Audit & Decision-Lineage Bus

An append-only, tamper-evident record links every action back through the proposals, checks, and approvals that produced it.

L4 · Orchestration — its place in the stack (left, click any layer) and its internal components (right). Telemetry rises; control descends.

Every action has a provenance

For each command that reaches the breeder or burner, the lineage bus records the complete causal chain: the raw diagnostics, the twin prediction, the copilot proposal, the rules and envelope verdicts, any human approval, and the final command. Nothing actuates without a written explanation of why. This is the accountability backbone for a machine whose behavior is shaped by learned systems.

Causation and correlation

json

{
  "command_id": "cmd_88f2",
  "correlation_id": "shot_00421",
  "caused_by": ["proposal_71a","envelope_ok_55","approval_leader_09"],
  "rules_version": "2030.04.1",
  "envelope_version": "2030.04.1",
  "twin_version": "l3.twin@v2.3.1",
  "copilot_version": "l5.copilot@v1.8.0",
  "decision": "EXECUTED"
}

Tamper-evidence

Audit events are chained with content hashes so any retroactive edit breaks the chain and is detectable. The bus is append-only and never compacted. This matters both for internal engineering trust and for eventual regulatory review of an operating fusion machine; the discipline is built and exercised now, during the design-and-simulation phase, so it is mature before FOAK.

What it enables

Deterministic replay of any decision from its recorded inputs.
Root-cause analysis: from an anomalous burner plug transient back to the proposal that preceded it.
Model accountability: attribute an outcome to the exact twin and copilot versions in force.
Regression testing: assert a new orchestration version reproduces past approved decisions.

Separation from operational topics

The audit bus is a distinct topic class with its own retention and access controls; operational backpressure never sheds audit events (see backpressure). Distributed traces (see tracing) share the correlation IDs so latency analysis and causal analysis use the same identifiers.