{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp05_complete_proposal_portfolio20_20260803","cell_id":"computability_boundary_mapping__veterinary_medicine","arm":"COMPLETE_PROPOSAL_PORTFOLIO","candidate_id":"cbm-vet-proof-carrying-surveillance-workflows-004","proposal_index":4,"version":0,"title":"Proof-Carrying Admission for Herd-Surveillance Workflows","problem":"An animal-health surveillance platform accepts user-authored workflows that aggregate longitudinal herd records, traverse contact chains, invoke reference services, and generate veterinary review queues. Its scheduler is expected to decide, for every arbitrary workflow and every well-formed future dataset, whether the workflow will terminate. Sample executions, manual inspection, and timeouts do not establish universal termination; yet rejecting every unfamiliar workflow would also discard programs that terminate but lack an automatically discovered proof. The platform therefore needs to distinguish the impossibility of a complete termination predictor from the feasibility of checking producer-supplied termination evidence.","actors":["Herd-health veterinarians using surveillance outputs","Veterinary epidemiologists authoring analytic workflows","Data engineers operating the surveillance platform","Workflow authors responsible for submitted code and evidence","Independent reviewer of the computation model and proof checker","Surveillance program director authorizing scheduled use"],"observable_state":"The platform accepts workflows with unrestricted loops, recursion, data-dependent traversal, or external calls; admission relies on successful runs over selected datasets; a scheduler timeout is labeled nonterminating or unsafe; external-service termination assumptions are undocumented; and workflows that pass admission can run automatically on later datasets without a version-linked totality argument.","consequence":"A workflow admitted from finite tests can fail to finish on a later valid dataset and delay its scheduled output, while a terminating workflow can be excluded because proof discovery or a trial execution did not finish. Conflating termination with acceptable resource use can also admit a provably terminating workflow whose runtime or memory requirements are operationally unsuitable.","affected_objective":"Admit reusable veterinary surveillance workflows only under explicit, checkable termination guarantees while retaining honest paths for uncertified jobs and separately assessing practical resource feasibility.","intervention":"Withdraw the requirement for a universal termination predictor over arbitrary workflows. Specify the workflow encoding, valid dataset class, execution semantics, external-call capabilities, and class-wide termination claim, then subject a direct diagonalization argument against the unrestricted predictor to independent review. Replace inference-only admission with a proof-carrying contract: a workflow seeking scheduled status must arrive with a certificate in a mechanically checkable language, such as structural recursion evidence, a well-founded ranking function for every loop, and termination contracts for every external call. Build a total certificate checker and prove that checker acceptance implies workflow termination for every input covered by the attached schema and capability assumptions. The checker need not discover certificates and may reject or leave uncertified some terminating workflows. Route accepted workflows to a separate complexity and capacity assessment before scheduling. Route missing, invalid, stale, or model-mismatched certificates to UNCERTIFIED or MODEL-MISMATCH; permit only an isolated, explicitly bounded one-off run when authorized, whose completion or timeout does not change class-wide certification. Preserve workflow hash, certificate, checker version, assumptions, result, complexity assessment, and recheck triggers in a supersedable boundary record.","structural_mapping":[{"archetype_element":"Problem-Class Specification","domain_realization":"Determines whether an arbitrary encoded herd-surveillance workflow terminates on every dataset admitted by a declared veterinary data schema."},{"archetype_element":"Computation Model Contract","domain_realization":"Defines workflow instructions, recursion, memory, data iteration, concurrency, external calls, and which service-termination contracts may be assumed."},{"archetype_element":"Quantifier and Scope Map","domain_realization":"Separates termination of one bounded execution from termination for every valid future dataset and separates certificate checking from universal certificate discovery."},{"archetype_element":"Computability Impossibility Certificate","domain_realization":"An independently checked diagonal construction addresses the proposed total termination predictor for the unrestricted workflow language."},{"archetype_element":"Promise-Problem Restriction","domain_realization":"Scheduled admission is accountable only for workflow-schema-certificate packages whose certificates pass the decidable checker and whose declared capabilities match runtime enforcement."},{"archetype_element":"Constructive Procedure Witness","domain_realization":"A total certificate checker validates syntax, proof steps, well-founded descent, recursive-call obligations, and external termination contracts."},{"archetype_element":"Solvability Guarantee Profile","domain_realization":"Checker acceptance is sound for termination under the recorded model but intentionally incomplete: rejection or missing evidence does not prove nontermination."},{"archetype_element":"Unknown and Nontermination Policy","domain_realization":"UNCERTIFIED, CERTIFICATE-REJECTED, MODEL-MISMATCH, bounded-run timeout, and demonstrated nontermination remain distinct states."},{"archetype_element":"Complexity Follow-On Gate","domain_realization":"Every termination-certified workflow receives a separate time, memory, communication, and external-service capacity assessment before recurring execution."