@inflexa-ai/harness 0.17.0 → 0.18.0

package/dist/prompts/target-assessment/briefs/executive-recommendation.js

@@ -41,10 +41,10 @@ dossier in the rationale.
   plausibility only; they do not support tractability, safety, or
   efficacy claims.
 - Do NOT cite trial AEs, efficacy, or termination reasons from
-  \`related_target_trials[]\` as evidence of the assessment target's
-  drug behaviour. These trials are on related receptors (e.g.,
-  CGRP-R/CALCRL for a CALCR assessment) and tell you nothing about the
-  assessment target itself.
+  \`excluded_rows[]\` as evidence of the assessment target's drug
+  behaviour. Those trials are attributed elsewhere — often to a related
+  receptor (e.g., CGRP-R/CALCRL for a CALCR assessment) — and tell you
+  nothing about the assessment target itself.
 - Do NOT interpret a Reactome pathway containing the gene symbol as
   evidence of drug-target binding. Reactome pathways list participating
   genes, not drug interactions. Drug-binding evidence comes from
@@ -61,7 +61,7 @@ dossier in the rationale.
   distinct-substance counts.
 - Do NOT surface organ-level liability claims (kidney, CNS, hepatic,
   cardiac, etc.) unless they appear in
-  \`safety_profile.target_organ_liabilities\`. That section is the
+  \`safety_profile.target_organ_liabilities.data.rows\`. That section is the
   probe-validated source for organ claims; any organ liability the
   probe rejected does not belong in \`key_risks\`.
 - Do NOT recommend a between-cofactor selectivity margin against rows in

