hack-house/docs/rq2p3-mechanism-prereg.md

Pre-registration (DRAFT) — RQ2-P3 funnelling-mechanism study

STATUS: APPROVED-PATH, PARAMS LOCKED — NOT YET FROZEN. Design + parameters operator-approved 2026-07-21 (grid B∈{2,4,8}×α∈{0,1,2}; run-level cluster bootstrap; two-sided/direction-agnostic). Remaining step before any confirmatory cell: human freeze checkpoint — record the SHA-256 of the final text in §10 and the operator freeze sign-off. Build + synthetic tests + the §7 calibration gate MAY proceed now; the confirmatory battery MUST wait for the freeze. This is a new study with its own slug (sor-consent-rq2p3). It does not modify the frozen lead prereg (sor-consent-prereg.md, SHA f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b), whose RQ2-P3 result stands as reported ("inconclusive — not testable as-instrumented").

0. Why this study exists

The lead paper found federation shrinks the per-circuit anonymity set (RQ2-P1, ΔH = −0.96 bits, Holm-significant) but could not test the mechanism (RQ2-P3): the bridge-federated instrument assigns a fresh willing bridge per circuit seed (assembler.py:131, _bridge_label(seed)), so every circuit routes through a distinct bridge, top-3 concentration is constant (c_i = 1/C), the covariate has zero variance, and Spearman ρ is undefined (stats.spearman returns 0.0 by construction). The lead paper reported this honestly as an as-instrumented degeneracy, not a null of a well-posed test.

The mechanical insight this study exists to test (see note-unique-bridge-artifact.md). The adversary's observation is exit_signature = (exit_house, bridge_label), and the per-circuit anonymity set m_i = the distinct entry nodes among circuits sharing that signature (confirm_load_rq2.py). A fresh bridge per circuit ⇒ every signature is unique ⇒ group size 1 ⇒ m_i = 1 ⇒ H ≈ 0. That — not funnelling — is why bridge-federated produced H ≈ 0 and drove the lead ΔH negative. Introduce a finite shared pool and many circuits share a bridge ⇒ shared signature ⇒ larger set ⇒ higher H. Under this posterior a bridge is a mix: more concentration plausibly raises anonymity, the opposite of the naive funnel story. So this study is, honestly, a test of whether the lead paper's "shrink" is a unique-bridge artifact — and it may qualify or correct the lead RQ2-P1 headline.

This study re-instruments the willing-bridge layer with a finite pool + skewed willingness so concentration genuinely varies, and — the key upgrade — treats concentration as a manipulated independent variable (a dose-response design) rather than a passive covariate. The direction is left two-sided: the naive prediction is funnel (ρ < 0); the mechanical prediction under the ratified posterior is mix (ρ > 0). We pre-commit to reporting whichever the data shows, including a correction to the lead result if warranted. The analysis code (bridge_concentration, rq2_p3_funnel) is already correct; only the instrument and this prereg are new.

1. Blinding & integrity posture (read first)

• This study is NOT blind to the RQ2-P1 shrink direction (the lead paper is published). Mitigations that keep it honest: (a) the funnelling hypothesis was pre-stated as a live mechanism in the lead paper's introduction, not invented post-hoc; (b) the confirmatory targets below are two-sided; (c) concentration is a manipulated IV, so the test is a designed dose-response, not a re-slice of the lead data.
• The lead RQ2-P1 result is NOT re-litigated here. Any ΔH this pool instrument produces is labeled EXPLORATORY / replication, never a re-run of the frozen RQ2-P1.
• No detector retuning. The entropy estimator, posterior construction, and Spearman path are inherited unchanged from the frozen lead pipeline; only bridge assignment changes.

2. Research question & hypotheses

RQ2-P3′. Within the consent-gated bridge-federated topology, does willing-bridge concentration causally reduce the per-circuit anonymity set (funnelling)?

• H1 (within-cell association, two-sided). Spearman ρ between per-circuit top-3 willing- bridge concentration c_i and per-circuit entropy H_i. Funnel iff BCa 95% CI < 0; mix iff CI > 0; inconclusive iff CI spans 0. Direction is not presumed.
• H2 (dose-response, two-sided). OLS slope β of H on realized top-3 concentration, over per-run mean points (9 cells × 30 runs = 270 clustered points), cell-level BCa CI. Funnel iff slope CI < 0; mix iff slope CI > 0.
• H3 (joint, direction-agnostic). Mechanism RESOLVED iff H1 and H2 agree in sign and both exclude 0; the sign is the finding (funnel vs mix). Unresolved if either spans 0.

3. Instrument change (the only new code)

Replace the per-seed fresh bridge with a willing-bridge pool of size B and a fixed skewed willingness weight vector, under a new topology factor so lead-paper cells stay bit-reproducible:

# new assembler branch: topology == "bridge-federated-pool"
weights   = zipf_weights(B, alpha)                 # fixed from the CELL seed; stable per run
idx       = weighted_draw(sha256(f"sor-bridge-pool|{circuit_seed}"), weights)
bridge    = f"bridge#{idx:02d}"                     # B distinct labels, REUSED across circuits

• Weights derive from the cell seed (not the circuit seed) so the willingness profile is fixed within a run and circuits genuinely share bridges → concentration varies.
• Everything else (hop structure, houses, exit-signature grouping, posterior, Miller–Madow H, BCa) is identical to the frozen lead pipeline.
• Touchpoints: assembler.py (new branch + pool helper), battery.enumerate_cells() (sweep). confirm_load_rq2.py, confirm.py, stats.py are unchanged.

