[MaxGhenis]

WIP. B0.2 per d1802 (Max 2026-10-21) and design revision 3 §3.1, §5.2 and §5.3.

This supersedes #554. It is #554's tree at 9a0ef5f4 as one commit on master fe5ab5ab. #554's branch history carries an early draft of the held-out registry file, which the registry's history check rejects. This branch's final tree touches no registry file.

What this will deliver

• One frozen record per gate (the ten §5.2 elements plus a named power procedure): B3, B3L, B4, I's observational timing gate, B5-empirical RET, B6a, B6b and J.
• J's joint estimands and numerical limits, for blinded ratification before B3 registers, with a J holdout independent of B2's evaluation data and B2's result recorded as exposed.
• A blinded review of prospective feasibility and power for the §5.3 limits.
• Pricing of the design's still-unpriced items (§3.3, Q13): the timing gate's data and loaders, HRS, linked withholding data, entrant initialization, B6b access, and the 2032/2050 extensions.
• B2's medians recorded as an open item (d1606).

Plan

docs/design/track_b_b0_2_plan.md:

1. Landscape lanes, with no counts.
2. A structural-audit protocol, reviewed by Sol, then frozen and hash-pinned before any count.
3. One-shot counts and power.
4. Per-gate records and questions for Max.
5. Reviews: Sol, the blinded feasibility review, and J's ratification.

This work is kept separate from the B2 successor design (d1659): neither lane reads the other's evidence (plan §2).

Status

• Plan
• Landscape lanes: the synthesis is docs/design/track_b_b0_2_landscape.md.
  • BEPUF 2020 is fully synthetic, so it cannot serve as an observed holdout.
  • The restricted linked-data decision is queued for Max as d1903.
• Protocol frozen

  • The protocol is docs/design/track_b_b0_2_protocol.md, status DRAFT. Its block is pinned at SHA-256 66cadfa4… (31af2b85… at 60d77cff, a92539b2… at c6aec979, 71e350ef… at 9b9d53f5).

  • Sol review rounds 1 to 3 asked for changes, and each was answered in the block before any freeze. Round 3 found that B0.1's exact public counts were not modeled, and that disclosures could empty the witness pool. B0.1's sets now enter the audit as exact counts, and an emptied pool reseeds or withholds.

  • The coordinator ruled that B0.1's sets may constrain the audit on conditions, which the block now states and the script meets:

    • a rerun gate before the audit;
    • a write boundary over every output path, failures included;
    • a defined decision record: each of this release's targets with its kind, unit type, sets, true size and final classification, and the class sizes. Nothing about the rounds is written;
    • a stated limit;
    • an invariant test on invented panels;
    • no precedent.

  • Since this PR opened: each program's limit is 300 seconds, up from 60, because round 3's 800-household rerun withheld on a loaded host when seed programs timed out (3fe9541d); warnings print nothing, since whether one fires and where can depend on the data; and an interruption, or a library's own exit, is reported like any failure, with no chained error (f9d6dc4c). Following the coordinator's rulings (74ed29be): the rounds are dropped from every output, and the committed provenance holds only the requested shape, fixed before any count, and hashes of inputs and code.

  • The coordinator then ruled that a stop counts as a decision, a withhold of the version (7f657916).

    • The next attempt is a new version, ruled on before it runs, that treats the stop as public.
    • A failure while reading the inputs or writing the files names its type and the script's line. One in the release prints only "B0.2 stopped in the release". The script's own raises keep their fixed messages.
    • Inside each phase, file descriptors 1 and 2 point at the null device, and every stream, the C library's included, is flushed before they are restored.
    • The stated limit names the run's total time, which no output writes or prints. The run is detached, with no wall limit, since the number of programs is bounded.

  • In place of a wall limit, the coordinator set three conditions on the run (60d77cff), since each program's limit is wall-clock time and any stop spends the version:

    • the script holds off sleep on its own process;
    • it starts only at nice 0, with the five-minute load below the CPU count;
    • an expected run time, extrapolated from the calibrations, goes to the coordinator before the freeze.

    Round 4's S2 replaced the first two with six run conditions checked before every program (below). The run prints nothing until it ends.

