{"schema_version":1,"assessment_id":"eoa_inverse_innovation_exp03_opportunity320_20260801","source_experiment_id":"eoa_inverse_innovation_exp03_full320_20260801","cell_id":"computability_boundary_mapping__aviation_aeronautics","archetype_slug":"computability_boundary_mapping","domain_slug":"aviation_aeronautics","title":"Scope-Relative Routing for Flight-Software Assurance Claims","opportunity_summary":"Evaluate an offline assurance workflow that formalizes the controller class and safety claim, separates decidable fragments from unrestricted or unresolved queries, routes each query to an appropriate exact, abstract, or bounded method, and preserves explicit UNKNOWN and scope labels. Its value depends on first confirming that an aviation program actually asserts the hypothesized unrestricted, exact, always-terminating guarantee rather than a finite bounded requirement.","adopter_authorizer":"Flight-control or autonomy design approval holders and their verification teams would adopt the workflow; the applicable certification or design-approval authority would authorize its use in accepted assurance evidence.","scores":{"meaningful_impact":{"score":4,"rationale":"If the hypothesized binary assurance interface exists, preventing UNKNOWN, timeouts, bounded results, or abstraction alarms from becoming universal safety clearance could materially protect passengers, crews, people beneath flight paths, and engineering capacity. The score is conditional because occurrence and prevalence are unsupported."},"stakeholder_pull":{"score":2,"rationale":"The packet identifies affected developers, operators, verification teams, and authorities, but supplies no evidence that any program currently demands the unrestricted decider, experiences the stated misclassification, or has requested this intervention."},"incremental_advantage":{"score":4,"rationale":"Relative to the stated rival of adding tests, compute, or model-checking capacity while retaining a Boolean unrestricted guarantee, scope-relative routing directly addresses unsupported totality and distinguishes bounded, sound-incomplete, and unresolved results. Advantage would shrink if the real requirement is already finite and honestly labeled."},"distinctiveness_plausibility":{"score":2,"rationale":"The combined boundary-routing and guarantee-record concept is coherent, but prior art is explicitly unsearched and the packet itself identifies established assurance cases, bounded model checking, abstract interpretation, runtime assurance, and certification guidance as comparison targets."},"technical_implementability":{"score":3,"rationale":"An offline pilot using synthetic controllers, formal claims, one enforceable fragment, and labeled method comparisons is technically bounded. Production implementation remains difficult because model fidelity, conservative abstraction, reduction correctness, scope enforcement, and state explosion are unresolved."},"adoption_authority_feasibility":{"score":4,"rationale":"The packet assigns acceptance to the applicable certification or design-approval authority, assigns analysis ownership to the design approval holder, and defines a non-certifying first step that does not alter aircraft or operational decisions. Actual authority participation is not yet evidenced."},"evidence_readiness":{"score":3,"rationale":"The candidate provides separate problem and intervention falsifiers, comparison methods, exclusions, and halt conditions. It lacks an actual program requirement, representative models, checked reduction, authority-approved sample, and evidence that labels survive downstream systems."},"safety_net_benefit":{"score":5,"rationale":"Explicit UNKNOWN and scope labels, conservative-abstraction requirements, versioned assumptions, excluded operational actions, and halt-and-rollback rules directly reduce the risk of unsupported clearance while retaining bounded or sound-incomplete assurance."},"scalability":{"score":3,"rationale":"The routing and labeling structure could be reused across controller analyses, but each controller class, environment encoding, safety property, reduction, decidable fragment, and certification context may require substantial model-specific validation."}},"score_confidence":"MODERATE","costs":{"first_evidence":{"band_2026_usd":"50K_TO_250K","scope":"Offline, non-certifying problem-validation study and pilot: inspect one concrete assurance requirement, formalize its scope, construct synthetic cases, attempt one reduction and one decidable fragment, and compare exact, abstract, bounded, and UNKNOWN outputs.","confidence":"LOW","assumptions":["A small authority-approved sample is accessible without live-aircraft work.","The study uses existing formal-analysis tools and computing infrastructure.","The work requires a small team with aviation assurance and formal-methods expertise plus limited independent review.","No certification credit is sought."]},"initial_deployment_startup":{"band_2026_usd":"250K_TO_1M","scope":"Prepare the workflow for controlled use by one design organization, including model and scope contracts, routing logic, label-preserving records, tool integration, governance procedures, training, and independent verification.","confidence":"LOW","assumptions":["Deployment covers a limited controller class and one organizational assurance process.","Existing analysis tools can be integrated rather than replaced.","Safety-relevant abstractions and scope checks require documented validation.","Authority engagement is available but a new certification framework is not required."]},"operational_launch":{"band_2026_usd":"1M_TO_5M","scope":"Launch a production-quality assurance capability for selected programs, including qualified or otherwise accepted tooling where required, representative-model validation, independent review, traceability integration, personnel training, and authority coordination.","confidence":"LOW","assumptions":["Launch remains limited to selected software classes and programs rather than an industry-wide mandate.","Certification expectations may require substantial evidence and independent verification.","No flight testing or certified-software modification is included.","Legacy evidence and downstream interfaces need adaptation to preserve scope and UNKNOWN labels."]