{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp05_complete_proposal_portfolio20_20260803","cell_id":"computability_boundary_mapping__veterinary_medicine","arm":"COMPLETE_PROPOSAL_PORTFOLIO","candidate_id":"cbm-vet-programmable-care-policy-verifier-001","proposal_index":1,"version":0,"title":"Model-Relative Safety Boundary for Programmable Veterinary Care Policies","problem":"A multispecies veterinary monitoring platform permits care teams to encode treatment and escalation policies as executable programs driven by open-ended streams of observations. Its proposed pre-deployment verifier is required to determine, for every arbitrary policy and every admissible patient trajectory, whether the policy will always terminate at each decision point and will never issue a prohibited action such as a contraindicated dose. That unrestricted total-exact requirement is unsupported: simulation success, review, and timeouts do not establish class-wide termination or safety, while a general impossibility analogy would also be insufficient unless the policy language, input model, and guarantee match a checked proof.","actors":["Attending veterinarian with responsibility for the animal's care","Veterinary clinical informatician who defines policy semantics and safety constraints","Software engineers implementing the policy language and verifier","Independent formal-methods reviewer","Veterinary technicians and animal caretakers who receive recommendations","Clinical safety committee governing deployment"],"observable_state":"The policy language admits arbitrary loops, recursion, dynamic calls, or unrestricted state; the requirement document promises a terminating safe/unsafe answer for every policy; tests cover only selected finite traces; analyzer timeouts can be rendered as safe, false, or generic failure; and neither the modeled patient trajectories nor external services used by policies are included in the stated computation model.","consequence":"An unverified policy may be cleared because analysis stopped without finding a violation, or useful automation may be abandoned because a difficult finite analysis is mislabeled undecidable. Either error can distort clinical escalation, expose an animal to an unauthorized recommendation, and leave clinicians unable to distinguish demonstrated safety from timeout, abstraction residue, or out-of-scope input.","affected_objective":"Provide clinicians with decision support whose termination and medication-safety guarantees are explicit, model-relative, enforceable at the policy-language boundary, and distinguishable from clinical judgment about the animal.","intervention":"Replace the unrestricted Boolean verifier with a governed boundary map. First specify the executable-policy class, observation encoding, external capabilities, quantifiers, and exact safety property. Seek both a constructive verifier and a checked reduction for the unrestricted language; for example, test whether an arbitrary computation can be embedded in a policy that emits a prohibited action exactly when that computation halts. Independently review the mapping before accepting any impossibility conclusion. Ship only an enforceable finite-state policy fragment with bounded data domains, prohibited recursion and dynamic code, declared external-call behavior, and a finite decision horizon. Construct a conservative abstraction of covered patient-state transitions and model-check every in-fragment policy. Return VERIFIED-WITHIN-MODEL only when no prohibited transition exists in the over-approximation; return POTENTIAL-VIOLATION with a trace when one is found; and return OUT-OF-SCOPE or UNKNOWN for rejected syntax, uncovered clinical assumptions, external-service ambiguity, or exhausted resource bounds. Route those latter states to veterinarian review without executing the proposed policy, and preserve the boundary, proof artifacts, model assumptions, and recheck triggers in a versioned decision record.","structural_mapping":[{"archetype_element":"Problem-Class Specification","domain_realization":"Executable veterinary care policies paired with encoded patient-observation streams and a property covering decision-step termination and absence of prohibited treatment commands."},{"archetype_element":"Computation Model Contract","domain_realization":"A policy interpreter with explicitly modeled memory, external calls, observation arrival, numeric domains, and scheduler behavior; an attending veterinarian is an accountable fallback, not an assumed computational oracle."},{"archetype_element":"Quantifier and Scope Map","domain_realization":"Separates the unsupported claim over every arbitrary program and trajectory from the shipped claim over syntactically admitted finite-state policies and trajectories represented by the validated abstraction."},{"archetype_element":"Computability Status Lattice","domain_realization":"Classifies the unrestricted verifier as unresolved until its proof is checked, the enforced finite fragment as decidable in principle, individual bounded analyses as verified or counterexample-producing, and uncovered cases as unknown or out of scope."},{"archetype_element":"Decidable Subclass Map","domain_realization":"Defines a mechanically checkable fragment with finite control state, bounded variables and horizon, no recursion or dynamic code loading, and explicit stubs for external services."