{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp06_four_proposal_generalization60_20260803","cell_id":"representation_independent_interface_contract__criminology_forensic","arm":"COMPLETE_PROPOSAL_PORTFOLIO","candidate_id":"blind_proficiency_exercise_capsule_v0","proposal_index":3,"version":0,"title":"Opaque Blind-Proficiency Exercise Capsule","problem":"A forensic laboratory may administer blind proficiency exercises through case-management, laboratory, or training systems whose internal representations expose that an assignment is a test. Exercise-specific identifiers, status values, routing paths, notifications, error behavior, or timing can reveal the hidden classification to participants. Alternative implementations can also disagree about when submissions become immutable, who may see the exercise identity, or which transitions constitute completion. A nominally compatible replacement therefore may alter both blindness and assessment state because no representation-independent behavioral contract defines the exercise component.","actors":["Laboratory proficiency-program steward","Forensic examiners participating under an authorized program","Technical reviewers and supervisors","Laboratory quality manager","Case-management and laboratory-system maintainers","Authorized auditors of the proficiency program"],"observable_state":"Before authorized disclosure, an examiner-facing client can sometimes distinguish a synthetic proficiency assignment from ordinary casework through observable metadata or behavior, or two implementations can return different participant-visible states after the same assignment, acceptance, submission, review, and disclosure sequence. Differences may include test-only prefixes, queues, URLs, error messages, required fields, notification templates, submission mutability, or premature access to the exercise classification.","consequence":"An implementation change can disclose the exercise’s identity, permit post-submission alteration, expose restricted assessment information, or produce inconsistent completion states without changing the exercise design itself. The resulting record may no longer support the intended blind assessment, and administrators may be unable to tell whether divergence reflects participant conduct, policy, or software representation.","affected_objective":"Preserve the blind-proficiency lifecycle, role-specific visibility, submission finality, and reviewable assessment state when the supporting system or storage representation changes.","intervention":"Define a Blind-Proficiency Exercise Capsule as an opaque, role-sensitive abstract state machine. Its lifecycle states are prepared, queued, accepted, submitted, adjudicated, disclosed, remediated when applicable, and closed. Public operations allow an authorized steward to prepare an exercise and its ordinary-case facade, enqueue it through a sanctioned workflow, permit a participant to accept or decline under stated conditions, record and lock a submission, permit an independent reviewer to append an adjudication, authorize disclosure, record an appeal or remediation outcome, and retrieve a role-specific view. Preconditions, postconditions, error categories, and side-effect limits are specified for every operation. Invariants require that only authorized stewards can bind the hidden exercise classification; pre-disclosure participant views contain no exercise-only field or status; locked submissions cannot be overwritten; adjudication cannot precede a locked submission; disclosure is explicit and irreversible for that capsule version; prior assertions remain visible to authorized auditors when corrected; and rejected operations leave abstract state unchanged. Database fields, test flags, routing tables, internal identifiers, notification infrastructure, and storage layout remain non-contractual. A replacement implementation is accepted only if it passes the same role-parameterized black-box lifecycle suite and a leakage probe comparing synthetic exercise and ordinary-case facades across all declared observable channels.","structural_mapping":[{"archetype_element":"Abstract component","domain_realization":"One opaque Blind-Proficiency Exercise Capsule with a hidden exercise classification and a governed lifecycle."},{"archetype_element":"Observable operation surface","domain_realization":"Prepare, enqueue, accept or decline, submit and lock, adjudicate, disclose, append appeal or remediation, close, and retrieve a role-specific view."},{"archetype_element":"Abstract state model","domain_realization":"Lifecycle state, participant assignment, immutable submission commitment, adjudication record, disclosure state, remediation or appeal record, and role-indexed visibility permissions."},{"archetype_element":"Behavioral laws and invariants","domain_realization":"No adjudication before submission; no overwrite after locking; no participant-visible exercise classification before disclosure; disclosure is irreversible within a version; corrections append rather than erase; unauthorized and invalid operations do not mutate abstract state."},{"archetype_element":"Hidden representation","domain_realization":"Exercise flags, database tables, routing queues, internal keys, storage layouts, template identifiers, caches, and notification-service organization."},{"archetype_element":"Abstraction function","domain_realization":"Each valid concrete record maps to one lifecycle state, visibility partition, locked submission, adjudication history, and disclosure status regardless of its internal fields or workflow engine."},{"archetype_element":"Observable side-effect boundary","domain_realization":"Participant-visible metadata, notifications, URLs, status labels, error categories, ordering, and coarse response behavior are included in leakage review; internal audit storage and scheduling algorithms are not public promises."},{"archetype_element":"Conformance oracle and substitutability rule","domain_realization":"One implementation-parameterized suite exercises every role and allowed transition; a candidate is substitutable only when mandatory lifecycle, authorization, immutability, and leakage checks pass."