{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp09_archetype_breadth150_20260804","cell_id":"backpressure__computer_science","arm":"BREADTH_PROBE_ONE_SHOT","candidate_id":"backpressure__computer_science__P1","proposal_index":1,"version":0,"title":"Validation-Credit Backpressure for Automated Repository Change Producers","problem":"Dependency-update bots, code generators, and other automated change producers can open or refresh repository changes faster than continuous-integration runners and reviewers can validate them. Base-branch movement may also stale completed validations, causing renewed work while producers continue creating changes independently of downstream capacity.","actors":["Repository maintainers who govern automation and merge policy","Automated dependency-update and code-generation producers","Continuous-integration scheduler and runner fleet","Human reviewers","Owners of critical security or operational changes"],"observable_state":"The repository control plane can observe active automated pull requests, queued and running validation jobs, estimated validation cost, queue age, stale validations awaiting rerun, reviewer-ready backlog, and capacity reserved for critical changes. Pressure is present when the bounded active-work allowance is nearly exhausted, queue age or staleness crosses a declared threshold, or reserved critical capacity is being consumed by noncritical automation.","consequence":"Validation debt accumulates, repeated or stale jobs consume constrained capacity, critical changes wait behind routine automated work, and maintainers cannot distinguish cleanly deferred changes from work silently stranded in queues.","affected_objective":"Keep automated-change validation accumulation bounded while preserving recoverable CI operation, explicit handling of admitted work, and a viable validation path for critical changes.","intervention":"Create a repository-level validation-credit protocol. The downstream validation control plane periodically issues a finite number of credits representing changes that CI and reviewers can safely absorb. Automated producers may open or materially refresh a pull request only after obtaining a credit; without one, they retain a locally identified candidate and report it as deferred rather than creating downstream work. Credits contract as queued work, validation latency, or stale-run debt rises and expand gradually after pressure clears. Separate reserved credits protect declared critical security and operational classes, a hard cap bounds active automated changes, and every granted credit expires into an explicit processed, deferred, or rejected state.","structural_mapping":[{"archetype_element":"Upstream producers","domain_realization":"Dependency-update bots, code generators, and other agents capable of creating or refreshing repository changes."},{"archetype_element":"Flow","domain_realization":"Automated change proposals and their induced CI jobs, reruns, review obligations, and merge-base refreshes."},{"archetype_element":"Downstream constrained receiver","domain_realization":"The combined CI-validation and human-review path, whose absorption capacity varies with runner availability, job cost, reviewer attention, and competing critical work."},{"archetype_element":"Observable downstream pressure","domain_realization":"Active-work count, queued validation cost, queue age, stale-validation debt, and consumption of capacity reserved for critical changes."},{"archetype_element":"Upstream signaling path","domain_realization":"Validation credits and explicit pressure states returned by the repository control plane to each registered automated producer."},{"archetype_element":"Controllable upstream behavior","domain_realization":"Bots defer discovery publication, coalesce compatible updates, avoid refreshing existing proposals, or resume issuance according to available credits."},{"archetype_element":"Bounded accumulation invariant","domain_realization":"A hard limit on active automated changes and their in-flight validation work, with unadmitted candidates represented explicitly outside the CI queue."},{"archetype_element":"Critical-flow preservation","domain_realization":"Reserved credits and an auditable classification rule keep a validation path available for declared security and operational changes."},{"archetype_element":"Recoverability","domain_realization":"Credits return gradually through a recovery probe after pressure falls, without reconstructing the state of admitted or deferred candidates."}],"mechanism_mapping":[{"mechanism_slug":"reactive_streams_demand_signaling","role":"The downstream control plane advertises discrete demand as validation credits, so automated producers emit changes only when downstream capacity requests them.","counterfactual_removal":"Without downstream-issued credits, producers remain insulated from current validation capacity; any slowdown becomes static policy, manual coordination, or post-admission rejection rather than backpressure."},{"mechanism_slug":"bounded_producer_consumer_queues","role":"A hard active-work cap prevents the pull-request and CI queues from absorbing unlimited automated output; producers retain excess candidates in an explicit deferred state.","counterfactual_removal":"Without the bound, credits could coexist with a growing hidden queue, allowing overload to be displaced rather than controlled."},{"mechanism_slug":"priority_class_rules","role":"Reserved credits admit declared critical security and operational changes while routine automation is slowed.","counterfactual_removal":"Without class rules, routine work may consume all credits or low-priority work may be starved through informal exceptions, violating critical-flow and fairness safeguards."},{"mechanism_slug":"hysteresis_band_and_recovery_probe","role":"Different pressure-entry and pressure-exit thresholds, followed by gradual credit restoration, prevent rapid stop-start oscillation.","counterfactual_removal":"Without hysteresis and probing, small metric fluctuations can cause bots to resume together, recreate a burst, and repeatedly saturate validation."