Phase 1: M0 experiment register, eval harness scaffold, opengrep acquisition

[tom-snyder]

Summary

The three Milestone 0 packets that need no external data and no inference — M0.1 (experiment register), M0.2 (Python eval harness), M0.7 (opengrep acquisition). Dispatched as three parallel workers with disjoint write scopes, then a critic. Every file landed inside its packet's declared scope; nothing under plan/ was touched.

The one property that matters

eval/register.yaml is what M0.18 reads to decide whether Anvil's detection-model tier exists at all. Two of its rows — EXP-01 (advisory-permutation ablation) and EXP-02 (code-metrics baseline) — can delete that tier entirely.

So one property is load-bearing above all others: a row whose experiment has not run must be impossible to confuse with one that passed. decision is required, non-nullable, with no empty-string and no absent representation. Every unrun row carries the explicit sentinel UNRESOLVED.

Two defects the critic found by mutation — both fixed here

1. The guard had a hole. "An unrun row stays UNRESOLVED" covered not_started/in_progress/blocked and omitted deferred. EXP-05 could be set to PASS and validation accepted it — precisely the "a missing decision reads as a pass" failure the rule exists to prevent. Fixed, and verified by mutating a deferred row and watching it get rejected.

2. Nothing ever ran the schema. The register was validated once, by hand, at authoring time. A schema nobody runs is a comment. eval/tests/test_register_schema.py now runs it, with one mutation test per unrun status, plus malformed-decision and deleted-row cases.

CI gains an eval-harness job, which closes the gap that let both of the above ship green: there was no Python job of any kind, so eval/'s tests could not fail a build no matter what they said.

Escalated, not worked around

M0.7 measured AikidoSec/opengrep-rules at the pinned commit and found TWO rules — both languages: [yaml], both restricted by paths.include to .github/workflows/**. Neither does taint analysis; neither examines application source in any language Anvil targets.

I confirmed this independently against the GitHub API: the repo is 8 KB, and rules/ holds exactly github_workflow_prompt_injection and npm_staged_publishing_missing.

00-SPINE.md §S4 assigns Lane B's source-recall tier to that corpus. If it stands, any target repo without GitHub Actions workflows yields zero candidates, and the adjudicator has nothing to adjudicate. This is a component-selection question for the spine, not something a worker may decide — so it is reported rather than patched around, and INSTR-01 should not be read as a recall measurement until it resolves.

Honest gaps

• The opengrep end-to-end path is UNVERIFIED. Nothing was downloaded or executed (my scope limit). Its four tests SKIP with an explicit reason naming the missing artefact, and smoke.py exits 2 — a code reserved for "artefact absent", distinct from pass/fail — rather than reporting an empty result.
• The cross-family critic did not run. openrouter/openai/gpt-oss-20b:free exited cleanly after 88 s having emitted zero tokens; the reroute also failed. 00-ROUTING.md makes cross-family critique a hard requirement for licence conclusions, so that gate is unfilled for M0.7's licence findings and is not being represented as satisfied.
• Workers flagged their own unverified transcriptions (baselines taken from the plan's restatement rather than re-read from research/). Those are recorded in the packet reports.

Testing

pip install -e eval/     ok
pytest tests/ -q         24 passed
register validates       0 errors, 14/14 ids, each exactly once
mutation: deferred+PASS  REJECTED  (was ACCEPTED before this PR)