{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp06_four_proposal_generalization60_20260803","cell_id":"representation_independent_interface_contract__sociology_anthropology","arm":"COMPLETE_PROPOSAL_PORTFOLIO","candidate_id":"community_governed_archive_permission_contract","proposal_index":1,"version":0,"title":"Opaque Community-Permission Contract for Multi-Community Ethnographic Archives","problem":"A multi-community ethnographic archive must decide whether a researcher may use a particular recording, image, transcript, or field note for a stated purpose. Each participating community may record and revise permission through different legitimate arrangements, such as a custodial council, designated family representatives, consensus meetings, or a local registry. Archive staff currently translate those arrangements through community-specific spreadsheet fields, color codes, document locations, and liaison knowledge. Downstream access decisions therefore depend on how permission is represented rather than solely on what use is presently authorized. A change in local recordkeeping, personnel, or workflow can consequently alter an archive decision even when the community's substantive authorization has not changed.","actors":["Community-recognized custodial or governing bodies","Community-appointed archive liaisons","Archive access stewards","Researchers requesting material","Archive system maintainers","People represented in or connected to deposited materials"],"observable_state":"For each material-and-proposed-use pair, archive staff can observe a request moving among unrequested, pending, permitted, denied, expired, and revoked states, but the current determination is reconstructed from heterogeneous local fields and informal interpretation. Observable discrepancies include two staff members deriving different access states from the same record, a permission surviving beyond its scope or expiry, a revocation failing to block a later delivery, and archive software reading local deliberative details merely to determine whether access is allowed.","consequence":"Representation-dependent interpretation can release material outside the community-authorized purpose, audience, duration, or conditions; it can also withhold permitted material. It makes changes to local governance records hazardous, exposes private deliberation to archive personnel, and can quietly transfer substantive authority from the recognized community body to whoever controls the archive's translation rules.","affected_objective":"Preserve scope-correct, auditable community authorization for ethnographic-material use while allowing communities to change their internal decision and recordkeeping arrangements without forcing downstream archive workflows to interpret or expose those arrangements.","intervention":"Define a representation-independent Community Permission object for each material-and-use request. Its public operations are submit_request, record_authoritative_decision, query_current_permission, narrow_or_revoke, expire, and record_delivery. The public result reports only the abstract state, authorized scope, conditions needed for archive enforcement, validity interval, decision authority identifier, and stable audit reference. Preconditions, postconditions, allowed transitions, errors, and side-effect limits are specified independently of any community's internal process. Core laws include: no permitted state exists without a decision from the recognized authority for that scope; permission never exceeds the recorded decision; a failed operation leaves state unchanged; querying does not mutate permission; narrowing or revocation cannot widen access; expiry blocks future delivery; and recording a delivery cannot retroactively change the authorization under which it occurred. Council membership, votes, kin relations, deliberative text, meeting sequence, local labels, and storage layout remain hidden. Each community-approved adapter maps its valid internal record to the abstract state, and both new adapters and replacements for an existing adapter must pass the same synthetic black-box transition suite before the archive may rely on them. Passing establishes behavioral conformance only; it does not establish that an authority is legitimate or that a decision is ethically sufficient.","structural_mapping":[{"archetype_element":"Abstract component","domain_realization":"The current community authorization governing one specified use of one archived ethnographic material."},{"archetype_element":"Observable operation surface","domain_realization":"Submit, decide, query, narrow or revoke, expire, and record delivery through stable inputs and outputs."},{"archetype_element":"Abstract state model","domain_realization":"Unrequested, pending, permitted with bounded scope and validity, denied, expired, or revoked."},{"archetype_element":"Behavioral laws and invariants","domain_realization":"Only recognized decisions create permission; authorization cannot silently widen; invalid operations preserve prior state; queries are non-mutating; expiry and revocation block future delivery."},{"archetype_element":"Hidden representation","domain_realization":"Community-specific deliberation, roles, records, terminology, meeting practices, and technical storage remain inaccessible to archive clients."},{"archetype_element":"Abstraction function","domain_realization":"A community-approved mapping converts each valid local decision record into exactly one public permission state and enforcement scope."},{"archetype_element":"Conformance oracle","domain_realization":"One black-box suite applies fictional decision and access sequences to every adapter and checks only public states, transitions, errors, and audit effects."},{"archetype_element":"Substitutability rule","domain_realization":"A replacement record system or adapter for the same community is acceptable to the archive workflow only if it preserves the public contract and has community authorization to represent decisions."