[MaxGhenis]

The dynamics coordinator made one registry of held-out data the record for every Track B gate and every open-population gate (2026-10-21). Several lanes will cite it, so it lands on master on its own, outside B0.2's draft (#554).

What it adds

• docs/design/track_b_holdout_registry.json, schema track_b_holdout_registry.v1.
  • Five historical imports, each verified at a line of gates.yaml, b2.py, disability.py or epuf.py, with scored evidence identified by gate:
    • H001 gate_m6: PSID waves 2015–2023;
    • H002 B2: PSID waves 2013 and 2015;
    • H003 gate_epuf_fill: EPUF 2006 TEST;
    • H004 gate_m4: the PSID employment-status panel and DI ASR 2023;
    • H005 gate_w1: Supplement 2023 §6.B, DI ASR 2023 table 19, Census HH-4 and AD-3 2023, the 2024 frame and the Mermin–Smith anchors.
  • Six disclosed pairs: four shared units (H001–H002, H001–H004, H002–H004, H004–H005) and two unresolved relations (H003–H004 and H003–H005: whether the 2023 DI ASR and Supplement tables report data years EPUF 2006 also covers).
  • complete: false until B0.2's exposure inventory (docs/design/track_b_b0_2_exposure_inventory.json) exists.
• src/populace_dynamics/track_b/holdout_registry.py: the rules and four controlled lists, each changed only by a reviewed code change:
  • the source vocabulary (SOURCES);
  • the registrations outside gates.yaml (REGISTRATIONS_OUTSIDE_GATES_YAML);
  • the scored runs (SCORED_RUNS), each pinned to its gate and the SHA-256 of its bytes;
  • the authorized historical imports (HISTORICAL_IMPORTS), each binding one entry id to its gate, unit keys and scored runs.
• Tests:
  • tests/test_track_b_holdout_registry.py, unit tier, 109 tests: invented registries and temporary git repositories, with an independently specified family map, overlap rule and transition table.
  • tests/test_track_b_holdout_registry_committed.py, artifact tier, 10 tests: the committed registry against the committed tree and its pinned runs/ artifacts, its base commit, a pull request's own commits, and, on pushes, every first-parent commit since the base.
• scripts/first_estimates_birth_evidence.py: the birth-evidence seal excludes the new module, as it does b2.py. Nothing in the historical projection imports it.

Invariants (hold for every registry and every commit)

1. Schema and types. The schema is track_b_holdout_registry.v1. Every field has its type, and dates are real. Malformed input, including appended entries, is reported, never raised; this is property-tested and was fuzzed with 5,000 cases.

2. Controlled vocabulary. The registry's sources equals the module's SOURCES, so adding a source or family is a reviewed code change. Catalog references are unique, which refuses aliases. Every unit key names a declared source. The key year means what the source declares: for PSID, the interview wave; for EPUF, the vintage in its title; for publications, the edition.

3. Overlap. A key is source:years[:scope...]. Two keys share a unit when the source is the same and the years intersect; scope never narrows that.

4. Disclosure. Live entries that share a unit list each other in disclosed_overlaps. Disclosures are symmetric, never self-referential, and name only known ids. An unresolved relation is also disclosed.

5. Family review. An entry reviews every earlier live entry of the same family that it neither shares a unit with nor discloses. A review has outcome disjoint, a substantive reason (at least 40 characters, no placeholder words) and citations: path:line within a committed file, or an https URL.

6. Provenance and status.

   • A registration starts as a lone candidate. Against the base, a new registration must arrive alone and move on only in a later commit. Its scored run's exact bytes must not have been committed, at any path and whether or not they were later moved or deleted, in the history of the commit that first records the entry on the first-parent chain (git log -m --find-object). When git cannot answer, or the clone is shallow so an empty search proves nothing, the check fails closed; replacement refs are ignored.
   • A historical import starts as used, and its id, gate, unit keys and scored runs must equal an authorization in HISTORICAL_IMPORTS. A second import under another id, or one claiming other units or runs, is refused. B0.2's inventory adds an import, or a correction to one, as a new authorized entry in a reviewed code change. Imports close once the base registry is complete.
   • Transitions run only candidate→frozen→used and candidate/frozen→withdrawn, and status is the history's last status.

7. Used means scored. Each scored_evidence item is {path, field, equals}.

   • The path is a scored run listed in SCORED_RUNS for the entry's gate. Its bytes are read from HEAD's tree (not the working tree, not a symlink) and must match the pinned SHA-256. Floor builders, candidate lists and dry runs are not listed, so they cannot stand as scored evidence, and a pathname cannot be reused for other content.
   • The field is gate, gate.name or registration_id, and its value equals equals.
   • equals must identify the gate in gates.yaml (key, id or registration_id) or in REGISTRATIONS_OUTSIDE_GATES_YAML.
   • Each identifier belongs to one gate only.

8. Append-only. This holds against the base commit; between a pull request's own consecutive commits; and, on pushes, between every pair of consecutive first-parent commits since the base, where each snapshot is also validated against its own commit's tree. A newly created registry is admitted against an empty one.

