{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp12_substrate_denial72_20260805","cell_id":"authority_legitimacy_and_consent_foundations__computer_science","arm":"CONSTRAINED_MAX","candidate_id":"authority_legitimacy_and_consent_foundations__computer_science__CONSTRAINED_MAX","decision":"PROPOSAL","abstention_reason":null,"proposal":{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp12_substrate_denial72_20260805","cell_id":"authority_legitimacy_and_consent_foundations__computer_science","arm":"CONSTRAINED_MAX","candidate_id":"authority_legitimacy_and_consent_foundations__computer_science__CONSTRAINED_MAX","proposal_index":1,"version":0,"title":"Distributed Custodian-Key Interlock for Shared-Chassis Firmware Writes","problem":"Consider a four-project FPGA-development chassis in which a service connector can reach either one project zone or a controller whose reset and firmware state affect all four zones. A maintainer's administrator credential, job title, or single rack key does not make each electrically affected project's assent a necessary condition of a state-changing service operation. The concrete problem is an electrical write, reset, or programming waveform reaching a project zone outside the scope physically granted by its custodian.","actors":["The hardware maintainer delegated to perform electrically safe service","Four project custodians whose boards or workloads can be affected","An independent electrical-safety custodian with veto but no unilateral enable power","The shared controller, service bus, and four addressable FPGA zones as material systems"],"observable_state":"Key-switch positions, selected service port, relay-contact state, service-line voltage and waveforms, and each target's latched state are directly observable. A scope breach has a material signature: a downstream state-changing waveform or target-state transition occurs while the maintainer key, a required affected-zone key, or the matching scope selection is absent.","consequence":"An unilateral or misscoped service operation can alter configuration, reset shared hardware, interrupt another project's work, or leave a target requiring recovery. It also denies an affected custodian a materially effective way to withhold or revoke the maintainer's authority for that operation.","affected_objective":"Make continuity of every mapped state-changing service conductor physically contingent on a bounded maintainer mandate, contemporaneous grants from every electrically affected project, and a compatible electrical fixture, while retaining an independent fail-open veto.","intervention":"Place a non-networked electromechanical interposer between the external programmer and the chassis service headers. A mechanically selected per-zone port is wired through the maintainer's normally-open key contact and that zone custodian's normally-open contact; the shared-controller port is wired through the maintainer contact and all four custodian contacts in series. The selector physically exposes only the chosen port. A passive resistor-coded fixture plug and analog voltage-window circuit test pinout and voltage compatibility without a processor. Only the resulting series current can energize force-guided relays that connect every traced state-changing conductor, including programming voltage, write or clock lines, and reset. Missing or removed keys, an incompatible fixture, loss of panel power, or the safety custodian's hardwired cutout de-energizes the coil and spring-opens those conductors. Directly driven mechanical flags may show the selected scope and contact state, but they do not control enforcement.","structural_mapping":[{"archetype_element":"Authority Mandate","domain_realization":"The maintainer's distinct physical key closes one indispensable series contact but cannot select a target or energize the panel alone. It represents a bounded service delegation rather than general control."},{"archetype_element":"Authority Boundary","domain_realization":"Separate fixed-wiring paths for each project zone and the shared controller, combined with a single-port mechanical selector, delimit which conductors and affected parties belong to the attempted operation."},{"archetype_element":"Legitimacy Basis Map","domain_realization":"The visible series circuit makes three non-substitutable bases concrete: delegated maintainer presence, grants from every electrically exposed zone, and fixture-to-target electrical compatibility."},{"archetype_element":"Affected Party Recognition","domain_realization":"A predeployment conductor trace assigns every zone reachable through a service scope to a required key contact. The shared path includes all four contacts; a per-zone path includes only its affected custodian."},{"archetype_element":"Consent Scope","domain_realization":"Each custodian key works only in its project station, must remain inserted for the selected scope, and can be removed to break continuity. Silence, an absent key, or a key for another zone cannot close the circuit."},{"archetype_element":"Competence Evidence","domain_realization":"A passive fixture code and analog bounds check establish only that the service tool is electrically compatible with the selected target. They do not pretend to prove the maintainer's judgment or authorize decisions outside electrical service."},{"archetype_element":"Procedural Fairness","domain_realization":"Every custodian mapped to the selected electrical blast radius occupies an equal series position. There is no software override or privileged bypass that can substitute one party's contact for another."},{"archetype_element":"Accountability and Review Path","domain_realization":"Any participating custodian can withdraw its key, and an independent safety cutout can halt current without being able to initiate it. A directly coupled mechanical cycle counter can preserve a limited actuation trace, but the veto works without that record."},{"archetype_element":"Public Reason Record and Legitimacy Signal","domain_realization":"An engraved conductor-to-zone plate and relay-driven mechanical flag expose the scope and actual energized state. These are intelligibility aids; the causal boundary resides in wiring and open contacts."},{"archetype_element":"Conflict-of-Interest Guardrail","domain_realization":"Enable and veto powers are physically separated: the maintainer cannot close custodian contacts, and the safety custodian can interrupt but cannot complete the enabling series chain."