height so the receiver can never sit below local ground. Frequency claims are also bounded by material validity: mixed concrete/medium-dry-ground studies stop at 10 GHz, while 28/60 GHz outputs are explicitly labeled concrete-only rather than silently extrapolating the ground model. c) Sovereign operations and honesty boundary.: CPUonly execution makes the pipeline reproducible on commodity national infrastructure, and the offline scene manifest now also drives SCOPE’s live UE-Sim ray-traced coverage snapshots (implementation commits f9e8fd31 and f7b2a798). The present claim is nevertheless towards-6G propagation: 10 GHz exercises an upper-midband/FR3 candidate regime and 28/60 GHz the FR2 extreme, but the antennas remain 1×1 V-polarized and no result is field-calibrated. What is built is the site-specific background-channel substrate, not yet the active ISAC sensing or cognitively closed loop. L. Deployed system The running Ulap SCOPE twin renders: the island-wide infrastructure network (130,248 buildings, roads, water mains, telecom, ports) draped on 3D terrain; the same scene in oblique
3D at building fidelity; the authoritative per-parish vulnerability index as a graded choropleth with a live weather/KPI header; a government-asset inspect panel (for example Grantley Adams International Airport (BGI)) that surfaces each feature’s source and attributes; and an RF coverage-planning surface driven by the Sionna propagation engine (receiver placement, stochastic coverage, and RSS/SINR statistics). The shared Newton scene_manifest.json additionally drives live UE-Sim ray-traced coverage snapshots, connecting the offline deterministic solver to the operational SCOPE interface. These views exercise built portions of layers 1–4 and 6 of Table I; screenshots accompany the deployment record in Figures 3–9, while deterministic outputs appear in Figures 10–14. M. Roadmap to the Sovereign Cognitive Digital Twin The sensing-maturity ladder of §IV is the yardstick, and the roadmap climbs it while closing the [D] gaps of Table I. Phase 0 (built) is the ingest-and-serve substrate plus the CPUonly deterministic propagation workflow and UE-Sim wiring documented above. Phase 1 (next) closes the highest-value governance gap: content-hash every cube at ingest, stand up the Amini Chain backbone and register the hashes, and promote the structural checks into an explicit quality-and-integrity admission gate so outputs become finance/evacuation-grade. Phase 2 replaces the single GeoPackage with a versioned lakehouse and lifts layers into X/Y/Z/Time cubes for state history and change detection, while a measurement campaign calibrates the Newton path-gain, delay, material, and antenna assumptions. Phase 3 adds the cognitive layer—the EKF belief-state synchronization of §V, using the calibrated deterministic scene as Hbackground , and ML surrogates (coastal, hydrology, evacuation) wired to live rainfall fields. Phase 4 adds closed-loop PPO/AI-RAN orchestration (an O-RAN Near-RT RIC xApp) and the GenAI GovChat query interface. Phase 5 brings the 6G ISAC feed online and enforces the L1/L2/L3 privacy waveforms and cross-layer anomaly detection at the physical layer. The same workflow transfers by replacing the government source and re-running the ingest/governance pipeline, from Barbados to the Philippine archipelago.
Fig. 3: Network coverage planning in the twin’s PLAN mode. Per-sector RF configuration (azimuth, tilt, and power; 3600 MHz, 50 MHz bandwidth) is propagated with a 3GPP TR 38.901 channel model over national infrastructure and the parish-vulnerability surface. Discrete receivers yield per-run statistics: 38.7% coverage, −72.6 dBm median RSS, and 10.3 dB median SINR across ∼75,619 cells. Concentric rings are predicted per-site coverage cells— the dual-function radio infrastructure repurposed for ISAC sensing in §IV.
Fig. 4: Authoritative per-parish vulnerability index. Parishes are graded Very Low to Very High from the Barbados Geoportal vulnerability grid aggregated to ADM1 boundaries. The inspected parish, Saint Michael, is Very High (composite 0.19/1.00; class 5 of 5), reflecting population density (2,160/km2 ; population 88,529) and a critical-facility access deficit (0.68 facilities per 10,000 residents). Its panel names the Barbados 2010 Census, OSM/curated critical facilities, geoBoundaries ADM1, and authoritative Geoportal grid, realizing the labeled-provenance contract of §VIII-D.
