{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp09_archetype_breadth150_20260804","cell_id":"computability_boundary_mapping__accounting_auditing","arm":"BREADTH_PROBE_ONE_SHOT","candidate_id":"computability_boundary_mapping__accounting_auditing__P1","proposal_index":1,"version":0,"title":"Computability-Bounded Assurance for Client-Defined Posting Automations","problem":"An audit firm proposes a continuous-audit analyzer that must always terminate and correctly decide whether any client-defined posting program can, for any future transaction stream and ledger state, recognize the same economic event more than once. Clients may supply unrestricted scripts with loops, recursion, external calls, and state-dependent posting logic. The analyzer's universal exact guarantee is left implicit even though the requested judgment concerns arbitrary program behavior over unbounded inputs.","actors":["Client accounting-system owner","Client controller","Audit engagement team","Audit-methodology committee","Assurance-tool engineering team","Independent formal-methods reviewer","Engagement partner"],"observable_state":"Some posting programs receive a clean Boolean result, while others exhaust a resource limit or require manual inspection; the interface nevertheless records every timeout or incomplete search as either 'duplicate recognition absent' or 'control failed.' The record does not distinguish a proved result, bounded testing, unknown, out-of-scope input, or service failure.","consequence":"A false clean result can leave duplicate revenue, expense, asset, or liability recognition outside the planned audit response; a false failure can trigger unnecessary control remediation. Treating repeated timeouts as an engineering-capacity problem can also sustain work toward an unsupported universal analyzer instead of defining an auditable operating boundary.","affected_objective":"Provide defensible assurance about duplicate-recognition controls without overstating what the automated analyzer can decide or allowing unknown results to become clean conclusions.","intervention":"Replace the universal Boolean analyzer specification with a versioned computability-boundary contract. Formally define the duplicate-recognition decision problem, finite encodings, permitted computation model, quantifiers, and required soundness, completeness, and termination. Seek a constructive total procedure and an impossibility reduction in parallel. Route programs admitted by an enforceable terminating posting-language fragment to a total analyzer; route other programs to bounded evidence collection that returns 'confirmed duplicate,' 'no duplicate within declared bound,' 'unknown,' 'out of supported fragment,' or 'system failure.' Require engagement-partner disposition of unknown and out-of-fragment cases, and reclassify whenever the posting language, external-call capability, state model, or guarantee changes.","structural_mapping":[{"archetype_element":"Problem-Class Specification","domain_realization":"The class consists of client-defined posting programs plus transaction streams and ledger states; the decision question is whether two postings attributable to one economic-event identity can occur on any permitted execution."},{"archetype_element":"Instance Representation Contract","domain_realization":"Programs, event identifiers, ledger states, posting outputs, and external-call summaries receive finite, versioned encodings with an explicit rule for when two postings represent the same economic event."},{"archetype_element":"Computation Model Contract","domain_realization":"The contract states whether scripts may use unrestricted loops, recursion, mutable state, nondeterminism, external services, or human responses, rather than treating those capabilities as ordinary closed computation."},{"archetype_element":"Solvability Guarantee Profile","domain_realization":"The requested unrestricted guarantee is separated into soundness, completeness, exactness, universal coverage, and termination; each deployed route publishes only the guarantees it supports."},{"archetype_element":"Quantifier and Scope Map","domain_realization":"The analysis distinguishes one observed ledger run, all inputs up to a declared bound, every execution of a restricted posting program, and every execution of an arbitrary client program."},{"archetype_element":"Computability Status Lattice","domain_realization":"Each program class is recorded as decidable, one-sided recognizable, partial or relative, unsupported by the model, or unresolved; operational timeout is not a status classification."},{"archetype_element":"Decidable Subclass Map","domain_realization":"A restricted posting fragment permits finite event domains, bounded iteration, terminating rule evaluation, modeled external calls, and enforceable event-identity propagation so exhaustive or model-based analysis can halt."},{"archetype_element":"Unknown and Nontermination Policy","domain_realization":"Timeout, cancellation, incomplete search, unsupported external behavior, and analyzer failure remain distinct from both 'duplicate found' and 'duplicate absent.'"