},{"archetype_element":"Computability Guarantee Record","domain_realization":"A versioned record binds certification to the workflow, schema, proof, checker, execution model, resource assessment, and conditions requiring renewed review."}],"mechanism_mapping":[{"mechanism_slug":"diagonalization_impossibility_proof","role":"Tests the unrestricted predictor by assuming a total analyzer and constructing an analyzer-relative workflow whose termination behavior contradicts the analyzer's verdict on its own encoded case.","counterfactual_removal":"Without a checked impossibility argument, the platform might treat engineering failures as proof of undecidability or continue funding an unsupported complete predictor."},{"mechanism_slug":"promise_problem_restriction","role":"Limits scheduled-admission accountability to workflow packages satisfying the enforceable promise of a valid certificate, matching schema, and declared external capabilities.","counterfactual_removal":"Without an enforceable promise, uncertified or model-mismatched workflows could inherit the certified path's termination guarantee."},{"mechanism_slug":"constructive_algorithm_and_correctness_proof","role":"Produces the total certificate-checking algorithm together with termination and soundness arguments showing that acceptance entails workflow termination under the recorded model.","counterfactual_removal":"Without a constructive and proved checker, proof-carrying admission would reduce to trusting workflow authors' termination assertions."},{"mechanism_slug":"proof_checking","role":"Re-derives each submitted termination argument against fixed rules and exposes unproved premises as explicit external contracts or rejected obligations.","counterfactual_removal":"Without independent checking, malformed, forged, or logically incomplete certificates could authorize recurring execution."},{"mechanism_slug":"fallback_mode_router","role":"Dispatches certified workflows to complexity review, sends invalid or mismatched packages back to authors, and confines authorized uncertified execution to an isolated bounded mode with explicit labels.","counterfactual_removal":"Without routing, bounded completion or administrative approval could be mistaken for class-wide termination certification."},{"mechanism_slug":"computational_complexity_analysis","role":"Assesses resource growth only after termination has been established, preventing computability and operational feasibility from being collapsed.","counterfactual_removal":"Without the follow-on gate, a terminating but excessively costly workflow could be admitted merely because its certificate is valid."},{"mechanism_slug":"computability_boundary_decision_record","role":"Records the rejected universal-predictor requirement, proof-carrying guarantee, workflow identity, assumptions, checker version, resource verdict, and recheck triggers.","counterfactual_removal":"Without the record, code, schema, checker, or external-service changes could silently retain an obsolete certificate."}],"causal_chain":["Arbitrary workflow expressiveness makes the proposed class-wide termination predictor a semantic claim over an unbounded program class.","A precise workflow and capability model makes that claim eligible for a direct impossibility argument instead of inference from failed executions.","A checked diagonalization result withdraws only the unrestricted complete-predictor requirement; it does not imply that individual workflows cannot have termination proofs.","Requiring a submitted certificate changes the operational task from discovering termination for every program to checking a finite proof artifact under fixed rules.","A total, sound certificate checker gives admitted workflow packages a model-relative termination guarantee while allowing honest incompleteness for uncertified programs.","Runtime enforcement ensures that certified workflows cannot acquire undeclared external capabilities that invalidate their proofs.","A separate complexity gate determines whether a termination-certified workflow is feasible for recurring surveillance schedules.","Fallback labels and the versioned record prevent bounded executions, timeouts, or stale certificates from being promoted into universal termination claims."],"baseline":"Platform staff run a submitted workflow on representative datasets, inspect its code, impose a wall-clock timeout, and approve recurring execution if the trials finish. This establishes completion only for those runs and does not show that the workflow terminates over the full admitted dataset class or that its resource growth is acceptable.","nearest_rivals":["Runtime timeout and job cancellation: guarantee that platform control eventually returns but do not establish that the workflow itself terminates or that a timeout means nontermination.","Historical execution monitoring: provides empirical runtime observations for encountered datasets but cannot prove class-wide termination from a finite history.","Heuristic static termination analysis: may infer useful results automatically but must expose whether it is sound, complete, or capable of returning unknown; it cannot silently serve as a universal decider.","A finite workflow language: can guarantee termination by syntactic restriction but requires authors to abandon otherwise certifiable programs; proof-carrying admission instead restricts the accepted evidence contract.","Manual code review: can identify plausible decreasing measures and dangerous calls but does not provide a uniform, replayable certificate-checking procedure.","Resource quotas: protect shared infrastructure from a single run but address capacity containment rather than the workflow's universal termination property."],"remaining_contrastive_claim":"The proposal does not claim to discover termination proofs for every