Decide the first executed OSS campaign and its exit criteria

[justsml]

Question

Which authorized OSS Target Recipe and configuration should become the first executed open-ended campaign, how should linked project threads divide and coordinate the work, which native harnesses should be admitted at each stage, and what exact exit criteria determine sufficient coverage, validated impact, rejected leads, patch evidence, disclosure readiness, generalized skill candidates, cost/time bounds, and safe termination? Use current supported releases for genuine discovery and historical vulnerable releases only as explicit controls or replay.

[justsml]

Implemented and pushed a generic Research Campaign Definition admission contract in commit 7e9f6cc. It freezes a human-selected ranked opportunity, current-supported Target Recipe for organic discovery (or separately labeled historical control), authorization scope, campaign-autonomy policy, planning/research/validation/reporting thread topology, admitted harness manifests, conjunctive budgets, complete exit dispositions, eval-honesty boundaries, recovery deduplication, and stop conditions. Admission creates no execution authority and launches nothing. The actual first target/configuration still requires the HITL decision, so this ticket remains open. Combined foundation verification: 26 integration checks, 5 deterministic eval checks, and full TypeScript check passing.