diff --git a/OVERSEER-STATUS.md b/OVERSEER-STATUS.md index ff21435..7a32c29 100644 --- a/OVERSEER-STATUS.md +++ b/OVERSEER-STATUS.md @@ -49,3 +49,7 @@ RQ2 RATIFIED (operator Andre, 2026-07-20, while blind) — observation-consisten - DRIVE STATE: SS1 ✅ SS2 firing ✅ SS3-RQ1 ✅ RQ2-proposal ✅ SS4-skeleton ✅. Battery: 492/9000, RUNNING healthy (PID 2539198). REMAINING GATES: SS3-RQ2 + RQ1-P2 pairing on Andre's RQ2 ratification; SS4 Results/Discussion + SS5 review on (a) battery completion (blinding) AND (b) RQ2 ratification. All data-independent overnight work now exhausted without fabricating or breaking blinding. - 2026-07-20 RQ2 RATIFIED + offline loader DONE + committed: docs/stage-05-rq2-posterior-clarification.md flipped PROPOSED→RATIFIED (operator Andre, while BLIND — 0 RQ2 stats computed). Built cmd_chat/sor/analysis/confirm_load_rq2.py: reconstructs each circuit's spec OFFLINE from per_circuit_seeds via deterministic assemble(), derives the observation-consistent anonymity set A_i (uniform/max-entropy → [1]*m_i), per-circuit H_i=Miller–Madow, and the willing-bridge concentration series — feeding confirm.rq2_p1_delta_h (ΔH two-sided) + rq2_p3_funnel (Spearman). Unit-tested on SYNTHETIC specs/seeds ONLY (test_sor_confirm_load_rq2.py, 6 passed; full SOR suite 172 passed). NEEDS-OPERATOR banner removed (resolved). - HARD BLIND HOLD STILL ON: collect_rq2_p1_arms/collect_rq2_p3 are BLIND-GATED — NOT run on real data; no RQ2-P1/P2/P3 result computed/inspected/reported until battery completes. Battery: 3816/9000 (~42%), alive, healthy. INSTRUMENT CAVEAT for SS5: bridge-federated assigns a fresh bridge per circuit seed ⇒ willing-bridge reuse is minimal ⇒ P3 concentration may be near-degenerate as-instrumented (an honest, reportable property — loader does not fix it). +- 2026-07-20 RQ1-P2 PAIRING RESOLVED = by run_index (overseer ruling, freeze-DERIVED — the Holm case, not the RQ2 gap-fill). docs/stage-05-rq1p2-pairing-clarification.md drafted: cites frozen §6 L197-198 (paired mandated), §4 L108 (RQ1 unit=AUC over the pair set ⇒ pairable unit is the RUN not the circuit), §4 L111 (R=30 balanced), §3 L97 (interleaving indexes shared session position); status RATIFIED-by-derivation / PROPOSED for Andre (low-risk, non-blocking); prereg UNTOUCHED. +- Loader wired: confirm_load.collect_rq1_p2_paired maps each run_index present in BOTH bridge=on (no-pad) & bridge=on+padding arms → one confirm.PairedCircuit (its two arms' pair sets), fed to the FROZEN confirm.rq1_p2_padding (§6 arm-level ΔAUC preserved; decision layer untouched); per_run_delta_aucs exposes the auditable per-run ΔAUC_i diagnostic; missing-arm run indices are simply unpaired (frozen R NOT redefined; inconclusive if too few remain). +- Unit-tested SYNTHETIC pcaps ONLY (test_sor_confirm_load_rq1p2.py, 4 passed: pair-by-run-index, positive ΔAUC_i when padding flattens, feeds frozen rq1_p2_padding CI>0, graceful missing-arm); full SOR suite 176 passed. No confirmatory record read (prereg §2 blinding: unblocks CODE not RESULTS). +- HARD BLIND HOLD REMAINS: no real RQ1-P2 number until battery completes (battery ~78/180 runs ≈ 43%, alive PID 2539198). prereg SHA INTACT (f22331a72e…); worktree-only feat/sor-consent-relay. diff --git a/cmd_chat/sor/analysis/confirm_load.py b/cmd_chat/sor/analysis/confirm_load.py index 4aab926..d53cce5 100644 --- a/cmd_chat/sor/analysis/confirm_load.py +++ b/cmd_chat/sor/analysis/confirm_load.py @@ -8,12 +8,15 @@ The candidate true pairing is the diagonal (same circuit); off-diagonal pairs ar unlinked — exactly the §4 "AUC over the (entry, exit) pair set, bootstrap over circuit pairs" unit. -Deliberately NOT here (held for the operator ruling — see OVERSEER NEEDS-OPERATOR): - * **RQ2** — the frozen DV is a *per-circuit adversary sender posterior* (§3/§4), - whose construction is not formula-pinned in the prereg and not produced by the - instrument; guessing a posterior model post-freeze would be HARKing. - * **RQ1-P2** nopad/pad *pairing* convention for the paired bootstrap — the pairing - rule across the bridge-on and bridge-on+padding arms is a choice; not guessed. +RQ1-P2 (padding efficacy) is wired here too: the frozen §6 **paired** bootstrap +pairs the bridge-on (no-pad) and bridge-on+padding