    • Three tests that had not yet run failed on their first run and were fixed in the tests (the block's preamble names them). The relabeling tests now include panels that release.

  • The count script scripts/track_b_b0_2_counts.py was built on invented frames. No count has run.

  • Evidence on invented tables is in docs/design/track_b_b0_2_evidence/: an enumeration oracle written apart from the integer programs, three searches over it, a calibration on invented panels, and the mutation runner, now with 93 specs. The build report is docs/design/track_b_b0_2_counts_report.txt.

  • Review round 4, at 60d77cff, approved the block and the script as they stand. It ran on an Opus 5.5 lane, since the Codex lanes were closed. Nothing is blocking. It asked for four test changes before the freeze, none of which changes the pin or the script. They are done in 80c5ab72 and 3747d0ee, and the count, review-root and exclusion test modules pass (322 tests):

    • main() runs under an audit hook in the relabeling tests, which refuses any write besides the run's outputs and any new process. The static check knows NumPy's, pandas', pickle's and shutil's writers.
    • A property test checks that the local copy is the same whatever rounds settled the targets.
    • Round 4's table, on which B0.1's exact household count withholds a small band's households, is now a test.
    • The Hypothesis relabeling swap is drawn between heads of different ages, and a draw that leaves the atoms unchanged is counted apart. In the first run, 14 of 16 draws changed the atoms and kept the decisions. Before, round 4 counted 41 of 60 draws swapping heads of one age, which leaves the atoms unchanged.

  • The coordinator ruled that round 4's other seven items also go in before the freeze, in one head with a fresh master merge. They are in 1f3b529c, on the master merge a3b62363, whose second parent 9967dfd6 is still master's head. (That merge's message names 51323bed in error.)

    • S1, the decision record: a target the round that ended the audit did not reach is unreached, whichever round that was, so the record no longer shows the round. Each class names the paths of this release's sets that hold it, in the release's order, and never B0.1's, even where a B0.1 set is the same set.
    • S2, the run's conditions: caffeinate is gone. Through ctypes, the script holds two IOKit sleep assertions in its own process, and reads the providing power source, the Darwin background priority and the main thread's QoS class.
      • Six named conditions (ac_power, sleep_assertions, nice, background, qos, load) must hold before the attempt record, or it refuses to start.
      • They are rechecked before every program, never during one. While one fails, it rechecks every 60 s and takes a lapsed assertion again. After 1,440 failed rechecks (24 h), it stops with the condition's name.
      • The QoS condition goes beyond round 4: on this host a CPU loop ran about a twelfth as fast under taskpolicy -c background, with niceness and the Darwin priority both 0.
      • As the coordinator then required (0f942549), qos holds only when the class is unspecified or the default or above, by two named constants, so an unknown class below the default fails. The block names the wait's constants (RECHECK_SECONDS, RECHECKS), the stop message is built from them, and a test runs the wait with a shortened bound and real sleeps.
    • S3: the exclusion test also builds a root with decoys that share basenames with B0.2's files, and requires each to be kept.
    • S4: a present row without its person or interview number, or a present person without a design stratum and cluster, stops the run while reading.
    • B1–B3: the committed status of a withheld release is among the audit's limits; the stop channel names the script's own checks; and running without a wall limit is stated to rest on the calibrations' timings, not on the program bound.

  • The mutation specs drop the five that targeted removed code, and add 20 for the new code plus round 4's four mutants, for 112. Round 4's four mutants are killed at 3747d0ee.

  • The count, review-root and exclusion modules pass at 1f3b529c: 359 tests. In the relabeling property, 14 of 16 draws changed the atoms and kept the decisions. At 0f942549, the 37 tests its change touches pass (run conditions, QoS, both bounded-wait tests, the static message check, the pin and the real-host reads); the full modules rerun with the evidence.

