Six Automations the
Nuclear Industry Has Never Seen

When a cyber event occurs in a nuclear facility, NRC requires a reportable event narrative (10 CFR 50.73) that establishes exactly what happened and in what order. Today this is assembled by hand from disparate log sources — hours or days after the event, with no mathematical proof of log ordering. Regulators have no way to verify the timeline hasn't been altered.

The PCM^rtos layer (CL-I) continuously logs every cell-state transition with RTOS-precision timestamps. After any security event, the Forensic Replay Engine feeds those logs through the CL-II Temporal Sequence Output Verification (TSOV) gate to reconstruct the exact sequence of state changes. The CL-IV intelligence wrapper generates a SHA-256-receipted event narrative ready for NRC submission — with the math to prove log ordering hasn't been altered.

SHA-256 receipted event timeline · NRC 10 CFR 50.73 narrative draft · TSOV sequence proof · Full chain of custody from cell-state to report

Nuclear digital I&C system vendors ship firmware updates on portable media. Today's verification is a hash check — compare the vendor-supplied hash against the downloaded file. A sophisticated supply-chain attacker who compromises the vendor's signing infrastructure can provide a matching hash for a malicious firmware. The hash check passes. The malware installs.

Before any firmware touches a safety-related I&C system, the Sovereign Firmware Verifier encodes it through the Nucleus GCQ codec (CL-0) and runs the resulting compressed representation through the CL-III asymmetric dual-codebook engine. The vendor holds the encoder codebook half; Guardian Posse holds the decoder half. Only a firmware with the correct codebook provenance produces a reconciling output. If the halves don't reconcile — installation is blocked and a tamper-evidence receipt is generated with the discrepancy logged. Hash match alone is insufficient.

Codebook reconciliation receipt · Installation gate decision (allow/block) · Tamper-evidence log · Supply chain audit trail per NRC RG 5.71

Maintenance windows on safety-related digital systems are the highest-risk period in a nuclear facility's cybersecurity posture. A technician with legitimate access can, intentionally or accidentally, perform an out-of-scope action that compromises system integrity. Today this window is monitored by a second technician with a paper checklist. The checklist doesn't generate a machine-readable audit trail and can't catch subtle out-of-sequence actions in real time.

When a maintenance window opens, the Maintenance Mode Governor activates the CL-II AI Governor in continuous-watch mode over the target system's I/O stream. The ISRI gate bounds-checks every input action against the pre-approved maintenance scope. The MSOV gate verifies that each resulting memory state transition is consistent with what an approved action should produce. Any out-of-scope input or unexpected state change triggers an immediate CL-IV alert — with the specific violated boundary logged — before the technician can proceed. The window is logged in full for regulatory review.

Real-time scope-violation alerts · Full maintenance window audit log · ISRI/MSOV gate pass/fail record · Regulatory-ready maintenance evidence package

Configuration integrity monitoring tools (file-integrity monitors, change-detection agents) operate at the software layer. An advanced persistent threat that compromises the OS or hypervisor can mask configuration changes from the very tools designed to detect them. This is the fundamental weakness of software-based integrity monitoring in safety-related systems — the monitor and the attacker share the same privilege domain.

The Nucleus Configuration Baseline Scanner encodes the approved system configuration through the Nucleus GCQ codec (CL-0), producing a compressed codebook representation that is stored in PCM cell-state memory (CL-I) — below the OS layer. Any subsequent configuration change alters the GCQ quantization of the system state. Because the codec operates below software, a compromised OS cannot prevent or mask the quantization change. The scanner continuously re-encodes and compares — any drift from the approved baseline codebook triggers an immediate CL-IV compliance alert, even when software-layer monitors are blind.

Codebook drift delta report · Sub-software integrity verification receipt · Configuration baseline SHA-256 hash · Change evidence package for regulatory review

NRC investigations require proof that cybersecurity event logs reflect what actually happened — in the order it happened. Network-time-synchronized logs can be manipulated. Log entries can be deleted, inserted, or reordered by an attacker with file system access. No existing nuclear cybersecurity solution creates a cryptographic proof of ordering that is independent of the logging infrastructure itself.

Every cybersecurity event log entry is processed through the CL-II Temporal Proof of Recency & Freshness (TPRF) gate. TPRF stamps each entry with a cryptographic binding that incorporates the RTOS-precision timestamp from CL-I and a hash chain linking it to the previous entry. The result is an unbroken, hash-linked log chain where every entry is provably earlier or later than every other — and where any deletion, insertion, or reordering breaks the chain. The CL-IV intelligence wrapper generates a chain-of-custody certificate ready for NRC submission or litigation.

Hash-linked event chain · TPRF ordering proof · Chain-of-custody certificate · NRC 10 CFR 73.77 notification package with tamper-evident log

The physical two-person rule (10 CFR 73.55(k)) requires that no single individual can perform a safety-critical action in a nuclear facility without a second person present and concurring. This rule is rigorously enforced in the physical domain. In the cyber domain, it is not. A single system administrator can change a firewall rule, reset credentials, or modify a safety system configuration — alone, at 2 AM, without any second verification. There is no digital equivalent of the two-person rule anywhere in nuclear cybersecurity today.

The Cyber Two-Person Integrity Engine (C-TPI) classifies cyber actions into "safety-critical" and "routine" tiers. Safety-critical actions — firewall rule changes, access grants, I&C system configuration modifications, cryptographic key operations — require two independent CL-II AI Governor verifications before execution. Each verification runs a separate AI agent chain with its own audit log. Both verifications must produce a passing CL-IV attestation. A single passing verification is explicitly rejected. The dual receipts are SHA-256 bound together — evidence that exactly two independent verification paths were completed, not one path run twice. This is the nuclear two-person rule, automated and extended to the digital domain.

Dual-receipt SHA-256 bundle · Independent agent chain audit logs · Safety-critical action registry · Two-person rule compliance certificate per 10 CFR 73.55(k)