{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp06_four_proposal_generalization60_20260803","cell_id":"representation_independent_interface_contract__futurism_foresight","arm":"COMPLETE_PROPOSAL_PORTFOLIO","candidate_id":"delphi_round_state_behavioral_contract","proposal_index":2,"version":0,"title":"Representation-Independent Contract for Delphi Elicitation Rounds","problem":"A national public-health agency conducts a multiround Delphi exercise about its long-range workforce needs. Participant enrollment, anonymous responses, round closure, aggregation, controlled feedback, revision, and withdrawal are handled across a survey vendor, facilitator spreadsheets, email records, and an analysis script. Those representations assign different implicit meanings to participant identity, response eligibility, missing answers, late submissions, aggregation, and post-closure edits. When records move between them or a tool is replaced, coordinators cannot determine whether the Delphi process state was preserved.","actors":["Public-health workforce foresight program manager","Delphi facilitators","Invited subject-matter experts","Survey-platform and analysis-tool maintainers","Data-protection officer","Agency leaders who consume the elicitation findings"],"observable_state":"Given the same elicitation record, two implementations can disagree about which participants were eligible in a round, which responses belong in an aggregate, whether feedback uses only closed-round responses, whether a withdrawn response remains counted, or whether a later response can be linked to a named expert. Existing checks can confirm matching columns or questionnaires without establishing equivalent lifecycle behavior.","consequence":"A platform migration or analysis rewrite can silently change the expert population, feedback shown between rounds, aggregate results, or anonymity boundary while the exercise is still described as one continuous Delphi process. This undermines interpretability of response revisions and the procedural basis for using the findings in workforce planning.","affected_objective":"Preserve the governed elicitation process, anonymity commitments, and round-to-round comparability while allowing the agency to replace survey, facilitation, and analysis implementations.","intervention":"Define an abstract component called a Blind Iterative Elicitation State. Its public operations enroll an eligible participant through a separately held identity service, issue an unlinkable study handle, open a round, accept or replace a response before closure, withdraw a response, close a round, compute a declared aggregate, publish controlled feedback, open a subsequent round, and export an audit view. Its state-transition laws require one active response per eligible handle and question per round, prohibit response mutation after closure, derive feedback only from the specified closed-round population, preserve withdrawals according to a declared policy, and prevent ordinary analysis operations from resolving handles to identities. Preconditions, postconditions, typed errors, allowed side effects, version rules, and sanctioned identity-recovery procedures are specified without reference to survey fields, spreadsheet rows, database tables, or vendor workflows. Each implementation must pass the same black-box and generated-sequence conformance suite before it may hold an authoritative Delphi round state.","structural_mapping":[{"archetype_element":"Abstract behavioral surface","domain_realization":"Enrollment, pseudonymous handle issuance, round opening, response submission and replacement, withdrawal, closure, aggregation, feedback publication, next-round creation, and audit export."},{"archetype_element":"Hidden representation","domain_realization":"Survey fields, spreadsheet rows, database schemas, email routing, encryption layout, vendor identifiers, aggregation code, and facilitator working files."},{"archetype_element":"Abstract state and invariants","domain_realization":"Participant eligibility, unlinkable study handles, round status, active-response membership, withdrawal status, aggregate specification, feedback provenance, and the separation between identity custody and ordinary analysis."},{"archetype_element":"Behavioral laws","domain_realization":"Only eligible handles may submit; at most one active response exists per handle-question-round tuple; closure prevents later mutation; published feedback derives from the declared closed population; repeated reads do not change state; identity resolution is unavailable through ordinary operations."},{"archetype_element":"Error and side-effect semantics","domain_realization":"Late or ineligible submissions return typed errors without entering the aggregate; failed closure leaves the round open; aggregation is read-only; authorized withdrawal produces a recorded state transition rather than silent deletion."},{"archetype_element":"Conformance oracle","domain_realization":"A reusable suite drives valid and invalid operation sequences through every survey, spreadsheet, or service-backed implementation and inspects only contract-authorized outputs."},{"archetype_element":"Substitutability rule","domain_realization":"A replacement implementation is acceptable only if it preserves all public round-state observations, anonymity boundaries, errors, and side-effect limits under the applicable contract version."},{"archetype_element":"Leakage boundary","domain_realization":"Observable vendor IDs, timestamps, export ordering, filenames, response metadata, and error details are audited for unintended identity or submission-history disclosure."