One interface between the twin and the machine.
Readings come in as typed, signed measurements. Commands go out as bounded actions. Every crossing is a signed document checked against the twin, the purpose and the person who approved it.
What crosses, and which way.
The interface carries four signed documents. Nothing else crosses.
Readings in. Each reading has a kind, a unit, a range, an uncertainty, a timestamp from a declared clock and the node that took it. The batch carries the lowest grade among its readings.
inAn action out: setpoint, trajectory, mode, model update or calibration update. It names its twin, its calibration, the band check and the lowest grade of the measurements behind it. It carries an expiry.
outWhat the machine reports after a command. Asked and observed are shown side by side; when they disagree the interface says so and stops.
inWhich agent, trained in which world, under which policy, was born into which system, and when.
out
A system declares what it is for before it acts.
Each system declares its purpose, the quantities it measures, the actions it may take, its safe limits and its twin. A check returns every issue it finds, each with a code.
Compute, processing, physics, motion, measurement, environment, energy, fluid and thermal, and structure.
Articulated robot, mobile platform, process machine, pump and valve system, environmental monitor, structure under observation and compute fleet.
Setpoint, trajectory, mode, model update and calibration update. Every action carries a safe limit in the unit of its quantity; an action without a limit is refused.
Motion, orientation, field, pressure, temperature, humidity, air quality, electrical, light, flow and sound, plus position, velocity, torque, force, energy and status code for machines. Each is tied to the twin variable it validates.
Only inside what the twin was solved for.
Inside its band, a measurement can validate a forecast and, if the sensor measured it, recalibrate the twin. Outside the band it is recorded and validates nothing. A twin is never extrapolated.
A result is as strong as its weakest input.
Anything built from several measurements takes the lowest grade among them, and a caller can set a floor below which a measurement only informs.
Estimated is not measured.
Orientation, step count, activity state and any channel a device computed can validate a forecast. They never recalibrate a twin and never stand alone behind an action.
A clock that is not declared scores nothing.
A site declares where its time comes from. Without one, readings are flagged and no twin is scored against them.
Read, never write.
Every integration starts here. The adapter decodes and signs; it has no way to send.
Nothing is issued.
The agent proposes while the real controller acts. Proposals and actions are compared, and a request to act is refused.
Per tenant, per system class.
An actuator needs an explicit grant signed by an operator at the site for that actuator and that quantity. A standing policy covers a low-risk, reversible setpoint inside its limits; moving a machine takes a person's approval each time.
Magnitude, rate, acceleration, duration.
Limits are enforced twice, by Living Worlds and by the site's own tighter policy. The stricter wins. Every command expires, and one that arrives late or out of order is rejected.
The machine's own safety system stays the safety function.
The advisory stop is a supervisory stop above the machine. A kill order at the site cancels queued commands and is never blocked by an unreachable Living Worlds. It sits above the machine's own emergency stop and safe torque off and does not replace them. A command the site cannot verify is denied and reported.
Connect a twin to a machine.
Tell us the system class and the actions it needs. We scope the purpose, the limits and the approval path together.