Frozen canonical requirements baseline. This is the single canonical document that states what a solution to the EA problem must address and how its underlying hypotheses are assessed. Its S1–S14 / T1–T4 / H1–H6 / KPI semantics are frozen at this baseline while vNext review is open. Proposed semantic changes are reviewed in the linked delta before any later explicit versioned promotion; editorial routing/link updates do not alter this freeze. It does not define a product, implementation, benchmark result, standards adoption, or a claim that EA or another candidate has passed.

Terminology clarification — no semantic change. The S1–S14 items are referred to in the current corpus as canonical requirements. Earlier documents may use the historical label “challenges” for the same S1–S14 IDs. This naming change does not alter any S#, T#, H# or KPI semantics.

Requirements vNext review is open — the frozen requirements themselves are unchanged. The current cumulative working review is Requirements vNext Review & Delta v0.1 Draft. It records post-freeze corpus evolution, including the two additional 00G/00H reference failure scenarios, and tests whether that material exposes a genuine requirement gap or only architecture/conformance/evidence deltas. Its current recommendation remains not to create S15+, T5+, H7+ or a new canonical KPI family. This document remains the frozen canonical Requirements until an explicit versioned successor is deliberately promoted.

Freeze status: public frozen canonical requirements baseline for the current review cycle. It applies to a human-led process, conventional control system, agentic architecture or composed system, within its declared decision scope, authority, evidence boundary, response horizon and resource envelope. Post-freeze changes are reviewed through the linked vNext delta rather than inserted here.

The canonical reading sequence is:

1. Foundation — 01: why an open ecosystem, bounded representation and residual indeterminacy matter.
2. EA principles and controls — 02: how determinate, unresolved, obtainable and structural-residual state must be handled.
3. This document: the complete S1–S14 requirement set, the sufficiently-good conditions, the research hypotheses and their KPIs.
4. Topology and architecture, then functions and interfaces: how EA is proposed to meet the requirements.

The DAOS source case uses T0 → T1 → T2: a basis is established, a commitment relies on it, and a material condition changes or becomes insufficiently established. In this document, T1–T4 are condition identifiers, not those case times.

Bidirectional provenance and reference-scenario application. DAOS is one concrete source of the requirement taxonomy. The 100-million-token reference failure scenario and the smart-city mobility reference failure scenario are additional concrete sources of failure mechanisms and quality-plan pressure for the same canonical requirements. They do not create a second requirement set or alter S1–S14, T1–T4, H1–H6 or the KPI protocol. Instead, each scenario makes a selected route explicit in both directions: a declared scope and failure mechanism identify the applicable S# → T# → H# → KPI → gate disposition; the canonical requirements determine what a requirements-conforming route must preserve, test and report in that scenario. The scenario documents retain their own facts, gates and outcome measures.

The test unit is a material subject–proposition–decision boundary: the entity or action concerned, the claim being assessed, and the receiving decision that will rely on it. In the EA dictionary, these are the subject, proposition and decision domain; scope is the coverage to which the resulting statement applies. A scope is therefore not merely a technical field or a business label. It answers: which subject, which claim, which decision, under which owner, time, evidence and operating conditions?

For readability, this document calls that boundary σ(d,t). It is a reader notation, not a new runtime schema. Every S#, T#, H# and KPI must name the same σ(d,t), or explicitly state the material dependency that links one scope to another.

• W(d,t) is the active observation and semantic window selected for decision d at time t. It is bounded and repeatedly qualified; it is not maximum context collection.

• Non-fungibility: a correct control, approval, search result or extra evidence in d2 does not compensate for a material knowledge fault in d1 unless a represented dependency and fresh evidence show that it actually requalifies d1. See the ecosystem-composition principle.

• Non-monotonicity: more tokens, signals, agents, telemetry or context are not presumed to produce more determination. They can add latency, correlation, conflict, privacy cost or human-capacity depletion. Expansion is justified only when it changes the qualified decision or preserves a viable response window.

