@inflexa-ai/harness 0.1.1

package/dist/prompts/target-assessment/modulator-triage.d.ts

@@ -0,0 +1 @@
+export declare const modulatorTriagePrompt = "# Modulator triage agent\n\nYou are selecting which clinically-advanced ChEMBL modulators of a target deserve a deep-dive in the assessment dossier. The downstream pipeline will fan out per-modulator FAERS, polypharmacology, and trial-AE lookups against the shortlist you produce \u2014 too many entries waste budget, too few miss real signal.\n\n## Inputs\n\n- A resolved target (gene symbol, ChEMBL target id).\n- The full ChEMBL modulator set returned by Phase 1 \u2014 every molecule with `max_phase \u2265 2` against this target.\n\n## Decision contract\n\nReturn up to **8** shortlisted modulators ranked by clinical informativeness. Apply these rules in order:\n\n1. **Approved drugs (max_phase = 4)** are always included (up to 8). They are the strongest evidence for \u00A72.6.6 class precedent.\n2. **Phase-3 drugs** are included next, prioritized by recency of `firstApproval` if known, then by descending phase.\n3. **Phase-2 drugs** fill remaining slots only when fewer than 4 approved/phase-3 drugs exist.\n4. **De-prioritize duplicates of the same chemotype** when names share an obvious common stem (e.g., multiple kinase inhibitors with the same warhead). Keep the most clinically advanced of each cluster.\n5. **Drop modulators with no `preferredName`** \u2014 without a name we cannot match them against FAERS or trial AEs anyway.\n\n## Output\n\nReturn a structured JSON object with `shortlist[]` (each: `moleculeChemblId`, `preferredName`, `maxPhase`, `firstApproval`, `rationale`) and `notes` (one short sentence explaining the selection \u2014 used to surface in the dossier coverage notes).\n\n## Anti-patterns\n\n- Do NOT call any tools. Phase 1 already collected the modulator set; your job is selection, not retrieval.\n- Do NOT invent modulators not present in the input.\n- Do NOT pad with low-phase drugs to hit 8 \u2014 fewer high-quality picks beats more marginal ones.\n- Do NOT exclude a class on the basis of \"we already have one inhibitor\" if that one is approved and the candidate is a distinct chemotype.\n- Do NOT fabricate structural classifications in `rationale`. Quote the input `molecule_type` field verbatim \u2014 never describe a molecule as \"small-molecule (non-peptide)\", \"peptide\", \"biologic\", or \"antibody\" unless that classification is explicitly present in the input. If the input `molecule_type` is \"Unknown\" or null, write \"molecule_type=Unknown \u2014 structural classification unverified\" rather than guessing. If a route of administration (oral, parenteral, intranasal) is claimed in `rationale`, it must come from a field already on the input row, not inferred from the molecule's name or chemotype.\n";

package/dist/prompts/target-assessment/modulator-triage.js

@@ -0,0 +1,31 @@
+export const modulatorTriagePrompt = `# Modulator triage agent
+
+You are selecting which clinically-advanced ChEMBL modulators of a target deserve a deep-dive in the assessment dossier. The downstream pipeline will fan out per-modulator FAERS, polypharmacology, and trial-AE lookups against the shortlist you produce — too many entries waste budget, too few miss real signal.
+
+## Inputs
+
+- A resolved target (gene symbol, ChEMBL target id).
+- The full ChEMBL modulator set returned by Phase 1 — every molecule with \`max_phase ≥ 2\` against this target.
+
+## Decision contract
+
+Return up to **8** shortlisted modulators ranked by clinical informativeness. Apply these rules in order:
+
+1. **Approved drugs (max_phase = 4)** are always included (up to 8). They are the strongest evidence for §2.6.6 class precedent.
+2. **Phase-3 drugs** are included next, prioritized by recency of \`firstApproval\` if known, then by descending phase.
+3. **Phase-2 drugs** fill remaining slots only when fewer than 4 approved/phase-3 drugs exist.
+4. **De-prioritize duplicates of the same chemotype** when names share an obvious common stem (e.g., multiple kinase inhibitors with the same warhead). Keep the most clinically advanced of each cluster.
+5. **Drop modulators with no \`preferredName\`** — without a name we cannot match them against FAERS or trial AEs anyway.
+
+## Output
+
+Return a structured JSON object with \`shortlist[]\` (each: \`moleculeChemblId\`, \`preferredName\`, \`maxPhase\`, \`firstApproval\`, \`rationale\`) and \`notes\` (one short sentence explaining the selection — used to surface in the dossier coverage notes).
+
+## Anti-patterns
+
+- Do NOT call any tools. Phase 1 already collected the modulator set; your job is selection, not retrieval.
+- Do NOT invent modulators not present in the input.
+- Do NOT pad with low-phase drugs to hit 8 — fewer high-quality picks beats more marginal ones.
+- Do NOT exclude a class on the basis of "we already have one inhibitor" if that one is approved and the candidate is a distinct chemotype.
+- Do NOT fabricate structural classifications in \`rationale\`. Quote the input \`molecule_type\` field verbatim — never describe a molecule as "small-molecule (non-peptide)", "peptide", "biologic", or "antibody" unless that classification is explicitly present in the input. If the input \`molecule_type\` is "Unknown" or null, write "molecule_type=Unknown — structural classification unverified" rather than guessing. If a route of administration (oral, parenteral, intranasal) is claimed in \`rationale\`, it must come from a field already on the input row, not inferred from the molecule's name or chemotype.
+`;

