SS2: raw-data freeze — confirmatory battery COMPLETE 180/180, checksummed

Battery output/sor-confirmatory/20260720T060132Z/confirmatory-data finished:
180 cell dirs, each metrics.json + manifest.json + non-empty circuits/ with
per-hop pcaps. Integrity PASS: 0 missing pcaps (27000 pcap + 9000 events.jsonl);
seed provenance verified 180/180 (seed == SHA256(S0=20260719 || cell_id ||
run_index)); R=30 held exactly across all 6 frozen design cells (RQ1{off,on,
on+padding}, RQ2{1house-N,bridge-federated,directory-federated}). No aggregate
battery-results.json (expected, NOT fabricated — 180-cell count is the frozen
completion proxy).

Immutability anchor: SHA256SUMS.txt over 36361 raw artifacts (sorted rel paths);
provenance.json (S0 + seed formula, executor SHA ce68d41, engine=docker
image_digest=null@runtime, timestamps, completion proxy); INTEGRITY-REPORT.md.
Anchors force-added (/output/ gitignored → raw data stays out of git). Raw
metrics.json IMMUTABLE — not recomputed or edited.

SS2 touched structure/checksum/provenance ONLY — no RQ1/RQ2 inferential
statistic (AUC/H/CI) computed or inspected. Next: SS3 frozen-§6 pass.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

OVERSEER-STATUS.md

@@ -53,3 +53,7 @@ RQ2 RATIFIED (operator Andre, 2026-07-20, while blind) — observation-consisten
 - Loader wired: confirm_load.collect_rq1_p2_paired maps each run_index present in BOTH bridge=on (no-pad) & bridge=on+padding arms → one confirm.PairedCircuit (its two arms' pair sets), fed to the FROZEN confirm.rq1_p2_padding (§6 arm-level ΔAUC preserved; decision layer untouched); per_run_delta_aucs exposes the auditable per-run ΔAUC_i diagnostic; missing-arm run indices are simply unpaired (frozen R NOT redefined; inconclusive if too few remain).
 - Unit-tested SYNTHETIC pcaps ONLY (test_sor_confirm_load_rq1p2.py, 4 passed: pair-by-run-index, positive ΔAUC_i when padding flattens, feeds frozen rq1_p2_padding CI>0, graceful missing-arm); full SOR suite 176 passed. No confirmatory record read (prereg §2 blinding: unblocks CODE not RESULTS).
 - HARD BLIND HOLD REMAINS: no real RQ1-P2 number until battery completes (battery ~78/180 runs ≈ 43%, alive PID 2539198). prereg SHA INTACT (f22331a72e…); worktree-only feat/sor-consent-relay.
+- 2026-07-20 SS2 BATTERY COMPLETE 180/180 cells + RAW DATA FROZEN (committed). Integrity PASS: 180 cell dirs, each metrics.json+manifest.json+non-empty circuits/, 0 missing per-hop pcaps (27000 pcaps + 9000 events.jsonl); seed provenance verified 180/180 (seed==SHA256(S0=20260719‖cell_id‖run_index)); no aggregate battery-results.json (expected, NOT fabricated — 180-cell count is the frozen completion proxy).
+- ARM BALANCE (R=30 held exactly): 6 design cells × 30 runs = RQ1{bridge=off,on,on+padding}=30 each + RQ2{1house-N,bridge-federated,directory-federated}=30 each (RQ1=90, RQ2=90; RQ3 not in frozen lattice). Battery window ≈ 2026-07-20T06:11:41Z→2026-07-21T05:24:09Z (~23h).
+- IMMUTABILITY ANCHOR: output/…/SHA256SUMS.txt = SHA-256 over 36361 raw artifacts (sorted rel paths), digest 3fb67c7a…; provenance.json (S0+seed formula, executor SHA ce68d41, engine=docker image_digest=null@runtime, timestamps, completion proxy) + INTEGRITY-REPORT.md. Freeze anchors force-added (/output/ gitignored → raw data stays out of git). Raw metrics.json IMMUTABLE, not recomputed.
+- BLINDING LIFTED for code-on-real-data; SS2 touched STRUCTURE/CHECKSUM/PROVENANCE ONLY — NO AUC/H/CI computed or inspected. NEXT=SS3 frozen-§6 inferential pass (RQ1-P1/P2 + RQ2-P1/P3 + Holm family=7) in one auditable run. prereg SHA INTACT; worktree-only.