Fig. 5: Government-asset inspection with hazard attributes. The holographic 3D render selects Grantley Adams International Airport (BGI) on the dark-map building and terrain base. Its inspect panel exposes provenance (Barbados Geoportal) and per-asset hazard return-period fields—landslide E_LS, seismic E_Seis, and coastal/rainfall flood W_CE/W_BE—used to join critical assets to climate-risk models (§VIII-B).
Fig. 6: Telecom asset in its coverage-and-exposure context. A 30 m monopole at Lawrence Yard (site BARCC035) is inspected over predicted RF coverage cells and the parish-vulnerability surface, together with the live weather/KPI header and traffic-flow scenario controls. This is the deployed telecom layer that becomes the network-as-sensor substrate in the S-CDT.
Fig. 7: Natural-language interaction layer (Amini Akili). The in-map generative assistant answers grounded questions about the current view, including active layers, outage planning, and recommended next actions. Shown over the parish-vulnerability choropleth with the Very High parish highlighted, it realizes interaction layer 6 of Table I and prefigures the GovChat query surface in §VIII-M.
Fig. 8: Twin over satellite imagery in oblique 3D. The Bridgetown and south-coast conurbation combines the potable-water network (cyan), road network (green), points of interest, and predicted antenna coverage cells on a satellite basemap. Inspection of the 45 m Wildey monopole (site BARSM031) demonstrates multi-source fusion layered over the authoritative government export.
corresponding to this paper is v1.0-paper2, archived at 10.5281/zenodo.21708211, which records the exact Git commit and solver configuration. Cite the DOI when reproducing these results: it resolves to that exact tree, whereas the default branch will move. XI. DATA AVAILABILITY
Fig. 9: National context view. The full island of Barbados (166 km2 ) appears on a satellite basemap with complete road and water networks, parish labels, traffic-flow scenario controls, and asset inspection. This is the bounded, high-fidelity reference deployment generalized to the Philippine archipelago in §VII.
IX. C ONCLUSION AND F UTURE W ORK We have argued that the cheapest path to national-scale climate perception for island and archipelagic states is not more dedicated sensors but a re-conception of the network itself as the nation’s sensing nervous system, orchestrated by a sovereign, cognitively closed-loop digital twin. The S-CDT unifies the built-environment and earth-system digital-twin traditions, grounds its perception in the emerging ETSI and 3GPP ISAC standards, is designed to control under realistic RAN delay via belief-state estimation, and treats sovereignty and physical-layer privacy as primary. The cognitive and zero-trust layers are specified here but not yet deployed; what is running today is reported in §VIII. The Barbados implementation now adds a reproducible CPU-only RF scene twin built from sovereign LiDAR-height buildings, real terrain, and the national tower register. Its frequency, terrain-following, multi-tower, multipath, and mobility studies instantiate the sitespecific Hbackground required by the future ISAC loop, while the explicit material and calibration limits prevent simulation from being misreported as deployed 6G sensing. Future work includes: field calibration of the Newton path-gain and delay predictions; CSI-based rainfall validation against Caribbean gauge networks; array-aware FR3/FR2 studies; sim-to-real PPO transfer on an O-RAN testbed; formal verification of the minimized-kernel trust boundaries; and measurement of the L1/L2/L3 privacy-waveform trade-off curve. X. C ODE AVAILABILITY The open-source software and reproducibility artifacts accompanying this paper are available at https://github.com/aminitech/ aminiulap-digital-twin. We release them to the community so that other small-island and climate-vulnerable states can reproduce these results and adapt the pipeline to their own national data, which is the practical form the sovereignty argument of §VI takes: a nation cannot hold sovereign control of a capability it cannot itself run. The release includes the ten-stage pipeline, pinned environments, manifests, tests, figure scripts, link_metrics.csv, the moving-receiver example, and CPU reproduction instructions. The tagged release