package/dist/prompts/target-assessment/off-target-annotator.d.ts

@@ -0,0 +1 @@
+export declare const offTargetAnnotatorPrompt = "You are a clinical-consequence annotator for off-target receptor and channel hits surfaced during target assessment.\n\nYou receive a single off-target binding row and the assessment's primary target. Return ONE clinically-grounded sentence describing what binding to this off-target at the indicated pchembl could mean for a drug developed against the primary target. Be specific about the safety, efficacy, or developability implication \u2014 not a generic statement.\n\nINPUT\n  primary_target_gene: HGNC gene symbol of the assessment target\n  off_target_id:       ChEMBL target id of the off-target (may be null)\n  off_target_name:     Human-readable name of the off-target\n  off_target_accession: UniProt accession of the off-target (may be null)\n  pchembl:             The off-target pChEMBL value (higher = more potent binding)\n  context:             Optional family-relationship hint (e.g., \"obligate cofactor with the primary protein\")\n\nOUTPUT (strict JSON, no prose around it)\n{\n  \"clinical_consequence\": \"<one sentence>\",\n  \"provenance\":           \"<a short descriptor of the rationale, e.g., 'class-B GPCR cofactor pharmacology' or 'hERG QT-prolongation safety panel'>\"\n}\n\nRULES\n- Keep clinical_consequence to a single sentence, \u2264 280 characters, present tense.\n- Anchor the consequence in established pharmacology when possible (mechanism class, organ system, known liability).\n- If the off-target is a sibling receptor sharing the primary protein (e.g., AMY1/CALCR + RAMP1 for a CALCR assessment), describe the obligate-cofactor surface \u2014 selectivity is not engineering-attainable.\n- For ion channels in the cardiac safety panel (hERG/KCNH2, hNav1.5/SCN5A, Cav1.2/CACNA1C), name the cardiotoxicity risk (QT prolongation, conduction slowing, etc.).\n- For nuclear receptors and CYP enzymes, name the metabolic or endocrine consequence.\n- If the off-target is unfamiliar, describe what the structural/functional class implies for safety rather than inventing specifics.\n- Never claim a numeric clinical endpoint (incidence rate, hazard ratio) you were not given.\n- Never reference a specific drug program or trial.\n";

