Skip to content

Subsystem: runtime / actuation / assurance / audit / meta / artifacts — trust & execution spine

The concrete execution loop and the tamper-evidence layer. runtime 56 files (~17.4k LOC), actuation 9, assurance 6, audit 2 (protobuf schema only), meta 2, artifacts 2.

Inputs

UPDEState and BoundaryState per step; ControlAction proposals from the supervisor; for audit, prior JSONL records (to resume the hash chain) and environment keys (SPO_AUDIT_KEY, SPO_AUDIT_KEYRING).

Outputs

  • Projected ControlActions (clamped, rate-limited).
  • A SHA-256 hash-chained JSONL audit log and a protobuf event stream, optionally HMAC-signed.
  • An AssuranceCaseBundle mapping evidence to EU AI Act 2024/1689, ISO/IEC 42001:2023, and ANSI/UL 4600 clauses, with a recomputed bundle hash.
  • QPUDataArtifact (canonical JSON + per-component SHA-256) for the quantum sibling.

Processing model

  • runtime/simulation.simulate — the master step loop (audit record → supervisor decision → action projection → engine step). When a protobuf audit stream is attached, the run-end SimulationResult includes a flushed whole-stream integrity summary from verify_event_stream_integrity(). Its only live control_mode is supervisor_policy. If callers provide both a calibrated TwinConformalGate and a deployment-specific twin_confidence_source, each live policy tick is conformal-scored before actions are applied; rejected ticks drop the current action set and are surfaced in result/audit records.
  • actuation/ActionProjector.project — clamp to bounds, then per-step rate-limit, then re-clamp. Deterministic; always closes the default loop. Optional neural CBF use is fail-closed in FoundationModelGovernor: a ControlBarrierFilter is accepted only with a verified matching BarrierCertificate bound by filter digest. A Koopman MPC is implemented but not wired into the default simulate() loop.
  • audit — hash chain event_hash = SHA-256(canonical_json(record)); optional HMAC over the chain; deterministic ReplayEngine.
  • assurance — content-addressed evidence items and a frozen, review-only bundle (actuation_permitted=False).
  • runtime/deterministic — a bounded-jitter, WCET-budgeted hard-deadline loop with a deadline-miss policy.

Backends

Pure Python/NumPy. No Rust in the runtime loop; the spo-supervisor Rust crate is not bound here.

Wiring

monitor → supervisor → actuation (projector) → audit → back to the engine. The CLI audit, assurance, and verification commands consume the audit log, build bundles, and run replay.

Scope boundaries (verified by execution)

  • Per-step tamper evidence is append-time hash chaining. simulate() does not rescan the full stream before each action; a protobuf audit stream is verified once at run end and surfaced on SimulationResult.
  • Audit signing is environment-gated (SPO_AUDIT_KEY), not structural; unsigned writes are permitted.
  • actuation_permitted=False is documentary — it is a frozen-dataclass assertion never consulted by the actuation flow. Runtime gating remains in the safety-tier checks and ActionProjector clamp/rate-limit path.
  • The hard-deadline loop defaults to miss_policy="abort"; diagnostic record-and-continue runs must request "observe" explicitly.
  • Neural CBF certificates are verifier-produced, but runtime CBF use is not offline-trust-only: FoundationModelGovernor refuses a CBF filter unless the supplied BarrierCertificate is verified and digest-bound to that filter.
  • The conformal twin-confidence gate is wired into live policy admission when a caller supplies the observed-twin confidence stream. It is not auto-enabled by the default CLI because spo run has no physical observed-twin source.
  • Koopman MPC is intentionally not a live simulate() mode. Passing a Koopman mode to simulate() fails closed; the supported Koopman path is the offline/review-only dVOC damping pipeline and FMI co-simulation surface.
  • The packaged audit.proto, root proto/audit.proto, and runtime dynamic descriptor carry the same signature/audit-mode fields.