cmpnd 0.8.0__tar.gz → 0.8.2__tar.gz

{cmpnd-0.8.0 → cmpnd-0.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmpnd
-Version: 0.8.0
+Version: 0.8.2
 Summary: DSPy observability and deployment SDK for cmpnd
 Project-URL: Homepage, https://cmpnd.ai
 Author-email: cmpnd <hello@cmpnd.ai>

{cmpnd-0.8.0 → cmpnd-0.8.2}/cmpnd/cli/commands/top.py

@@ -622,10 +622,9 @@ def _parse_deploy_metadata(raw: str | None) -> dict[str, Any] | None:
     from ... import deployment
 
     try:
-        deployment._validate_deploy_metadata(value)
+        return deployment._prepare_deploy_metadata(value)
     except (TypeError, ValueError) as exc:
         raise api_client.CliError(f"--metadata is invalid: {exc}")
-    return value
 
 
 def cmd_deploy(client: api_client.ApiClient, args: Any) -> None:

{cmpnd-0.8.0 → cmpnd-0.8.2}/cmpnd/dataset_sync.py

@@ -12,7 +12,7 @@ from typing import Any
 
 import httpx
 
-from . import configuration, identity
+from . import configuration, identity, models
 
 logger = logging.getLogger(__name__)
 
@@ -113,12 +113,20 @@ def build_dataset_payload(
         inputs = {k: v for k, v in d.items() if k in input_fields}
         expected_outputs = {k: v for k, v in d.items() if k not in input_fields}
 
+        # Hashed from the example as given, deliberately: this hash keys dataset
+        # dedup and the per-run split-membership join (train/val_example_hashes,
+        # computed elsewhere from the same unscrubbed example), so it is the
+        # example's identity and must not move with a storage concern.
         example_hash = identity.compute_example_hash(inputs) if inputs else ""
 
         examples.append(
             {
-                "inputs": inputs,
-                "expected_outputs": expected_outputs,
+                # Both land in jsonb columns, so they go through the same
+                # serializer the trace path uses — which also makes a
+                # non-JSON-native field value (a Pydantic model, an image) exportable
+                # instead of failing the encode at send time.
+                "inputs": models._safe_serialize(inputs),
+                "expected_outputs": models._safe_serialize(expected_outputs),
                 "example_hash": example_hash,
             }
         )

{cmpnd-0.8.0 → cmpnd-0.8.2}/cmpnd/deployment.py

@@ -16,7 +16,7 @@ from typing import Any
 
 import httpx
 
-from . import configuration, execution, identity, packaging
+from . import configuration, execution, identity, models, packaging
 
 logger = logging.getLogger(__name__)
 
@@ -27,9 +27,19 @@ logger = logging.getLogger(__name__)
 _MAX_DEPLOY_METADATA_BYTES = 64 * 1024
 
 
-def _validate_deploy_metadata(metadata: Any) -> None:
-    """Validate the deploy metadata blob, raising at the call site on a bad
-    value so the user sees a clear message instead of a server 422/413."""
+def _prepare_deploy_metadata(metadata: Any) -> dict[str, Any]:
+    """Validate the deploy metadata blob and return it in storable form.
+
+    Raises at the call site on a bad value so the user sees a clear message
+    instead of a server 422/413. Validation and scrubbing are one step on
+    purpose: the returned blob lands in a jsonb column, so a caller that
+    validated without scrubbing would still be able to ship a payload the
+    column must reject.
+
+    The size cap is measured on the value as given — scrubbing only ever
+    shortens it, so the check stays the conservative one the server's own
+    limit is stated against.
+    """
     if not isinstance(metadata, dict):
         raise TypeError(f"deploy(metadata=...) must be a dict, got {type(metadata).__name__}")
     if not all(isinstance(k, str) for k in metadata):
@@ -40,6 +50,7 @@ def _validate_deploy_metadata(metadata: Any) -> None:
         raise TypeError(f"deploy(metadata=...) must be JSON-serializable: {exc}") from exc
     if len(encoded.encode("utf-8")) > _MAX_DEPLOY_METADATA_BYTES:
         raise ValueError(f"deploy(metadata=...) exceeds the {_MAX_DEPLOY_METADATA_BYTES}-byte limit")
+    return models._safe_serialize(metadata)
 
