{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp03_full320_20260801","cell_id":"layer_decay_and_expiration_management__security_intelligence","trajectory_id":"R","attempt_index":0,"archetype_slug":"layer_decay_and_expiration_management","domain_slug":"security_intelligence","decision":"CANDIDATE","problem_id":"stale_security_intelligence_active_by_default","causal_lever_id":"lifecycle_state_gated_intelligence_visibility","proposal":{"problem":"Security-intelligence repositories can leave superseded reports, indicators, watchlists, and assessments discoverable as current by default after their validity changes, causing analysts or automated consumers to rely on stale judgments; indiscriminate deletion, however, can destroy provenance, investigative reconstruction, legal evidence, or accountability.","actors_substrate":["intelligence analysts and watch officers","collection and assessment teams","repository and security administrators","automated alerting and enrichment systems","oversight, legal, records, and investigative personnel","people or organizations affected by intelligence-driven decisions","temporally deposited reports, indicators, assessments, and watchlist entries"],"observable_state":"A sampled repository contains aged or contradicted artifacts without explicit active, superseded, expired, held, or archived states, and ordinary search or feeds return them alongside current intelligence.","consequence":"Stale artifacts may shape prioritization, attribution, alerts, or scrutiny, while cleanup is postponed or performed unsafely because dependencies and preservation obligations are unclear.","affected_objective":"Keep intelligence retrieval current and interpretable while preserving necessary provenance, reconstruction, evidentiary value, and controlled recoverability.","structural_mapping":[{"archetype_element":"sequentially accumulated layers","domain_realization":"Reports, indicators, assessments, watchlist entries, and enrichment products are deposited over time into intelligence repositories.","claim_kind":"INFERENCE"},{"archetype_element":"changing active usefulness or validity","domain_realization":"An artifact may become obsolete through supersession, changed adversary behavior, expired observables, or revised assessment while retaining historical value.","claim_kind":"HYPOTHESIS"},{"archetype_element":"stale layers masquerading as current","domain_realization":"Unlabeled legacy intelligence can remain eligible for ordinary search, feeds, or automated enrichment.","claim_kind":"HYPOTHESIS"},{"archetype_element":"retention versus deletion tension","domain_realization":"Removing obsolete intelligence can conflict with provenance, source-handling, oversight, investigation, legal-hold, and reconstruction needs.","claim_kind":"INFERENCE"},{"archetype_element":"governed differentiated disposition","domain_realization":"Explicit lifecycle states route artifacts to refresh, supersession, tiered archive, quarantine, preservation exception, or authorized destruction.","claim_kind":"HYPOTHESIS"}],"component_map":[{"component":"layer_inventory_and_identity_map","status":"direct","domain_realization":"Identity-resolved catalog of intelligence artifacts and duplicates."},{"component":"deposition_order_and_age_index","status":"direct","domain_realization":"Creation, ingestion, validation, and last-review timestamps."},{"component":"retention_policy_matrix","status":"adapted","domain_realization":"Artifact-class matrix for minimum retention, maximum retention, review, and disposition."},{"component":"decay_function_or_aging_rule","status":"adapted","domain_realization":"Class-specific confidence or review-priority decay; age alone cannot determine truth."},{"component":"expiration_trigger_definition","status":"direct","domain_realization":"Elapsed validity, supersession, contradiction, owner departure, or scheduled-review failure triggers."},{"component":"layer_value_and_risk_score","status":"adapted","domain_realization":"Review ranking combining currency, provenance, use, sensitivity, evidentiary value, and recreation cost."},{"component":"dependency_and_reconstruction_check","status":"direct","domain_realization":"Pre-disposition trace of alerts, cases, assessments, citations, models, and audit reconstruction."},{"component":"pruning_or_archival_pathway","status":"direct","domain_realization":"Refresh, withdraw from active retrieval, archive, compact, quarantine, or destroy."},{"component":"preservation_exception_register","status":"direct","domain_realization":"Named source, historical, evidentiary, safety, and investigation exceptions with owners."},{"component":"deletion_audit_and_rollback_window","status":"direct","domain_realization":"Audited soft deletion with time-bounded restoration."},{"component":"resource_budget_and_storage_tier","status":"direct","domain_realization":"Budgets and service levels for active, nearline, cold, and deep archive."