Engineering that tests its own assumptions.

Each adapter declares capabilities, its risk envelope, measurement channels, calibration source, cost model and stop mechanisms. The experiment model only ever talks to that declaration. Native protocols stay behind it: vendor SDKs, OPC UA, SiLA 2, ROS 2, Modbus or whatever the equipment exposes.

# What an adapter declares about one instrument (illustrative)
adapter: furnace_example
capabilities:   [set_temperature, hold, ramp, purge_n2]
envelope:       envelopes/furnace_example.yaml
channels:
  chamber_temp: { sensor: tc_02, unit: degC, max_rate_hz: 10 }
calibration:    { source: tc_02.cal, valid_until: <date> }
cost_model:     { per_hour_usd: 28, consumables: [n2_gas] }
stop:           { software: abort(), hardware: e_stop_relay }
native:         vendor_sdk | opc_ua | sila2 | ros2 | modbus

No adapters exist today. Protocol names are examples of the interfaces an adapter would translate to, not integrations.

Operating range

Allowed values for each controllable parameter.

Prohibited states

Combinations that are never allowed, even if each value is.

Hard maxima

Motion, force, pressure, temperature, voltage, concentration.

Materials

Permitted and forbidden material classes.

Space and time

Physical boundary and the window the grant covers.

Stop and approval

Emergency stop, and which approvals each class needs.

Out-of-envelope requests are refused and returned with a reason. Terranoux does not quietly adjust a parameter to make a request fit. Widening an envelope is an authority decision, made outside Terranoux.

instrument        reactor_07   # exampletemperature       54°C   # range 20–80°Cpressure          1.2 bar   # ≤ 2.5 barduration          45 min   # ≤ 90 minmaterial_classes  [aqueous, non_oxidizing]prohibited_states [dry_heat, sealed_over_2bar]cost_ceiling      $400 / runphysical_boundary vessel_interiortime_boundary     grant window onlyauthority         grant_example_7f3aemergency_stop    enabled

Where a credible model exists, the proposal is simulated before approval is requested. The result carries the model's identity and validity range. Where no credible model exists, that is stated, and the experiment may need a smaller first run or a higher level of approval.

Predicted outcome

A band, not a point. Used later to flag surprises.

Resource use

Materials, instrument time, energy and cost.

Envelope violations

Steps that would cross a limit, removed before review.

Fidelity

Which model, which version, and where it is known to fail.

• →Terranoux sends the validated contract, predicted risk class and estimated cost to LucidRail.
• →LucidRail checks identity, permissions, policy, budget and required approvals, and returns a scoped, time-limited grant or a refusal.
• →A grant can be revoked during a run. Revocation is a stopping condition.
• →Terranoux holds no means to issue, widen or extend a grant for itself.

1. 01ConfigureSet up equipment to the contract through its adapter.
2. 02PreflightConfirm calibration validity, interlock state and the grant window.
3. 03RunPerform interventions in order, recording each action as performed.
4. 04WatchMonitor stopping conditions and envelope limits continuously.
5. 05Deviate or stopRecord every deviation. Stop on any stopping condition, interlock or revocation.

Hardware interlocks and emergency stops sit below software and override it. If an instrument refuses an action, the refusal is recorded as data, not retried around.

Raw observations

Unprocessed readings, with units and sampling rate.

Instrument identity

Which sensor, which firmware, which channel.

Calibration state

When it was last calibrated and against what.

Uncertainty

Declared resolution and known error where available.

Environmental state

Ambient conditions that could affect the reading.

Timestamps

Monotonic and wall-clock, so ordering survives clock drift.

The package links the exact specification, the authorization, the equipment and its calibration, the actions actually performed, deviations, failures, raw measurements, environmental state, timestamps and costs. It is signed along its chain of custody. The engineering model then decides what the evidence means for the design.

# Evidence package (draft structure)
evidence:
  experiment: exp_example_0142  sha256: 9f1c…e04a
  grant:      grant_example_c41e  issuer: lucidrail
  equipment:
    - furnace_example   firmware: <version>
    - tc_02             calibration: tc_02.cal (14 d)
    - 4pp_01            calibration: 4pp_01.cal (14 d)
  actions:              # what was actually done, in order
    - t: 00:03:41.870  set_temperature 120 degC
    - …
  deviations:
    - t: 02:20:31.761  chamber_temp +1.8 degC over setpoint
  observations:   raw/  (27 files, unprocessed)
  environment:    { ambient_c: 21.4, atmosphere: N2 }
  failures:       []
  cost:           { samples: 9, instrument_hours: 3.57, usd: 158 }
  custody:        signed by adapter → executor → engineering model
  verdict:        null  # interpreted downstream, where it can be checked