{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp03_full320_20260801","cell_id":"computability_boundary_mapping__human_computer_interaction","trajectory_id":"R","attempt_index":0,"archetype_slug":"computability_boundary_mapping","domain_slug":"human_computer_interaction","decision":"CANDIDATE","problem_id":"binary_preflight_verdicts_for_unrestricted_end_user_automations","causal_lever_id":"proof_scoped_validation_with_explicit_unknown_routing","proposal":{"problem":"HYPOTHESIS: An end-user automation or agent-authoring interface presents a binary preflight verdict—safe/unsafe, valid/invalid, or will/will-not-complete—for every workflow users can express, although the language permits loops, arbitrary code, external services, or unbounded interaction. Timeouts and inconclusive searches are consequently rendered as definite answers, creating misleading system feedback and unsafe reliance.","actors_substrate":["automation authors","interface and analyzer designers","operators approving deployment","people affected by automated actions","security and accessibility reviewers"],"observable_state":"The UI accepts unrestricted workflows, promises a universal binary verdict, lacks distinct UNKNOWN, TIMEOUT, and OUT-OF-SCOPE states, and cannot link each verdict to a stated scope and guarantee.","consequence":"Authors may deploy unsafe workflows after false reassurance, discard valid workflows after timeout-derived rejection, or repeatedly revise an automation that no total exact analyzer can handle as specified.","affected_objective":"Accurate user understanding, safe deployment, usable feedback, and avoidance of futile universal-analyzer development.","structural_mapping":[{"archetype_element":"Implicit universal problem class","domain_realization":"HYPOTHESIS: The authoring surface treats every expressible workflow as eligible for the same preflight decision.","claim_kind":"HYPOTHESIS"},{"archetype_element":"Total, exact, terminating guarantee","domain_realization":"The binary interface semantically promises a correct answer for every accepted workflow.","claim_kind":"INFERENCE"},{"archetype_element":"Expressive representation and computation model","domain_realization":"HYPOTHESIS: Workflows can contain unbounded iteration, arbitrary extensions, or adaptive external interaction.","claim_kind":"HYPOTHESIS"},{"archetype_element":"Computability boundary","domain_realization":"A checked constructive proof or valid source-to-target reduction separates guaranteed fragments from unresolved or undecidable cases.","claim_kind":"INFERENCE"},{"archetype_element":"Weaker honest fallback","domain_realization":"Restricted exact checks, sound abstraction, bounded search, and witness-producing recognition return guarantee-labelled results with explicit UNKNOWN.","claim_kind":"INFERENCE"},{"archetype_element":"Governed reclassification","domain_realization":"Changes to workflow syntax, plug-ins, external capabilities, or guarantees trigger review and updated interface language.","claim_kind":"INFERENCE"}],"component_map":[{"component":"Problem-Class Specification","status":"adapted","domain_realization":"Grammar and semantic class of user-authored workflows."},{"component":"Instance Representation Contract","status":"adapted","domain_realization":"Canonical workflow encoding, plug-in declarations, and bounds."},{"component":"Computation Model Contract","status":"adapted","domain_realization":"Analyzer powers, external calls, interaction, and resource model."},{"component":"Solvability Guarantee Profile","status":"direct","domain_realization":"Exact, sound-one-sided, bounded, approximate, or unresolved verdict."},{"component":"Quantifier and Scope Map","status":"direct","domain_realization":"Distinguishes every accepted workflow from bounded or restricted subsets."},{"component":"Computability Status Lattice","status":"direct","domain_realization":"Decidable, recognizable, relative, unresolved, or undecidable classifications."},{"component":"Constructive Procedure Witness","status":"direct","domain_realization":"Algorithm plus correctness and termination proof for each exact fragment."},{"component":"Reduction Preservation Contract","status":"direct","domain_realization":"Computable source-to-workflow translation with answer preservation."},{"component":"Computability Impossibility Certificate","status":"direct","domain_realization":"Reviewed reduction for any unrestricted impossibility conclusion."},{"component":"Assumption Register","status":"direct","domain_realization":"Language, semantics, oracle, environment, and promise assumptions."},{"component":"Decidable Subclass Map","status":"adapted","domain_realization":"Mechanically enforceable safe workflow fragments and bounds."},{"component":"One-Sided Recognition Contract","status":"adapted","domain_realization":"Witness-backed YES without fabricated NO."},{"component":"Unknown and Nontermination Policy","status":"adapted","domain_realization":"Separate UNKNOWN, TIMEOUT, OUT-OF-SCOPE, and SYSTEM-ERROR UI states."},{"component":"Fallback Solution Contract","status":"adapted","domain_realization":"Per-mode scope, guarantees, labels, and escalation behavior."