Overview

Executive Summary

The Bidirectional Store-and-Forward Gateway (BSFG) is a hexagonal boundary primitive enabling partition-tolerant integration between two independent trust domains (zones). It guarantees that either zone may become unreachable without blocking producers, losing data, or forcing shared infrastructure. Both zones continue operating autonomously during partition. Upon reconnection, facts are replayed from cursors with idempotent boundary-level materialization (duplicate suppression via atomic insertion at forward buffers).

Problem Statement

Modern industrial plants require asynchronous integration between Enterprise IT (External Zone) and Plant OT (Internal Zone). Traditional synchronous gateways force producers to block or fail during network partitions, GC pauses, DNS failures, and extended enterprise outages. Simple message buses lose in-flight data or require shared infrastructure that violates zone autonomy.

BSFG solves this via durable asynchronous buffering with configurable idempotency: neither zone blocks on the other's availability, data survives partition, and duplicates are suppressed at ingress without background reconciliation workers.

Architectural Objectives

Explicit Non-Objectives (Scope Exclusions)

Topology: Four-Buffer Decomposition

BSFG represents the minimal factorization of durability × availability × directionality under partition tolerance constraints.

The Four Logical Roles

Dataflow Diagram

flowchart LR
  subgraph EZ["EXTERNAL ZONE (Enterprise IT)"]
    EP["Producers/Consumers"]
    ISB["ISB (store)"]
    EFB["EFB (forward)"]
    EP --> ISB
    EFB --> EP
  end

  subgraph IZ["INTERNAL ZONE (Plant OT)"]
    IP["Producers/Consumers"]
    IFB["IFB (forward)"]
    ESB["ESB (store)"]
    IFB --> IP
    IP --> ESB
  end

  ISB -- "GATE open/closed (async handoff only)" --> IFB
  ESB -- "GATE open/closed (async handoff only)" --> EFB

Buffer Flow: ISB → IFB (ingress) | ESB → EFB (egress)

Cursor Management and Frontier Semantics

The Cursor Tracker maintains per-direction state:

• next_to_send_offset — Next entry to transmit from store to forward buffer
• highest_contiguous_committed_offset — Maximal offset where all prior entries are confirmed at forward buffer

Contiguous Prefix Constraint: Acknowledgment frontier must be strictly contiguous. Truncation at store buffer is safe only for entries ≤ highest_contiguous_committed_offset, ensuring no gaps in durability history.

Recovery Protocol: On node restart, replay from checkpointed highest_contiguous_committed_offset. Duplicates are suppressed by IFB/EFB idempotency.

Formal Interface Contracts

All implementations must satisfy these interfaces:

Store Buffer Interface (ISB, ESB)

interface StoreBuffer {
  // Append payload durably; return monotonic offset
  append(payload: Bytes, metadata: Headers) → Promise<Offset>;

  // Truncate all entries before offset (safe only for contiguous prefix)
  truncateBefore(offset: Offset) → Promise<void>;

  // Replay entries starting from offset
  replay(from: Offset) → AsyncIterator<Entry>;

  // Return highest_contiguous_committed_offset from Cursor Tracker
  getFrontier() → Promise<Offset>;
}

Forward Buffer Interface (IFB, EFB)

interface ForwardBuffer {
  // Atomic idempotent insert: reject if key exists, insert if not
  putIfAbsent(idempotencyKey: Key, payload: Bytes, metadata: Headers)
    → Promise<Status {Inserted, AlreadyExists}>;

  // Retrieve by key
  get(key: Key) → Promise<Option<Bytes>>;

  // Query by time range
  queryByTimeRange(start: Timestamp, end: Timestamp) → Iterator<Entry>;
}

Cursor Tracker Interface

interface CursorTracker {
  // Record that entry at offset with idempotencyKey is confirmed
  commit(offset: Offset, idempotencyKey: Key) → Promise<void>;

  // Return current checkpoint
  getCheckpoint() → Promise<{
    nextToSend: Offset,
    committed: Offset  // highest_contiguous_committed_offset
  }>;
}

Operational Modes

Normal Mode (Gate Open)

• Low-latency handoff: ISB → IFB with immediate acknowledgment
• Zones are connected and exchange facts in real-time
• Forward buffers serve as staging for consumer pickup

Autonomous Mode (Gate Closed)

• Network partition detected; synchronous paths drop
• Producers append to ISB/ESB (local durability only)
• Consumers read from IFB/EFB (zero network dependency)
• Cursor advancement freezes at last confirmed offset
• Both zones continue operating independently