  • Round 5's first attempt, a Sol delta review at c6aec979, stopped before its report: the provider's content filter refused it after 1 h 38 min. Its draft found two gaps in round 4's items and two wording errors in the block, all fixed in 9322a0b6 (pin 71e350ef…):

    • S2's sleep assertions: the check counted an assertion that still existed as held, though its owner can set it to the off level, where it no longer prevents sleep. held() now requires the AssertLevel property to read 255, and an assertion that fails is given back before it is taken again. A macOS test sets a real assertion off.
    • T1's test confinement: it let a write into an existing __pycache__ folder pass, and did not see a database, the system log, a file's removal or metadata, a rename's source, or a socket before it connected. It now refuses each, with bytecode writing off while it holds, and the static check refuses the modules that could write past an audit hook (socket, sqlite3, syslog, mmap and others).
    • The block: the identifier check can fire on the real files, since the person-wave reader passes each wave's interview number through as read (the block said it never fires); and round 4's two 97-head status tables are described separately.
    • Two mutation specs cover the assertion fix, for 114. Master 7e050df5 is merged at c8d6dbb3; it changes no B0.2 file, nothing B0.2 imports, and not the tier file.

  • Round 5's second attempt (Sol, at 9b9d53f5) found all eleven items and those four fixes resolved, apart from one sentence: the block credited the reader's fixed-atom rerun's result (withheld at 0 to 2 heads) to the natural tables, which round 5 found withheld at 1, 2 and 7. Fixed in 3e169c74 (pin 66cadfa4…), with its three nonblocking suggestions:

    • a CoreFoundation ownership test for the host calls, which catches a properties dictionary left unreleased;
    • a design-stratum identifier case, which catches a stratum left out of the check;
    • name lookups refused by the test confinement.

    Two mutation specs cover them, for 116. Master 1ec57a5d (PSID income and wealth readers and field registry (D1a) #575, D1a) is merged at 226d844d. It adds two data modules and changes a birth-evidence script, tests and the tier files; nothing B0.2 imports.

  • Calibrations at 60d77cff on invented panels, with B0.1's sets registered:

    • 9,000 households release: 3,838 targets in 2,146 s of audit.
    • 800 and 3,000 households withhold, each on one narrow one-person class. B0.1's exact cuts leave such a class at 0 to 3, so the real run may withhold too.
    • The expected run time went to the coordinator.

  • Whether a class that B0.1's published counts already fix should still withhold this release is a methodology call, queued for Max. Nothing freezes until he rules. If an exemption is adopted, it comes with its own property test, a killed mutant and a stated condition.

  • Next:

    1. A delta review (round 5d) of 3e169c74 and the master merge, at 226d844d. APPROVED (Sol): the requested sentence is right, the only change between the markers, and both pins match; the ownership test catches all five ownership mutations tried; the stratum spec fails exactly the new case; the four lookups are refused; the merge changes nothing B0.2 imports; the tier arithmetic holds. No new findings: the block and script may be frozen as they stand.
    2. Master 444f970d (SM1: differential mortality by lifetime earnings, education and race (normalized within age-sex-year cells) #570 SM1, OP1: open-population harness around the sealed loop #566 OP1) is merged at e79f41b5. It adds the mortality_ses and open_population packages, and changes a birth-evidence script, its test and the tier files: no B0.2 file and nothing B0.2 imports. The B0.2 files and the pin are identical to 226d844d's.
    3. Evidence at e79f41b5, on the serial runner (one job at a time, one core, nice 10), with each program's limit at 300 s:

       • The B0.2 modules: 380 passed.

       • Calibrations on invented panels with B0.1's sets registered, as main() registers them: 800 and 3,000 households withhold, each on one narrow one-person class, as at 60d77cff. 9,000 households release: 3,838 targets (3,820 wide, 18 irrelevant) in 2,245 s of audit. No target took more than 31.5 s over all its programs, and no seed program more than 20.4 s.

       • The same two panels without B0.1's sets release: 800 households, 2,843 targets, all wide, in 276 s; 3,000 households, 3,112 targets, all wide, in 668 s. B0.1's sets are what makes them withhold. A diagnostic of which B0.1 sets pin the one-person class (a Sol review found it sound for this question) runs next on the same runner, for Max's ruling.

