gate_w1 candidate 4: one-shot on the amendment-3 surface (registered 4964126356)

[MaxGhenis]

Verdict: gate PASS

One-shot scored run of W1 candidate 4 — the unchanged c3 model (transport_deployment_v3, byte-identical) — against the LIVE amended gate_w1 surface (44 gated = 43 family-A + the pair-scoped C2), partition bound from gates.yaml at run time. Published regardless (no_self_rescue; write_new one-shot, refuses overwrite).

Registration: issue #42, comment 4964126356. Surface: amendment-3 flip 14658d0 (ratified cb1ef63). Base 14658d0; live master has since advanced only by docs-commit #183 (43ac64f), which does not touch gates.yaml/src/scripts/runs — scored surface identical.

Artifact: runs/gate_w1_candidate4_v1.json (git blob d944ed2270a2c46c36ed3d0cd7e3328f1c8dbe88) + env sidecar. Verdict adapter needed the patch: c3's _family_c_pass hardcodes reversed_to_anchor (the demoted 4-element rule) → it would have FAILED family-C here; the pre-registered pair-scope adapter (required_swap_realised) PASSES.

Gate outcome

Component	Rule (amendment-3)	Result
Family A	≥ 4 / 5 seeds fully in-band (43/43)	PASS — 5 / 5 seeds pass
Family C (gated: C2)	required_swap_realised on [payroll_plus_2pp, elimination]	PASS — swap realised (True)
Family B	report-only, contributes nothing	0 / 10 within tol (does not gate)
Gate	Family A AND Family C	PASS

Family A — per seed (of 43 gated cells)

Seed	In-band	Seed pass
0	43/43	✓
1	43/43	✓
2	43/43	✓
3	43/43	✓
4	43/43	✓

5 / 5 seeds pass; every gated cell in-band on every seed. Per-draw dispersion (conformance): max_across_draw_sd = 0.351065412906704, max_per_draw_abs_ln = 0.495819096421816, regenerated_surface = true, identity_candidate = false — non-zero across-draw dispersion confirms the candidate regenerates every scored column (the prohibited identity map is excluded).

Family C — compression fingerprints

Fingerprint	Gated	Required swap realised	Reversed to anchor	τ vs required
C2 elimination_plus2pp	yes (pair-scope)	True	False	0.333
C1 ppi_nra	no (report-only)	False	False	0.667

C2 (amendment-3 pair-scope): the gated check is required_swap_realised on [payroll_plus_2pp, elimination] — realised (elimination outranks +2pp). The full-ordering statistic publishes report-only:

• deployed: [elimination, cap_150k, payroll_plus_2pp, payroll_plus_1pp]
• required: [elimination, payroll_plus_2pp, payroll_plus_1pp, cap_150k]

so reversed_to_anchor = False and kendall_tau_vs_required = 0.333 — the cap_150k/+1pp legs are report-only (anchor_ordering_internally_inconsistent_under_certified_swap, the pinned-frame-scoped Q10 disclosure). This is bit-identical to c3's committed C2 result; only the gating statistic changed (amendment 3), not the ordering.

Bit-identity check (the registered reproduction expectation)

BIT-IDENTICAL. Every one of the 43 cells gated in both runs has a per-cell [K=20 draws × 5 seeds] sub-cube exactly equal to runs/gate_w1_candidate3_v1.json — 0 deviations over 43 × 20 × 5 = 4,300 values. Frame identical to c3 (sha256 c2065b64…, 166302 persons / 57240 households, total_weight 340008863.6777494). Over the 43 shared cells the dispersion stats are identical to 15 digits; c3's published max_per_draw_abs_ln = 0.938 was driven by hh_size_share.1, a cell demoted to report-only by amendment 3 — its exclusion (not any numerical change) is the entire difference.

