Securing Byproduct-Material Accountancy Data

Records of bred tritium, helium-3, and neutron services are integrity-protected and access-controlled, because their trustworthiness matters to regulators and safeguards.

Why accountancy is a security concern

The breeder (Hyperion) produces a tritium product (~4 kg/yr class), ~1.97 kg/yr helium-3, and 14 MeV neutron services, with the tritium breeding ratio treated as a design lever across 1.1/1.5/1.8. Records of what was produced, held, and transferred underpin regulatory reporting and material safeguards. If those records can be silently altered, the accountancy is worthless. Kronos protects them with the same integrity machinery used for control audit - not as an afterthought but as a first-class data class.

Integrity and access controls

• Accountancy entries are written to the tamper-evident append-only log and hash-chained.
• Each entry is signed by the measuring instrument's authenticated identity - see zero-trust identity.
• Records are exported to regulators/analysis only via the one-way diode, so the reporting path cannot be an ingress.
• Write access follows least privilege and separation of duties for adjustments/corrections.
• Reconciliation checks flag any inventory discrepancy for review.

Consistency reconciliation

# Mass-balance reconciliation over the signed record chain
def reconcile(period):
    produced = sum(e.qty for e in records(period, kind='produced'))
    transferred = sum(e.qty for e in records(period, kind='transferred'))
    held_delta = inventory_end(period) - inventory_start(period)
    resid = produced - transferred - held_delta
    if abs(resid) > policy.material_tolerance:
        flag_discrepancy(period, resid)     # cannot be silently absorbed

Confidentiality alongside integrity

Some accountancy data is sensitive; access is role-scoped and its export destinations are fixed by policy, never chosen by an external caller. This aligns with the plant's rule that only the L7 boundary talks outward and that no observed request redirects where regulated data goes.

Design status: the record schema, signing, chaining, and reconciliation run against twin-simulated production data. Live material accountancy begins with FOAK operation and first tritium ~2030; the integrity architecture is ready ahead of it.