{"schema_version":1,"experiment_id":"eoa_inverse_innovation_exp12_substrate_denial72_20260805","cell_id":"synchronized_release_dampening__computer_science","arm":"ORDINARY_MAX","candidate_id":"synchronized_release_dampening__computer_science__ORDINARY_MAX","proposal_index":1,"version":0,"title":"Recovery-Leased Dependency Fetching for CI Build Backlogs","problem":"When a CI dependency registry or internal artifact mirror recovers from an outage, one readiness transition can make every blocked build runnable at once. Runners with similar retry behavior then issue overlapping manifest and package-blob requests within a narrow window. Although the mirror may be able to serve the backlog when spread over time, its recovering connection pool, metadata store, cache-fill workers, or upstream link cannot serve the synchronized wave, so the recovery signal can initiate another overload-and-retry cycle.","actors":["CI platform operator","Artifact mirror or package-registry operator","Build scheduler","Ephemeral CI runners","Project teams with blocked builds","Security or release owners responsible for urgent builds"],"observable_state":"A qualifying episode has a timestamped mirror-unavailable-to-ready transition, an enumerable population of builds blocked on dependency retrieval, a narrow post-transition cluster of first fetch attempts, elevated mirror connection or queue occupancy, and repeated requests for some identical immutable dependency digests. Pre-incident or time-averaged demand remains within the mirror's service envelope, while timeouts, errors, or readiness flapping concentrate near the shared recovery transition.","consequence":"The artifact service can return to overload, runners can generate another synchronized retry wave, and the build backlog can drain unpredictably. This delays ordinary builds and may also obstruct urgent security or release work even though the same dependency work could have been served sequentially or shared across runners.","affected_objective":"Restore CI service predictably while keeping admitted dependency work within the recovering mirror's service envelope, avoiding duplicate upstream transfers, and preserving bounded waiting, tenant fairness, artifact integrity, and an explicit path for urgent builds.","intervention":"Separate the mirror's healthy notification from permission for every blocked dependency stage to run. The scheduler retains affected stages in a recovery queue and issues short-lived fetch leases in tenant-balanced cohorts. A token budget, widened only from mirror health signals with hysteresis, bounds new upstream cache misses. At the artifact proxy, requests are coalesced by registry origin, authorization scope, platform, and immutable digest so one verified in-flight fetch can serve authorized followers. Lease retries use bounded jitter; ungranted runners receive explicit backpressure rather than polling freely. Every queued stage has a maximum wait, and a small audited token reserve provides an escape lane for approved urgent builds without disabling the general gate.","structural_mapping":[{"archetype_element":"Shared Release Signal","domain_realization":"The artifact mirror's readiness transition or incident-recovery acknowledgement currently licenses blocked CI dependency stages to resume."},{"archetype_element":"Waiting Population Boundary","domain_realization":"Build stages recorded by the scheduler as blocked on the affected registry or mirror during the outage form the bounded waiting population."},{"archetype_element":"Finite Choke Point","domain_realization":"The recovering mirror's connection pool, metadata database, cache-fill workers, storage bandwidth, and upstream registry link constitute the finite service path."},{"archetype_element":"Release Correlation Metric","domain_realization":"Measure the width of the post-readiness arrival window, peak simultaneous fetches, fetch starts per lease interval, retry phase alignment, and upstream requests per immutable digest."},{"archetype_element":"Dispersion Policy","domain_realization":"Tenant-balanced cohorts receive short-lived leases with bounded randomized activation times rather than one global all-clear."},{"archetype_element":"Admission Gate","domain_realization":"A token budget limits newly admitted upstream misses and expands or contracts from mirror queue, connection, and error health bands with hysteresis."},{"archetype_element":"Coalescing Rule","domain_realization":"Exactly matching, authorization-compatible requests share one in-flight verified artifact retrieval; followers receive the result only after digest and provenance checks succeed."},{"archetype_element":"Upstream Backpressure Channel","domain_realization":"The scheduler and proxy return a lease-not-yet-valid or retry-after instruction, preventing runners from independently probing the recovering mirror."},{"archetype_element":"Fairness and Starvation Guard","domain_realization":"Round-robin tenant allocation, maximum queue age, and an audited urgent-build reserve constrain starvation and priority capture."},{"archetype_element":"Capacity Recovery Signal","domain_realization":"Observed mirror health widens admission gradually; a single binary readiness result does not immediately release the full backlog."