package/dist/prompts/target-assessment/briefs/liability-bullets.d.ts

@@ -1 +1 @@
-export declare const liabilityBulletsBrief = "# Section: Liability bullets\n\nWrite evidence-cited liability bullets in toxicologist voice. Each bullet\ncovers one organ-or-axis with severity, the supporting evidence pointer,\nand a rationale that names the mechanism hypothesis.\n\n## Inputs\nYou receive the full Phase-4 dossier as JSON. Cite section paths and\ncounts (FAERS n=NN, IMPC p=...) verbatim from the dossier.\n\n## Approval precedents (provided)\n- FDA approval precedents for the target's candidate indication are\n  supplied in the prompt \u2014 queried once from openFDA / Drugs@FDA (see the\n  `## FDA approval precedents` block). For class precedents not present\n  in the dossier, cite a listed NDA/BLA application number + label section.\n  Do not assert precedents absent from that block and the dossier.\n\n## Output discipline\n- Severity is one of high / medium / low.\n- Each rationale must include either a hedge phrase, a literature\n  citation, or a regulatory reference for every efficacy/safety claim.\n- Do not fabricate counts. If the dossier lacks evidence, mark it\n  explicitly (\"the data do not support a conclusion\") rather than\n  generating filler.\n- Trial AEs, failed-trial reasons, and outcomes may be used as\n  toxicology evidence only when the row has\n  `eligible_for_toxicology_aggregation: true` and\n  `attribution.evidence_role: \"supports_target\"`. Rows marked\n  `contextual` or `excluded` are coverage/context only; do not cite\n  them as safety evidence.\n\n## Category vocabulary\nEach bullet's `category` MUST be exactly one of:\n- `fatal_post_market` \u2014 class-defining contraindication / fatal\n  post-market signal (e.g., anaphylaxis-with-death on a class label).\n  When `safety_profile.regulatory_actions.coverage === \"available\"`, every\n  row in that array is a confirmed regulatory event (EMA referral, FDA\n  safety communication, REMS, withdrawal). Emit one\n  `fatal_post_market` bullet per row, naming the `agency`, `action_date`,\n  and quoting the `finding` verbatim. Do NOT phrase regulatory\n  actions as inferences from FAERS counts.\n- `class_liability` \u2014 formal class-precedent organ liability meeting\n  the 3-drug threshold (sourced from\n  `safety_profile.class_precedent.data.per_organ`).\n- `off_target_safety` \u2014 selectivity-driven liability at a related\n  receptor (sourced from\n  `safety_profile.off_target_panel.data.rows`).\n- `high_safety_organ_expression` \u2014 expression-driven on-target\n  liability at a safety-relevant tissue (sourced from\n  `off_tissue_risk.data.rows` and the\n  `safety_profile.target_organ_liabilities` probe).\n- `broad_expression` \u2014 expression spread across many tissues without a\n  single-organ driver (sourced from\n  `derived.liability_summary.expression_breadth`).\n- `other` \u2014 uncategorisable safety observation worth flagging; use\n  only when none of the above fit.\n\n## Obligate-cofactor rows\n\n`safety_profile.off_target_panel.data.excluded_rows[]` may contain rows\nwith `relationship: \"obligate_cofactor\"`. These represent the\nassessment target heterodimerised with a different obligate accessory\nprotein (e.g., a CALCR/RAMP3 entry on a CALCR assessment is the AMY3\namylin receptor \u2014 same gene product, different RAMP partner).\n\n- Do NOT generate an `off_target_safety` liability bullet for these\n  rows. Selectivity between cofactor partners of the same gene product\n  is not pharmacologically attainable; the protein is the same.\n- Do NOT recommend a between-cofactor selectivity margin (e.g., \"\u2265N-fold\n  over <gene>/RAMP<N>\") against an obligate-cofactor row. The\n  pharmacology is context-dependent on cofactor co-expression in the\n  target tissue, which is an on-target property, not a selectivity\n  property.\n- If the row carries a `clinical_consequence` annotation (e.g.,\n  satiety, nausea), fold that consequence into an\n  `high_safety_organ_expression` or `broad_expression` bullet where\n  the cofactor's tissue distribution makes the engagement clinically\n  relevant. Do not invent a selectivity liability.\n\n## Mechanism-claim discipline\n\nWhen stating a mechanism for an adverse-event signal, the mechanism must operate at the same biological scale as the AE.\n\n- Do NOT cite developmental, regenerative, or homeostatic biology (e.g., satellite-cell quiescence, stem-cell niche maintenance, tissue homeostasis) as the mechanism for a clinical AE signal like arthralgia, myalgia, or fatigue. Those papers describe tissue-level processes, not AE-producing pathways. If the only mechanistic candidate in the dossier is at the tissue-homeostasis level, omit the mechanism claim and report the AE signal alone (the rationale can still cite the AE prevalence number).\n\n- Respect anatomical boundaries. The nucleus tractus solitarius (NTS) is brainstem, not hypothalamus. The nucleus accumbens is basal ganglia, not hypothalamus. The amygdala is subcortical, not hypothalamus. When binning a CNS expression signal under a region category, the region in the rationale must match the region in the dossier source path. Do not conflate \"neural circuit involving X\" with \"expressed in X\" \u2014 the latter is the only on-target claim supported by tissue expression data.\n\n- For `category: \"high_safety_organ_expression\"` bullets, the cited brain region must be one of: hypothalamus, brainstem (medulla / pons / midbrain), cerebellum, basal ganglia (caudate / putamen / nucleus accumbens / globus pallidus), thalamus, hippocampus, amygdala, or cortex (frontal / temporal / parietal / occipital / cingulate). Do not invent new region categories.\n\n### Source counters for bullet rationale\n\nEach bullet rationale MUST cite at least one numeric counter from one of:\n  - safety_profile.faers.data.top_signals[].report_count (preferred when available)\n  - safety_profile.faers.data.per_modulator[].report_count\n  - safety_profile.class_precedent.data.per_organ[].top_aes[].report_count (use when target-level FAERS is queried_no_data)\n  - safety_profile.trial_aes.data.serious[].incidence_pct / non_serious[].incidence_pct\n  - safety_profile.off_target_panel.data.rows[].pchembl with the off_target_name\nA bullet that cites a numeric counter from class_precedent.per_organ.top_aes.report_count is valid;\ndo NOT delete it for \"no source\" if a class_precedent counter is present.\n\n### Tissue-expression unit discipline\n\nWhen citing tissue-expression values, ALWAYS use the unit string from `reference_biology.normal_tissue_expression.data.unit` (one of: \"tpm\",\n\"ntpm\", \"consensus_normalized\"). Do not assume \"TPM\" \u2014 Open Targets'\nhpa_consensus source emits \"consensus_normalized\" (nTPM-like).\nRender as e.g. \"217 nTPM\" or \"217 (consensus_normalized)\", never \"217 TPM\"\nunless the unit field is \"tpm\".\n\n### Citation discipline\n\nWhen citing a PMID inside a `key_risks` or `liability_bullet` entry:\n1. The cited paper's stated conclusion MUST be directionally consistent with the way it is cited. If the paper concluded that an exposure *reduced* a risk, do NOT cite it as evidence FOR that risk \u2014 even if it was historically discussed alongside the risk in regulatory reviews.\n2. When unsure of a paper's directional conclusion, omit the citation and use a different evidence source from the dossier body.\n3. Every NCT cited must appear in the dossier's clinical_development.trials, failed_trials, or analytics.discovery_trials sections AND must have an intervention referencing a drug from drug_interactions. NCTs whose interventions are outside the on-target class (e.g., SGLT2 inhibitors in a GLP-1R dossier) must not be cited.";
+export declare const liabilityBulletsBrief = "# Section: Liability bullets\n\nWrite evidence-cited liability bullets in toxicologist voice. Each bullet\ncovers one organ-or-axis with severity, the supporting evidence pointer,\nand a rationale that names the mechanism hypothesis.\n\n## Inputs\nYou receive the full Phase-4 dossier as JSON. Cite section paths and\ncounts (FAERS n=NN, IMPC p=...) verbatim from the dossier.\n\n## Approval precedents (provided)\n- FDA approval precedents for the target's candidate indication are\n  supplied in the prompt \u2014 queried once from openFDA / Drugs@FDA (see the\n  `## FDA approval precedents` block). For class precedents not present\n  in the dossier, cite a listed NDA/BLA application number + label section.\n  Do not assert precedents absent from that block and the dossier.\n\n## Output discipline\n- Severity is one of high / medium / low.\n- Each rationale must include either a hedge phrase, a literature\n  citation, or a regulatory reference for every efficacy/safety claim.\n- Do not fabricate counts. If the dossier lacks evidence, mark it\n  explicitly (\"the data do not support a conclusion\") rather than\n  generating filler.\n- Trial AEs, failed-trial reasons, and outcomes may be used as\n  toxicology evidence only when the row has\n  `eligible_for_toxicology_aggregation: true` and\n  `attribution.evidence_role: \"supports_target\"`. Rows marked\n  `contextual` or `excluded` are coverage/context only; do not cite\n  them as safety evidence.\n\n## Category vocabulary\nEach bullet's `category` MUST be exactly one of:\n- `fatal_post_market` \u2014 class-defining contraindication / fatal\n  post-market signal (e.g., anaphylaxis-with-death on a class label).\n  When `safety_profile.regulatory_actions.coverage === \"available\"`, every\n  row in that array is a confirmed regulatory event (EMA referral, FDA\n  safety communication, REMS, withdrawal). Emit one\n  `fatal_post_market` bullet per row, naming the `agency`, `action_date`,\n  and quoting the `finding` verbatim. Do NOT phrase regulatory\n  actions as inferences from FAERS counts.\n- `class_liability` \u2014 formal class-precedent organ liability meeting\n  the 3-drug threshold (sourced from\n  `safety_profile.class_precedent.data.per_organ`).\n- `off_target_safety` \u2014 selectivity-driven liability at a related\n  receptor (sourced from\n  `safety_profile.off_target_panel.data.rows`).\n- `high_safety_organ_expression` \u2014 expression-driven on-target\n  liability at a safety-relevant tissue (sourced from\n  `off_tissue_risk.data.rows` and the\n  `safety_profile.target_organ_liabilities.data.rows` probe).\n- `broad_expression` \u2014 expression spread across many tissues without a\n  single-organ driver (sourced from\n  `derived.liability_summary.expression_breadth`).\n- `other` \u2014 uncategorisable safety observation worth flagging; use\n  only when none of the above fit.\n\n## Obligate-cofactor rows\n\n`safety_profile.off_target_panel.data.excluded_rows[]` may contain rows\nwith `relationship: \"obligate_cofactor\"`. These represent the\nassessment target heterodimerised with a different obligate accessory\nprotein (e.g., a CALCR/RAMP3 entry on a CALCR assessment is the AMY3\namylin receptor \u2014 same gene product, different RAMP partner).\n\n- Do NOT generate an `off_target_safety` liability bullet for these\n  rows. Selectivity between cofactor partners of the same gene product\n  is not pharmacologically attainable; the protein is the same.\n- Do NOT recommend a between-cofactor selectivity margin (e.g., \"\u2265N-fold\n  over <gene>/RAMP<N>\") against an obligate-cofactor row. The\n  pharmacology is context-dependent on cofactor co-expression in the\n  target tissue, which is an on-target property, not a selectivity\n  property.\n- If the row carries a `clinical_consequence` annotation (e.g.,\n  satiety, nausea), fold that consequence into an\n  `high_safety_organ_expression` or `broad_expression` bullet where\n  the cofactor's tissue distribution makes the engagement clinically\n  relevant. Do not invent a selectivity liability.\n\n## Mechanism-claim discipline\n\nWhen stating a mechanism for an adverse-event signal, the mechanism must operate at the same biological scale as the AE.\n\n- Do NOT cite developmental, regenerative, or homeostatic biology (e.g., satellite-cell quiescence, stem-cell niche maintenance, tissue homeostasis) as the mechanism for a clinical AE signal like arthralgia, myalgia, or fatigue. Those papers describe tissue-level processes, not AE-producing pathways. If the only mechanistic candidate in the dossier is at the tissue-homeostasis level, omit the mechanism claim and report the AE signal alone (the rationale can still cite the AE prevalence number).\n\n- Respect anatomical boundaries. The nucleus tractus solitarius (NTS) is brainstem, not hypothalamus. The nucleus accumbens is basal ganglia, not hypothalamus. The amygdala is subcortical, not hypothalamus. When binning a CNS expression signal under a region category, the region in the rationale must match the region in the dossier source path. Do not conflate \"neural circuit involving X\" with \"expressed in X\" \u2014 the latter is the only on-target claim supported by tissue expression data.\n\n- For `category: \"high_safety_organ_expression\"` bullets, the cited brain region must be one of: hypothalamus, brainstem (medulla / pons / midbrain), cerebellum, basal ganglia (caudate / putamen / nucleus accumbens / globus pallidus), thalamus, hippocampus, amygdala, or cortex (frontal / temporal / parietal / occipital / cingulate). Do not invent new region categories.\n\n### Source counters for bullet rationale\n\nEach bullet rationale MUST cite at least one numeric counter from one of:\n  - safety_profile.faers.data.top_signals[].report_count (preferred when available)\n  - safety_profile.faers.data.per_modulator[].report_count\n  - safety_profile.class_precedent.data.per_organ[].top_aes[].report_count (use when target-level FAERS is queried_no_data)\n  - safety_profile.trial_aes.data.serious[].incidence_pct / non_serious[].incidence_pct\n  - safety_profile.off_target_panel.data.rows[].pchembl with the off_target_name\nA bullet that cites a numeric counter from class_precedent.per_organ.top_aes.report_count is valid;\ndo NOT delete it for \"no source\" if a class_precedent counter is present.\n\n### Tissue-expression unit discipline\n\nWhen citing tissue-expression values, ALWAYS use the unit string from `reference_biology.normal_tissue_expression.data.unit` (one of: \"tpm\",\n\"ntpm\", \"consensus_normalized\"). Do not assume \"TPM\" \u2014 Open Targets'\nhpa_consensus source emits \"consensus_normalized\" (nTPM-like).\nRender as e.g. \"217 nTPM\" or \"217 (consensus_normalized)\", never \"217 TPM\"\nunless the unit field is \"tpm\".\n\n### Citation discipline\n\nWhen citing a PMID inside a `key_risks` or `liability_bullet` entry:\n1. The cited paper's stated conclusion MUST be directionally consistent with the way it is cited. If the paper concluded that an exposure *reduced* a risk, do NOT cite it as evidence FOR that risk \u2014 even if it was historically discussed alongside the risk in regulatory reviews.\n2. When unsure of a paper's directional conclusion, omit the citation and use a different evidence source from the dossier body.\n3. Every NCT cited must appear in the dossier's clinical_development.trials, failed_trials, or analytics.discovery_trials sections AND must have an intervention referencing a drug from drug_interactions. NCTs whose interventions are outside the on-target class (e.g., SGLT2 inhibitors in a GLP-1R dossier) must not be cited.";

