VAPI: Verifiable Controller Input Provenance with Physics-Backed Liveness for Competitive Gaming

Part 1 — Provenance.VAPI provides a cryptographically verifiable evidence rail for controller input. Each gaming session produces a signed, hash-chained stream of 228-byte evidence records whose origin (ECDSA-P256 signature), ordering (monotonic counter + hash linkage), and integrity (hash-chain verification) can be confirmed by any third party on a public blockchain without access to the original device. Part 2 — Physics.Software-only injection is made empirically infeasible by a nine-level Physical Input Trust Layer (PITL) that binds committed evidence to physics-coupled controller signals — IMU gravity baseline, IMU-button causal latency, stick-IMU temporal cross-correlation, biometric kinematic fingerprinting (11 features, Mahalanobis distance), temporal rhythm analysis, and active haptic challenge-response using the DualShock Edge's motorized adaptive triggers. Live hardware validation on a DualShock Edge CFI-ZCP1 confirms a 14,000× injection detection margin. Part 3 — Status.The prototype spans ~220 files with ~1,289 automated tests. Thirteen contracts are deployed on IoTeX testnet. Living calibration (Mode 6, Phase 38) autonomously evolves L4 thresholds from verified session data every 6 hours using exponential decay weighting. All PITL thresholds are empirically calibrated from N=69 real sessions across 3 distinct players. The primary current limitation is single-population calibration: L4 functions as a per-player anomaly detector rather than a cross-player identifier (inter-person separation ratio 0.362).