@inflexa-ai/harness 0.46.2 → 0.48.0

package/dist/prompts/synthesis-agent.js

@@ -7,8 +7,8 @@ literature-grounded **interpretation** — not a catalog of what each step
 produced.
 
 You are task-oriented — you do not interact with the user. You receive
-the run's context, investigate what you need via your research sub-agent,
-and return a structured synthesis.
+the run's context, look up the evidence that you need, and return a
+structured synthesis.
 
 ## How Your Work Reaches the User
 
@@ -34,45 +34,27 @@ can read that themselves. What they need from you is:
 Think like a senior reviewer writing the Discussion section of a paper,
 not like a scribe summarizing the Results section.
 
-## Your Tools
-
-### literature_reviewer (research sub-agent — delegate focused research)
-A task-oriented sub-agent that holds the bio-lookup and literature tools.
-Delegate to it when you need evidence — you have no bio-lookup tools of
-your own.
-
-Delegations must be **focused**:
-- One well-scoped research brief per call (e.g., "Investigate FOXM1 and
-  MKI67 in the context of proliferation signatures in bulk RNA-seq of
-  breast tumor vs normal. Assess novelty and find supporting PMIDs.")
-- Include the experimental context the sub-agent needs (conditions, modality,
-  what the computational finding showed).
-- Do NOT send the whole summary block and ask for "a literature review".
-  The sub-agent will produce shallow results on diffuse briefs.
-
-You may delegate again after an initial pass if a
-theme becomes apparent and needs its own evidence sweep.
-
-### submit_synthesis (success path)
-Submit the synthesis. Checks the payload; returns either
-\`{accepted: true}\` (DONE — stop) or \`{accepted: false, issues}\` (fix
-specific fields per issue path and call again, OR switch to
-\`report_blocker\` if the synthesis cannot be made valid). The last accepted
-submission is the synthesis.
-
-### report_blocker (terminal — cannot produce a synthesis)
-Call ONLY when the run produced no synthesizable content — every summary is
-empty, or the summaries are contradictory to the point of incoherence.
-"No findings worth surfacing" is NOT a blocker: with non-empty summaries you
-can always submit a synthesis (overview + conclusions) with an empty
-\`findings[]\`. Pass a short reason, then stop.
-
-## Canonical Flow
-
-Ground the novel findings, the contradictions, and the cross-step themes
-in literature before you draft. Then call \`submit_synthesis\`. If it is
-rejected, fix the cited issue paths and call again. If it cannot be made
-valid, call \`report_blocker\`.
+## The Files of the Run
+
+The step summaries come first. Read a file of the run only where a summary is
+thin: a number that a summary names and does not give, a table that it points
+to, or a paper that the analysis holds. Each file that you read fills your
+context, thus read the part that you need.
+
+## Evidence
+
+Your lookup tools (genes, proteins, annotations, interactions, PubMed,
+citations, drug-gene interactions, preclinical profiles) are cheap API calls,
+and they run in \`run_script\`: put the independent lookups in one script, and
+print what you keep. Ground the novel findings, the contradictions, and the
+cross-step themes in literature before you draft. Look up what
+a finding needs: a high-confidence finding that can be novel, a finding that
+maps to a known disease or pathway, a theme across two or more steps. A QC
+result or a technical finding with no biological claim needs no lookup.
+
+Each \`pmid\` that you cite must be in a lookup result of this run, also a
+result that a script read and did not print.
+\`submit_synthesis\` refuses each other PMID.
 
 ## Writing the Synthesis
 
@@ -95,9 +77,7 @@ a known drug?
 
 **Assigning \`preclinical-validation\`** — cite IMPC mouse-KO phenotypes for
 loss-of-function consequences and cross-species baseline expression for
-tissue-of-action context (both come back from
-\`gene_preclinical_profile\`), when the literature reviewer's report
-includes them.
+tissue-of-action context, both from \`gene_preclinical_profile\`.
 
 **What a good \`limitation\` looks like** — it names what it affects and
 why it matters:
@@ -111,49 +91,6 @@ why it matters:
 - "Target druggability not assessed — pathway importance does not imply
   tractability."
 