package/dist/prompts/target-assessment/briefs/liability-bullets.js

@@ -48,7 +48,7 @@ Each bullet's \`category\` MUST be exactly one of:
 - \`high_safety_organ_expression\` — expression-driven on-target
   liability at a safety-relevant tissue (sourced from
   \`off_tissue_risk.data.rows\` and the
-  \`safety_profile.target_organ_liabilities\` probe).
+  \`safety_profile.target_organ_liabilities.data.rows\` probe).
 - \`broad_expression\` — expression spread across many tissues without a
   single-organ driver (sourced from
   \`derived.liability_summary.expression_breadth\`).

package/dist/prompts/target-assessment/briefs/target-organ-liabilities.d.ts

@@ -1 +1 @@
-export declare const targetOrganLiabilitiesBrief = "# Section: Target-organ liabilities (audit trail)\n\nFor each implicated organ system, write a per-organ trail that connects\ngenetic, expression, FAERS, and class-precedent evidence to a stated\nmechanism hypothesis.\n\n## Inputs\nYou receive the full Phase-4 dossier as JSON. Cite section paths and\ncounts verbatim. Anchor every organ name to the canonical\norgan-system vocabulary (hepatobiliary, renal, cardiac, etc.) \u2014 colloquial\nsubstitutes are rejected by the voice probe.\n\n## Approval precedents (provided)\n- FDA approval precedents for the candidate indication are supplied in the\n  prompt (see the `## FDA approval precedents` block). For class\n  precedents withdrawn or labelled for the same liability, cite a listed\n  Drugs@FDA NDA/BLA \u00A7<section>. Do not assert precedents absent from that block.\n\n## Output discipline\n- Trail format is study-summary cadence: claim, evidence with counts,\n  qualifier on human relevance.\n- Mechanism hypothesis can be null if the data do not support one \u2014 say\n  so rather than guessing.\n- Trial AEs, failed-trial reasons, and outcomes may be used as\n  organ-liability evidence only when the row has\n  `eligible_for_toxicology_aggregation: true` and\n  `attribution.evidence_role: \"supports_target\"`. Rows marked\n  `contextual` or `excluded` are coverage/context only; do not cite\n  them as safety evidence.";
+export declare const targetOrganLiabilitiesBrief: string;

package/dist/prompts/target-assessment/briefs/target-organ-liabilities.js

@@ -1,3 +1,7 @@
+import { ORGAN_SYSTEMS } from "../../../contracts/organ-system.js";
+// Interpolated rather than restated, so the prompt cannot name an organ the
+// schema will reject.
+const organTokens = ORGAN_SYSTEMS.join(", ");
 export const targetOrganLiabilitiesBrief = `# Section: Target-organ liabilities (audit trail)
 
 For each implicated organ system, write a per-organ trail that connects
@@ -6,9 +10,9 @@ mechanism hypothesis.
 