 
 def _raise_http_error(response: httpx.Response, action: str) -> None:
@@ -155,11 +166,11 @@ def deploy(module, metric=None, timeout=300, metadata=None):
         # slot and reject an oversized deploy before signing it (Slice E).
         "declared_content_length": len(zip_bytes),
     }
-    # Carry the caller's metadata blob (validated at the call site) as a
-    # reserved top-level body key, committed with the deployment record server-side.
+    # Carry the caller's metadata blob (validated and made jsonb-storable at the
+    # call site) as a reserved top-level body key, committed with the deployment
+    # record server-side.
     if metadata is not None:
-        _validate_deploy_metadata(metadata)
-        deploy_body["metadata"] = metadata
+        deploy_body["metadata"] = _prepare_deploy_metadata(metadata)
     if sig is not None:
         deploy_body["signature_name"] = packaging._signature_to_string(sig)
         deploy_body["module_class"] = type(module).__name__

{cmpnd-0.8.0 → cmpnd-0.8.2}/cmpnd/exporter_http.py

@@ -62,21 +62,68 @@ def _send_json(client: httpx.Client, method: str, path: str, payload: Any) -> ht
 # so a re-POST of a request that actually landed can't double-insert.
 _RETRYABLE_STATUS = frozenset({502, 503, 504})
 
+# Backpressure, not unavailability: the server's buffer is full and it wants the
+# record dropped, so the caller counts it as *dropped* and we never retry it —
+# not even if the body carried a retryable flag. Named because that exemption is
+# the one thing the body-flag read below must not be able to override.
+_DROP_STATUS = 429
+
+
+def _server_says_retryable(response: httpx.Response) -> bool:
+    """Whether the server explicitly marked this error response retryable.
+
+    The `"retryable": true` error-body field is the server's stable machine
+    signal for "this failed transiently and did not commit — send it again". It
+    is what keeps this side off a hard-coded status list: the server can start
+    signalling a new transient condition without an SDK release. A body that
+    isn't JSON, isn't an object, or lacks the field reads as not-retryable.
+    """
+    try:
+        body = response.json()
+    except Exception:
+        return False
+    return isinstance(body, dict) and body.get("retryable") is True
+
 
 def _is_retryable_export_error(exc: BaseException) -> bool:
     """Whether a failed data send is a transient delivery blip worth retrying.
 
-    True for gateway/overload statuses (502/503/504) and httpx transport/timeout
-    errors (connect/read/pool timeouts, connection refused/reset). False for
-    everything else — 4xx (client error, a retry won't help), 429 (backpressure,
-    the caller records it as *dropped* not errored), and 500 (the platform's to
-    answer for, mirroring the is_external_outage boundary). Non-httpx exceptions
-    are not retried (a bug in our own build path shouldn't loop)."""
+    True for gateway/overload statuses (502/503/504), a response the server
+    explicitly flagged retryable (see `_server_says_retryable`), and httpx
+    transport/timeout errors (connect/read/pool timeouts, connection
+    refused/reset). False for everything else — 4xx (client error, a retry won't
+    help), 429 (backpressure, the caller records it as *dropped* not errored, and
+    no body flag overrides that), and an unflagged 500 (the platform's to answer
+    for, mirroring the is_external_outage boundary). Non-httpx exceptions are not
+    retried (a bug in our own build path shouldn't loop)."""
     if isinstance(exc, httpx.HTTPStatusError):
-        return exc.response.status_code in _RETRYABLE_STATUS
+        status = exc.response.status_code
+        if status == _DROP_STATUS:
+            return False
+        return status in _RETRYABLE_STATUS or _server_says_retryable(exc.response)
     return isinstance(exc, (httpx.TimeoutException, httpx.TransportError))
 
