{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp06_four_proposal_generalization60_20260803","cell_id":"representation_independent_interface_contract__human_computer_interaction","arm":"COMPLETE_PROPOSAL_PORTFOLIO","candidate_id":"wizard_to_automation_behavioral_envelope","proposal_index":4,"version":0,"title":"Behavioral Envelope for Wizard-to-Automation Prototype Handoff","problem":"A design team evaluates a conversational meeting-rescheduling assistant by placing a hidden human operator behind a convincing chat interface. The operator can improvise clarifications, remember undeclared context, inspect backstage information, repair misunderstandings, and avoid unsafe actions. Because these behaviors are recorded only in instructions and transcripts, the team cannot determine whether a later automated implementation is a substitute for the experience that participants encountered or a materially different assistant behind the same visual surface.","actors":["People interacting with the prototype","Human-computer interaction researchers","Hidden prototype operators","Conversation and interaction designers","Engineers implementing the automated assistant","Calendar-service owner","Research ethics and privacy reviewers"],"observable_state":"For a scripted scheduling scenario, the hidden-human implementation and an automated candidate can be observed through contract-level state: constraints explicitly supplied, unresolved clarification requirements, proposals presented, selected proposal, confirmation status, error class, and calendar side-effect status. The problem is present when equivalent user action sequences produce different semantic response acts or state transitions, when the operator uses information unavailable to the planned system, or when either implementation writes a calendar event outside the declared confirmation rules.","consequence":"A user-facing study may evaluate an experience produced by unbounded human judgment rather than the proposed system, while the eventual implementation may omit recovery behavior or introduce side effects that the prototype concealed. Conversely, engineers may freeze incidental operator wording or timing because no one has separated the tested behavioral promise from the operator's internal method.","affected_objective":"Make experience evidence from a human-simulated assistant interpretable and make later implementation substitution testable, while preserving freedom to replace the hidden operator with rule-based, model-based, or hybrid internals.","intervention":"Define a representation-independent Scheduling Assistance Session contract before further prototype evaluation. The abstract state contains only user-supplied scheduling constraints, clarification obligations, candidate proposals, selection state, explicit-confirmation state, and external-action status. Public operations accept a scheduling intent, add or retract a constraint, request clarification, offer proposals, select a proposal, request confirmation, confirm, cancel, report unavailability, and recover from a transient failure. Semantic response acts are contractual, but exact wording and internal reasoning are not. Invariants require that only declared information influences proposals, insufficient constraints produce clarification rather than invention, no calendar write occurs before explicit confirmation, cancellation never books, and retrying the same confirmed intent creates at most one event. The human operator works through a console that exposes only these operations; automated implementations use the same boundary. A common black-box oracle governs both before either is treated as an implementation of the studied assistant.","structural_mapping":[{"archetype_element":"Abstract behavioral surface","domain_realization":"The scheduling session's semantic user inputs, assistant response acts, state transitions, confirmation behavior, errors, and calendar side-effect outcomes."},{"archetype_element":"Hidden representation","domain_realization":"Human operator judgment, operator notes, rule engines, language models, prompt chains, search algorithms, temporary caches, and proposal-ranking strategies."},{"archetype_element":"Abstract state model","domain_realization":"A session comprising declared constraints, outstanding clarification obligations, offered proposals, current selection, confirmation state, and external-action status."},{"archetype_element":"Behavioral laws and invariants","domain_realization":"Undeclared information cannot affect proposals; missing required constraints trigger clarification; cancellation cannot book; confirmation precedes any write; repeated confirmation with one intent token commits at most once; and observation operations do not change calendar state."},{"archetype_element":"Error and side-effect semantics","domain_realization":"Invalid selections, contradictory constraints, unavailable calendars, expired proposals, and transient write failures have declared response classes and state-preservation or retry rules."},{"archetype_element":"Abstraction mapping","domain_realization":"The operator console and each automated adapter map their internal reasoning and storage to the same contract-level scheduling state and semantic response acts."},{"archetype_element":"Representation-hiding boundary","domain_realization":"The prototype surface and calendar sandbox accept only contract operations; participants and client code cannot invoke operator-specific commands or inspect reasoning artifacts."},{"archetype_element":"Conformance oracle","domain_realization":"A parameterized suite drives synthetic conversations through human-operated, rule-based, or model-based implementations and observes only semantic acts, abstract state, errors, and sandbox side effects."},{"archetype_element":"Substitutability rule","domain_realization":"An automated candidate may be described as implementing the studied behavioral envelope only if it passes the shared oracle and does not require undeclared data or operator-only escape hatches."},{"archetype_element":"Leakage control","domain_realization":"An audit checks whether exact prose, operator response rhythm, hidden calendar access, backstage messages, or decoded internal identifiers have become accidental promises."