Planning Dossier — CVN-N001-EK-S01: D1 — ADR "Tradability Decision Protocol" + Phase 0 Charter Draft¶

Story: CVN-N001-EK-S01 · parent Epic CVN-N001-EK OpenProject: wp#271 · GitHub issue: #1164 Type: implementation plan (ADR-68), submitted for committee plan_review. Date: 2026-06-09 · Revision: r3 (second external-review rework — see Revision journal). Story exit gate: requires methodology committee plan_review PASSED before transition to Specified. plan_review PASSED on 2026-06-09 — committee session bacfae82, strong consensus, 5/5 experts (8.5–9.0), OP Meeting #269. The Story may transition to Specified. (Committee recommendations are non-blocking enrichments folded into the downstream S02/S03/S04 charter placeholders and ADR enforcement — see Committee recommendations below.)

Revision journal. - r1 (PR #1165) — bilingual internal plan. - r2 (PR #1166) — full English, specification-grade rewrite after an external-review REWORK verdict: English throughout, closed the "action-policy = free retry" hole, moved the instance thesis out of the durable ADR into the charter, set the ADR/charter status separation, standalone ADR file, strengthened acceptance criteria, risk-owner role, methodological references, killed-tuple enforcement gate, glossary, traceability matrix. - r3 (this revision) — second external-review pass (4.55/5, PASS after P0/P1 edits): removed the residual "budget-free" wording (§9.2) that reopened the retest hole; reframed the exit gate as a required condition, not a pre-claimed PASS; added a methodological traceability table (§4); made the risk-owner sign-off a blocking veto (§10); reworded the concrete program thesis as a hypothesis (§7); made the E_econ_min vs E_pred_min distinction explicit (§7); tightened "siloed exploration" (§9.4); added an acceptance criterion forbidding budget-free retest wording (§12); resolved committee Q6/Q7 (§13).

1. Executive summary¶

The EI cost-sensitivity pilot returned inconclusive / under-powered (confidence intervals compatible with both loss and gain at every cost level, dominated by cross-asset dispersion). Combined with the program history (abandoned ML-boost tracks, weak AUC→f1_buy transfer, best_iter=1), "run one more exploratory sweep" is now a garden-of-forking-paths hazard, not a plan.

Story S01 delivers D1: the durable decision rules (an ADR) plus an unlocked charter template (the instance to be filled later). S01 derives no quantitative value, runs no experiment, selects no model, and authorizes no trading. Quantitative values are derived in S02 (D2) and locked in S03 (D3); S04 (D4) is the first Story permitted to execute a Phase 2 predictivity run.

The deliverable is a document, so this plan describes what D1 will contain and which methodological invariant each artifact must prove — there is no code.

2. Problem¶

A durable, pre-registered, falsifiable decision layer does not yet exist. Without it, the choice of decision parameters (thresholds, budgets, null-gate, stopping rules) is itself an unconstrained degree of freedom that can be tuned post hoc to manufacture a favourable verdict. The structural prohibition no downstream optimisation before upstream proof has no written, reviewed home.

Therefore no quantitative pre-study (S02) and no run (S04) may start until these rules are written and reviewed. D1 is the prerequisite for the rest of the Epic.

3. Decision boundary¶

S01 delivers the durable decision rules and an unlocked charter template. It does not derive quantitative values, run experiments, select a model, or authorize trading.

If the ADR is accepted in S01, the durable rules become binding. The instance-specific charter remains unlocked until S03. S02 derives the quantitative values; S03 locks the charter with joint sign-off from the operator, the methodology reviewer, and the risk owner; S04 is the first Story allowed to execute a Phase 2 run.

No downstream work — filtering, meta-labeling, sizing, execution optimisation, or portfolio construction — is authorized by S01.

4. Methodological foundations¶

The invariants below are not house doctrine; each is grounded in established practice. The ADR must cite them.

Purged & embargoed cross-validation — when labels depend on future horizons and samples overlap (the triple-barrier case), naive CV leaks and over-states performance; purging overlapping samples and embargoing around test folds is the standard remedy (López de Prado, Advances in Financial Machine Learning, 2018).
Probability of Backtest Overfitting (PBO) / CSCV — investment backtests are vulnerable to selection under multiple trials; the combinatorially-symmetric cross-validation framework estimates the probability that an in-sample-best configuration is out-of-sample sub-par (Bailey, Borwein, López de Prado & Zhu, 2014).
Pre-specified experimental design (DoE) — "define the design before measurement" is standard statistical engineering, not a preference (NIST/SEMATECH e-Handbook of Statistical Methods).
Multiple-testing / False Discovery Rate control — when many tuples, families, thresholds, or iterations are tested, the false-discovery rate must be controlled explicitly (Benjamini & Hochberg, 1995).
Garden of forking paths — even without explicit re-running, analyst degrees of freedom invalidate naive inference; pre-registration is the defence (Gelman & Loken, 2013).

