Action-Gating Pipeline

Every candidate action passes a fixed, ordered sequence of independent checks; any stage can reject, and rejection is the default.

L4 · Orchestration — its place in the stack (left, click any layer) and its internal components (right). Telemetry rises; control descends.

One path to actuation

There is exactly one path from a proposal to a command on L1, and it runs through an ordered pipeline of independent checks. No component may skip a stage, and the pipeline fails closed: if any stage errors or times out, the action is rejected. This single-path discipline is what lets the whole stack reason about safety.

The ordered stages

text

1. RECONCILE   twin + copilot -> single candidate         (L4)
2. SCHEMA      command validates against registry         (reject on fail)
3. AUTHZ       caller holds a valid, scoped command token  (reject on fail)
4. RULES       all hard-bound predicates true             (reject on fail)
5. ENVELOPE    stays inside state-dependent safe region    (reject on fail)
6. RATE        within actuation slew/quota limits          (reject on fail)
7. APPROVAL    human gate if authority level requires it   (reject/timeout)
8. COMMIT      idempotent command emitted to L1

Independence of stages

Stages 4 (rules) and 5 (envelope) are deliberately independent of the ML stack that produced stage 1. A failure or compromise of the twin or copilot cannot disable them because they do not call into those systems. This is defense in depth: the intelligent layer and the guarding layer share no failure mode.

Fail-closed default

Unknown command schema: reject.
Missing or expired token: reject (see authorization).
Envelope checker unavailable: reject, do not fall through.
Approval timeout on an energizing action: reject.

Applies identically to both machines

A breeder coil-current setpoint and a burner plug-field setpoint traverse the same pipeline; only the specific rules, envelope model, and authority thresholds differ. Every stage's verdict is journalled to the lineage bus so the full decision is replayable. The pipeline is validated today against the digital twin ahead of FOAK first tritium around 2030.