The Deterministic
Environmental Execution
Control Plane
CO₂Router is a pre-execution governance engine that authorizes compute before it runs. Every decision is deterministic, cryptographically sealed, and replayable. Five binding actions. Full signal provenance. 77ms p95.
Five Binding Actions
Every authorization request returns exactly one of five binding actions. These are not recommendations — they are the output of a governance engine with execution authority.
| Action | Meaning |
|---|---|
run_now | Conditions clear — execute immediately |
reroute | Redirect to lower-carbon region |
delay | Hold until clean window opens |
throttle | Reduce resource footprint to comply |
deny | Execution refused — policy violation |
deny action distinguishes CO₂Router from advisory systems. A system that cannot deny does not govern.Provider Hierarchy
Signals are ranked by trust tier. The lowest defensible signal is used — never averaged. Every signal carries source, freshness, estimated/synthetic flags, and confidence score through the decision into the proof frame.
| Tier | Provider | Role | Status |
|---|---|---|---|
| T1 | WattTime MOER MOER current + forecast | Primary causal routing signal | live |
| T1 | EIA-930 Balance, interchange, subregion | Predictive grid telemetry | live |
| T2 | Electricity Maps Premium, per-key | Flow-traced enrichment (optional) | live |
| T3 | Ember Monthly/yearly baseline | Structural validation only | live |
| T4 | Aqueduct 2.1 / AWARE 2.0 27hr stale — monitored | Water stress index | degraded |
| T4 | CO₂Router Decision Log Grows with every decision | Proprietary moat — owned signal | live |
Multi-Objective Evaluation Order
Evaluation is sequential and exits early on policy violation. Cost is never a routing reason — it is a consequence.
SHA-256 ProofHash per Decision Frame
Every decision is sealed with a SHA-256 hash of the canonical decision envelope. The envelope includes: arbitrated signal values, policy evaluation result, decision action, selected region, reference timestamp, and operating mode. Any modification to the record invalidates the hash.
// CiResponseV2 — core proof fields
{
decisionFrameId: "32133b3a-77f5-4123-b5f6-024e8f954eba",
decision: "run_now",
proofHash: "sha256:a7f3d9...",
qualityTier: "HIGH",
signalConfidence: 0.88,
fallbackUsed: false,
carbonIntensity: 112, // gCO₂/kWh
selectedRegion: "us-west-2",
leaseExpiresAt: "2026-04-02T08:21:00Z", // +4h (HIGH tier)
estimatedFlag: false,
syntheticFlag: false,
provider_disagreement: { flag: false, pct: 3.1 }
}Latency Architecture
Hot path budget: 100ms internal quality gate. Budget allocation: 40ms signal resolution (cache-only) · 20ms scoring · 10ms governance · 10ms serialization · 20ms buffer. Provider calls never occur on the hot path — all external data flows through background workers → Redis cache → hot path.
Read Latency ADR-001 →Reference Materials
Technical Whitepaper
PDF · March 2026Architecture, signal arbitration, cryptographic decision provenance, and the SAIQ governance framework.
Architecture Diagrams
DiagramsSignal tier topology, decision pipeline, provider hierarchy, fallback chain, and enforcement path.
Latency ADR-001
ADR · AcceptedFive-layer latency control architecture. 100ms hot path budget. Measured: 77ms p95 total, 59ms p95 compute.
Data Layer Report
Internal · Engineering35+ Prisma models. Decision log, grid signal snapshots, water bundles, adaptive intelligence, observability path.
Production Audit
March 2026Full audit of engine and dashboard. Implementation status, known issues, test coverage, environment requirements.
Master System Document
12 sectionsCanonical reference: locked claims, terminology, identity, architecture principles, and distribution architecture.