}],"mechanism_mapping":[{"mechanism_slug":"capacity_aware_reconnect_queue","role":"Treat blocked dependency stages as re-entrants to a recovering service and release them only through leases priced by current mirror health.","counterfactual_removal":"Without the recovery queue, the readiness transition again exposes the mirror to the entire waiting population, even if runner retry timing has some jitter."},{"mechanism_slug":"token_bucket_admission_gate","role":"Bound the rate of new upstream cache misses while allowing the recovery rate to increase gradually as health stabilizes.","counterfactual_removal":"Without the token gate, cohort timing alone does not prevent a large cohort or many distinct digests from exceeding the recovering service window."},{"mechanism_slug":"single_flight_request_coalescing","role":"Convert simultaneous requests for the same immutable, authorization-compatible artifact into one verified upstream fetch plus local fan-out.","counterfactual_removal":"Without coalescing, leases may spread the wave but still spend scarce recovery capacity on duplicate transfers and metadata work."},{"mechanism_slug":"exponential_backoff_with_jitter","role":"Desynchronize lease reacquisition and transient fetch retries while imposing a maximum delay.","counterfactual_removal":"Without bounded jitter, runners denied in the same interval can re-align at the next fixed retry boundary and recreate a smaller recurring wave."},{"mechanism_slug":"priority_bypass_token","role":"Reserve bounded, audited capacity for approved security or release-critical builds while the general backlog remains staged.","counterfactual_removal":"Without a bounded escape lane, urgent work can wait behind the backlog, encouraging operators to disable the entire gate and restore all-at-once release."}],"causal_chain":["The dependency mirror becomes unavailable, causing CI dependency stages to block or enter retry state.","The scheduler records the affected stages, but a shared readiness transition would ordinarily make them runnable together.","Similar runner behavior compresses their dependency requests into a short post-transition window.","Overlapping dependency graphs cause both distinct cache misses and duplicate requests for identical digests to reach the recovering mirror.","The synchronized work occupies finite connections, metadata capacity, cache-fill workers, or upstream bandwidth faster than those resources recover.","Queueing and timeouts prompt further retries and may make readiness flap, creating another common timing cue.","The proposed queue withholds general dependency admission and grants tenant-balanced, jittered leases within a health-derived token budget.","Digest-scoped single-flight retrieval removes authorized duplicate upstream work, while explicit backpressure prevents denied runners from free-running retries.","If the causal model is correct, the backlog is presented as a governed stream of unique fetch work, while maximum-wait and priority rules constrain the latency transferred upstream."],"baseline":"Use a binary-release baseline in which the mirror's first healthy result immediately makes every blocked dependency stage runnable. Each runner performs its own dependency requests and existing retry behavior, with no recovery-specific admission budget or cross-runner single-flight operation. Runner count, build inputs, mirror capacity, and artifact verification remain matched to the intervention comparison.","nearest_rivals":["Increase mirror replicas, connection capacity, cache-fill workers, or upstream bandwidth. This is preferable if evenly spread demand still exceeds sustainable capacity, but it does not isolate release correlation as the cause.","Apply a fixed global CI concurrency cap. This is simpler and may be sufficient, but it also holds compute-only work and does not distinguish duplicate dependency fetches from independent work.","Use client-only exponential backoff with full jitter. This decentralizes dispersion, but it lacks current mirror-capacity feedback, a bounded waiting-population view, and cross-runner duplicate coalescing.","Keep the mirror circuit open and admit a few half-open probes before issuing an all-clear. This tests recovery safely, but a subsequent binary all-clear can still release the accumulated build population together.","Prebuild dependency images or rely on a conventional artifact cache. This can remove fetch work entirely for covered inputs and should be preferred where coverage is adequate; cold, invalidated, or authorization-specific artifacts still require a governed miss path."],"remaining_contrastive_claim":"Against a fixed global build-concurrency cap, the candidate has a distinct causal prediction: post-recovery mirror pressure is governed more directly by the admitted rate of non-coalesced upstream dependency fetches than by the total number of running builds. The specialized design is warranted only if digest-scoped coalescing and mirror-health tokens change that mediator while unrelated compute-only work can continue; if total-build capping performs equivalently without obstructing unrelated work, the specialized intervention loses its contrastive advantage.","authority_safety":{"decision_authority":"The CI platform owner and artifact-service owner jointly control a trial; the security or release authority defines which build classes may use the urgent reserve. Individual projects and runners cannot unilaterally bypass the recovery gate.","authorized_first_step":"Run only a trace-driven replay against an isolated mirror emulator, using de-identified build and digest identifiers and fixed