},{"archetype_element":"Leakage control","domain_realization":"An audit checks whether outputs, error wording, identifiers, ordering, or timing reveal unpromised facts about deliberation or internal governance."},{"archetype_element":"Versioned stewardship","domain_realization":"Community authorities approve semantic changes to decision meaning, while archive maintainers may change internal implementation without such approval only when observable conformance is preserved."}],"mechanism_mapping":[{"mechanism_slug":"abstract_data_type_specification","role":"Defines permission by abstract values and operations, then requires each local representation to satisfy a validity invariant and a community-approved mapping to those values.","counterfactual_removal":"Without the abstract model and mapping, the proposal becomes a collection of field translations and cannot distinguish preserved authorization from superficial format compatibility."},{"mechanism_slug":"design_by_contract_clause","role":"Allocates obligations for every operation, including who may record a decision, what scope must be supplied, what an invalid transition returns, and whether state remains unchanged.","counterfactual_removal":"Without explicit preconditions, postconditions, and error semantics, adapters could share operation names while disagreeing about invalid requests, revocation, expiry, or partial failure."},{"mechanism_slug":"interface_definition_language","role":"Encodes the minimal public operations and result types in a machine-readable schema from which the archive and community-side adapters use the same boundary.","counterfactual_removal":"Without an enforceable surface, archive clients could continue importing community-specific fields even if a prose contract existed."},{"mechanism_slug":"opaque_type_or_module_boundary","role":"Prevents archive clients from inspecting deliberative records and makes the declared permission operations the only routine route to a decision state.","counterfactual_removal":"Without opacity, staff could bypass the contract for convenience, recreating dependencies on local labels, personnel, and private deliberation."},{"mechanism_slug":"black_box_contract_test_suite","role":"Exercises identical synthetic state-transition sequences against each adapter and gates technical acceptance on contract-level observations.","counterfactual_removal":"Without a shared oracle, an adapter could claim compatibility while differing on scope boundaries, failed operations, expiry, or revocation."},{"mechanism_slug":"representation_leakage_probe","role":"Examines public outputs and side channels for unpromised exposure of votes, kinship roles, deliberation order, local identifiers, or storage conventions.","counterfactual_removal":"Without the probe, technically hidden records could still become inferable and their observable artifacts could form an unofficial interface."},{"mechanism_slug":"abstraction_barrier_code_review","role":"Requires reviewers to classify every new archive dependency as either a promised permission behavior or an impermissible reach into community-specific representation.","counterfactual_removal":"Without human review, useful but unintended observables could be normalized as dependencies before mechanical controls recognize them."},{"mechanism_slug":"semantic_versioning_and_deprecation_gate","role":"Separates implementation changes from changes to public permission meaning and stages any behavioral break through authority review and migration.","counterfactual_removal":"Without change governance, a schema-compatible update could alter authorization semantics or strand clients without an explicit decision about compatibility."}],"causal_chain":["Archive clients are restricted to a small permission interface rather than community-specific records.","Each community-approved adapter maps its own valid decision representation to the same abstract states, scopes, transitions, and errors.","Contract clauses and opacity prevent clients from treating deliberative details or storage conventions as permission rules.","A common black-box suite rejects adapters that do not preserve the specified observable behavior across operation sequences.","Leakage review identifies observable but unpromised details before archive clients rely on them.","Local recordkeeping or adapter implementations can then change without changing archive access behavior when conformance and community authorization are preserved.","Reduced dependence on representation lowers the chance that a technical or clerical change silently widens, narrows, or exposes a community decision."],"baseline":"Archive staff use community-specific forms, spreadsheets, correspondence, and liaison explanations. Access logic contains bespoke field mappings and manual exceptions; tests, where present, reproduce current examples rather than checking shared behavioral laws. Any change to a community's records requires staff to inspect the new representation and revise downstream rules.","nearest_rivals":["Adopt one universal permission form and taxonomy for every participating community.","Keep heterogeneous records but assign a central archive liaison to interpret every request manually.","Build a separate field-to-field integration for each community without a shared state-transition contract.","Let a central ethics or archive committee make final access decisions from deposited consent documents."],"remaining_contrastive_claim":"Unlike a universal form, the intervention does not require communities to adopt one internal representation; unlike permanent manual interpretation, it makes the archive-visible obligations explicit and testable; unlike bespoke field integrations, it governs sequences, invariants, errors, and substitution rather than syntax alone; and unlike centralized review, it leaves substantive permission with the recognized community authority. The