draft: fixed-trace protocol and statistical planning

[bokelley]

Draft review slice A for #7292. Exact base: main at 712ddc6765c3f3942eb9c491c3a4497ddcd1abfb; exact head: 07c5b01dbeb46465421d12a7f296b0cf62b64051.

This head rebases the previously reviewed a2c2d2ca5f64528a66a79aa443845394098e7b40 range onto current main. Stable patch-id/range comparison is equivalent except for the requested removal of the unused judgeCells declaration; no A semantics changed.

Scope: planning/statistical declarations, corpus/pack identities, exact configuration-cell and architecture estimands, randomized-schedule declarations, multiplicity, and fail-closed budget/admission gates only. Files: fixed-trace-evaluation-protocol.ts, fixed-trace-experimental-design.ts, fixed-trace-partition.ts, fixed-trace-safe-snapshot.ts, and the two matching unit tests (+2486/-0).

Non-admitting: one immutable finalProtocol record binds every still-unavailable final artifact: sizing pilot, judge calibration, randomization/episode manifest, dated pricing cohort, E+M certificate/result, exact power, independent type-I verifier/signature, operations/missingness gates, and external custody/collision evidence. It is validated/fingerprinted as one record; no parallel confirmatory object remains. No dispatch, spend, production handler, canary, approval, or merge authority. Prospective API, tool, and simulator ceilings are null until sealed dated bindings exist.

Verification on this exact rebased head: 50 focused protocol/design tests; 62 neighboring fixed-trace-suite tests; TypeScript; and git diff --check all passed. Fresh independent review is required.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean fail-closed Addie eval-harness planning slice (+2494/-0, six new files).

Scope checked: Six new files under server/src/addie/eval/** plus unit tests. No protocol surface touched (static/schemas/source/**, docs/reference/**, dist/**), so no changeset required — correctly omitted. No oneOf/discriminator, immutability, or 3.1.x patch-eligibility concerns apply. Not a protocol-policy/breaking-class change, so no governance-precedent or breaking-change hard gate fires.

High-risk flag: true, but every reason is (added) — new files matching server/src/addie/**. New scaffolding matching a high-risk glob is not escalation-worthy on the flag alone (no (modified)/(deleted) entries, no medium-or-higher findings on a modified sensitive file).

Findings: Reviewer verified the largest file (fixed-trace-evaluation-protocol.ts): cell inventory self-check, priceId never throws at load, arm-call arithmetic matches pinned tests, hostile-input snapshot membrane rejects getters/proxies/cycles. Only a single non-blocking Low note (dead judgeCells at L556-563). No Critical/High/Medium findings.

Gates: gated_paths=false; no no-auto-approve team match; no prior decision. Decision table rows 1–8 do not fire → row 9 approve.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean pass, no blocking findings.

This PR adds only Addie planning/statistical declaration artifacts under server/src/addie/eval/** plus two matching unit tests (+2486/-0). No protocol surface is touched: no static/schemas/source/**, docs/reference/**, dist/**, or wire shape, so no changeset is required and none is missing. All new modules are dispatchable:false with explicit timeoutMs, retries:0, and caching disabled.

Reviewer verified fail-closed guards in selectFixedTraceScreeningSurvivors, consistent hybrid worst-case accounting, and the snapshot boundary in the largest file. Delta since the prior approve is the unused judgeCells removal plus a rebase.

High-risk flag is true only because new files match server/src/addie/**, but all matches are (added) — new files are normal scaffolding and not escalation-worthy on the flag alone (no (modified)/(deleted) entries). gated_paths is false. No no-auto-approve team match. review_decision is REVIEW_REQUIRED, but no hard gate applies (gated_paths false, no prose gate triggered by this non-protocol diff).

Decision table: rows 1–8 do not fire (no critical/high, gated_paths false, no deleted high-risk path, no medium findings, no team gate, prior decision was approve). Falls through to row 9 → approve.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean pass, consistent with the prior approve at 07c5b01.

This PR adds six new files (four source, two test) under server/src/addie/eval/ — Addie offline-evaluation planning scaffolding: frozen constants, structural validators, SHA-256 fingerprints, and a hostile-input snapshot membrane. All additions are new files; nothing existing was modified or deleted.

Checked:

• No critical/high/medium findings reported by the reviewer.
• No static/schemas/source/**, docs/**, dist/**, migrations, or wire/auth/transport surface touched — changeset absence is correct.
• Code is fail-closed by construction (dispatchable:false, status:"unavailable", null ceilings) with adversarial tests for proxies, getters, cycles, and forged digests.

High-risk flag is true, but all high_risk_reasons are (added) — new files matching server/src/addie/** are normal scaffolding and not escalation-worthy on the flag alone. No deleted/modified sensitive files, no medium findings, no author-team gate, and gated_paths is false. Rows 1–8 do not fire; falls through to row 9.