output/sor-confirmatory/20260720T060132Z/INTEGRITY-REPORT.md

@@ -0,0 +1,59 @@
+# SS2 raw-data freeze — integrity report
+
+**Battery:** `output/sor-confirmatory/20260720T060132Z/confirmatory-data`
+**Frozen prereg SHA-256:** `f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b`
+**Frozen §4 sample:** R = 30 runs × C = 50 circuits per cell.
+**Completion criterion (frozen):** 180 cells each carrying `metrics.json` — **MET**.
+
+## Integrity assertions (all PASS)
+
+| Check | Result |
+|---|---|
+| Cell dirs | **180** |
+| Each has `metrics.json` | ✅ 180/180 |
+| Each has `manifest.json` | ✅ 180/180 |
+| Each has non-empty `circuits/` | ✅ 180/180 |
+| Missing per-hop pcaps (hop0/1/2 × 9000 circuits) | **0** |
+| Seed provenance `seed == SHA256(S0‖cell_id‖run_index)` (S0 = 20260719) | ✅ 180/180 match, 0 mismatch |
+
+## Design-lattice mapping (R = 30 balance held)
+
+RQ3 is **not** in the frozen lattice (dropped for the G4+RQ1+RQ2 lead paper). The
+6 design cells (3 RQ1 arms + 3 RQ2 arms) each carry exactly R = 30 runs:
+
+| cell_id | runs |
+|---|---|
+| RQ1/topo=1house/selector=static/bridge=off | 30 |
+| RQ1/topo=1house/selector=static/bridge=on | 30 |
+| RQ1/topo=1house/selector=static/bridge=on+padding | 30 |
+| RQ2/bridge=off/selector=static/topo=1house-N | 30 |
+| RQ2/bridge=off/selector=static/topo=bridge-federated | 30 |
+| RQ2/bridge=off/selector=static/topo=directory-federated | 30 |
+
+RQ counts: RQ1 = 90, RQ2 = 90. Selector = static; churn_schedule_id = none (RQ1/RQ2 use no churn).
+
+## Immutability anchor
+
+`SHA256SUMS.txt` — SHA-256 over **36361** raw artifacts (27000 per-hop pcaps +
+9000 per-circuit `events.jsonl` + 361 `json` = 180 metrics + 180 manifest + 1),
+sorted by relative path. Manifest-of-manifests digest:
+`3fb67c7a9253c7f61f25a8432224decd85cff1b4baee8f6a1b60baa936707922`.
+
+Raw `metrics.json` are **immutable** — not recomputed or edited in this stone.
+
+## Provenance notes
+
+- No aggregate `battery-results.json` was written (expected; **not** fabricated).
+  Cell count 180/180 is the completion proxy.
+- `engine.image_digest` was recorded `null` at run time (sor-hop image not
+  digest-pinned by the executor); containment `engine != local` was asserted
+  per-hop by `ForwarderPlan` at collection time.
+- Battery window (mtime proxy): start `2026-07-20T06:11:41Z` → end
+  `2026-07-21T05:24:09Z` (≈ 23h).
+
+## Blinding
+
+Blinding is **lifted for code-on-real-data**. SS2 touched **only**
+structure/checksums/provenance — **no** RQ1/RQ2 inferential statistic (AUC / H /
+CI) was computed, aggregated, or inspected. The first real inferential numbers
+come from the frozen §6 pipeline in **SS3**, in one auditable pass.