-## Cross-Field Invariants (enforced at submit_synthesis)
-
-- \`finding.stepId\` must match a stepId present in the input summaries.
-- Every \`theme.findings[]\` entry must reference a finding that exists
-  in \`findings[]\` (same stepId + title).
-- Every \`keyReferences[].pmid\` must appear in at least one
-  \`finding.references[]\` entry — the cross-run list summarizes what's
-  already cited per finding.
-
-Every \`pmid\` you write comes from a \`literature_reviewer\` response.
-\`submit_synthesis\` cannot check this, and nothing after you re-checks a
-PMID, so an invented one reaches the reader as a real citation.
-
-## Investigation Strategy
-
-**Which findings need delegation?**
-- Findings labeled high-confidence in the summary but potentially novel —
-  needs literature check to confirm or challenge novelty.
-- Findings that could map to a known disease or pathway context — needs
-  a PubMed sweep for the gene+condition combination.
-- Candidate themes spanning 2+ steps — delegate a theme-level brief to
-  get references that tie the findings together.
-
-**Which findings do NOT need delegation?**
-- Trivial / expected results (QC passed, dimensions as expected).
-- Technical findings with no biological claim (batch effect detected,
-  normalization applied).
-
-**Composing a delegation brief** — include:
-1. The specific genes/pathways/features to investigate (from the summary).
-2. The experimental context (conditions, modality, organism if known).
-3. What the computational finding showed (one sentence).
-4. What you want back (novelty assessment? supporting PMIDs? pathway
-   context? interaction partners?).
-
-Example:
-> "Investigate SPP1, TREM2, and APOE in the context of microglia
-> activation in Alzheimer's disease single-cell RNA-seq. Finding:
-> these three genes form a co-expression module enriched in
-> disease-associated microglia. Return: novelty assessment, 3-5 key
-> PMIDs supporting or challenging the DAM signature, and any known
-> interactions among the three."
-
 ## Do NOT
 
 - **Reiterate step results.** The reader has the step summaries. Do not
@@ -176,9 +113,6 @@ Example:
   predictive requires evidence of treatment x marker interaction,
   prognostic only requires association with outcome.
 - Force findings into themes. If findings don't converge, return fewer (or zero) themes.
-- Call \`submit_synthesis\` before delegating at least once when findings need
-  literature grounding. (A run with only technical/QC findings may skip delegation
-  and submit directly, but state that clearly in the overview.)
 - Submit a placeholder or stub payload to "see what happens". A degenerate
   payload that passes the schema is recorded as the run's result.
 `;

package/dist/provenance/collector.d.ts

@@ -5,11 +5,8 @@
  * Integrates with:
  *   - K8sSandbox executeCommand provenance (script reads + writes via inotify)
  *   - Data-mount filesystem write tracking (agent file-tool outputs)
- *
- * Input attribution comes exclusively from sandbox exec inotify (the
- * authoritative record of what computation actually consumed). Agent
- * tool reads are not tracked here — they're exploratory and would
- * pollute the lineage graph.
+ *   - The workspace read tools of the agent (`provenance/workspace-reads.ts`),
+ *     whose host-side reads no exec frame names
  */
 import type { ArtifactRecord } from "../execution/artifact-record.js";
 import type { ProvenanceRecord, InputRef, InputSource } from "./types.js";

package/dist/provenance/collector.js

@@ -5,11 +5,8 @@
  * Integrates with:
  *   - K8sSandbox executeCommand provenance (script reads + writes via inotify)
  *   - Data-mount filesystem write tracking (agent file-tool outputs)
- *
- * Input attribution comes exclusively from sandbox exec inotify (the
- * authoritative record of what computation actually consumed). Agent
- * tool reads are not tracked here — they're exploratory and would
- * pollute the lineage graph.
+ *   - The workspace read tools of the agent (`provenance/workspace-reads.ts`),
+ *     whose host-side reads no exec frame names
  */
 import { presentFirst } from "../lib/present.js";
 import { collapseWhitespace, hasWhitespace } from "../lib/text.js";

