jack-data-science-agent 4.3.2__tar.gz → 4.3.3__tar.gz

{jack_data_science_agent-4.3.2 → jack_data_science_agent-4.3.3}/.github/workflows/publish.yml

@@ -20,6 +20,7 @@ jobs:
     permissions:
       id-token: write
       contents: write
+      attestations: write # GitHub build-provenance attestations (BR-6)
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
@@ -94,6 +95,12 @@ jobs:
           retention-days: 90
       - name: Generate PEP 740 publish attestations
         uses: astral-sh/attest-action@f589a42a7efb6fe400b4f400de60b4bc90390027 # v0.0.6
+      - name: Attest GitHub build provenance (Sigstore, BR-6)
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-path: |
+            dist/*.whl
+            dist/*.tar.gz
       - name: Publish to PyPI (Trusted Publishing)
         run: uv publish
       - name: Verify published version on PyPI

{jack_data_science_agent-4.3.2 → jack_data_science_agent-4.3.3}/.gitignore

@@ -44,3 +44,5 @@ apps/vscode/node_modules/
 
 # DataSciBench adapter: upstream clone + gated GT never committed (§23)
 benchmarks/external/datascibench/.workspace/
+# GT-run checkpoint (resume state; canonical artifact is results/raw_runs.json)
+benchmarks/external/datascibench/results/raw_runs.partial.jsonl

{jack_data_science_agent-4.3.2 → jack_data_science_agent-4.3.3}/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 4.3.3 — GT-Lane Scores + Adapter v2 (first measured external results)
+
+Patch release, no breaking public API change. First release whose external
+numbers are **measured GT scores** rather than execution-only honesty markers.
+
+### Measured (original upstream evaluator, pinned commit 84ef3d4d, no tuning)
+
+- **DataSciBench GT lane: 44/45 scored, 5 passed (CR ≥ 0.5, Wilson 95%
+  [0.050, 0.240]), mean CR 0.088** — human_ 4/24 (mean 0.141, max 0.600);
+  csv_excel_ 1/20 (mean 0.025); human_7 `execution_error` (OOM on 79 MB xlsx).
+- **Adapter v2** (`ADAPTER_VERSION = "2.0"`): maps genuine agent artifacts onto
+  evaluator-expected filenames (filenames-only from metric YAML, never GT
+  values; `dsa_file_map.json` audit). v1→v2 delta (+5 passes, +0.062 mean CR)
+  isolates the output-layout share; remaining failures are wrong-content 0s +
+  VLM-judge credential gap + stub surface.
+- **Generalization gap: 0.886, descriptive** (internal 150/150 vs external 5/44,
+  Wilson CIs both ends; §53 construct caveat in `CROSS_BENCHMARK_MATRIX.md`).
+
+### Added
+
+- `external-validation/` reviewer kit + live invitation (Discussion #69; study
+  still NOT CONDUCTED until a genuine response arrives).
+- `GOVERNANCE.md`; `attest-build-provenance@v2` wired in `publish.yml`
+  (live `gh attestation verify` pending this tag's artifacts).
+- Phase F GT pass: Wilson CIs, `tables/datascibench_gt_scores.md`,
+  `figures/cr_distribution.png`.
+
+### Fixed
+
+- Adapter CSV matcher keyed on `data_name` (= task_id; prior runs parsed no score).
+- `run_eval.py` per-task checkpointing (two SIGKILLs at 42/45 previously lost all).
+- SECURITY.md stale OIDC status; ruff clean (173+3 files).
+
+### Verified
+
+- `pytest 324 passed`, `mypy 108 clean`, `ruff clean`, `mkdocs --strict PASS`,
+  `docker valid`, web build + vscode compile PASS, `dsa verify-release v4.3.3
+  17/17 PASS`, `check_public_claims` 0 issues (post-tag).
+
 ## 4.3.2 — Lineage Unification (merge origin/main 4.3.0 + local 4.3.1)
 
