MAPE-K · Monitor, Analyse, Plan, Execute
The control loop
The software observes the plant, proposes changes and justifies them — it may only touch the machine once a human has agreed. Every step is attested before it takes effect.
Open proposals
Nothing to decide. The control loop only proposes something when the situation warrants it — and at most one per station, so that no list arises that nobody can get through any more.
Chain of evidence
Append-only, hash-chained, signed. The database rejects UPDATE, DELETE and TRUNCATE. Whoever changes an entry breaks the chain from that point on — the check then names not just “broken” but the number of the first broken entry and since when it has been lossless again.