{"schema_version":1,"assessment_id":"eoa_inverse_innovation_exp03_opportunity320_20260801","source_experiment_id":"eoa_inverse_innovation_exp03_full320_20260801","cell_id":"computability_boundary_mapping__engineering_design","archetype_slug":"computability_boundary_mapping","domain_slug":"engineering_design","title":"Enforced Decidable Verification with Explicit Unknown Routing","opportunity_summary":"Restrict exact, terminating controller-safety verification to a mechanically recognized decidable fragment and route all other inputs to sound approximation, witnessed-violation search, or explicit UNKNOWN, preventing partial results and timeouts from authorizing an exact PASS. The mechanism is coherent and testable on archived models, but the production premise, formal computability boundary, workflow fit, and distinctiveness remain unverified.","adopter_authorizer":"The accountable engineering safety authority that approves the admitted model language and every guarantee used in design assurance, with verification engineers and certification personnel as operational adopters.","scores":{"meaningful_impact":{"score":4,"rationale":"If unrestricted or unsupported inputs are currently collapsed into PASS or FAIL, guarantee-labelled routing could prevent unsafe clearance, unnecessary rejection, and pursuit of an impossible universal verifier. The magnitude is potentially high, but the incidence of this practice and the fidelity of formal models to physical safety decisions are unsupported."},"stakeholder_pull":{"score":2,"rationale":"Designers, operators, verification engineers, and certification personnel have identifiable stakes, but the packet supplies no evidence that an actual organization promises universal exact verification, experiences material timeout ambiguity, or would prioritize changing its workflow."},"incremental_advantage":{"score":4,"rationale":"Compared with simulation campaigns and inconsistently interpreted timeouts, the proposal adds mechanically enforced fragment admission, guarantee-labelled routing, explicit UNKNOWN, and a prohibition on converting bounded or partial results into exact PASS. Whether these features improve production decisions remains untested."},"distinctiveness_plausibility":{"score":3,"rationale":"The composition of a decidable fragment, enforced admission, fallback analysis, explicit UNKNOWN, and governance labels is internally differentiated and plausible, but prior art is explicitly unsearched, so distinctiveness is uncertain."},"technical_implementability":{"score":3,"rationale":"An archived-model router test and finite-fragment verifier appear technically bounded, but implementation depends on formal target semantics, a valid reduction or boundary proof, enforceable fragment recognition, sound abstractions, and usable fallback behavior, none of which is supplied as completed evidence."},"adoption_authority_feasibility":{"score":4,"rationale":"The packet identifies an accountable engineering safety authority, assigns approval of admitted languages and guarantees, excludes automatic certification, and specifies halt and rollback conditions. Actual organizational authority, certification alignment, and willingness to accept UNKNOWN remain unverified."},"evidence_readiness":{"score":3,"rationale":"The candidate specifies 20 finite-state and 20 unrestricted archived cases, a baseline comparison, independent proof review, and falsifiers. Readiness is limited because exhaustive bounded ground truth cannot establish unrestricted behavior and the formal boundary certificate is not yet available."},"safety_net_benefit":{"score":4,"rationale":"Explicit UNKNOWN, prohibition of UNKNOWN-as-SAFE, guarantee-labelled routing, manual-review fallback, and immediate withdrawal after any false SAFE provide meaningful containment during evaluation. Residual risks include unsound abstraction and certification of an inaccurate physical model."},"scalability":{"score":3,"rationale":"A recognizer-and-router architecture could be reused across controller projects sharing formal languages and assurance rules, but each language, property class, abstraction, and certification context may require separate proofs and governance. High UNKNOWN volume or informal escape hatches could prevent scale."}},"score_confidence":"MODERATE","costs":{"first_evidence":{"band_2026_usd":"50K_TO_250K","scope":"Inventory the deployed model and property languages, construct and independently review the proposed boundary argument, and run the archived 40-case non-production comparison with admission, label, and verdict auditing.","confidence":"MODERATE","assumptions":["Archived models and relevant semantics are accessible without major data acquisition.","The work requires verification-engineering labor, safety-authority participation, test-harness preparation, and independent formal review.","No live controller operation or certification decision is included.","Unrestricted cases require witnessed, seeded, or otherwise declared test oracles rather than universal ground truth."]},"initial_deployment_startup":{"band_2026_usd":"250K_TO_1M","scope":"Build a production-quality fragment recognizer, exact-verification route, fallback routes, guarantee labels, audit logging, integration interfaces, and validation suite for one organizational workflow.","confidence":"LOW","assumptions":["One principal controller-model language and one assurance workflow are initially targeted.","An existing verifier or analysis stack can be integrated rather than built entirely from scratch.","Formal semantics and fragment membership are mechanically enforceable.","The estimate includes engineering, safety review, software integration, and documentation but not broad fleet migration."]},"operational_launch":{"band_2026_usd":"250K_TO_1M","scope":"Qualify the integrated workflow for operational use through independent validation, assessor review, user training, process changes, controlled migration, and rollback preparation.","confidence":"LOW","assumptions":["Launch is limited to one organization or product line.","Automatic certification approval remains excluded.","Compliance and assessor coordination are substantial but do not require creation of a new regulatory regime.","No major redesign of controller models is required to enter the admitted fragment."]