{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp03_full320_20260801","cell_id":"computability_boundary_mapping__public_administration_policy","trajectory_id":"R","attempt_index":0,"archetype_slug":"computability_boundary_mapping","domain_slug":"public_administration_policy","decision":"CANDIDATE","problem_id":"unbounded_policy_program_assurance","causal_lever_id":"enforceable_policy_language_boundary_with_explicit_unknown","proposal":{"problem":"A public agency requires a pre-deployment analyzer to decide, for every program expressible in an extensible machine-executable policy language and every possible case, whether processing terminates and preserves specified legality and service invariants. Timeouts and inconclusive searches are currently liable to be reported as failures or approvals. The unrestricted total-exact requirement may be impossible, while narrower fragments may remain decidable.","actors_substrate":["agency policy owners","rules-engine developers","caseworkers and reviewers","applicants and regulated parties","oversight and appeals bodies"],"observable_state":"The agency makes unrestricted assurance claims from finite tests, lacks a distinct UNKNOWN result, and cannot link analyzer guarantees to enforceable language and input boundaries.","consequence":"An impossible or mismatched assurance requirement consumes implementation resources and can produce false clearance, false rejection, or opaque non-decisions affecting public entitlements and obligations.","affected_objective":"Deliver timely, legally faithful, reviewable policy implementation without representing bounded or one-sided evidence as universal assurance.","structural_mapping":[{"archetype_element":"unbounded problem class","domain_realization":"all programs in an extensible executable-policy language over all admissible cases","claim_kind":"HYPOTHESIS"},{"archetype_element":"total exact decider","domain_realization":"an analyzer promised to terminate with a correct Boolean assurance verdict for every program and case","claim_kind":"INFERENCE"},{"archetype_element":"computability model","domain_realization":"the policy interpreter plus declared data, service, human, and interaction capabilities","claim_kind":"INFERENCE"},{"archetype_element":"decidable region","domain_realization":"a mechanically enforced finite-state or otherwise proved-decidable policy-language fragment","claim_kind":"HYPOTHESIS"},{"archetype_element":"honest weaker fallback","domain_realization":"sound conservative analysis, bounded checking, or escalation returning labeled UNKNOWN when assurance is unavailable","claim_kind":"HYPOTHESIS"},{"archetype_element":"boundary drift","domain_realization":"new recursion, external calls, or unbounded case generation invalidating an earlier guarantee","claim_kind":"INFERENCE"}],"component_map":[{"component":"Problem-Class Specification","status":"adapted","domain_realization":"policy programs, cases, properties, and universal claim"},{"component":"Instance Representation Contract","status":"adapted","domain_realization":"versioned policy grammar and case-data schema"},{"component":"Computation Model Contract","status":"adapted","domain_realization":"interpreter and declared external capabilities"},{"component":"Solvability Guarantee Profile","status":"direct","domain_realization":"exact, sound-incomplete, bounded, or escalated"},{"component":"Quantifier and Scope Map","status":"direct","domain_realization":"every program, case, execution, and property quantified explicitly"},{"component":"Computability Status Lattice","status":"direct","domain_realization":"decidable, recognizable, partial, relative, or unresolved"},{"component":"Constructive Procedure Witness","status":"adapted","domain_realization":"analyzer with correctness and termination argument"},{"component":"Reduction Preservation Contract","status":"direct","domain_realization":"computable source-to-policy-program mapping with preserved answer"},{"component":"Computability Impossibility Certificate","status":"direct","domain_realization":"checked proof limited to the unrestricted class"},{"component":"Assumption Register","status":"adapted","domain_realization":"grammar, semantics, data, oracle, and bound assumptions"},{"component":"Decidable Subclass Map","status":"adapted","domain_realization":"enforceable safe language fragments"},{"component":"One-Sided Recognition Contract","status":"adapted","domain_realization":"witness-backed confirmation without fabricated negative"},{"component":"Unknown and Nontermination Policy","status":"direct","domain_realization":"UNKNOWN, TIMEOUT, OUT_OF_SCOPE, and ERROR remain distinct"},{"component":"Fallback Solution Contract","status":"adapted","domain_realization":"guarantee-labeled routing and human review"},{"component":"Computability Guarantee