claim is structural only: if the public contract is adequate and each mapping is authorized and conforming, archive clients need not depend on internal governance representation.","authority_safety":{"decision_authority":"The community-recognized custodial or governing body retains authority over who may decide, what uses may be permitted, what information may be exposed, and whether an adapter accurately represents its decisions. The archive access steward may enforce the published result and reject nonconforming technical implementations but may not create, broaden, reinterpret, or substitute for community permission.","authorized_first_step":"With explicit participation approval from the relevant community representatives, an archive steward may convene a tabletop exercise using fictional materials and synthetic decision records to draft and test the abstract operations and mappings. No real access determination is changed during this step.","excluded_actions":["Inferring a community's authority structure from archive records","Treating technical conformance as proof of legitimate authority or ethical adequacy","Exposing votes, kinship relations, deliberative text, or identities not required for enforcement","Migrating real permission records without community approval and validation","Automatically broadening ambiguous, missing, expired, or conflicting permission","Using a conforming adapter to override a community decision","Running a live canary on restricted ethnographic material during the first evidence step"],"halt_rollback":"Stop the exercise if community representatives judge that the abstract states erase a decision distinction, misidentify authority, or require disclosure of protected governance information. Discard the synthetic adapter, retain the existing access process unchanged, and return disputed clauses to the recognized authority; any later pilot must support immediate reversion to the prior read-only decision path."},"negative_tests":{"strongest_counterevidence":"The strongest counterevidence would be that observed access failures persist even when permission state is already derived consistently and independently of record representation, while the actual disagreements concern unresolved authority, conflicting substantive mandates, or ethical judgments that no interface can settle.","problem_falsifier":"A bounded audit would falsify the proposed problem for the examined setting if independent archive staff, using only the existing approved public information, reconstruct identical permission states and transition outcomes across record-system or personnel changes, and no examined discrepancy depends on internal fields, labels, or undocumented conventions.","intervention_falsifier":"The intervention fails its first test if two independently constructed adapters can pass the stated suite yet yield different contract-relevant access outcomes on held-out synthetic sequences, if a valid community decision cannot map to exactly one abstract state without losing an authority-recognized distinction, or if ordinary archive work still requires inspecting hidden records.","risks":["The abstract state model may flatten culturally significant distinctions in authority, temporality, conditionality, or collective deliberation.","A technically conforming adapter may lend false legitimacy to an unauthorized decision process.","Opaque deliberation can protect privacy while also making dissent or coercion harder for archive staff to detect.","Error text, identifiers, response timing, or audit metadata may leak protected governance information.","An incomplete conformance suite may certify behavior that violates an untested clause.","Conservative handling of ambiguity may withhold material that was actually permitted.","Contract drafting and adapter maintenance may impose uncompensated work on community representatives.","Version governance may privilege archive administrators unless community approval rights are explicit and usable."]},"next_evidence_step":"Conduct one non-live, two-week tabletop with one archive steward and representatives authorized by one participating community. Use 12 fictional request sequences spanning grant, denial, narrowed scope, invalid authority, duplicate decision, expiry, revocation before delivery, revocation after recorded delivery, conflicting updates, malformed input, query repetition, and adapter replacement. Before implementation, write the state model, clauses, permitted observables, and stop conditions. Independently implement a spreadsheet-shaped adapter and a ledger-shaped adapter over synthetic records; run the same black-box suite and a leakage review against both. Record unmappable distinctions, divergent outcomes, required hidden-data access, and clauses rejected by community representatives. This step supplies evidence about problem fit and contract adequacy only and does not authorize use on real records.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Not assessed against prior candidates because the task is sealed and prior experiment candidates are forbidden context. This proposal is derived only from the supplied archetype, mechanisms, and sociology-and-anthropology domain card.","revision_record":{"parent_version":null,"progress_targets_addressed":["Initial complete proposal","Concrete domain problem","Representation-independent causal structure","Authority-bounded first evidence"],"conceptual_changes":["Initial formulation of community permission as an abstract behavioral object without standardizing internal governance."],"operational_changes":["Specified operations, states, invariants, mappings, conformance gate, leakage audit, rollback, and a synthetic tabletop."],"evidence_changes":["Set prior art to unsearched and limited first evidence to a non-live synthetic exercise."],"claim_changes":["Restricted the claim to conditional structural decoupling; made no claim of novelty, prevalence, demand, or effect size."]}}