}],"mechanism_mapping":[{"mechanism_slug":"abstract_data_type_specification","role":"Defines the scheduling session by abstract values and operations, then maps both operator-console state and automated state to that meaning.","counterfactual_removal":"Without the abstract state and mapping, a transcript-level resemblance could conceal different confirmation, clarification, or external-action semantics."},{"mechanism_slug":"design_by_contract_clause","role":"Assigns preconditions, postconditions, error behavior, and unchanged-state guarantees to proposal, selection, confirmation, cancellation, and retry operations.","counterfactual_removal":"Without the clauses, the operator and automation could expose the same operation names while allocating responsibility and failure recovery differently."},{"mechanism_slug":"opaque_type_or_module_boundary","role":"Prevents the chat surface and operator from directly editing confirmation or booking state, forcing all transitions through the declared scheduling operations.","counterfactual_removal":"Without opacity, a hidden operator could repair or complete cases through backstage actions that the eventual implementation cannot reproduce."},{"mechanism_slug":"interface_definition_language","role":"Provides a machine-readable definition of semantic inputs, response-act types, errors, and sandbox calendar commands shared by the operator console and automated adapters.","counterfactual_removal":"Without the generated boundary, implementation-specific fields and privileged commands could enter one version of the assistant while remaining absent from another."},{"mechanism_slug":"black_box_contract_test_suite","role":"Runs one contract-derived battery against every hidden implementation and gates claims of behavioral substitution on observable conformance.","counterfactual_removal":"Without the shared oracle, separate prototype and engineering tests could both pass while judging different behavioral promises."},{"mechanism_slug":"property_based_conformance_test","role":"Generates sequences of added and retracted constraints, contradictory requests, cancellations, failures, confirmations, and retries to exercise session invariants.","counterfactual_removal":"Without generated sequences, ordinary scripted dialogues could miss unauthorized booking or corrupted confirmation state after unusual but permitted interaction orders."},{"mechanism_slug":"mock_fake_or_stub_implementation","role":"Uses a deliberately simple deterministic scheduling fake to exercise the contract and prototype client before either the human wizard or automation is treated as the reference behavior.","counterfactual_removal":"Without an independent stand-in, the contract and tests could be written backward from the operator's improvisations, converting accidental wizard behavior into the specification."},{"mechanism_slug":"representation_leakage_probe","role":"Identifies observable but unpromised dependencies on exact wording, response timing, operator knowledge, backstage communication, or internal identifiers.","counterfactual_removal":"Without the probe, operator-specific cues could become load-bearing parts of the tested experience even though the formal operations conform."},{"mechanism_slug":"abstraction_barrier_code_review","role":"Requires reviewers to classify each operator privilege and automated dependency as public behavior, sanctioned diagnostic access, or prohibited reach-through.","counterfactual_removal":"Without human review, convenient operator interventions or automation-specific assumptions could quietly widen the behavioral envelope."}],"causal_chain":["The prototype currently exposes a stable-looking chat surface while a hidden operator supplies behavior through unconstrained internal judgment.","A scheduling-session contract separates the assistant behavior under evaluation from the means used to produce it.","The operator console and automated adapters are restricted to the same semantic operations, declared information, errors, and side-effect rules.","Shared black-box and generated-sequence tests reveal hidden implementations that improvise unauthorized transitions, omit recovery behavior, or mishandle confirmation and retry.","Leakage review identifies operator-specific cues that remain observable even though they are outside the declared promise.","Study observations can then be attributed to a bounded behavioral envelope rather than to an unspecified human performance.","A later automated implementation can be assessed against that envelope without copying the operator's reasoning process, notes, or exact language."],"baseline":"Give the hidden operator a scenario guide and sample responses, record prototype sessions, and later ask engineers to reproduce the apparent experience from transcripts and design documentation. Safety and recovery differences are reconciled informally during implementation.","nearest_rivals":["A detailed operator script, which can reduce improvisation but does not define an abstract state, executable invariants, or a substitution oracle.","A clickable or scripted conversational prototype, which is reproducible within its canned paths but cannot represent the bounded dynamic behavior being tested.","Transcript coding, which can classify observed operator behavior after sessions but does not prevent unauthorized behavior or govern a later implementation.","An API schema for the automated assistant, which can standardize message shapes without specifying clarification, confirmation, retry, or side-effect semantics.","A direct user study of an early automated system, which tests that implementation but does not provide a representation-independent boundary for comparing it with the earlier human-simulated experience."],"remaining_contrastive_claim":"The proposal makes the bounded, externally observable behavior of the simulated assistant the binding object across a human wizard and later automation. It neither asserts that passing implementations reason equivalently nor that conformance establishes usability, technical feasibility, scheduling quality, or participant acceptance.","authority_safety":{"decision_authority":"The research lead and prototype-system owner may jointly authorize the sandbox contract