{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp06_four_proposal_generalization60_20260803","cell_id":"bounded_rivalry_governance__aviation_aeronautics","arm":"COMPLETE_PROPOSAL_PORTFOLIO","candidate_id":"brg-aa-04-avionics-gateway-contestability-arena","proposal_index":4,"version":0,"title":"Contestability-Preserving Arena for an Aircraft Health-Data Gateway","problem":"A fleet modernization program must select a primary avionics gateway that transfers aircraft health and condition data to approved maintenance applications. Suppliers compete for one fleet integration contract and reference-implementation position. If evaluation emphasizes initial features, integration schedule, and acquisition price, a supplier can win through proprietary schemas, undocumented extensions, subsidized adapters, or control of conformance tooling. The initial victory can then make later applications, replacement gateways, and data migration dependent on the winner, allowing success in one contest to determine the rules and entrants of future contests.","actors":["Aircraft operator or fleet owner","Aircraft design-approval holder and avionics engineering authority","Competing avionics gateway suppliers","Independent interoperability and cybersecurity laboratory","Maintenance-analytics application suppliers","Aircraft maintenance and records personnel","Flight operations and safety personnel","Procurement officials and conflict-of-interest reviewer","Independent appeal and competition-review panel","Applicable airworthiness and cybersecurity authorities"],"observable_state":"For each candidate, observe acquisition and integration price; disclosed interface completeness; independently implemented message exchange; use of undocumented extensions; data-export completeness; conformance-test reproducibility; cross-vendor application onboarding effort; upgrade and rollback behavior; fault containment; latency and data-loss behavior; cybersecurity findings; proprietary tooling dependencies; licensing restrictions; configuration portability; evaluator support supplied at below-declared cost; common ownership or subcontracting relationships; protest findings; and estimated effort to replace the gateway without changing downstream applications. After selection, observe interface changes, challenger qualification, migration exercises, application concentration, change-order pricing, and access refusals.","consequence":"A gateway can win the immediate comparison while acquiring durable control over aircraft data formats, adapters, validation tools, and switching knowledge. Downstream application suppliers may then require the winner's permission or proprietary tooling, the fleet owner may face growing replacement risk, and safety-relevant upgrades can become coupled to commercial dependence unrelated to the original contest purpose.","affected_objective":"Select a safe and supportable aircraft health-data gateway while preserving verified interoperability, data portability, independent conformance testing, supplier entry, controlled evolution, and the fleet owner's ability to replace the implementation without reopening every downstream integration.","intervention":"Run an interoperability-constrained gateway arena in which access to future competition is protected before suppliers compete on implementation. The fleet engineering authority first freezes a minimum interface profile, data-export package, safety-isolation boundary, cybersecurity evidence standard, licensing covenant, and change-control process without reference to bidder-specific extensions. A published tender prequalifies suppliers on avionics competence, configuration control, support capacity, technical-data rights, and corporate independence. Eligible gateways enter a blinded bench plugfest using synthetic aircraft-health messages, independently built maintenance clients, malformed inputs, version transitions, disconnection cases, and rollback exercises. Safety isolation, message integrity, approved data handling, and cybersecurity requirements are noncompensable gates. Among passers, scoring covers independently verified interoperability, portability, fault containment, lifecycle support burden, change transparency, price, and schedule. The primary prize is the fleet integration contract; a separate supplier receives the conformance-harness and reference-adapter contract, and the primary winner must escrow the frozen interface artifacts and migration package. Bidder-funded integration demonstrations and evaluator assistance are capped and declared. Before award, an independent competition review tests whether patents, licenses, tooling, data custody, bundled services, or below-cost pilot support would let the winner foreclose later entrants. A migration-performance bond remains in force until an independent client and replacement implementation complete the defined portability exercise. Cross-bid ownership and pricing patterns are screened uniformly for possible coordination, with investigation and judgment separated. The interface reopens through scheduled challenger windows, while safety-relevant changes remain under engineering and regulatory authority rather than contestant vote.","structural_mapping":[{"archetype_element":"Rivalry purpose statement","domain_realization":"Use supplier competition to select a capable gateway implementation while ensuring that winning the current integration does not confer control over future interfaces or entrants."},{"archetype_element":"Scarce prize or selection constraint","domain_realization":"One primary fleet integration contract and reference-implementation position, paired with a separately awarded conformance-harness role."},{"archetype_element":"Competitor eligibility boundary","domain_realization":"Entrants must satisfy avionics competence, configuration-management, support, technical-data, cybersecurity, licensing, and disclosed-ownership requirements before comparative testing."