package/dist/provenance/seam.d.ts

@@ -97,7 +97,8 @@ type BlockAct = {
  * One observation of a session.
  *
  * The union names one event for each act: the start of a session, the four block operations, the title,
- * the derivation, the preview, the record, the file write of a conversation turn, and the approval of a plan. Each event carries
+ * the derivation, the preview, the record, the file write of a conversation turn, a script that read or wrote a
+ * file, and the approval of a plan. Each event carries
  * the analysis and the thread, thus a consumer places it with no lookup. The title sits on the document,
  * thus the title event names no block.
  *
@@ -186,6 +187,40 @@ export type SessionProvenanceEvent = {
     tool: string;
     /** The loop's tool-call id of the write — the replay-stable identity of the invocation. */
     invocationId: string;
+} | {
+    /**
+     * One script of `run_script` that read or wrote a file. The script, each file that it read, and each
+     * file that it derived carry the hash of their exact bytes, thus a derived file chains to the files
+     * that made it. The harness emits it from the fold of the call record, thus a replay emits it again
+     * with the same values.
+     */
+    type: "run-script";
+    analysisId: string;
+    /** The thread whose turn ran the script. Absent when the scope carries none. */
+    threadId?: string;
+    /** The loop's tool-call id of the `run_script` call. */
+    invocationId: string;
+    /** The saved script. Absent when the session has no scratch directory. */
+    script?: {
+        path: string;
+        hash: string;
+        size: number;
+    };
+    /** Each table that the script read, analysis-root-relative. */
+    reads: ReadonlyArray<{
+        path: string;
+        hash: string;
+    }>;
+    /** Each file that the script derived, analysis-root-relative. */
+    writes: ReadonlyArray<{
+        path: string;
+        hash: string;
+        size: number;
+    }>;
+    /** Each tool that the script called, in call order. */
+    tools: readonly string[];
+    /** The script ran to its end. A failed script keeps the files that it wrote before the failure. */
+    ok: boolean;
 };
 /**
  * The provenance seam of the harness. An embedder realizes the members that it records, and the harness

package/dist/provenance/workspace-reads.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The lineage of the workspace reads of a step agent.
+ *
+ * `read_file`, `grep`, and `read_pdf` read on the host, outside each sandbox exec, thus no exec frame names their
+ * reads. A tool puts its reads into its call record, and its `foldCallRecord` gives them to the collector of the step.
+ * Thus a replay, which runs no `execute`, rebuilds the same inputs.
+ */
+import type { Logger } from "../lib/logger.js";
+import type { ProvenanceCollector } from "./collector.js";
+/**
+ * One file whose content a read tool gave to the agent. `path` is analysis-relative. `hash` is the SHA-256 of the
+ * whole file, or `null` when the tool held only a part of it.
+ */
+export type WorkspaceRead = {
+    readonly path: string;
+    readonly hash: string | null;
+};
+/** The call record of a read tool. */
+export type WorkspaceReadRecord = {
+    readonly reads: readonly WorkspaceRead[];
+};
+export type WorkspaceReadLineage = {
+    /** The read of `path`, as the tool gave it to the read seam. `wholeFile` is the bytes of the whole file, or `null` for a part. */
+    readOf(path: string, wholeFile: Buffer | null): WorkspaceRead | undefined;
+    /** Track the reads of one call in the collector of the step. */
+    track(reads: readonly WorkspaceRead[]): void;
+};
+export type WorkspaceReadLineageDeps = {
+    readonly collector: ProvenanceCollector;
+    readonly workspaceRoot: string;
+    readonly analysisId: string;
+    /** The host base of a relative path, the same that the read tools give to the read seam. */
+    readonly workingDir: string;
+    readonly logger?: Logger;
+};
+export declare function createWorkspaceReadLineage(deps: WorkspaceReadLineageDeps): WorkspaceReadLineage;

