exoskeleton/docs/calibration/CALIBRATION_POLICY.md

Calibration and Evidence-Locking Policy

This document defines when a numerical setting may move from development to a locked experiment. Calibration output is engineering evidence, not a paper result.

Evidence states

Every setting or implementation contract receives one of four states:

1. Verified contract: a deterministic identity or accounting invariant has passed an independent reconstruction from stored arrays.
2. Provisional numerical setting: calibration supports using the setting in another calibration or pilot, but not in a locked experiment.
3. Frozen setting: the value, selection rule, analysis configuration, source commit, and admissible operating envelope are fixed before locked data are inspected.
4. Not freeze-ready: the calibration design is confounded, lacks the required comparison, or has an unacceptable safety/transparency trade-off.

Freeze gate

A setting can be frozen only if all of the following are true:

• trials are generated from a clean, immutable Git commit;
• paired methods receive identical trajectory, model, sensor, and network inputs where the hypothesis requires pairing;
• calibration instances are genuinely distinct rather than timing-only repetitions;
• failure, invalidity, timeout, clipping, intervention, and exclusion reasons are machine-readable and retained;
• the primary endpoint is numerically well-defined for the selected stratum;
• the selected value is supported by a parameter scan or an external physical calibration, not by a single untested level;
• tail behavior and failed trials are reviewed before the value is selected;
• the locked configuration and independent metric configuration receive new hashes after the decision.

H1--H4 decision boundaries

• H1: freeze only after reach clipping, joint-limit stress, low-manipulability stress, and valid branch-continuity trajectories are separately identifiable. The experimental unit is a complete trajectory.
• H2: numerical calibration may select a robust DLS region, but physical wrench-accuracy claims require an independent six-axis F/T reference, timestamp calibration, payload/friction calibration, and a causal acceleration estimate.
• H3: the fixed-branch virtual-work identity is a deterministic contract. Actual closed-loop power mismatch is a different performance endpoint and must not be replaced by the identity check. Near-zero-power trials require a preregistered normalizer gate or an absolute mismatch outcome.
• H4: passing the energy-accounting audit verifies implementation correctness only. Energy capacity and feedback gain remain not freeze-ready if the projection distortion is excessive or the tested network/contact envelope is incomplete.

Data handling

Raw batches remain under output/experiments/ and are intentionally ignored by Git because they can be regenerated from the plan, source commit, and recorded seeds. The source-controlled audit records plan hashes, source-data hashes, anomalies, and freeze decisions. No calibration value may be copied into the manuscript Results section.

Locked experiments must use a new batch directory and must never overwrite a calibration batch. A locked run is invalid if the worktree is dirty or if its recorded source and model hashes do not match the approved lock record.