• Failure-trajectory rule: Type 1 and Type 2 remain the only two management-failure classes, but a run may move between them. Timeout, default, defensive approval or reviewer pressure can force an unresolved Type-1 path into Type-2 closure; later contradiction of a compressed Type-2 closure can reopen as Type-1 HOLD/search when its discarded basis is unrecoverable. False convergence, divergence, oscillation and cascade are measured trajectories or consequences, not additional types. Defensive UNKNOWN, qualifier saturation and injected doubt are classified by whether they create unbounded delay/containment (Type 1) or suppress/force unsupported closure (Type 2).

This prevents a new vocabulary at each stage: S# identifies the canonical requirement for σ(d,t); T# states the condition the solution must show; H# states why the EA principles predict that condition can be met; and the KPI records supporting or falsifying evidence for that same scope.

The following are the complete canonical solution requirements exposed by the DAOS case. A candidate need not satisfy every requirement outside its declared scope. It must declare which S1–S14 requirements it addresses, what it consumes from other owners, and where it stops. A locally correct component does not establish a whole-system result by itself.

Before assessment, declare the decision, legitimate owner, commitment state, null action, T0 basis, T2 change or insufficiency, evidence boundary, residual, materiality threshold, authority, response deadline, capacity and full cost ledger.

The minimum test branches are valid continuity; observed material change; insufficiently established condition; adversarial or poisoned evidence; capacity/deadline constraint; cross-domain handoff; false convergence from correlated or imitated closure; defensive UNKNOWN; qualifier saturation; and repeated posture reversal. A command receipt, elapsed time, confidence score or human approval is not an outcome unless the declared observable effect is recorded.

The following four conditions adapt the structure of the “Sufficiently Good” requirements in Minimalistic Regime-Aware Early Warning Systems to the changed-decision-basis problem. They do not transfer its detector theorem, action guarantee or validation result to EA, DAOS or another system.

These conditions are jointly constraining. A timely alert without an authorized response is insufficient; a permitted response without material-break qualification is insufficient; and a rich control plane that loses scope, authority or unresolved state is insufficient.

These six hypotheses are the research hypotheses of the EA foundation. They are not established results and are not identical to the later EA differential. A system following the EA foundation should make them testable under a declared scope and resource envelope.

The H1–H6 wording above remains the complete hypothesis set. The new trajectory branches refine how it is tested:

• H1 covers legitimate bounded closure and whether Type 1 is forced into Type 2, or a prior Type 2 reopens as an unrecoverable Type-1 loop.
• H2 and H3 cover both incompatible divergence and premature false convergence when local scope, correlated evidence or compressed closures are promoted system-wide; cascade is measured as propagation and timing, not assumed as an independent cause.
• H4 covers whether a bounded envelope preserves material qualification without full-state disclosure and without qualifier saturation.
• H5 and H6 cover whether churn, injected doubt or repeated posture reversal is detected and bounded before capacity or response margin is exhausted.

These readings add no new hypothesis and do not assert that every run must exhibit every trajectory.

All compared configurations use the same frozen case facts, available evidence, authority, action library, deadline and human/tool budget. Report a numerator, denominator, branch and configuration for each rate. Do not pool heterogeneous branches into an unsupported score. The operational C–H measures retained from the prior protocol are measurement instruments here, allocated under the H# they test; they are not a second set of hypotheses. The common outcome vector is:

[false continuation, false containment, qualified-posture correctness, deadline pass, handoff integrity, observable outcome effect, total decision burden].