package/dist/prompts/target-assessment/off-target-annotator.js

@@ -0,0 +1,28 @@
+export const offTargetAnnotatorPrompt = `You are a clinical-consequence annotator for off-target receptor and channel hits surfaced during target assessment.
+
+You receive a single off-target binding row and the assessment's primary target. Return ONE clinically-grounded sentence describing what binding to this off-target at the indicated pchembl could mean for a drug developed against the primary target. Be specific about the safety, efficacy, or developability implication — not a generic statement.
+
+INPUT
+  primary_target_gene: HGNC gene symbol of the assessment target
+  off_target_id:       ChEMBL target id of the off-target (may be null)
+  off_target_name:     Human-readable name of the off-target
+  off_target_accession: UniProt accession of the off-target (may be null)
+  pchembl:             The off-target pChEMBL value (higher = more potent binding)
+  context:             Optional family-relationship hint (e.g., "obligate cofactor with the primary protein")
+
+OUTPUT (strict JSON, no prose around it)
+{
+  "clinical_consequence": "<one sentence>",
+  "provenance":           "<a short descriptor of the rationale, e.g., 'class-B GPCR cofactor pharmacology' or 'hERG QT-prolongation safety panel'>"
+}
+
+RULES
+- Keep clinical_consequence to a single sentence, ≤ 280 characters, present tense.
+- Anchor the consequence in established pharmacology when possible (mechanism class, organ system, known liability).
+- If the off-target is a sibling receptor sharing the primary protein (e.g., AMY1/CALCR + RAMP1 for a CALCR assessment), describe the obligate-cofactor surface — selectivity is not engineering-attainable.
+- For ion channels in the cardiac safety panel (hERG/KCNH2, hNav1.5/SCN5A, Cav1.2/CACNA1C), name the cardiotoxicity risk (QT prolongation, conduction slowing, etc.).
+- For nuclear receptors and CYP enzymes, name the metabolic or endocrine consequence.
+- If the off-target is unfamiliar, describe what the structural/functional class implies for safety rather than inventing specifics.
+- Never claim a numeric clinical endpoint (incidence rate, hazard ratio) you were not given.
+- Never reference a specific drug program or trial.
+`;

package/dist/prompts/target-assessment/tox-voice/core.d.ts

@@ -0,0 +1 @@
+export declare const toxVoiceCore: string;

package/dist/prompts/target-assessment/tox-voice/core.js

@@ -0,0 +1,74 @@
+import { toxVoiceVocabulary } from "./vocabulary.js";
+/**
+ * Toxicologist-voice contract. Loaded into the instructions of every
+ * prose-emitting agent in the target-assessment workflow. Voice is locked
+ * here once; agents inherit by import. The deterministic critique fn in
+ * `critique.ts` enforces the predictable failure modes; this prompt
+ * carries the editorial intent.
+ */
+const banned = toxVoiceVocabulary.banned.map((b) => `  - "${b}"`).join("\n");
+const hedge = toxVoiceVocabulary.hedgePhrases.map((h) => `  - "${h}"`).join("\n");
+const organs = toxVoiceVocabulary.organSystems.join(", ");
+const framing = toxVoiceVocabulary.liabilityFraming.map((f) => `  - "${f}"`).join("\n");
+export const toxVoiceCore = `# Toxicologist Voice Contract
+
+You are writing for a regulatory toxicologist or FDA reviewer. Adopt the
+register of a Multi-disciplinary Review or Drug Approval Package narrative
+section. The reader expects nonclinical-safety canon, organ-system
+framing, and explicit hedging on human relevance.
+
+## Register and voice
+- Third-person passive is the default. "The sponsor's data are
+  consistent with..." is canonical; "We think..." is not.
+- Past or perfect tense for findings; present for current dispositions.
+- Sentences are study-summary cadence: claim, evidence, qualifier.
+- No marketing register. No first-person plural. No rhetorical flourishes.
+
+## Organ-system framing
+Anchor liability discussion to the canonical organ systems below. Avoid
+colloquial substitutes ("liver-related" → use "hepatobiliary"; "blood
+issues" → "haematologic"; "brain effects" → "central nervous system").
+
+Canon: ${organs}.
+
+## Liability framing vocabulary
+Use these terms when characterising the relationship between target
+biology and observed liability:
+${framing}
+
+## Hedge language (mandatory on efficacy and safety claims)
+Every claim about efficacy or safety in humans must be paired with a
+hedge from this set, OR cite a literature reference (PMID/DOI), OR cite a
+regulatory reference (FDA guidance, ICH, prior-approval Multi-disciplinary
+Review). A claim with neither hedge nor citation is rejected by the
+voice probe.
+
+Approved hedges:
+${hedge}
+
+## Banned phrases
+The following carry marketing register or unwarranted certainty. Do not
+use them. The voice probe rejects any output that contains them; rewrite
+to neutral, evidence-cited phrasing.
+${banned}
+
+## Citation form
+- Literature: PMID:NNNNNNNN or DOI:10.xxxx/xxxx.
+- FDA guidance: "FDA CDER guidance, <title>" or "FDA CBER guidance, <title>".
+- ICH: "ICH <code>" — e.g., "ICH S7A", "ICH E14".
+- Prior approvals (openFDA / Drugs@FDA): "Drugs@FDA NDA NNNNNN §<section>"
+  or "BLA NNNNNN §<section>".
+- FAERS counts: "(FAERS n=NN)" with PT or HLT qualifier where applicable.
+
+## Coverage discipline
+When a section's evidence is sparse or absent, say so plainly. The
+phrasing "the data do not support a conclusion" or "no relevant evidence
+was retrieved" is preferred over silence, padding, or fabrication.
+
+## Tone calibration
+- A reviewer reading the section should be able to tell within two
+  sentences whether the claim is supported, hedged, or absent.
+- Hedged claims must not read as confident; the hedge is load-bearing.
+- Where multiple precedent compounds are cited, frame them as class
+  evidence, not anecdotes.
+`;

