Decide harness-study admission and attribution design

[justsml]

Question

Given the researched comparison contract, how should native Codex, Claude Code, and OpenCode studies be admitted progressively rather than as a default full-factorial matrix, and how should target state, prompts, human help, native tools, active working time, tokens/cost, setup friction, dead-end recovery, patches, disclosure readiness, signal confidence, cross-association, independently validated findings, and demonstrated security effect be attributed without collapsing effectiveness into one leaderboard score? Decide pilot gates, replication, invalid-run classes, stopping rules, and when a future ExploitHunter tool-combination or per-model study becomes warranted.

[justsml]

Implemented and pushed the deterministic native-harness study admission foundation in commit 5755aa5. It validates requested versus observed provider/model/effort, exact-route funding evidence, structured-terminal and usage canaries, sandbox denial observations, forbidden permission-bypass flags, progressive prerequisites, same-model bridge matching, and frozen cohort/budget invariants. It also defines a multidimensional outcome vector without collapsing results into a leaderboard. Focused eval contract: 5 passing tests. Full TypeScript check passes. No provider, paid, or target-backed run was launched. Keeping this HITL decision ticket open.