{"schema_version":1,"assessment_id":"eoa_inverse_innovation_exp03_opportunity320_20260801","source_experiment_id":"eoa_inverse_innovation_exp03_full320_20260801","cell_id":"computability_boundary_mapping__data_science","archetype_slug":"computability_boundary_mapping","domain_slug":"data_science","title":"Guarantee-Labeled Leakage Analysis for Bounded Pipeline Classes","opportunity_summary":"Replace an unsupported universal LEAK/NO_LEAK promise for arbitrary executable pipelines with a reviewed computability boundary, an enforceable decidable pipeline fragment, and explicit UNKNOWN or OUT_OF_SCOPE routing for weaker analyses. The candidate supports bounded research, but not yet an impossibility claim, a proven checker, or a production guarantee.","adopter_authorizer":"The data-science platform team is the likely adopter. The platform risk owner may authorize the bounded pilot; production guarantee changes require joint approval from platform engineering and model-risk governance.","scores":{"meaningful_impact":{"score":4,"rationale":"Preventing false NO_LEAK verdicts could avert inflated validation results and unreliable model authorization while reducing wasted work on an impossible universal specification. The magnitude and prevalence of the stated failure are unsupported in the sealed candidate."},"stakeholder_pull":{"score":3,"rationale":"Model developers, validation reviewers, downstream decision owners, and affected people have identifiable interests in truthful assurance, but the packet contains no observed demand, adoption commitment, incident frequency, or evidence that users will accept restricted coverage and UNKNOWN outputs."},"incremental_advantage":{"score":4,"rationale":"Relative to converting unresolved analysis into NO_LEAK or merely extending heuristic timeouts, enforceable scope membership, a proved exact checker for a restricted fragment, and explicit UNKNOWN routing provide a materially stronger and testable assurance structure. Utility may fall if the fragment is narrow or UNKNOWN rates are high."},"distinctiveness_plausibility":{"score":3,"rationale":"The composition of a model-matched impossibility review, decidable DSL, mechanically enforced scope, and guarantee-labeled fallbacks is internally coherent and differentiated from the stated baseline. External distinctiveness cannot be established because prior art is unsearched."},"technical_implementability":{"score":3,"rationale":"A frozen-corpus prototype, restricted IR, checker, and label routing are technically bounded, but the load-bearing reduction, leakage semantics, termination and correctness proofs, enforceable scope boundary, and treatment of opaque services remain unresolved."},"adoption_authority_feasibility":{"score":4,"rationale":"The packet identifies the platform risk owner, engineering, and model-risk governance, limits pilot authority, excludes production decision changes, and specifies halt and rollback conditions. Joint production approval and caller compliance still create coordination risk."},"evidence_readiness":{"score":3,"rationale":"The candidate supplies separate problem and intervention falsifiers, a frozen-corpus pilot, comparisons, and halt criteria. It does not supply the formal reduction, fragment proof, corpus characteristics, baseline results, or evidence that the alleged unrestricted production claim exists."},"safety_net_benefit":{"score":5,"rationale":"Explicit UNKNOWN and OUT_OF_SCOPE states, prohibition of silent negative conversion, non-production evaluation, mandatory existing review, false-NO_LEAK halt criteria, and rollback of negative assurance labels directly limit harm while evidence is gathered."},"scalability":{"score":3,"rationale":"A versioned IR and checker could be reused across pipelines inside an enforceable fragment, but routine-pipeline coverage, analysis complexity, opaque external services, conservative-result volume, and governance maintenance are unresolved constraints."}},"score_confidence":"MODERATE","costs":{"first_evidence":{"band_2026_usd":"50K_TO_250K","scope":"Formalize one pipeline IR and leakage policy, review one model-matched reduction, prototype one restricted checker with UNKNOWN routing, and compare it with the current analyzer on a frozen corpus without changing production decisions.","confidence":"LOW","assumptions":["A suitable frozen corpus and platform experts are available.","The work uses one bounded IR and one leakage policy rather than all pipeline languages.","The band includes formal-methods labor, engineering, validation review, data preparation, coordination, and evaluation.","No exact labor rates, corpus size, or proof complexity are supplied."]},"initial_deployment_startup":{"band_2026_usd":"250K_TO_1M","scope":"After favorable evidence, harden the restricted checker, mechanically enforce fragment membership, integrate guarantee labels and audit records, establish governance controls, and prepare a limited non-authorizing deployment.","confidence":"LOW","assumptions":["The existing platform exposes integration points and does not require a wholesale rewrite.","Deployment remains limited to a defined pipeline class.","Security, compliance, documentation, training, and independent validation are included.","Proof repair or extensive pipeline migration could move the effort outside this band."]},"operational_launch":{"band_2026_usd":"1M_TO_5M","scope":"Launch governed production assurance across supported platform workflows, including migration tooling, monitoring for label collapse, model-risk validation, support for unsupported constructs, incident handling, and communication of versioned guarantees.","confidence":"LOW","assumptions":["Launch spans multiple teams and materially used workflows.","Existing mandatory review remains available for UNKNOWN and OUT_OF_SCOPE cases.","The checker does not need to model every opaque external service exactly.","No adoption volume, platform architecture, or compliance regime is provided."]