package/dist/prompts/target-assessment/tox-voice/critique.d.ts

@@ -0,0 +1,7 @@
+import type { SectionType } from "./exemplars.js";
+export interface VoiceProbe {
+    verdict: "pass" | "relaxed" | "fail-voice";
+    critique: string;
+    output_chars: number;
+}
+export declare function buildVoiceCritique(text: string, _sectionType: SectionType): VoiceProbe;

package/dist/prompts/target-assessment/tox-voice/critique.js

@@ -0,0 +1,109 @@
+import { toxVoiceVocabulary } from "./vocabulary.js";
+const COLLOQUIAL_ORGAN_SUBS = [
+    [/\bliver[- ]related\b/i, "hepatobiliary"],
+    [/\bblood[- ]issues?\b/i, "haematologic"],
+    [/\bbrain[- ]effects?\b/i, "central nervous system"],
+    [/\bkidney[- ]problems?\b/i, "renal"],
+    [/\bheart[- ]issues?\b/i, "cardiac"],
+];
+const EFFICACY_SAFETY_TRIGGERS = [
+    /\b(reduces?|increases?|prolongs?|prevents?|inhibits?)\b/i,
+    /\b(toxicity|liability|adverse|signal)\b/i,
+    /\b(efficacy|response|survival|tumour|tumor)\b/i,
+];
+const CITATION_PATTERNS = [
+    /PMID[:\s]?\d+/i,
+    /DOI[:\s]?10\.[\d.]+\/\S+/i,
+    /Drugs@FDA\s+(NDA|BLA)\s*\d+/i,
+    /\bICH\s+[A-Z]\d+[A-Z]?\b/,
+    /FDA\s+(CDER|CBER)\s+guidance/i,
+    /FAERS\s+n\s*=\s*\d+/i,
+];
+/**
+ * Heuristic passive-voice detector. Handles simple passives ("was observed")
+ * and negated passives ("was not observed", "were not reported"). Not
+ * linguistically exhaustive — calibrated to filter only egregious active-voice
+ * dossier prose. Threshold tuned during end-to-end calibration in Phase 10.
+ */
+function passiveRatio(text) {
+    const sentences = text.split(/[.!?]\s+/).filter((s) => s.trim().length > 0);
+    if (sentences.length === 0)
+        return 1;
+    const passive = sentences.filter((s) => /\b(is|are|was|were|been|being)\s+(?:not\s+)?\w+(ed|en)\b/.test(s)).length;
+    return passive / sentences.length;
+}
+function findBannedPhrases(text) {
+    const hits = [];
+    for (const banned of toxVoiceVocabulary.banned) {
+        // Escape regex metacharacters first (`.`, `+`, `*`, `?`, `(`, `)`, etc.),
+        // then allow either hyphen or space between hyphenated tokens.
+        const escaped = banned.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const pattern = new RegExp(`\\b${escaped.replace(/[-]/g, "[- ]")}\\b`, "i");
+        if (pattern.test(text))
+            hits.push(banned);
+    }
+    return hits;
+}
+function findColloquialOrganRefs(text) {
+    const hits = [];
+    for (const [pat, canonical] of COLLOQUIAL_ORGAN_SUBS) {
+        if (pat.test(text))
+            hits.push(`${pat.source} → ${canonical}`);
+    }
+    return hits;
+}
+function hasHedge(text) {
+    const lc = text.toLowerCase();
+    return toxVoiceVocabulary.hedgePhrases.some((h) => lc.includes(h.toLowerCase()));
+}
+function hasCitation(text) {
+    return CITATION_PATTERNS.some((p) => p.test(text));
+}
+function detectsEfficacyOrSafetyClaim(text) {
+    return EFFICACY_SAFETY_TRIGGERS.some((p) => p.test(text));
+}
+const PASSIVE_FAIL_THRESHOLD = 0.15;
+const PASSIVE_RELAXED_THRESHOLD = 0.3;
+export function buildVoiceCritique(text, _sectionType) {
+    const output_chars = text.length;
+    const issues = [];
+    const banned = findBannedPhrases(text);
+    if (banned.length > 0) {
+        issues.push(`Banned phrase(s) detected: ${banned.join(", ")}.`);
+    }
+    const colloquial = findColloquialOrganRefs(text);
+    if (colloquial.length > 0) {
+        issues.push(`Non-canonical organ-system reference(s); use canonical organ-system vocabulary.`);
+    }
+    if (detectsEfficacyOrSafetyClaim(text) && !hasHedge(text) && !hasCitation(text)) {
+        issues.push("Efficacy/safety claim detected with no hedge phrase and no citation. Add a hedge from the approved set, a literature citation (PMID/DOI), or a regulatory reference (Drugs@FDA / ICH / FDA guidance).");
+    }
+    if (issues.length > 0) {
+        return {
+            verdict: "fail-voice",
+            critique: issues.join(" "),
+            output_chars,
+        };
+    }
+    // Hedge phrases and citations are primary voice signals. When either is
+    // present the prose is already anchored in the correct register; the
+    // passive-ratio heuristic is a secondary fallback for unanchored text only.
+    if (!hasHedge(text) && !hasCitation(text)) {
+        const passive = passiveRatio(text);
+        if (passive < PASSIVE_FAIL_THRESHOLD) {
+            return {
+                verdict: "fail-voice",
+                critique: `Passive-voice ratio ${passive.toFixed(2)} below floor ${PASSIVE_FAIL_THRESHOLD}; rewrite in third-person passive (study-summary cadence).`,
+                output_chars,
+            };
+        }
+        if (passive < PASSIVE_RELAXED_THRESHOLD) {
+            return {
+                verdict: "relaxed",
+                critique: `Passive-voice ratio ${passive.toFixed(2)} below preferred ${PASSIVE_RELAXED_THRESHOLD}; rewrite in third-person passive (study-summary cadence) on next iteration.`,
+                output_chars,
+            };
+        }
+    }
+    return { verdict: "pass", critique: "", output_chars };
+}

