WITNESS

WITNESS ingests four things about a production line: the electrical drawings, live equipment telemetry, the maintenance history, and the site safety rules. Out of those comes one output, a written recommendation with citations, delivered early enough to act on.

Telemetry arrives over MQTT or a Modbus poll and lands in a ring buffer for the live view and a Parquet archive for the historical one. Three detectors run over hourly windows: threshold rules, an IsolationForest anomaly model per channel group, and a lead-time estimator that answers the only question a maintenance planner actually asks, which is how long they have. Every step writes to a hash-linked provenance chain. The rule is blunt: if it is not in the chain, it did not happen.

Phase 3 closed against a fixed ten-seed simulation set. Recall was 1.0 on fault classes f1 through f3, false alarms ran at 0.5 per simulated day, and median lead time ranged from 3.4 to 25.6 hours depending on the fault. Precision measured 0.89 against a 0.90 target, and that gap is written into the repository rather than rounded away.

The prohibition is the design. An agent that can open a breaker is a safety system, and a safety system earns its permissions through a process this is not. WITNESS writes a recommendation and a person acts on it.