{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp04_retrieval_first_paired20_20260802","cell_id":"computability_boundary_mapping__engineering_design","arm":"PROPOSAL_FIRST","candidate_id":"cbm-ed-programmable-safety-assurance-boundary","hypothesis_id":null,"version":0,"title":"Assurance-Boundary Gate for Extensible Safety-Control Designs","problem":"A design organization requires one verifier to return a correct SAFE or UNSAFE result, with guaranteed termination, for every submitted programmable safety-control design. The declared input class includes controllers with supplier scripts, unbounded state, and unrestricted executable extensions, but the representation, computation model, and universal guarantee are not explicit. Engineers consequently treat verifier timeouts as failures, add search capacity without knowing whether the unrestricted requirement is decidable, and sometimes narrow accepted designs without updating the public assurance claim.","actors":["Control-system designers","Supplier software engineers","Safety assessors","Design assurance board","Chief engineer acting as design authority","Operators of the resulting physical system"],"observable_state":"Submitted controller models mix finite-state designs with unrestricted scripts and unbounded variables; the assurance tool exposes only SAFE, UNSAFE, or generic failure; some analyses time out; and release records do not state which language fragment, bounds, abstractions, or external judgments support each verdict.","consequence":"A design may be delayed indefinitely by an unattainable universal verification requirement, or may be released after timeout, abstraction, or bounded evidence is misrepresented as an exact class-wide safety decision.","affected_objective":"Maintain truthful, auditable safety assurance while obtaining terminating verification results for an enforceable portion of the controller-design space.","intervention":"Insert an assurance-boundary gate before verification and release. The gate formalizes the submitted design language, state representation, safety property, quantifiers, computation model, and requested guarantee; tests whether an exact terminating decision procedure can be constructed or whether an impossibility argument applies; admits exact verification only for mechanically enforceable finite or decidable fragments; routes richer designs to sound over-approximation, explicitly bounded exploration, or accountable expert escalation; preserves UNKNOWN, OUT_OF_SCOPE, TIMEOUT, and TOOL_FAILURE as distinct states; and records the applicable guarantee and recheck triggers with every design decision.","structural_mapping":[{"archetype_element":"Implicit open-ended problem class","domain_realization":"The organization asks one verifier to decide safety for controller models ranging from finite state machines to unrestricted executable supplier scripts."},{"archetype_element":"Universal exact terminating requirement","domain_realization":"Every well-formed submitted design is expected to receive a correct Boolean SAFE or UNSAFE answer in finite time."},{"archetype_element":"Model-relative solvability classification","domain_realization":"The gate fixes the controller language, input encoding, safety semantics, environmental assumptions, and available computational or expert capabilities before classifying the requested guarantee."},{"archetype_element":"Constructive and impossibility evidence pursued separately","domain_realization":"A total algorithm plus termination and correctness argument supports a decidable fragment, while a checked reduction is required before declaring the unrestricted executable class undecidable."},{"archetype_element":"Restricted decidable region","domain_realization":"A parser-enforced finite-state controller fragment with bounded data domains and explicit environment assumptions receives exhaustive verification."},{"archetype_element":"Weaker honest fallback","domain_realization":"Designs outside the exact fragment receive sound abstract analysis, bounded exploration, or escalation, each labeled with its actual guarantee rather than inheriting the universal claim."},{"archetype_element":"Explicit non-answer states","domain_realization":"UNKNOWN, OUT_OF_SCOPE, TIMEOUT, and TOOL_FAILURE remain distinct from UNSAFE and from a proven impossibility result."},{"archetype_element":"Version-linked boundary record","domain_realization":"Each release decision links the model, fragment, bounds, abstraction, evidence, guarantee, residual uncertainty, and triggers that require reclassification."}],"mechanism_mapping":[{"mechanism_slug":"language_fragment_restriction","role":"Define a syntactically enforceable controller sublanguage whose state space and property semantics admit a total decision procedure; reject or quarantine nonmembers before exact verification.","counterfactual_removal":"Without enforceable fragment membership, unrestricted designs could enter the exact-verification path and receive guarantees that do not apply to them."},{"mechanism_slug":"bounded_domain_exhaustive_search","role":"Enumerate every reachable state and transition for admitted finite designs, producing a complete verdict only within the recorded data, component, and environment bounds.","counterfactual_removal":"Without exhaustive checking of the bounded space, the exact-fragment verdict would rest on sampled executions and could not support a within-bound completeness claim."},{"mechanism_slug":"abstract_interpretation_or_model_checking","role":"Over-approximate richer controller behavior so a sound SAFE result can be issued when the abstraction proves the safety property, while spurious counterexamples remain unresolved rather than becoming automatic UNSAFE verdicts.","counterfactual_removal":"Without a sound approximate mode, out-of-fragment designs would face either unsupported Boolean answers or immediate manual handling even when a weaker machine-checkable guarantee is available."},{"mechanism_slug":"halting_problem_reduction","role":"Provide a checkable route for determining whether unrestricted executable extensions make the requested total semantic safety decider impossible under the stated computation model.","counterfactual_removal":"Without a valid reduction or equivalent proof, repeated timeouts could be rhetorically upgraded into an unjustified undecidability claim."},{"mechanism_slug":"fallback_mode_router","role":"Dispatch each submission to exact finite verification, sound abstraction, bounded search, or expert escalation and attach the corresponding guarantee label to the result.","counterfactual_removal":"Without governed routing, weaker evidence could be silently presented through the same SAFE or UNSAFE interface as exact decisions."