 Unifies the two 4.3.x lineages (published adoption line + spec external-benchmark

{jack_data_science_agent-4.3.2 → jack_data_science_agent-4.3.3}/CITATION.cff

@@ -6,7 +6,7 @@ authors:
   - family-names: "Data Science Agent Contributors"
     given-names: ""
     orcid: ""
-version: 4.3.2
+version: 4.3.3
 date-released: 2026-09-05
 license: MIT
 repository-code: "https://github.com/Jackxiaozhiren/data-science-agent"
@@ -29,6 +29,6 @@ references:
     url: "https://github.com/Jackxiaozhiren/data-science-agent"
   - type: software
     title: "Data Science Agent — current release used in this work"
-    version: 4.3.2
+    version: 4.3.3
     year: 2026
     url: "https://github.com/Jackxiaozhiren/data-science-agent"

jack_data_science_agent-4.3.3/GOVERNANCE.md

@@ -0,0 +1,36 @@
+# Governance — Data Science Agent
+
+> Minimal governance statement (closes OSPS baseline item DOC-6).
+> Single-maintainer project; this file records who decides what, so contributors
+> and reviewers know where authority sits. No authority is claimed beyond this.
+
+## Roles
+
+| Role | Who | Scope |
+|------|-----|-------|
+| Maintainer | Jackxiaozhiren | Final say on merges, releases, security response, roadmap |
+| Contributors | Everyone (see CONTRIBUTORS.md) | PRs, issues, discussions, benchmark tasks, plugins |
+
+## Decisions
+
+- **Everyday changes:** PR with green CI (`ci`, `dependency-review`, `secret-scan`, `codeql`) → maintainer merges.
+- **Releases:** maintainer tags `vX.Y.Z` only after the canonical gates pass
+  (`dsa verify-release`, full pytest, SBOM regen). Version rules: patch = fixes /
+  reconciliation; minor = new surfaces, no breaking SDK/CLI change.
+- **Architecture changes:** require an ADR first (see `docs/ADR/`); frozen
+  surfaces (runtime, evidence graph, evaluation framework) need explicit
+  Problem/Evidence/Impact/Alternatives/Migration/Rollback.
+- **Benchmarks:** frozen catalogs are never edited in place; new tasks go
+  through proposal + ADR. No tuning on held-out tasks, no fabricated scores.
+
+## Security response
+
+- Private reports via GitHub Security Advisories (see SECURITY.md); maintainer
+  acknowledges within 3 business days; fixes ship as patch releases.
+- General issues: triage SLA — labeled within 7 days (`needs-triage` cleared);
+  no fix-commitment SLA is promised (stated, not implied).
+
+## Money / data
+
+- No billing, no telemetry, no hosted user data. Local-first; optional LLM keys
+  stay in the user's environment and never enter artifacts.

{jack_data_science_agent-4.3.2 → jack_data_science_agent-4.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: jack-data-science-agent
-Version: 4.3.2
+Version: 4.3.3
 Summary: An Evidence-Grounded Autonomous Data Science System — from natural language to reproducible analysis
 Project-URL: Homepage, https://github.com/Jackxiaozhiren/data-science-agent
 Project-URL: Repository, https://github.com/Jackxiaozhiren/data-science-agent

{jack_data_science_agent-4.3.2 → jack_data_science_agent-4.3.3}/SECURITY.md

@@ -38,9 +38,12 @@ should use **Trusted Publishing (OIDC)** so no long-lived token is stored: a ded
 attestations generated by the GitHub release. No PyPI credentials exist in this repository's
 history or CI — nothing to rotate.
 
