bundle/v0/RUNBOOK.md

# Preparation runbook

From this lane directory:

```bash
python -m pip install --no-deps -e .
python -m loss_aware_dro_repro.cli validate-plan
python -m loss_aware_dro_repro.cli materialize-manifest --output .openresearch/artifacts/task-manifest.jsonl
python -m loss_aware_dro_repro.cli smoke --output .openresearch/artifacts/smoke/receipt.json
pytest -q
```

`smoke` is explicitly `TOY_DIAGNOSTIC` and cannot support C1-C3. Do not invoke the future conic runner until the clean environment, independent method implementation, reviewer quorum, exact config hash, and launch authority all pass.

Validate the clean matched artifacts without launching anything:

```powershell
& .venv/Scripts/python.exe -B scripts/validate_scientific_canary.py .openresearch/artifacts/scientific-canary-v14 --manifest .openresearch/control/scientific-risk-sensitivity-manifest-v4.json
& .venv/Scripts/python.exe -B scripts/validate_scientific_canary.py .openresearch/artifacts/scientific-canary-v15 --manifest .openresearch/control/scientific-risk-sensitivity-manifest-v4.json
```

Recorded identities `v3`, `v6-v7`, and `v10-v13` must not be relaunched. Earlier unexecuted `v8-v9` configs are superseded by the hardened evidence contract and must not be used.

Identities `v14` and `v15` ran exactly once from clean commit `8be5520` and must not be relaunched. Stopping-rule identity `v16` ran exactly once from clean commit `d912834` and must not be relaunched. Validate it with:

```powershell
$env:PYTHONPATH="$PWD/src"
& .venv/Scripts/python.exe -B scripts/validate_scientific_canary.py .openresearch/artifacts/scientific-canary-v16 --manifest .openresearch/control/scientific-convergence-manifest-v1.json
```

The receipt is claim-ineligible and must be interpreted as `paper_stopped_not_converged`.

Validate the canonical Appendix-routes bundle without launching anything:

```powershell
& .venv/Scripts/python.exe -B scripts/validate_appendix_canary.py .openresearch/artifacts/appendix-canary-v5 --manifest .openresearch/control/appendix-routes-manifest-v3.json
```

Appendix identities `v1`, `v2`, `v4`, and `v5` must not be relaunched. The earlier unexecuted `v3` config is superseded by the hardened contract and must not be used. Identity `v5` ran exactly once from clean commit `8be5520` and is bound by Appendix manifest `v3`.

Validate the independently regenerated hypergradient component artifact:

```powershell
$env:PYTHONPATH="$PWD/src"
& .venv/Scripts/python.exe -B scripts/validate_hypergradient.py `
  .openresearch/artifacts/validation/hypergradient.json `
  --config configs/hypergradient_validation_v1.json
```

The validator first verifies the adjacent SHA-256 sidecar and proves every bound scientific file against the base commit's Git tree and blob objects. In full mode it also checks the documented locked environment, including Clarabel and POT, reconstructs all 93 numerical gradient matrices from 882 retained scalar evaluations, checks all solver and transport residuals, and independently regenerates the full evidence payload. `--structural-only` explicitly does not perform regeneration. See `HYPERGRADIENT_VALIDATION.md` for the executed hashes and limits. This artifact validates the gradient oracle components only. It does not establish paper-scale C1 or convergence claim C2, so all scientific verdicts remain `HOLD`.

After paper-scale execution, evaluation requires three immutable inputs:

```bash
python -m loss_aware_dro_repro.cli evaluate \
  --results .openresearch/artifacts/raw/task-results.jsonl \
  --gradient-checks .openresearch/artifacts/validation/hypergradient.json \
  --proof-audit .openresearch/artifacts/validation/theorem-5.1.json \
  --output .openresearch/artifacts/evaluation/claim-verdicts.json
```

Missing, duplicate, unexpected, author-generated, hash-mismatched, or trace-free results fail closed.