       • Mutation record: 113 of 116 specs killed. The three survivors were untested paths, not faults in the script. As the coordinator ruled, they are answered with tests only:

         • spec 37, the audit's use of the relations it registers between unit types: abbbf793 checks that with the relation a household class withholds, and without it releases;
         • spec 53, the B0.1 record check for a set with no published count: an earlier check fired first in every test, so 8a30da57 adds a case that only this check catches;
         • spec 66, the class sizes counting atom classes only: no test table had a difference that was not also an atom class, so 8a30da57 adds nested sets where one is.

         Each new test kills its mutant. The count script is unchanged (SHA-256 7ec6ee28…). The count module: 232 passed.

    4. Master 172f690f is merged at 1e3ff4d8. It adds OP1's report and the held-out registry's module, tests and record: no B0.2 file and nothing B0.2 imports.
    5. The full mutation record reruns at 1e3ff4d8, after the modules, on the same runner. Then one evidence commit: the calibration file, with each run's limit and sets (300 s with B0.1's sets now, 60 s without before); the rerun record; and the report's final-head section. Then a delta review of everything since 226d844d, and out of draft.
    6. Max's ruling. Then, if nothing blocking remains, a status-only commit freezes the block, and the script runs once.
• Exclusion inventory before any count reaches master
  • docs/design/track_b_b0_2_exclusions.json lists every B0.2 file, including the future counts and exposure inventory. Since round 4 it also lists the 12 files in docs/design/track_b_b0_2_evidence/, which round 4 found were left in blinded review roots.
  • It is a standing record in scripts/track_b_b0_1_review_root.py.
  • tests/test_track_b_b0_2_exclusions.py checks the record's exact list and requires every tracked B0.2 file to be on it. Since 3747d0ee, its name rule also catches any file in a folder named as B0.2's. Before, it checked basenames only, which is how the evidence folder was missed. Since 1f3b529c, a built root with decoys that share basenames with B0.2's files must keep every decoy.
• Counts (one run) and power (the power procedure waits on Max)
• Records and pricing
• Reviews and ratification

Invariants (stated in the protocol block, tested on invented tables)

• Size-blindness: before the withhold test, every solver program depends only on the publication and the frame's structure. test_audit_programs_depend_only_on_the_publication compares solver transcripts across tables that share a publication.
• Replay: a reader who knows the rule and reruns it on any vector with the same publication learns exactly the final constraint set, disclosures included. Checked by enumeration in docs/design/track_b_b0_2_evidence/search.py.
• Width: on a release, every sensitive target has two exactly verified feasible sizes at least 4 apart, so no range of fewer than five sizes holds every size it can take. Checked by the tests and by enumeration.
• This release's targets: which targets are this release's own, and their order, are the same whatever earlier sets coincide with them.
• Relabeling: swapping a death and a move-out so that B0.1's counts, this release's class sizes and the audit's decisions are unchanged leaves every byte the run writes or prints unchanged. One example where the atoms change, and a Hypothesis property.
• Write boundary: a stop, an interruption included, prints one line with no chained error. In the release, that line is a fixed text naming the phase. While reading or writing, it is a type and a line. The script's own raise adds its message, which a static test confines to paths and settings. Nothing printed inside a phase is seen, through Python, a file descriptor or the C library's buffers. Warnings print nothing.
• Provenance: the committed record's key set is exact, the geometry is the requested shape, and every hash in either file is of an input or code.
• One attempt: the run's six conditions are checked, and the sleep assertions taken, before the attempt record; they are checked again before every program, and a Hypothesis property checks that waiting out a failed condition changes no decision. The attempt record is written and flushed before the count; each output file is written to a temporary name, fsynced and hard-linked into place, and never replaces an existing file.

Tier counts change: unit 18,789 → 19,025 (+236) against master 172f690f, merged at 1e3ff4d8; total 25,595. The +236 is the earlier +233 and the three new test cases. CI's full collection passed the tier policy at 18,666 at 226d844d (+233 against master 1ec57a5d), and at 19,013 at e79f41b5. The README tier table matches. CI checks the counts, and they are recounted at the merge slot. Merging waits for a slot from the dynamics coordinator.

axiom: n/a: Track B design and audit records; no policy encoding.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
social-security-model	Ready	Preview	Oct 26, 2026 2:11pm UTC