output/sor-confirmatory/20260720T060132Z/provenance.json

@@ -0,0 +1,71 @@
+{
+  "schema": "sor-raw-freeze/1",
+  "battery_dir": "output/sor-confirmatory/20260720T060132Z",
+  "data_subdir": "confirmatory-data",
+  "frozen_prereg_sha256": "f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b",
+  "seed": {
+    "S0": 20260719,
+    "formula": "seed = SHA256(S0 || cell_id || run_index)[:8] as u64 big-endian, via cmd_chat.sor.battery.derive_seed",
+    "verified": "180/180 per-cell manifest/metrics seeds recomputed and matched derive_seed(cell_id, run_index)"
+  },
+  "design_lattice": {
+    "R_runs_per_cell": 30,
+    "C_circuits_per_run": 50,
+    "cells_total": 180,
+    "circuits_total": 9000,
+    "note": "RQ3 arm is NOT in the frozen lattice (dropped for the G4+RQ1+RQ2 lead paper); the 6 design cells are 3 RQ1 arms + 3 RQ2 arms, each R=30.",
+    "cells": {
+      "RQ1/topo=1house/selector=static/bridge=off": 30,
+      "RQ1/topo=1house/selector=static/bridge=on": 30,
+      "RQ1/topo=1house/selector=static/bridge=on+padding": 30,
+      "RQ2/bridge=off/selector=static/topo=1house-N": 30,
+      "RQ2/bridge=off/selector=static/topo=bridge-federated": 30,
+      "RQ2/bridge=off/selector=static/topo=directory-federated": 30
+    },
+    "rq_counts": {"RQ1": 90, "RQ2": 90}
+  },
+  "executor": {
+    "confirmatory_run_git_sha": "ce68d41348b3c151cab0f265efbce8fc7e9a839e",
+    "confirmatory_run_git_note": "last commit touching cmd_chat/sor/confirmatory_run.py + executor.py (SS1 executor commit)",
+    "worktree_head_at_freeze": "a7c5eb221d3fb96acb8d2872a22cf6ec38416dbb",
+    "branch": "feat/sor-consent-relay"
+  },
+  "isolation": {
+    "engine": "docker",
+    "image_digest": null,
+    "image_digest_note": "per-cell manifests recorded engine.image_digest=null at run time; the sor-hop image was not digest-pinned by the executor. Containment (engine != local) was asserted per-hop by ForwarderPlan; image digest is unavailable post-hoc.",
+    "assertion": "isolated-docker-only (engine != local) enforced per hop at collection time"
+  },
+  "timestamps": {
+    "battery_start_utc": "2026-07-20T06:11:41Z",
+    "battery_end_utc": "2026-07-21T05:24:09Z",
+    "start_end_source": "earliest per-cell manifest mtime -> latest per-cell metrics mtime (no aggregate results.json was written)"
+  },
+  "completion": {
+    "criterion": "180 cells each carrying metrics.json (frozen completion proxy)",
+    "criterion_met": true,
+    "battery_results_json_present": false,
+    "battery_results_json_note": "aggregate battery-results.json was NOT written by the run; this is expected and NOT fabricated. Cell count (180/180) is the completion proxy per the frozen criterion."
+  },
+  "integrity": {
+    "cell_dirs": 180,
+    "all_have_metrics_json": true,
+    "all_have_manifest_json": true,
+    "all_have_nonempty_circuits": true,
+    "missing_per_hop_pcaps": 0,
+    "seed_verify_ok": 180,
+    "seed_verify_bad": 0
+  },
+  "checksums": {
+    "manifest_file": "SHA256SUMS.txt",
+    "artifact_count": 36361,
+    "artifact_breakdown": {"pcap": 27000, "events.jsonl": 9000, "json": 361},
+    "sha256sums_txt_digest": "3fb67c7a9253c7f61f25a8432224decd85cff1b4baee8f6a1b60baa936707922",
+    "note": "SHA256SUMS.txt holds a SHA-256 over every raw artifact (per-hop pcaps, per-circuit events.jsonl, per-cell metrics.json + manifest.json), sorted by relative path. This is the raw-data immutability anchor. Raw metrics.json are IMMUTABLE and were NOT recomputed or edited."
+  },
+  "blinding": {
+    "status": "lifted for code-on-real-data as of battery completion",
+    "ss2_scope": "structure/checksums/provenance ONLY — no RQ1/RQ2 inferential statistic (AUC/H/CI) computed, aggregated, or inspected in this stone. First real inferential numbers come from the frozen §6 pipeline in SS3 in one auditable pass.",
+    "note": "Per-cell metrics.json contain live-written per-circuit DV columns; SS2 checksums them without aggregating or reading effect directions across cells."
+  }
+}