}],"mechanism_mapping":[{"mechanism_slug":"abstract_data_type_specification","role":"Models the elicitation independently of storage and supplies invariants plus an abstraction function mapping each valid platform state to participant, round, response, withdrawal, and feedback states.","counterfactual_removal":"Without an abstract state and semantic mapping, matching questionnaires or exports cannot establish that two systems represent the same Delphi process."},{"mechanism_slug":"design_by_contract_clause","role":"Specifies caller obligations and component guarantees for submission, replacement, withdrawal, closure, aggregation, and feedback, including non-mutation after rejected operations.","counterfactual_removal":"Without per-operation clauses, late responses, duplicate submissions, missing answers, and closure failures remain implementation-specific."},{"mechanism_slug":"opaque_type_or_module_boundary","role":"Exposes pseudonymous participant and round handles while withholding identity mappings and internal response structures from facilitators and analysis clients.","counterfactual_removal":"Without enforced opacity, clients can couple to vendor identifiers or directly inspect identity-bearing records, defeating substitutability and the declared anonymity boundary."},{"mechanism_slug":"black_box_contract_test_suite","role":"Provides one implementation-parameterized acceptance gate covering operations, outputs, state transitions, errors, withdrawals, feedback provenance, and identity-access restrictions.","counterfactual_removal":"Without a common black-box gate, a replacement can satisfy the same nominal workflow while changing consequential round behavior."},{"mechanism_slug":"property_based_conformance_test","role":"Generates submission, replacement, withdrawal, failed-operation, closure, and feedback sequences to test invariants across paths that example cases may omit.","counterfactual_removal":"Without generated operation sequences, defects that arise only from unusual event orderings can pass a small set of scripted round tests."},{"mechanism_slug":"representation_leakage_probe","role":"Checks exports, ordering, timestamps, error content, metadata, and response handles for observable but unpromised information that could reveal identity or internal submission history.","counterfactual_removal":"Without leakage probing, an opaque API could still disclose linkable patterns through authorized outputs."},{"mechanism_slug":"mock_fake_or_stub_implementation","role":"Supplies a minimal in-memory elicitation engine that can exercise closure failures, withdrawals, duplicate submissions, and identity-access attempts without involving experts or a live vendor.","counterfactual_removal":"Without a controllable stand-in, early client and conformance tests would depend on a live study or one vendor's behavior, biasing the contract toward that representation."},{"mechanism_slug":"semantic_versioning_and_deprecation_gate","role":"Classifies changes to eligibility, withdrawal, aggregation, feedback, and audit semantics and prevents silent reinterpretation of archived or active rounds.","counterfactual_removal":"Without versioned behavioral change control, a routine tool update could alter the meaning of round histories while retaining the same operation names."}],"causal_chain":["The agency defines Delphi round state through public operations, transition laws, anonymity invariants, and error semantics rather than through vendor fields or facilitator files.","Each implementation maps its internal records to that abstract state and makes representation details unreachable through ordinary elicitation and analysis operations.","Generated and example-based black-box tests expose implementations that count, revise, close, withdraw, aggregate, or publish feedback differently.","Leakage probes test whether outputs disclose identity-bearing or submission-history details that the formal surface does not authorize.","Only implementations satisfying the same behavioral and leakage gates may hold or replace the authoritative elicitation state.","Tool substitution can therefore be evaluated as preservation of elicitation procedure rather than inferred from matching screens, schemas, or exports."],"baseline":"The program manager defines the Delphi procedure in a study protocol, configures a survey platform, maintains facilitator crosswalks, and reconciles exports with spreadsheets and analysis scripts. Migration review checks questionnaires, participant counts, and aggregate tables, but does not apply a shared state model or operation-sequence oracle to every implementation.","nearest_rivals":["A standard questionnaire and export schema aligns field names and value shapes but does not define lifecycle transitions, withdrawal behavior, closure semantics, aggregation membership, or identity-access limits.","A detailed facilitator operating procedure assigns human steps but does not make independently built survey and analysis implementations behaviorally substitutable.","Mandating one survey platform avoids near-term migration but leaves the procedure dependent on that platform's undocumented semantics and supplies no acceptance rule for a future replacement.","A privacy impact assessment evaluates data handling and disclosure risks but does not establish equivalence of round-state operations or aggregation behavior.","Manual reconciliation of counts and summary statistics can detect selected discrepancies after migration but does not exercise invalid operations, rare state sequences, or unpromised