},{"archetype_element":"Fallback Solution Contract","domain_realization":"Model checking supplies a model-relative safety verdict; suspected violations receive traces; all other unsupported cases abstain and enter veterinarian review without automatic clinical execution."},{"archetype_element":"Unknown and Nontermination Policy","domain_realization":"Timeout, abstraction gap, invalid fragment membership, and uncertain external behavior remain separate from safe, unsafe, and clinically contraindicated."},{"archetype_element":"Computability Guarantee Record","domain_realization":"A versioned record links the policy grammar, transition abstraction, checked proof or unresolved obligations, verifier version, output semantics, and triggers requiring reclassification."}],"mechanism_mapping":[{"mechanism_slug":"halting_problem_reduction","role":"Tests the unrestricted requirement by constructing a computable embedding in which a policy emits a prohibited action exactly when an arbitrary source computation halts; the conclusion is accepted only for the matched language and guarantee.","counterfactual_removal":"Without this mechanism, repeated timeouts could be treated as impossibility evidence, or an informal halting-problem analogy could be used to overstate the boundary."},{"mechanism_slug":"reduction_direction_checklist","role":"Requires the independently established source problem to map into the veterinary-policy verification target and exposes totality, computability, answer preservation, encoding, and computation-model assumptions.","counterfactual_removal":"Without this review gate, a reversed or partial reduction could prematurely prohibit useful restricted verification."},{"mechanism_slug":"language_fragment_restriction","role":"Makes eligibility syntactically enforceable by admitting only a finite-state, bounded policy language for which termination and exhaustive analysis can be established.","counterfactual_removal":"Without an enforceable fragment, documentation could promise a restricted guarantee while the runtime continued accepting unrestricted programs."},{"mechanism_slug":"abstract_interpretation_or_model_checking","role":"Explores a finite over-approximation of covered patient and policy states so absence of a prohibited transition is sound relative to the abstraction contract, while added behaviors may produce conservative alarms.","counterfactual_removal":"Without finite over-approximate analysis, the intervention would provide a boundary declaration but no systematic safety verdict for admitted policies."},{"mechanism_slug":"fallback_mode_router","role":"Dispatches in-fragment policies to model checking and routes out-of-fragment, assumption-violating, or resource-exhausted cases to labeled abstention and veterinarian review.","counterfactual_removal":"Without routing and guarantee labels, weaker results could be laundered into the original safe/unsafe claim."},{"mechanism_slug":"computability_boundary_decision_record","role":"Versions the chosen boundary, shipped guarantee, supporting artifacts, residual uncertainty, and triggers such as language extensions or new external services.","counterfactual_removal":"Without the record, later changes could silently invalidate the analyzed class or cause the unrestricted claim to reappear."}],"causal_chain":["An unrestricted policy language plus a universal exact-and-terminating verifier requirement creates an unbounded semantic program-analysis claim.","Explicit encodings, quantifiers, and computation capabilities make the claimed class precise enough for constructive or impossibility arguments.","A checked source-to-target reduction can reject only the matched unrestricted requirement, without condemning bounded or syntactically restricted policies.","An enforceable finite policy fragment moves admitted inputs into a class with a terminating exhaustive analysis.","A conservative finite abstraction includes all patient-policy transitions covered by its assumptions, permitting a model-relative safe verdict while retaining false alarms as potential violations.","The router preserves VERIFIED-WITHIN-MODEL, POTENTIAL-VIOLATION, UNKNOWN, and OUT-OF-SCOPE as distinct operational states and prevents abstentions from authorizing treatment.","Veterinarian control and a versioned boundary record keep formal verification subordinate to clinical authority and force re-analysis when language or model assumptions change."],"baseline":"Policy authors conduct code review and simulate selected patient traces; the analyzer runs until success or timeout, and downstream interfaces expect a Boolean safe/unsafe result. This baseline can find concrete failures but supplies neither a class-wide termination argument nor an honest representation of unexamined behavior.","nearest_rivals":["Randomized or scenario-based simulation: useful for finding failures on sampled trajectories but cannot establish the universal claim from finite passing tests.","Runtime monitoring with emergency shutdown: can react to observed prohibited states but does not provide a pre-deployment guarantee and may intervene only after a hazardous recommendation is generated.","Manual specialist review of every policy: