grid-decision-record-audit-stream-reference

AGPL-3.0 reference implementation of grid-decision-record-audit-stream. Runs the Continental Grid Operator × VendorE GridSense 6.x trajectory end-to-end against a mock BES Cyber System vault. Proves the EnergyTech design — including the FIRST Suite numeric regulatory wall-clock invariant (CIP-008 1-hour) — works in code.

Part of the Kinetic Gain Protocol Suite. Sibling to fhir-resource-access-audit-reference (HealthTech), matter-decision-record-audit-stream-reference (LegalTech), and defense-decision-record-audit-stream-reference (DefenseTech).

What this proves

1. 2-axis vault gating — BES categorization × OT/IT boundary intersect to per-tuple policy. HIGH+OT transmission switching is allowed only with NERC-certified operator + cert id. HIGH+IT permits search but not generate.
2. CIP-008 1-hour wall-clock — cyber-incident events must include cip_008_report_ref.filed_at within 60 minutes of timestamp. Verifier rejects late reports as missed-window violations.
3. Human-operator-in-loop on HIGH-impact OT — verifier rejects HIGH+OT events lacking agent.human_operator_user_id_tokenized.
4. NERC certification on transmission switching — verifier rejects switching events without agent.nerc_certification_id_tokenized.

Run it

npm install && npm start
# → Built 3 events → examples/cgo-gridsense-reference-stream.ndjson
# → OK · 3 events · chain ✓ · 3 invariants ✓ (cip-008-1h + human-op-on-HIGH+OT + nerc-cert-on-switching)
npm test    # 7 unit tests

Canonical trajectory

1. Load-forecast read on MEDIUM+IT (tok_lf_a1) — no special gates.
2. CIP-008 cyber-incident flagged on HIGH+IT (tok_ids_b2) — must file via E-ISAC within 1 hour. Reference reports 55 minutes after detection.
3. Transmission-switching recommendation on HIGH+OT (tok_tso_c3) — NERC-certified operator with cert id tok_nerc_cert_007.

Composes with

• grid-decision-record-audit-stream — the spec this implements
• grid-asset-data-vault-contract-profile — vault contract referenced by the mock
• nerc-cip-readiness-evidence-bundle — evidence-bundle that ingests these events
• grid-operations-incident-card-profile — verifier failures map to Incident Cards
• Kinetic Gain Protocol Suite — umbrella

Compliance posture

Reference implementation readiness scaffolding for NERC CIP-002 through CIP-014 + TSA SD-2021-02C + DOE EO 14028 + FERC + state PUC + ISO/RTO BPM. Does NOT constitute NERC compliance attestation, TSA pipeline approval, FERC tariff approval, or NERC System Operator certification. The mock vault is in-memory — production deployments require real OT/IT-segmented infrastructure with FIPS-validated crypto + ISA/IEC 62443 zone separation. Per the standing Suite public-language guardrail: readiness · evidence · posture · controls · scaffolding — never "compliant" / "certified" without external attestation.

License

AGPL-3.0-only.