# Protocol amendment v1.1: preflight implementation clarifications

Issued on 2026-08-01 before formal mutation scoring and before any model/API
call. This document does not replace or erase frozen protocol v1. It records
preflight facts that must be fixed before confirmatory execution.

## Scope corrections discovered mechanically

- The pinned tau2 revision contains 130 Airline/Retail tasks satisfying the
  implemented public-write-action rule, not the planning estimate of 168.
  Formal enumeration must use the code-derived 130 and report the discrepancy.
- The current ToolSandbox fixed-state materializer supports 54 original,
  unaugmented scenarios with persistent-state constraints. This is a preflight
  implementation catalog, not yet a claim that all 54 pass final task
  eligibility or that no additional original scenarios can be supported.
- AppWorld preflight selection scans deterministic SHA-256 order over public
  train/dev task identifiers and retains tasks whose protected validation
  solution produces a non-supervisor persistent database change. Protected
  solutions and evaluation contents remain local and are never logged in
  plaintext.

## Windows compatibility and reproducibility

- AppWorld 0.1.3.post1 uses a POSIX `SIGALRM` timeout in its task verifier.
  On Windows the adapter invokes the same evaluator with
  `timeout_seconds=None`, redirects AppWorld/IPython caches into the project,
  and forces UTF-8 console I/O. The evaluator logic is otherwise unchanged.
- ToolSandbox fixture timestamps are generated relative to wall-clock time.
  Replay hashes normalize each timestamp field to its within-namespace origin,
  retaining relative intervals and ordering. Official evaluator inputs and
  scores are not normalized or changed.
- ToolSandbox's environment uses `networkx==3.3` instead of declared 3.2.1 and
  `ccy==1.4.0` instead of declared 1.3.1 because the latter pinned package was
  unavailable. These deviations require sensitivity checks before formal use.

## Preflight evidence

- tau2: 20/20 accepted; deterministic replay passed.
- ToolSandbox: 19/20 reached exact score 1.0; the remaining task scored
  0.9484251274 because two alternative-looking answer constraints are combined
  by the pinned evaluator. This failure is retained. Twenty of 21 scanned
  scenarios had an actual persistent change.
- AppWorld: 20/20 accepted; deterministic replay passed.
- Every stored preflight record reports zero model/API calls and zero paid cost.

These facts pass the runtime portion of the preflight. They do not pass the
separate frozen requirement for a blinded manual audit of 30 generated mutants.

## Frozen blind-audit packet

The outcome-blinded packet contains 30 items, exactly 10 per benchmark: 22
`required_revert` harmful candidates and 8 `json_object_order` benign
candidates. It hides source task identifiers, source hashes, validation
solutions, evaluator scores, rewards, and evaluation hashes. Its deterministic
SHA-256 packet hash is
`65d9b0a1997c7dcb8c9aee2ad331c285960be5c05ac649ae7e20efee2dee375f`.
The complete-preflight gate remains false until a human reviews all 30 items
without opening the source key and at least 27 are marked valid.