terminating workflow. It claims only that a total checker can soundly validate certificates expressed in its proof language under enforced execution assumptions, after which resource feasibility remains a separate question. Rejection, missing evidence, or bounded-run timeout never establishes nontermination.","authority_safety":{"decision_authority":"The surveillance program director authorizes recurring workflows, the platform owner enforces execution capabilities, an independent reviewer approves the checker and boundary proof, and veterinarians retain authority over interpretation and any animal-level response.","authorized_first_step":"Build an offline checker for a small certificate language and test it against synthetic workflows with structural recursion, decreasing counters, mutual calls, deliberate infinite loops, invalid ranking functions, and mocked external services. No workflow may enter a live surveillance schedule during this step.","excluded_actions":["Scheduling an experimental workflow against live surveillance feeds","Changing animal-level monitoring, movement, testing, or treatment from prototype output","Treating missing or rejected certificates as proof that a workflow does not terminate","Treating a valid termination certificate as proof of acceptable runtime, scientific validity, or clinical correctness","Allowing certified code to invoke undeclared external services or capabilities","Reusing a certificate after workflow, schema, checker, or execution-model changes without revalidation"],"halt_rollback":"Stop certificate-based admission and revert all affected workflows to uncertified status if the checker accepts a deliberately invalid proof, an accepted workflow violates its modeled termination guarantee, runtime capabilities bypass the certificate contract, or a stale certificate survives a registered change. Preserve diagnostic artifacts and restore the previous scheduling controls until independent correction and review are complete."},"negative_tests":{"strongest_counterevidence":"A checkable total procedure that correctly decides universal termination for every workflow in the full admitted unrestricted language would defeat the proposed impossibility boundary and remove the need to rely on incomplete proof-carrying admission.","problem_falsifier":"The computability problem is absent if every admitted workflow is generated from a finite acyclic plan with statically bounded iteration and only total bounded external operations; termination would then follow constructively from the existing language definition.","intervention_falsifier":"The intervention fails if checker acceptance does not imply workflow termination under actual runtime semantics, certificate validity cannot be decided, or capability enforcement permits unmodeled calls that invalidate the proof.","risks":["The formal workflow semantics may diverge from the production interpreter.","Certificate construction may require expertise unavailable to some workflow authors.","A sound but narrow proof language may leave useful terminating workflows uncertified.","External services may violate recorded termination contracts after certification.","Termination-certified workflows may still exceed operational time, memory, or communication limits.","Bounded one-off runs may be misrepresented as evidence of universal termination.","The authority conveyed by a checked certificate may lead users to overread it as validating epidemiological logic or veterinary conclusions."]},"next_evidence_step":"Define a toy workflow language with finite records, unbounded natural-number loops, structural list recursion, and mocked external calls. Implement a certificate checker for structural recursion and lexicographic ranking functions, then prove the checker terminates and that acceptance implies termination in the toy semantics. Evaluate no more than twelve synthetic workflow-certificate pairs covering valid proofs, subtle invalid descent claims, nonterminating workflows, stale hashes, and external-contract mismatches. Measure checker behavior separately from bounded workflow runtime and have a second reviewer inspect the diagonal construction and checker proof. This evidence may support only the toy checker's soundness and routing behavior; it cannot establish production semantic fidelity, operational feasibility, or effects on veterinary surveillance.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Proposal 1 verifies prohibited actions in individual programmable veterinary care policies by enforcing a finite-state language and model-checking a conservative patient abstraction. Proposal 4 instead addresses universal termination admission for herd-surveillance data workflows and retains expressive programs when authors provide checkable termination certificates; it does not analyze clinical-action safety. Proposal 2 searches for an existential trace-matching witness across open-ended animal-behavior simulators using enumeration, dovetailing, and explicit UNKNOWN. Proposal 4 neither searches parameter executions nor recognizes a behavior match; it checks a supplied proof for a unary all-input termination property and then invokes a separate complexity gate. Proposal 3 governs semantic equivalence between legacy and replacement laboratory pipelines through proof search, counterexamples, and finite-envelope comparison. Proposal 4 compares no program pair and authorizes no migration; its adoption unit is recurring surveillance-job admission, and its central move is shifting from impossible universal proof discovery to decidable producer-supplied proof checking. The problem, actors, decision object, intervention, evidence flow, fallback, and causal path are therefore distinct from every earlier proposal.","revision_record":{"parent_version":null,"progress_targets_addressed":[],"conceptual_changes":[],"operational_changes":[],"evidence_changes":[],"claim_changes":[]}}