Report-only families (published, do not gate)

• Family B (10 M4/DI margins): 0/10 within tolerance (bit-identical to c3).
• C1 (ppi_nra): report-only (fingerprint_reversal_not_realized, amendment 2); reversed_to_anchor False, τ vs required 0.667.
• hh_size quad (hh_size_share.{1,3,4,5plus}, demoted by amendment 3): not evaluated in this artifact — the run binds the 43 gated cells only (size-2 remains gated and is among the 43, in-band 5/5). Their committed values are in c3's artifact; the frame/model/streams identical and the shared-cell cube bit-identical, they reproduce c3's out-of-band pattern exactly (sizes 1/3/5+ out-of-band 5/5; size 4 out-of-band 4/5, clears seed 1). This is the whittling the amendment discloses: amendment 3 demoted exactly the cells c3 failed and rescoped C2 to exactly the part c3 passed.

Forecast vs outcome (graded against the registration)

Registered forecast	Outcome
p(gate PASS) ≈ 0.90	PASS (in the ~90% modal mass)
Modal = PASS with the family-A cube bit-identical to c3's committed artifact	EXACT MATCH — 0 cube deviations over all 43 shared cells; C2 pair realised as committed
Residual risk (a): env drift / nondeterminism breaks bit-identity	Not realised — two-env split reproduced; frame + cube bit-identical
Residual risk (b): verdict-adapter build step introduces an error	Not realised — CI-green build; statistics untouched; family_c_pass correct under the pair-scope rule
Residual risk (c): surface-binding mismatch (runner ↔ amended block)	Not realised — partition bound 43 family-A + C2 exactly

Registered disclosures (restated)

1. Known-passable surface (ratified record, not a hedge) — amendment 3 §3 states plainly the post-amendment surface is passable by this committed model; the whittling defense (permitted-lever line; pre-named in the ratified a2 forecast before c3 ran; forensics-proven; no committed verdict changed) is carried in the amendment and its five-round ceremony (ratified cb1ef63).
2. Lever-1 partial self-reference — the entry anchor targets the retained 25-34 band; those cells' passes carry the same caveat (all 25-34 marital_share cells in-band 5/5).
3. Family-level search size — 4th scored candidate, after 3 forensics rounds and 3 ratified amendments; registry 54/54 at registration; every step registered and publicly graded. On a PASS, an INDEPENDENT adversarial verification must reproduce the run bit-exactly before the record admits it (standing addendum); this pass carries the gates.yaml §9 certification-scope language (what the 44-cell pass does and does not certify).

Build-step & runner faithfulness

scripts/run_gate_w1_candidate4.py is a strict byte-copy of scripts/run_gate_w1_candidate3.py (diff = two hunks only): (1) output name → gate_w1_candidate4_v1; (2) _family_c_pass reads required_swap_realised instead of the demoted 4-element reversed_to_anchor (gates.yaml fingerprints.c2.gated_check_amendment_3 / candidate_procedure.pass_rule). Model untouched (git diff origin/master -- src/ empty). As a strict byte-copy the artifact carries c3's descriptive metadata verbatim — verdict.candidate reads "w1_candidate3" and the gate_rule prose still reads "reverses"; the operative rule is the pair-scope adapter (family_c_pass True with reversed_to_anchor False proves it gated on required_swap_realised), and both statistics publish in verdict.fingerprints.

Env (two-env split, replicated from the c3 sidecar): frame exported in the policyengine.py .venv (py 3.13.9 / hf_hub 0.34.4 / tables 3.11.1); scored phases in .venv-gate (py 3.14.4 / numpy 2.5.1 / pandas 3.0.3 / sklearn 1.8.0 / scipy 1.18.0 — matches the c3 sidecar byte-for-byte). Contract gates.yaml blob 1efbf0958b722d8172697ac3f9a48c043de09bcf at head 778fb0a.

Draft — grading, the registry update, and (on this PASS) the independent bit-exact verification are the orchestrator's acts; not marking ready.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
social-security-model	Ready	Preview, Comment	Jul 14, 2026 1:31am

[MaxGhenis]

Independent pass-verification: VERIFIED-PASS (bit-exact)

Independent adversarial verification of the candidate-4 PASS, per the standing process addendum (issue #42 comment 4948637741): full pipeline re-executed from the committed code, compared field-by-field against the committed artifact, plus the adapter audit, registration-compliance review, no-self-rescue trail, and certification-scope check. Verification performed in a fresh worktree at 71ec93f (scripts/src identical to build commit 778fb0a; the artifact commit adds only runs/gate_w1_candidate4_v1.json + sidecar). No repo edits; all verification outputs were written to an untracked scratch path and deleted.

