Add exitdrill mutate to build seeded adversarial derivatives of an export

[ChelseaKR]

What

exitdrill mutate export.json --attachment-root files/ --out lossy/ --seed 7 --drop-relationships 2 --corrupt-attachment 1 --strip-permissions 1 --drop-audit-events 2 --alter-field 1 builds a deterministic adversarial derivative of any synthetic normalized export — the generalisation of scripts/build_directus_lossy_canary.py, which hard-codes one profile's mutations. It keeps entity row counts unchanged (the "same count, different evidence" attack the README highlights), writes a mutation-statement.json listing exactly what it changed as aggregate counts (never record ids or values), and refuses any input that lacks the synthetic-only marker.

Why it matters

Negative controls are how this project proves its gates can fail: the lossy canary exists because a clean fixture alone proves nothing. Today every new fixture needs a hand-written mutation script, so the negative control is the part most likely to be skipped. A seeded mutator makes "this evaluator would have caught it" a one-line check for any synthetic contract, and it is squarely inside the freeze — a test-tooling verb over the existing normalized contract, adding no connector or data category. It also gives the outside-person walkthrough (#51) a second thing to try.

Scope

• mutate.py with pure, seeded mutation operators per dimension; output through the same bounded atomic writer; statement document with a schema.
• validate accepts the derivative; drill on it must report not_structurally_restorable with the dimensions named in the statement failing.
• scripts/build_directus_lossy_canary.py reimplemented on top of the operators, with its committed statement byte-identical (acceptance test).

Out of scope

• Mutating baselines or capture bundles; random or unseeded modes; any mutation that changes entity counts.

Done when

• Same seed and flags → byte-identical derivative and statement; different seed → different derivative, same statement counts.
• Drilling the derivative fails exactly the dimensions the statement names and no others.
• An export without the synthetic marker is refused before any file is written.
• The statement contains no record value from the input (disclosure gate).

Pointers

• scripts/build_directus_lossy_canary.py (_mutate), src/exitdrill/loader.py, src/exitdrill/models.py, src/exitdrill/paths.py
• README "Three-minute demo"; docs/decisions/0021-gate-record-value-disclosure-on-the-synthetic-demo.md

Proposed with AI assistance.

[ChelseaKR]

Measured against origin/main at 86e8773: the acceptance test names a file that is not committed, so as written it cannot be run.

The Scope bullet reads:

scripts/build_directus_lossy_canary.py reimplemented on top of the operators, with its committed statement byte-identical (acceptance test).

The statement is adversarial-derivative.json, written at scripts/build_directus_lossy_canary.py:240 into a staging path and carrying "schema_version": "exitdrill/adversarial-derivative/v0.1" (line 244). Its destination is a required CLI argument (--statement, line 276), and the only caller passes a temporary directory: scripts/check_directus_canary_demo.py:186 builds it under tempfile.TemporaryDirectory(prefix="exitdrill-directus-canary-") (lines 180-181). It is created and destroyed inside the demo run.

git cat-file -e origin/main:<path> says it is absent everywhere it could plausibly live:

• examples/directus-11.17.4-civic-case/adversarial-derivative.json — missing
• examples/synthetic-crm-lossy/adversarial-derivative.json — missing
• adversarial-derivative.json (repo root) — missing

git ls-tree -r --name-only origin/main | grep -i adversar returns exactly one path, and it is a script: scripts/build_civicrm_target_adversaries.py. Its sibling statement (adversarial-derivatives.json) is likewise generated into a temp directory and never committed. .gitignore does not exclude either; they were simply never committed, because the derivative bundles themselves are not committed.

The likely source of the belief is examples/directus-11.17.4-civic-case/README.md:150, which refers to "what the derivative's adversarial-derivative.json statement declares" as though it were a durable artifact.

Two ways forward, and the choice changes what the test is worth:

1. Restate the criterion as "byte-identical to the statement the current builder emits", which is what scripts/check_directus_canary_demo.py and tests/test_directus_demo.py already assert at runtime. Smallest change; the test stays a refactor-equivalence check, which is what this issue actually needs.
2. Commit a statement and hold the builder to it. Stronger, but it commits a new evidence artifact, which touches the freeze question this issue's own framing turns on.

Reading 1 looks right to me, but it is a change to an acceptance criterion the owner wrote, so I have not edited the issue. The rest of #132 (exitdrill mutate over the normalized contract, seeded and deterministic) is specified well enough to build once this bullet is settled.

Prepared with AI assistance; reviewed before submission.