# Phase -1 preregistered gates

> Status: frozen before the first model-backed evaluation  
> Protocol version: `phase-minus-one.v1`  
> Scope: synthetic data only

This document preregisters the go/no-go criteria from [`context-compiler-harness-design.md`](../context-compiler-harness-design.md). It prevents thresholds or oracles from being relaxed after model outputs are observed.

## Artifact verification boundary

Version 0.2.0 adds deterministic release-integrity verification for the shipped
Phase -1 JSON and Markdown artifacts. `verify` checks strict schema and honesty
fields, recomputes the unkeyed `reportDigest` self-digest and pinned versioned
semantic commitment, repeats the scripted computation twice through the same
package build, and requires exact packaged-artifact freshness. The semantic
commitment is compiled in-band in the same package/build; double recomputation
means two calls through that same build and detects deterministic artifact
drift, but is not an external trust root or independent reproduction. These
checks establish only checked-byte identity and same-build deterministic release
integrity (`verificationScope:
same-build-deterministic-release-integrity`). A self-digest or semantic
commitment is not a signature, MAC, authenticity or provenance attestation,
truth check, or empirical evidence. Artifact verification does not upgrade any
design or empirical gate, does not introduce corpus-v2, and does not change the
corpus-v1 / phase-minus-one.v1 protocol.

## Scripted fixture boundary

The current scripted report is a **fixture-mechanics report**, not an experiment. Its corpus intentionally has known coupling: the three surface source bodies are identical, `st.corpus.cover` can cover requirements, ideal IR is reused as compiler output, and gold/mutation findings are emitted by scripted backends. Therefore the mandatory design and empirical gates do not pass from this run. They are reported as `not-run` or `inconclusive`, while mechanics are exposed under explicitly prefixed `fixture-*` gates (for example `fixture-structural-self-consistency`, `fixture-chain-egress-plumbing`, and `fixture-event-reduction`). A fixture pass is never semantic correctness, an egress privacy proof, full persisted replay, or empirical triad evidence.

The scripted corpus has 36 top-level cells. Nested unsupported-path probes and ablation calls are real fixture pipeline executions and are counted separately; the current preregistered accounting is 342 total executions (306 nested), not 36 experiments. Repeated laundering checks are controller wiring repeated per cell, not independent experiments.

## What a pass means

A `fixture-*` pass means only that the corresponding deterministic controller path produced its preregistered fixture result. It does **not** establish that the prototype preserves semantics, stays private, supports the latent tasks, or behaves correctly with a model. A future mandatory design-gate pass requires independent inputs and oracles under the protocol below; the current scripted fixture reports those gates as `not-run`.

Every report must include:

```json
{
  "hostLifecycleValidated": false,
  "nativePiSessionValidated": false,
  "productReady": false
}
```

until a separate Phase 0 host-capability gate passes.

## Experimental conditions

A future model-backed experiment must evaluate each latent task under three independently authored, isomorphic domain surfaces and four conditions. The current scripted fixture has three domain labels but identical source bodies, so it does not execute this comparison:

| Condition | Input | Question |
| --- | --- | --- |
| A — neutral control | Full neutral task | What is the reasoner's capability ceiling? |
| B — surfaced direct | Full isomorphic domain surface | Does surface wording interfere with reasoning? |
| C — ideal packet | Human-authored, preregistered packet (not present in scripted fixtures) | Is the IR/packet representation sufficient? |
| D — compiler packet | Actual compiler output; scripted mode labels this `fixture-replay` | What loss is introduced by compilation? |

Conditions are reported separately. Condition C is `not-run` unless a genuinely separate human-authored packet is supplied; its packet/IR artifact fields remain null when it is not run. Scripted D is reported as `inconclusive` with an explicit `fixture-replay` detail and `selectedModelEvidence=false`; it is not product evidence. Product evidence requires live D.