1. Independent re-execution

Two-env split replicated from the sidecar and verified before running:

Env	Registered / sidecar	Verified on this machine
frame export (policyengine.py .venv)	py 3.13.9, huggingface_hub 0.34.4, tables 3.11.1	py 3.13.9, hf_hub 0.34.4, tables 3.11.1, pandas 2.3.2 — match
scored phases (.venv-gate)	py 3.14.4, numpy 2.5.1, pandas 3.0.3, sklearn 1.8.0, scipy 1.18.0, macOS-26.5.1-arm64	identical, byte-for-byte vs the committed sidecar environment block

Fresh frame export (scripts/export_frame_persons.py) reproduced the committed provenance exactly: sha256 c2065b64… verified, 166302 persons / 57240 households, total_weight 340008863.6777494, identical populated_source_fractions. Full pipeline (fit → seed 0..4 → family-b → family-c → assemble) re-run from the committed runner via a scratch copy whose diff vs scripts/run_gate_w1_candidate4.py is one hunk (the output path redirected to scratch; schema_version/run untouched), so the committed artifact was never at risk of being touched and the payload is directly comparable.

2. Bit-exact comparison — my artifact vs committed runs/gate_w1_candidate4_v1.json

Full-tree leaf-by-leaf comparison (every field, every array element):

Surface	Compared	Deviations
family-A cube [20 × 43 × 5]	4,300 values	0
family-A per-cell verdict fields (5 seeds × 43 cells × 7 fields)	1,505	0
verdict block (incl. gate_pass, family_c_pass, fingerprints)	whole block	byte-identical
family_b block (0/10 within tol)	whole block	byte-identical
family_c block (all statistics)	whole block	byte-identical
conformance (max_across_draw_sd 0.35106541290670407, max_per_draw_abs_ln 0.49581909642181554)	—	identical to full precision

The only differing leaves in the whole artifact, enumerated exhaustively (11): frame_provenance.frame_pickle (worktree path), family_a.per_seed[0..4].elapsed_seconds (5), generator_fit_provenance.*.fit_seconds (5). All wall-clock/path metadata; zero numeric model-output differences. Sidecar: environment byte-identical; contract.blob_sha identical (1efbf095…); contract.head_sha differs as expected (theirs 778fb0a — execution at the build commit; mine 71ec93f — the artifact commit checkout). Committed artifact git blob confirmed d944ed2270a2c46c36ed3d0cd7e3328f1c8dbe88, as claimed.

Cross-check vs candidate 3 (the registered reproduction expectation), independently recomputed: my cube's 43 gated cells are a strict subset of c3's 47; all 4,300 shared sub-cube values exactly equal c3's committed cube (0 deviations); the c3-only cells are exactly the amendment-3-demoted hh_size_share.{1,3,4,5plus}; C1 and C2 fingerprint blocks byte-identical to c3's; c3's overall max_per_draw_abs_ln 0.9378340576894976 is driven by hh_size_share.1 and its max over the 43 shared cells equals c4's published 0.49581909642181554 to all digits — every reproduction claim in the PR body checks out.

3. Adapter audit

diff scripts/run_gate_w1_candidate3.py scripts/run_gate_w1_candidate4.py = 4 unified hunks falling entirely inside the two pre-registered change classes, nothing else:

1. Output name (3 textual sites: docstring line 26, ARTIFACT_PATH, schema_version/run) → gate_w1_candidate4_v1, exactly the artifact path the registration's protocol line pre-commits.
2. Family-C verdict adapter (docstring + the read): _family_c_pass reads required_swap_realised instead of reversed_to_anchor.

(The PR body's "diff = two hunks only" is loose phrasing — it is two registered change classes across 4 unified hunks; no unregistered change is present.)