Record","status":"adapted","domain_realization":"versioned public assurance statement"},{"component":"Recheck Trigger","status":"adapted","domain_realization":"grammar, interpreter, property, or external-capability change"},{"component":"Termination Condition","status":"direct","domain_realization":"proved termination or explicit analysis budget"},{"component":"Scope Boundary","status":"direct","domain_realization":"machine-enforced fragment and case preconditions"},{"component":"Decision Record","status":"direct","domain_realization":"approved boundary, rationale, and owner"},{"component":"Uncertainty Residue","status":"direct","domain_realization":"unproved obligations and uncovered behaviors"},{"component":"Independent Proof Review","status":"adapted","domain_realization":"separate technical and policy-semantics review"},{"component":"Complexity Follow-On Gate","status":"direct","domain_realization":"resource analysis after decidability is established"}],"mechanism_dispositions":[{"slug":"abstract_interpretation_or_model_checking","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Conservatively checks an approved abstraction while labeling false-alarm residue.","counterfactual_removal":"The fallback loses a sound automated assurance mode."},{"slug":"bounded_domain_exhaustive_search","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Exhausts a small, precisely encoded pilot domain only.","counterfactual_removal":"The pilot loses complete within-bound evidence."},{"slug":"computability_boundary_decision_record","disposition":"selected_load_bearing","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Versions the boundary, guarantee, owner, and triggers.","counterfactual_removal":"Guarantees can drift without traceability."},{"slug":"computational_complexity_analysis","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Assesses feasible scale only after solvability classification.","counterfactual_removal":"Decidable options may still be operationally unusable."},{"slug":"constructive_algorithm_and_correctness_proof","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Required before claiming a fragment has a total exact analyzer.","counterfactual_removal":"The positive boundary lacks a witness."},{"slug":"diagonalization_impossibility_proof","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Redundant if a simpler valid reduction settles the class.","counterfactual_removal":"No change to the chosen proof path."},{"slug":"enumeration_and_dovetailing","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Unbounded nontermination is unsuitable for administrative decisions.","counterfactual_removal":"No change; bounded semi-decision is retained."},{"slug":"fallback_mode_router","disposition":"selected_load_bearing","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Routes in-scope cases to exact, conservative, bounded, or review modes.","counterfactual_removal":"Weaker guarantees can be silently overstated."},{"slug":"halting_problem_reduction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Used only if executable-policy expressiveness supports a valid embedding.","counterfactual_removal":"The unrestricted impossibility claim may remain unresolved."},{"slug":"language_fragment_restriction","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Enforces a syntactic fragment with a proved decision procedure.","counterfactual_removal":"No enforceable total-exact service boundary remains."},{"slug":"many_one_reduction_proof","disposition":"selected_supporting","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Supplies the total answer-preserving map for any hardness transfer.","counterfactual_removal":"The reduction certificate loses its preservation contract."},{"slug":"promise_problem_restriction","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Unenforced promises permit authoritative outputs on violating cases; syntactic enforcement is safer.","counterfactual_removal":"No change to the enforced-fragment design."},{"slug":"proof_by_counterexample","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Tests and refutes overbroad analyzer claims without proving impossibility.","counterfactual_removal":"Cheap claim-boundary testing is lost."},{"slug":"proof_checking","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Independently checks the exact theorem and exposed premises.","counterfactual_removal":"A proof gap could authorize an unsafe boundary."},{"slug":"reduction_direction_checklist","disposition":"selected_supporting","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Gates, but does not certify, a reduction.","counterfactual_removal":"Direction and scope errors become easier to miss."