 ## Inputs
 You receive the full Phase-4 dossier as JSON. Cite section paths and
-counts verbatim. Anchor every organ name to the canonical
-organ-system vocabulary (hepatobiliary, renal, cardiac, etc.) — colloquial
-substitutes are rejected by the voice probe.
+counts verbatim. The \`organ\` field of every row MUST be exactly one of
+these tokens: ${organTokens}. Anything else is rejected. Trail prose may
+use the reader-facing name for that organ; the \`organ\` field may not.
 
 ## Approval precedents (provided)
 - FDA approval precedents for the candidate indication are supplied in the
@@ -19,6 +23,10 @@ substitutes are rejected by the voice probe.
 ## Output discipline
 - Trail format is study-summary cadence: claim, evidence with counts,
   qualifier on human relevance.
+- \`severity\` is your own read of the liability for that organ — \`high\`,
+  \`medium\`, or \`low\` — and must follow from the trail you wrote.
+- Cite a PMID inline (\`PMID:12345678\`) for every literature claim in the
+  trail; a trail that cites none is recorded as having no citable support.
 - Mechanism hypothesis can be null if the data do not support one — say
   so rather than guessing.
 - Trial AEs, failed-trial reasons, and outcomes may be used as

package/dist/prompts/target-assessment/investigation/adversarial-critique.d.ts

@@ -0,0 +1 @@
+export declare const adversarialCritiquePrompt = "You are the adversarial critic in a target-assessment claim investigation.\n\nYou are handed one organ liability claim about an assessed target, the mechanism\nproposed for it, and the evidence the assessment collected for that organ. Your\njob is to argue that the claim does NOT hold.\n\nYou are not a reviewer and you are not a second opinion. Nobody is asking you\nwhether the claim looks reasonable. Build the strongest available case against\nit, and then say how strong that case actually turned out to be.\n\n## Where a claim breaks\n\nWork through the ways a corroborated organ signal can still be wrong:\n\n- **Correlated sources.** Several sources agreeing is only evidence when they are\n  independent. Curated databases routinely re-import the same primary study.\n- **Species and model.** A knockout phenotype in a mouse is not a human organ\n  liability, and a whole-body knockout is not pharmacological inhibition.\n- **Confounded clinical signal.** Adverse events attributed to a drug can belong\n  to the indication, the comorbidity, the co-medication, or the trial population.\n- **Expression is not consequence.** Presence in a tissue does not establish that\n  modulating the target there produces harm.\n- **Wrong scale.** A mechanism drawn from developmental or homeostatic biology\n  does not explain an acute clinical event.\n- **Direction.** A cited paper may conclude the opposite of the way it is used.\n- **Better explanation.** Something other than the target may account for the\n  signal \u2014 an off-target, a metabolite, a class effect, a formulation.\n\n## How to work\n\nSearch the literature for records that would disconfirm the claim: contradicting\nfindings, negative results, reanalyses, populations where the effect is absent.\nUse the tools you were given. Read enough of a hit to know what it concluded\nbefore you cite it \u2014 a title is not a conclusion.\n\nIf a search returns nothing useful, that is information: it means the objection\nyou were building has no published support, and you should say that rather than\nassert it anyway.\n\n## Finishing\n\nReport your outcome by calling `record_critique` exactly once. Prose replies are\ndiscarded \u2014 a critique that is not recorded through that tool did not happen.\n\nIts `support` carries your counter-evidence:\n\n- Use `scored` only with records you actually retrieved, each carrying a real\n  publication identifier, digital object identifier, or accession.\n- Use `unknown` with a one-line reason whenever you could not find such a\n  record. This is a complete and expected answer, and it is always the right one\n  when the alternative is a citation you are not sure of. An objection with\n  unknown support is still recorded and still read.\n\n## Do NOT\n\n- Do NOT endorse the claim. If the case against it is weak, say the case is weak\n  \u2014 do not convert your turn into a confirmation.\n- Do NOT invent a publication identifier, accession, or trial number, and do not\n  cite one from memory that you did not retrieve in this run.\n- Do NOT report support as `scored` while noting in the objection that the\n  evidence is indirect. Indirect is `unknown` with that as the reason.\n- Do NOT object on grounds you cannot state concretely. \"The evidence is limited\"\n  is not an objection; \"the three contributing sources all trace to one 2011\n  curation of the same cohort\" is.\n- Do NOT raise an objection about a different organ than the one you were given.\n- Do NOT assume anything about what ran before you or what will run after, and do\n  not ask for more context \u2014 argue from what you were handed plus what you find.";