},"annual_recurring":{"band_2026_usd":"250K_TO_1M","scope":"Maintain the IR, checker proofs, policy definitions, corpus regressions, guarantee documentation, integrations, monitoring, governance review, and escalation paths for UNKNOWN and OUT_OF_SCOPE pipelines.","confidence":"LOW","assumptions":["A small cross-functional engineering and validation function is retained.","Pipeline-language and leakage-policy changes require continuing proof and regression work.","Existing infrastructure absorbs most compute and storage needs.","The rate of platform change and review volume are unknown."]}},"research_burden":"HIGH","earliest_credible_horizon":"3_TO_12_MONTHS","pipeline_gates":{"recognizable_externally_supportable_problem":{"status":"YES","reason":"The candidate specifies an observable failure condition—an unrestricted analyzer that maps timeouts or unresolved cases to NO_LEAK—and a credible causal consequence through inflated validation and unreliable authorization. Its prevalence remains unmeasured, but the problem itself is testable."},"identifiable_adopter_or_authorizer":{"status":"YES","reason":"The platform team is the adopter; the platform risk owner can authorize the bounded pilot, while platform engineering and model-risk governance jointly control production guarantee changes."},"distinct_testable_incremental_claim":{"status":"YES","reason":"The proposal claims that an enforceable restricted checker plus explicit UNKNOWN routing avoids unsupported negative assurance more defensibly than unrestricted heuristic analysis with longer timeouts; false NO_LEAK results, unenforceable membership, or label overinterpretation falsify that claim."},"bounded_next_evidence_step":{"status":"YES","reason":"The authorized frozen-corpus study limits work to one IR, one reviewed reduction, one restricted checker, and verdict comparison, with no production decision changes."},"no_unresolved_safety_or_authority_stop":{"status":"YES","reason":"The first step is within stated authority and includes exclusions, halt conditions, and rollback to existing review. Formal uncertainty blocks stronger claims but does not block the non-production evidence step."},"implementation_cost_scope_and_range":{"status":"UNCERTAIN","reason":"The candidate defines implementation components but provides no staffing, corpus size, platform architecture, integration count, proof complexity, or compliance workload; broad resource bands can be hypothesized but require external scoping."}},"blocking_evidence":["Whether the platform actually accepts unrestricted executable pipelines and makes a total exact LEAK/NO_LEAK guarantee.","A precise leakage policy and computation model that capture material real-world leakage channels.","A correctly directed, preservation-reviewed reduction establishing only the claimed unrestricted boundary.","A fragment grammar with mechanically enforceable membership plus termination and correctness proofs for its checker.","Frozen-corpus evidence on false NO_LEAK results, false alarms, UNKNOWN rates, routine-pipeline coverage, and analysis complexity.","Evidence that users and downstream systems preserve UNKNOWN and OUT_OF_SCOPE semantics rather than treating them as NO_LEAK.","External prior-art research before any novelty or distinctiveness claim."],"next_evidence_step":"Run the authorized frozen-corpus study: inventory whether accepted pipelines violate an effectively finite enforceable class; formalize one leakage predicate and pipeline IR; independently review one model-matched reduction; implement a restricted checker with mechanical scope testing and explicit UNKNOWN routing; then compare its verdicts, false-NO_LEAK count, UNKNOWN rate, coverage, and runtime against the current timeout-based analyzer. Stop if the inventory falsifies the unrestricted premise, the reduction fails preservation review, any in-scope false NO_LEAK occurs, membership is unenforceable, or callers collapse UNKNOWN.","research_questions":["Does the deployed platform actually make the unrestricted total-exact claim described by the candidate?","What temporal and informational leakage policy is sufficiently complete for the intended decisions?","Under the same program representation and computation model, does the proposed reduction preserve the formal leakage property?","Which routinely used pipelines fit an enforceable decidable fragment?","Can the restricted checker be proved terminating and correct, especially for NO_LEAK verdicts?","How often do sound abstraction and bounded witness search return false alarms or UNKNOWN on the frozen corpus?","Do versioned labels remain intact in interfaces, reports, governance workflows, and downstream decisions?","How should opaque external services be scoped or represented without overstating assurance?","What adjacent static-analysis, information-flow, lineage, workflow-language, and leakage-detection approaches already exist?","What staffing, integration, validation, and recurring-governance resources would production use require?"],"recommendation":"PARTNERED_RESEARCH","uncertainty_constraints":["Closed-book assessment cannot establish problem prevalence, realized impact, market size, external novelty, or prior-art position.","The candidate describes but does not exhibit the reduction, fragment proof, checker, or pilot results.","Cost bands are resource-equivalent planning ranges with low confidence, not observed prices or estimates.","The computability argument is model-relative and may not apply if the deployed pipeline class is already finite, acyclic, fully observable, and decidable.","Operational value depends on routine-pipeline coverage and on users preserving the meaning of UNKNOWN and OUT_OF_SCOPE.","The earliest horizon refers to a credible bounded research result, not a production-grade universal assurance capability."],"closed_book_prior_art_boundary":"Prior-art status is UNSEARCHED. This assessment evaluates only the proposal's internal distinction from its stated baseline and nearest rival; it makes no claim about novelty, prevalence, existing implementations, or superiority to external methods."}