Interface Calibration and Provenance

A reading is only as trustworthy as its calibration record; this interface carries the traceable provenance every layer checks before acting.

Trust travels with the number

Across both machines' 60+ ports, no layer is allowed to act on a bare number. Each engineering-unit value carries a provenance record: which calibration produced it, when, with what uncertainty, and whether the calibration is still valid. This interface defines and enforces that record.

Provenance fields

• Calibration polynomial/gain and its reference standard.
• Calibration epoch and validity window (drift-based expiry).
• Stated uncertainty for the channel.
• Health status: valid / suspect / masked.

# provenance gate before any layer uses a value
def trusted(reading):
    p = reading.provenance
    return (p.status == 'valid'
            and age(p.cal_epoch) <= p.validity_window
            and reading.value == clip(reading.value, p.range))
# twin/MPC/copilot all call trusted() first
if not trusted(x): x = impute_or_mask(x)

When a calibration expires or a sensor drifts out of tolerance, the value is not silently used — it is marked suspect and either imputed (from the sensor-topology graph model) or masked so the reconstruction proceeds on trusted channels only. This is how a stale gauge never corrupts a strain margin, a heat-flux map, or an accountancy ledger.

Owner and scope

Owner: L2 for the calibration store and provenance record; every higher layer is a consumer that must check it. Accountancy-grade interfaces (tritium, helium-3) carry the strictest traceability; fast control channels carry the shortest validity windows because drift there is most damaging. This provenance is the same discipline the analog front end begins and the accountancy ledger ends with. Design-and-simulation specification.