 
+def _retry_after_seconds(exc: BaseException) -> float | None:
+    """The server's own backoff hint for this failure, in seconds, or None.
+
+    Only the delta-seconds form of `Retry-After` is honored — that is what the
+    server emits alongside a retryable error. A missing header, the HTTP-date
+    form, or an unparseable value returns None so the caller falls back to its
+    own exponential backoff rather than trusting a number it can't read. A
+    transport error has no response at all and so has no hint.
+    """
+    if not isinstance(exc, httpx.HTTPStatusError):
+        return None
+    raw = exc.response.headers.get("retry-after")
+    if not raw:
+        return None
+    try:
+        return max(0.0, float(raw))
+    except ValueError:
+        return None
+
+
 @dataclass
 class ExportItem:
     """Item in the export queue."""
@@ -144,6 +191,12 @@ class BatchExporter:
         # can zero the backoff. Distinct from the start-post budget above.
         self._data_post_attempts = 3
         self._data_post_backoff = 0.5
+        # Ceiling on a single inter-attempt wait, including one the server asked
+        # for via Retry-After. The exporter thread is the only thing draining the
+        # queue, so an over-long wait doesn't just delay this send — it stalls
+        # every queued record behind it and risks the queue filling. Honoring the
+        # server's hint is worth it; honoring an unbounded one is not.
+        self._data_post_max_delay = 5.0
 
         # Guard against registering multiple exit handlers on repeated start()
         self._atexit_registered = False
@@ -473,13 +526,16 @@ class BatchExporter:
     def _send_json_retrying(self, client: httpx.Client, method: str, path: str, payload: Any) -> httpx.Response:
         """`_send_json` + `raise_for_status`, retrying transient delivery blips.
 
-        Retries `_data_post_attempts` times with exponential backoff on a
-        retryable failure (502/503/504 or a transport/timeout error — see
-        `_is_retryable_export_error`), then re-raises. A non-retryable failure
-        (4xx, 429, 500, or a 2xx that somehow raised) propagates on the first
-        attempt, so the caller's existing except blocks still record it (429 →
-        dropped, everything else → error) exactly as before — the only change
-        is that a transient blip now gets a few tries before it counts."""
+        Retries `_data_post_attempts` times on a retryable failure — a
+        gateway/overload status, a response the server flagged `retryable`, or a
+        transport/timeout error (see `_is_retryable_export_error`) — then
+        re-raises. The wait between attempts is the server's `Retry-After` hint
+        when it sent one, else exponential backoff, capped either way by
+        `_data_post_max_delay`. A non-retryable failure (4xx, 429, an unflagged
+        500, or a 2xx that somehow raised) propagates on the first attempt, so
+        the caller's existing except blocks still record it (429 → dropped,
+        everything else → error) exactly as before — the only change is that a
+        transient blip now gets a few tries before it counts."""
         last_exc: Exception | None = None
         for attempt in range(self._data_post_attempts):
             try:
@@ -489,10 +545,19 @@ class BatchExporter:
             except Exception as e:
                 last_exc = e
                 if _is_retryable_export_error(e) and attempt + 1 < self._data_post_attempts:
+                    delay = _retry_after_seconds(e)
+                    if delay is None:
+                        delay = self._data_post_backoff * (2**attempt)
+                    delay = min(delay, self._data_post_max_delay)
                     logger.debug(
-                        "cmpnd: retrying %s %s after transient error (attempt %d): %s", method, path, attempt + 1, e
+                        "cmpnd: retrying %s %s after transient error in %.2fs (attempt %d): %s",
+                        method,
+                        path,
+                        delay,
+                        attempt + 1,
+                        e,
                     )
-                    time.sleep(self._data_post_backoff * (2**attempt))
+                    time.sleep(delay)
                     continue
                 raise
         assert last_exc is not None  # unreachable: the loop either returns or raises