},{"archetype_element":"Fallback Solution Contract","domain_realization":"Out-of-fragment programs receive bounded trace testing, certificate review where available, and engagement-partner escalation; these procedures do not inherit the unrestricted total-exact claim."},{"archetype_element":"Recheck Trigger","domain_realization":"Adding recursion, an unmodeled plug-in, unbounded state, a new event-matching rule, or a stronger assurance claim automatically invalidates the prior classification pending review."}],"mechanism_mapping":[{"mechanism_slug":"halting_problem_reduction","role":"Test whether a hypothetical total duplicate-recognition analyzer for unrestricted posting programs could decide whether an encoded program halts by arranging a duplicate posting exactly when the encoded computation halts.","counterfactual_removal":"Without this reduction test, repeated analyzer failure could be treated as insufficient compute, while an impossibility conclusion could rest only on analogy rather than a property-preserving argument."},{"mechanism_slug":"language_fragment_restriction","role":"Admit only posting programs whose bounded control flow, finite modeled state, and external-call contracts preserve a total analysis procedure.","counterfactual_removal":"Without an enforceable fragment, the system would either retain an unsupported universal guarantee or silently narrow inputs while continuing to publish unrestricted assurance language."},{"mechanism_slug":"semi_decision_with_explicit_unknown","role":"Allow witness search to confirm a reachable duplicate posting while preserving unknown when the search does not establish either side under its declared operating bound.","counterfactual_removal":"Without an explicit unknown state, timeout or incomplete exploration would be coerced into a misleading clean or failed control result."},{"mechanism_slug":"fallback_mode_router","role":"Send admitted programs to the total restricted analyzer and send other cases to bounded testing, certificate review, engagement escalation, or abstention according to the boundary record.","counterfactual_removal":"Without routing, weaker evidence paths could be presented as equivalent to a total decision procedure."},{"mechanism_slug":"proof_checking","role":"Require an independent reviewer to check the constructive termination argument, reduction direction, encoding, and public guarantee before the classification changes audit-tool behavior.","counterfactual_removal":"Without proof checking, a reversed reduction or mismatch between the formal event identity and the accounting assertion could create a false boundary claim."}],"causal_chain":["An unrestricted posting language can encode open-ended, state-dependent computation.","The proposed audit question quantifies over every future input and execution while demanding an exact terminating answer.","Testing and timeouts establish behavior only for examined runs and cannot justify the universal guarantee.","A checked constructive proof or impossibility reduction classifies the declared problem relative to its representation and computation model.","An enforceable language restriction creates a smaller class on which total analysis may be proved, while other inputs retain explicit unknown or out-of-scope status.","The router preserves the evidence strength of each path and prevents bounded testing from becoming an unrestricted clean conclusion.","Engagement-partner disposition and recheck triggers connect the formal boundary to audit planning without transferring audit-opinion authority to the analyzer."],"baseline":"The firm applies static checks, sample transaction replay, runtime limits, and specialist review to client posting scripts, then compresses the result into a pass/fail control field. Additional engineering effort is commissioned when analysis times out, but no version-linked record specifies the analyzed program class, computation model, universal quantifier, or meaning of timeout.","nearest_rivals":["Adding compute or longer timeouts to the existing analyzer, which addresses resource limits but not whether the universal total-exact specification is achievable","Property-based testing or larger transaction samples, which can find counterexamples but cannot establish behavior for every execution of an unrestricted program","A heuristic duplicate-entry classifier, which can prioritize suspicious postings but has an error contract rather than a universal semantic guarantee","Manual code review, which can supply engagement evidence but does not itself constitute one uniform terminating decision procedure for the full program class","Requiring a control-owner attestation, which changes the evidence source without classifying the analyzer's computational boundary"],"remaining_contrastive_claim":"The candidate's distinctive claim is that the audit-tool contract should first classify whether exact duplicate-recognition analysis is uniformly decidable for the declared posting-program class, and then couple an enforceable decidable