The 19 authoritative static layers underlying the national twin are the property of the Government of Barbados and were obtained from the Barbados Geoportal, Lands & Surveys Department [19]. They are not redistributed with this paper. The release instead provides acquisition and license instructions, per-layer checksums and schemas, and non-restricted fixtures sufficient to exercise the pipeline end to end. Derived products that are ours to release—the Newton scene manifest, the propagation outputs, and the figure data—are included in full. Third-party live feeds (Copernicus, ESA WorldCover, OpenSky, CelesTrak, OSM, OpenCellID, PeeringDB, TeleGeography) remain under their respective upstream licenses. AUTHOR C ONTRIBUTIONS Contributions are recorded following the CRediT taxonomy. Each author states their own roles; none are assigned on another author’s behalf. To be completed by the authors before submission. All authors read and approved the final manuscript. ACKNOWLEDGMENTS We thank the Government of Barbados for its support of this work: the Ministry of Industries, Innovation, Science and Technology (MIST), and the Lands & Surveys Department for the authoritative national geospatial export that makes the Barbados twin possible. The interpretations and any errors in this paper are the authors’ own and do not represent the position of the Government of Barbados. R EFERENCES [1] UNDP Climate Promise, “Small Island Developing States are on the frontlines of climate change,” 2023. [Online]. Available: https://climatepromise.undp.org/news-and-stories/small-islanddeveloping-states-are-frontlines-climate-change-heres-why [2] World Economic Forum, “Unpredictable weather events are reshaping the future of small states and island nations, like Barbados,” 2023. [Online]. Available: https://www.weforum.org/ stories/2023/06/barbados-climate-resilience-data-technology/ [3] Centre for Digital Built Britain, “National Digital Twin Programme.” [Online]. Available: https://www.cdbb.cam.ac.uk/whatwe-did/national-digital-twin-programme [4] Centre for Digital Built Britain, “The Gemini Principles,” 2018. [Online]. Available: https://www.cdbb.cam.ac.uk/system/files/ documents/TheGeminiPrinciples.pdf [5] Government Technology Agency of Singapore (GovTech), “5 things to know about Virtual Singapore.” [Online]. Available: https://www.tech.gov.sg/technews/5-things-to-know-aboutvirtual-singapore/ [6] European Commission, “Destination Earth (DestinE).” [Online]. Available: https://digital-strategy.ec.europa.eu/en/policies/ destination-earth [7] Ericsson, “Integrated Sensing and Communication (ISAC) explained.” [Online]. Available: https://www.ericsson.com/en/6g/ isac
Fig. 10: Frequency sweep on identical Newton/Rising Sun geometry. Median best-server path gain falls from −106.2 dB at 1.8 GHz to −121.5 dB at 10 GHz. The mixed ground/concrete study is deliberately capped at 10 GHz, the validity limit of itu_medium_dry_ground.
Fig. 12: Conventional 3.5 GHz best-server map over the terrain scene, sampled on a horizontal receiver plane. Geometry resolves settlement shadowing, but receiver height above ground varies with relief.
Fig. 11: Concrete-only 28/60 GHz experiment. Median path gain is −130/ − 136 dB and coverage contracts to line-of-sight lobes around the masts. The explicit concrete-only label avoids extrapolating the ground material beyond its validated frequency interval.
Fig. 13: Ground-following 3.5 GHz map at 1.5 m above local terrain, assembled from a 57-plane ceiling-rule stack at 108 samples per transmitter, on the same colour scale and grid as Figure 12. Residual ridge shadowing appears that the horizontal map in Figure 12 cannot represent physically.