package/dist/prompts/target-assessment/investigation/adversarial-critique.js

@@ -0,0 +1,67 @@
+export const adversarialCritiquePrompt = `You are the adversarial critic in a target-assessment claim investigation.
+
+You are handed one organ liability claim about an assessed target, the mechanism
+proposed for it, and the evidence the assessment collected for that organ. Your
+job is to argue that the claim does NOT hold.
+
+You are not a reviewer and you are not a second opinion. Nobody is asking you
+whether the claim looks reasonable. Build the strongest available case against
+it, and then say how strong that case actually turned out to be.
+
+## Where a claim breaks
+
+Work through the ways a corroborated organ signal can still be wrong:
+
+- **Correlated sources.** Several sources agreeing is only evidence when they are
+  independent. Curated databases routinely re-import the same primary study.
+- **Species and model.** A knockout phenotype in a mouse is not a human organ
+  liability, and a whole-body knockout is not pharmacological inhibition.
+- **Confounded clinical signal.** Adverse events attributed to a drug can belong
+  to the indication, the comorbidity, the co-medication, or the trial population.
+- **Expression is not consequence.** Presence in a tissue does not establish that
+  modulating the target there produces harm.
+- **Wrong scale.** A mechanism drawn from developmental or homeostatic biology
+  does not explain an acute clinical event.
+- **Direction.** A cited paper may conclude the opposite of the way it is used.
+- **Better explanation.** Something other than the target may account for the
+  signal — an off-target, a metabolite, a class effect, a formulation.
+
+## How to work
+
+Search the literature for records that would disconfirm the claim: contradicting
+findings, negative results, reanalyses, populations where the effect is absent.
+Use the tools you were given. Read enough of a hit to know what it concluded
+before you cite it — a title is not a conclusion.
+
+If a search returns nothing useful, that is information: it means the objection
+you were building has no published support, and you should say that rather than
+assert it anyway.
+
+## Finishing
+
+Report your outcome by calling \`record_critique\` exactly once. Prose replies are
+discarded — a critique that is not recorded through that tool did not happen.
+
+Its \`support\` carries your counter-evidence:
+
+- Use \`scored\` only with records you actually retrieved, each carrying a real
+  publication identifier, digital object identifier, or accession.
+- Use \`unknown\` with a one-line reason whenever you could not find such a
+  record. This is a complete and expected answer, and it is always the right one
+  when the alternative is a citation you are not sure of. An objection with
+  unknown support is still recorded and still read.
+
+## Do NOT
+
+- Do NOT endorse the claim. If the case against it is weak, say the case is weak
+  — do not convert your turn into a confirmation.
+- Do NOT invent a publication identifier, accession, or trial number, and do not
+  cite one from memory that you did not retrieve in this run.
+- Do NOT report support as \`scored\` while noting in the objection that the
+  evidence is indirect. Indirect is \`unknown\` with that as the reason.
+- Do NOT object on grounds you cannot state concretely. "The evidence is limited"
+  is not an objection; "the three contributing sources all trace to one 2011
+  curation of the same cohort" is.
+- Do NOT raise an objection about a different organ than the one you were given.
+- Do NOT assume anything about what ran before you or what will run after, and do
+  not ask for more context — argue from what you were handed plus what you find.`;

package/dist/prompts/target-assessment/investigation/claim-reverification.d.ts

@@ -0,0 +1 @@
+export declare const claimReverificationBrief = "# Task: re-verify one organ liability claim\n\nYou are given a corroborated organ liability claim, the mechanism proposed for\nit, the objection raised against it, and the evidence the assessment collected\nfor that organ. Decide what survives.\n\nYou are adjudicating, not summarising. Weigh the objection against the evidence\nand say which of them the record actually supports.\n\n## The verdict vocabulary\n\n- `upheld` \u2014 the objection was answered by the evidence, and the claim stands as\n  proposed.\n- `weakened` \u2014 the objection lands, but the claim is not eliminated: it holds in\n  a narrower form, or with lower confidence in its mechanism.\n- `overturned` \u2014 the objection is decisive; the evidence does not support the\n  claim as stated.\n- `undetermined` \u2014 the record settles neither side. This is a real verdict, not a\n  refusal to answer, and it is correct whenever the evidence is genuinely silent.\n\nThe verdict is your read of the record in words. There is no score, no\nthreshold, and no arithmetic \u2014 do not attempt to derive one, and do not describe\nthe claim as passing or failing a bar.\n\nNothing you return removes a claim from the assessment. An `overturned` verdict\nis recorded and read; it does not delete the organ, and you should therefore\nnever soften a verdict to protect a liability from disappearing.\n\n## Support for the verdict\n\nCite the records that carry your verdict \u2014 the ones you actually relied on, from\nthe evidence you were given or from the objection's counter-evidence.\n\nIf nothing in the record carries the verdict, return support state `unknown`\nwith a one-line reason. That is a complete answer, expected often, and always\npreferable to a locator you are not certain of. The verdict itself is still\nrecorded.\n\n## Do NOT\n\n- Do NOT cite a publication identifier, accession, or regulatory reference that\n  was not in the material you were given.\n- Do NOT report support as `scored` while noting the evidence is thin. Thin is\n  `unknown` with that as the reason.\n- Do NOT restate the objection as the verdict. Say what the record supports.\n- Do NOT return `upheld` merely because the claim was corroborated by several\n  sources \u2014 whether those sources are independent is exactly what the objection\n  may be contesting.\n- Do NOT assume anything about what ran before you or what will run after.";

package/dist/prompts/target-assessment/investigation/claim-reverification.js

@@ -0,0 +1,49 @@
+export const claimReverificationBrief = `# Task: re-verify one organ liability claim
+
+You are given a corroborated organ liability claim, the mechanism proposed for
+it, the objection raised against it, and the evidence the assessment collected
+for that organ. Decide what survives.
+
+You are adjudicating, not summarising. Weigh the objection against the evidence
+and say which of them the record actually supports.
+
+## The verdict vocabulary
+
+- \`upheld\` — the objection was answered by the evidence, and the claim stands as
+  proposed.
+- \`weakened\` — the objection lands, but the claim is not eliminated: it holds in
+  a narrower form, or with lower confidence in its mechanism.
+- \`overturned\` — the objection is decisive; the evidence does not support the
+  claim as stated.
+- \`undetermined\` — the record settles neither side. This is a real verdict, not a
+  refusal to answer, and it is correct whenever the evidence is genuinely silent.
+
+The verdict is your read of the record in words. There is no score, no
+threshold, and no arithmetic — do not attempt to derive one, and do not describe
+the claim as passing or failing a bar.
+
+Nothing you return removes a claim from the assessment. An \`overturned\` verdict
+is recorded and read; it does not delete the organ, and you should therefore
+never soften a verdict to protect a liability from disappearing.
+
+## Support for the verdict
+
+Cite the records that carry your verdict — the ones you actually relied on, from
+the evidence you were given or from the objection's counter-evidence.
+
+If nothing in the record carries the verdict, return support state \`unknown\`
+with a one-line reason. That is a complete answer, expected often, and always
+preferable to a locator you are not certain of. The verdict itself is still
+recorded.
+
+## Do NOT
+
+- Do NOT cite a publication identifier, accession, or regulatory reference that
+  was not in the material you were given.
+- Do NOT report support as \`scored\` while noting the evidence is thin. Thin is
+  \`unknown\` with that as the reason.
+- Do NOT restate the objection as the verdict. Say what the record supports.
+- Do NOT return \`upheld\` merely because the claim was corroborated by several
+  sources — whether those sources are independent is exactly what the objection
+  may be contesting.
+- Do NOT assume anything about what ran before you or what will run after.`;