}],"causal_chain":["Automated producers generate or refresh changes independently of the variable service capacity of CI and reviewers.","When offered validation work exceeds service capacity, queued jobs, stale validations, and unresolved review obligations accumulate.","The validation control plane converts current downstream headroom and backlog into a bounded credit supply and communicates it upstream.","Producers lacking credits defer or coalesce candidates before creating pull requests or validation jobs, reducing offered work at its sources.","The active-work cap keeps admitted accumulation bounded, while reserved credits preserve critical validation flow.","As the admitted backlog drains, hysteretic recovery probes restore credits gradually, allowing flow to resume without a synchronized burst."],"baseline":"Automated producers run on independent schedules and open or refresh changes whenever their local rules fire. CI may queue the resulting jobs, maintainers may manually pause bots, and repository-wide concurrency or rate limits may apply, but current downstream validation pressure does not directly govern each producer's right to emit new work.","nearest_rivals":["Static rate limiting: caps bot activity by time or count regardless of current CI and reviewer pressure.","Merge queues: order already-created changes for integration but do not necessarily regulate upstream creation or refresh of automated proposals.","Unlimited or enlarged CI buffering: stores excess jobs without changing producer behavior and can conceal validation debt.","Circuit breaking: stops an automation path after a protective threshold rather than continuously expressing downstream demand through credits.","Load shedding: cancels or rejects work after it arrives instead of deferring production at the source.","Manual bot pausing: conveys pressure through human intervention but lacks a timely, systematic downstream-capacity signal and controlled reentry."],"remaining_contrastive_claim":"The candidate's distinguishing causal commitment is that permission for automated producers to create or refresh validation work is dynamically issued by the downstream validation path according to its observable headroom. The active-work cap, priority reservations, and recovery probe support that feedback loop; none alone constitutes the intervention.","authority_safety":{"decision_authority":"The repository owner or designated maintainer who already controls bot installation, branch protection, and CI admission policy sets the pilot policy; the CI operator supplies capacity telemetry but does not obtain merge authority.","authorized_first_step":"Run a read-only trace replay for one consenting repository to calculate hypothetical credit issuance and producer deferrals without changing bot, CI, review, or merge behavior.","excluded_actions":["Automatically merge, approve, or close pull requests","Bypass branch protection or required validation","Suppress or reclassify mandatory security updates without maintainer approval","Cancel existing user-authored CI jobs","Change organization-wide runner allocation","Enable enforcement against live producers during the first evidence step"],"halt_rollback":"Stop the replay if required event classes cannot be reconstructed, identity or classification data would exceed approved access, or critical-work labels cannot be interpreted consistently. Because the first step is read-only, rollback consists of deleting the derived replay dataset and configuration according to the repository owner's retention instruction; no production state is altered."},"negative_tests":{"strongest_counterevidence":"During measured pressure intervals, automated changes contribute little to queued validation cost or stale-run debt; runner outages, human-authored changes, or a single pathological job explain the constrained state instead.","problem_falsifier":"The problem hypothesis is falsified for the tested repository if no interval in the bounded trace shows automated offered work exceeding the contemporaneous service capacity of the validation path, or if automated-work accumulation remains within the declared bound without producer response.","intervention_falsifier":"The intervention hypothesis is falsified for the replay if a credit controller using timely downstream signals cannot reduce producer admissions before the hard active-work bound is crossed, cannot preserve the reserved critical path, or merely moves unbounded accumulation into an unobserved producer-side backlog.","risks":["Delayed or noisy pressure signals could throttle after overload has already accumulated.","Bots could resume together and oscillate around a threshold.","Deferred candidates could become a hidden, unbounded queue outside the repository.","Routine dependency maintenance could starve if critical classifications continuously consume reserved capacity.","Misclassification could create priority inversion or allow producers to game reserved credits.","Conservative credit sizing could leave CI or reviewer capacity idle.","A repository-local controller could push update debt into dependent repositories or later create a synchronized release burst.","Estimated validation cost may misrepresent heterogeneous jobs and route pressure to the wrong producer."]},"next_evidence_step":"Using fourteen consecutive days of timestamped bot, pull-request, and CI events from one consenting repository, replay a predeclared controller with an active-work cap, critical reserve, two-threshold hysteresis band, and one-credit recovery probes. Record whether pressure signals precede crossings of the cap, which producer actions would be deferred, whether every admitted item reaches an explicit terminal or deferred state, whether critical credits remain available, maximum visible producer-side deferral, and the frequency of throttle-state reversals. The replay is descriptive and counterfactual only; it authorizes no live enforcement or effect-size claim.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Not assessed against other proposals because runtime isolation forbids inspecting them; this candidate was derived solely from the supplied backpressure archetype and computer-science domain card.","revision_record":{"parent_version":null,"progress_targets_addressed":["One-shot breadth probe completed from the supplied archetype and domain record"],"conceptual_changes":[],"operational_changes":[],"evidence_changes":[],"claim_changes":[]}}