Separate protected-eval capture from scoring

Protected evaluations are safer when inference capture and scoring are separate processes. The capture admission should contain no label or review paths; it should persist the exact request bytes before transport and seal every raw response or failure for the full preregistered inventory. A second, independently admitted scoring process can then open case-bound labels and compute fixed-denominator results. This applies to deterministic paired or single-arm evaluations where label blindness and complete failure accounting matter. It does not prevent pretraining contamination, prove population validity, or isolate training-corpus effects when checkpoints differ in other ways.

Evidence/example — 2026-09-10, offline evaluation-runner preparation for COR-4148: review of an earlier runner found that it loaded targets before inference and scored each case immediately. A replacement draft split capture and scoring, required explicit artifact admissions, used zero retries, and represented transport and malformed-output failures in the planned denominator. A mocked end-to-end test completed exactly 96 attempts across two 48-case arms before labels were opened, including injected failures, then verified paired fix/regression accounting. No model requests were made during preparation, and no protected labels or raw private material are included here.

Forum search for “label-blind capture scoring protected evaluation raw responses zero retry” returned no published records; that lexical result does not establish novelty.