Corpus updates

Section 8 of 22

F2 changes the collection of test inputs and expectations. Record code changes and corpus changes separately even when they belong to the same fix. A correct implementation can expose a mistaken test, so changing an expectation is allowed when its policy reason is explicit.

Step	Work and depth	Required actor, evidence, and transition	Failure or wait
T01. Submit	S + C, none	Contributor supplies case inputs, expected results, policy references, provenance, and requested payment if any. Controller authenticates the submission.	Incomplete cases return for correction. Private material without permission cannot enter the public corpus.
T02. Classify	C with conditional J, targeted	Controller identifies new coverage, duplicates, removals, relaxed thresholds, or changed expectations. Maintainer accepts any funded scope through F6.	Duplicate coverage can be rejected or credited only for additional value. Unclear policy moves to T03.
T03. Validate expectations	C with conditional J, targeted or full	Corpus authority checks schema and reproduction. The assigned council decides new or disputed expectations against the policy. Record a case decision.	A mistaken expectation returns to T01. New policy meaning branches into F9 before operative use.
T04. Freeze for testing	X + C, targeted	Corpus executor records an immutable proposed version and candidate-use permission. Runner evaluates its cases against relevant verifier versions.	An actual production-policy failure starts F4 or F5. Missing evidence enters F10.
T05. Open challenge	O, targeted	Controller publishes accessible case evidence and the proposed effect. For a coupled update, use U11. Otherwise open the corpus activation window.	C01 through C05 handles qualifying objections. Unavailable evidence stops the access clock.
T06. Authorize activation	C, targeted	Controller checks accepted expectations, complete required evidence, applicable policy, and no unresolved blocker after the valid window.	Material changes repeat relevant validation and challenge opportunity. Unresolved cases close without activation.
T07. Activate	X + C, none	Authorized executor updates the canonical corpus reference and confirms it. Coupled changes activate with the identified release.	Reconcile an uncertain write. Do not announce a version active merely because the job was submitted.
T08. Record completion	C + X, none	Controller preserves case attribution, old corpus versions, and accepted payment milestones.	Payment failures continue in F6 without undoing the accepted case history.

A standalone corpus version can govern future candidates while production continues under its recorded release history. It does not retrospectively claim that an older release passed new tests. If the new case demonstrates an existing policy violation, treat that finding on its merits through the defect or incident flow.

The public and held-out portions of a corpus both need versioned expectations and a permitted evaluator. Members must receive enough evidence and access to exercise the promised challenge right. Where a private exploit prevents ordinary disclosure, the policy must identify confidential access or authorized reproduction and how the case can be challenged. Do not count a nominal public window when its essential evidence is inaccessible.

An embargo temporarily withholds exploit details while the DAO contains a defect. Record who can access the evidence, what ends the embargo, the maximum withholding period, and who can authorize an extension. A retained private reproduction copy and public disclosure are separate decisions. Publish a sanitized regression case when its disclosure conditions hold.

Confidential case examination

Use a published confidential examination rule for held-out or embargoed cases. Commit to each case's input, expected result, policy reference, and a random secret value before the candidate evaluation. Including that secret value makes guesses about a short hidden input harder to confirm from the public hash. Keep the exact package available to the authorized evaluators and record the commitments in the corpus version.

The public record supplies the relevant policy, a sanitized account of the behavior, evaluation method, observed result, case commitment, and any limits on public reproduction. Members and founding participants can submit counterexamples or challenge the policy interpretation through C01 without receiving all hidden inputs.

Before U11, assign a confidential examiner separately from the case author and original decision-maker. The examiner must be able to inspect the committed inputs and reproduce the disputed result against the exact candidate. It returns an authenticated case decision with a public explanation and restricted evidence where disclosure remains unsafe. Its qualification and appeal rules follow the ordinary scoped council process.

This provides a narrower public challenge right than disclosure of every case. Publish that limitation. Do not claim a commitment alone lets the public verify the expected result. During founding operation, separate assignments can remain under one operator, so confidential examination is not proof of independent institutional control.

If required confidential access or reproduction capability is unavailable, the confidential requirement remains incomplete and the applicable challenge clock stops. Define the access class when accepting the case, before its result is known. A maintainer cannot conceal a failed public case by changing its access class during the release.

Rotate exposed holdouts and budget fresh variants. Disclosure follows the exploit and credential-exposure rule, not automatic reveal on activation. An unresolved live exploit can still make publication unsafe after a new version is deployed. Retain the separate embargo deadline, extension authority, and sanitized-publication obligation.