},{"component":"review_cadence_and_revalidation_loop","status":"direct","domain_realization":"Periodic owner review of lifecycle rules, exceptions, and restoration results."},{"component":"legal_hold_or_compliance_override","status":"direct","domain_realization":"Legal, oversight, records, or investigation hold that blocks disposal."},{"component":"hot_warm_cold_access_state","status":"adapted","domain_realization":"Current operational, limited-access, archived, and deep-archive visibility states."},{"component":"orphan_layer_detection","status":"direct","domain_realization":"Evidence that no live product, case, alert, citation, or reconstruction path depends on an artifact."},{"component":"supersession_marker","status":"direct","domain_realization":"Durable withdrawn or superseded marker naming the successor where applicable."},{"component":"layer_compaction_candidate_flag","status":"adapted","domain_realization":"Flag for packaging immutable legacy collections without replacing their provenance."},{"component":"rehydration_or_restore_procedure","status":"direct","domain_realization":"Controlled retrieval, parsing, integrity verification, and reconnection of archived intelligence."},{"component":"deletion_impact_estimate","status":"direct","domain_realization":"Estimate of affected consumers, cases, evidentiary loss, and recovery difficulty."},{"component":"stale_context_detector","status":"adapted","domain_realization":"Signals such as contradicted facts, invalid observables, broken references, or a newer authoritative assessment."}],"mechanism_dispositions":[{"slug":"age_weighted_value_score","disposition":"selected_supporting","contribution_type":"TEST_DESIGN","adaptation_or_rejection":"Use only to rank human review; age may lower currency but cannot override holds, provenance, or explicit contradictions.","counterfactual_removal":"The pilot remains viable but review sampling becomes less systematic."},{"slug":"archive_restore_test","disposition":"selected_load_bearing","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Exercise representative intelligence formats and dependencies across archive-age bands.","counterfactual_removal":"Archival cannot credibly preserve reconstruction because recoverability remains unproven."},{"slug":"cache_eviction_rule","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Recency or frequency may manage a technical cache but is not a defensible intelligence-validity or retention rule.","counterfactual_removal":"No change to the proposed lifecycle causal chain."},{"slug":"dependency_safe_delete_check","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Trace live cases, alerts, products, citations, and reconstruction paths before destructive disposition.","counterfactual_removal":"Deletion could silently break operations or accountability, hard-gating viability."},{"slug":"lifecycle_storage_tiering_policy","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Demote access while preserving identity, provenance, controls, and restoration metadata.","counterfactual_removal":"Stale visibility can still be reduced, but affordable long-term retention weakens."},{"slug":"log_rotation_and_cleanup_job","disposition":"considered_rejected","contribution_type":"NONE","adaptation_or_rejection":"Content-blind generational purging fits homogeneous logs, not heterogeneous intelligence with unequal validity and evidentiary value.","counterfactual_removal":"No change; class-specific disposition supplies the needed pathway."},{"slug":"retention_schedule","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Make the class matrix authoritative, with cited obligations, accountable exceptions, and hold overrides.","counterfactual_removal":"Disposition lacks consistent authority and defaults back to indefinite retention or ad hoc deletion."},{"slug":"soft_delete_quarantine_window","disposition":"selected_load_bearing","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"First remove from ordinary visibility, retain access controls, and allow audited restoration before destruction.","counterfactual_removal":"Early cleanup errors become irreversible, hard-gating a safe pilot."},{"slug":"stale_layer_detection_dashboard","disposition":"selected_load_bearing","contribution_type":"CORE_CAUSAL","adaptation_or_rejection":"Expose inventory, lifecycle state, owner, and evidence-based staleness signals without automatically changing status.","counterfactual_removal":"The intervention cannot reliably identify or measure stale-active artifacts."},{"slug":"time_to_live_ttl_policy","disposition":"selected_supporting","contribution_type":"OPERATIONAL","adaptation_or_rejection":"Limit TTL to classes with explicit validity horizons; expiry means review, refresh, or active-view withdrawal, not automatic destruction.","counterfactual_removal":"Lifecycle still works but volatile indicators require more manual review."