},{"component":"Computability Guarantee Record","status":"direct","domain_realization":"Versioned evidence behind each public interface claim."},{"component":"Recheck Trigger","status":"adapted","domain_realization":"Grammar, plug-in, semantic, oracle, or guarantee change."},{"component":"Termination Condition","status":"adapted","domain_realization":"Declared analysis budget or proof-backed totality."},{"component":"Scope Boundary","status":"adapted","domain_realization":"Enforced fragment membership and visible exclusions."},{"component":"Decision Record","status":"direct","domain_realization":"Chosen boundary, rationale, owner, evidence, and expiry."},{"component":"Uncertainty Residue","status":"adapted","domain_realization":"Open proof obligations and workflows not classified."},{"component":"Independent Proof Review","status":"direct","domain_realization":"Reviewer checks theorem, encoding, reduction, and formalization."},{"component":"Complexity Follow-On Gate","status":"direct","domain_realization":"Exact fragments proceed to latency and resource feasibility assessment."}],"mechanism_dispositions":[{"slug":"abstract_interpretation_or_model_checking","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Sound finite abstraction supplies a labelled conservative fallback.","counterfactual_removal":"Core boundary remains, but fewer out-of-fragment workflows receive useful analysis."},{"slug":"bounded_domain_exhaustive_search","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Exhaustively checks finite workflow and trace bounds.","counterfactual_removal":"Bounded claims lose a direct completeness test."},{"slug":"computability_boundary_decision_record","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Versions boundary, evidence, UI guarantee, and recheck triggers.","counterfactual_removal":"Guarantees can drift without auditable provenance."},{"slug":"computational_complexity_analysis","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Gates proven-decidable fragments on practical latency and memory.","counterfactual_removal":"Computable fragments may be misrepresented as usable."},{"slug":"constructive_algorithm_and_correctness_proof","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Required before an exact total verdict is promised for a fragment.","counterfactual_removal":"The restricted interface lacks affirmative evidence for its guarantee."},{"slug":"diagonalization_impossibility_proof","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"A target-specific reduction is clearer than a new direct self-reference proof.","counterfactual_removal":"No change; the reduction route remains."},{"slug":"enumeration_and_dovetailing","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Unbounded running conflicts with an interactive preflight response; bounded semi-decision is used.","counterfactual_removal":"No change."},{"slug":"fallback_mode_router","disposition":"selected_load_bearing","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Routes each workflow to exact, sound, bounded, or escalation mode and labels the guarantee.","counterfactual_removal":"Weaker outputs can again be mistaken for universal decisions."},{"slug":"halting_problem_reduction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Tests whether unrestricted workflow termination or behavior checking inherits undecidability.","counterfactual_removal":"The impossibility boundary would rest on analogy rather than a certificate."},{"slug":"language_fragment_restriction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"An enforceable grammar excludes constructs that defeat the fragment's decision procedure.","counterfactual_removal":"No mechanically policed exact-answer region remains."},{"slug":"many_one_reduction_proof","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Its obligations are incorporated into the selected halting reduction rather than run separately.","counterfactual_removal":"No change if preservation obligations remain explicit."},{"slug":"promise_problem_restriction","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Unenforced promises permit authoritative outputs on violating inputs; syntactic restriction is safer.","counterfactual_removal":"No change."},{"slug":"proof_by_counterexample","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"A well-formed failing workflow can refute the existing universal product claim.","counterfactual_removal":"Overclaim detection depends more heavily on formal proof review."},{"slug":"proof_checking","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Independent checking hard-gates published decidability or impossibility claims.","counterfactual_removal":"A flawed proof could authorize misleading interface guarantees."},{"slug":"reduction_direction_checklist","disposition":"selected_supporting","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Screens source, target, direction, totality, encoding, and assumptions.","counterfactual_removal":"Wrong-direction hardness claims become more likely."