Investigation effort
Does structured behavior reduce the work required to reach a supportable conclusion?
Elapsed time, pivots, queries, screens visited and raw events inspected.
No reduction, or a reduction accompanied by lower conclusion accuracy.
Last updated
Research / Methodology
These protocols define the questions, measures and negative-result conditions before benchmark outcomes exist. [to be benchmarked]
Why pre-register
Each protocol must identify its dataset, baseline, task, measures and negative outcome before collection begins. Changes remain versioned rather than silently replacing the method that produced an inconvenient result.
Draft publishedProtocol register
Does structured behavior reduce the work required to reach a supportable conclusion?
Elapsed time, pivots, queries, screens visited and raw events inspected.
No reduction, or a reduction accompanied by lower conclusion accuracy.
How much telemetry can be represented as actions, behaviors and incident chains without losing decision-relevant evidence?
Events per action, actions per behavior, behaviors per chain and retained provenance links.
Compression removes evidence needed to reconstruct an originating action or effect.
Can an investigator identify the originating process, initial action, affected objects and persistence?
Correct identification, completeness, unsupported assertions and time to answer.
Structured behavior performs no better than the baseline workflow or introduces confident attribution errors.
Does explicit observability help a reasoner stay inside the evidence boundary as coverage degrades?
Correct abstention, gap identification, unsupported claims and conclusion stability.
Gap labels do not reduce unsupported conclusions or materially impair useful conclusions.
How does raw telemetry, an alert summary and structured behavior change human or software reasoning?
Root-cause accuracy, recommended-action accuracy, context consumed and claims about unobserved activity.
Structured behavior is less accurate, consumes more context, or hides evidence available in another condition.
Publication commitment
Results should be published with the protocol version they ran against—including results that fail to support the design hypothesis.
No protocol on this page currently carries a completed result, participant count, dataset assignment or benchmark date. Those fields will be added only when the work exists.