{cmpnd-0.8.0 → cmpnd-0.8.2}/cmpnd/models.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import re
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from enum import Enum
@@ -11,6 +12,50 @@ from uuid import UUID
 
 from . import identity, imaging
 
+# U+0000 (NUL) and lone UTF-16 surrogates are valid JSON, and valid in a Python
+# str, but the server cannot store either: a JSON column rejects both, and a NUL
+# is rejected by a plain text column too (it is valid UTF-8, but PostgreSQL text
+# cannot hold it). A captured input/output/attribute string, and the text of an
+# exception quoting that data, can all legitimately contain them — so we strip
+# them here rather than shipping a payload the server must reject. On a UTF-8
+# database these are the only such code points, so this is the complete set.
+#
+# "Chokepoint" is load-bearing and is a property of the callers, not just of
+# this function: every payload field bound for a JSON *or* text column goes
+# through _safe_serialize (or _strip_unstorable / _strip_unstorable_opt for a
+# value already known to be a string). Anything that hand-rolls its own
+# serializer instead reopens the hole — the optimizer tracker and the
+# dataset/deploy payload builders therefore route through here too.
+_UNSTORABLE_CODEPOINTS = re.compile("[\x00\ud800-\udfff]")
+
+
+def _strip_unstorable(s: str) -> str:
+    """Drop un-storable code points (U+0000, lone surrogates) from ``s``.
+
+    Fast path: the C-level search returns ``None`` for the ~always-clean case,
+    so no replacement string is built.
+    """
+    return _UNSTORABLE_CODEPOINTS.sub("", s) if _UNSTORABLE_CODEPOINTS.search(s) else s
+
+
+def _strip_unstorable_opt(s: str | None) -> str | None:
+    """``_strip_unstorable`` for an optional string, preserving ``None``.
+
+    For the top-level payload fields that are plain strings on the wire and land
+    in text columns (notably ``error_message``, which is ``str(exception)`` and
+    so routinely quotes the very captured data the code point came from) — they
+    never pass through ``_safe_serialize``.
+    """
+    return None if s is None else _strip_unstorable(s)
+
+
+def _type_name(value: Any) -> str:
+    """Scrubbed class name of ``value``, for the type tags and marker strings
+    below. CPython refuses an un-storable code point in a real class name, so
+    this is defensive: a metaclass answering ``__name__`` itself is the only way
+    one arrives, and the scrub costs one call at each interpolation site."""
+    return _strip_unstorable(type(value).__name__)
+
 
 def _safe_serialize(value: Any, _stack: set[int] | None = None) -> Any:
     """Recursively serialize a value to JSON-safe types.
@@ -28,8 +73,11 @@ def _safe_serialize(value: Any, _stack: set[int] | None = None) -> Any:
     if value is None:
         return None
 
-    # Primitives - JSON safe (no need to track these)
-    if isinstance(value, (str, int, float, bool)):
+    # Primitives - JSON safe (no need to track these). Strings are scrubbed of
+    # jsonb-un-storable code points; numerics/bools can't carry any.
+    if isinstance(value, str):
+        return _strip_unstorable(value)
+    if isinstance(value, (int, float, bool)):
         return value
 
     # UUID
@@ -43,23 +91,27 @@ def _safe_serialize(value: Any, _stack: set[int] | None = None) -> Any:
     # Bytes
     if isinstance(value, bytes):
         try:
-            return value.decode("utf-8")
+            return _strip_unstorable(value.decode("utf-8"))
         except Exception:
             return f"<bytes: {len(value)} bytes>"
 