contributes clinical interpretation but lacks a declared totality, latency, refusal, and consistency model and should not be represented as a universal decider.","Bounded concrete trace enumeration: gives complete results inside a stated horizon and finite encoding, but its verdict does not extend beyond that bound.","Ordinary clinical rule validation: checks policy content against a maintained contraindication table but does not by itself analyze arbitrary control flow, termination, or all possible observation sequences."],"remaining_contrastive_claim":"The proposal is specifically a model-relative solvability and guarantee-classification system for executable care policies: it withdraws an unsupported universal Boolean promise, enforces a decidable fragment, and preserves abstention states. It is not merely a faster simulator, a clinical contraindication database, or a claim that finite-state verification establishes safety for physiology outside the validated abstraction.","authority_safety":{"decision_authority":"The attending veterinarian retains authority over diagnosis and treatment; the clinical safety committee authorizes policy-language and verifier deployment, and an independent reviewer must accept any computability proof used to narrow or reject the project.","authorized_first_step":"Conduct an offline, non-clinical specification exercise on a small set of synthetic policies: formalize the unrestricted claim, attempt the reduction, define one finite fragment and abstraction, and check model-checker outputs against hand-enumerated finite cases.","excluded_actions":["Issuing, changing, withholding, or administering medication","Deploying experimental policies into live clinical workflows","Treating VERIFIED-WITHIN-MODEL as a diagnosis or individualized treatment authorization","Converting UNKNOWN, timeout, or OUT-OF-SCOPE into safe or no-risk","Allowing an out-of-fragment policy to execute while awaiting review","Extending the proof conclusion beyond its stated encoding, model, and quantifiers"],"halt_rollback":"Stop the pilot and disable any routing toward execution if a prohibited command is missed in a covered hand-enumerated case, fragment membership can be bypassed, an abstention is converted into authorization, or the abstraction cannot be justified as conservative for its stated transition model. Retain the synthetic artifacts and revert the verifier status to research-only pending correction and independent re-review."},"negative_tests":{"strongest_counterevidence":"A checkable constructive algorithm that terminates and correctly decides the stated safety property for every policy in the full declared executable language would defeat the proposed unrestricted-boundary diagnosis and require complexity assessment instead.","problem_falsifier":"The inferred problem is falsified if the actual accepted policy class and observation domain are already finite and effectively enumerable, all external behavior is bounded, and the required guarantee is explicitly confined to that finite class; then the issue is practical state-space cost rather than computability.","intervention_falsifier":"The intervention fails if the syntactic restriction cannot be enforced at ingestion and runtime, or if the patient-state abstraction omits a covered transition, because either condition breaks the claimed model-relative guarantee even when the checker terminates.","risks":["A coarse abstraction may produce enough potential-violation alarms that users bypass the system.","A formally sound result may be clinically irrelevant because the encoded contraindication property or patient model is wrong.","Language restrictions may exclude clinically necessary temporal or contextual reasoning and drive policy authors to unsafe escape hatches.","A correct finite-state analysis may be computationally impractical; decidability alone does not establish usable latency.","Human escalation may be delayed, unavailable, or treated as infallible unless responsibility and service limits are explicit.","Official-looking decision records may preserve a wrong boundary if proof review or recheck triggers are weak."]},"next_evidence_step":"Using no live animal data or treatment decisions, define a toy policy grammar with at most eight control states, three discretized observation variables, a five-step horizon, and a fixed prohibited-action table. Create a fully enumerable set of synthetic policies and trajectories within those bounds, hand-label every reachable prohibited transition, and compare those labels with fragment admission, model-checker verdicts, traces, and abstention routing. In parallel, write the unrestricted source-to-target reduction and have a second reviewer check its direction, totality, answer preservation, and exact scope. The bounded result may support only implementation correctness for that toy model and the adequacy of the output-state separation; it must not be generalized to clinical effect or unrestricted solvability.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Not assessed; the sealed input supplies no prior proposal content for comparison.","revision_record":{"parent_version":null,"progress_targets_addressed":[],"conceptual_changes":[],"operational_changes":[],"evidence_changes":[],"claim_changes":[]}}