},{"mechanism_slug":"computability_boundary_decision_record","role":"Preserve the chosen boundary, assumptions, evidence links, shipped guarantee, residual uncertainty, and recheck triggers for each verifier and controller-language version.","counterfactual_removal":"Without a durable record, later language extensions or tool changes could silently invalidate the assurance boundary while old wording persists."}],"causal_chain":["An unrestricted controller language plus a universal safety question creates a demand for a total exact verifier over an open-ended class.","The assurance-boundary gate makes the representation, quantifiers, computation model, environmental assumptions, and requested guarantee explicit.","Constructive proof obligations and independently checkable impossibility arguments separate decidable fragments from unresolved or undecidable regions without using timeout as evidence.","Mechanical fragment checks and finite bounds identify submissions eligible for exact terminating exhaustive verification.","A governed router assigns remaining submissions to sound abstraction, explicitly bounded exploration, or accountable expert escalation.","Typed outputs prevent UNKNOWN, OUT_OF_SCOPE, TIMEOUT, and TOOL_FAILURE from being interpreted as SAFE or UNSAFE.","A versioned decision record ties every release claim to its applicable scope and causes language, assumption, tool, or environment changes to trigger reclassification.","The organization can stop pursuing unsupported universal automation while retaining useful, accurately labeled assurance for bounded and weaker modes."],"baseline":"The ordinary baseline is a common verifier interface applied to heterogeneous controller models, supplemented by simulation, test suites, longer time limits, added compute, and ad hoc expert review. Results are reduced to pass, fail, or tool error, and the release record does not preserve the exact scope or strength of the evidence.","nearest_rivals":["A conventional model-based safety-assurance workflow that uses simulation, formal verification, and expert review but does not first classify the total-exact requirement or preserve distinct computability statuses","Restricting every controller to a finite-state modeling language without maintaining fallback modes for designs that require excluded expressiveness","Increasing verifier resources and optimizing search under the assumption that every timeout is only a tractability problem"],"remaining_contrastive_claim":"Compared with the strongest rival, the candidate's remaining contrastive feature is a mandatory, model-relative solvability classification before tool selection, coupled to machine-enforced scope and result labels that prevent bounded, approximate, timed-out, or escalated analyses from inheriting an exact universal assurance claim.","authority_safety":{"decision_authority":"The chief engineer, advised by the design assurance board and an independent verification reviewer, owns the boundary record and any authorization to use a verification result in release approval.","authorized_first_step":"Run a non-release pilot on a frozen set of previously adjudicated controller models: specify their encodings and guarantees, classify them through the proposed gate, and compare routed labels with the evidence already recorded, without changing any deployed system or release status.","excluded_actions":["Automatically approve a design for release","Treat UNKNOWN, OUT_OF_SCOPE, TIMEOUT, or TOOL_FAILURE as SAFE or UNSAFE","Change deployed controller logic or safety interlocks","Claim undecidability without a checked proof whose assumptions match the submitted class","Generalize a bounded or abstract result beyond its recorded scope","Allow the verifier vendor or pilot team to supersede the chief engineer's release authority"],"halt_rollback":"Halt the pilot if the gate cannot conservatively enforce fragment membership, if any output loses its guarantee label, or if a previously unsafe or unresolved case is surfaced as unqualified SAFE. Roll back by disabling the pilot router, retaining the existing release workflow, and preserving pilot records for review; no release decision changes during the pilot."},"negative_tests":{"strongest_counterevidence":"A constructive, independently checked algorithm that correctly decides the stated safety property and terminates for every design in the full declared controller language under the same computation model would defeat the premise that a computability boundary is needed for that requirement.","problem_falsifier":"The problem is falsified if the actual accepted design class is already finite or otherwise governed by an enforceable decidable representation, all requested guarantees are explicitly bounded, and timeouts are solely resource-feasibility failures rather than ambiguity about total solvability.","intervention_falsifier":"The intervention is falsified if, on the frozen pilot set, the gate cannot reproducibly enforce its class boundaries and guarantee labels, or if ordinary formal-assurance review produces the same classifications and traceability without the added boundary gate.","risks":["A wrong formalization can produce a valid proof about a model that does not faithfully represent the physical controller or environment.","An unsound abstraction can issue false confidence, while an overly coarse sound abstraction can produce unusably many unresolved alarms.","The decidable fragment may exclude safety-relevant behaviors that designers then move into informal escape hatches.","Finite exhaustive search can be computable yet infeasible, creating pressure to confuse resource exhaustion with a semantic verdict.","Expert escalation may function as an undeclared oracle if competence, latency, refusal, accountability, and evidence requirements are not specified.","A correct boundary record can become stale when the controller language, verifier, environmental model, or supplier interface changes."]},"next_evidence_step":"Using only a frozen set of 12 previously adjudicated controller models, have one control engineer specify the input grammar, state bounds, safety property, and environmental assumptions; have an independent verification engineer apply the proposed classification and routing rules; then check whether every model receives a reproducible route and one of the distinct statuses SAFE-WITHIN-SCOPE, UNSAFE-WITNESS, UNKNOWN, OUT_OF_SCOPE, TIMEOUT, or TOOL_FAILURE. Record disagreements and stop without altering release decisions. This bounded step tests semantic fidelity, enforceable membership, label preservation, and routing reproducibility; it does not test operational effect size.","prior_art_status":"UNSEARCHED","revision_record":{"parent_version":null,"progress_targets_addressed":[],"conceptual_changes":[],"operational_changes":[],"evidence_changes":[],"claim_changes":[]}}