The following measures apply to any hypothesis test that recommends, authorizes or executes a non-null response:

• Posture correctness: runs whose posture is within the branch oracle’s permitted set ÷ applicable runs.
• Authority-field completeness: handoffs containing owner, authority, scope, freshness, dependency and expiry fields ÷ handoffs requiring them.
• Authorized-response compliance: non-null actions within the declared authority/action library ÷ non-null actions.
• Reversibility/containment compliance: applicable responses meeting their declared bound ÷ applicable responses.
• False-positive response cost: cost of unnecessary non-null actions ÷ valid-continuity runs.
• PNI test, only if claimed: covered admissible states in which U(A,ω) ≥ U(A_null,ω) ÷ all declared covered admissible states. A PNI claim requires 100%; any counterexample defeats that claim.

These measures do not give EA authority. They test whether a candidate has kept assessment, posture, legitimate owner, permit, action and observed effect distinct.

Use these measures only on declared branches where the corresponding mechanism is injected or observable. They are allocated to H1–H6 as stated below and do not form a new hypothesis set.

A high UNKNOWN rate is not by itself failure, and a low one is not by itself success. The branch oracle, materiality, incentives, scope, owner, response window and downstream effect determine whether uncertainty was correctly preserved, defensively inflated or silently suppressed.

The preceding sections are not four independent checklists. For each declared σ(d,t), the assessor selects the relevant requirement (S#), applies the condition(s) that make that requirement sufficiently good (T#), states the foundation hypothesis or hypotheses being tested (H#), and records the named KPI evidence. The same scope, owner, time, evidence boundary and response horizon must remain visible throughout.

A KPI pass is evidence for the stated hypothesis and condition; it is not by itself proof that a requirement has been satisfied. A condition is met only when the applicable S# requirement, the full T# condition, the evidence and the relevant KPIs hold together for the declared scope. Conversely, a failed KPI, missing required field, unavailable owner or expired response window is a direct reason to mark the linked condition insufficient for that run. It must not be averaged away by good results in another scope.

The map identifies the normal test route. It does not convert upstream functions into EA functions: where a requirement depends on an externally owned source function, the route tests whether the candidate preserves and qualifies the received determination rather than whether it issued the underlying grant, identity or policy.

S14 is an aggregate assessment route, not a separate breadth score. A declared test names the material component or components it exercises: (1) evidence sufficiency; (2) Type-1 / Type-2 transition; (3) conflict, arbitration or precedence record; (4) expiry; and (5) re-entry and disposition update. The third component records the applicable owner or the absence of one; it does not authorize EA to arbitrate or create precedence. These components reuse the S1–S14, T1–T4, H1–H6 and KPI protocol above; they create no new requirements or KPI taxonomy.

1. Freeze the scope. Declare σ(d,t): subject, proposition, receiving decision, legitimate owner, commitment state, evidence and observation boundary, materiality threshold, authority, deadline, capacity and null action. Record the selected W(d,t).
2. Select the requirement route. Name every S# materially present in that scope and the T# conditions required by the map. If a source function is outside the candidate, name its owner and the handoff/re-entry boundary rather than silently assuming it works.
3. State the falsifiable expectation. Name the H# being tested and the comparison configuration. Hold facts, authority, action library, deadline and resource envelope constant across configurations.
4. Instrument the KPIs. For every required KPI, declare numerator, denominator, branch oracle, threshold and observable outcome. Preserve UNKNOWN, residual, scope, provenance, freshness, dependency, capacity, authority and expiry through each handoff.
5. Declare composition and arbitration. Where several scopes or postures meet, state material dependencies, hard constraints, legitimate veto scope/expiry, timeout/default behaviour, evidence-versus-authority role, re-entry target and anti-oscillation rule. Human approval or a timeout may authorize a response; neither is new evidence about the world model.
6. Decide condition by condition. A positive result supports the named H# for this run and contributes evidence to its T# condition. A negative result marks the linked condition insufficient or requires a qualified HOLD/re-entry. Report the scope-specific result; do not trade it against a different domain.

Consider σ(d1,t): whether to release a production order for machine M under its current maintenance and safety regime. The subject is machine M and the order; the proposition is that the maintenance/safety basis remains adequate for release; the decision is the authorized release or hold. Its W(d1,t) includes the declared maintenance sources, safety regime, owner, current evidence, response deadline and available human review capacity.

