{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp03_full320_20260801","cell_id":"computability_boundary_mapping__military_strategic_studies","trajectory_id":"R","attempt_index":0,"archetype_slug":"computability_boundary_mapping","domain_slug":"military_strategic_studies","decision":"CANDIDATE","problem_id":"universal_autonomous_mission_policy_assurance","causal_lever_id":"enforceable_policy_scope_with_labeled_assurance_fallbacks","proposal":{"problem":"A defense organization requires a pre-deployment system to decide, for every autonomous mission policy and every admissible adversary-environment evolution, whether the policy will terminate and remain within rules of engagement. The policy language, environment model, quantifiers, and meaning of a timeout are unspecified, so finite scenario success may be reported as universal assurance while implementation teams pursue a guarantee that may be unavailable for the unrestricted policy class.","actors_substrate":["command authority and rules-of-engagement owners","autonomy acquisition and assurance teams","mission-policy authors","operators supervising autonomous systems","adversaries, civilians, friendly forces, and coalition partners represented in the environment model"],"observable_state":"Assurance reports collapse verified-safe, no violation found, timeout, out-of-model, and unknown into a deployment-facing pass/fail result; claimed coverage exceeds the tested or formally analyzed policy class.","consequence":"Unsafe policies may receive apparent clearance, useful autonomy may be delayed by an impossible universal-verifier requirement, and commanders cannot tell which assurance claim applies to a mission change.","affected_objective":"Obtain credible pre-deployment assurance without overstating what analysis proves or silently excluding operationally relevant policies and environments.","structural_mapping":[{"archetype_element":"unrestricted problem class","domain_realization":"arbitrary autonomous mission policies interacting with unbounded adaptive adversary-environment traces","claim_kind":"HYPOTHESIS"},{"archetype_element":"total exact decision demand","domain_realization":"a guaranteed terminating verdict on termination and rules-of-engagement compliance for every admitted policy and trace","claim_kind":"INFERENCE"},{"archetype_element":"model-relative boundary proof","domain_realization":"a checked constructive procedure or impossibility reduction tied to the exact policy syntax, semantics, and environment model","claim_kind":"INFERENCE"},{"archetype_element":"decidable region","domain_realization":"an enforceable finite-state or otherwise restricted mission-policy language with stated environment bounds","claim_kind":"HYPOTHESIS"},{"archetype_element":"honest weaker fallback","domain_realization":"sound abstraction, bounded counterexample search, or one-sided violation recognition returning explicit UNKNOWN outside its guarantee","claim_kind":"INFERENCE"}],"component_map":[{"component":"Problem-Class Specification","status":"adapted","domain_realization":"Define the admitted policy and adversary-environment class."},{"component":"Instance Representation Contract","status":"adapted","domain_realization":"Version policy syntax, state variables, ROE predicates, and trace encoding."},{"component":"Computation Model Contract","status":"adapted","domain_realization":"State analyzer capabilities, oracle-like human inputs, sensors, and resource model."},{"component":"Solvability Guarantee Profile","status":"direct","domain_realization":"Separate total exact, sound incomplete, bounded, and relative guarantees."},{"component":"Quantifier and Scope Map","status":"direct","domain_realization":"Distinguish all policies/all traces from a named policy or bounded scenario set."},{"component":"Computability Status Lattice","status":"direct","domain_realization":"Classify each assurance question as decidable, recognizable, partial, relative, or unresolved."},{"component":"Constructive Procedure Witness","status":"direct","domain_realization":"For any decidable fragment, retain its analyzer plus correctness and termination arguments."},{"component":"Reduction Preservation Contract","status":"direct","domain_realization":"Require a total computable source-to-policy translation preserving the assurance answer."},{"component":"Computability Impossibility Certificate","status":"direct","domain_realization":"Retain a checked reduction or direct proof before declaring the unrestricted class undecidable."},{"component":"Assumption Register","status":"direct","domain_realization":"Record policy semantics, environment closure, ROE formalization, and external capabilities."},{"component":"Decidable Subclass Map","status":"adapted","domain_realization":"Map enforceable finite-state, bounded-horizon, or syntactically restricted policy regions."},{"component":"One-Sided Recognition Contract","status":"adapted","domain_realization":"Confirm a witnessed violation without claiming that failure to find one proves safety."},{"component":"Unknown and Nontermination Policy","status":"direct","domain_realization":"Keep UNKNOWN, timeout, out-of-scope, analyzer failure, safe, and unsafe distinct."},{"component":"Fallback Solution Contract","status":"direct","domain_realization":"Label the exact guarantee of each restricted, abstract, bounded, or escalated mode."},{"component":"Computability Guarantee Record","status":"direct","domain_realization":"Version-link the shipped claim to its model, proof, and analyzer."