-    # Enums
+    # Enums — recurse so a string-backed member value is scrubbed (real enums
+    # like SpanType have clean values, so this is a no-op for them; it only
+    # strips a pathological NUL/lone-surrogate value).
     if isinstance(value, Enum):
-        return value.value
+        return _safe_serialize(value.value, _stack)
 
-    # Types/classes (like SignatureMeta)
+    # Types/classes (like SignatureMeta). repr() of a class is whatever its
+    # metaclass says — DSPy's interpolates the signature's instructions and field
+    # metadata — so it is captured text, not a bounded label.
     if isinstance(value, type):
-        return repr(value)
+        return _strip_unstorable(repr(value))
 
     # For compound types, check for cycles using object identity
     obj_id = id(value)
     if obj_id in _stack:
         # True cycle detected - we're currently serializing this object
-        return f"<circular ref: {type(value).__name__}>"
+        return f"<circular ref: {_type_name(value)}>"
 
     # Add to stack before recursing into compound types
     _stack.add(obj_id)
@@ -73,9 +125,9 @@ def _safe_serialize(value: Any, _stack: set[int] | None = None) -> Any:
         if isinstance(value, (list, tuple)):
             return [_safe_serialize(v, _stack) for v in value]
 
-        # Dicts
+        # Dicts (keys become jsonb object keys, so scrub them too)
         if isinstance(value, dict):
-            return {str(k): _safe_serialize(v, _stack) for k, v in value.items()}
+            return {_strip_unstorable(str(k)): _safe_serialize(v, _stack) for k, v in value.items()}
 
         # DSPy Prediction and similar - has toDict method
         if hasattr(value, "toDict") and callable(value.toDict):
@@ -107,12 +159,17 @@ def _safe_serialize(value: Any, _stack: set[int] | None = None) -> Any:
             except Exception:
                 pass
 
-        # Objects with __dict__ (general objects, custom classes)
+        # Objects with __dict__ (general objects, custom classes). Attribute
+        # names become jsonb object keys, so scrub them like dict keys.
         if hasattr(value, "__dict__"):
             try:
-                obj_dict = {k: _safe_serialize(v, _stack) for k, v in value.__dict__.items() if not k.startswith("_")}
+                obj_dict = {
+                    _strip_unstorable(k): _safe_serialize(v, _stack)
+                    for k, v in value.__dict__.items()
+                    if not k.startswith("_")
+                }
                 # Add type info for clarity
-                obj_dict["__type__"] = type(value).__name__
+                obj_dict["__type__"] = _type_name(value)
                 return obj_dict
             except Exception:
                 pass
@@ -123,17 +180,17 @@ def _safe_serialize(value: Any, _stack: set[int] | None = None) -> Any:
                 obj_dict = {}
                 for slot in value.__slots__:  # pyright: ignore[reportAttributeAccessIssue]
                     if not slot.startswith("_") and hasattr(value, slot):
-                        obj_dict[slot] = _safe_serialize(getattr(value, slot), _stack)
-                obj_dict["__type__"] = type(value).__name__
+                        obj_dict[_strip_unstorable(slot)] = _safe_serialize(getattr(value, slot), _stack)
+                obj_dict["__type__"] = _type_name(value)
                 return obj_dict
             except Exception:
                 pass
 
         # Final fallback - convert to string
         try:
-            return str(value)
+            return _strip_unstorable(str(value))
         except Exception:
-            return f"<unserializable: {type(value).__name__}>"
+            return f"<unserializable: {_type_name(value)}>"
 
     finally:
         # Remove from stack after we're done serializing this object
@@ -455,7 +512,13 @@ class SpanBuilder:
         )
 