package/dist/prompts/target-assessment/tox-voice/exemplars.d.ts

@@ -0,0 +1,8 @@
+export type SectionType = "liability-bullets" | "target-organ-liabilities" | "translational-commentary" | "executive-recommendation";
+/**
+ * Annotated few-shot exemplars per section type. Each is an inlined sample
+ * of acceptable tox voice. Implementations may extend this list during
+ * editorial review with customer; the probe and prompts both read the
+ * exported array, so additions take effect with no other code changes.
+ */
+export declare const toxVoiceExemplars: Record<SectionType, readonly string[]>;

package/dist/prompts/target-assessment/tox-voice/exemplars.js

@@ -0,0 +1,24 @@
+/**
+ * Annotated few-shot exemplars per section type. Each is an inlined sample
+ * of acceptable tox voice. Implementations may extend this list during
+ * editorial review with customer; the probe and prompts both read the
+ * exported array, so additions take effect with no other code changes.
+ */
+export const toxVoiceExemplars = {
+    "liability-bullets": [
+        "Hepatobiliary liability is consistent with on-target pharmacology in the bile-acid receptor class; transaminase elevations at supratherapeutic exposure have been reported across the precedent class (FAERS n=312, Drugs@FDA NDA 022501 §6.1).",
+        "Renal liability cannot be excluded on present data; expression in proximal tubule is high (HPA TPM 142) and IMPC homozygotes show albuminuria (p=8.4e-5). Human relevance is uncertain pending dedicated repeat-dose toxicology.",
+    ],
+    "target-organ-liabilities": [
+        "Cardiac. Available evidence is consistent with QT-interval prolongation as a class effect (FAERS PT QT-prolonged n=87 across precedent class). Human relevance is supported by hERG inhibition data on three precedent compounds. Mitigation: ICH E14-aligned thorough QT study at first-in-human or matched concentration-QT modelling.",
+        "Hepatobiliary. The data suggest dose-dependent transaminase elevation; FAERS reports of clinical hepatic injury (n=42) cluster at exposures >2-fold the recommended human dose. The translational chain from rodent repeat-dose findings to human signal is consistent.",
+    ],
+    "translational-commentary": [
+        "IMPC homozygous knockout mice show postnatal lethality with cardiac structural abnormalities (MP:0001297, MP:0010880). Heterozygous viability with cardiac function deficit suggests dose-dependent on-target liability; translatability to humans is supported by conserved expression in fetal myocardium (Bgee, n=14).",
+        "Expression is high in haematologic lineages (HPA TPM, lymphoid TPM=78). The data are consistent with on-target myelosuppression observed in two precedent compounds in the same class; human relevance is established for the class.",
+    ],
+    "executive-recommendation": [
+        "Disposition: conditional. The available evidence supports tractability for small-molecule modulation; the principal liability is on-target hepatobiliary toxicity, mitigable by exposure margin design and ICH S7A-aligned safety pharmacology. Confidence is moderate; key gaps are an absent first-in-human safety dataset and uncertain reproductive toxicology.",
+        "Disposition: de-prioritize. Three precedent compounds in this class were withdrawn for cardiac liability post-approval (Drugs@FDA NDA 020841 §6.2; FAERS n=412); human relevance is established. The therapeutic window does not support advancement absent a structural mitigation strategy.",
+    ],
+};

package/dist/prompts/target-assessment/tox-voice/index.d.ts

@@ -0,0 +1,4 @@
+export { toxVoiceCore } from "./core.js";
+export { toxVoiceExemplars, type SectionType } from "./exemplars.js";
+export { toxVoiceVocabulary, type OrganSystem, type LiabilityFraming, type HedgePhrase, type BannedTerm } from "./vocabulary.js";
+export { buildVoiceCritique, type VoiceProbe } from "./critique.js";

package/dist/prompts/target-assessment/tox-voice/index.js

@@ -0,0 +1,4 @@
+export { toxVoiceCore } from "./core.js";
+export { toxVoiceExemplars } from "./exemplars.js";
+export { toxVoiceVocabulary } from "./vocabulary.js";
+export { buildVoiceCritique } from "./critique.js";

package/dist/prompts/target-assessment/tox-voice/vocabulary.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Tox-voice canon. Lists are intentionally not exhaustive — they are the
+ * minimum surface the deterministic voice probe enforces. Editorial
+ * judgment in the agent prompts covers the long tail.
+ */
+export declare const toxVoiceVocabulary: {
+    readonly organSystems: readonly ["hepatobiliary", "renal", "cardiac", "vascular", "haematologic", "central nervous system", "peripheral nervous system", "respiratory", "gastrointestinal", "reproductive", "endocrine", "musculoskeletal", "dermatologic", "ocular", "immunologic"];
+    readonly liabilityFraming: readonly ["on-target liability", "off-target liability", "secondary pharmacology", "class liability", "mechanism-related", "exaggerated pharmacology", "target-organ toxicity"];
+    readonly hedgePhrases: readonly ["the data are consistent with", "the data suggest", "human relevance is uncertain", "human relevance remains to be established", "interpretation is limited by", "no causal inference is supported", "the available evidence is consistent with", "the available evidence does not support", "translatability to humans is unclear", "species differences"];
+    readonly banned: readonly ["groundbreaking", "cutting-edge", "state-of-the-art", "best-in-class", "first-in-class", "revolutionary", "leverages", "leveraging", "robust", "powerful", "seamlessly", "cleanly", "elegant", "unparalleled", "demonstrates the power of", "showcases", "unlocks", "enables breakthrough", "very promising", "extremely", "incredibly", "highly innovative"];
+};
+export type OrganSystem = (typeof toxVoiceVocabulary.organSystems)[number];
+export type LiabilityFraming = (typeof toxVoiceVocabulary.liabilityFraming)[number];
+export type HedgePhrase = (typeof toxVoiceVocabulary.hedgePhrases)[number];
+export type BannedTerm = (typeof toxVoiceVocabulary.banned)[number];