},{"component":"Recheck Trigger","status":"adapted","domain_realization":"Reclassify after policy-language, ROE, environment, sensor, or assistance changes."},{"component":"Termination Condition","status":"direct","domain_realization":"Specify total termination or the resource bound that produces UNKNOWN."},{"component":"Scope Boundary","status":"direct","domain_realization":"Mechanically reject or quarantine policies outside the assured fragment."},{"component":"Decision Record","status":"direct","domain_realization":"Record the accepted assurance boundary and deployment interpretation."},{"component":"Uncertainty Residue","status":"direct","domain_realization":"List unproved obligations and unmodeled behaviors."},{"component":"Independent Proof Review","status":"direct","domain_realization":"Have an independent assurance function check formal claims and reductions."},{"component":"Complexity Follow-On Gate","status":"direct","domain_realization":"Assess operational feasibility only after in-principle solvability is established."}],"mechanism_dispositions":[{"slug":"abstract_interpretation_or_model_checking","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Use a sound over-approximation or finite model for the restricted policy class; distinguish proved safety from possible, potentially spurious violations.","counterfactual_removal":"Without a sound weaker analyzer, narrowing the universal claim yields little usable assurance."},{"slug":"bounded_domain_exhaustive_search","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Exhaust synthetic policies and traces only within an explicit finite pilot bound.","counterfactual_removal":"The boundary proposal survives, but its first test loses complete within-bound coverage."},{"slug":"computability_boundary_decision_record","disposition":"selected_load_bearing","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Version the chosen policy fragment, guarantee, assumptions, and recheck triggers.","counterfactual_removal":"Assurance scope can drift silently across mission and software changes."},{"slug":"computational_complexity_analysis","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Gate latency and resource assessment after a fragment is shown decidable.","counterfactual_removal":"A decidable analyzer could still be fielded despite unusable mission-planning cost."},{"slug":"constructive_algorithm_and_correctness_proof","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Require an analyzer and totality/correctness proof for any exact fragment claim.","counterfactual_removal":"The decidable-side classification would lack a positive witness."},{"slug":"diagonalization_impossibility_proof","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Reject initially because a domain-specific self-referential construction is not supplied; test a reduction first.","counterfactual_removal":"No material change; impossibility can be supported by a valid reduction."},{"slug":"enumeration_and_dovetailing","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Unbounded recognition is operationally unsuitable for deployment assurance; use a bounded recognizer with UNKNOWN.","counterfactual_removal":"No change because the bounded protocol supplies the needed behavior."},{"slug":"fallback_mode_router","disposition":"selected_load_bearing","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Route by enforceable scope to exact, sound-abstract, bounded, or human-review modes and label each result.","counterfactual_removal":"Callers could mistake fallback output for universal clearance."},{"slug":"halting_problem_reduction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Attempt only if arbitrary computation can be faithfully embedded in the declared mission-policy semantics.","counterfactual_removal":"There would be no justified route from repeated verifier failure to class-wide impossibility."},{"slug":"language_fragment_restriction","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Define a mechanically enforceable policy fragment admitting a total assurance procedure.","counterfactual_removal":"Out-of-class policies could enter an analyzer whose guarantee does not cover them."},{"slug":"many_one_reduction_proof","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Use as the preservation discipline for any halting-source embedding.","counterfactual_removal":"The impossibility inference could rest on an invalid or one-directional analogy."},{"slug":"promise_problem_restriction","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"A mere caller promise is too weak for safety assurance unless mechanically enforced; prefer syntactic restriction.","counterfactual_removal":"No change because enforceable fragment membership is stronger."},{"slug":"proof_by_counterexample","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Use an in-scope policy missed or misclassified by the current analyzer to refute universal claims.","counterfactual_removal":"Pilot failures would be less decisive against overbroad coverage claims."},{"slug":"proof_checking","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Independently verify constructive and impossibility certificates against the stated theorem.","counterfactual_removal":"A proof gap could authorize an incorrect assurance boundary."},{"slug":"reduction_direction_checklist","disposition":"selected_supporting","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Gate reductions on source-to-target direction, totality, computability, preservation, and assumptions.","counterfactual_removal":"Review remains possible but is more exposed to a common invalid-transfer error."