Layer 4 Orchestration Overview

The orchestration layer coordinates twin predictions and copilot proposals into bounded, gated actions before anything reaches real-time control.

Position in the stack

Layer 4 sits between the machine-learning tiers above it (L3 digital twin, L5 copilot) and the real-time control loop below it (L1). Its job is coordination and containment: it accepts proposals from probabilistic systems and converts them into commands only after schema validation, safety-envelope checks, policy evaluation, and any required human approval. No twin output and no copilot suggestion reaches L1 actuation on the breeder (Hyperion) or the burner (Aegis / MetroVolt) without passing through this gate.

What orchestration owns

• The event-streaming backbone that carries every measurement, prediction, proposal, and command as an immutable event.
• The workflow / campaign engine that runs shot and experiment procedures as durable, resumable state machines.
• The rules engine and HARD safety bounds, enforced independently of the ML stack.
• Human-in-the-loop approval routing and the experiment scheduler with priority and preemption.
• The audit and decision-lineage bus that records why every action happened.

Design and simulation framing

Both machines are design-and-simulation studies. Breeder construction begins Q2 2027 with first-of-a-kind first tritium targeted around 2030; there is no hardware net-gain claim before FOAK. Layer 4 is therefore specified and validated today against the digital twin and against replayed synthetic campaigns, so that the gating discipline is proven long before it governs physical actuators.

Core invariant

The controlling invariant is separation of concerns: intelligence proposes, orchestration disposes. The ML stack may be wrong, drifting, or adversarially perturbed; the orchestration layer assumes it can be and never lets an ungated proposal move a coil current, a gas valve, or a neutral beam. See the action-gating pipeline for the enforced sequence.

proposal (L3/L5) -> validate -> policy -> safety envelope -> approval? -> command (L1)
                     any stage may REJECT; reject is the default