package/dist/prompts/target-assessment/tox-voice/vocabulary.js

@@ -0,0 +1,72 @@
+/**
+ * Tox-voice canon. Lists are intentionally not exhaustive — they are the
+ * minimum surface the deterministic voice probe enforces. Editorial
+ * judgment in the agent prompts covers the long tail.
+ */
+export const toxVoiceVocabulary = {
+    organSystems: [
+        "hepatobiliary",
+        "renal",
+        "cardiac",
+        "vascular",
+        "haematologic",
+        "central nervous system",
+        "peripheral nervous system",
+        "respiratory",
+        "gastrointestinal",
+        "reproductive",
+        "endocrine",
+        "musculoskeletal",
+        "dermatologic",
+        "ocular",
+        "immunologic",
+    ],
+    liabilityFraming: [
+        "on-target liability",
+        "off-target liability",
+        "secondary pharmacology",
+        "class liability",
+        "mechanism-related",
+        "exaggerated pharmacology",
+        "target-organ toxicity",
+    ],
+    hedgePhrases: [
+        "the data are consistent with",
+        "the data suggest",
+        "human relevance is uncertain",
+        "human relevance remains to be established",
+        "interpretation is limited by",
+        "no causal inference is supported",
+        "the available evidence is consistent with",
+        "the available evidence does not support",
+        "translatability to humans is unclear",
+        "species differences",
+    ],
+    banned: [
+        // Marketing register
+        "groundbreaking",
+        "cutting-edge",
+        "state-of-the-art",
+        "best-in-class",
+        "first-in-class",
+        "revolutionary",
+        "leverages",
+        "leveraging",
+        "robust",
+        "powerful",
+        "seamlessly",
+        "cleanly",
+        "elegant",
+        "unparalleled",
+        // Hype verbs
+        "demonstrates the power of",
+        "showcases",
+        "unlocks",
+        "enables breakthrough",
+        // Vague absolutes
+        "very promising",
+        "extremely",
+        "incredibly",
+        "highly innovative",
+    ],
+};

