The Gold Standard · Experimental Design
Make the decision path visible
A second residual copy can contain the only surviving container digest, seed configuration or transformation manifest. That fact may justify a careful appeal, but it does not automatically justify keeping the raw export or leaving its creation route available.
The gold standard separates reconstruction evidence from copied data. It validates the smallest missing artifact, moves it into the controlled archive and retires code, credentials, schedules, templates, suppliers and recovery instructions as one route.
Choose the route closest to your decision
Chapter contents
Chapters 1–3
Chapters 4–6
Chapters 7–9
Chapters 10–12
CHAPTER 1 OF 12 · FRAME THE RESIDUAL-COPY APPEAL
1. Define the second residual object and appeal
Record the object identifier, location, owner, creation path, data classes, encryption, access, experiment relation and difference from the first residual copy. State exactly which reconstruction question the appeal says it can answer.
Do not let the label residual copy stand in for inspection. The object may contain raw records, transformed weights, code, logs and configuration with different retention consequences.
CHAPTER 2 OF 12 · FRAME THE RESIDUAL-COPY APPEAL
2. Restate the validated archive contract
List the data, code, environment, parameters, seeds, manifests, provenance and verification evidence the archive was intended to preserve. Identify who approved that minimum and which reconstruction tests it passed.
A gap exists only when a material experiment claim cannot be reconstructed or audited from the controlled archive, not when the residual copy is merely easier to browse.
Evidence check
Check whether the scope, owner and decision consequence are explicit before continuing.
CHAPTER 3 OF 12 · FRAME THE RESIDUAL-COPY APPEAL
3. Predefine appeal outcomes and containment
Possible outcomes include rejection, extraction of a bounded artifact, replacement of an archive element, legal hold or temporary preservation pending independent review. Isolate the object and preserve metadata before any transformation.
Name who can decide extraction, sanitisation and route retirement. The reviewer should not be the operator who owns the export job.
| Field | Evidence |
|---|---|
| Object | Identifier |
| Claimed gap | Reconstruction need |
| Exposure | Data classes |
| Authority | Decision owner |
CHAPTER 4 OF 12 · TEST RECONSTRUCTION NEED
4. Compare the object with the archive by evidence type
Use manifests, hashes, schema comparison and controlled reconstruction to identify unique source, code, parameter, environment or provenance evidence. Avoid opening more sensitive content than the comparison requires.
A file-level difference is not automatically scientifically material. Determine whether the difference changes a documented step or the ability to reproduce a reported result.
CHAPTER 5 OF 12 · TEST RECONSTRUCTION NEED
5. Trace the complete export route
Map trigger, code version, service identity, source selection, transformation, destination, supplier settings, retention, infrastructure template, recovery image and runbook. Record which layer can recreate each prerequisite.
Final retirement fails if a deleted schedule can be regenerated from code or an old credential remains valid in a supplier environment.
Evidence check
Ask a second reviewer to reconstruct the example from the preserved evidence and stated assumptions.
CHAPTER 6 OF 12 · TEST RECONSTRUCTION NEED
6. Worked example: a copy contains the missing seed configuration
A second residual export contains raw preference-weight inputs and one configuration file with the container digest and random-seed family omitted from the archive. Independent review confirms that this small artifact is necessary to reconstruct the published sensitivity analysis.
The team extracts the configuration with provenance, verifies reconstruction and sanitises the raw export. Changed-context check: when the same configuration already exists in a validated, versioned archive and reproduces the analysis, duplicate presence in the residual copy does not create a retention need.
| Evidence | Question |
|---|---|
| Data | Unique material input? |
| Code | Version present? |
| Configuration | Parameters and seeds? |
| Provenance | Origin traceable? |
CHAPTER 7 OF 12 · EXTRACT AND DECIDE
7. Extract the scientific minimum with provenance
Copy only the necessary artifact into a quarantined review area, record source object, tool, reviewer, hash and transformation, then move the validated result into the archive under version control.
If extraction changes format, preserve the mapping and verify that the archived artifact still reconstructs the material result without relying on the residual object.
CHAPTER 8 OF 12 · EXTRACT AND DECIDE
8. Decide every known residual and derived copy
After extraction, apply the authorised disposition to the source object, replicas, snapshots, recovery points and derived exports. Verify target identity and method after the relevant propagation window.
Record any bounded legal or records hold with owner, scope and expiry. A held object is not a completed deletion and must not remain on the retired export path.
Evidence check
Verify that the control still reaches the intended decision under a changed but plausible context.
CHAPTER 9 OF 12 · EXTRACT AND DECIDE
9. Retire the export route at every enabling layer
Remove schedules, service identities, secrets, destination rules, infrastructure definitions, recovery templates and supplier permissions. Update runbooks, alerts and ownership so the route cannot return through maintenance or migration.
Do not keep a dormant emergency switch unless it has a current scientific purpose and a separately reviewed boundary. Dormancy is not retirement.
| Layer | Closure |
|---|---|
| Code | Definition removed |
| Identity | Revoked |
| Destination | Rule closed |
| Recovery | Template repaired |
CHAPTER 10 OF 12 · VERIFY FINAL RETIREMENT
10. Exercise reconstruction and route absence together
Reconstruct the material analysis from the validated archive, then deploy and recover representative environments. Confirm that the archive works while the retired export cannot create data in any known destination.
Test an attempted recreation and verify that monitoring identifies the code, identity and destination before data leaves the controlled boundary.
CHAPTER 11 OF 12 · VERIFY FINAL RETIREMENT
11. State limits and common misconceptions
Sanitisation renders target data infeasible to access for a defined effort and method; it does not validate the scientific result. An inventory cannot prove that an unknown copy never existed.
Finding a necessary artifact does not make the whole residual export necessary. Scientific minimum, privacy exposure and route recurrence must be decided separately.
Evidence check
Confirm that versions, notices and unresolved limits remain visible in the final record.
CHAPTER 12 OF 12 · VERIFY FINAL RETIREMENT
12. Close with retirement-survival monitoring
Track export definitions, service identities, secrets, destinations, snapshots, recovery templates, supplier buckets and reconstruction results after change. Reopen review on any attempted recreation or new archive gap.
The gold standard closes when the archive independently reconstructs the material result, known copies have authorised dispositions and the export route is no longer deployable or recoverable.
| Test | Pass condition |
|---|---|
| Reconstruct | Archive succeeds |
| Deploy | No export |
| Recover | Route absent |
| Attempt | Detected and blocked |
Frequently asked questions
Can a second residual copy contain necessary evidence?
Yes, but the review must prove a material archive gap and preserve only the smallest necessary artifact.
Does one useful file justify keeping the raw export?
No. Extract and validate the bounded artifact, then decide the remaining data under its authorised disposition.
What makes export-route retirement final?
Closure of code, schedules, identities, destinations, supplier permissions, recovery templates and runbooks, followed by deployment and recovery tests.
What proves the archive is sufficient?
An independent reconstruction of the material result using the controlled, versioned archive without the residual object.
Continue through verified routes
Core routes
Experimental Design subject root · Gold Standard of Education · Gold Standard directory · How X Works hub
Specialist routes
- Export automation reopening and second residual copy review
- Snapshot deletion verification and copy-path recurrence control
- Reconstruction exception closure drift and residual copy discovery
- Retained-media disposition appeal