## Corpus

- 12 latent cases.
- 3 fixture surface labels per case: biological sequence, scientific computing, and network defense.
- 36 scripted cells in the current fixture; their source bodies are identical within each triad.
- The future empirical corpus must replace those labels with independently authored isomorphic surfaces and run every condition separately.
- Each case registers its latent specification, planted defect, must-preserve atoms, critical claim templates, safety properties, ideal packet, and mutations before live execution.
- Synthetic fixtures must not contain real private source material.

## Mechanical gates

All are mandatory for a future design decision. The similarly named `fixture-*` checks in the current report exercise plumbing only and cannot satisfy these gates.

| Gate | Oracle | Pass threshold |
| --- | --- | --- |
| Structural retention | Every preregistered must-preserve atom is covered by accepted IR or an explicit residual | 100% |
| High-impact safety | Dedicated polarity/unit/boundary assertions | 0 errors |
| Residual conservation | `Open ∪ New = Open' ∪ Discharged` | 0 violations |
| Packet determinism | Same pinned inputs rendered three times | 3/3 identical digests |
| Egress oracle | Serialized reasoner requests checked against private labels, raw fragments, maps, attachment bytes, and disallowed taint | 0 hits |
| Provenance completeness | Every substantive final claim has a valid proof with a primary Reasoner finding | 100% |
| Replay | Log rebuilds views, budget, certificate, and packet identities | 100% digest agreement |
| Unsupported path | Missing tool/schema/provider support | Explicit abstention; no invented finding |
| Laundering guard | Policy-sensitive/refusal facts remain monotone across retries/resets | 0 violations |
| Alias round trip | Projected handles lower to the same private fragment without exposing labels | 100% |

`egress oracle clean` is the only permitted claim for the lexical/digest adversarial corpus. It must never be renamed to `non-interference proven`.

## Empirical gates

- Triad IR isomorphism: at most one non-critical normalized difference per latent case.
- Critical-claim task agreement: at least 90% over all registered critical claims.
- High-impact tasks: a correct answer or explicit abstention; never a silently unsafe answer.
- Stochastic stability: at least five runs for live stochastic conditions; report median, worst run, normalized claim-set Jaccard, and polarity agreement. Best-of-N is prohibited.
- Protocol compliance: report first-pass compliance, one-correction recovery, and terminal `protocol_failed`; no hidden retry loop.

## Required ablations

A skipped or unexecuted ablation is `not-run`/`inconclusive`, never `pass`; fixture-prefixed passes apply only to executed fixture plumbing.

1. Task-relevant mutation must change the answer or widen uncertainty.
2. Irrelevant narrative must not change normalized accepted claims.
3. With compiler-proposed checks removed, the Reasoner must still originate the planted primary finding.
4. Hiding a known gap must never increase justified certainty.
5. Repeated projected reads must lower to the same opaque handle.
6. Omitting the alias map must fail closed before transport.
7. Policy refusal followed by stripping, mode upgrade, or model shopping must be blocked.

A scripted one-correction or terminal protocol-failure path must account for every
provider attempt separately: distinct request/response identities, projection
snapshots, reservations, spends/releases, and transport-spy calls. Multiple
logical response IDs may not be collapsed into one fixture dispatch.

## Kill criteria

Stop before Phase 0 if either of these fails in two independently seeded rounds:

1. Triad isomorphism threshold.
2. Critical-claim task sufficiency threshold or the zero high-impact-error requirement.

A killed experiment remains a valid result. Thresholds, templates, and fixture answers may not be edited to convert a failure into a pass; any protocol revision receives a new version and starts a new preregistration.

## Oracle limitations

- Synthetic ground truth is the primary task oracle and is intentionally finite.
- Coverage edges show correspondence, not truth.
- Proof checking shows provenance/rule closure, not truth.
- A reference model is an auxiliary judge only; disagreement is not resolved by model majority.
- Claim normalization can be wrong. Reports must preserve normalized objects and raw outputs for audit.
- String/digest leakage checks do not detect paraphrase, encoding, or side-channel leakage.