},{"slug":"semi_decision_with_explicit_unknown","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Bound sound violation search and return UNKNOWN, never SAFE, when unconfirmed.","counterfactual_removal":"Timeout could again be laundered into a safety verdict."},{"slug":"theorem_prover_guided_search","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Optional implementation aid, not necessary to the boundary decision; prover timeout supplies no verdict.","counterfactual_removal":"No causal change; proofs may be constructed and checked by other means."},{"slug":"turing_reduction_analysis","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Relative oracle degrees are unnecessary for the initial exact-versus-fallback deployment decision.","counterfactual_removal":"No material change to the proposed classification."}],"causal_chain":["Formalize the policy class, trace semantics, ROE property, computation model, and universal guarantee.","Seek both a constructive total analyzer and a valid source-to-target impossibility reduction under the same contracts.","Mechanically restrict inputs where an exact terminating analyzer exists; preserve unresolved status elsewhere.","Route remaining inputs to sound abstraction or bounded violation search with explicit UNKNOWN and human escalation.","Version the evidence and recheck when operational language, environment, or external capabilities change."],"baseline":"Manual safety cases plus finite simulation and scenario testing, with timeouts or absence of discovered violations often compressed into a deployment recommendation.","nearest_rival":"Apply finite-state model checking to selected policies without first defining whether the operational policy language and environment remain inside that finite model.","authority_safety":{"affected_parties":["operators and commanders relying on assurance labels","friendly and coalition forces","civilians and other persons exposed to autonomous action","policy authors and assurance personnel accountable for clearance"],"decision_authority":"The designated operational commander retains deployment authority; the ROE owner defines the normative property, and an independent assurance authority approves only the scope and meaning of the evidence.","authorized_first_step":"Run a sandboxed pilot on a small synthetic policy language and bounded simulated environment: formalize one ROE property, attempt both a total analyzer and a checked reduction, exhaust all instances within the pilot bound, and measure SAFE, violation, UNKNOWN, and out-of-scope rates.","excluded_actions":["live weapon release or target engagement","treating UNKNOWN, timeout, or out-of-scope as SAFE","claiming unrestricted undecidability without a checked matching proof","expanding the assured fragment without reclassification and independent review"],"halt_rollback":"Halt the pilot if the ROE formalization is disputed, fragment membership cannot be enforced, a supposedly sound analyzer misses a seeded violation, or result labels are collapsed downstream; withdraw the affected guarantee record and revert all cases to human review."}},"negative_tests":{"strongest_counterevidence":"A precise, enforceably finite policy and environment model may already cover the actual requirement and admit a known total verifier; then the problem is complexity and model validity, not a computability boundary.","analogy_break":"Strategic adversaries and physical environments are not automatically equivalent to arbitrary programs. A halting analogy fails unless their relevant behavior is captured by the declared encoding and a property-preserving computable embedding.","failure_condition":"The intervention fails if the restricted language excludes operationally necessary behavior, the abstraction is unsound, or commanders interpret a weaker guarantee as mission-wide clearance.","problem_falsifier":"The diagnosed problem is falsified if all deployment-relevant policies and traces are demonstrably within a fixed enforceable finite class, assurance labels already preserve unknown and scope, and no universal claim extends beyond that class.","intervention_falsifier":"The intervention is falsified if, under an independently reviewed pilot formalization, boundary routing and explicit UNKNOWN do not reduce false universal-clearance claims or cannot produce a useful assured subclass compared with the baseline.","risks":["A formally verified model may misrepresent ROE or physical behavior.","Restriction may remove tactically important expressiveness and induce untracked escape hatches.","False alarms from coarse abstraction may cause alert disregard.","Boundary records may confer authority on an incorrect or stale proof.","Human escalation may be too slow or inconsistent for operational timelines."]},"null_rationale":null,"classification":{"candidate_kind":"DOMAIN_TRANSFER","prior_art_status":"UNSEARCHED","evidence_maturity":"HYPOTHESIS"},"revision_change_log":{"revision_kind":"ORIGINAL","prior_problem_id":null,"prior_causal_lever_id":null,"problem_changed":false,"causal_lever_changed":false,"conceptual_changes":[],"operational_changes":[],"repairs_addressed":[]},"confidence":0.82,"generator_notes":"Closed-book structural transfer. The candidate is conditional on faithfully formalizing mission policies and adversary-environment traces; no claim is made that the unrestricted target class is already proved undecidable."}