metadata leakage."],"remaining_contrastive_claim":"The proposal is specifically a behavioral and state-transition contract for the execution of anonymous iterative elicitation. It is not a questionnaire format, a general privacy policy, a facilitation method, or a mandate to use one Delphi platform.","authority_safety":{"decision_authority":"The Delphi program manager may draft and test the contract; the data-protection officer controls identity-separation and recovery rules; the study sponsor retains authority to approve the elicitation protocol and use its findings in workforce decisions.","authorized_first_step":"Using synthetic participants and non-live questions, the program manager may build an in-memory reference model and adapters for a spreadsheet representation and a test survey export, then run offline conformance and leakage checks.","excluded_actions":["Contacting or enrolling real experts during the first test","Migrating an active or authoritative Delphi study","Resolving synthetic or real study handles to identities outside an approved identity-custody procedure","Changing an approved study protocol, aggregate definition, or withdrawal policy","Treating software conformance as evidence that expert judgments are accurate or representative","Publishing responses, feedback, or identity-bearing metadata","Allowing the contract designer to redefine contested methodological choices as implementation invariants without sponsor approval"],"halt_rollback":"Stop if ordinary contract operations expose identity, the abstraction cannot express an approved withdrawal or feedback rule, generated tests merge distinct participant states, or an adapter requires live records. Roll back by deleting the synthetic mappings and withdrawing the adapters from consideration; no active study or authoritative record is modified."},"negative_tests":{"strongest_counterevidence":"The agency may determine that the procedural meaning of its Delphi exercise depends irreducibly on facilitator judgment and platform-specific interaction context, making a representation-independent state surface either too weak to protect the method or so detailed that it merely reproduces one implementation.","problem_falsifier":"A blinded reconstruction from the existing survey, spreadsheet, and analysis representations yields identical eligibility, active-response membership, withdrawal treatment, feedback population, aggregates, and anonymity access for every predeclared case without additional behavioral rules.","intervention_falsifier":"Two independently implemented systems pass the complete contract suite but produce different predeclared feedback populations, aggregate memberships, or identity-access outcomes for the same operation history, or an approved ordinary workflow cannot be expressed without exposing internal representation.","risks":["The contract may encode one contested interpretation of Delphi practice as a technical invariant.","A weak generator may omit the state sequences most likely to reveal disagreement.","A fake implementation may become an unearned semantic authority rather than a testing aid.","Opaque handles may still be linkable through timing, ordering, or metadata.","Over-specified aggregation or feedback rules may prevent legitimate methodological changes.","Technical acceptance may obscure differences in participant experience that affect elicitation quality.","Versioning may preserve procedural interpretation without preserving the social context in which responses were produced."]},"next_evidence_step":"Predeclare a synthetic protocol containing eligibility changes, duplicate submissions, pre-closure replacements, late submissions, withdrawals before and after closure, a failed closure, two aggregation rules, feedback publication, and attempted identity access. Implement that protocol independently in an in-memory model and a spreadsheet-backed adapter, drive both with the same generated and scripted operation sequences, and compare only contract-level observations. Record every divergence and every observable metadata channel. The bounded output is an assessment of whether the surface is expressible, discriminating, and non-leaking; it does not authorize use with real participants or estimate downstream effects.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Proposal 1 addressed preservation of a governed scenario set when regional water futures move among narrative, graph, spreadsheet, and simulation representations; its focal object was scenario meaning, and its causal path ran through stable scenario identity, provenance, and implication queries. This proposal addresses a materially different problem: preservation of the anonymous multiround procedure used to elicit expert judgments for public-health workforce foresight. Its focal object is an elicitation state machine, its critical invariants concern eligibility, closure, withdrawal, aggregation membership, feedback provenance, and identity separation, and its causal path runs through procedural conformance and leakage control. It is independently adoptable by a Delphi program without adopting the scenario-set contract, and Proposal 1 can be adopted without running a Delphi process.","revision_record":{"parent_version":null,"progress_targets_addressed":["Second complete proposal","Materially different domain problem within the same archetype-domain cell","Distinct intervention and causal path","Explicit contrast with proposal 1","Bounded falsifiable first evidence"],"conceptual_changes":[],"operational_changes":[],"evidence_changes":[],"claim_changes":[]}}