package/dist/provenance/workspace-reads.js

@@ -0,0 +1,33 @@
+/**
+ * The lineage of the workspace reads of a step agent.
+ *
+ * `read_file`, `grep`, and `read_pdf` read on the host, outside each sandbox exec, thus no exec frame names their
+ * reads. A tool puts its reads into its call record, and its `foldCallRecord` gives them to the collector of the step.
+ * Thus a replay, which runs no `execute`, rebuilds the same inputs.
+ */
+import { createNoopLogger } from "../lib/console-logger.js";
+import { computeSha256 } from "../lib/fs-helpers.js";
+import { resolveWorkspacePath } from "../workspace/paths.js";
+export function createWorkspaceReadLineage(deps) {
+    const { collector, workspaceRoot, analysisId, workingDir } = deps;
+    // The mount root of `execute_command`, thus a file that an exec and a read tool read is one input.
+    const mountRoot = `/${analysisId}`;
+    const logger = (deps.logger ?? createNoopLogger()).named("workspace-reads");
+    return {
+        readOf(path, wholeFile) {
+            const resolved = resolveWorkspacePath({ workspaceRoot, analysisId, path, workingDir });
+            if (resolved.kind !== "ok")
+                return undefined;
+            // A hash of a part names no version of the file. Reconcile hashes the file from disk instead.
+            return { path: resolved.relative.split("\\").join("/"), hash: wholeFile === null ? null : computeSha256(wholeFile) };
+        },
+        track(reads) {
+            for (const read of reads) {
+                if (collector.trackInputAccess(mountRoot, read.path, read.hash) !== null)
+                    continue;
+                if (collector.claimRefusalNarration(read.path))
+                    logger.warn("refusing lineage edge to an undeclared same-run path", { path: read.path });
+            }
+        },
+    };
+}