   • Base entries stay as a prefix, in order.
   • id, provenance, gate, lane, source, units and unit_keys never change.
   • gate_identifiers, evidence, scored_evidence, disclosed_overlaps, overlap_review and history only extend. Rules only extend.
   • Declared sources never change.
   • complete never goes back to false.

   The base is chosen as follows:

   • on a push, the event's before commit;
   • on a pull request, the merge base with origin/$GITHUB_BASE_REF;
   • otherwise, the merge base with master;
   • and when that merge base is HEAD, HEAD's first parent.

   In CI, an unresolvable base fails the test.

9. Incomplete flag. complete: true requires the completion record to be committed.

Merge with a merge commit. This PR and every later registry PR must merge with a merge commit, never a rebase, so draft commits never enter master's first-parent history (registry rule 7).

Known incompleteness. Legacy gates gate_1, gate_2, gate_2b and gate_2c have committed scored outputs that are not yet imported. B0.2's exposure inventory imports each or records that it holds out nothing a Track B or open-population gate could use; the registry stays complete: false until then.

What the rules cannot catch mechanically. The timing rule sees scores committed to this repository, not scores computed elsewhere; gates.yaml preregistration and issue #42 cover that. The overlap rule cannot see two sources sharing underlying data, or two editions reporting the same data years; family reviews and disclosures cover that, and reviewers of each registry change must check them. Vocabulary changes are code changes, reviewed as such.

Verification

• Tests: PYTHONPATH=$PWD/src:$PWD python -m pytest -q -p no:cacheprovider tests/test_track_b_holdout_registry.py tests/test_track_b_holdout_registry_committed.py tests/estimates/test_birth_evidence_artifact.py gives 130 passed and 2 skipped. The skips are the pull-request-commits test (pull request events) and the first-parent history test (pushes).
• Lint: Black 26.5.1 (-l 79) and ruff check are clean.
• Mutations: 70 of 70 killed, one per rule. The record is docs/design/track_b_holdout_registry_mutations.json.
• Tiers: after merging master with Track B G v2: close #495, compute five refused configurations, one contract across G, R2 and R3 #530 (d5dfef9b), unit 18,088 → 18,197 and artifact 4,253 → 4,263, for a total of 24,738, recounted with pytest --collect-only -m <tier>. Track B: held-out data registry for every Track B and open-population gate #560 takes the tier slot after Track B G v2: close #495, compute five refused configurations, one contract across G, R2 and R3 #530, so the counts are rechecked again at merge.

Review history:

• Round 1 asked for changes (one high, five medium, one low), answered in c299a304.
• Round 2 asked for changes (six medium, one low), answered in 9e3c6a4c.
• Round 3 asked for changes (five medium, two low), answered in 296bf2bb.
• Round 4 asked for changes (two medium, two low), answered in 5f7d995d. The reviewer's own counterexample scripts, replayed on that commit, are all refused.
• Round 5 asked for changes (one medium, three low) at d5dfef9b, answered in the next commit: shallow clones fail closed, merge-resolution and replacement-ref topologies are tested, subprocess failures are reported, and SHA-256 ids are accepted.

No real data is read, and nothing in gates.yaml, engine/ or runs/ changes.

axiom: n/a: Track B audit infrastructure; no policy encoding.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
social-security-model	Ready	Preview	Oct 24, 2026 3:54pm UTC

[MaxGhenis]

Merge audit (coordinator, 2026-10-24 17:08Z): merged at head 77b5bc31 with --match-head-commit, merge commit 097d3cb4.

• Independent review: round 7 (GPT-6.1 Sol) returned APPROVE at 404a7ee6. Both round-6 findings are resolved in substance, with executed evidence. Two low findings remain, neither blocking. First, no regression test covers an unset GITHUB_EVENT_PATH: a mutant that drops TypeError handling at holdout_registry.py:1187 survives, though production raises LookupError correctly. Second, two pytest IDs in the mutation record (check 73) are truncated; the mutant itself is killed. The review also read the remerge diff and found it only removes conflict markers.
• The delta since the review is the single merge commit 77b5bc31, whose parents are 404a7ee6 and master f8ffc7d9. The coordinator checked it mechanically:
  • git merge-tree --write-tree 404a7ee6 f8ffc7d9 conflicts only in tests/tier_counts.json and tests/README-tiers.md.
  • The head's tree differs from the automatic merge only in those two files.
  • Both carry the recount: unit 18,254 and artifact 4,271, with the other tiers unchanged, for a total of 24,803.
  • So the delta is master's own content plus the recount, the same pattern accepted for U2 §20 steps 4–6: record the step-4 pass, materialize the final parameter block and rulings record, ratify by merge #556.
• CI: gh pr checks exited 0 at 77b5bc31 (11 passed, 1 skipped), the tier-count check included.
• State: MERGEABLE, not a draft, no CHANGES_REQUESTED review.
• Body and diff: a data-terms grep of the body and the diff f8ffc7d9...77b5bc31 found no matches.
• Tier slot: released. The next queued PR recounts against master 097d3cb4.