01
ENFORCEMENT PLANE
Executor-side Gate
The only plane allowed to call the actuator. Missing proof is refused before mutation.
- State
- checking
- Workload
- not proven
- Canary
- not verified
- Bypass
- none observed
EMILIA GATE / THREE-PLANE PROOF
Enforce. Witness. Settle.
A control plane that cannot confuse seeing traffic with stopping an action.
Reference lab · no production effect
Protected consequence
Grid curtailment · ... kW
loading · ... seconds
- Action digest
- not available
- Coverage
- loading
- Settlement
- loading
02
WITNESS PLANE
Independent observation
A pinned TAP or observer signs what it saw. Visibility remains evidence, never authorization.
- Signature
- absent
- Capture point
- checking
- Sequence
- checking
- Payload
- unknown
03
CONTROL PLANE
Coverage and reliance
Pinned policy composes proof rows and refuses incomplete settlement. No hidden trust score.
- Inventory
- 0 bps covered
- Settlement
- checking
- Metering
- 0 protected action
- Usage record
- refused
THE HONEST NEGATIVE
Traffic was observed. Enforcement was not proven.
The witness is healthy, but a passive observer cannot block the actuator. Coverage becomes witness_only and settlement fails closed.
REPRODUCIBLE ARTIFACTS
Every decision has a digest.
These are outputs from the running reference kernels, not hand-authored status labels.