The L1 to L2/L3 Boundary
L1 streams validated telemetry up and receives advisory targets down, but its safety and timing guarantees never depend on the layers above it.
A one-way safety dependency
L1 talks to L2 (data fabric) and L3 (twin and AI) constantly — it publishes telemetry upward and consumes advisory setpoints downward. But the dependency is deliberately one-way for safety: L1's guarantees hold even if L2 and L3 are slow, wrong, or absent. Information flows both ways; authority does not flow down into the safety-critical loops.
What crosses upward
- Validated, time-stamped state vectors for the L2 petabyte archive.
- Actuator commands and arbitration outcomes, for the twin and audit.
- Fault, interlock, and protection events with precise timing.
- Feature streams feeding the L2 feature store and L3 models.
This upward stream is rate-constrained traffic on the deterministic fabric — bounded so it can never crowd out a protection frame. It is what lets L3 build a faithful digital twin and L0 retrain surrogates offline, without ever touching L1's timing.
What crosses downward
Downward comes advisory intelligence: MPC trajectories, disruption-precursor predictions that arm L1 loops earlier, imputed values for dropped channels, and gain schedules from the twin. All of it is validated at the boundary and treated as advisory — the handoff contract ensures a bad or missing target degrades quality, not safety.
Why the boundary is the architecture
This boundary is the whole point of separating L1 from the intelligent stack: it lets Kronos evolve models freely above the line while the certified, deterministic layer below the line keeps both machines safe and on time. It is the structural expression of determinism vs learning at the tier scale.