# 14-Day Squad Fatigue Safety Pilot Runbook

## Scope

The pilot validates one customer-owned sports algorithm candidate and a bounded mutation corpus inside customer-controlled infrastructure. It does not authorize automatic deployment, change the trading or sports core, or certify player health, match outcomes, profitability, or regulatory compliance.

## Day 0 — owner prerequisites

- nominate one engineering owner and one risk/compliance reviewer;
- select one non-production Squad Fatigue candidate;
- provide a sanitized deterministic fixture set;
- define operator thresholds, fixed-point scale, output bounds, timeout, and kill-switch policy;
- confirm that no production signing key is required for the pilot.

## Days 1–2 — installation and isolation

1. Build the private image from the pinned repository commit.
2. Start the worker on an AF_UNIX socket with a tenant-scoped evidence directory.
3. Confirm network egress is disabled.
4. Confirm the worker runs non-root with a read-only application filesystem.
5. Confirm candidate source and fixtures never leave the customer environment.
6. Record image digest, runtime version, host profile, and configured limits.

Acceptance: local worker health is green; network and filesystem escape probes are blocked.

## Days 3–4 — contract mapping

- map candidate inputs to operator-owned fixture fields;
- encode exact formula obligations, scale rules, output bounds, threshold equivalence, and resource limits;
- review every invariant with engineering and risk owners;
- freeze Contract v1 and its SHA-256 digest.

Acceptance: contract ownership and truth boundary are signed off by both owners.

## Days 5–6 — canonical verification

- submit the canonical candidate through the private worker;
- poll for the final receipt;
- reproduce the Proof Pack on a clean machine;
- verify manifest root, canonical AST, execution IR, concrete output, solver context, and optional seal status;
- retain the promotion decision as human-review-only.

Acceptance: final verdict is VERIFIED and local reproduction succeeds byte-for-byte.

## Days 7–9 — adversarial corpus

Run all 15 mutations:

- semantic threshold and coefficient drift;
- hardcoded and snapshot-overfit outputs;
- scale mismatch;
- fuel exhaustion;
- artifact tampering.

For each case record:

- expected and actual verdict;
- first failing invariant or block reason;
- worker duration and peak resident memory;
- Proof Pack or fault-receipt digest;
- operator action.

Acceptance: 12 semantic mutations are REFUTED and 3 execution/integrity mutations are BLOCKED.

## Days 10–11 — CI/CD integration

Recommended non-blocking introduction:

```text
candidate build
  -> EvidenceBound verification
  -> receipt publication
  -> operator review queue
  -> explicit promotion approval
```

During the pilot, a BLOCKED or REFUTED result must stop promotion of that candidate without stopping the existing sports core. The production algorithm remains unchanged.

Acceptance: the gate blocks only candidate promotion and leaves the current production path available.

## Days 12–13 — performance and failure drills

- run 30 sequential canonical submissions;
- run 4 bounded concurrent submissions if host capacity permits;
- trigger timeout, malformed request, socket loss, worker restart, and evidence-root permission failures;
- verify no partial receipt is presented as VERIFIED;
- confirm recovery does not require deleting evidence.

Acceptance: all failures remain fail-closed and recoverable with documented operator actions.

## Day 14 — decision review

Review:

- review time before and after the pilot;
- mutation detection coverage;
- reproducibility rate;
- worker latency and memory envelope;
- integration effort;
- unresolved policy, privacy, legal, or operational risks;
- recommendation: continue, revise, or stop.

## Success threshold

Continue only when:

- 100% of declared corpus outcomes match;
- 100% of retained receipts reproduce;
- zero network or evidence-root escapes occur;
- no automatic promotion path exists;
- the customer confirms a repeated review job worth operationalizing.

## Kill or revise threshold

Stop or revise when any candidate receives an unsupported VERIFIED status, a receipt cannot reproduce, isolation fails, promotion can bypass human approval, or integration cost exceeds the customer's recurring risk-reduction value.

## Rollback

Disable the CI gate, stop the private worker, preserve evidence for audit, and revert the integration commit. The existing sports production core remains unchanged throughout the pilot.