Full citations in References. Each invariant is traced back to its source and forward to its enforcement:

Methodological source	Invariant it grounds	Enforced in
López de Prado (purged/embargoed CV)	predictivity must beat a leakage-free baseline	null-gate definition (charter, S02) · ADR §6.3 gate chain
Bailey et al. (PBO / CSCV)	in-sample-best ≠ out-of-sample edge under multiple trials	tuple + FDR budgets (ADR §6.6) · final-holdout policy (§9.3)
NIST/SEMATECH (pre-specified DoE)	design fixed before measurement	Phase 0 charter lock (S03) · pre-registration rule (§9.1)
Benjamini & Hochberg (FDR)	control false discoveries across many tests	FDR / multiple-testing ledger (ADR §6.6)
Gelman & Loken (forking paths)	analyst degrees of freedom invalidate naive inference	anti-snooping rules (§9) · killed-tuple register (§9.6)

5. Deliverables and non-deliverables¶

Deliverables (D1):

A. The ADR "tradability decision protocol" — durable governance rules (status target: Accepted).
B. The charter template — instance document with explicit placeholders (status: Draft, unlocked).
C. A Story hub + nav wiring so every artifact is reviewable through the documentation site.

Non-deliverables (explicitly out of scope for S01): any quantitative value (E_econ_min, E_pred_min, P90 cost, MDE, budgets, Sortino floor — S02); charter lock (S03); any Phase-2+ run (S04); any sweep, filtering, sizing, or deployment.

6. ADR scope (artifact A)¶

A standalone ADR file documentation/adr/0102-tradability-decision-protocol.md (next free number, verified at write time) plus a one-line entry in the ADR.md catalogue. The ADR is kept concise; the operational detail (the per-tuple decision tree) lives in the dedicated decision-tree page, which the ADR references rather than inlines.

The ADR captures only durable, instance-independent rules:

Registered program thesis (concept). The ADR defines what a "registered program thesis" is and requires every charter to name one. It does not hard-code any instance (no defi_top5, no ATR-H4, no GBT) — those belong to the charter (§7).
Switch boundary. Long-only vs cross-sectional / market-neutral. Any switch is a separate Epic (its own estimand and gates), never a continuation — an anti-scope-creep invariant.
Strict gate chain (Phases 2→6): predictivity → gross expectancy → cost survival → filtering → sizing/execution. No downstream gate is touched before the upstream gate is cleared.
Verdict taxonomy: PROMOTE · ONE-ITERATION (rare, pre-paid) · KILL (hierarchical: tuple → family → program thesis) · INFEASIBLE (under-power failure). A clean KILL/INFEASIBLE is a success (a sharp decision), not a failure. INFEASIBLE authorizes only substrate expansion (wider universe / folds), program stop, or a new charter if the program thesis itself changes — never iteration on features or thresholds. There is a single INFEASIBLE state (no separate DEFERRED-INFEASIBLE, no generic PARK — a catch-all park becomes a graveyard); its discipline is the constrained next-action list, not a new label.
Anti-snooping rules (§9) — constitutive, each with an enforcement consequence.
Budgets — families, ONE-ITERATION slots, FDR / multiple-testing. The ADR mandates that budgets exist and are decremented; the values are charter placeholders (S02).
Mandatory registries — registered tuples; killed tuples (with an anti-resurrection enforcement gate, §9); family budget; FDR budget; final-holdout access log; reopening conditions.

S01 locks the rules (if the ADR is accepted); it does not lock any instance-specific value.

7. Charter scope (artifact B)¶

The charter instantiates the ADR for this run, with explicit placeholders and no values:

Placeholder	Source Story	Lock authority
Named program thesis (the concrete instance)	S01 names it; values around it: S02	S03
`E_econ_min`, P90 cost at target capacity, mapping → `E_pred_min`	S02 (D2)	S03
MDE / minimum universe (power simulation)	S02 (D2)	S03
Principal null-gate definition (purged/embargoed, conservatism-wins)	S02 (D2)	S03
Budget sizes (families / `ONE-ITERATION` slots / FDR)	S02 (D2)	S03
R1 — Sortino definition (periodicity / MAR / annualisation + floor basis)	S02 (D2)	S03
Closed list of structural coordinates (§9)	S01 drafts; ratified	S03
Frozen values + joint sign-off	—	S03 (D3)

The charter names this candidate program thesis (the one concrete instance, kept out of the durable ADR) as a hypothesis to be tested, not a claim: whether a long-only directional ML entry edge on defi_top5, with an ATR-H4 triple-barrier label and a GBT model class, can be shown economically tradable at conservative P90 cost and target capacity.

