{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp05_complete_proposal_portfolio20_20260803","cell_id":"computability_boundary_mapping__economics_finance","arm":"COMPLETE_PROPOSAL_PORTFOLIO","candidate_id":"cbm-ef-programmable-contract-solvency-boundary-001","proposal_index":1,"version":0,"title":"Computability-Gated Solvency Review for Programmable Financial Contracts","problem":"A clearinghouse accepts programmable derivatives whose payoff code may contain unbounded recursion, persistent state, adaptive oracle calls, or external modules. Its proposed listing analyzer is required to decide, for every admitted contract and every admissible sequence of market and oracle events, whether settlement always terminates without requiring transfers beyond posted collateral. The requirement leaves the contract language, event encoding, computation model, external capabilities, time horizon, and meaning of “always” implicit. Timeouts and finite scenario passes can consequently be forced into Boolean approval decisions even though neither establishes a class-wide result.","actors":["Contract issuers and developers","Clearinghouse model-risk analysts","Clearinghouse listing committee","Margin and collateral operations staff","Clearing members exposed to settlement obligations","Oracle and external-module operators","Independent formal-methods reviewer"],"observable_state":"A submitted contract passes sampled price-path simulations but the analyzer times out on an adversarial or deeply recursive case; the workflow nevertheless offers only “solvent” or “insolvent,” with no distinct states for unknown, out-of-scope, abstraction alarm, or analysis failure. Documentation continues to describe the analyzer as covering all valid contracts even when implementation limits silently exclude some language features.","consequence":"A contract can receive unjustified solvency clearance, or a sound but incomplete analysis can be treated as a rejection; engineering effort can also continue toward an unsupported total-exact requirement instead of an enforceable restricted guarantee.","affected_objective":"Sound, terminating, and auditable listing decisions that preserve collateral adequacy without representing incomplete computation as evidence of solvency or insolvency.","intervention":"Install a computability gate before automated solvency review. First freeze a versioned contract-language grammar, operational semantics, fixed-point number representation, oracle interface, external-call model, event horizon, and the exact universal property to be decided. For the unrestricted language, construct and independently check a proposed source-to-target reduction: encode a candidate computation as a contract that requests an undercollateralized transfer if and only if that computation halts. Until the reduction and its assumptions are validated, classify the unrestricted status as unresolved rather than undecidable. In parallel, define an enforceable fragment with fixed maturity, finitely bounded events and state, statically bounded loops, declared oracle ranges, and no unmodeled external calls. Supply a terminating, correct finite-state procedure for that fragment; where exact enumeration is too costly, use a sound over-approximation whose only clearing verdict is SAFE and whose alarms remain POSSIBLE_BREACH. Route every submission to EXACT_PASS, EXACT_FAIL, SOUND_SAFE, POSSIBLE_BREACH, UNKNOWN, OUT_OF_SCOPE, or SYSTEM_FAILURE, and prohibit UNKNOWN, OUT_OF_SCOPE, or SYSTEM_FAILURE from becoming automatic approvals. Version-link the boundary, proof artifacts, fragment, output guarantee, and recheck triggers in a decision record.","structural_mapping":[{"archetype_element":"Implicit open-ended problem class and universal guarantee","domain_realization":"All programmable derivative contracts and all admissible market-event streams are treated as one class requiring a correct, terminating solvency answer."},{"archetype_element":"Explicit instance and computation contracts","domain_realization":"The contract grammar, numeric encoding, oracle behavior, external modules, execution semantics, event horizon, and collateral property are frozen and versioned."},{"archetype_element":"Parallel constructive and impossibility evidence","domain_realization":"A checked halting-style reduction is attempted for the unrestricted language while a total finite-state solver is constructed for an enforceable fragment."},{"archetype_element":"Decidable subclass boundary","domain_realization":"Only contracts with bounded control flow, state, maturity, oracle ranges, and modeled dependencies enter the guaranteed fragment."},{"archetype_element":"Weaker honest fallback","domain_realization":"A sound over-approximation may certify SAFE or emit POSSIBLE_BREACH, while resource exhaustion produces UNKNOWN rather than a fabricated negative or positive."},{"archetype_element":"Status-preserving operational interface","domain_realization":"Exact, sound-one-directional, unknown, out-of-scope, and system-failure results remain distinct in listing records and downstream controls."},{"archetype_element":"Reclassification on assumption change","domain_realization":"Changes to the language, compiler, oracle contract, numeric semantics, event bounds, or external-call permissions trigger a new boundary review."