Full Decision-Audit Lineage

Every control decision is traceable from actuator command back through the model, its inputs, and the code and data versions that produced it - a complete, replayable chain.

Why lineage, not just logs

A conventional log tells you what happened. Lineage tells you why, in a form you can replay. When an autonomy layer or an operator drives a magnet ramp on the breeder or a plug-field adjustment on the burner, Kronos records not only the command but the exact model version, the sensor snapshot that fed it, the policy that authorized it, and the code and configuration hashes in effect. This is essential for a machine that makes fast decisions faster than a human can review them, and for regulators who must reconstruct events.

What a lineage record contains

• The actuator command and its timestamp, signed by the issuing node's identity.
• The input state vector (diagnostics snapshot / twin state) by content hash.
• The model or controller version and its bitstream/model hash.
• The authorizing policy id and, for human actions, the operator identity.
• The parent decisions this one depended on - forming a directed acyclic graph.

# Each decision emits a signed, hash-linked lineage node
def record_decision(cmd, state, model, policy_id, parents):
    rec = {
      'cmd': cmd, 't': now_ns(),
      'state_hash': sha384(canonical(state)),
      'model_hash': model.hash, 'policy': policy_id,
      'parents': [p.id for p in parents],       # builds the DAG
      'issuer': node.workload_id,
    }
    rec['id'] = sha384(canonical(rec))
    rec['sig'] = node.sign(rec['id'])
    append_immutable(rec)                         # to the audit log
    return rec

Replay and accountability

Because inputs are content-addressed, any decision can be re-run against the same state in the digital twin to confirm the model would produce the same output - distinguishing a model error from tampering or a hardware fault. The chain is written to the immutable audit log and exported via the data diode.

Design status: the lineage schema, DAG linking, and replay harness are implemented against the twin. On a live plant the same records would be generated at control-loop cadence; the throughput and storage design is validated in simulation, not yet under reactor operation.