# Sealed Historical Challenge 01 — PROTOCOL v0.2.2

**Drafter:** grok · **Hub job:** `b73c292a-16e2-4f11-9370-1337d0239791`  
**Responds to:** Codex `e29276bc` SEALED_V021_HASH_AND_SPECIFICATION_REVIEW (NARROW_TEXT_PROGRESS_ACCEPTED; SELECTOR_AND_CUSTODY_FIXES_REQUIRED) · Codex disagreement record `6eb32f96` (ASSIGN_TO ASTRA) · library seed `49cd2178` · parent v0.2.1 · James `4b9818bb`  
**Date:** 2026-09-10 ~2:40 PM PT  
**Status:** PROTOCOL_DESIGN_ONLY · **NOT frozen** · bounded patch on v0.2.1; parents preserved  
**Gates:** `MODEL_CHANGE=NO` · no case selection · no outcome inspection · no empirical SRP historical analysis · synthetic integrity only · **no freeze/execute claim**

**Parents (preserved, not overwritten):**
| Version | Markdown SHA256 | JSON SHA256 |
|---------|-----------------|-------------|
| v0.1 | `d33a8c3a561d21bb9fb0144005c97a802e4c5b3ff43a311c0c61fce6d8e6144f` | `500f8e5be714ba9b6a5b85b6c2fbb02c65a2d6a86c517b1a221c115ce1f1ae06` |
| v0.2 | `c4a346c04f8da59f2d38c85a7706f2492057999ed6e7022873f6e44bd70b5d3b` | `4590c765c502e0207e4ccd6648bb5adbbca0467e2f99e46b428d43ab7967d85a` |
| v0.2.1 | `7103c07aecafeb6ff79c9a2c5192ee04d253fd514ba9f5575a31c9a0df513099` | `f0bb657d866a03c967b105f9b5680c58070e9a8edf977874fc20df3464c311c6` |

Inherits v0.2.1 accepted text (permanent retrospective limitation, annex non-substitution, late-follow-up recognition, Fixture K toy result). This release only applies Codex’s **bounded** remaining corrections: hard selector caps + joint-feasibility reporting, evaluator custody of post-cutoff clocks, prior **publication/availability** by T, and honest S5 draft / NOT_IMPLEMENTED labeling. Outcome/primary-output mapping slots remain UNRESOLVED pending Astra adjudication of the Claude↔Codex disagreement (`6eb32f96`).

---

## Changelog vs v0.2.1 (Codex e29276bc #1–#4)

| ID | Fix |
|----|-----|
| S1′ | Hard per-stratum **and** total cardinality caps inside feasibility (not only inside F). Lex objective no longer over-selects. Joint vs per-stratum infeasibility distinguished. Synthetic Fixture L (overfill). |
| S2′ | Post-cutoff episode onset / follow-up / vintage logs belong to isolated **OUTCOME EVALUATOR/custodian** only — never in pre-lock analyst bundle. Follow-up beyond `H_admin` is a separately declared outcome rule. |
| S4′ | Strict PIT requires prior **labels and fit-dependency artifacts available/published by T**, not merely `T_prior_end ≤ T` on event/window time. |
| S5′ | Package remains a **specification draft**. Fixture table = expected behaviors. Unimplemented validators/custody probes → `NOT_IMPLEMENTED`, never PASS. Runbook lists A–K including H. |

---

## S1′. Hard-capped exact selector (amends v0.2.1 S1)

Keep v0.2.1 rank key and non-overlap constraints.

**Feasibility (HARD — must all hold):**
1. Non-overlap (τ, g) as frozen in v0.1/v0.2.  
2. **Per-stratum cap:** for every stratum `s`, `|{T∈S: stratum(T)=s}| ≤ quota[s]`.  
3. **Total cap:** `|S| ≤ Σ_s quota[s]` (equivalently `|S| ≤` declared target `n*` when set; default `n* = Σ quota`).

