Guardrails: Safe-Operating-Envelope Checks

The certified operating envelope is the arbiter of every proposed action; membership is recomputed over the full state, never clipped or assumed.

The envelope is the safety contract

The safe operating envelope is the certified region of state space in which the machine may operate. It is defined by physics and engineering limits — current, field, pressure, density, temperature margins, stability boundaries — and it is the arbiter of every proposed action. A proposed action is admissible only if applying it keeps the predicted state inside the envelope.

Membership, not clipping

Envelope enforcement checks membership; it does not silently clip an out-of-bounds proposal into the region. Clipping hides intent and can produce a physically inconsistent setpoint. Instead, a proposal that would leave the envelope is denied with the specific violated constraint returned to the copilot, which must replan. This keeps the reasoning honest and the operator informed.

envelope_contains(state, proposal):
  s' = predict(state, proposal)          # twin/reduced model
  for c in constraints:                   # breeder or burner set
     if not c.satisfied(s'):
        return (False, c.name, c.margin(s'))
  return (True, None, min_margin(s'))

Machine-specific constraint sets

The envelope is recomputed by L4 from the full current state for every proposal, using the twin or a certified reduced model — L4 never trusts a copilot's claim that its proposal is in-envelope. Constraints carry margins, so L4 can distinguish a comfortable action from one that skirts a boundary, and can require human confirmation for low-margin actions even when they are technically admissible.

Envelope checks are the semantic complement to the structural schema validation: schemas stop malformed and grossly out-of-range calls cheaply; envelope checks stop contextually unsafe ones with full-state physics. Both sit inside L4 authorization ahead of L1 and the hardware interlocks. See the L3 safe-operating-envelope definition.