## Precision follow-up gate

Do not run this gate from a dirty lane. First require a clean commit, the full test suite, and an independent implementation review. Planning does not launch work:

```powershell
& .venv/Scripts/python.exe scripts/run_local_batch.py plan-precision-followup `
  --manifest .openresearch/control/stopping-storage-precision-followup-v1/batch-manifest-v2.json `
  --receipt .openresearch/control/stopping-storage-precision-followup-v1/batch-plan-v2.json
```

Manifest `v1` failed closed because the lane was dirty and issued no task. It must not be relaunched. Manifest `v2` is the executed clean identity. The plan must project exactly 2,580 tasks, eight workers, zero external cost, denied external authority, task-list hash `c3d85274bac29c5f4a6b4d334a57459689fb17f7fd4b4dc6c9ae7529df855b`, and the frozen 5,400-second issuance gate. Only then run the exact planned batch:

```powershell
& .venv/Scripts/python.exe scripts/run_local_batch.py run `
  --manifest .openresearch/control/stopping-storage-precision-followup-v1/batch-manifest-v2.json `
  --output-root .openresearch/artifacts/stopping-storage-precision-followup-v2
```

Aggregation must report 2,580 validated successes, zero rejected tasks, no blocker, and `complete: true`:

```powershell
& .venv/Scripts/python.exe scripts/run_local_batch.py aggregate `
  --manifest .openresearch/control/stopping-storage-precision-followup-v1/batch-manifest-v2.json `
  --output-root .openresearch/artifacts/stopping-storage-precision-followup-v2
```

The executed aggregate is `sha256:65c51df2681e33ba1363341cd44bcfd8d094b8427cc599eb40ac6c1f95ae862d`, with 2,580 validated successes, zero rejected tasks, no blocker, and `complete: true`. Analyze it with:

```powershell
& .venv/Scripts/python.exe scripts/analyze_precision_followup.py `
  --manifest .openresearch/control/stopping-storage-precision-followup-v1/batch-manifest-v2.json `
  --output-root .openresearch/artifacts/stopping-storage-precision-followup-v2 `
  --aggregate-summary .openresearch/artifacts/stopping-storage-precision-followup-v2/aggregates/65c51df2681e33ba1363341cd44bcfd8d094b8427cc599eb40ac6c1f95ae862d/summary.json `
  --aggregate-results .openresearch/artifacts/stopping-storage-precision-followup-v2/aggregates/65c51df2681e33ba1363341cd44bcfd8d094b8427cc599eb40ac6c1f95ae862d/results.jsonl
```

The sealed analysis is `sha256:4b2009f94a968455b96ec3f7c0a618cb446d4f3c67ec610f86e0180097e2c3b6`. A second full analysis produced the same hash. The precision gate passed, but its only positive eligibility is `diagnostic_resource_estimate_eligible`. Claim, cost-freeze, and full-matrix-freeze eligibility remain false. C1, C2, and C3 remain `HOLD`.

## Checkpoint/resume canary

This canary is local, claim-ineligible, and limited to eight frozen tasks. It runs a
distinct-identity uninterrupted oracle, pauses the candidate after completed iteration
zero, and resumes the candidate in a fresh process. It compares canonical timing-free
scientific projections, including the production terminal post-update re-solve, as exact
bytes; it never uses a numeric tolerance. Immutable parent-launch and worker-process
receipts bind the observed PID plus a per-process UUID and nonce, and validation requires
the worker's OS-observed parent PID to match the parent launch binding, the parent-observed
worker PID to match the worker receipt, and the start and resume process instances to differ.

Run only from a clean committed lane after focused tests pass:

```powershell
& .venv/Scripts/python.exe -B scripts/run_checkpoint_resume_canary.py run `
  --config configs/checkpoint_resume_canary_v1.json `
  --output-root .openresearch/artifacts/checkpoint-resume-canary-v1
```

The same lifecycle may be inspected explicitly with `start`, `resume`, and `validate`.
`start` intentionally leaves eight resumable checkpoints. `resume` performs an all-task
preflight before authorizing any continuation. An orphan, tampered checkpoint, duplicate
event, elapsed monotonic time over 300 seconds, process-instance reuse, or same-identity
restart fails closed. Paid/remote compute, external inference, training, pushing, and
publishing remain denied. A pass does not authorize long-tail or full-matrix work and
leaves C1-C3 at `HOLD`.

The canary executed once from clean commit
`654bce052ee076f65a1a38f06fdae769afb35403`. Its manifest is
`sha256:559fe003a09b0b71457f125dc1fa42ff0c3e43aeb7907bbb5d987968c6853946`
and its immutable receipt is
`sha256:ae7f31368dc23426f43b9bd8e651596cd90b5020c861a89304337da9348a679d`.
All eight comparisons were exact bytes, all terminal post-update re-solves matched, and
the lifecycle finished in 37.203 monotonic seconds against the 300-second cutoff. A
second validation and an independent artifact audit passed without changing any of the
108 files. This pass still leaves C1-C3 at `HOLD`.