Governed Water-Tank Co-Simulation

Canonical FMI example — GOVERNED: Restraint gate + signed receipt per run
MODELED / SIMULATED 0 runtime CDN locked 8 @ c7c0ba17 Λ = Conjecture 1 OpenModelica + FMPy pattern (never Cameo/Dymola) receipt: …

OpenModelica-pattern plant FMU (A·der(level)=inflow·valve−demand) co-simulated with a PI level-controller FMU and a stochastic demand generator. Fixed-step + fixed-seed → reproducible → same receipt hash.

idle

Signed provenance receipt (DSSE)

run a co-sim to produce a signed receipt…
Related surfaces: 6DOF FMU TwinReq→Lean→FMU→Receipt
All outputs MODELED/SIMULATED — not physical hardware. Effectors SIMULATED, human-on-loop; no live vessel/weapon control. Signed receipts are integrity proofs for the simulation run, not operational data. Trust is bounded and NEVER 100%. Doctrine v11 LOCKED 749/14/163 @ kernel c7c0ba17 · Λ = Conjecture 1 (NEVER theorem) · Khipu BFT = Conjecture 2 · SLSA L1/L2 attested, L3 roadmap. Stack: OpenModelica + FMPy + SysML-v2 patterns — never Cameo/Dymola (proprietary).