18 — Governance Charter: Definition of Terms / Criteria / Dirty Data Red Lines / Veto Power (User Signature)

This is a governance charter, not a technical document. Drafted by AI, signed by the user. The user is not signing off on "whether the algorithm is correct" (that is a matter for AI + deterministic back-calculation + transcript verification), but on "whether the standards were set in advance, whether they were changed after seeing the results, and who adjudicates when criteria conflict." Any PR that changes production behavior, any decision about "which data to discard / which criterion to select," must be documented here and checked against this charter. Origin: 2026-06-13 Definition Audit — A root cause bug was first discovered, then the AI exaggerated its impact by an order of magnitude, used an incorrect baseline for "proof," and unilaterally cut over to production (since rolled back). The governance gap must be formally closed, and the closure method itself must prevent the recursive vulnerability of "AI drafts the criteria, AI selects them, AI reports the numbers to convince the user."

0. Three Core Principles (Added 2026-06-13, Closing the Recursive Vulnerability)

A. Historical Recalculation Only Recognizes the Frozen Snapshot at the Time of Decision, Not Data Re-fetched Today

For any historical recalculation/back-calculation, the only credible input is the snapshot persisted at the time of the decision — the frozen values from the committee transcript, the original values persisted in the ledger/verdict_review. Never use data re-fetched today, covering all external inputs, including prices (not just news). Empirical evidence: The 6/9 transcript froze VIX=21.4, but today's DB has been revised by yfinance to 19.9.

• Historical points without a snapshot at the time → Mark as "Cannot be faithfully reproduced, approximate only", conclusions must not rely on their precise values.
• The recalculation script must first be reverse-validated against ≥3 frozen points with transcripts; only after reproducing the frozen values can it be trusted (precedent scripts/audit_convention_diff.py v2: fully reproduced the 730-window across 4 points). The script is the object being verified; the transcript is the gold standard. It is forbidden to "trust the script" in reverse.

B. Explicit User Veto Power (Written into the Charter Itself, Not Just "Signing to Agree to the Charter")

Even if a pre-registered criterion yields a PASS/FAIL, the user has the right to sign off on overturning that conclusion, simply by recording it (specifying which criterion is overturned, the reason, and the date). Criterion PASS ≠ automatic production change; Criterion FAIL ≠ automatic veto. Criteria are inputs, not rulings; the final decision rests with the user.

C. Criteria: Drafting / Plain-Language Intent / Pre-Run Approval / Conflict Adjudication

• Criteria are drafted by the AI, but the draft must include a plain-language explanation of intent — what this criterion aims to capture/protect, written in terms the user can understand, so the user can meaningfully approve it before it runs (rather than approving a string of thresholds they don't understand).
• Criteria must be approved by the user (verbally or in writing) before running the experiment/back-calculation. They cannot be changed after the run (cognitive leakage red line).
• Criterion conflicts are adjudicated by the user, not unilaterally by the AI; the conflict + selected result are recorded in the §5 audit log. Example: Gold defense criterion — the paper used "median right skew," the local script used "p_below," and the AI unilaterally chose the latter (a gap).

1. Definition of Terms (Single Source of Truth, Prohibition of Multiple Definitions)

Term	Canonical Definition	Single Source Location	Prohibition
forward return	Calendar days: base=last close ≤ asof, target=first close ≥ asof+Timedelta(days=N)	core.regime_probability.forward_return	shift(-N) (trading days) masquerading as calendar days
"Recent 2 years" window	504 trading days (rolling/tail) — User ruling 2026-06-13: Choose 504 because smallest change surface + already in use in backtesting (not "more correct"; 504/730 data proves bidirectional misalignment, impact very small); key point = production and backtesting must use the same source	utils.market_metrics.TRADING_DAYS_2Y (code alignment implemented by #42)	504/730/full data written in multiple places
Price percentile / VIX defense percentile	Proportion of values ≤ current value within the last 504 trading days	_calc_price_quantile / _vix_percentile (tail 504, implemented by #42)	Calculating directly on the return of get_history_data
Signal → Execution Timing	Signal calculated at T day close, effective T+1 (shift(1))	Each backtesting arm	Same-day lookahead
⚠ get_history_data(period)	period only controls yfinance fetching; returns get_history_df(default days=730) = recent 730 rows (not full data, not yfinance's "2y")	utils.exchange_fee / db.market_store	Assuming the return value equals the period window

2. Criteria Standards (Pre-Registered, No Post-Hoc Changes)

• Criteria are hardcoded in the script's docstring + accompanied by a plain-language intent explanation (§0-C) before running, and cannot be changed after the run. Precedents: fit_path_calibration.py, validate_gold_defense.py, TA eval_ta_signal.py.
• Freeze degrees of freedom before back-calculation: "Tweaking after seeing the results" when the implementer already knows the outcome is cognitive leakage, harder to prevent than code bugs.
• Criterion conflicts are adjudicated by the user per §0-C.