},{"archetype_element":"Contest arena boundary","domain_realization":"Suppliers may compete through compliant implementation, interoperability, support design, price, and schedule. Undocumented extensions, test interference, concealed dependencies, evaluator inducements, proprietary capture of required interfaces, bid coordination, and post-deadline substitution are prohibited."},{"archetype_element":"Performance metric and scoring basis","domain_realization":"Noncompensable safety, integrity, and cybersecurity gates precede scoring of cross-vendor interoperability, export and replacement portability, fault containment, lifecycle burden, price, schedule, and transparent change handling."},{"archetype_element":"Fair process and due process layer","domain_realization":"The interface profile, plugfest cases, scoring, evidence custody, conflicts, caps, tie-breaks, debriefs, and independent appeal process are frozen before bids and applied equally."},{"archetype_element":"Anti-sabotage and anti-collusion guardrail","domain_realization":"Separated test environments, signed artifacts, access logs, common-ownership disclosures, bid-pattern screens, and graduated sanctions constrain interference, leakage, reciprocal bidding, and coordinated market division."},{"archetype_element":"Externality and spillover boundary","domain_realization":"Migration effort, application rework, records access, fault isolation, cybersecurity remediation, and future-maintainer burden enter the contest rather than remaining costs for downstream users."},{"archetype_element":"Escalation and arms-race damper","domain_realization":"Caps on free adapters, bidder-funded demonstrations, uncompensated engineering assistance, and evaluator contact prevent suppliers from buying advantage through subsidized pilot effort that challengers must later match."},{"archetype_element":"Prize decomposition or multiple-winner design","domain_realization":"The primary gateway contract and independent conformance-harness contract go to separate corporate groups, preventing the implementation winner from also owning the test of compatibility."},{"archetype_element":"Winner power and lock-in review","domain_realization":"Pre-award competition review, interface escrow, portable records, an independent reference adapter, migration exercises, and challenger windows constrain control over essential access points."},{"archetype_element":"Learning and recalibration loop","domain_realization":"Post-integration review compares plugfest predictions with actual application onboarding, interface changes, support burden, portability exercises, and challenger access, then revises or retires the arena."}],"mechanism_mapping":[{"mechanism_slug":"tender_or_rfp_process","role":"Publishes interface obligations, bidder qualifications, comparative evidence, evaluation criteria, conflicts, debriefs, and appeal rights before offers are received.","counterfactual_removal":"Without a contestable tender, eligibility and interface requirements could be tailored informally around a preferred supplier or changed after evaluators see the bids."},{"mechanism_slug":"contest_rulebook","role":"Freezes legal moves, noncompensable gates, plugfest procedures, scoring, artifact custody, prohibited dependencies, tie-breaks, and protests.","counterfactual_removal":"Without a binding rulebook, suppliers or judges could redefine interoperability, substitute configurations, or admit proprietary exceptions after results become known."},{"mechanism_slug":"antitrust_or_competition_review","role":"Examines whether licensing, patents, tooling, data custody, bundling, or control of validation infrastructure would let the winner foreclose future gateway or application competitors.","counterfactual_removal":"Without winner-power review, a meritorious implementation victory could automatically confer unrelated control over the essential interfaces required for later competition."},{"mechanism_slug":"multiple_award_or_portfolio_selection","role":"Separates the primary implementation award from the conformance-harness and reference-adapter award and requires corporate independence between recipients.","counterfactual_removal":"Without prize decomposition, the gateway winner could define, implement, and judge conformance, making nominal interoperability dependent on its discretion."},{"mechanism_slug":"externality_bond_or_liability_rule","role":"Secures delivery of interface artifacts, data export, defect remediation, and a defined replacement-portability exercise through a migration-performance bond.","counterfactual_removal":"Without secured responsibility, a supplier could promise portability to win and leave the fleet owner to fund missing artifacts or migration work after dependence has formed."},{"mechanism_slug":"spending_cap_or_resource_cap","role":"Caps free demonstration integrations, uncompensated adapters, evaluator support, and other bidder-funded resources considered in scoring.","counterfactual_removal":"Without the cap, the contest could reward the supplier able to subsidize the largest pilot and later recover that expenditure through lock-in or change orders."},{"mechanism_slug":"anti_collusion_monitoring","role":"Pools ownership, subcontracting, bid, licensing, and pricing information to screen for cover bids, reciprocal abstention, coordinated bundling, or false independence.","counterfactual_removal":"Without pooled screening, apparently separate gateway and conformance bidders could coordinate awards or belong to an undisclosed common commercial arrangement."},{"mechanism_slug":"sabotage_or_foul_penalty_schedule","role":"Defines graduated consequences for plugfest interference, artifact substitution, concealed proprietary dependencies, evaluator inducements, test leakage, and false ownership disclosures.","counterfactual_removal":"Without known consequences, interference or concealment could remain profitable and enforcement could be improvised selectively after award."