package/dist/prompts/target-assessment/investigation/index.d.ts

@@ -0,0 +1,3 @@
+export { mechanismProposalBrief } from "./mechanism-proposal.js";
+export { adversarialCritiquePrompt } from "./adversarial-critique.js";
+export { claimReverificationBrief } from "./claim-reverification.js";

package/dist/prompts/target-assessment/investigation/index.js

@@ -0,0 +1,3 @@
+export { mechanismProposalBrief } from "./mechanism-proposal.js";
+export { adversarialCritiquePrompt } from "./adversarial-critique.js";
+export { claimReverificationBrief } from "./claim-reverification.js";

package/dist/prompts/target-assessment/investigation/mechanism-proposal.d.ts

@@ -0,0 +1 @@
+export declare const mechanismProposalBrief: string;

package/dist/prompts/target-assessment/investigation/mechanism-proposal.js

@@ -0,0 +1,49 @@
+import { ORGAN_SYSTEMS } from "../../../contracts/organ-system.js";
+// Interpolated rather than restated, so the prompt cannot name an organ the
+// schema will reject.
+const organTokens = ORGAN_SYSTEMS.join(", ");
+export const mechanismProposalBrief = `# Task: propose a mechanism for one organ liability
+
+You are given ONE canonical organ token and the evidence this assessment has
+already collected about that organ — the sources that raised a signal for it,
+what each of them said, and the record each signal came from. Propose how the
+assessed target could produce a liability in that organ.
+
+The organ is supplied to you and is already one of: ${organTokens}. You are not
+asked to choose an organ and you must not reassign the claim to another one.
+
+## What a proposal is
+
+- One mechanism, stated plainly: what the target does, in which cells or tissue,
+  and how that becomes the observed liability.
+- Grounded in the evidence you were handed. Every record you were given carries
+  a locator; cite the locators of the records your mechanism actually rests on.
+- Scaled to the observation. A mechanism must operate at the same biological
+  scale as the signal it explains — do not explain a clinical adverse-event
+  signal with developmental or tissue-homeostasis biology.
+
+## Reporting no mechanism costs you nothing
+
+If the evidence supports no mechanism, say so: return no mechanism statement and
+a support reason explaining what was missing. That is a complete, correct answer
+and it is preferred over a plausible-sounding story.
+
+If you can state a mechanism but cannot point at a record that supports it,
+return the statement with support state \`unknown\` and a one-line reason. An
+unknown support is a normal outcome, not a penalty, and it is always cheaper
+than a citation you are not certain of.
+
+## Do NOT
+
+- Do NOT cite a publication identifier, accession, or regulatory reference that
+  was not in the evidence you were given. A locator you produced from memory is
+  a fabrication even when the paper exists.
+- Do NOT report support as \`scored\` while explaining in prose that the evidence
+  is weak or indirect. Weak or indirect support is \`unknown\` with that as the
+  reason.
+- Do NOT restate the evidence back as the mechanism. "Several sources report
+  hepatic signals" is an observation; a mechanism says why.
+- Do NOT propose a mechanism for a different organ, a different target, or a
+  drug class rather than the target.
+- Do NOT assume anything about what ran before you or what will run after. Work
+  from what you were handed.`;

package/dist/prompts/target-assessment/tox-voice/index.d.ts

@@ -1,4 +1,4 @@
 export { toxVoiceCore } from "./core.js";
 export { toxVoiceExemplars, type SectionType } from "./exemplars.js";
-export { toxVoiceVocabulary, type OrganSystem, type LiabilityFraming, type HedgePhrase, type BannedTerm } from "./vocabulary.js";
+export { toxVoiceVocabulary, type LiabilityFraming, type HedgePhrase, type BannedTerm } from "./vocabulary.js";
 export { buildVoiceCritique, type VoiceProbe } from "./critique.js";

package/dist/prompts/target-assessment/tox-voice/vocabulary.d.ts

@@ -1,15 +1,18 @@
 /**
- * Tox-voice canon. Lists are intentionally not exhaustive — they are the
- * minimum surface the deterministic voice probe enforces. Editorial
- * judgment in the agent prompts covers the long tail.
+ * Tox-voice canon. The stylistic lists are intentionally not exhaustive —
+ * they are the minimum surface the deterministic voice probe enforces, and
+ * editorial judgment in the agent prompts covers the long tail.
+ *
+ * `organSystems` is the exception: it is closed, because it is a projection
+ * of the canonical organ vocabulary rather than a list of its own. Prose and
+ * structured fields must name the same organs.
  */
 export declare const toxVoiceVocabulary: {
-    readonly organSystems: readonly ["hepatobiliary", "renal", "cardiac", "vascular", "haematologic", "central nervous system", "peripheral nervous system", "respiratory", "gastrointestinal", "reproductive", "endocrine", "musculoskeletal", "dermatologic", "ocular", "immunologic"];
+    readonly organSystems: string[];
     readonly liabilityFraming: readonly ["on-target liability", "off-target liability", "secondary pharmacology", "class liability", "mechanism-related", "exaggerated pharmacology", "target-organ toxicity"];
     readonly hedgePhrases: readonly ["the data are consistent with", "the data suggest", "human relevance is uncertain", "human relevance remains to be established", "interpretation is limited by", "no causal inference is supported", "the available evidence is consistent with", "the available evidence does not support", "translatability to humans is unclear", "species differences"];
     readonly banned: readonly ["groundbreaking", "cutting-edge", "state-of-the-art", "best-in-class", "first-in-class", "revolutionary", "leverages", "leveraging", "robust", "powerful", "seamlessly", "cleanly", "elegant", "unparalleled", "demonstrates the power of", "showcases", "unlocks", "enables breakthrough", "very promising", "extremely", "incredibly", "highly innovative"];
 };
-export type OrganSystem = (typeof toxVoiceVocabulary.organSystems)[number];
 export type LiabilityFraming = (typeof toxVoiceVocabulary.liabilityFraming)[number];
 export type HedgePhrase = (typeof toxVoiceVocabulary.hedgePhrases)[number];
 export type BannedTerm = (typeof toxVoiceVocabulary.banned)[number];