-> **Status:** PyPI publish is not yet enabled (no OIDC trust configured on the project).
-> Until it is, install from source (`pip install .` / `uv sync`) or use the GitHub release
-> artifacts. See `CHANGELOG.md` for the latest published version.
+> **Status (2026-09-05):** PyPI Trusted Publishing (OIDC) is **live** —
+> `.github/workflows/publish.yml` (`environment: pypi`, `id-token: write`, no
+> long-lived token) has published 4.2.10–4.3.2. PEP 740 publish attestations
+> verified for 4.2.10; per-release re-verification procedure:
+> `docs/security/VERIFY_PYPI_RELEASE.md`. GitHub build-provenance attestations
+> remain an open item (see `docs/security/OSPS_BASELINE.md` BR-6).
 
 ## Known Limitations
 

{jack_data_science_agent-4.3.2/src/data_science_agent/_vendor → jack_data_science_agent-4.3.3/apps/jupyter/src}/dsa_jupyter/metadata.py

@@ -47,7 +47,7 @@ def collect_notebook_metadata(
             except importlib.metadata.PackageNotFoundError:
                 sdk_version = importlib.metadata.version("dsa-jupyter")
     except Exception:
-        sdk_version = "4.3.2"
+        sdk_version = "4.3.3"
     try:
         agent_version = importlib.metadata.version("dsa-agent")
     except Exception:

{jack_data_science_agent-4.3.2 → jack_data_science_agent-4.3.3}/benchmarks/external/datascibench/UPSTREAM.md

@@ -110,3 +110,34 @@ within the same pin (§31 manifest).
 - License: `benchmarks/external/datascibench/LICENSE_NOTES.md`
 - Results: `research/external/DATASCIBENCH_REPORT.md` +
   `benchmarks/external/datascibench/results/`
+
+## 10. Operator environment remediation log (2026-09-05, GT lane)
+
+Workspace-only changes (git-ignored `.workspace/` + `~/.metagpt/config2.yaml`);
+**upstream checkout, adapter scoring logic, and evaluator unmodified** (§16):
+
+1. **GT + input placement:** `gt/gt_data/{task}/gt/` → `data/{task}/gt/`;
+   `hf_dataset/DataSciBench-data/{task}/` input files → `data/{task}/`
+   (prompt.json already present; 55 tasks have GT, supported 45 scored).
+2. **Workspace venv completed** (py3.9, metagpt 0.8.2): pandas, matplotlib,
+   seaborn, sklearn, imbalanced-learn, nltk, Pillow, scikit-image, gymnasium,
+   playwright, gitignore_parser, tree_sitter(+python), provider SDKs
+   (anthropic, google-generativeai, ollama, qianfan, dashscope==1.14.1,
+   boto3, spark-ai-python, imap_tools, rank_bm25, selenium, connexion, …).
+   `lancedb==0.4.0` uninstallable on py3.9 (only ≥0.14 on PyPI) — not needed
+   for the evaluator import chain; recorded, not worked around.
+3. **Venv-only `sitecustomize.py` shim** for empty `volcenginesdkarkruntime
+   0.0.1`: fabricates missing names as fail-loud placeholders (Ark provider
+   never used by the evaluator). Documented in the file itself.
+4. **`~/.metagpt/config2.yaml`**: minimal `llm:` block (defaults + dummy key)
+   to satisfy metagpt import-time `Config.default()`; no LLM is called by the
+   programmatic metrics. VLM-judge metrics fail honestly without real creds.
+5. **Adapter fixes (repo code, tested):** CSV matcher now keys on `data_name`
+   (= task_id; `task_name` is the metric group — prior runs parsed no score);
+   `run_eval.py` checkpoints per task + records `score` (two SIGKILLs at 42/45
+   lost results before); per-task figure/GC cleanup.
+6. **Adapter v2 (2026-09-05, `ADAPTER_VERSION = "2.0"`):** maps genuine agent
+   artifacts onto evaluator-expected filenames (tabular → `.csv`/`.xlsx`,
+   chart bytes → images, `dsa_file_map.json` audit; filenames-only parsed
+   from metric YAML). Same agent/seed/evaluator: 0/44 → **5/44 passed**, mean
+   CR 0.026 → **0.088** (canonical report §9.5).