},{"mechanism_slug":"challenger_access_window","role":"Schedules bounded opportunities for a qualified alternative gateway to run the same conformance and migration exercises before the incumbent architecture becomes irreversible.","counterfactual_removal":"Without recurring access, accumulated integrations and controlled interface knowledge could make future competition ceremonial even when the contract is formally reopened."},{"mechanism_slug":"post_contest_impact_review","role":"Tests whether bench interoperability predicted actual onboarding, portability, support burden, interface evolution, and continued challenger access.","counterfactual_removal":"Without post-award review, a formally open interface could become practically proprietary through later extensions, tooling changes, or weak migration performance."}],"causal_chain":["A fleet-wide gateway contract is scarce, and winning also places one implementation at the center of future data exchanges.","If selection emphasizes immediate integration, suppliers can gain through subsidized pilots, proprietary extensions, bundled tooling, and optimistic portability promises.","A bidder-independent interface floor and eligibility boundary remove ownership of essential access points from the permitted ways to win.","Independent clients, synthetic messages, version changes, and replacement exercises test interoperability as behavior rather than documentation.","Noncompensable safety and cybersecurity gates prevent price or feature points from offsetting unacceptable technical risk.","Caps on bidder-funded demonstrations limit an escalation race based on subsidized integration effort.","Separate implementation and conformance awards prevent the winner from becoming its own interoperability judge.","Competition review and a secured migration obligation internalize future-entry and switching consequences before dependence forms.","Scheduled challenger windows test whether a qualified alternative can still enter after integrations accumulate.","Post-contest review detects practical lock-in or metric gaming and changes the interface, contract, or use of rivalry when winning ceases to reflect the stated purpose."],"baseline":"A prespecified conventional best-value procurement in which suppliers demonstrate their gateways using their own adapters and support teams, and one winner is chosen principally on current features, initial integration cost, delivery schedule, and documented compliance. The winner may also supply the conformance tools and proprietary adapters, subject only to ordinary contract data-rights clauses.","nearest_rivals":["Adopt a single externally defined interface standard and award implementation to the lowest compliant bidder; this reduces design discretion but does not by itself verify practical portability, independent conformance, or later extension control.","Build and maintain the gateway in-house; this avoids supplier platform capture but transfers technical, staffing, lifecycle, and assurance responsibility to the fleet owner.","Select one strategic supplier under a long-term partnership with negotiated data rights; this can align investment but relies on bilateral oversight rather than preserving active challenger pressure.","Buy multiple proprietary gateways and connect them through custom adapters; this diversifies suppliers but can multiply integration burden and move lock-in into the adapter layer.","Require source-code escrow from a single winner; this provides a contingency artifact but does not ensure usable interface rights, independent expertise, data portability, or routine contestability.","Use a public feature-and-performance leaderboard; this makes comparison visible but does not separate essential infrastructure from the winner or constrain downstream foreclosure."],"remaining_contrastive_claim":"The testable contrast is whether bidder-independent interface rules, cross-vendor bench interoperability, separated conformance ownership, secured migration performance, and scheduled reopening preserve practical replacement and application entry better than a conventional single-winner best-value procurement. This is a design hypothesis, not an effect claim.","authority_safety":{"decision_authority":"The aircraft design-approval holder and designated avionics engineering and safety authorities retain control of architecture, configuration, safety assessment, and installation approval. The fleet procurement authority controls commercial awards within those constraints. Applicable aviation and cybersecurity authorities retain all approval and enforcement powers. Neither contest score nor competition review authorizes installation or operational data use.","authorized_first_step":"Conduct a non-operational bench exercise using synthetic aircraft-health messages, mock maintenance clients, isolated candidate gateways or software representations, and a draft interface profile. Calculate shadow scores and run a simulated replacement exercise without connecting to an aircraft, operational network, maintenance record system, or procurement decision.","excluded_actions":["No connection to an aircraft bus, operational avionics network, or live maintenance system","No use of operational flight, crew, passenger, or maintenance-record data","No installation approval, certification credit, supplier award, or exclusion based on the shadow exercise","No compensation of a safety, integrity, or cybersecurity gate failure with other score components","No compelled disclosure of proprietary implementation details beyond predeclared interface and audit evidence","No anomaly-screen finding treated as proof of collusion, common control, or misconduct","No interface change after submissions that advantages an identified candidate","No transfer of configuration or safety authority to contestants, judges, or procurement personnel"],"halt_rollback":"Halt if the bench environment can reach an operational network, synthetic messages cannot be distinguished reliably from operational data, interface requirements conflict with a safety or cybersecurity boundary, candidate artifacts cannot be isolated, or an evaluator has an undisclosed supplier conflict. Disconnect and quarantine the bench, invalidate affected results, restore the frozen artifacts, document the cause, and rerun only after independent approval of corrected boundaries and rules."