package/dist/prompts/target-assessment/tox-voice/vocabulary.js

@@ -1,26 +1,15 @@
 /**
- * Tox-voice canon. Lists are intentionally not exhaustive — they are the
- * minimum surface the deterministic voice probe enforces. Editorial
- * judgment in the agent prompts covers the long tail.
+ * Tox-voice canon. The stylistic lists are intentionally not exhaustive —
+ * they are the minimum surface the deterministic voice probe enforces, and
+ * editorial judgment in the agent prompts covers the long tail.
+ *
+ * `organSystems` is the exception: it is closed, because it is a projection
+ * of the canonical organ vocabulary rather than a list of its own. Prose and
+ * structured fields must name the same organs.
  */
+import { ORGAN_SYSTEMS, ORGAN_SYSTEM_LABELS } from "../../../contracts/organ-system.js";
 export const toxVoiceVocabulary = {
-    organSystems: [
-        "hepatobiliary",
-        "renal",
-        "cardiac",
-        "vascular",
-        "haematologic",
-        "central nervous system",
-        "peripheral nervous system",
-        "respiratory",
-        "gastrointestinal",
-        "reproductive",
-        "endocrine",
-        "musculoskeletal",
-        "dermatologic",
-        "ocular",
-        "immunologic",
-    ],
+    organSystems: ORGAN_SYSTEMS.map((organ) => ORGAN_SYSTEM_LABELS[organ]),
     liabilityFraming: [
         "on-target liability",
         "off-target liability",

package/dist/providers/__fixtures__/session.d.ts

@@ -1,16 +1,17 @@
 /**
  * Test-only harness `RequestSession` builder. Not a `*.test.ts` file, so the test
  * runner ignores it; imported by harness unit tests that need a session but never
- * read its (opaque) auth. The auth is the trivial local one — the harness never
- * inspects it. Managed-adapter tests that exercise `getAuth` / the managed seams
- * use the managed builder in `compose/__fixtures__/session.ts` instead.
+ * read its (opaque) auth. `auth` defaults to the trivial local value the harness
+ * never inspects; an embedder whose adapters downcast `auth` to a concrete type
+ * overrides it rather than re-declaring the whole session shape.
  */
-import type { RequestSession, Scope } from "../../auth/types.js";
+import type { AuthContext, RequestSession, Scope } from "../../auth/types.js";
 export interface SessionOverrides {
     user?: string;
     scope?: Scope;
     agentId?: string;
     callPath?: readonly string[];
+    auth?: AuthContext;
 }
 /** Build a fully-populated harness `RequestSession` for tests, with per-field overrides. */
 export declare function makeSession(overrides?: SessionOverrides): RequestSession;

package/dist/providers/__fixtures__/session.js

@@ -1,9 +1,9 @@
 /**
  * Test-only harness `RequestSession` builder. Not a `*.test.ts` file, so the test
  * runner ignores it; imported by harness unit tests that need a session but never
- * read its (opaque) auth. The auth is the trivial local one — the harness never
- * inspects it. Managed-adapter tests that exercise `getAuth` / the managed seams
- * use the managed builder in `compose/__fixtures__/session.ts` instead.
+ * read its (opaque) auth. `auth` defaults to the trivial local value the harness
+ * never inspects; an embedder whose adapters downcast `auth` to a concrete type
+ * overrides it rather than re-declaring the whole session shape.
  */
 import { makeLocalAuth } from "../../auth/local-auth-context.js";
 /** Build a fully-populated harness `RequestSession` for tests, with per-field overrides. */
@@ -15,6 +15,6 @@ export function makeSession(overrides = {}) {
             agentId: overrides.agentId ?? "conversation-agent",
             callPath: overrides.callPath ?? ["conversation-agent"],
         },
-        auth: makeLocalAuth(),
+        auth: overrides.auth ?? makeLocalAuth(),
     };
 }

package/dist/report-model/block-walk.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The one walk over a block tree.
+ *
+ * A block kind decides where a reference sits, which prose carries a free numeral, and whether the block
+ * holds children. Three consumers need that same knowledge: the mechanical validator, the draft finish,
+ * and the draft operations. A switch for each consumer is a switch that a ninth block kind can miss in
+ * silence, because each arm returns and none of them fails to build. Thus the walk lives here one time.
+ *
+ * The walk reads a finished `Block` tree and a relaxed `DraftBlock` tree alike. The two differ only in the
+ * section rules, and the section arm reads the children of either one.
+ *
+ * The walk resolves nothing and it opens no file. It reports what the tree holds, and a caller decides
+ * which part it needs.
+ */
+import type { Block } from "../contracts/report-blocks.js";
+import type { Reference } from "../contracts/report-reference.js";
+import type { DraftBlock } from "./draft.js";
+/** A block of a finished report, or a block of a draft. The atoms are the same shape in both. */
+export type AnyBlock = Block | DraftBlock;
+/**
+ * One reference that the walk met, tied to the block that carries it.
+ *
+ * `encodingColumns` is present for a `chart` only. A chart names its axes as free strings, thus the names
+ * must be matched against the table that the binding resolves to. Nothing else can catch a chart that
+ * plots a column which does not exist. The match needs the resolved rows, thus only a value-tier consumer
+ * reads this field.
+ */
+export interface CollectedReference {
+    blockId: string;
+    reference: Reference;
+    encodingColumns?: string[];
+}
+/** An advisory warning about the content of one block. A warning never makes a report invalid. */
+export interface ReportWarning {
+    blockId: string;
+    kind: "free-numeral";
+    detail: string;
+}
+/** What one walk over a block tree found. */
+export interface BlockWalk {
+    /** Each reference, in document order, tied to the block that carries it. */
+    references: CollectedReference[];
+    /** Each id that more than one block holds, named one time, in sorted order. */
+    repeatedIds: string[];
+    /** Each free numeral that prose carries. */
+    warnings: ReportWarning[];
+}
+/** Warn for each free-standing numeral that the prose of one block carries. */
+export declare function numeralWarnings(blockId: string, prose: string): ReportWarning[];
+/**
+ * Walk a block tree, and report each reference, each repeated id, and each free numeral.
+ *
+ * An id is what makes a block addressable, thus an amend by id is well defined only while each id belongs
+ * to one block. The walk is pre-order, thus the references follow the document order.
+ */
+export declare function walkBlocks(blocks: readonly AnyBlock[]): BlockWalk;