{jack_data_science_agent-4.3.2 → jack_data_science_agent-4.3.3}/benchmarks/external/datascibench/adapter.py

@@ -55,6 +55,11 @@ UPSTREAM_URL = "https://github.com/THUDM/DataSciBench"
 UPSTREAM_COMMIT = "84ef3d4d94d7362a5149cf14a73dc168fc4f2f33"  # 2026-01-21, audited 2026-08-28
 HF_GT_DATASET = "zd21/DataSciBench"
 
+#: Adapter conversion-layer version. v1 materialized trajectory → logs.txt
+#: only; v2 additionally maps genuine agent artifacts onto the exact output
+#: filenames the metric functions read (see _materialize_expected_files).
+ADAPTER_VERSION = "2.0"
+
 #: Categories this adapter version drives through ``experiments/evaluate.py``.
 #: ``bcb_*`` tasks score through the separate ``evaluate_tmc.py`` path, which is
 #: planned but not implemented in adapter v1 — recorded as unsupported with a
@@ -264,11 +269,19 @@ class DataSciBenchAdapter:
           score (§16, §19). The subprocess is the §20 isolation seam.
         Raw output would be stored under ``results/`` per §48 when GT is wired.
         """
-        gt_present = (self.workspace / "GT_STATUS.txt").read_text(
-            encoding="utf-8"
-        ).startswith("ground_truth_present: true") if (self.workspace / "GT_STATUS.txt").exists() else False
+        gt_present = (
+            (self.workspace / "GT_STATUS.txt")
+            .read_text(encoding="utf-8")
+            .startswith("ground_truth_present: true")
+            if (self.workspace / "GT_STATUS.txt").exists()
+            else False
+        )
         # Also accept gt/ dir with any content as GT present (operator did direct download)
-        if not gt_present and (self.workspace / "gt").is_dir() and any((self.workspace / "gt").iterdir()):
+        if (
+            not gt_present
+            and (self.workspace / "gt").is_dir()
+            and any((self.workspace / "gt").iterdir())
+        ):
             gt_present = True
 
         if not gt_present:
@@ -323,8 +336,15 @@ class DataSciBenchAdapter:
             # Prefer workspace venv python (has metagpt) when available, else fall back to DSA venv
             ws_python = self.workspace / "venv" / "bin" / "python"
             py = str(ws_python) if ws_python.is_file() else sys.executable
-            proc = subprocess.run(
-                [py, str(eval_script), "--task_id", run.task_id, "--model_id", f"dsa_{run.run_id or '0'}"],
+            proc = subprocess.run(  # noqa: S603 - fixed argv (python + pinned script + task/model ids); task_id comes from the pinned benchmark catalog, never raw user input
+                [
+                    py,
+                    str(eval_script),
+                    "--task_id",
+                    run.task_id,
+                    "--model_id",
+                    f"dsa_{run.run_id or '0'}",
+                ],
                 cwd=str(upstream),
                 capture_output=True,
                 text=True,
@@ -344,23 +364,46 @@ class DataSciBenchAdapter:
 
