Secured Deterministic Grid Orchestration

What It Is

CitizenSolar is a secured, deterministic, policy-bounded orchestration fabric for storage-first, software-defined energy systems.

• • Storage-first orchestration for telemetry, reserve policy, operator workflow, and audit-ready event handling.
• • A deterministic control layer that keeps safety-relevant actions bounded by policy, trust state, supplier-risk status, and human approval.
• • A commercial bridge from BESS and BYOS packaging into Community Energy Bank operations, reporting, and governance workflows.

What It Is Not

CitizenSolar keeps the spearhead in a bounded infrastructure category instead of overstated autonomy language.

• • Not autonomous grid AI.
• • Not certified AI safety or certified grid control.
• • Not a live regulated dispatch or market settlement system.
• • Not a guaranteed savings or guaranteed grid revenue engine.

National-To-Nano Orchestration Stack

The orchestration layer is designed to move from jurisdictional and fleet constraints down to site, asset, and operator decisions in a traceable order.

• • Regional and jurisdictional posture: market, procurement, and supplier-risk constraints shape what the system may recommend.
• • Portfolio and fleet posture: storage fleets, reserve policy, telemetry confidence, and BYOS compatibility define the operating envelope.
• • Site and asset posture: controller identity, firmware state, interconnection rules, and local safety modes constrain dispatch logic.
• • Operator posture: recommendations, simulations, and escalations move through human review before any staged supervised execution path.

Agent Taxonomy

The current doctrine uses named agent roles so technical and procurement reviewers can understand function and action boundary at a glance.

• • Grid Sentinel (Cyber / telemetry): Detects anomalies, spoofing, telemetry gaps, and supplier-risk events. Action boundary: Observe / explain.
• • Reserve Governor (BESS / CEB): Enforces minimum reserve, SOC thresholds, and shared-storage policy rules. Action boundary: Recommend / supervised execute.
• • Load Balancer (Site / fleet): Suggests charge and discharge posture across assets. Action boundary: Simulate / recommend.
• • Forecast Agent (Analytics): Uses load, solar, weather, tariff, and SOC forecasts. Action boundary: Explain / simulate.
• • Firmware Quorum Agent (Device trust): Checks firmware signatures, version state, and update eligibility. Action boundary: Block / isolate / escalate.
• • BYOS Adapter Agent (Mixed fleet): Normalizes third-party devices and detects interface mismatch. Action boundary: Observe / classify.
• • Supplier-Risk Agent (Compliance): Screens inverter, BMS, EMS, cloud jurisdiction, and high-risk exposure. Action boundary: Explain / flag.
• • Community Ledger Agent (CEB): Synchronizes asset, capacity, reserve, event, allocation, assurance, and governance ledgers. Action boundary: Record / reconcile.
• • Audit Scribe (Evidence): Produces event trails and decision logs. Action boundary: Record only.
• • Operator Relay (Human control): Routes decisions to operator review and escalation paths. Action boundary: Human-in-loop.
• • Market Adapter Watcher (Future layer): Watches future regional market-adapter conditions. Action boundary: Disabled for live market action.

Deterministic Action Tiers

Actions are separated by explainability, operator approval, and release posture so the public release never implies uncontrolled autonomy.

• • T0 Observe: Read telemetry, device state, and market/public signals. Public release: Allowed.
• • T1 Explain: Generate causal explanation, risk note, and audit summary. Public release: Allowed.
• • T2 Recommend: Suggest operator action. Public release: Allowed.
• • T3 Simulate: Run bounded dispatch, reserve, and islanding scenarios. Public release: Allowed.
• • T4 Supervised Execute: Execute only after policy and operator approval. Public release: Limited / staged.
• • T5 Deterministic Local Fallback: Pre-approved emergency behavior. Public release: Roadmap / controlled pilots.
• • T6 Autonomous Market Action: Live market bidding and dispatch. Public release: Disabled / future only.

Causal State Graph

The orchestration model treats telemetry trust, reserve state, firmware identity, supplier-risk status, and governance conditions as explicit state inputs rather than hidden heuristics.

• • Telemetry state, reserve policy, firmware trust, supplier-risk notes, and governance requirements are treated as explicit state inputs.
• • Agents explain why a recommendation exists, what rule bounded it, and what evidence would be required to advance it.
• • The current release keeps the model explainable and operator-supervised instead of presenting opaque autonomy as a product virtue.

Deterministic Control Safeguards

The safeguard model blocks or downgrades action when trust, reserve, safety, governance, or operator-approval conditions are not satisfied.