[8] Ericsson Technology Review, “Sensing in 6G: use cases and architecture.” [Online]. Available: https: //www.ericsson.com/en/reports-and-papers/ericsson-technologyreview/articles/sensing-in-6g-use-cases-and-architecture [9] ETSI, “ETSI publishes first Report on ISAC Use Cases for 6G” (GR ISC 001), April 2025. [Online]. Available: https://www.etsi.org/newsroom/press-releases/2520-etsipublishes-first-report-on-isac-use-cases-for-6g/ [10] ETSI, “New Report on ISAC System and RAN Architectures” (GR ISC 003), 2026. [Online]. Available: https://www.etsi.org/newsroom/news/2646-gr-isc-003-6g-isacsystem-ran-architectures/ [11] 3GPP, “TR 22.837: Feasibility Study on Integrated Sensing and Communication,” Release 19. [12] 3GPP, “TR 38.901: Study on channel model for frequencies from 0.5 to 100 GHz” (ISAC extensions), Release 19. [13] “A Comprehensive Survey of 3GPP Release 19 ISAC Channel Modeling,” arXiv:2512.03506, 2025. [Online]. Available: https:
Fig. 14: Four-tower 3.5 GHz best-server gain and servingcell association. The deterministic geometry exposes the interference/association boundary west of Newton and the handover structure used by the live UE-Sim.
//arxiv.org/abs/2512.03506 [14] ITU-R, “Recommendation P.838: Specific attenuation model for rain for use in prediction methods.” [15] “RainGaugeNet: CSI-Based Sub-6 GHz Rainfall Attenuation Measurement and Classification for ISAC Applications,” arXiv:2501.02175, 2025. [Online]. Available: https://arxiv.org/ abs/2501.02175 [16] “Toward Native ISAC Support in O-RAN Architectures for 6G,” arXiv:2603.03607, 2026. [Online]. Available: https://arxiv.org/ abs/2603.03607 [17] OPPO, “A Versatile 6G with Minimized Kernel” (6G White Paper). [Online]. Available: https://www.oppo.com/content/dam/ oppo/common/mkt/footer/OPPO-6G-White-Paper-EN.pdf [18] OPPO, “6G Security Architecture: Intelligent Security Built on Zero Trust” (6G Security White Paper). [Online]. Available: https://www.oppo.com/content/dam/oppo/common/ mkt/footer/OPPO-6G-Security-WhitePaper-EN.pdf [19] Government of Barbados, “Barbados Geoportal — Lands &
Surveys Department.” [Online]. Available: https://geoportal-bdslsdept.hub.arcgis.com/ [20] G. M. Gichuru and Z. A. M. Cayetano, “SIDSense: DatabaseFree TV White Space Sensing for Disaster-Resilient Connectivity,” arXiv:2602.13542 [cs.NI], 2026. [Online]. Available: https://arxiv. org/abs/2602.13542 [21] H. Tiwari, B. Kar, P. Tiwari, et al., “Digital Twin-assisted belief-state reinforcement learning for latency-robust ISAC in 6G networks,” arXiv:2604.25967, 2026. [Online]. Available: https://arxiv.org/abs/2604.25967 [22] O. Günlü, S. Tomasin, J. P. Vilela, F. Chiti, P. Dass, A. Alexiou, and U. Roedig, “ISAC Privacy: Challenges and Solutions for 6G,” arXiv:2605.28325, 2026. [Online]. Available: https://arxiv. org/abs/2605.28325 [23] G. Pan, Z. Li, A. Özçelikkale, C. Häger, M. F. Keskin, and H. Wymeersch, “Observation Compression in Rate-Limited Closed-Loop Distributed ISAC Systems: From Signal Reconstruction to Control,” in Proc. IEEE Globecom Workshops, 2025, arXiv:2505.01780. [Online]. Available: https://arxiv.org/abs/2505. 01780 [24] M. F. Keskin, M. Srinivasan, O. Günlü, H. Chen, P. Papadimitratos, M. Almgren, Z. S. He, and H. Wymeersch, “MultiDomain Security for 6G ISAC: Challenges and Opportunities in Transportation,” arXiv:2511.16316, 2025. [Online]. Available: https://arxiv.org/abs/2511.16316 [25] T. S. Rappaport, Wireless Communications: Principles and Practice, 2nd ed. Upper Saddle River, NJ, USA: Prentice Hall, 2002.