},"annual_recurring":{"band_2026_usd":"50K_TO_250K","scope":"Maintain the recognizer and verifier, review language or requirement changes, monitor UNKNOWN and bypass rates, audit guarantee labels, investigate incidents, and repeat assurance reviews.","confidence":"LOW","assumptions":["The admitted language and assurance rules change infrequently.","The organization retains specialist verification and safety-review capacity.","Recurring costs exclude major expansion to additional modeling languages, jurisdictions, or product families."]}},"research_burden":"HIGH","earliest_credible_horizon":"3_TO_12_MONTHS","pipeline_gates":{"recognizable_externally_supportable_problem":{"status":"YES","reason":"The packet describes a concrete engineering failure mode—timeouts, unsupported inputs, and failed searches being collapsed into PASS or FAIL—and identifies resulting safety and resource harms. Its occurrence in a real production workflow remains to be established."},"identifiable_adopter_or_authorizer":{"status":"YES","reason":"The accountable engineering safety authority is explicitly assigned approval of the admitted language and every shipped guarantee; verification engineers and certification personnel are identifiable users."},"distinct_testable_incremental_claim":{"status":"YES","reason":"The proposal claims that enforced fragment admission and labelled fallback will reduce ambiguous or overstated verdicts relative to simulation, manual review, and inconsistently interpreted timeouts. The archived comparison specifies false SAFE, admission bypass, label overstatement, and unchanged ambiguity as falsifiers."},"bounded_next_evidence_step":{"status":"YES","reason":"A 40-case archived, non-production comparison is bounded and includes a baseline, independent review, explicit exclusions, and halt conditions. Its conclusions must remain inside the declared finite or witnessed evidence fences."},"no_unresolved_safety_or_authority_stop":{"status":"YES","reason":"The authorized first step is non-production, automatic certification and UNKNOWN-as-SAFE are excluded, the accountable authority is named, and any false SAFE, admission bypass, or overstated proof label triggers halt and withdrawal. These controls support research, not live authorization."},"implementation_cost_scope_and_range":{"status":"UNCERTAIN","reason":"The packet bounds the initial experiment but does not inventory production languages, existing verifier assets, integration surfaces, compliance obligations, migration volume, or expected UNKNOWN workload, leaving deployment and recurring cost ranges low-confidence."}},"blocking_evidence":["A formal inventory determining whether deployed model and property languages are genuinely unrestricted or already form an effectively enumerable finite class with a total correct procedure.","A completed controller encoding and independently reviewed source-to-target preservation proof under declared execution and property semantics.","Evidence that fragment membership cannot be bypassed and that admitted cases produce no false SAFE labels.","Valid case-level oracles that do not treat bounded exploration as ground truth for unrestricted behavior.","Evidence that the formal problem faithfully represents consequential certification decisions and that excluded behavior is not routinely required.","Measured UNKNOWN volume, ambiguity reduction, and manual-review burden relative to the stated baseline.","Prior-art research on verification boundaries, decidable fragments, three-valued outcomes, and assurance-governance workflows."],"next_evidence_step":"On the 40 archived non-production models, first inventory and mechanically classify each model-property pair, then compare the proposed router with the existing timeout-based workflow on admission accuracy, false SAFE results, label correctness, ambiguous-verdict rate, and UNKNOWN burden. Stop and reject the intervention if any admitted case is falsely marked SAFE, membership is bypassed, labels overstate evidence, or ambiguity is not reduced; reject the problem premise if every allowed production input is already in a finite class served by a total correct procedure.","research_questions":["Do actual production model and property languages express nontermination or unbounded reachability, or are they already finite and decidable under deployed semantics?","Can the proposed reduction be formally constructed with all preservation obligations proved and independently reviewed?","Is membership in the exact fragment mechanically decidable and enforceable across every input and interface?","What sound fallback analyses and witnessed-violation searches are available, and how often do they return actionable results rather than UNKNOWN?","Does the formal model capture the certification decisions and physical hazards that stakeholders actually need to assess?","How do false SAFE, false rejection, ambiguity, analyst effort, and review time compare with simulation, testing, manual review, and current timeout handling?","Would designers shift excluded requirements into informal artifacts or bypass the admitted language?","What established mechanisms or assurance workflows already implement the same composition and governance contract?","Which authority can approve guarantee labels, require rollback, and prevent partial results from being used for certification?"],"recommendation":"PARTNERED_RESEARCH","uncertainty_constraints":["The existence and prevalence of the stated universal-verifier promise are unsupported.","The computability boundary is hypothesis-level and relative to formal model and property semantics that have not been supplied.","World novelty, prior art, prevalence, market size, and realized impact are unmeasured.","Bounded testing cannot establish safety or termination for unrestricted cases beyond its declared fence.","A sound proof about an executable model does not establish that the model faithfully represents the physical plant.","Deployment cost depends heavily on language count, existing tooling, certification obligations, migration needs, and UNKNOWN volume."],"closed_book_prior_art_boundary":"No conclusion about originality, prevalence, comparative maturity, or existing implementations is warranted. The packet marks prior art as unsearched; this assessment evaluates only the internal plausibility and testability of the sealed mechanism composition."}