},{"slug":"tombstone_or_deletion_marker","disposition":"selected_supporting","contribution_type":"SAFETY_GUARDRAIL","adaptation_or_rejection":"Retain a minimal controlled marker recording withdrawal, reason, time, and successor without preserving unnecessary content.","counterfactual_removal":"References may become ambiguous and stale replicas or exports may revive withdrawn intelligence."}],"causal_chain":["Inventory artifacts and expose their age, ownership, lifecycle state, and staleness evidence.","Apply class-specific policy, holds, exceptions, and dependency checks before disposition.","Withdraw expired or superseded artifacts from current-facing retrieval and leave resolvable markers.","Archive or quarantine recoverably, test restoration, and destroy only after authorized gates and rollback windows.","Analysts and automated consumers encounter less stale intelligence while oversight and reconstruction remain available."],"baseline":"Repositories retain intelligence in active search or feeds indefinitely; timestamps and analyst judgment carry most currency assessment, and cleanup occurs through ad hoc labels, folders, or administrator action.","nearest_rival":"Improve search ranking and add freshness warnings while leaving every artifact active. This may reduce prominence but does not create authoritative expiry, preservation, dependency, archival, or deletion states.","authority_safety":{"affected_parties":["analysts and operational consumers","intelligence subjects and organizations affected by decisions","artifact owners and source-handling personnel","investigators, auditors, legal and records officers","downstream system owners"],"decision_authority":"Repository owners may change visibility within approved policy; records, legal, oversight, source-protection, and relevant product owners must authorize exceptions and irreversible destruction within their mandates.","authorized_first_step":"Run a 30-day shadow pilot on one non-live artifact class: inventory it, assign proposed states, compare stale-active retrieval against baseline, trace dependencies, and restore a sample archive; permit labels and test indexes only, with no hard deletion or operational feed suppression.","excluded_actions":["hard deletion during the first test","overriding legal, investigation, records, source-protection, or preservation holds","automatically changing analytic confidence solely from age","suppressing live operational feeds without owner approval","broadening access to archived sensitive material"],"halt_rollback":"Halt if a proposed withdrawal affects a live alert, case, protected hold, source obligation, or unmodeled consumer, or if any sampled restore fails; revert test visibility changes from the audit log and keep artifacts intact."}},"negative_tests":{"strongest_counterevidence":"The apparent problem may be a search-interface defect: users may already distinguish currency correctly from dates and provenance, while historical artifacts rarely influence decisions and existing retention controls preserve all required dependencies.","analogy_break":"Intelligence artifacts are not passive storage layers: an old assessment can regain relevance, adversaries can deliberately induce misleading staleness signals, and analytic validity does not decay monotonically with age.","failure_condition":"Lifecycle labels are not propagated to feeds, exports, and downstream systems, or ownership and dependency metadata are too incomplete to support safe disposition.","problem_falsifier":"A representative pre-intervention sample shows negligible stale or superseded artifacts in current-facing results and no consequential analyst or automated use of them, with explicit lifecycle states already covering the corpus.","intervention_falsifier":"In the bounded pilot, lifecycle gating fails to reduce stale-active retrieval versus baseline, or it causes missed relevant retrieval, unresolved dependencies, or restoration failures beyond the predeclared tolerance.","risks":["Premature expiry can suppress weak but strategically important warning.","Adversaries or biased owners may manipulate staleness or exception signals.","Archives and quarantine prolong exposure of sensitive data.","Lifecycle metadata may reveal sources, investigations, or collection priorities.","False precision in value scores may displace analytic judgment.","Downstream copies may retain or resurrect withdrawn artifacts."]},"null_rationale":null,"classification":{"candidate_kind":"DOMAIN_TRANSFER","prior_art_status":"UNSEARCHED","evidence_maturity":"HYPOTHESIS"},"revision_change_log":{"revision_kind":"ORIGINAL","prior_problem_id":null,"prior_causal_lever_id":null,"problem_changed":false,"causal_lever_changed":false,"conceptual_changes":[],"operational_changes":[],"repairs_addressed":[]},"confidence":0.84,"generator_notes":"Closed-book structural inference from the supplied packet. Empirical prevalence, effect size, dependency completeness, and tolerances require local measurement."}