The route is S3 (regime/context), S5 (indeterminacy and containment), S10 (commitment/material change) and S14 (evidence-to-decision). It therefore requires T1 to recognize a material break within the declared boundary, T2 to issue a qualified posture to the legitimate owner, T3 if a hold, release or other response is proposed, and T4 to reach that posture while it remains useful. H1 tests whether unresolved maintenance evidence is preserved rather than forced into PASS; H2 tests whether evidence valid only within the maintained window is not inflated into a global safety conclusion; H5 tests requalification under churn or shortening source validity; H6 tests whether widening the window actually improves the decision before the deadline. H3 and H4 join the route if the decision relies on a lossy cross-system handoff or a bounded preservation envelope.

For this one scope, material-break recall/precision, explicit-indeterminate rate, false-continuation rate, freshness, requalification latency, remaining response margin, human-capacity demand and authorized-response compliance are the linked evidence. If a material safety change is missed, T1 is insufficient. If a handoff drops an unresolved maintenance dependency or produces a PASS without a receiving owner, T2 is insufficient. If a release is outside the action library or a claimed safe response fails the PNI test, T3 is insufficient. If the assessment completes only after the release/hold is no longer actionable, or it consumes the declared review capacity without decision-relevant gain, T4 is insufficient.

Now consider a separate procurement decision σ(d2,t) with extra telemetry or additional agents. Its apparently good result cannot compensate for the missing maintenance evidence in d1. It may change d1 only if a represented material dependency, fresh evidence and requalification show how it bears on the machine-release proposition. Likewise, adding more telemetry or agents to d1 is not an improvement merely by volume: the H6 evidence-yield, burden and response-margin measures must show that the expansion improves the qualified decision instead of consuming the viable response window.

The universal requirements above do not presume EA. They ask what any sufficiently-good candidate must make testable. EA’s separate, lower-priority research question is whether a strong peer composition can meet the same requirements without an equivalent semantic layer.

The four EA-specific differential propositions are: scoped non-fungible determination; proportionate decision-window requalification; separation of epistemic condition from operating posture and independent actuation authority; and interoperable targeted re-entry. They are falsified or narrowed if a strong, equally resourced peer reaches the same decisions, residual trace, timeliness and burden without equivalent semantics. They are not an assertion that no other system can meet them, and they do not establish superiority.

This document integrates the complete DAOS requirement taxonomy, the EWS-derived sufficiently-good requirements, the EA foundation’s H1–H6 and the previously defined operational KPI protocol. The source materials remain unchanged as preserved non-canonical working inputs. The separate canonical architecture benchmark and reference-scenario evidence applies these requirements to strong-peer comparison and empirical corroboration; it does not redefine them.

No statement here implies that Ω is closed or exhaustively enumerable, that R_U = Ω − U, that UNKNOWN means independence, that more agents necessarily improve determination, or that EA replaces authority, identity, governance, human oversight, control execution, observability, provenance or incident management.

The current canonical requirements route is S1–S14 → T1–T4 → H1–H6 → KPI/falsification. It is the controlling requirements basis for tests and fixtures that cite this document/version; it is not a claim that fourteen requirements, four sufficiency conditions or six hypotheses exhaust every future Structural Awareness / Ecosystem Positioning requirement.

Later developments — including 00G false-context convergence, participant-local positioning, ACC/admissibility, selective signalling/choreography, the objective-conditioned gradient, Ecosystem Cartography, effective-role drift and MSCA Operation/Repositioning — may expose additional requirement surfaces, conditions, measures or cross-component conformance needs. They do not silently add requirements to this document.

Any such extension must be introduced through an explicit, version-controlled requirements change with traceability to the affected S/T/H/KPI routes. Existing pre-registrations and tests remain interpretable against the version they actually cite.