     def _build_attributes(self) -> dict[str, str]:
-        """Build attributes dict, injecting repl_history if present."""
+        """Build attributes dict, injecting repl_history if present.
+
+        The nested JSON rides as an attribute *value*, so it reaches the wire
+        through the same scrub as every other attribute string (``to_api_dict``
+        passes the result to ``_safe_serialize``) — the jsonb-storability of the
+        column does not rest on ``json.dumps``' ``ensure_ascii`` escaping here.
+        """
         attrs = dict(self.attributes)
         if self.repl_history:
             attrs["repl_history"] = json.dumps(self.repl_history)
@@ -472,7 +535,7 @@ class SpanBuilder:
             "start_time": self.start_time.isoformat() if self.start_time else None,
             "end_time": self.end_time.isoformat() if self.end_time else None,
             "status": self.status.value,
-            "error_message": self.error_message,
+            "error_message": _strip_unstorable_opt(self.error_message),
             "error_type": self.error_type,
             "signature_name": self.signature_name,
             "signature_instructions": self.signature_instructions,
@@ -577,7 +640,7 @@ class TraceBuilder:
             "start_time": self.start_time.isoformat() if self.start_time else None,
             "end_time": self.end_time.isoformat() if self.end_time else None,
             "status": self.status.value,
-            "error_message": self.error_message,
+            "error_message": _strip_unstorable_opt(self.error_message),
             "program_name": self.program_name,
             "program_version": self.program_version,
             "signature_name": self.signature_name,
@@ -589,7 +652,11 @@ class TraceBuilder:
             "signature_output_field_schemas": self.signature_output_field_schemas,
             "program_signature_hash": identity.format_signature_hash(self.program_signature_hash),
             "signature_summary": self.signature_summary,
-            "component_signatures": self.component_signatures,
+            # The server forwards this blob verbatim into a jsonb column, and its
+            # program registration is best-effort (a rejection is only logged), so
+            # an un-storable code point here would silently lose the whole
+            # component list. Scrub at the source — the only place that can.
+            "component_signatures": _safe_serialize(self.component_signatures),
             "compiled_from_run_id": self.compiled_from_run_id,
             "demo_ids": self.demo_ids,
             "request_preview": (self.request_preview or "")[:500],
@@ -597,8 +664,8 @@ class TraceBuilder:
             "eval_run_id": str(self.eval_run_id) if self.eval_run_id else None,
             "optimization_run_id": (str(self.optimization_run_id) if self.optimization_run_id else None),
             "adapter_type": self.adapter_type,
-            "tags": self.tags,
-            "metadata": self.metadata,
+            "tags": _safe_serialize(self.tags),
+            "metadata": _safe_serialize(self.metadata),
             "project": self.project_tags[0] if self.project_tags else None,
             "project_tags": self.project_tags if self.project_tags else [],
             "spans": [s.to_api_dict() for s in self._batch_spans] if self._batch_spans else [],
@@ -617,7 +684,7 @@ class TraceBuilder:
             "signature_output_field_types": self.signature_output_field_types,
             "program_signature_hash": identity.format_signature_hash(self.program_signature_hash),
             "signature_summary": self.signature_summary,
-            "component_signatures": self.component_signatures,
+            "component_signatures": _safe_serialize(self.component_signatures),
             "root_span_type": self.root_span_type,
             "project": self.project_tags[0] if self.project_tags else None,
             "project_tags": self.project_tags if self.project_tags else [],
@@ -629,7 +696,7 @@ class TraceBuilder:
             "start_time": self.start_time.isoformat() if self.start_time else None,
             "end_time": self.end_time.isoformat() if self.end_time else None,
             "status": self.status.value,
-            "error_message": self.error_message,
+            "error_message": _strip_unstorable_opt(self.error_message),
             "request_preview": (self.request_preview or "")[:500],
             "response_preview": (self.response_preview or "")[:500],
             "total_tokens": self.total_tokens,
@@ -642,8 +709,8 @@ class TraceBuilder:
             "demo_ids": self.demo_ids,
             "eval_run_id": str(self.eval_run_id) if self.eval_run_id else None,
             "optimization_run_id": (str(self.optimization_run_id) if self.optimization_run_id else None),
-            "tags": self.tags,
-            "metadata": self.metadata,
+            "tags": _safe_serialize(self.tags),
+            "metadata": _safe_serialize(self.metadata),
             "project": self.project_tags[0] if self.project_tags else None,
             "project_tags": self.project_tags if self.project_tags else [],
         }
@@ -757,7 +824,7 @@ class EvalExampleBuilder:
             "total_tokens": self.total_tokens,
             "cost": self.cost,
             "status": self.status.value,
-            "error_message": self.error_message,
+            "error_message": _strip_unstorable_opt(self.error_message),
         }
 