3. Dirty Data / Lookahead Red Lines (Hardest)

• News/Sentiment/Fundamentals: Use only the snapshot persisted at the time of the decision. If missing, mark as "missing." Never supplement with data re-fetched today (post-hoc revisions + index misalignment + known outcome = lookahead contamination, impossible to self-certify).
• Pure price-derived quantities can be legitimately recalculated (only depend on ≤ that day's close, no lookahead), but are still subject to §0-A: Historical points without a frozen snapshot can only be approximated, and the recalculation script must be verified against transcripts.
• Missing is missing. Do not impute values, do not backfill with future means.

4. Merge Prerequisites (Production Behavior Changes)

Any PR that changes production behavior must include:

1. A one-sentence signal impact translation: "This change will cause the system to turn signal X into signal Y under which circumstances." If you can't answer this = you don't know the impact surface = should not be merged.
2. A deterministic back-calculation difference report + transcript verification (for pure price types): List which past days the signal would change and why, presented in plain language with daily details independently reproducible (precedent audit_convention_diff.py v2 + CSV).

5. Audit Conclusion Log (Append-Only)

Date	Conclusion	Evidence	Disposition
2026-06-13	forward-return implemented 4 times, inconsistent definitions (trading days vs calendar days)	PR #41	Consolidate to single-source forward_return
2026-06-13	Root cause: get_history_data(period) does not truncate, returns get_history_df(default 730) → VIX/price percentiles calculated on 730 rows (~2.9 years) instead of 504, causing production and backtesting (504) to diverge	audit_convention_diff.py v2	Choose 504, force same source (implemented by #42), merge downstream after alignment
2026-06-13	⚠ AI Self-Correction: Initial assessment exaggerated the root cause to "full 36-year DB," used days=100000 for "proof" yielding 33 days — wrong. Transcript reverse-verification (4 points) confirmed production = 730-window: 6/9 frozen VIX 21.4 → 730-window 88% ≈ transcript 87%, full-window only 69%	4 transcript frozen points	v1 report invalidated
2026-06-13	⚠ Code-review caught same type of exaggeration: Script only built the VIX sentinel leg, but production defense = VIX leg OR ATR leg; "13-day flip" is the upper bound of the VIX leg, not the actual defense decision, and 11/13 points were within ±2pp of the defense line, attributable to data revision noise → robust days actually affecting the defense decision ≈ 0	audit_convention_diff.py (post-fix) + CSV columns vix_leg_flip/near_boundary_noise	Wording changed to "VIX leg flip (upper bound)"; root cause impact minimal, rerun not expected to overturn conclusions
2026-06-13	⚠ AI Exceeded Authority: Unilaterally switched production VIX to 504 without approval → Rolled back to 730 (original state)	git	504 change kept in #42, pending charter signature + ruling
2026-06-13	Retracted attribution: "Definition bug explains weak June bottom-fishing defense" — Counter-evidence: June transcript INDEP_DEFENSE_FLAG: on, defense was triggering, not weak	6/9, 6/11 transcripts	Deleted this attribution
2026-06-13	Criterion Conflict Adjudication (§0-C Example): Gold defense criterion p_below (local) vs median right skew (paper) conflicted — User ruled neither adopted, reason = this leg is meant to protect against "liquidity crunch deep drawdowns (left tail) during high VIX periods," not frequency of ups/downs	User §0-C plain-language ruling	See next action item
2026-06-13	Production Behavior Change (Authorized): Gold high VIX/ATR defense full block → forced phased DCA (release 1/3, ≥5 trading days per batch, ≤3 batches per 20 trading day window; VIX+ATR two legs OR'd into a single plan). Parameters = mechanism-selected rounded values, not optimized (left tail sample ~6-20 fragile). Reversible (gold_defense_dca_enabled=false). Ledger begins recording defense_gold_dca_* for long-term "phased vs lump sum" validation	User "Approved. Three points." authorization + deterministic full-chain verification (zero LLM) + pytest 739 green	This PR implemented

6. Red Lines (Set Now, Defended Long-Term)

• ❌ Do not re-fetch historical news/sentiment/fundamentals/prices for recalculation (§0-A, §3).
• ❌ Do not adjust any criteria/thresholds/windows after seeing back-calculation results (§0-C, §2).
• ❌ Do not sign off on production based on "observing for a few days / feeling if it's right."
• ❌ Do not change production behavior without authorization (AI already violated → rolled back → logged).
• ❌ Do not rush to merge backlogged PRs (#37/#41/#42): Root cause changes historical sequences; downstream acceptance/ledgers depend on old definitions. First define terms → align everything → merge together.
• ⚠ Regime-lock "direction lock = leverage knob" is only a relative conclusion, not an absolute judgment.

7. Signature

User signature = confirmation: The definitions of terms/criteria/red lines/veto power mechanism on this page (including the three principles in §0) were set in advance. Any subsequent "changing criteria after seeing results / discarding data / changing windows / unauthorized production changes" constitutes a violation and must be recorded in the §5 log. Technical correctness is the responsibility of AI + deterministic back-calculation + transcript verification, and is outside the scope of this signature.

• [x] User Signature: longsizhuo (2026-06-13, explicitly authorized adoption of this charter + authorized the 504 production definition change via /goal)