fragment to non-Boolean fallbacks. Its contribution is not better duplicate matching, more testing, or faster search; it is preserving the boundary among proved absence, witnessed duplication, bounded non-observation, unknown, and out-of-scope inputs.","authority_safety":{"decision_authority":"The audit-methodology committee may approve the analyzer's formal scope and output meanings after independent proof review. The engagement partner retains authority over risk assessment, additional procedures, control conclusions, and the audit opinion. Client management retains responsibility for records and controls.","authorized_first_step":"A read-only methods study may formalize one existing posting-rule language and replay previously authorized synthetic or de-identified programs to test scope classification and output semantics; it may not alter ledgers or engagement conclusions.","excluded_actions":["Automatically issuing or modifying an audit opinion","Writing, reversing, or blocking client journal entries","Treating unknown, timeout, out-of-fragment, or system failure as evidence that duplicate recognition is absent","Expanding the supported language or guarantee without reclassification and approval","Using client data outside existing engagement permissions","Allowing the tool vendor or client control owner to self-approve the boundary proof"],"halt_rollback":"Halt the study if event identity cannot be represented consistently, the restricted-class membership check is not enforceable, the proof review identifies an unsound classification, or outputs are consumed as Boolean control conclusions. Roll back by disabling decision labels, retaining the tool only as a clearly labeled evidence aid, and restoring the prior engagement review procedure."},"negative_tests":{"strongest_counterevidence":"The current client-rule language may already prohibit unbounded iteration, recursion, dynamic code, and unmodeled external behavior, with a proven terminating semantics and a constructive total procedure for duplicate-recognition reachability. That would make unrestricted-program computability mapping unnecessary for the actual deployed class, leaving complexity or model fidelity as the relevant issue.","problem_falsifier":"The problem is falsified if the intended assurance claim concerns only a finite, explicitly bounded set of transactions and states, or if no class-wide terminating guarantee is requested and timeout is already preserved as non-conclusive.","intervention_falsifier":"The intervention is falsified if independent review cannot establish either a sound total analyzer for the restricted fragment or a conservative, terminating membership check, or if engagement users continue treating fallback outputs as equivalent to proved absence despite the revised contract.","risks":["The formal event-identity definition may omit accounting substance and make a mathematically correct analyzer irrelevant to the assertion.","A restrictive language may exclude legitimate client processes or push logic into opaque external services.","Unknown and out-of-fragment cases may concentrate manual workload on complex engagements.","A flawed reduction direction or theorem-assumption mismatch may be used to reject feasible bounded automation.","Management may cite the general boundary to avoid improving practical controls that remain testable or analyzable.","Users may interpret 'no duplicate within declared bound' as an unrestricted clean result.","Changes to scripts or external services may escape the recheck trigger and cause guarantee drift."]},"next_evidence_step":"Within one methods sprint, select one version of a posting-rule language and a maximum of 20 synthetic programs spanning bounded loops, recursion, external calls, and event-identity reuse. Produce a problem-class specification, computation-model contract, candidate halting-reduction sketch, restricted-fragment membership rule, and five-state output contract. Have one independent formal-methods reviewer and one audit-methodology reviewer attempt to refute the reduction, the fragment's termination argument, and the accounting fidelity of event identity. End with an unresolved, rejected, or provisionally supported boundary record; do not deploy or infer effect size.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"No other experiment candidates or proposals were inspected. This one-shot candidate instantiates the archetype in assurance over programmable journal-posting behavior, centered on a universal semantic duplicate-recognition claim and an enforceable restricted-language boundary.","revision_record":{"parent_version":null,"progress_targets_addressed":["One-shot generation from the supplied archetype and domain card","Concrete accounting-and-auditing problem with observable failure state","Causal preservation of specification, model, guarantee, classification, restricted subclass, and fallback","Explicit authority, safeguards, falsifiers, risks, and bounded evidence step"],"conceptual_changes":[],"operational_changes":[],"evidence_changes":[],"claim_changes":[]}}