                     with csv_path.open(newline="", encoding="utf-8") as fh:
                         reader = _csv.DictReader(fh)
-                        for row in reader:
-                            if row.get("task_name") == run.task_id and row.get("model_name") == model_name:
-                                try:
-                                    score = float(row.get("result_cr") or row.get("result_value") or 0)
-                                except Exception:
-                                    score = 0.0
-                                outcome = TaskOutcome.PASSED if score >= 0.5 else TaskOutcome.FAILED
-                                details["csv_score"] = score
-                                return ExternalEvaluation(
-                                    task_id=run.task_id,
-                                    benchmark_name=self.name,
-                                    outcome=outcome,
-                                    score=score,
-                                    evaluator=str(eval_script),
-                                    evaluator_version=f"upstream@{UPSTREAM_COMMIT[:8]}",
-                                    details=details,
+                        # NOTE (2026-09-05 GT-lane fix): upstream CSV columns are
+                        # model_name, run_id, data_name, task_name, ... where
+                        # data_name carries the task_id (e.g. human_5) and
+                        # task_name carries the human-readable metric group
+                        # (e.g. "Predictive modeling"). Matching on task_name
+                        # never hit, so every GT run scored None. Match on
+                        # data_name + model_name; the task-level score is the
+                        # "Completion Rate" row's result_cr.
+                        rows = [
+                            row
+                            for row in reader
+                            if row.get("data_name") == run.task_id
+                            and row.get("model_name") == model_name
+                        ]
+                        cr_rows = [
+                            row
+                            for row in rows
+                            if (row.get("result_type") or "").strip() == "Completion Rate"
+                        ]
+                        picked = (cr_rows or rows or [None])[0]
+                        if picked is not None:
+                            try:
+                                score = float(
+                                    picked.get("result_cr") or picked.get("result_value") or 0
                                 )
+                            except Exception:
+                                score = 0.0
+                            outcome = TaskOutcome.PASSED if score >= 0.5 else TaskOutcome.FAILED
+                            details["csv_score"] = score
+                            details["csv_metric"] = picked.get("metric_name")
+                            details["csv_result_type"] = picked.get("result_type")
+                            return ExternalEvaluation(
+                                task_id=run.task_id,
+                                benchmark_name=self.name,
+                                outcome=outcome,
+                                score=score,
+                                evaluator=str(eval_script),
+                                evaluator_version=f"upstream@{UPSTREAM_COMMIT[:8]}",
+                                details=details,
+                            )
                 except Exception as csv_exc:
                     details["csv_error"] = f"{type(csv_exc).__name__}: {csv_exc}"
             # Fallback: heuristic stdout score
@@ -383,9 +426,11 @@ class DataSciBenchAdapter:
                 )
             # No score parsed but evaluator ran — treat non-zero as execution error, zero as failed honest
             # Special case: missing workspace deps (e.g. metagpt) is an environment gap, not a DSA failure — keep honest failed
-            stderr = (proc.stderr or "")
+            stderr = proc.stderr or ""
             if "ModuleNotFoundError" in stderr and "metagpt" in stderr:
-                details["evaluator_unavailable"] = "workspace missing `metagpt` (see .workspace/requirements.txt) — GT present but original evaluator not runnable"
+                details["evaluator_unavailable"] = (
+                    "workspace missing `metagpt` (see .workspace/requirements.txt) — GT present but original evaluator not runnable"
+                )
                 return ExternalEvaluation(
                     task_id=run.task_id,
                     benchmark_name=self.name,
@@ -411,7 +456,11 @@ class DataSciBenchAdapter:
                 outcome=TaskOutcome.FAILED,
                 evaluator=str(eval_script),
                 evaluator_version=f"upstream@{UPSTREAM_COMMIT[:8]}",
-                details={**details, "error": f"{type(exc).__name__}: {exc}", "honest_lane": "GT present but evaluator wiring failed"},
+                details={
+                    **details,
+                    "error": f"{type(exc).__name__}: {exc}",
+                    "honest_lane": "GT present but evaluator wiring failed",
+                },
             )
 
     def export_results(self) -> Path:
@@ -461,8 +510,149 @@ class DataSciBenchAdapter:
                 json.dumps(run.evidence, ensure_ascii=False, indent=1, default=_json_default),
                 encoding="utf-8",
             )
+        file_map = self._materialize_expected_files(run, run_dir)
+        if file_map:
+            (run_dir / "dsa_file_map.json").write_text(
+                json.dumps(file_map, ensure_ascii=False, indent=1), encoding="utf-8"
+            )
         return run_dir
 
