Add Neuronpedia v0.1 artifact, provider, and intervention schema bumps

[mdheller]

Summary

Adds the first Neuronpedia integration schema tranche as three bounded v0.1 schema surfaces:

• ArtifactSourceLock
• ProviderBinding
• InterventionSpec

This is intentionally schema/fixture work only. It does not touch the M1 runner and does not add runtime execution authority.

Added

Schemas:

• schemas/neuronpedia/artifact-source-lock.v0.1.json
• schemas/neuronpedia/provider-binding.v0.1.json
• schemas/neuronpedia/intervention-spec.v0.1.json

Fixtures:

• tests/fixtures/neuronpedia/artifact-source-lock.synthetic.json
• tests/fixtures/neuronpedia/artifact-source-lock.mutable.invalid.synthetic.json
• tests/fixtures/neuronpedia/provider-binding.synthetic.json
• tests/fixtures/neuronpedia/provider-binding.writeback.invalid.synthetic.json
• tests/fixtures/neuronpedia/intervention-spec.synthetic.json
• tests/fixtures/neuronpedia/intervention-spec.execution.invalid.synthetic.json

Make targets:

• neuronpedia-static
• neuronpedia-schema-fixtures
• neuronpedia-ci

certificate-ci now includes neuronpedia-ci.

Schema intent

ArtifactSourceLock

Locks an external or mirrored interpretability artifact to an immutable source reference. It requires a source hash, provenance level, append-only mutation policy, and explicit non-claims.

ProviderBinding

Declares a local binding to an external interpretability provider without granting provider trust, writeback authority, live fetch authority, or claim-promotion authority.

InterventionSpec

Declares a bounded interpretability intervention plan over locked artifacts and provider bindings. It explicitly does not authorize execution, live model mutation, provider writeback, behavioral claim promotion, or safety claims.

Boundary discipline

This PR does not:

• modify M1 runner behavior
• fetch live Neuronpedia data
• authorize model interventions
• authorize provider writeback
• promote behavior claims
• assert artifact authenticity
• add runtime authority

Validation surface

The new fixtures enforce both positive and negative cases:

• mutable artifact locks are rejected
• provider writeback bindings are rejected
• intervention specs that allow live mutation or promote claims are rejected

Review focus

• Are the non-claims complete enough?
• Should provider bindings require an explicit policy reference when may_fetch_live=true in a future revision?
• Should InterventionSpec.execution_status remain review-only by default?
• Are the schema names and target paths aligned with existing lawful-learning/certificate conventions?

Local CI

Not run locally through the connector. Opened as draft pending CI/review.

[mdheller]

Superseding this PR rather than merging it.

Reason: the generalized interpretability harness is now merged on main via PR #11, with current-main CI wiring via PR #28 and Neuronpedia registry-only steering negative coverage via PR #29. The canonical surfaces are now:

• schemas/interpretability/provider-binding.v0.json
• schemas/interpretability/artifact-source-lock.v0.json
• schemas/interpretability/feature-registry-entry.v0.json
• schemas/interpretability/intervention-spec.v0.json
• tests/fixtures/interpretability/*
• scripts/check-interpretability-harness.py
• GNUmakefile interpretability harness targets

This PR creates a second parallel namespace under schemas/neuronpedia/* and edits the stale Makefile, which would duplicate the now-canonical harness vocabulary. The useful boundary intent from this branch has been preserved in the merged harness path, especially PR #29: registry-only Neuronpedia evidence may support candidate discovery and citation, but cannot be treated as a live steering substrate.

Non-claim: this is not rejecting Neuronpedia integration. It is rejecting a parallel schema namespace now that the provider-agnostic harness owns the surface.

[mdheller]

Hardening update added.

ArtifactSourceLock now explicitly requires:

• decomposition_type
• frozen decomposition metadata
• explicit no_decomposition_correctness_claim

Additional negative fixture added:

• artifact-source-lock.missing-decomposition.invalid.synthetic.json

The negative-fixture surface now separates:

• mutable lock failure
• missing decomposition-type failure

This isolates moat commitment enforcement more cleanly:

• Commitment 1: append-only, content-hash-bound source locks
• Commitment 7: decomposition type must be declared and pinned per artifact

neuronpedia-schema-fixtures now validates both negative cases.