Rules Engine & Hard Bounds

A deterministic rules engine enforces hard operational bounds independently of the ML stack; it can only ever forbid, never command.

L4 · Orchestration — its place in the stack (left, click any layer) and its internal components (right). Telemetry rises; control descends.

Independence from intelligence

The rules engine is the machine's written law. It is small, deterministic, human-authored, and version-controlled, with no dependence on the twin, the copilot, or any learned model. Its sole power is to REJECT a proposed command that violates a hard bound. It never originates an action. This asymmetry is deliberate: intelligence can be wrong, so the veto authority must not itself be intelligent.

Hard bounds are physics and engineering limits

Breeder toroidal field must not exceed the conductor's peak-field rating (design peak 16.84 T); on-axis target 8 T.
Breeder plasma current commanded slew and magnitude bounded around the 9.66 MA design point.
Burner plug field bounded at the 26.49 T design point; throat field at 17 T; no command may exceed magnet ratings.
Fuelling, heating, and pumping interlocked so no combination can be commanded outside the validated envelope.

Rule structure

python

# rules are pure predicates over (command, machine_state); default DENY
@rule("coil_peak_field")
def within_peak_field(cmd, state):
    return cmd.expected_peak_field_T <= LIMIT_PEAK_FIELD_T   # 16.84

@rule("slew_limit")
def within_slew(cmd, state):
    return abs(cmd.d_setpoint_dt) <= SLEW_MAX[cmd.actuator]

# a command passes ONLY if every rule returns True (AND of predicates)

Relationship to the safety envelope

The rules engine evaluates static, absolute bounds. The safety-envelope checker evaluates the richer, state-dependent envelope (combinations of quantities that are individually legal but jointly unsafe). Both must pass; either can veto. Together they form the independent guard described in the gating pipeline.

Change control

Because these rules are safety law, they are changed only through reviewed, audited pull requests with two-person sign-off, and every rule evaluation is logged to the lineage bus with the rule version that ran. A copilot may propose a rule change, but the change follows the human process; it never self-modifies.