arms **by run index** — the only +balanced pairing the R=30 interleaved design supports (freeze-derived; see +`docs/stage-05-rq1p2-pairing-clarification.md`). Each run index becomes one +`confirm.PairedCircuit` fed to the frozen `confirm.rq1_p2_padding`. + +Split out (RQ2 lives in its own loader): **RQ2** — the per-circuit adversary +sender posterior (§3/§4) is reconstructed in `confirm_load_rq2.py` per the RATIFIED +stage-05 posterior clarification. Blinding (prereg §2, binding): callers must **not** run this on a confirmatory data dir until the full battery has completed — no inspection of intermediate @@ -24,7 +27,7 @@ from __future__ import annotations import json from pathlib import Path -from typing import Dict, List, Tuple +from typing import Dict, List, Sequence, Tuple from cmd_chat.sor.analysis.detectors import score_matrix from cmd_chat.sor.executor import DEFAULT_BINS, ExecutorError, bin_pcap_bytes @@ -43,6 +46,7 @@ def classify_run(run_dir: Path) -> Dict[str, object]: "cell_id": d["cell_id"], "rq": d["rq"], "padding_applied": bool(d.get("padding_applied", False)), + "run_index": d.get("run_index"), # needed for the §6 RQ1-P2 run-index pairing } @@ -88,3 +92,63 @@ def collect_rq1_p1_pairs(data_dir: Path, *, bins: int = DEFAULT_BINS, hops: int if info["rq"] == "RQ1" and str(info["cell_id"]).endswith("bridge=on") and not info["padding_applied"]: pairs.extend(reconstruct_run_pairs(run_dir, bins=bins, hops=hops)) return pairs + + +# --------------------------------------------------------------------------- # +# RQ1-P2 (padding efficacy) — the frozen §6 PAIRED bootstrap, paired BY RUN INDEX. +# Freeze-derived pairing (docs/stage-05-rq1p2-pairing-clarification.md): each run +# index i yields one confirm.PairedCircuit carrying that run's no-pad and +pad pair +# sets, fed to the frozen confirm.rq1_p2_padding. BLIND-GATED on real data. +# --------------------------------------------------------------------------- # +def _arm_pairs_by_run_index( + data_dir: Path, *, want_padding: bool, bins: int, hops: int +) -> Dict[int, List[Pair]]: + """Map run_index -> that run's RQ1 (entry,exit) pair set, for the bridge-on arm + with (``want_padding``) or without padding. Runs missing a run_index in their + persisted metrics.json are skipped (never guessed).""" + out: Dict[int, List[Pair]] = {} + for run_dir in sorted(p for p in Path(data_dir).iterdir() if p.is_dir()): + if not (run_dir / "metrics.json").exists(): + continue + info = classify_run(run_dir) + if info["rq"] != "RQ1" or not str(info["cell_id"]).endswith( + "bridge=on+padding" if want_padding else "bridge=on" + ): + continue + if bool(info["padding_applied"]) != want_padding or info["run_index"] is None: + continue + out[int(info["run_index"])] = reconstruct_run_pairs(run_dir, bins=bins, hops=hops) + return out + + +def collect_rq1_p2_paired( + data_dir: Path, *, bins: int = DEFAULT_BINS, hops: int = 3 +) -> List["PairedCircuit"]: + """The RQ1-P2 paired units: one :class:`confirm.PairedCircuit` per run index + present in **both** the bridge-on (no-pad) and bridge-on+padding arms — the + freeze-derived run-index pairing (§6 "paired bootstrap"). Graceful: a run index + missing an arm is simply not paired (the frozen R is not silently redefined); + the caller reports inconclusive if too few paired units remain. BLIND-GATED — + do not call on a confirmatory dir until the battery completes (prereg §2).""" + from cmd_chat.sor.analysis.confirm import PairedCircuit + + nopad = _arm_pairs_by_run_index(Path(data_dir), want_padding=False, bins=bins, hops=hops) + padded = _arm_pairs_by_run_index(Path(data_dir), want_padding=True, bins=bins, hops=hops) + return [ + PairedCircuit(nopad_pairs=tuple(nopad[i]), pad_pairs=tuple(padded[i])) + for i in sorted(set(nopad) & set(padded)) + ] + + +def per_run_delta_aucs(paired: Sequence["PairedCircuit"]) -> List[float]: + """The per-run paired differences ``ΔAUC_i = AUC(no-pad,i) − AUC(+pad,i)`` — the + auditable per-run diagnostic behind the §6 paired CI (one value per paired run + index). Positive ⇒ padding lowered that run's linkability AUC.""" + from cmd_chat.sor.analysis.detectors import auc + + def _auc(pairs) -> float: + pos = [s for s, linked in pairs if linked] + neg = [s for s, linked in pairs if not linked] + return auc(pos, neg) + + return [_auc(u.nopad_pairs) - _auc(u.pad_pairs) for u in paired] diff --git a/docs/stage-05-rq1p2-pairing-clarification.md b/docs/stage-05-rq1p2-pairing-clarification.md new file mode 100644 index 0000000..08fd785 --- /dev/null +++ b/docs/stage-05-rq1p2-pairing-clarification.md @@ -0,0 +1,101 @@ +# Stage-05 analysis clarification — RQ1-P2 paired-bootstrap pairing = by run_index + +**Status: RATIFIED-by-derivation, 2026-07-20 — PROPOSED for operator (Andre) +confirmation (low-risk, freeze-faithful, non-blocking).