package/dist/report-model/block-walk.js

@@ -0,0 +1,89 @@
+/**
+ * The one walk over a block tree.
+ *
+ * A block kind decides where a reference sits, which prose carries a free numeral, and whether the block
+ * holds children. Three consumers need that same knowledge: the mechanical validator, the draft finish,
+ * and the draft operations. A switch for each consumer is a switch that a ninth block kind can miss in
+ * silence, because each arm returns and none of them fails to build. Thus the walk lives here one time.
+ *
+ * The walk reads a finished `Block` tree and a relaxed `DraftBlock` tree alike. The two differ only in the
+ * section rules, and the section arm reads the children of either one.
+ *
+ * The walk resolves nothing and it opens no file. It reports what the tree holds, and a caller decides
+ * which part it needs.
+ */
+/**
+ * A free-standing token that looks like a number, with an optional decimal part and an optional percent
+ * sign.
+ *
+ * The left boundary keeps the digits of a name out of the warnings. The domain prose is dense with a
+ * symbol such as `TP53`, `CD8`, or `IL6`, and without the boundary each one warns for its digits and
+ * buries the real free figures.
+ *
+ * The check is advisory only. A natural-language numeral is brittle to police, because a numeral in prose
+ * can be a real free-standing figure or a harmless part of a name. Thus a hit warns, and it never fails
+ * the report.
+ */
+const NUMERAL_PATTERN = /(?<![A-Za-z0-9])-?\d+(?:\.\d+)?%?/g;
+/** Warn for each free-standing numeral that the prose of one block carries. */
+export function numeralWarnings(blockId, prose) {
+    const warnings = [];
+    for (const match of prose.matchAll(NUMERAL_PATTERN)) {
+        warnings.push({ blockId, kind: "free-numeral", detail: match[0] });
+    }
+    return warnings;
+}
+/**
+ * Walk a block tree, and report each reference, each repeated id, and each free numeral.
+ *
+ * An id is what makes a block addressable, thus an amend by id is well defined only while each id belongs
+ * to one block. The walk is pre-order, thus the references follow the document order.
+ */
+export function walkBlocks(blocks) {
+    const references = [];
+    const warnings = [];
+    const seenIds = new Set();
+    const repeated = new Set();
+    const visit = (block) => {
+        if (seenIds.has(block.id)) {
+            repeated.add(block.id);
+        }
+        else {
+            seenIds.add(block.id);
+        }
+        switch (block.kind) {
+            case "section":
+                for (const child of block.blocks) {
+                    visit(child);
+                }
+                return;
+            case "text":
+                warnings.push(...numeralWarnings(block.id, block.content.prose));
+                return;
+            case "claim":
+                warnings.push(...numeralWarnings(block.id, block.content.prose));
+                for (const binding of block.bindings) {
+                    references.push({ blockId: block.id, reference: binding });
+                }
+                return;
+            case "metric":
+                references.push({ blockId: block.id, reference: block.value });
+                return;
+            case "chart": {
+                const encoding = block.encoding;
+                const encodingColumns = [encoding.x, encoding.y, encoding.group, encoding.value].filter((column) => column !== undefined);
+                references.push({ blockId: block.id, reference: block.binding, encodingColumns });
+                return;
+            }
+            case "table":
+            case "figure":
+            case "citation":
+                references.push({ blockId: block.id, reference: block.binding });
+                return;
+        }
+    };
+    for (const block of blocks) {
+        visit(block);
+    }
+    return { references, repeatedIds: [...repeated].sort(), warnings };
+}

package/dist/report-model/draft-finish.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The finish of a draft.
+ *
+ * An edit refuses what is wrong. The finish refuses what is missing. Thus the finish gates the whole
+ * draft one time: the full document schema, the unique ids, and the structural tier over every reference.
+ *
+ * The finish opens no file, and it reads the snapshot alone. Thus it runs the structural tier only, and
+ * the value tier stays in the gate of the report pipeline. The chart encoding-column match needs the rows
+ * behind a binding, thus it stays with the value tier.
+ *
+ * The free-numeral scan needs no file, thus the finish runs it and reports each hit as a warning. A
+ * warning never makes a draft invalid, and it rides beside the outcome in either case. Without the
+ * channel a caller could not read the one signal that catches a figure typed into prose with no metric
+ * block behind it.
+ *
+ * The result is plain data. A gap is an expected outcome, not an error, thus the finish never throws. On
+ * a pass the finish gives the valid document, and it does not change the draft.
+ */
+import { type ReportDocument } from "../contracts/report-blocks.js";
+import type { UnresolvedReference } from "../contracts/report-reference.js";
+import { type ReportWarning } from "./block-walk.js";
+import type { DraftDocument } from "./draft.js";
+import type { ReportSnapshot } from "./reference-resolver.js";
+/** A schema conformance gap, reduced to a path and a message. */
+export interface SchemaGap {
+    kind: "schema";
+    path: string;
+    message: string;
+}
+/** A duplicate id gap. More than one block holds the id. */
+export interface DuplicateIdGap {
+    kind: "duplicate-id";
+    id: string;
+}
+/** An unresolved reference gap. It ties the block that carries the reference to the reason it did not resolve. */
+export interface UnresolvedReferenceGap {
+    kind: "unresolved-reference";
+    blockId: string;
+    failure: UnresolvedReference;
+}
+/** One completeness gap of a draft. The kind set is closed. */
+export type FinishGap = SchemaGap | DuplicateIdGap | UnresolvedReferenceGap;
+/**
+ * The finish result. On a pass it gives the valid document. On a fail it gives each gap. The warnings
+ * ride along in either case, because a warning is advisory and it never decides the outcome.
+ */
+export type FinishResult = {
+    valid: true;
+    document: ReportDocument;
+    warnings: ReportWarning[];
+} | {
+    valid: false;
+    gaps: FinishGap[];
+    warnings: ReportWarning[];
+};
+/**
+ * Finish a draft. The finish validates the schema, the unique ids, and the structural resolution of each
+ * reference, and it reports each gap as data. It warns about each free numeral in prose.
+ */
+export declare function finishDraft(draft: DraftDocument, snapshot: ReportSnapshot): FinishResult;