}],"mechanism_mapping":[{"mechanism_slug":"consent_capture_and_revocation_workflow","role":"Implemented as project-specific removable key contacts whose continuing physical closure is necessary for the selected write path.","counterfactual_removal":"Removing the custodian contacts lets the maintainer energize a path without an affected party's physical grant, eliminating the proposal's central consent mapping."},{"mechanism_slug":"decision_rights_matrix","role":"Implemented as fixed series wiring that associates each mechanically selectable service scope with exactly the maintainer and affected-custodian contacts required for that scope.","counterfactual_removal":"Replacing the topology with one common enable contact collapses scope and representation into single-holder access control."},{"mechanism_slug":"credentialing_and_peer_review_process","role":"Narrowly realized by the distinct maintainer key and independently acting passive fixture-compatibility circuit; together they test delegated presence and electrical domain fit, not general expertise.","counterfactual_removal":"Custodian grants would remain, but any fixture or nondelegated holder could complete the technical side of the conjunction, so the full authority foundation would fail."},{"mechanism_slug":"appeal_or_review_forum","role":"Realized prospectively as a material veto: key withdrawal or the independent cutout changes the electrical outcome instead of merely recording an objection.","counterfactual_removal":"Initial joint enablement could still occur, but affected parties would lose the physical correction and revocation path during an operation."},{"mechanism_slug":"public_reason_giving_protocol","role":"Represented only as a supporting engraved scope map and directly coupled mechanical state flag.","counterfactual_removal":"Removing the plate and flag reduces intelligibility but leaves the normally-open electrical barrier intact, demonstrating that reporting is not the operative intervention."}],"causal_chain":["Trace every state-changing route from each service connector to the controller and project zones; stop if the electrical blast radius cannot be bounded.","Fabricate the scope-specific series circuits and place normally-open relay contacts across every mapped state-changing conductor.","The mechanical selector exposes one port and thereby selects a fixed, nonprogrammable set of required key contacts.","The maintainer and every custodian mapped to that scope must physically close their distinct contacts.","The passive fixture code and analog window circuit must also be within the selected target's electrical bounds.","Only that conjunction supplies coil current, causing force-guided contacts to connect the selected service lines and no other zone.","Absence or removal of any required key, unsafe voltage, power loss, or safety veto removes coil energy and spring-opens the signal path without consulting software or a person downstream.","Consequently, arbitrary programmer commands cannot produce a mapped downstream state transition unless the bounded physical conjunction is present; whether key holders are legitimate representatives remains a separately falsifiable social boundary condition."],"baseline":"The primary baseline is a direct service cable controlled by a software login or maintainer procedure. A second baseline is one keyed maintenance switch held by a single operator. Both comparators can be tested on the same dummy chassis; they are conceptual alternatives, not claims about current practice or prior art.","nearest_rivals":["Independent per-board hardware write-protect jumpers or complete cable removal, which may provide simpler physical isolation but require access to each board and may not jointly gate a shared controller.","A single-custodian keyed switch or padlock, which physically blocks outsiders but concentrates all enabling authority in one holder.","A software multi-approval gate around the programming utility, which can express rich scopes but is absent at an exposed electrical header and loses its effect when software enforcement is removed.","A cryptographic firmware-acceptance mechanism, which can bind an image to an approved signer but does not by itself require contemporaneous assent from every party affected by a shared reset or controller write.","A fixed two-holder interlock, which prevents one-person action but may fail to represent the actual affected set when service scope changes."],"remaining_contrastive_claim":"Conditional on a complete conductor map and genuinely separate custody of the physical keys, fixed series topology can make every mapped firmware-write path require the maintainer, the exact affected set, and a compatible fixture. Unlike a software approval gate or single-holder lock, no command or sole credential can bridge an open contact. This claim does not establish informed or voluntary consent, perceived legitimacy, superiority to complete disconnection, novelty, prevalence, demand, or effect size.","authority_safety":{"decision_authority":"Each project custodian decides whether to close its project's grant for an operation affecting that zone. The maintainer controls execution only after all required grants exist. The safety custodian may veto but may not authorize alone. The prototype builder has no authority to redefine the affected-party set without a new conductor trace and stakeholder decision.","authorized_first_step":"Build and test one isolated low-voltage interposer against four latching dummy targets or recoverable decommissioned boards. It may not be attached to an operational rack, network, live workload, or irreplaceable firmware target.","excluded_actions":["No production or occupied-rack installation during the first evidence step","No hidden bypass, remote relay control, programmable controller, or software approval dependency","No consolidation of all project keys under the maintainer's custody","No claim that key insertion proves informed consent, voluntariness, representation, or trust","No live write whose interruption could irreversibly damage equipment or data","No deployment while an alternate state-changing header or conductor remains unmapped"],"halt_rollback":"Removal of any required key or opening the safety cutout de-energizes the relay; test power is then isolated and the interposer is unplugged. The original unmodified test harness is retained for restoration. Only sacrificial or independently recoverable targets are used because revocation during a write can leave a partial image."