The adapter's rule vs the live contract:

• gates.yaml family_c.candidate_procedure.pass_rule (blob 1efbf095…): "Amendment 3 RE-SCOPES the gated C2 check to the PAIR: PASS iff required_swap_realised on [payroll_plus_2pp, elimination] … with no requirement on the cap_150k/+1pp positions, which publish report-only … The full-ordering statistic is still computed and published; only the pair gates." Same rule in fingerprints.c2.gated_check_amendment_3 ("required_swap_realised on [payroll_plus_2pp, elimination] ONLY"), and gate_partition.gate_eligible = [fingerprint.elimination_plus2pp].
• Adapter (_family_c_pass): gated_fids and all(fc["fingerprints"][fid]["required_swap_realised"] for fid in gated_fids) with gated_fids bound from gate_partition.gate_eligible at run time — an exact implementation.

Mutation checks (in-memory, on the pure helpers): live binding yields 43 family-A + ['c2'] matching the artifact; demoting a cell in a mutated family_a block shrinks the gated set (binding is live, not hardcoded); emptying gate_eligible yields no gated fids and _family_c_pass returns False (no vacuous pass); the adapter returns True on (swap=T, rev=F) and False on (swap=F, rev=T) — it reads the pair statistic, not the ordering.

Decisiveness confirmed: on the committed statistics, the old c3 rule (reversed_to_anchor) evaluates False and the pair-scope adapter True — the adapter was decisive exactly as disclosed, and the artifact's own family_c_pass: true with reversed_to_anchor: false (kendall_tau_vs_required 0.333, deployed [elimination, cap_150k, payroll_plus_2pp, payroll_plus_1pp]) proves the operative rule was the pair.

4. Registration compliance (comment 4964126356)

• Ordering: registration 2026-07-14T00:19:18Z → build commit 778fb0a 00:39:40Z → CI green on 778fb0a 00:44:40Z (pytest 3.11/3.13, lint, build all success) → execution → artifact commit 01:30:36Z. Timestamps are consistent with the registered "CI-verified BEFORE execution" ordering (total phase runtime ≥ ~9 min even fully parallel; ≈30 min serial in my re-run).
• One-shot / write_new / no partial state: the branch adds exactly 3 files over base 14658d0 (runner, artifact, sidecar). Seed phases write only to gitignored scratch/; write_new is exclusive-create with cleanup-on-failure and _refuse_if_artifact_exists guards every phase; the artifact+sidecar pair exists once, landed in one commit, and is internally consistent (reproduced bit-exactly). Any pre-write_new seed re-runs after kills could not leak state into the committed record, and none did.
• Seeds and streams: gate seeds 0–4 and K=20 confirmed in code (td1.GATE_SEEDS, K_DRAWS) and artifact. Streams actually consumed: family-A 5200+k (FAMILY_A_STREAM_BASE, v3's registered-distinct base), family-B 9200, family-C 9300 — published correctly in the artifact's protocol block. Finding (prose, non-blocking): the registration's parenthetical "K=20 draws 9100+k" names a stream v3 does not consume (9100+k is c1/c2's family-A base, present in v3 only as a comment); c3's own registration carried the same slip ("streams 9100+k"). The operative claim — "same registered streams as c3, byte-identical model" — is true and is exactly what the bit-identity result certifies.
• Reproduction expectation: "the family-A cube is EXPECTED to reproduce candidate 3's committed per-cell values bit-exactly, and the pair-swap to realise as committed" — met, verified independently above; no deviation to report.
• Registered build-step exception: honored precisely — statistics computation untouched (verified: family_c block byte-identical to c3's), verdict read only.

