BLACK-BOX INTERFACES / FINITE EVIDENCE

When can a new
interface be trusted?

Probe an opaque target. Track competing mappings.
Admit a plan only under an explicit evidence rule.

THE EXPERIMENT

ReferenceUnknown mapTarget

Acquisition sees target observations. The private audit checks the frozen decision afterward.

Synthetic finite-state benchmark

01 / CONFIGURELOCAL WORKER

Target family

Structural instance seed

Available for generated protocols. Selects target dynamics; label seeds repeat the same structural parent.

Label seed

Call budget (resets + actions)

Changes opaque labels and nuisance variation. It does not create an independent structural target.

Plan horizon

Benchmark split

Target engine

Candidate backend

Choose how the same finite model class is represented. Structural factor counts do not measure memory compression.

Probe policy

Admission rule

Calibration rule

Model-safe calibration checks every proposed probe against all surviving mappings. Its guarantee depends on the declared model and truthful anchors.

Allowed candidate fraction

Used by risk-controlled admission. A fraction of surviving candidates, uniformly weighted; this is not a calibrated probability of real-world harm. Zero requires consensus.

Deployment mode

Temporal adaptersInclude one-step latency

Recovery strategy

Simplex fallback behavior: single-step holding action vs multi-step return-to-initial (q0) trajectory.

Automated escalationClimb complexity if refuted

Provide output anchorsSemantic evidence

Controlled fault injectionFault type

Inject a synthetic fault to compare monitoring and recovery behavior. Semantic swaps can change hazards without changing raw observations.

Onset step

Fault phase

Zero-based onset: step 0 affects the first action. The counter restarts after each target reset. Select deployment, calibration, or both phases.

Stuck output symbol

Only used for stuck output: reference symbol 0–3, before opaque output labels.

Paired comparison using the current controls.

Scope & finite limits

These are synthetic finite machines. Candidate families assume input and output permutations, resets, stationarity, and a bounded planning horizon. A finite probe transcript cannot establish unrestricted semantic safety. Out-of-family and interface-error cases deliberately challenge these assumptions.

Target acquisition, source computation, and private audit costs are separate. Oracle admission is a privileged baseline.

NO EVIDENCE YET

Start with a controlled unknown.

Run a seeded case to inspect the reference model, surviving mappings, observations, and independently audited outcome.

01 Configure02 Probe03 Decide04 Audit

When can a newinterface be trusted?

Start with a controlled unknown.

When can a new
interface be trusted?