# PRE-REGISTRATION HALT GATE

**Status:** LOAD-BEARING -- this is the primary structural defense against definition-dependent audit verdicts.

---

## Why this gate exists

ProPublica's COMPAS audit and Northpointe's response produced opposite verdicts from identical data. Chouldechova (2017) proved mathematically that equal false-positive / false-negative rates across groups and equal positive predictive value across groups cannot both hold when base rates differ. The "audit result" is therefore a function of which fairness definition is binding, not only of the evidence. Selecting that definition AFTER seeing probe results is the canonical definition-dependent failure: any outcome can be rationalized.

The Local Law 144 empirical record and the NY State Comptroller's 17x delta reinforce the pattern -- audit regimes that permit post-hoc definitional choice systematically under-report real violations.

Pre-registration of the fairness / audit criterion BEFORE probes run removes this degree of freedom. The criterion hash is immutable for the run.

---

## Gate invariants

1. No defect probe may execute until the criterion is registered, timestamped, and hashed.
2. The criterion hash is written to the Evaluator Search Ledger at lock time and is immutable for the run.
3. Signal 3 of the 5-signal integrity inventory fires if the criterion is absent, ambiguous, or modified mid-run. Signal 3 is the ONLY signal that HALTS the run; other signals are first-class findings but do not halt.
4. A modified criterion mid-run does not "re-lock"; the run is invalidated and restarted under the new criterion. Probe results collected before the modification are discarded for the current verdict (they may be retained as diagnostic evidence for E9).

---

## Required criterion components

A valid pre-registered criterion names all three of:

a) Fairness definition -- one of: equal FPR/FNR; equal PPV; demographic parity; calibration within groups; individual-fairness counterfactual; or a named frame-specific criterion from `evaluator/references/audit-doctrine/FRAME_CRITERION_CATALOG.md`. Free-text "fair" or "equitable" is NOT sufficient.

b) Violation threshold -- the numeric or categorical threshold at which the criterion is deemed violated. E.g., "FPR difference > 0.10 across any protected-group pair" is valid; "significant disparity" is NOT.

c) Claim-type scope -- which RAM claim types this criterion binds. Quantitative, qualitative, methodological, synthesis: criterion may apply to a subset; the subset must be named.

Any of (a) / (b) / (c) missing or ambiguous -> HALT.

---

## Halt protocol

On halt:

1. Return CRITICAL finding to Audit Charter Lock (E6) with payload: `{run_id, missing_component: "a"|"b"|"c"|"multiple", charter_hash_attempted, timestamp}`.
2. Co-emit to Self-Audit Resistance Monitor (E9) the halt event so E9 can register that probes did not run (prevents silent under-report).
3. Do NOT probe.
4. Await E6's re-issued charter; re-enter Phase A from the top.

Halt is not a failure state for E5; it is the correct behavior. An E5 that probes under an ambiguous criterion is architecturally broken.

---

## Immutability enforcement

The criterion hash is computed over the canonical representation of (a), (b), (c) and recorded in the Evaluator Search Ledger. Any subsequent write to the criterion field during the run is detected by hash mismatch. On mismatch:

- The run is invalidated.
- A CRITICAL event is emitted to the Reopen Authority Enforcer (E7) flagging "probe-result leak into criterion re-registration" -- the classic post-hoc selection failure.
- E9 is informed so the mismatched run is excluded from self-audit statistics.

---

## Most fragile assumption

That the pre-registered criterion can always be specified with sufficient precision before the run. If Phase 3 / Phase 4 surfaces a claim type (e.g., exploratory qualitative synthesis) where criterion pre-registration is structurally impossible, this gate and the Blind-Spot Mapper design reopens. This is a first-class kill criterion, not a workaround to invent.
