The Unified API Gateway: One Door In and Out

A single authenticated gateway mediates every external interaction with the plant, translating outside requests into governed L1-L6 actions and never exposing control internals.

One door, by design

The unified API gateway is the only network endpoint any external party may reach. Grid operators, isotope customers, parts suppliers, regulators, and sibling plants in a fleet all speak to the same gateway. Internally it fans requests out to L1 control, the L3 KRONOS-CTRL twin, L4 logistics, and L5 compliance services, but the outside sees a stable, versioned contract, not the stack behind it. This collapses the attack surface to one hardened boundary and gives every interaction a single place for authentication, authorization, rate limiting, schema validation, and audit.

Read model and write model

The gateway separates a read plane (plant state, telemetry snapshots, availability forecasts, isotope inventory, compliance status) from a write plane (dispatch setpoints, offtake orders, maintenance windows). The read plane is high-fan-out and cacheable; the write plane is low-rate, strongly authenticated, and always idempotent so a retried command never double-executes.

# gateway request lifecycle (pseudocode)
def handle(req):
    caller = mtls_identity(req)                 # who, cryptographically
    authz(caller, req.action, req.resource)     # RBAC + scope check
    validate_schema(req.body, contract_version) # reject malformed early
    rate_limit(caller, req.action)
    if req.plane == 'write':
        require_idempotency_key(req)            # exactly-once semantics
    resp = route_to_service(req)                # L1 / L3 / L4 / L5
    audit_log(caller, req, resp)                # immutable trail (L5)
    return sign(resp)

Every write is bounded by the L1 safe operating envelope. A grid dispatch command asking the burner for more power than the certified extraction limit is clamped or rejected at the gateway edge, before it can reach actuation. The gateway therefore acts as a policy enforcement point, not merely a transport.

Because the gateway is instantiated identically per unit, a fleet controller talks to twenty plants exactly as an operator talks to one. This uniformity is what makes multi-unit coordination and fleet model propagation tractable. All machines remain design and simulation studies today; the gateway is exercised against the twin and mock external clients.