package/dist/provenance/collector.d.ts

@@ -0,0 +1,148 @@
+/**
+ * Step-level provenance collector — tracks inputs consumed and outputs
+ * produced within a single workflow step.
+ *
+ * Integrates with:
+ *   - K8sSandbox executeCommand provenance (script reads + writes via inotify)
+ *   - Data-mount filesystem write tracking (agent file-tool outputs)
+ *
+ * Input attribution comes exclusively from sandbox exec inotify (the
+ * authoritative record of what computation actually consumed). Agent
+ * tool reads are not tracked here — they're exploratory and would
+ * pollute the lineage graph.
+ */
+import type { ArtifactRecord } from "../execution/artifact-record.js";
+import type { ProvenanceRecord, InputRef, InputSource } from "./types.js";
+/** A single observed write from the provenance frame.
+ *
+ * `hash` is left empty by `feedExecFrame` — it is the
+ * responsibility of `reconcileManifestWithDisk` to populate the hash
+ * from disk just before registration, so the registered hash always
+ * matches the bytes the storage backend will receive at upload time. Callers that
+ * synthesize writes from a context where the bytes are already known
+ * and stable (e.g., `recordFileToolWrite` for in-process agent tool
+ * writes) may pass a non-empty hash directly.
+ */
+export interface ObservedWrite {
+    /** Analysis-relative path (e.g., "runs/run-001/step-de/output/results.csv") */
+    path: string;
+    /** SHA-256 hash of the file content. Empty string when deferred to reconcile. */
+    hash: string;
+    /** File size in bytes. */
+    size: number;
+}
+/** Explicit classification context for a file read. Callers build this
+ *  from the step's own coordinates (stepId/runId/dependsOn) instead of the
+ *  collector parsing paths. */
+export interface InputClassificationContext {
+    source: InputSource;
+    stepId?: string;
+    runId?: string;
+}
+/**
+ * Build classification context for a file read using known step metadata.
+ *
+ * Uses prefix matching against structured metadata — no path segment
+ * extraction. The caller knows its own stepId/runId and its upstream
+ * dependencies (dependsOn).
+ *
+ * For prior-run reads (paths under runs/ that don't match own run or
+ * any dependsOn entry), this falls back to path extraction — see the
+ * prior-run branch below for why.
+ */
+export declare function classifyReadPath(relativePath: string, ownStepId: string, ownRunId: string, dependsOn?: string[]): InputClassificationContext;
+export interface ProvenanceCollectorOptions {
+    stepId: string;
+    runId: string;
+    /** Step IDs this step depends on (for upstream mount enumeration). */
+    dependsOn?: string[];
+}
+export declare class ProvenanceCollector {
+    readonly stepId: string;
+    readonly runId: string;
+    readonly dependsOn: string[];
+    /** Prefix for converting analysis-relative write paths to step-relative. */
+    private readonly stepPrefix;
+    /**
+     * Map from input file relative path (e.g., "inputs/Lab A Storage/trail_0/data.csv")
+     * to fileId. Sourced from the data-mount filesystem's inputPathToFileId map
+     * (passed by reference, populated lazily during filesystem init).
+     */
+    private inputFileIdMap?;
+    /** Tracked reads from read-only mounts, keyed by `mountPath:relativePath`. */
+    private readonly inputAccesses;
+    /** File tool write records, keyed by output path (relative to /artifacts). */
+    private readonly fileToolRecords;
+    /** Command execution records, keyed by output path (relative to /artifacts). */
+    private readonly commandRecords;
+    constructor(opts: ProvenanceCollectorOptions);