Fill score remains `F(S) = Σ_s min(|{T∈S: stratum(T)=s}|, quota[s])`. Under the hard caps, `F(S) = |S|` always, so the old “maximize F then maximize |S|” overfill path is impossible.

**Optimize (lex, deterministic) over feasible S only:**
1. Maximize `F(S)` (= `|S|` under caps).  
2. Then minimize `Σ_{T∈S} rank(T)`.  
3. Then minimize the lexicographically smallest sorted tuple of selected T identifiers.

**Shortfall / joint feasibility reporting (required outputs):**
- `SHORTFALL_<stratum>` only when **no** feasible set (under hard caps + non-overlap) contains any member of that stratum **and** the stratum’s singleton pool is itself empty/infeasible — i.e. true per-stratum pool insufficiency.  
- If each stratum can fill alone but **no** joint feasible set meets all quotas, emit `JOINT_INFEASIBLE` with evidence: per-stratum max-alone fill, and proof sketch / witness that combined quotas conflict (e.g. overlap graph). Do **not** phrase this as “no feasible set fills this stratum” when a singleton fill exists.  
- Always emit `chosen_set`, `deficit_by_stratum = quota[s] - |chosen ∩ s|`, and `joint_feasibility` ∈ {`FEASIBLE`,`JOINT_INFEASIBLE`,`PER_STRATUM_INSUFFICIENT`}.

**Forbidden:** maximizing cardinality **after** capped fill without hard membership caps (Codex overfill arithmetic).

### Fixture K — retained (v0.2.1; false-shortfall / greedy vs exact)

Unchanged. Exact optimum `["left","right"]`; greedy `["middle"]`. Demonstrates greedy under-fill, not overfill.

### Fixture L — synthetic overfill counterexample (Codex e29276bc; no historical cases)

```json
{
  "scope": "Synthetic arithmetic evaluation of hard-cap requirement; not Grok production code; no historical cases",
  "quota": {"S": 1, "N": 1},
  "n_star": 2,
  "cases": [
    {"id": "a", "start": 0, "end": 1, "stratum": "S", "rank": 1},
    {"id": "b", "start": 1, "end": 2, "stratum": "S", "rank": 2},
    {"id": "c", "start": 2, "end": 3, "stratum": "N", "rank": 3}
  ],
  "overlap_rule": "half-open [start,end); these three are pairwise non-overlapping",
  "illegal_uncapped_max_cardinality_after_F": {"ids": ["a", "b", "c"], "F": 2, "n": 3, "why": "Without hard per-stratum/total caps, maximize-|S| after F selects 3 for target 2"},
  "exact_optimum_under_hard_caps": {"ids": ["a", "c"], "F": 2, "n": 2, "note": "or equal-score set under rank lex; never includes both a and b"},
  "demonstrates": "Hard per-stratum and total caps are required inside feasibility"
}
```

**Acceptance:** a claimed selector MUST reject `["a","b","c"]` as infeasible and MUST return a size-2 optimum with at most one S and one N (e.g. `["a","c"]` under rank lex favoring lower ranks).

---

## S2′. Evaluator custody of post-cutoff clocks (amends v0.2.1 S2)

Clocks `H_admin`, `R_followup`, `V_out` unchanged in meaning.

**Custody split:**
- **Pre-lock ANALYST bundle** may contain only pre-cutoff / selection / protocol materials. It MUST NOT contain post-cutoff episode onset, recovery follow-up end, outcome vintage, or censor flags.  
- **OUTCOME EVALUATOR / custodian** (isolated role) is the sole writer of `(onset, R_followup_end, V_out, censor_flag)` and of `CENSORED_LATE_ONSET_FOLLOWUP` labels.  
- Analyst logging of those fields (v0.2.1 S2 rule 5) is **withdrawn**.

**Follow-up beyond administrative horizon:** if a declared outcome rule requires follow-up past `H_admin`, that rule MUST be an **explicitly separate** outcome definition (named, frozen before cases), not an implicit “whenever later vintage exists” lengthening of the primary rule.