Reconciliation Mode (Gate Reopening)

• Boundary reconnects; handoff resumes
• Replay from highest_contiguous_committed_offset + 1
• IFB/EFB suppress duplicates via putIfAbsent
• Cursor advances gradually until backlog cleared

Idempotency Model

Idempotency Key Strategies

Implementations support configurable idempotency key derivation:

1. Default (SHA-256): Hash the payload bytes exactly — byte-exact deduplication
2. Semantic: Hash canonicalized payload + metadata subset — ignores non-essential fields
3. Explicit: Application-provided message_id (e.g., UUID, business key)

Idempotent Append Semantics

if message_id already exists and payload is identical:
    return existing entry offset
if message_id already exists and payload differs:
    reject as conflicting_duplicate

This contract is enforced at the Forward Buffer (IFB/EFB) via atomic putIfAbsent semantics. Producers may retry indefinitely with the same message_id and payload; the second append is idempotent.

Data Integrity and Authenticity

Integrity via Content Addressing

Facts are immutable once appended. Content hash (SHA-256) verifies payload has not been modified in transit.

Authenticity via mTLS

All zone-to-zone communication uses mutual TLS (mTLS) with certificate-based zone identity. Peer zones verify the peer's certificate Common Name (CN) to confirm the authenticated source zone.

Artifacts

Producers upload artifacts and append facts referencing them by digest. The fact includes artifact_digest: SHA256(content). Consumers verify the artifact matches the digest; mismatch indicates tampering or loss.

Failure Mode Analysis

Threat Model

Safety Certification Context

BSFG operates as an "Other System" per IEC 61508 (not itself a Safety Instrumented Function). It does not execute safety shutdowns. It provides data availability for safety systems during network partition:

• Gateway failure must not prevent safety systems from accessing last known state (achieved via local IFB/EFB reads)
• Safety-critical deployments require explicit backpressure policy: reject new writes if capacity is exhausted (no silent eviction of unacknowledged data)

Standards Alignment

Proof by Exclusion

BSFG is the minimal compositional primitive satisfying all objectives (O1–O4) and exclusions (N1–N7). Systematic elimination:

1. Request-Reply (#154): Eliminated — violates O1 via synchronous coupling
2. Message Bus (non-durable): Eliminated — violates O2 via volatile in-flight storage
3. Guaranteed Delivery (#101, unidirectional): Eliminated — insufficient for bidirectional autonomy
4. Shared Database Integration: Eliminated — violates N1 via 2PC requirement
5. Messaging Bridge (#133): Eliminated — assumes simultaneous availability, lacks intermediate staging

Conclusion: BSFG is the minimal dual Guaranteed Delivery (bidirectional) + Idempotent Receiver (configurable keys) + Messaging Gateway (abstraction).

Verification Matrix

Glossary

• BSFG: Bidirectional Store-and-Forward Gateway
• ISB: Ingress Store Buffer (External → Internal, durable write-ahead log)
• IFB: Ingress Forward Buffer (External → Internal, idempotent staging)
• ESB: Egress Store Buffer (Internal → External, durable write-ahead log)
• EFB: Egress Forward Buffer (Internal → External, idempotent staging)
• Idempotency Key: Unique identifier for duplicate suppression (hash or explicit ID)
• Contiguous Frontier: The maximal offset where all prior entries are confirmed acknowledged
• Hexagonal Port: Interface boundary enabling backend swappability
• Cursor Tracker: Externalized state machine maintaining acknowledgment frontier
• Gate: Logical circuit breaker between Normal and Autonomous modes
• Zone: Independent trust domain (External/Internal, Enterprise IT/Plant OT)

Cross-Links

Logical System Layer (How BSFG operates):

• Boundary Roles — The four roles and their invariants
• Replay Model — Handoff protocol and operational modes
• Peer Replication — Zone-to-zone replication semantics
• Message Model — Envelope and fact structure
• Artifact Handling — Out-of-band storage semantics
• Security Model — Trust, authentication, integrity

Integration Layer (How to use BSFG):

• Integration Contract — Producer and consumer obligations
• Producer Guide — How to emit facts
• Consumer Guide — How to consume facts

Substrate Layer (How to implement BSFG):

• NATS/JetStream Reference — Reference implementation
• Identity Model — Zone identity and authentication
• Deployment Guides — Operational procedures

Documentation Model:

• Documentation Layers — The three-layer ontology that governs BSFG docs