}],"mechanism_mapping":[{"mechanism_slug":"halting_problem_reduction","role":"Tests whether a total exact solvency decider for the unrestricted contract language would decide halting by mapping each source program to a contract whose undercollateralized transfer is triggered exactly when the source halts.","counterfactual_removal":"Without the reduction artifact, repeated analyzer failure would not justify an impossibility conclusion, leaving the unrestricted boundary unresolved and vulnerable to analogy-based claims."},{"mechanism_slug":"proof_checking","role":"An independent reviewer verifies the reduction, the fragment solver’s termination and correctness arguments, and every assumption connecting formal settlement semantics to operational settlement.","counterfactual_removal":"Without independent checking, a reversed reduction, incomplete termination argument, or mismodeled contract semantics could receive institutional authority without a valid guarantee."},{"mechanism_slug":"language_fragment_restriction","role":"Defines a mechanically enforceable contract subset with bounded control flow, state, event count, oracle ranges, and dependencies.","counterfactual_removal":"Without syntactic restriction, the system could silently accept instances outside the class for which terminating analysis is justified."},{"mechanism_slug":"bounded_domain_exhaustive_search","role":"Enumerates the complete finite transition system of small or tractable in-fragment contracts and returns exact pass or fail certificates within the declared bounds.","counterfactual_removal":"Without complete bounded checking, passing simulations would remain samples rather than exhaustive evidence for the finite declared class."},{"mechanism_slug":"abstract_interpretation_or_model_checking","role":"Over-approximates larger in-fragment state spaces so that absence of an abstract breach soundly supports SAFE, while abstract counterexamples remain possible rather than certain breaches until validated.","counterfactual_removal":"Without a sound approximation mode, contracts beyond practical exhaustive-search limits would either be mislabeled exact, rejected solely for cost, or pushed back into unsupported simulation."},{"mechanism_slug":"fallback_mode_router","role":"Selects exact, sound-approximate, or non-automated handling according to enforceable scope and labels the resulting guarantee without promotion.","counterfactual_removal":"Without routing and guarantee labels, UNKNOWN, abstraction alarms, and out-of-scope cases could again be collapsed into the listing workflow’s Boolean output."},{"mechanism_slug":"computability_boundary_decision_record","role":"Records the chosen boundary, shipped guarantee, proof links, exclusions, and assumption changes that require re-evaluation.","counterfactual_removal":"Without a supersedable record, later language or oracle changes could silently invalidate the analysis while the original guarantee remains in use."}],"causal_chain":["Freezing the language, event representation, computation model, and universal solvency property makes the target class and quantifiers inspectable.","A checked reduction can rule out a total exact decider only for the matching unrestricted class; a failed or mismatched proof leaves that status explicitly unresolved.","A parser and type checker enforce membership in a finite-state fragment before analysis, preventing unsupported inputs from inheriting its guarantee.","Exhaustive search decides tractable finite instances exactly, while a verified over-approximation provides a one-directional SAFE result for selected larger instances.","The router preserves EXACT_FAIL, POSSIBLE_BREACH, UNKNOWN, OUT_OF_SCOPE, and SYSTEM_FAILURE instead of converting them into insolvency or solvency claims.","Only EXACT_PASS or SOUND_SAFE may advance to ordinary human listing review; all other statuses require remediation, refinement, or explicit committee disposition and cannot trigger automatic approval.","The versioned decision record causes changes in semantics, bounds, or external capabilities to trigger reclassification before the old guarantee is reused.","Listing decisions therefore rest on a stated model-relative guarantee rather than on elapsed runtime or sampled-path success."],"baseline":"Evaluation baseline: code review plus finite deterministic and stochastic market-path simulations, governed by a fixed runtime budget and a Boolean listing interface. A pass means no tested path produced a breach; a timeout or unsupported feature is handled by local analyst judgment. This baseline provides instance evidence but no proof that all admitted programs terminate or that all admissible paths were covered.","nearest_rivals":["Increase simulation volume, adversarial path generation, and compute capacity while retaining the unrestricted Boolean claim.","Require manual legal and model-risk review for every programmable contract without formally delimiting what computation the reviewers are expected to decide.","Ban all programmable contracts and admit only a fixed catalog of hand-coded payoff templates.","Impose larger collateral buffers to absorb analyzer uncertainty without distinguishing computability uncertainty from estimated economic risk.","Use a finite scenario library as the official approval test and define passing that library as “solvent,” thereby changing the economic property without explicitly changing the public guarantee."],"remaining_contrastive_claim":"The intervention changes the accountable claim itself: it separates unrestricted solvability from finite-fragment decidability