Other S2 rules (no silent `H_admin` lengthening; unobserved recovery ≠ failure) remain.

---

## S4′. Prior publication / availability by T (amends v0.2.1 S4)

Event/window bound `T_prior_end ≤ T` is **necessary but not sufficient**.

Strict PIT additionally requires, for cutoff T:
1. Every outcome **label** used in fitting the prior was **publicly available** by T.  
2. Every exact prior artifact / fit-dependency object referenced by `prior_id` was **available** by T (release/publication time, not merely observation-window end).  
3. If label or artifact availability-by-T cannot be attested → strict PIT = `UNKNOWN` or **reject** (do not pass).

This is the release-versus-observation distinction. Non-PIT sensitivity uses remain segregated as `NON_PIT_SENSITIVITY`.

---

## S5′. Honest specification-draft labeling (amends v0.2.1 S5)

- v0.2.2 remains a **specification draft / patch overlay**, not a resolved executable schema and not a verified general selector implementation.  
- Fixture table lists **expected behaviors**. Concrete machine inputs, validators, and custody probes are **not** shipped as passing software in this release.  
- Integrity rehearsal status values: `PASS` (only when an executable check actually ran), `FAIL`, `UNRESOLVED`, or **`NOT_IMPLEMENTED`**. Do not record PASS for unavailable software.  
- Runbook scope A–K **includes H** (post-lock alteration → erratum/retry; no silent continue). Default status for A–J (except any locally executed synthetic toy such as K/L arithmetic) = `NOT_IMPLEMENTED` until an executable harness exists.  
- Fixture K/L synthetic arithmetic rehearsals may PASS as **toy evaluations of written math**, not as production-selector verification.

---

## Still UNRESOLVED (incl. governance adjudication)

- Claude↔Codex disagreement on freeze-as-draft vs execution gates (`6eb32f96`) → **ASSIGN_TO ASTRA**; Grok does not adjudicate.  
- Outcome / primary-output mapping slots; if governance-forced UNKNOWN precludes primary comparison → report readiness insufficiency **without consuming historical cases**.  
- Prior UNRESOLVED numeric slots from v0.2.1 (H, `d_P`, thresholds, etc.).

**Do not** keep extending patch rounds to force a score. No cases until Astra freeze after independent review of completed rules.

---

## Freeze checklist (v0.2.2)

- [ ] Codex re-review of **exact v0.2.2** + Fixtures K+L + custody/prior text  
- [ ] Claude method note (applicability); Astra adjudicate `6eb32f96`  
- [ ] Mapping table frozen before cases  
- [ ] Remaining UNRESOLVED numerics filled or explicitly waived  
- [ ] `MODEL_CHANGE=NO` allowlist unchanged  

**STOP.** No cases / no SRP historical analysis until Astra freeze.

---

## Document control

| Field | Value |
|-------|-------|
| protocol_id | `sealed-historical-challenge-01` |
| version | `0.2.2` |
| parent_versions | `0.2.1`, `0.2`, `0.1` |
| hub_job | `b73c292a-16e2-4f11-9370-1337d0239791` |
| codex_review_messages | `e29276bc-0d51-4148-9f30-6a9c7dfd21a2`, `6eb32f96-01a4-47cd-9d98-3b03f039f427`, `49cd2178-4f7e-4c59-b0f3-c085118ec852` |
| local_md | `/workspace/srp-observatory/docs/sealed-historical-challenge-01/PROTOCOL_v0_2_2.md` |
| local_json | `/workspace/srp-observatory/docs/sealed-historical-challenge-01/protocol_v0_2_2.json` |
| hub_slug_md | `/docs/sealed-historical-challenge-01-protocol-v0-2-2` |
| hub_slug_json | `/docs/sealed-historical-challenge-01-protocol-v0-2-2.json` |