and operator console; the calendar-service owner controls any external-action integration, and the applicable ethics and privacy authority controls participant-facing use.","authorized_first_step":"Construct the contract, a deterministic fake, and a human-operated sandbox implementation; exercise them only with synthetic availability and a non-networked calendar ledger before proposing any participant study.","excluded_actions":["Connecting the prototype to real calendars or messaging systems","Collecting real participant availability or contact data","Conducting concealed human simulation without the required consent, disclosure, debriefing, and ethics review","Allowing the operator to use undeclared personal or organizational information","Treating contract passage as evidence of usability, accuracy, fairness, security, or production readiness","Routing production requests to an unvalidated implementation"],"halt_rollback":"Stop if any implementation can write outside the sandbox, if the operator needs undeclared information to satisfy the contract, if a seeded pre-confirmation booking passes the oracle, or if the boundary prevents required participant protections. Disable the operator console, destroy synthetic ledger contents, and revert to a noninteractive prototype while the behavioral envelope is revised or rejected."},"negative_tests":{"strongest_counterevidence":"The strongest counterevidence would show that the experience being evaluated depends essentially on situated human judgment, social inference, or backstage information that cannot be represented in a bounded contract without either removing the useful behavior or specifying the operator's internal process.","problem_falsifier":"The inferred problem is falsified if the existing operator is already structurally confined to a documented behavioral interface, uses only inputs available to the planned system, and produces the same contract-level states and side effects as independently implemented candidates across adversarial synthetic scenarios.","intervention_falsifier":"The intervention is falsified if independently built implementations pass the suite yet diverge on a declared clarification, confirmation, cancellation, retry, or calendar-side-effect obligation, or if distinguishing acceptable behavior requires exposing operator notes, reasoning steps, exact prose, or implementation-specific identifiers.","risks":["A contract may overconstrain natural conversation and make the prototype unrepresentative of an acceptable assistant.","A permissive response-act vocabulary may allow meaningfully different experiences to pass.","Exact wording or timing may affect user interpretation even when semantic response acts match.","The deterministic fake or human wizard may share assumptions embedded in the contract, leaving common errors undetected.","Researchers may treat a bounded behavioral envelope as evidence that automation is buildable.","Hidden human operation can create consent, privacy, and expectation risks if participant protections are inadequate.","An automated implementation may conform on scripted semantics while failing on language understanding before those operations are reached."]},"next_evidence_step":"Run a bounded offline mutation study with synthetic calendars and twenty predefined conversation traces. Write expected abstract states and side effects before implementation; execute the traces against a deterministic fake and a console-constrained human wizard; and seed implementations that use an undeclared constraint, skip clarification, book before confirmation, double-book after retry, and silently select an expired proposal. Continue only if the oracle rejects every seeded violation, the valid implementations agree at the contract level without sharing internals, and leakage review finds no operator-only information required for success.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Proposal 1 contracts live maintenance-report task execution across visual, touch, voice, and assistive representations, with modality adapters preserving user agency and workflow outcomes. Proposal 2 contracts usability-evidence records across redesigns, protecting measurement semantics and collection boundaries. Proposal 3 contracts the identity, semantic target, provenance, and lifecycle of design critiques across changing artifacts. This proposal instead governs whether a hidden human wizard and a later automated interior are substitutable behind one prototype experience. Its protected object is the simulated assistant's behavioral envelope; its central failure is prototype evidence generated by an unreproducible interior; and its causal path restricts operator privileges, tests semantic conversation behavior, and gates wizard-to-automation handoff. It is independently adoptable without cross-modal interfaces, longitudinal telemetry, or persistent design annotations.","revision_record":{"parent_version":null,"progress_targets_addressed":["Initial complete proposal at proposal_index 4","Material differentiation from sealed proposals 1, 2, and 3"],"conceptual_changes":["Established the prototype assistant's behavioral envelope as the abstract component.","Separated semantic response acts and side effects from human or automated reasoning processes.","Made prototype-to-product substitutability a testable condition rather than an inference from surface resemblance."],"operational_changes":["Specified an operator console restricted to contract operations and declared information.","Added a deterministic fake, generated conversation sequences, seeded unsafe implementations, authority boundaries, and rollback conditions.","Restricted first evidence to synthetic availability and a non-networked calendar ledger."],"evidence_changes":["Defined offline comparison of a deterministic fake and console-constrained human wizard.","Added negative controls for undeclared information, missing clarification, premature booking, non-idempotent retry, and expired selection.","Kept prior-art status unsearched."],"claim_changes":["Made no claim of novelty, prevalence, demand, effect size, buildability, usability, or production readiness.","Limited the claim to observable conformance with a declared prototype behavioral envelope."]}}