},{"slug":"semi_decision_with_explicit_unknown","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Returns witnessed YES or bounded UNKNOWN, never timeout-as-NO.","counterfactual_removal":"Inconclusive searches can become false verdicts."},{"slug":"theorem_prover_guided_search","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Proof discovery tooling is optional and cannot interpret policy-semantic fidelity.","counterfactual_removal":"Manual checked proofs remain sufficient."},{"slug":"turing_reduction_analysis","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Relative degrees add no needed operational distinction here.","counterfactual_removal":"The chosen boundary and fallback are unchanged."}],"causal_chain":["Formalize the executable-policy class, semantics, quantifiers, and computation model.","Seek a total constructive witness and a scope-matched impossibility reduction in parallel.","Enforce proved-decidable fragments and classify remaining inputs without collapsing statuses.","Route each query to the strongest justified mode and label its guarantee.","Preserve UNKNOWN and escalate consequential cases, preventing unsupported automated decisions.","Reclassify whenever language, model, property, or external capability changes."],"baseline":"Continue building and benchmarking one unrestricted Boolean analyzer; treat timeout as failure, false, or manual exception.","nearest_rival":"Use an ordinary risk-based human-in-the-loop rules-engine review without first proving which universal guarantees are available.","authority_safety":{"affected_parties":["benefit applicants","licensees and regulated parties","caseworkers","agency program owners","oversight and appeals bodies"],"decision_authority":"The agency program executive may authorize a pilot; legal/policy owners approve semantic scope, and an independent technical reviewer approves boundary claims.","authorized_first_step":"Offline pilot on one non-live policy family: formalize its grammar and invariants, enforce a small fragment, exhaust a bounded corpus, and compare exact, conservative, and UNKNOWN outputs with expert adjudication.","excluded_actions":["production eligibility denial or sanction from UNKNOWN, TIMEOUT, or OUT_OF_SCOPE","claiming unrestricted impossibility without a checked scope-matched proof","silently admitting policies outside the enforced fragment","treating formal assurance as proof of legal or normative correctness"],"halt_rollback":"Halt if the abstraction misses a known behavior, fragment membership is bypassed, outputs are mislabeled, or expert disagreement reveals semantic mismatch; disable automated routing and revert all pilot cases to existing review."}},"negative_tests":{"strongest_counterevidence":"The actual deployed language and case space may already be finite, effectively enumerable, and covered by a total correct analyzer; then the issue is complexity or assurance quality, not a computability boundary.","analogy_break":"Executable policy programs are only models of administration. Undecidability of a program property does not imply that a particular case is unresolvable, that human judgment is an oracle, or that the underlying policy is legally invalid.","failure_condition":"The approach fails if the restricted language omits necessary policy distinctions, membership cannot be enforced, or formal properties do not faithfully represent administrative duties.","problem_falsifier":"Show that the claimed service covers only a fixed finite class with an effective complete enumeration and an independently verified total correct procedure, with no unrestricted public claim.","intervention_falsifier":"In the bounded pilot, the boundary-and-router design does not reduce mislabeled results or unsupported assurance claims versus baseline, or produces materially more unresolved consequential cases without safer disposition.","risks":["A formally decidable fragment may exclude cases affecting vulnerable groups.","Conservative analysis may overload reviewers with false alarms.","Officials may treat UNKNOWN as discretionary permission to deny or delay.","A checked theorem may concern the wrong policy semantics.","Complexity may make a decidable fragment unusable at service deadlines."]},"null_rationale":null,"classification":{"candidate_kind":"MECHANISM_COMPOSITION","prior_art_status":"UNSEARCHED","evidence_maturity":"HYPOTHESIS"},"revision_change_log":{"revision_kind":"ORIGINAL","prior_problem_id":null,"prior_causal_lever_id":null,"problem_changed":false,"causal_lever_changed":false,"conceptual_changes":[],"operational_changes":[],"repairs_addressed":[]},"confidence":0.86,"generator_notes":"The fit depends on the agency making a reusable total-exact claim over an extensible executable-policy class. It does not apply to a single bounded adjudication, semantic ambiguity requiring prior clarification, or a known-decidable problem whose only difficulty is resource cost."}