Air Gaps and Controlled Bridging
The safety and control core is air-gapped from routable networks; the rare crossing to update a model or policy is a deliberate, two-person, fully logged event.
What is air-gapped and why
The innermost control and safety domain - the L1 fast loop, the safety-instrumented system, and the master interlock chain - has no routable connection to any wider network during operation. An air gap is the strongest available containment: an attacker on the enterprise or even the OT supervisory network has no packet path to these nodes. For a machine holding a 9.66 MA plasma (breeder) or a 26.49 T plug (burner), that guarantee is worth the operational friction it imposes.
The problem air gaps create
A pure air gap makes legitimate updates hard: new control policies, retrained models from the digital twin, calibration tables, and firmware all need to cross it eventually. Historically this is where air gaps fail - via unmanaged USB media or a temporary cable that becomes permanent. Kronos treats every crossing as a named, ceremony-governed event rather than an ad hoc convenience.
The bridging ceremony
- Payload is built and signed on the IT side; provenance is recorded (see SBOM and provenance).
- A one-way import station verifies signatures, scans, and re-signs with an OT-domain key.
- Two authorized staff with distinct roles must both approve - see separation of duties.
- The import is time-boxed; the transfer medium is single-use and inventoried.
- Every step lands in the decision-audit lineage with operator identities and hashes.
Distinction from data diodes
The data diode handles continuous OT-to-IT export. The air-gap bridge handles the opposite, rare, high-consequence direction: bringing a vetted artifact in. They are different mechanisms for different flows and are never collapsed into a single bidirectional link.
Design status: the ceremony, import-station verification, and dual-approval workflow are implemented in the twin/staging environment. The physically air-gapped control room build is part of the FOAK plant scope from Q2 2027; nothing here runs against a live reactor yet.