synthetic credentials. The trial may change replay scheduler and proxy settings but not production pipelines or external registries.","excluded_actions":["Production deployment or automatic fleet-wide enablement","Disabling artifact signature, digest, provenance, or authorization checks","Sharing artifacts across incompatible authorization scopes","Silently granting projects permanent priority status","Indefinitely holding builds without a maximum-wait outcome","Changing or load-testing a third-party registry without its operator's authorization"],"halt_rollback":"Halt the replay if artifact verification differs from baseline, any authorization boundary is crossed, the recovery queue grows without a bounded disposition, urgent-reserve use crowds out the general queue, or maximum-wait guards fire. Roll back by disabling the experimental scheduler and proxy flags and restoring the isolated baseline configuration; no production state is altered."},"negative_tests":{"strongest_counterevidence":"The strongest counterevidence would be a replay showing that the mirror remains overloaded under evenly spaced, nonduplicate requests at the same total work level. That would indicate persistent capacity shortage or a slow dependency rather than release correlation, making capacity repair or bottleneck removal the appropriate intervention.","problem_falsifier":"The proposed problem is falsified if an aligned incident trace shows no discontinuity in fetch starts after the shared readiness transition, no transient concentration of connections or queue depth, negligible repeated digests, or continued saturation after the same requests are evenly spread. It is also falsified if runners are released by independent signals rather than a common recovery event.","intervention_falsifier":"The intervention is falsified if matched replay shows that leases and single-flight do not change admitted-concurrency or duplicate-fetch mediators, merely move timeouts into the scheduler, fail to stop repeated readiness cycles, or violate predefined integrity, authorization, priority, or maximum-wait guards. An equally safe and simpler rival under the same workload also defeats the case for this design.","risks":["Staging transfers latency from the mirror into the CI queue and can lengthen full backlog recovery.","Incorrect or delayed health feedback can keep admission too narrow or widen it before the mirror is stable.","A centralized lease service or artifact proxy can become a new bottleneck or failure dependency.","Incorrect single-flight keys can leak artifacts across authorization scopes; coalesced failures can also fan one bad result to many waiters.","Tenant balancing can be gamed through job splitting, while priority classification can be captured without audit.","Identically seeded jitter or synchronized lease expiry can recreate periodic waves.","Queued runner processes can consume memory, worker slots, or scheduler storage, displacing rather than eliminating overload.","Urgent security work can be delayed if the escape reserve, escalation authority, or maximum-wait behavior is misconfigured."]},"next_evidence_step":"Take one de-identified CI episode trace containing readiness, scheduler, request-digest, retry, and mirror-health timestamps, and replay it against one isolated mirror emulator at fixed service capacity. Run exactly three configurations—binary all-release baseline, full-jitter-only rival, and health-budgeted leases plus digest single-flight—with three fixed random seeds each, then stop. Record arrival-window width, simultaneous fetches, upstream requests per digest, mirror queue and error state, completed and rejected builds, queue-age distribution, urgent-reserve use, and integrity or authorization failures. Advance beyond this nine-run screen only if the baseline reproduces the synchronized-release signature, the intervention changes the proposed concurrency and duplication mediators rather than merely rejecting work, and no safeguard fires.","prior_art_status":"UNSEARCHED","diversity_from_prior_proposals":"Runtime isolation prevents comparison with other proposals, so no cross-proposal diversity claim is made. Within the supplied packet, this candidate is concretized at the CI scheduler–artifact mirror boundary and controls the post-readiness release of blocked dependency stages through health-priced leases and authorization-safe digest coalescing.","revision_record":{"parent_version":null,"progress_targets_addressed":["Produce one complete computer-science candidate with an independently recognizable problem","Preserve the shared-signal, waiting-population, finite-choke, and governed-release causal structure","Specify operational mechanisms, serious rivals, safeguards, falsifiers, and a bounded first test"],"conceptual_changes":["Initial formulation; maps synchronized release dampening to dependency-fetch demand created when a CI artifact service recovers."],"operational_changes":["Initial intervention defines scheduler-held recovery leases, health-derived admission tokens, digest-scoped single-flight retrieval, explicit backpressure, fairness bounds, and an urgent escape reserve."],"evidence_changes":["Initial evidence plan limits evaluation to nine non-production trace replays with matched workload and capacity."],"claim_changes":["Initial contrastive claim is conditional on the unique-fetch admission mediator and makes no claim of novelty, prevalence, demand, or effect size."]}}