• • G1 - If telemetry trust falls below threshold, orchestration downgrades to observe-only.
• • G2 - If firmware signature or controller identity fails, the asset is isolated from the orchestration pool.
• • G3 - If reserve minimum is violated, discharge recommendation is blocked.
• • G4 - If interconnection or export limits are unknown or exceeded, export-increasing actions are blocked.
• • G5 - If public-sector procurement or supplier-risk status is unresolved, the system is advisory-only.
• • G6 - If governance quorum is missing for shared or community assets, allocation updates are blocked.
• • G7 - If local safety, fire, or AHJ mode is active, dispatch is locked to safe fallback.
• • G8 - If model confidence is insufficient, the agent may explain but not recommend.
• • G9 - If human operator authorization is missing, the action cannot advance beyond simulation.
• • G10 - Every material recommendation must produce an audit record.

Community Energy Bank Connection

Community Energy Bank gives the orchestration layer a governed operating shell for allocation reports, reserve policy, assurance evidence, and governance review.

• • Reserve Governor and Community Ledger Agent tie deterministic control to the seven-ledger shared-storage model.
• • Shared-storage assets need governance quorum, allocation transparency, and audit-ready records before recommendations become operational.
• • This keeps community storage framed as governed resilience infrastructure rather than speculative energy finance.

BYOS And Supplier-Risk Connection

Mixed-fleet orchestration only works when adapter normalization and supplier-risk screening are explicit.

• • BYOS adapter logic normalizes third-party devices and flags interface mismatches before they enter a broader orchestration pool.
• • Supplier-risk review screens inverter, BMS, EMS, controller, and cloud dependencies for jurisdictional and trust concerns.
• • The current release treats unresolved supplier-risk or public-sector diligence gaps as advisory constraints, not as silent passes.

Business Model Stack

The orchestration spearhead only matters commercially when it is tied to readiness, packaging, software, governance, compliance, operations, and partner delivery.

• • Readiness: Orchestration Readiness Review (Fixed-fee assessment)
• • System Packaging: Compliant BESS / BYOS / telemetry stack (Hardware/software margin)
• • Software Layer: SolarINT Orchestrator / Mission Control / OnGrid Security (SaaS / license / managed service)
• • Governance Layer: Community Energy Bank ledger model (Setup + recurring governance ops)
• • Compliance Layer: Supplier-risk, procurement, jurisdictional readiness (Advisory + diligence fee)
• • Operations Layer: Monitoring, reporting, reserve policy, audit trails (Monthly recurring service)
• • Partner Layer: OEM/EPC/installer enablement (Partner program / certification / rev-share)

Orchestration Readiness Review

The first sellable offer is a fixed-fee readiness review that turns doctrine into an actionable pilot-scoping package.

• • Asset inventory and BYOS compatibility map
• • Telemetry trust review
• • Inverter/BMS/EMS supplier-risk screen
• • Reserve-policy design
• • Deterministic control guardrail map
• • Community Energy Bank ledger-readiness map
• • Operator workflow model
• • Jurisdictional compliance notes
• • Agent action-tier recommendation
• • Pilot deployment plan

Revenue Ladder And Partner Thesis

The commercial path moves from public trust and fixed-fee review into deployment packaging, recurring software, governance operations, and regional partner enablement.

• • Tier 0: Public trust layer for Public visitors, procurement reviewers, partners (Credibility and discovery surface)
• • Tier 1: CitizenSolar Orchestration Readiness Review for Municipality, C&I site, EPC, energy community, storage provider (Fixed-fee assessment)
• • Tier 2: Pilot deployment pack for Qualified deployment counterparties (Setup fee + hardware margin + managed orchestration fee)
• • Tier 3: SolarINT Orchestrator subscription for Operators, fleet owners, deployment partners (Recurring software / managed service)
• • Tier 4: Community Energy Bank operations for Shared-storage and governance-oriented programs (Setup fee + governance ops + reporting and assurance service)
• • Tier 5: Regional / national partner fabric for OEMs, installers, regional delivery partners (Partner program + deployment enablement + support services)
• • Hardware / OEM: CitizenSolar turns compliant hardware into software-governed, audit-ready, region-fit energy infrastructure.
• • EPC / Installer: CitizenSolar gives installers deterministic orchestration, telemetry, reporting, and compliance support for storage-first deployments.
• • Municipality: CitizenSolar packages storage as governed resilience infrastructure, not speculative energy finance.
• • Utility / DSO: CitizenSolar prepares local storage fleets for policy-bounded coordination and future flexibility readiness without premature market-dispatch claims.
• • Regulator / Safety Reviewer: CitizenSolar’s agentic layer is staged, bounded, logged, explainable, operator-supervised, and deterministic where safety matters.

Boundary Note

This route is intentionally bounded so procurement, technical, and partner audiences can evaluate the orchestration layer without reading it as live autonomous infrastructure.

• • CitizenSolar does not present the current release as a fully autonomous grid-control system.
• • CitizenSolar does not present the current release as a certified AI safety system or cybersecurity certification artifact.
• • CitizenSolar does not present the current release as live regulated dispatch, market settlement infrastructure, or blanket compliance proof.