4. Design matrix (concentration as IV)

Bridge-federated-pool, selector static, matched-N, bridge willingness the only manipulation:

• Pool size B ∈ {2, 4, 8} — 3 levels.
• Willingness skew alpha ∈ {0 (uniform), 1.0 (moderate Zipf), 2.0 (heavy Zipf)} — 3 levels.
• Full 3×3 = 9 concentration cells (each realizes a distinct mean top-3 concentration).

Run order randomized within cell; deterministic from an ordering seed distinct from data seeds.

5. Dependent variables

• Per-circuit H_i — Miller–Madow entropy of the uniform posterior over the observation- consistent anonymity set (inherited verbatim from the frozen lead pipeline).
• Per-circuit top-3 concentration c_i — confirm_load_rq2.bridge_concentration (unchanged).

6. Sampling, seeds, stopping rule

• R = 30 seeded runs/cell, C = 50 circuits/run (matched to the lead study).
• Base seed S0 = 20260719; per-cell seed = SHA256(S0 ‖ cell_id ‖ run_index) (matched).
• Fixed stopping rule: all 9 cells × R run to completion. No optional stopping, no interim looks. An uninformative cell is reported inconclusive, never extended.

7. Instrument-validation gate (boolean; blocks the confirmatory run)

Re-worded 2026-07-21, pre-freeze (deviation logged in stage-05-rq2p3-gate-clarification.md). Items 1–2 were originally written under the naive-funnel prior ("pool reproduces the zero-variance degeneracy"; "B=1 → low H"). Both are mechanically wrong under the ratified posterior and were corrected before freeze — see the §7 scope note below. No hypothesis changed (H1/H2/H3 in §2 stay two-sided/direction-agnostic); only a mis-specified validation gate was fixed. The original dry-pass output that exposed this is cited in the deviation log.

All must pass before any confirmatory cell:

1. Reproduce the lead degeneracy — on the FROZEN branch, not the pool. The lead zero-variance degeneracy is a property of the injective fresh-bridge map (a unique bridge per circuit seed = effectively no reuse). A finite pool of any size B draws with replacement, so birthday collisions make concentration non-constant and ρ defined — a pool cannot and must not be expected to reproduce the fresh-bridge degeneracy. The regression check therefore anchors on the actual frozen bridge-federated branch (UNTOUCHED): it must still yield unique exit-signatures → m_i = 1 → H_i ≈ 0, constant c_i = 1/C. That is the real "lead reproduces" teeth.
2. B = 1 boundary. B = 1 → all circuits share the one bridge → c = 1.0 (keep this concentration tooth). Under the ratified posterior the anonymity set is then all circuits sharing the exit house, so H_i sits at the HIGH end (maximal mix) — the "low H" gloss was the naive-funnel error and is refuted by construction here. Expect high H.
3. Monotonicity. Realized mean top-3 concentration is monotone decreasing in B and increasing in alpha, across the sweep, on a dry (non-confirmatory) calibration pass.
4. Entropy calibration unchanged. H = log₂N on equiprobable synthetic senders (inherited).

§7 scope note (why items 1–2 do NOT assert an H-vs-c sign). This gate validates the instrument — concentration varies monotonically (item 3), entropy is exact (item 4), the frozen branch is untouched (item 1), and the B=1 boundary hits c = 1.0 (item 2). It must not pre-assert the sign of H-vs-concentration, because that sign is the two-sided confirmatory question (H1/H2). Baking "expect low H at high concentration" into a validation gate would be funnel-circular; removing it makes the study more rigorous, not less. The confirmatory hypotheses in §2 stay two-sided/direction-agnostic — UNCHANGED. (Note: the dry calibration pass already previews a mix, ρ 0→+0.838 across the sweep; this is surfaced openly as an exploratory preview and does not relax the two-sided pre-commitment.)

If any gate item fails → STOP, do not report; surface as NEEDS-OPERATOR.

8. Analysis plan

• Effect size + BCa 95% CI for every test; p never reported alone; 10,000 resamples; α = 0.05.
• H1: confirm.rq2_p3_funnel(c, H) per cell + pooled, but resampled with a run-level cluster bootstrap (resample whole runs, not individual circuits). Rationale: circuits sharing a bridge have identical c_i and correlated H_i, so per-circuit resampling pseudo-replicates and falsely narrows the CI (the same defect noted for lead RQ1-P1). The run is the independent unit.
• H2: OLS slope of per-run mean-H on per-run mean top-3 concentration (270 clustered points); BCa CI resampling over runs within cells (cluster bootstrap).
• Multiplicity: Holm–Bonferroni over this study's own family {H1-pooled, H2-slope} (the lead study's family-of-7 is closed and not reopened).
• Confirmatory vs exploratory: the 9-cell sweep is confirmatory; any per-cell ρ contrast or ΔH replication is labeled EXPLORATORY.
• Data exclusion (pre-data): quarantine only on integrity failure (SHA/pcap mismatch, non-reproducing seed). No performance-based exclusions.

9. Rails (immutable, inherited)

Prereg frozen after approval — never edited (deviations only in a stage-05-style log; no HARKing; nulls are results). Containment: isolated docker only, self-generated fixture traffic, lab-only. Budget $0. Worktree only on feat/sor-consent-relay. Raw data immutable + SHA-256.

10. Freeze block (to complete at approval)

FROZEN: <date>
PREREG SHA-256: <hash of final text>
APPROVED BY: <operator>
POOL/ SKEW LEVELS LOCKED: B∈{2,4,8}, alpha∈{0,1.0,2.0}