Five layers. Each one sufficient on its own.

The second layer runs a high-frequency thermal sensor polling loop, completely independent of the main execution path. When any monitored sensor exceeds a configured threshold, this layer triggers an immediate emergency power reduction — bypassing governance gates and executing directly.

The response latency target is under 2ms from threshold breach to power reduction confirmation. This layer cannot be disabled by software policy — it is an always-on safety circuit.

All power limit requests — whether from a user application, an operator, or an automated scheduler — must pass through the governance gate before execution. The gate evaluates the request against a configurable ruleset.

Rules can encode time-based constraints, fleet-wide policies, per-workload budgets, or operator-specific limits. Requests that fail the gate are rejected and logged. The gate itself is audited — every evaluation produces a record.

Once a request has passed the governance gate, Layer 4 executes the change and immediately reads back the hardware register to verify the intended state was applied. A delta of zero is required — if the readback does not match the request, the discrepancy is flagged, logged, and an alert is triggered.

This layer catches silent hardware failures, register corruption, and any tampering that occurred between the governance gate and hardware execution.

Every event in the SPARK-XC pipeline — including actions, governance decisions, thermal events, verification results, and layer faults — is written to the cryptographic audit log. Each entry is signed with HMAC-SHA256 and chained to its predecessor.

The chain means that any insertion, deletion, or modification of a historical entry is immediately detectable. The log is the permanent, tamper-evident record of every power management decision ever made by the system.