5. No-self-rescue trail

• runs/gate_w1_candidate{1,2,3}_v1.json each have exactly one commit on origin/master (e53b58c, 6ebb6eb, 64ebf97) — never edited; committed verdicts all still read gate_pass: false (c3: family-A 0/5 under the 47-cell surface, family-C failing the 4-element reversal).
• Amendment-3 ceremony record intact: history entry 2026-07-13-w1-hh-size-and-c2-pair carries the five-round ceremony (4962052314 → 4962297637 → 4962578395 → 4962844009 → 4963441188), ratified by squash cb1ef63, with the explicit no-self-rescue paragraph ("candidate 1 … candidate 2 … candidate 3 all STAND FAIL … the demotion rescues nothing") and the pre-commitment to exactly this verification round.
• Contract blob chain: gates.yaml blob 1efbf0958b722d8172697ac3f9a48c043de09bcf is identical at the flip 14658d0, the build commit 778fb0a, the PR head 71ec93f, and live origin/master — the sidecar's contract reference points at the surface that is still live. Master has advanced only by M6 design amendment 3b: year-0 earnings-domain law (§2.8.3, closes Sol round-4 blocker) #183 (43ac64f), which touches docs/design/m6_projection_engine.md only — scored surface identical, as the PR body claims.

6. Certification scope (gates.yaml §9)

The live certification_scope certifies "the TRANSPORT of the already-fit PSID generators onto the certified populace frame — the 44 gated cells (43 family-A joints + 1 family-C fingerprint — the pair-scoped C2 elim<->+2pp compression swap)", with the hh_size quad, cap_150k/+1pp legs, 18-24 pair, 65+ quad, C1, and all 10 family-B margins report-only, and does_not_support the dynamics re-certification, projection (M6), revenue (M7), integrated scoring (M8), behavioral response, and benefit levels. The PR body stays inside this scope: it claims the 44-cell transport surface only, restates the report-only families as publishing-not-gating, carries the known-passable-surface and search-size disclosures, and makes no claim touching any does_not_support item.

Findings (all non-blocking; none affects the verdict)

1. Frozen-artifact self-description — the byte-copy constraint leaves the artifact misdescribing itself in four places: verdict.candidate = "w1_candidate3", verdict.gate_rule prose = "every GATED fingerprint reverses" (the demoted rule), and registration.comment_id/verdict.registration_pointer = null with "pending amendment-2 ratification (build only)" status — while the run is in fact the registered candidate 4 under the amendment-3 pair rule. A reader loading the artifact without PR/commit context would conclude it is an unregistered build-only c3 run whose verdict contradicts its own prose (family_c_pass: true with reversed_to_anchor: false). Both quirks were disclosed in the registration/PR/commit, and the contradiction is resolvable via gates.yaml — but the artifact is the frozen record. Recommend the record entry (or a runs/ note) carry a mapping annotation: gate_w1_candidate4_v1.json → registration 4964126356; candidate field = the c3 MODEL (byte-copy); operative family-C rule = amendment-3 pair scope. Do not touch the frozen artifact.
2. Registered-stream prose slip — "K=20 draws 9100+k" in the registration (inherited from c3's registration) does not name a stream the code consumes; the artifact's protocol block (5200/9200/9300) is the exact record. Worth folding into the same annotation.
3. "Two hunks" phrasing — the runner diff is two registered change classes across 4 unified hunks (the output name touches the module docstring, ARTIFACT_PATH, and schema_version/run). No unregistered change exists; suggest the record entry use the change-class wording.
4. No test pin yet — runs/gate_w1_candidate4_v1.json is not yet referenced by any test (prior candidates are pinned by tests/test_gate_w1_candidate{2,3}*.py). Expected at this stage — the record entry, grading, and pin are the orchestrator's acts — noted so it isn't dropped.
5. Scope of this verification — independent re-execution from the committed code with a fresh frame export, fresh generator fit, and fresh scoring in a fresh worktree, but on the same machine class as the original run (the sidecar's platform string matches this host). Cross-machine bit-identity was not part of the registered expectation and remains untested.

Verdict

VERIFIED-PASS (bit-exact). The claimed result — gate PASS on the amendment-3 surface, 5/5 seeds × 43/43 family-A cells, pair-swap realised, family-A cube bit-identical to c3 on all shared cells — reproduces exactly from the committed code under the registered protocol, the verdict adapter implements the live contract rule and was decisive as disclosed, the registration's pre-commitments were honored, and the no-self-rescue trail is intact. Per the standing addendum this PASS is now eligible for the record; the record entry, grading, and merge remain the orchestrator's acts.