}],"mechanism_mapping":[{"mechanism_slug":"abstract_data_type_specification","role":"Defines the capsule by abstract lifecycle states, role-indexed views, operations, invariants, and a mapping from valid concrete records to those meanings.","counterfactual_removal":"Without it, the proposal would describe a workflow convention but could not determine whether differently stored exercise records represent the same state or preserve the same blindness obligations."},{"mechanism_slug":"design_by_contract_clause","role":"Assigns preconditions, postconditions, unchanged-state guarantees, and allowed errors to preparation, assignment, submission locking, adjudication, disclosure, and remediation operations.","counterfactual_removal":"Without it, implementations could disagree about invalid transitions, repeated submissions, premature adjudication, or unauthorized disclosure while still exposing matching operation names."},{"mechanism_slug":"opaque_type_or_module_boundary","role":"Provides role-scoped capsule handles and operations without exposing the hidden exercise flag or its concrete storage to participant-facing clients.","counterfactual_removal":"Without it, a client could inspect internal fields or types and directly discover the classification that the intervention must conceal."},{"mechanism_slug":"black_box_contract_test_suite","role":"Runs the same lifecycle and visibility scenarios against every implementation using only public role-scoped operations and observable side effects.","counterfactual_removal":"Without it, replacement acceptance would rely on field mapping, documentation, or selected demonstrations rather than a shared behavioral gate."},{"mechanism_slug":"property_based_conformance_test","role":"Generates role-operation sequences to test transition legality, locked-submission immutability, authorization partitions, append-only corrections, and unchanged state after rejection.","counterfactual_removal":"Without it, unusual sequences such as repeated disclosure, adjudication before submission, or cross-role access could escape a suite limited to normal workflow examples."},{"mechanism_slug":"representation_leakage_probe","role":"Compares synthetic exercise and ordinary-case facades for test-only fields, identifiers, routes, labels, messages, notifications, ordering, and other observable but unpromised distinctions.","counterfactual_removal":"Without it, an implementation could satisfy the documented lifecycle while revealing exercise identity through an accidental observable channel."},{"mechanism_slug":"mock_fake_or_stub_implementation","role":"Provides a synthetic ordinary-case workflow and controlled role clients so leakage and rare failure paths can be tested without enrolling personnel or touching live casework.","counterfactual_removal":"Without it, the first meaningful comparison could require live workflows or expose actual participants to an unvalidated implementation."},{"mechanism_slug":"semantic_versioning_and_deprecation_gate","role":"Governs changes to lifecycle meanings, role visibility, error categories, side-effect promises, and disclosure rules.","counterfactual_removal":"Without it, a nominally compatible update could add a participant-visible field or change submission finality without an explicit breaking-change review."}],"causal_chain":["Blind proficiency administration depends on concealing an exercise classification while still presenting a usable case-like workflow.","When systems expose internal test flags, routing structures, or exercise-specific behavior, participants can observe representation details that were never intended as part of the workflow.","Different implementations can also encode lifecycle transitions and role visibility differently, so replacement can change blindness or assessment state.","The intervention defines an opaque capsule through role-scoped operations, explicit state transitions, invariants, errors, and observable side-effect limits.","The abstraction mapping separates lifecycle meaning from database flags and workflow-engine structure, while the opaque boundary prevents direct inspection.","A shared black-box suite tests transition and authorization behavior, and the leakage probe compares all declared participant-visible channels between exercise and ordinary-case facades.","Only an implementation satisfying both behavioral conformance and predeclared leakage criteria is accepted as a substitute for the capsule role."],"baseline":"The comparison baseline is a proficiency workflow implemented through exercise-specific forms, spreadsheets, training modules, or case-system flags, with blindness checked through procedural review and replacement assessed through field mapping and selected walkthroughs. The first evaluation would inventory actual participant-visible dependencies rather than assume that any particular channel currently leaks.","nearest_rivals":["A written confidentiality procedure instructs administrators not to reveal exercise identity but does not prevent software fields, routes, or errors from exposing it.","Role-based access control can restrict named fields yet does not define lifecycle semantics, submission finality, or every participant-observable side effect.","A separate training platform manages exercises explicitly but does not preserve a blind, ordinary-case facade and may make the assignment’s nature evident by its location.","Audit logging records actions after they occur but does not specify which transitions are valid or prevent premature disclosure and post-submission overwrite.","A standardized proficiency scoring rubric governs adjudication content but does not govern the opaque assignment lifecycle or implementation substitutability.","Manual pre-release walkthroughs can detect selected clues but do not provide one reusable black-box oracle across implementations and generated operation sequences."],"remaining_contrastive_claim":"The proposal’s limited architectural claim is that a blind exercise can be represented as an opaque, role-sensitive state machine whose lifecycle and observability—not its database flags—bind every implementation. It does not define proficiency content, scoring validity, personnel consequences, laboratory