},{"slug":"semi_decision_with_explicit_unknown","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Returns witness-backed YES or budget-triggered UNKNOWN, never timeout-derived NO.","counterfactual_removal":"The interface again forces inconclusive computation into a deceptive binary."},{"slug":"theorem_prover_guided_search","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Proof discovery tooling is unnecessary for the bounded first test; checking supplied certificates suffices.","counterfactual_removal":"No causal change."},{"slug":"turing_reduction_analysis","disposition":"incompatible","contribution_type":"NONE","adaptation_or_rejection":"Relative oracle degrees do not answer the product's concrete guarantee or one-sided UI requirement.","counterfactual_removal":"No change."}],"causal_chain":["HYPOTHESIS: An unrestricted authoring language plus a universal binary preflight claim creates obligations no current evidence supports.","Formal class, encoding, quantifiers, computation model, and user-visible guarantee make the obligation testable.","Constructive proofs establish exact fragments; a valid reduction may retire the unrestricted total-exact claim.","Enforceable restrictions and mode routing match each workflow to the strongest justified method.","Explicit UNKNOWN, TIMEOUT, and OUT-OF-SCOPE signifiers prevent inconclusive computation from appearing definitive.","Versioned evidence and recheck triggers keep interface claims aligned as expressiveness changes."],"baseline":"Ordinary baseline: retain the universal binary validator, improve runtime and error copy, and map timeout or analyzer failure to pass/fail.","nearest_rival":"A faster heuristic analyzer with confidence scores but no formal scope restriction or distinct unknown state.","authority_safety":{"affected_parties":["automation authors","reviewers and operators","people acted upon by workflows","maintainers of connected services"],"decision_authority":"The product owner may approve a shadow prototype; security, accessibility, and formal-methods reviewers must approve any production guarantee or enforcement change.","authorized_first_step":"Run a read-only, sandboxed comparison on 40 consented or synthetic workflows: classify scope, display guarantee-labelled outcomes, and test whether users distinguish FALSE from UNKNOWN without executing external actions.","excluded_actions":["production deployment decisions based on the prototype","labelling UNKNOWN as SAFE or FALSE","silently narrowing accepted syntax","concealing known hazards from participants","claiming undecidability before independent review"],"halt_rollback":"Halt if any known hazardous workflow receives an exact SAFE label, participants systematically interpret UNKNOWN as safe, fragment membership is not enforceable, or accessibility review fails. Disable the prototype and restore non-assertive preflight messaging while retaining logs for review."}},"negative_tests":{"strongest_counterevidence":"A mechanically enforced finite or otherwise decidable workflow language, paired with an independently checked total correct verifier and accurate binary UI, would defeat the hypothesized computability-boundary diagnosis.","analogy_break":"Human interpretation or external interaction may add information not available to the analyzer, while natural-language intent may be too ambiguous for a stable formal property. A halting analogy proves nothing unless the deployed encoding and computation model support a valid reduction and preserve the real HCI task.","failure_condition":"The approach fails if the exact fragment excludes most real workflows, UNKNOWN dominates, users treat labels as decorative, or routing errors overstate guarantees.","problem_falsifier":"Audit finds no universal exact claim: accepted inputs are already enforceably bounded, timeout and unknown remain distinct, and users accurately understand each verdict's limited scope.","intervention_falsifier":"In the bounded comparison, guarantee-labelled routing does not improve users' discrimination of FALSE versus UNKNOWN or reduce unsafe deployment choices relative to the baseline, despite correct classification and comparable task time.","risks":["False confidence from a flawed formalization or unsound abstraction","Excessive UNKNOWN results degrading usefulness","Expressiveness loss driving users to unsafe escape hatches","Automation bias transferring from binary verdicts to official-looking guarantee labels","Accessibility failures making status distinctions imperceptible","Boundary records becoming stale after language or plug-in changes"]},"null_rationale":null,"classification":{"candidate_kind":"MECHANISM_COMPOSITION","prior_art_status":"UNSEARCHED","evidence_maturity":"HYPOTHESIS"},"revision_change_log":{"revision_kind":"ORIGINAL","prior_problem_id":null,"prior_causal_lever_id":null,"problem_changed":false,"causal_lever_changed":false,"conceptual_changes":[],"operational_changes":[],"repairs_addressed":[]},"confidence":0.84,"generator_notes":"Closed-book structural transfer. The target problem and its prevalence are hypotheses; no novelty or prior-art claim is made."}