Critical infrastructure increasingly integrates operational technology, information technology, Internet of Things (IoT) devices and data-driven decision support systems. This convergence creates opportunities for monitoring and prediction while increasing dependence on data quality, cybersecurity, model credibility and institutional accountability. This paper proposes a Digital Twin reference architecture, structured into seven layers, covering physical sensing and actuation, edge validation, operational data management, digital representation, Artificial Intelligence (AI), decision support, and institutional governance and human oversight. A transversal blockchain-based trust layer asynchronously anchors selected hashes and metadata outside the time-critical control path. The study uses a design-oriented conceptual synthesis of scientific publications, technical guidance and regulatory sources. The architecture is examined through comparison with representative frameworks, a requirement-based coverage assessment and a threat-based walkthrough informed by external sources. A hypothetical water-distribution scenario illustrates the incident-to-decision workflow using synthetic measurements and an illustrative score of 0.72, which is not a calibrated probability of water loss. The proposed architecture links data, model and decision provenance while separating operational control, analytical support and evidence preservation under explicit human authority. These design provisions offer a conceptual basis for predictive resilience in critical infrastructure; their operational benefits remain to be established through implementation and empirical evaluation.