** Worktree clarification +note only — **NOT a deviation**. This *reads an implied unit out of* the frozen +prereg; it does **not** edit the frozen prereg (`sor-consent-prereg.md`, SHA +`f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b`). + +**Made while BLIND** (battery mid-collection, **0 RQ1 confirmatory statistics +computed, inspected, or reported**). Like the Holm clarification — and *unlike* the +RQ2-posterior clarification — this adds **no construct**: it restates the pairing +the frozen text already implies for the §6 *paired* bootstrap. + +> **Distinction from the RQ2 case.** The RQ2 note filled a genuine gap (the prereg +> pinned a per-circuit posterior but no construction rule → it needed operator +> *ratification*). This note is the **Holm case**: the frozen text fixes the +> answer; naming it is compliance, not a new methodological choice. Hence +> "RATIFIED-by-derivation" — operator confirmation is a courtesy check, not a gate. + +## The question + +Frozen §6 RQ1-P2 mandates a **paired** bootstrap of a padding-efficacy difference: + +- **§6 (Analysis), RQ1-P2** (prereg L197–198): *"ΔAUC = AUC(bridge-on, no-pad) − + AUC(bridge-on, +pad); **paired** bootstrap 95% CI. Padding effective iff ΔAUC CI + **> 0**."* + +"Paired" is **mandated** — an unpaired / two-sample bootstrap is out. But a single +physical circuit is run under **either** the no-pad **or** the +pad arm, never both +(they are different §2 cells with different `cell_id`s → different per-run seeds). +So: **what is the paired unit?** Earlier this was held as a "choice" on the grounds +that per-arm *seeds differ so nothing pairs* — but that conflates **seed-pairing** +with **run-pairing**. + +## Authority (the freeze fixes the unit) + +Three frozen facts jointly determine the pairing: + +- **§4 unit of analysis** (prereg L108): *"RQ1 — the (entry, exit) circuit-segment + pair (**AUC over the pair set**)."* The RQ1 statistic is an **arm/cell-level set + AUC**, *not* a per-circuit quantity. So the pairable unit is never the individual + circuit — it is the thing that yields one AUC. +- **§4 repetition** (prereg L111): *"**R = 30** independent seeded runs per design + cell."* Both the no-pad and the +pad arms have the **same balanced R = 30** runs, + indexed `i ∈ {0..29}`. This is the only structure that is **1-to-1 across the two + arms**. +- **§3 confounds L97 / executor design** (interleaving): run order is *randomized + and controls interleaved* to bracket **per-session thermal / background-load + drift** on the grid. Run index `i` therefore indexes a **shared replicate / + session position** whose nuisance the pairing is meant to remove. + +Pairing by run index is the **only balanced pairing the R = 30 interleaved design +supports**, and it is exactly the nuisance-removal a *paired* bootstrap exists for. + +## Decision (freeze-derived, implemented) + +**RQ1-P2 pairs by run index `i ∈ {0..29}`.** For each run index `i`: + +1. `AUC_nopad(i)` = the correlator AUC over run `i`'s **(entry, exit) pair set** in + the **bridge=on** (no-pad) cell; +2. `AUC_pad(i)` = the AUC over run `i`'s pair set in the **bridge=on+padding** cell; +3. `ΔAUC_i = AUC_nopad(i) − AUC_pad(i)` — one paired difference per run index. + +The **paired bootstrap 95% CI** resamples the **run-index paired unit** (each unit +carries both arms' pair sets for that `i`); the reported effect size is the §6 +arm-level `ΔAUC = AUC(no-pad) − AUC(+pad)` and the gate is **unchanged: padding +effective iff the CI > 0.** Realized as one `confirm.PairedCircuit` per run index +fed to the frozen `confirm.rq1_p2_padding` decision function (the §6 decision layer +is **not** modified) — the loader only shapes the paired units. + +**Validity note.