},"annual_recurring":{"band_2026_usd":"250K_TO_1M","scope":"Maintain models, fragments, tools, evidence versions, training, independent checks, authority coordination, and reclassification when software, environments, assumptions, or certification expectations change.","confidence":"LOW","assumptions":["A limited portfolio of programs uses the workflow.","Specialist formal-methods and assurance staff remain necessary.","Major tool redevelopment or fleet-wide expansion is excluded.","Governance records and scope rules are reviewed at least annually and after material changes."]}},"research_burden":"HIGH","earliest_credible_horizon":"3_TO_12_MONTHS","pipeline_gates":{"recognizable_externally_supportable_problem":{"status":"UNCERTAIN","reason":"The packet clearly states a falsifiable assurance failure, but labels it HYPOTHESIS and provides no external evidence that an aviation program actually requires an unrestricted exact terminating analyzer or collapses unresolved results into pass/fail clearance."},"identifiable_adopter_or_authorizer":{"status":"YES","reason":"The design approval holder and verification teams are identified as prospective adopters, while the applicable certification or design-approval authority explicitly owns acceptance."},"distinct_testable_incremental_claim":{"status":"YES","reason":"The proposal can be tested against the stated compute-and-testing rival by measuring whether scope-relative routing preserves semantic fidelity and explicit UNKNOWN labels while still resolving an enforceable fragment."},"bounded_next_evidence_step":{"status":"YES","reason":"The authorized offline pilot is limited to synthetic controllers and a small approved sample, compares four output modes, and is falsified by a finite already-labeled requirement, an invalid reduction, or failure to preserve semantics and labels."},"no_unresolved_safety_or_authority_stop":{"status":"YES","reason":"The first step is non-certifying and affects no aircraft decision; automatic clearance, live-flight experimentation, certified-software changes, and treating UNKNOWN as safe are excluded, with explicit halt and rollback conditions."},"implementation_cost_scope_and_range":{"status":"YES","reason":"The pilot and prospective organizational deployment are sufficiently bounded to state broad resource-equivalent bands, although exact certification, integration, data-access, and tooling requirements remain unknown."}},"blocking_evidence":["Evidence that a real aviation assurance requirement seeks a class-wide exact, always-terminating decision rather than analysis of a fixed finite controller, bounded environment, and bounded horizon.","Evidence that current interfaces or governance actually collapse timeout, bounded evidence, proof failure, abstraction alarms, or UNKNOWN into binary certification claims.","A faithful declared aviation computation and environment model, including treatment of finite hardware, continuous dynamics, uncertain sensors, learned components, and human interaction.","Independent validation that the proposed impossibility reduction preserves hazardous reachability in the declared model, or evidence that a checked total procedure exists instead.","Demonstration that the chosen decidable fragment and abstractions retain safety-relevant behavior and that scope membership is enforceable.","Demonstration that UNKNOWN, method strength, assumptions, and scope labels survive downstream assurance records and decisions.","Prior-art comparison sufficient to determine whether the combined routing and guarantee-record approach adds anything material to existing practice."],"next_evidence_step":"Run an offline, non-certifying study on one concrete program requirement, synthetic controllers, and a small authority-approved sample. Compare the proposed scope-relative router with the existing Boolean workflow and the stated added-compute rival across exact, conservative-abstract, bounded, and deliberately unresolved cases. Stop or reclassify the opportunity if the requirement is finite and already preserves UNKNOWN, the reduction fails to preserve hazardous reachability, the fragment omits relevant behavior, or any downstream interface loses the scope or UNKNOWN label.","research_questions":["Does any target program actually assert the hypothesized unrestricted, class-wide, exact, always-terminating guarantee?","Are timeouts, bounded results, proof failures, or abstraction alarms currently converted into pass/fail decisions, and at which interface?","Is the deployed assurance task finite-state or bounded in a way that makes it decidable in principle, leaving only a complexity problem?","What controller language, computation model, input encoding, environment model, horizon, and safety property must the claim cover?","Can a reduction be independently checked to preserve hazardous reachability in that declared model?","Which useful controller fragment has a checked total procedure, and can membership in that fragment be enforced?","Do conservative abstractions preserve all safety-relevant behaviors for the pilot cases?","Can scope, assumptions, method strength, and UNKNOWN remain intact through evidence management and authority review?","How does the combined workflow differ materially from existing aviation assurance cases, bounded checking, abstract interpretation, runtime assurance, and certification practices?","What evidence would the applicable authority require before accepting the workflow for any certification credit?"],"recommendation":"VALIDATE_PROBLEM_FIRST","uncertainty_constraints":["Closed-book assessment cannot establish problem prevalence, stakeholder demand, prior art, distinctiveness, market size, realized impact, or exact cost.","All impact and advantage judgments are conditional on the existence of a genuinely unrestricted exact assurance claim and a binary interface that mishandles unresolved results.","Finite airborne hardware, bounded missions, or bounded environment models may turn the central issue from undecidability into computational intractability.","Continuous dynamics, uncertain sensing, learned components, and human interaction may invalidate a software-only encoding or reduction.","Cost bands are resource-equivalent planning ranges, not quotations, and depend strongly on certification expectations, tool qualification, model access, and integration depth.","The workflow must not receive operational or certification authority merely because an offline pilot succeeds."],"closed_book_prior_art_boundary":"Prior art and world novelty are unmeasured. The candidate is classified UNSEARCHED, so this assessment makes no claim that boundary mapping, method routing, explicit UNKNOWN states, scope-labeled assurance records, or their combination is new or uncommon in aviation."}