and practical cost, then preserves exact, sound-one-directional, unknown, and out-of-scope statuses through the listing decision. Simulation expansion, manual review, collateral add-ons, and template bans may alter evidence or exposure, but they do not by themselves establish and maintain that model-relative computability boundary.","authority_safety":{"decision_authority":"The clearinghouse listing committee retains approval and rejection authority; the model-risk function owns the formal scope and guarantee record, and an independent reviewer must accept proof obligations before any automated clearance status is relied upon.","authorized_first_step":"The head of model risk may authorize an offline, read-only prototype on a frozen set of de-identified contract programs and synthetic oracle traces, with no connection to production listing, margin, collateral, settlement, or trading systems.","excluded_actions":["Automatically approve, reject, suspend, or delist a contract","Change margin requirements or move, reserve, or release collateral","Execute trades, settlement instructions, oracle updates, or contract code against live accounts","Treat UNKNOWN, OUT_OF_SCOPE, POSSIBLE_BREACH, timeout, or SYSTEM_FAILURE as SOUND_SAFE","Describe a bounded or abstract result as covering the unrestricted contract language","Deploy a new language feature, compiler version, oracle interface, or external module under an earlier guarantee without reclassification"],"halt_rollback":"Halt the prototype if an independently reproduced case shows an unsound SAFE verdict, fragment-membership enforcement can be bypassed, result labels are lost downstream, or the formal semantics materially diverge from executed settlement behavior. Quarantine affected records, withdraw the corresponding guarantee version, and revert all reviewed cases to the pre-pilot committee workflow; because the first step is offline and read-only, no financial transaction requires reversal."},"negative_tests":{"strongest_counterevidence":"The strongest counterevidence would be a checked language specification showing that every admitted contract is already strongly normalizing with a computable static execution bound, all state and oracle domains are finite and enforced, and an existing total-correct solver decides the stated property. That would place the problem on the decidable side and make practical complexity, rather than a computability boundary, the relevant issue.","problem_falsifier":"The problem is falsified if a semantic and implementation audit confirms that unrestricted recursion, unbounded state, adaptive unmodeled calls, and infinite event streams are impossible in every accepted instance, and that timeouts are never interpreted as semantic verdicts or hidden by the interface.","intervention_falsifier":"The intervention fails its first test if independent review cannot validate either the proposed unrestricted-class reduction or the restricted solver’s termination and correctness obligations, the parser cannot enforce fragment membership, or the sound abstraction produces a SAFE verdict for any concrete bounded counterexample. It is also operationally falsified if every economically faithful case in the frozen corpus becomes OUT_OF_SCOPE or UNKNOWN, leaving no case with a usable stated guarantee.","risks":["The formal settlement model may omit behavior present in the production compiler, oracle, or external module.","An unsound abstraction could clear a real collateral breach.","A coarse but sound abstraction could produce persistent false alarms and encourage operators to bypass the gate.","Contract authors could restructure code to satisfy syntactic checks while reintroducing unmodeled behavior through external dependencies.","Decision-makers could misread SOUND_SAFE as an exact characterization rather than a one-directional certificate.","A valid impossibility result for the unrestricted language could be overstated as applying to bounded fragments.","A decidable finite fragment could still be computationally impractical at relevant bounds.","Governance records could become stale when language or market-interface assumptions change."]},"next_evidence_step":"Conduct one bounded offline boundary exercise on no more than 12 frozen, de-identified contract programs. Freeze one DSL/compiler version and a toy settlement model with at most two assets, eight event steps, four price intervals per asset, bounded fixed-point balances, and no external calls. Produce: the exact decision-property specification; one proposed program-to-contract reduction for the unrestricted syntax; one parser-enforced finite fragment; one exhaustive finite-state solver with termination and correctness arguments; one sound abstraction comparison; and one decision record whose output alphabet includes every required status. Have a reviewer independent of the author check the reduction direction, semantic preservation, fragment enforcement, and solver proofs. This step yields only a classification and feasibility record and authorizes no live listing decision.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"No comparison with other proposals was performed; this sealed candidate was derived only from the supplied archetype, mechanisms, and economics-and-finance domain card.","revision_record":{"parent_version":null,"progress_targets_addressed":[],"conceptual_changes":[],"operational_changes":[],"evidence_changes":[],"claim_changes":[]}}