},"negative_tests":{"strongest_counterevidence":"The strongest counterevidence would be either a state change delivered through an ungated conductor with a required key absent or a demonstration that complete per-board disconnection supplies the same scoped joint control with less failure surface. Evidence that one person can routinely obtain or operate every nominally separate key would also defeat the consent mapping even if the relays work.","problem_falsifier":"Electrical tracing shows that every service port is already physically isolated to one project's board and that no controller write, reset, power, or debug path can affect another project. In that case there is no shared binding-authority problem for this intervention.","intervention_falsifier":"The intervention is falsified if any denied key combination, wrong selector position, incompatible fixture, key removal, or panel-power loss permits a downstream target transition; if an authorized selection reaches an unselected zone; or if blocking depends on software, a report, or operator compliance rather than open contacts.","risks":["An overlooked alternate header, shared ground path, parasitic coupling, or rewiring change could bypass the gate.","Relay welding, key duplication, selector wear, or deliberate bridging could create false enablement.","Key possession can be coerced, transferred, or misrepresented; the panel cannot establish informed or voluntary consent.","The device can create legitimacy theater if custodians do not actually represent everyone bearing consequences.","A missing key or veto can delay emergency maintenance or become a denial-of-service instrument.","Opening the circuit during programming can leave partial firmware or an unrecoverable target unless recovery is independently designed.","Analog compatibility checks can drift or reject a safe fixture, and they do not demonstrate human competence.","Relay contacts and added interconnect may degrade high-speed service signals or introduce unsafe voltage behavior.","A fixed affected-party map can become false after chassis, cabling, or project ownership changes."]},"next_evidence_step":"On one isolated four-zone latch emulator, first trace and label every state-changing conductor; terminate the study if the map is incomplete. Build one five-key, five-scope interposer using fixed wiring, normally-open force-guided relays, a passive fixture code, and an analog bounds circuit, with no processor, network, logging system, or software control. Use a signal generator and direct oscilloscope or latch observation to enumerate all 32 maintainer-plus-custodian key combinations at each selector position, then repeat representative authorized and denied cases with an incompatible fixture, panel-power loss, safety veto, and key removal during a signal. The predeclared technical criterion is that only the target authorized by the exact required conjunction changes state, while every denied condition leaves all protected targets unchanged and returns contacts open. Compare the same stimuli through a direct cable and a single-key gate. This step tests material causality only, not social legitimacy.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Not assessed because runtime isolation forbids inspection of other proposals. Internally, this candidate is distinguished by a distributed electromechanical write-path conjunction rather than a software governance, reporting, or incentive mechanism.","revision_record":{"parent_version":null,"progress_targets_addressed":["Satisfied the binding substrate counterfactual with direct interruption of electrical conductors","Preserved mandate, scope, affected-party grant, competence-boundary, fairness, and revocation relationships as causal elements","Separated the testable physical claim from untested claims about informed consent or legitimacy","Specified bounded baselines, rivals, falsifiers, and a software-free first experiment"],"conceptual_changes":["Initial version: narrowed the archetype to authority over state-changing service operations on a shared hardware chassis and treated legitimate grant as a conjunctive physical prerequisite rather than a trust signal."],"operational_changes":["Initial version: specified fixed series key topology, mechanical scope selection, force-guided fail-open relays, passive fixture coding, analog compatibility gating, and an independent veto-only cutout."],"evidence_changes":["Initial version: defined a finite 32-combination-per-scope bench matrix plus wrong-scope, incompatible-fixture, power-loss, veto, and mid-signal-removal tests."],"claim_changes":["Initial version: claims only prevention of mapped unilateral electrical state changes under stated boundary conditions and explicitly withholds novelty, prevalence, demand, effect-size, informed-consent, and perceived-legitimacy claims."]},"substrate_contract":{"primary_allowed_process":"PHYSICAL_MATERIAL","counterfactual_independence":"Remove every program, algorithm, database, network, dashboard, log, instruction, approval workflow, incentive, and after-the-fact review. With the removable key contacts physically open, the analog safety contact open, or panel power absent, no coil current flows and spring-loaded relay contacts separate the state-changing conductors. Arbitrary programmer commands therefore remain upstream of an air gap. The keys' physical distribution and the fixed wiring are intervention components, not authorization records. Stripping their labels would remove the social interpretation but not the material anti-unilateral effect; physically giving one operator all keys would instead remove a core intervention component and invalidate advancement.","forbidden_channel_audit":"The design contains no model, programmable controller, database, recommender, information router, or software control loop. The analog circuit directly gates relay energy rather than sensing for downstream analytics. Mechanical flags and the cycle counter are optional visibility aids; deleting them does not alter blocking. Human key insertion is an upstream physical input, not a report or procedural-enforcement step. Governance is limited to interpreting who should hold each already separate key; the claimed causal outcome is the contact-level prevention of an electrical state change, and no broader legitimacy outcome is asserted without separate evidence."}}}