 
@@ -922,7 +989,7 @@ class EvalRunBuilder:
             "end_time": self.end_time.isoformat() if self.end_time else None,
             "duration_ms": self.duration_ms,
             "status": self.status.value,
-            "error_message": self.error_message,
+            "error_message": _strip_unstorable_opt(self.error_message),
             "score": self.score,
             "total_examples": self.total_examples,
             "passed_examples": self.passed_examples,
@@ -935,8 +1002,8 @@ class EvalRunBuilder:
             "total_cost": self.total_cost,
             "avg_tokens_per_example": self.avg_tokens_per_example,
             "avg_cost_per_example": self.avg_cost_per_example,
-            "tags": self.tags,
-            "metadata": self.metadata,
+            "tags": _safe_serialize(self.tags),
+            "metadata": _safe_serialize(self.metadata),
             "examples": [ex.to_api_dict() for ex in self._examples],
             "optimization_run_id": (str(self.optimization_run_id) if self.optimization_run_id else None),
             "project": self.project_tags[0] if self.project_tags else None,

{cmpnd-0.8.0 → cmpnd-0.8.2}/cmpnd/optimizers/gepa_callback.py

@@ -12,13 +12,12 @@ Usage:
 
 from __future__ import annotations
 
-import json
 import logging
 import time
 from typing import Any
 from uuid import UUID
 
-from .. import context
+from .. import context, models
 from . import tracker
 
 logger = logging.getLogger(__name__)
@@ -191,8 +190,10 @@ class CmpndGEPACallback:
             components = event.get("components", [])
             dataset = event.get("dataset", {})
 
-            # Deep copy to avoid mutation (matches tracker.py pattern)
-            dataset_copy = json.loads(json.dumps(dataset, default=str))
+            # Deep copy to avoid mutation (matches tracker.py pattern), and the
+            # copy is jsonb-storable: the dataset is raw captured LM text bound
+            # for a jsonb column.
+            dataset_copy = models._safe_serialize(dataset)
 
             self._tracker.capture_reflective_dataset(
                 iteration=iteration,
@@ -464,17 +465,9 @@ class CmpndGEPACallback:
 
         for idx, instructions in enumerate(candidates):
             try:
-                # Extract parent index (first non-None parent)
-                parent_idx = None
-                if idx < len(parents):
-                    parent_list = parents[idx]
-                    if isinstance(parent_list, (list, tuple)):
-                        for p in parent_list:
-                            if p is not None:
-                                parent_idx = p
-                                break
-                    elif parent_list is not None:
-                        parent_idx = parent_list
+                # Extract the full parent list — a merge proposal has two, and
+                # serve derives the mutation type and generation from them.
+                parents_of = tracker.normalize_parent_indices(parents[idx] if idx < len(parents) else None)
 
                 # Compute aggregate score: prefer val_subscores (per-example),
                 # fall back to objective_scores (per-objective)
@@ -503,7 +496,7 @@ class CmpndGEPACallback:
                     tracker.CandidateData(
                         candidate_idx=idx,
                         instructions=instructions if isinstance(instructions, dict) else {},
-                        parent_idx=parent_idx,
+                        parent_indices=parents_of,
                         discovery_iteration=int(discovery_counts[idx]) if idx < len(discovery_counts) else 0,
                         val_aggregate_score=val_aggregate_score,
                         val_subscores=val_subs,