package/dist/report-model/production-resolver.d.ts

@@ -5,51 +5,21 @@
  * The realization holds three layers. Layer one is identity: membership through `snapshotEntry`, and a
  * streamed hash compare with `computeSha256File`. A hash mismatch fails before any parse. Layer two is
  * the host fast path: an in-process parse of a CSV, a TSV, a JSON, or a parquet file at or under the cap.
- * Layer three is the fall-through: an over-cap file or a host parse fault goes to the extraction arm. On any
- * doubt the read falls through, thus correctness never depends on the host parser. An extension that names
- * no tabular format refuses here, because the host decides the format for both arms.
+ * Layer three is the fall-through: an over-cap file or a host parse fault fails as `extraction-unavailable`.
+ * On any doubt the read falls through, thus the host parser never gives a partial or guessed answer. An
+ * extension that names no tabular format refuses the same way.
  *
  * A read of the bytes is the expensive part, thus an optional `ArtifactReadCache` outlives one resolver. It
- * holds the streamed hash and the extracted rows against a stat signature. Two tool calls of one analysis
- * share one cache, and each call still binds its own extraction arm with its own auth.
+ * holds the streamed hash and the parsed rows against a stat signature. Two tool calls of one analysis
+ * share one cache.
  *
  * The realization calls the shared assert functions in `assert-rules.ts`, and it mirrors the locator walk
  * and the reason choices of `fixture-resolver.ts`. Thus one semantics exists, and the fixture stays the
  * executable specification of the value tier. The two realizations are substitutable behind the seam.
  */
-import { type Result } from "neverthrow";
-import type { SuspendingRefusal } from "../sandbox/sandbox-error.js";
 import { type ReferenceResolver } from "./reference-resolver.js";
 /** One artifact row, as plain cells. A text-backed format holds a numeric column as a string. */
-type Row = Record<string, string | number>;
-/**
- * One artifact that the host fast path could not read, addressed for the extraction arm. The `hash` pins
- * the exact bytes, thus the arm reads the same artifact that the identity layer verified.
- *
- * `format` carries the reader that the host decided. The arm never derives a reader from the extension,
- * thus the host arm and the sandbox arm can never read one file two ways.
- */
-export type ExtractionRequest = {
-    readonly path: string;
-    readonly hash: string;
-    readonly format: TabularFormat;
-};
-/** The rows that the extraction arm read for one artifact. Downstream the rows share the host path logic. */
-export type ExtractionArtifact = {
-    readonly rows: Array<Record<string, string | number>>;
-};
-/**
- * The out-of-process read arm. One `extract` call covers every fall-through artifact of one document
- * pass. The result maps each requested path to its rows. A path that the arm could not read is absent
- * from the map, and the reference at that path fails as `unreadable-artifact`. A refusal of the sandbox of the
- * pass with the suspend flag is the `err`, and each reference of the batch reports its reason.
- *
- * The arm is a seam, thus a test stubs it. While no realization is wired, a fall-through reference fails
- * with `extraction-unavailable`, and the detail names the absent arm.
- */
-export type ExtractionArm = {
-    extract(requests: readonly ExtractionRequest[]): Promise<Result<ReadonlyMap<string, ExtractionArtifact>, SuspendingRefusal>>;
-};
+export type Row = Record<string, string | number>;
 /**
  * The disk facts of one artifact that outlive one resolver.
  *
@@ -64,12 +34,11 @@ export type ArtifactRead = {
     readonly rows?: Array<Record<string, string | number>>;
 };
 /**
- * The read cache of one analysis. It holds what a read of the bytes costs: the streamed hash, and the rows
- * of a file that the host could not parse in process. Two resolvers of one analysis share one cache, thus a
- * preview and the record that follows it hash one unchanged file one time and start one container.
+ * The read cache of one analysis. It holds what a read of the bytes costs: the streamed hash, and the parsed
+ * rows. Two resolvers of one analysis share one cache, thus a preview and the record that follows it hash and
+ * parse one unchanged file one time.
  *
- * The cache holds no authorization and no session value. Each resolver still binds its own extraction arm
- * over the auth of its own call.
+ * The cache holds no authorization and no session value.
  */
 export type ArtifactReadCache = {
     get(absolutePath: string): ArtifactRead | undefined;
@@ -89,22 +58,23 @@ export declare function createArtifactReadStore(): ArtifactReadStore;
  * The construction deps of the production resolver.
  *
  * `workspaceRoot` and `analysisId` contain the untrusted snapshot path through `resolveWorkspacePath`,
- * the same containment as the preview tool. `cap` gates the cell extraction, and it defaults to 16 MiB.
- * `extractionArm` is optional, because no sandbox realization is wired yet. `readCache` is optional, thus a
- * resolver with no cache reads every artifact itself and its reads die with it.
+ * the same containment as the preview tool. `cap` gates the cell read, and it defaults to 16 MiB.
+ * `readCache` is optional, thus a resolver with no cache reads every artifact itself and its reads die with it.
  */
 export type ProductionResolverDeps = {
     readonly workspaceRoot: string;
     readonly analysisId: string;
     readonly cap?: number;
-    readonly extractionArm?: ExtractionArm;
     readonly readCache?: ArtifactReadCache;
 };
+/** The tabular formats that the host fast path reads. Another extension names no format at all. */
+export type TabularFormat = "csv" | "tsv" | "json" | "parquet";
 /**
- * The tabular formats that the host fast path reads. The host decides which one a file is, one time, and it
- * carries the decision to the extraction arm. Another extension names no format at all.
+ * Map a file extension to the format that the host arm reads. An unknown extension gives back `undefined`.
+ *
+ * This is the one format decision of the report path.
  */
-export type TabularFormat = "csv" | "tsv" | "json" | "parquet";
+export declare function detectFormat(path: string): TabularFormat | undefined;
 /**
  * Read one value as a cell, or drop it.
  *
@@ -114,8 +84,7 @@ export type TabularFormat = "csv" | "tsv" | "json" | "parquet";
  * where the caller detects the loss.
  *
  * A non-finite number is not a cell either. A parquet float column holds a `NaN` or an `Infinity`, thus the
- * coercion drops it and the row omits the key. The extraction script (`tasks/extract-values-script.ts`)
- * drops the same value to `None`, thus the host arm and the sandbox arm read the same bytes the same way.
+ * coercion drops it and the row omits the key.
  */
 export declare function coerceCell(value: unknown): string | number | undefined;
 /**
@@ -123,8 +92,10 @@ export declare function coerceCell(value: unknown): string | number | undefined;
  * name are structural doubt, thus each gives back `undefined` and the file falls through.
  */
 export declare function parseDelimited(text: string, delimiter: string): Row[] | undefined;
+/** Parse the bytes of one table in a decided format. A parse fault gives back `undefined`. */
+export declare function parseTable(format: TabularFormat, bytes: Buffer): Promise<Row[] | undefined>;
 /**
- * Make the production resolver over the workspace root and the optional extraction arm.
+ * Make the production resolver over the workspace root.
  *
  * The resolver holds a per-pass cache. `prepare` groups the references by artifact, reads each file one
  * time, and fills the cache. `resolve` then answers from the cache. A `resolve` with no prior `prepare`
@@ -132,4 +103,3 @@ export declare function parseDelimited(text: string, delimiter: string): Row[] |
  * artifact on both paths, and never one read for each reference.
  */
 export declare function createProductionResolver(deps: ProductionResolverDeps): ReferenceResolver;
-export {};