Interface Ownership by Layer

Ownership of a physical interface is assigned by its worst-case timing requirement, not by which team is smartest about the physics.

The assignment principle

Kronos separates intelligence from authority. Learning layers (L3 twin, L5 copilots) may propose, but only the layer that can meet the interface's timing budget with a provable worst-case is allowed to drive it. This keeps the failsafe path certifiable independently of any machine-learning component.

Layer responsibilities

• L1 (control plane): microsecond–millisecond loops — quench trip, coil supplies, gas valves, beam notching, DEC modulation.
• L2 (data fabric): timestamping, transport, and schema for every interface reading; owns no actuation.
• L3 (twin / AI): state estimation and MPC setpoint trajectories on a 50–100 ms predictive shadow.
• L4 (orchestration): campaign-level interface sequencing (fueling schedules, tritium campaigns).
• L7 (ecosystem): accountancy, offtake logistics, regulatory feeds — minutes to days.

Handoff contract

When a setpoint crosses from L3 into L1 it becomes advisory: L1 revalidates it against the hardware envelope, clamps or rejects out-of-range commands, and only then drives the interface. The reverse path — sensor readings — flows up through L2 with provenance so the twin and copilots never see an un-timestamped value.

This division is why an interface latency budget is the first thing specified for any new sensor or actuator, and why the HAL contracts encode the owning layer as a required field.