},"negative_tests":{"strongest_counterevidence":"The existing gateway selection already uses a fully specified and independently governed interface, verified second-source implementations, portable data and conformance tooling, enforceable migration exercises, separate test ownership, and recurring challenger access, with no supplier able to control extensions or downstream application entry.","problem_falsifier":"Independent clients can integrate with every eligible gateway from the published interface alone; replacement requires no winner-controlled artifacts or permissions; later interface changes remain supplier-neutral; and initial victory does not increase the winner's control over data, validation, applications, or future eligibility.","intervention_falsifier":"Plugfest results do not predict independent integration or replacement effort, purportedly open requirements create unacceptable safety or cybersecurity exposure, a usable second implementation cannot be produced without winner-specific knowledge, or separated awards and bonds add governance burden without preserving a credible challenger path.","risks":["A formally open interface may remain practically dependent on undocumented timing, error handling, or tooling behavior.","Interface disclosure may expand cybersecurity exposure if sensitive implementation details are confused with necessary interoperability information.","A frozen profile may impede legitimate safety improvements or new sensor capabilities.","Portability tests may cover simple data transfer while missing configuration, provenance, or historical-context dependencies.","The primary and conformance suppliers may coordinate despite formal corporate separation.","A migration bond may be too small, expire too early, or exclude the most consequential switching costs.","Smaller suppliers may be unable to post security or fund qualification even when technically capable.","Caps on free support may prevent challengers from demonstrating legitimate integration competence.","Competition review may punish size or success without identifying purpose-linked foreclosure.","The fleet owner may lack the expertise to maintain the interface and conformance suite independently.","Multiple contractual owners can diffuse responsibility for defects at the gateway-interface boundary.","Synthetic bench traffic may not reproduce aircraft timing, faults, loads, or maintenance workflows.","Safety or certification dependencies may make nominal challenger windows operationally unusable.","An incumbent may influence later interface changes through accumulated implementation knowledge or committee participation."]},"next_evidence_step":"Pre-register an isolated bench study with a frozen draft interface, one synthetic health-data producer, two independently built maintenance clients, and two or more candidate gateway implementations or faithful software representations. Test normal exchange, malformed messages, data loss, version transitions, export, rollback, replacement, and operation without supplier assistance. Apply the proposed gates, capped support rules, separated conformance scoring, migration obligation, and shadow competition review; compare with the conventional best-value evaluation, source-code escrow alone, and a lowest-price open-interface rule. Report undocumented dependencies, independent integration effort, conformance disagreements, portability failures, safety and cybersecurity gate results, rank sensitivity, supplier-assistance usage, and whether a challenger can complete the exercise from the governed artifacts alone. Use results only to decide whether a separately authorized procurement pilot is warranted.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Proposal 1 governs airline rivalry for scarce departure opportunities during airport recovery, addressing premature readiness and taxi-queue occupation through gate holding, capped priority credits, and repeated release nominations. Proposal 4 instead governs supplier rivalry for a fleet avionics gateway and prevents one procurement winner from controlling future interfaces, data access, conformance infrastructure, and entry; it does not allocate aircraft movement or depend on airline urgency. Proposal 2 governs flight-control engineering teams competing for scarce validation resources, addressing benchmark overfitting and compute escalation through hidden-condition safety testing and portfolio downselection. Proposal 4 does not seek the most robust control algorithm: it protects an essential interoperability layer through supplier-independent rules, separated conformance ownership, migration security, and winner-power review. Proposal 3 governs maintenance shops competing for recurring rotable repair volume, addressing underpriced delayed repair consequences through matched work cohorts, mature field outcomes, warranty reserves, and rolling work-share allocation. Proposal 4 instead concerns platform and interface capture created by a fleet integration award; its evidence is cross-vendor interoperability and replacement feasibility rather than component repair outcomes. The four proposals have distinct contested prizes, strategic pathologies, interventions, observables, authorities, and adoption decisions, and each can be implemented without adopting any of the others.","revision_record":{"parent_version":null,"progress_targets_addressed":["Fourth independently adoptable proposal","Material separation from proposals 1, 2, and 3","Concrete avionics interface actors and observable lock-in indicators","Full bounded-rivalry structural mapping","Winner-power and mechanism-removal analysis","Authority-preserving isolated evidence step","Explicit diversity from every earlier proposal"],"conceptual_changes":[],"operational_changes":[],"evidence_changes":[],"claim_changes":[]}}