accreditation, or whether blindness is appropriate for a given program.","authority_safety":{"decision_authority":"The laboratory quality authority and formally designated proficiency-program steward may approve the abstract contract and synthetic sandbox evaluation. Decisions to enroll personnel, use results in competency determinations, disclose an exercise, or impose remediation remain with the institution’s authorized human process.","authorized_first_step":"Build synthetic ordinary-case and exercise capsules containing no real personnel or case data, implement the participant, reviewer, and steward views in a sandbox, and run predeclared lifecycle and leakage comparisons against a simple reference model and one candidate adapter.","excluded_actions":["No covert enrollment or monitoring of personnel","No use of sandbox outcomes in employment, certification, discipline, or competency decisions","No insertion of synthetic exercises into live case queues","No access to live case records or existing personnel-assessment records","No production disclosure, notification, or remediation action","No weakening of local authorization, labor, privacy, or quality-review requirements","No acceptance of an implementation solely because participants failed to notice a leak"],"halt_rollback":"Stop if any participant-scoped operation reveals the hidden classification before authorized disclosure, if locked work can be altered, if role separation fails, if the sandbox contacts a live notification or case service, or if the abstract model cannot represent a required authorized workflow. Preserve current proficiency procedures, delete only disposable synthetic sandbox state, and return the disputed clause to quality, privacy, and technical review."},"negative_tests":{"strongest_counterevidence":"The strongest counterevidence would show that exercise recognition is driven primarily by physical materials, scheduling, administrator behavior, unusual case facts, or other cues outside the component’s observable boundary. It would also count against the intervention if meaningful assessment review requires participant access to representation details that the opaque capsule would conceal.","problem_falsifier":"The proposed software problem is falsified for the bounded setting if an inventory shows that participants cannot access exercise-specific representation details, all lifecycle and visibility obligations are already explicit and executable, and alternative implementations produce indistinguishable contract-visible behavior for every tested role and sequence.","intervention_falsifier":"The intervention is falsified for the tested scope if an implementation passes all predeclared contract and leakage checks yet an independent participant-role review reliably identifies synthetic exercise capsules from information within the declared observable boundary, or if two passing implementations yield materially different lifecycle, visibility, submission, or disclosure states.","risks":["The contract may create confidence in software blindness while cues outside the interface still reveal the exercise.","Ordinary-case facades may be modeled too narrowly and omit observable channels used by actual clients.","Attempting to equalize behavior could suppress a legitimate safety or quality warning.","Generated role sequences may miss concurrency races between submission, adjudication, and disclosure.","Opaque handling may impede authorized audit unless the steward and auditor views are complete.","A reference model may encode one institution’s proficiency policy as though it were representation-independent.","Stable timing or notification promises could over-constrain implementations, while leaving them unspecified could permit recognizable differences.","The capsule could be repurposed for undisclosed personnel surveillance if authority limits are not enforced." ]},"next_evidence_step":"Create a sandbox matrix of synthetic ordinary assignments and synthetic exercise capsules spanning preparation, queueing, acceptance, decline, draft work, submission locking, attempted resubmission, adjudication, correction, disclosure, appeal, and closure. Before execution, specify expected abstract post-states, permitted errors, role-visible fields, notifications, routes, and explicitly tolerated differences. Run the same matrix against a transparent reference state machine and one independent adapter. Add generated invalid sequences and compare participant-facing transcripts after removing only values the contract declares variable. Record every distinguishable channel and lifecycle divergence without modifying the acceptance criteria after results are observed. This step tests whether the bounded behavioral and leakage contract is coherent; it does not authorize a live blind exercise.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Proposal 1 concerned preservation of physical-evidence continuity meaning across custody, seal, sampling, consumption, and correction records. Proposal 2 concerned representation-independent retrieval, provenance, qualification, and query behavior for artifacts extracted from a fixed digital source image. Proposal 3 instead concerns a quality-assurance assignment whose hidden classification and role-sensitive lifecycle must survive changes in workflow implementation. Its causal path is disclosure or state divergence through exercise-specific observables, not alteration of custody history or artifact-corpus semantics. Its intervention is an opaque blind-exercise capsule with visibility partitions and submission-finality laws. It can be adopted for proficiency administration without changing evidence-continuity tracking or digital-artifact extraction, and either earlier proposal can be adopted without this one.","revision_record":{"parent_version":null,"progress_targets_addressed":["Third independently adoptable proposal","Explicit differentiation from proposals 1 and 2","Causal preservation of representation hiding and behavioral substitution","Operational authority and misuse safeguards","Bounded falsifiable evidence plan"],"conceptual_changes":[],"operational_changes":[],"evidence_changes":[],"claim_changes":[]}}