E_econ_min vs E_pred_min must not be conflated. E_econ_min is the economic break-even threshold derived from conservative P90 cost and target capacity. E_pred_min is the minimum predictive effect required to meet E_econ_min through the documented predictive-to-economic mapping. A lift in f1_buy/AUC (E_pred) is not an economic edge (E_econ); the mapping between them is itself a charter placeholder (S02). This separation is the historical failure mode the protocol exists to prevent.

The draft charter (S01) enumerates every placeholder and its source/lock authority; it fills no value and is not locked.

8. Explicit non-goals¶

No quantitative values; no charter lock; no Phase-2+ run; no model selection; no sweep, filtering, sizing, calibration choice, or execution rule; no trading or deployment authority of any kind.

9. Anti-snooping rules¶

Constitutive rules, each with a concrete enforcement consequence:

9.1 Action-policy tuning is not a free retry. It may remain inside the same registered tuple only if the action-policy search space, the selection metric, and the nested-validation procedure were pre-registered before any OOS evaluation. Otherwise, changing the action policy creates a new tuple and consumes the corresponding tuple and multiple-testing budget.

9.2 Closed list of structural coordinates. The charter carries a closed list of "structural" coordinates (e.g. label family, feature set, model class, universe). Changing any of them = new tuple = budget. Only a pre-registered, bounded action-policy search may remain inside the same tuple, per §9.1 — and even then it is not a free retry: it is part of the tuple's pre-registered budget (inside-budget, not budget-free). Any action-policy change outside the declared space creates a new tuple and consumes the corresponding tuple and multiple-testing budget.

9.3 Final-holdout policy. The final holdout may not be used to choose thresholds, top-k rules, calibration policies, cost-survival adjustments, or execution rules. It is touched once per tuple, at the verdict, with a dated entry in the holdout access log.

9.4 Source of the next tuple. The next tuple comes from theory / siloed exploration, never from a confirmation result. Siloed exploration may not inspect the final holdout and may not use Phase 2 confirmation results to choose a new tuple. Any insight carried from exploration into a new tuple must be recorded as prior rationale before registration — otherwise it is post-hoc, regardless of the name given to it.

9.5 Cost re-tuning is post-hoc. Re-tuning to survive cost at Phase 4 = post-hoc = KILL tuple (not a correction).

9.6 Killed-tuple enforcement gate. Before a new tuple is registered, it is checked against the killed-tuple register. If it is materially equivalent to a killed tuple, it is rejected unless the explicit reopening condition is met and recorded. The register must block, not merely exist.

10. Review gates and roles¶

S01 exit: requires methodology committee plan_review PASSED (this dossier is the artifact under review); the PASS is not pre-claimed.
S03 lock: joint sign-off — operator + methodology reviewer + risk owner — with role separation (the charter locker ≠ the run launcher).
Risk-owner role (defined, not symbolic): the risk owner does not validate the science; they validate that no trading/deployment authority is implied, that cost/capacity assumptions are explicit, and that all downstream use is gated. A risk sign-off without these checks is void.
Risk-owner veto is blocking. If the risk owner does not sign, S03 cannot lock the charter and S04 cannot run. A risk-owner objection cannot be overridden by methodology approval alone — it is resolved only by addressing the objection or by an explicit, recorded waiver from the accountable owner.

11. Risks and mitigations¶

Risk	Mitigation
R1 Sortino unresolved → temptation to assert an actionable floor	Charter places Sortino as an S02 placeholder; the ADR forbids any actionable "sub-floor" statement until R1 is resolved.
Premature lock of values	Strict ADR (rules) / charter (instance) separation; charter is `Draft` in S01; lock = S03 with joint sign-off.
Over-constraining the ADR with numbers that belong to S02	The ADR contains no value — only rules and placeholder names.
Scope creep (doing the pre-study in S01)	Explicit non-goals (§8); any value is deferred to S02.
ADR not durable (instance details leak into it)	§6.1 keeps the concrete thesis in the charter; acceptance criteria assert "no instance-specific value in the ADR".
Killed-tuple resurrection	§9.6 blocking gate, asserted in acceptance criteria.
Symbolic risk sign-off	§10 defines concrete risk-owner checks.

12. Acceptance criteria¶

13. Committee questions¶

The external review pre-resolved the five original questions; the plan now adopts the following positions and asks the committee to ratify or overturn them:

ADR placement — Position: standalone ADR file (adr/0102-…), concise, linking the decision-tree page; one-line catalogue entry. Not a section in the ADR.md monolith.
ADR status — Position: Accepted after S01 (it holds only durable rules); the charter instance stays Draft until the S03 lock.
Verdict taxonomy — Position: no generic PARK; keep INFEASIBLE but constrain its allowed next actions to substrate expansion or program stop (§6.4). Ratify the tuple → family → thesis granularity.
Long-only vs cross-sectional — Position: keep the boundary; cross-sectional is a separate hypothesis family / Epic (§6.2).
Structural vs action-policy — Position: a closed list of structural coordinates (§9.2) plus a bounded, pre-registered action-policy rule (§9.1). Confirm the closed list is the right enforcement.