+    /**
+     * Set the input file ID map (passed by reference from the data-mount filesystem).
+     * Called after construction when the data mount filesystem is available.
+     */
+    setInputFileIdMap(map: Map<string, string>): void;
+    /**
+     * Track a file read from a read-only mount.
+     * Called by sandbox exec provenance frame processing.
+     *
+     * @param mountPath - The workspace mount path (e.g., "/a1/data" or "/a1" for single-mount)
+     * @param relativePath - Path relative to the mount root
+     * @param hash - SHA-256 hash of the file content, or null if file no longer exists
+     * @param context - Explicit classification context from the caller. When provided,
+     *   the collector uses it directly instead of classifying from the path.
+     */
+    trackInputAccess(mountPath: string, relativePath: string, hash: string | null, context?: InputClassificationContext): InputRef;
+    /**
+     * Record a file tool write (write_file, edit_file).
+     * Called after the data-mount filesystem records the artifact.
+     *
+     * File tool writes are agent-authored content — not derived from input
+     * files via execution — so no inputs are attributed.
+     */
+    recordFileToolWrite(artifact: ArtifactRecord): void;
+    /**
+     * Record outputs from a sandbox command execution.
+     * Called after provenance frame processing extracts observed writes.
+     *
+     * When commandReads is provided, uses those as the inputs for this
+     * command's provenance records (per-command scoping). Falls back to
+     * snapshotting the global inputAccesses accumulator when not provided.
+     */
+    recordCommandExecution(command: string, args: string[], exitCode: number, durationMs: number, writes: ObservedWrite[], scriptPath?: string, commandReads?: InputRef[]): void;
+    /**
+     * Get provenance inputs classified as `source: "data"` (input files read from /data mount).
+     */
+    getDataInputs(): InputRef[];
+    /**
+     * All distinct input refs observed this step, any source. The returned refs
+     * are the live objects also held by the per-command records, so repairing a
+     * `hash` here (e.g. `reconcileManifestWithDisk` filling read hashes from
+     * disk) propagates into the registration payload.
+     */
+    getTrackedInputs(): InputRef[];
+    /**
+     * Drop an input ref from lineage entirely — removes it from the tracked-input
+     * map and from every record's `inputs` array (identity match, since the refs
+     * are shared objects). `reconcileManifestWithDisk` calls this for a read that
+     * resolves to a directory (e.g. an `ls` / `list.files` of a mount): the
+     * inotify frame tracks the open, but a directory is not a content-attestable
+     * file artifact and must never reach registration. Mirrors the output-side
+     * non-file drop.
+     */
+    dropInput(ref: InputRef): void;
+    /**
+     * Get merged, deduplicated provenance records.
+     * Command records win over file-tool records for the same output path.
+     */
+    getRecords(): ProvenanceRecord[];
+    /** Remove any record (command or file-tool) for the given output path. */
+    removeRecord(path: string): void;
+    /**
+     * Replace the existing record for `record.outputPath` while preserving
+     * last-write-wins ordering (command beats file-tool). If a command record
+     * exists, the replacement overwrites it; otherwise the file-tool record
+     * is overwritten. If neither exists, the replacement is stored as a
+     * file-tool record so `getRecords()` surfaces it.
+     */
+    replaceRecord(record: ProvenanceRecord): void;
+}