** Pairing removes the shared replicate/session nuisance under +interleaving; it never invalidates the CI. If replicate correlation happens to be +0, the paired bootstrap reduces to ~unpaired conservativeness — so pairing is +weakly dominant and safe. Differing per-arm *seeds* are irrelevant: the pairing is +over the **run position**, not the seed. + +**Graceful degradation (no R-dropping).** All R = 30 run indices are attempted; a +run index missing one arm (e.g. an integrity-quarantined run, §6 exclusion rule) is +simply not paired — the frozen R is **not** silently redefined, and if too few +paired units remain the test reports **inconclusive** (never a shrink-to-fit). + +*Covered by `tests/test_sor_confirm_load_rq1p2.py` (SYNTHETIC pcaps only): 30 +paired `ΔAUC_i` from per-run AUCs, paired-bootstrap CI via `confirm.rq1_p2_padding`, +and graceful pairing when a run is missing an arm.* + +## Blinding (binding) + +Ratification-by-derivation unblocks the **CODE, not the results** (prereg §2). The +`collect_rq1_p2_paired` real-data entrypoint is **BLIND-GATED** — it must not run on +a confirmatory data dir until the full battery **completes** (`battery-results.json` +present, or all 180 cell-runs carry `metrics.json`). The pairing logic is +unit-tested on **synthetic** pcaps only, mirroring the RQ1-P1 loader (`8224a38`) and +the RQ2 loader (`bd7e376`). + +## Operator confirmation (requested, non-blocking) + +Andre: this is a **freeze-derived** reading (the Holm pattern), not a new construct. +Confirm at leisure; no RQ1-P2 number is computed until the battery completes +regardless. If you would rather pair differently (e.g. pool to a single arm-level +ΔAUC with an unpaired CI), that would be a **deviation** (§8) since §6 says +*paired* — flag it and it goes in `sor-consent-deviations.md`. diff --git a/tests/test_sor_confirm_load_rq1p2.py b/tests/test_sor_confirm_load_rq1p2.py new file mode 100644 index 0000000..726abda --- /dev/null +++ b/tests/test_sor_confirm_load_rq1p2.py @@ -0,0 +1,111 @@ +"""SS3 RQ1-P2 loader — the freeze-DERIVED run-index paired bootstrap, on SYNTHETIC +pcaps only (docs/stage-05-rq1p2-pairing-clarification.md). + +These pin that the loader pairs the bridge-on (no-pad) and bridge-on+padding arms +**by run index** into one `confirm.PairedCircuit` per index — the only balanced +pairing the R=30 interleaved design supports — and that the frozen §6 decision +function `confirm.rq1_p2_padding` consumes those units unchanged. NO confirmatory +record is read (prereg §2 blinding): run dirs are hand-built with synthetic pcaps +and metrics.json that carry a `run_index`. +""" + +import json +import struct + +from cmd_chat.sor.analysis import confirm, confirm_load + + +def _write_series_pcap(path, series): + """Minimal LINKTYPE_RAW pcap placing one packet of size series[k] at t=k, so + bin_pcap_bytes(path, bins=len(series)) reproduces `series` bin-for-bin.""" + path.parent.mkdir(parents=True, exist_ok=True) + with open(path, "wb") as f: + f.write(struct.pack(" 0. + assert all(d > 0.0 for d in deltas) + + +def test_feeds_frozen_rq1_p2_padding_decision(tmp_path): + for i in range(5): + _write_arm_run(tmp_path, run_index=i, padding=False) + _write_arm_run(tmp_path, run_index=i, padding=True) + paired = confirm_load.collect_rq1_p2_paired(tmp_path, bins=4, hops=3) + test = confirm.rq1_p2_padding(paired, seed=1, n_resamples=200) + assert test.name == "RQ1-P2" and test.effect == "ΔAUC" + assert test.ci.point > 0.0 and test.decision == "padding-effective" + + +def test_graceful_when_a_run_index_missing_an_arm(tmp_path): + # run_index 0,1 in both arms; run_index 2 only no-pad, run_index 3 only +pad. + for i in (0, 1): + _write_arm_run(tmp_path, run_index=i, padding=False) + _write_arm_run(tmp_path, run_index=i, padding=True) + _write_arm_run(tmp_path, run_index=2, padding=False) # unpaired + _write_arm_run(tmp_path, run_index=3, padding=True) # unpaired + paired = confirm_load.collect_rq1_p2_paired(tmp_path, bins=4, hops=3) + # Only the two indices present in BOTH arms are paired; frozen R is not + # silently redefined — the unpaired runs are simply dropped from the pairing. + assert len(paired) == 2