Resolved by the external review (positions to ratify):

DEFERRED-INFEASIBLE? — Position: No. Keep a single INFEASIBLE state with strictly constrained next-actions (substrate expansion, program stop, or a new charter if the thesis changes — never feature/threshold iteration, §6.4). A second label adds taxonomy, not discipline.
Closed structural list — ADR or charter? — Position: the charter names the coordinates for this instance; the ADR defines the requirement and the enforcement rule (§6.1, §9.2). The set may evolve per program, so it is instance-level.

Glossary¶

Tuple — a registered, fully-specified experimental configuration (label family, feature set, model class, universe, action policy) under test through the gate chain.
Program thesis — the named hypothesis a charter tests (e.g. a long-only ML entry edge). The ADR requires one; the charter names the concrete instance.
Gate — a pass/fail decision point in the Phase 2→6 chain.
Lock — freezing charter values under joint sign-off (S03); irreversible without a recorded reopening.
Structural coordinate — a tuple dimension whose change creates a new tuple and consumes budget.
Action policy — the decision layer (thresholds, top-k, calibration) applied to a model's scores; tunable inside a tuple only under §9.1.
Final holdout — the data partition reserved for the verdict, touched once per tuple (§9.3).
Null-gate — the purged/embargoed baseline a tuple must beat to demonstrate predictivity (defined S02).

Traceability matrix¶

Invariant / deliverable	Acceptance criterion (§12)	Downstream consumer
ADR = durable rules only	"no instance-specific value in ADR"	S02/S03/S04 (binding)
Charter = placeholders only	"charter contains no quantitative value"	S02 fills, S03 locks
Action-policy gate (§9.1)	"no rule allows unbudgeted re-testing"	S04 (tuple registration)
Closed structural list (§9.2)	acceptance via §13 Q7	S04
Holdout policy (§9.3)	"final-holdout policy is explicit"	S04 verdict
Killed-tuple gate (§9.6)	"killed-tuple register has a blocking gate"	every new tuple
ADR Accepted / charter Draft	"ADR status = Accepted; charter Draft"	S03 lock
Risk-owner role (§10)	"risk-owner role is defined"	S03 sign-off
Methodological grounding (§4)	"References section cites foundations"	external review

Committee recommendations (non-blocking — for downstream stories)¶

plan_review PASSED with strong consensus; the following recommendations are enrichments, not blockers, and are routed to the stories that own them. They do not change the S01 scope.

Recommendation	Owner story
Define objective material-equivalence criteria + valid reopening conditions for the killed-tuple register	S01 ADR / charter wording
Define the pre-registered action-policy search space standard (bounded, budgeted)	S01 ADR / S02 charter
Add execution-realism placeholders (slippage, fees, funding, venue liquidity) so P90 cost survives live fills	S02 charter
Pre-specify minimum trade count + power thresholds to prevent underpowered runs	S02 charter
Mandate probability calibration (e.g. Platt) + validation (Brier) for threshold decisions	S02 charter
Mandate stress-case / regime-sensitivity tests	S02 charter
Define position-sizing guardrails + concentration limits (e.g. max % 24h volume)	S08 charter
Require 9-filter-chain ablation (per-filter value + interactions)	S02
Automate registry enforcement (killed-tuple, holdout access log, FDR ledger)	S03/S04
Charter-lock immutability (hash / write-once) post joint sign-off	S03
Kill-switch + live observability (drift, confidence decay, alerts, runbooks); staged rollout + rollback	S08 / runtime Epic
Risk-owner veto escalation / dispute-resolution path	S03 charter
Siloed-exploration guidelines/templates + prior-rationale documentation	S01 ADR / S04

References¶

M. López de Prado, Advances in Financial Machine Learning, Wiley, 2018 (purged & embargoed CV; combinatorial purged CV).
D. H. Bailey, J. Borwein, M. López de Prado, Q. J. Zhu, "The Probability of Backtest Overfitting", Journal of Computational Finance, 2014. https://www.davidhbailey.com/dhbpapers/backtest-prob.pdf
NIST/SEMATECH, e-Handbook of Statistical Methods — Design of Experiments. https://www.nist.gov/programs-projects/nistsematech-engineering-statistics-handbook
Y. Benjamini, Y. Hochberg, "Controlling the False Discovery Rate", J. R. Statist. Soc. B, 1995.
A. Gelman, E. Loken, "The garden of forking paths", 2013.