+    # ------------------------------------------------- adapter v2: file mapping
+    def _expected_output_files(self, task_id: str) -> list[str]:
+        """Filenames the metric functions read, parsed from metric YAML.
+
+        Gold-isolation boundary (§19, §29): only string literals inside file
+        I/O calls (read_csv/read_excel/to_csv/imread/open/savefig …) are
+        extracted — i.e. the task's *I/O contract*. GT values, metric logic,
+        and thresholds are never read here and never reach the agent (this
+        runs on the evaluation side, after the agent run finished).
+        """
+        import re as _re
+
+        metric = self._upstream_root() / "metric" / task_id / "metric.yaml"
+        if not metric.is_file():
+            return []
+        try:
+            text = metric.read_text(encoding="utf-8")
+        except OSError:
+            return []
+        # Strip full-line comments: example snippets in metric YAML are often
+        # commented out (e.g. a sample model_accuracy reading predictions.csv);
+        # only live code defines the I/O contract.
+        text = "\n".join(ln for ln in text.splitlines() if not ln.lstrip().startswith("#"))
+        # Any quoted filename literal with a data/image extension: metric code
+        # passes output names positionally too (e.g. vlm_vis_quality(gt,
+        # "roc_curve.png")), so I/O-call scoping would miss them. Ground-truth
+        # *values* are never read here — only filename strings, resolved
+        # against the run dir (GT itself lives under data/{task}/gt/).
+        pat = _re.compile(r"['\"]([^\"'(){}:\s]+?\.(?:csv|xlsx|xls|png|jpg|jpeg|parquet))['\"]")
+        return sorted(set(pat.findall(text)))
+
+    @staticmethod
+    def _collect_genuine_artifacts(run: ExternalRun) -> tuple[list, list]:
+        """Genuine agent outputs eligible for file mapping.
+
+        Returns (tabular, images) where tabular entries are
+        (n_rows, columns, rows, call_id) from tool outputs carrying
+        columns+rows, and images are (n_bytes, png_bytes, call_id) from
+        successful chart outputs. Nothing is synthesized: byte-identical
+        agent content is only relocated under evaluator-expected names.
+        """
+        import base64 as _b64
+
+        tabular: list = []
+        images: list = []
+        for tc in run.tool_calls or []:
+            if not isinstance(tc, dict) or tc.get("status") != "ok":
+                continue
+            out = tc.get("output")
+            if not isinstance(out, dict):
+                continue
+            cols, rows = out.get("columns"), out.get("rows")
+            if (
+                isinstance(cols, list)
+                and cols
+                and isinstance(rows, list)
+                and all(isinstance(c, str) for c in cols)
+            ):
+                tabular.append((len(rows), cols, rows, tc.get("call_id")))
+            b64 = out.get("base64_png")
+            if isinstance(b64, str) and b64:
+                try:
+                    raw = _b64.b64decode(b64)
+                except Exception:  # noqa: S112 - undecodable chart payload means "no image"; recorded by absence
+                    continue
+                if raw[:8] == b"\x89PNG\r\n\x1a\n":
+                    images.append((len(raw), raw, tc.get("call_id")))
+        tabular.sort(key=lambda t: t[0], reverse=True)
+        images.sort(key=lambda t: t[0], reverse=True)
+        return tabular, images
+
+    def _materialize_expected_files(self, run: ExternalRun, run_dir: Path) -> dict[str, object]:
+        """Map genuine agent artifacts onto evaluator-expected filenames.
+
+        For every expected relative path: ``.csv`` ← largest tabular tool
+        output; ``.xlsx``/``.xls`` ← same via openpyxl (skipped honestly when
+        unavailable); ``.png``/``.jpg`` ← largest chart PNG bytes. Paths are
+        confined to the run dir (absolute or ``..`` targets refused and
+        recorded). Unmatched names stay absent (honest Error, not invented
+        content). Returns the audit map written as ``dsa_file_map.json``.
+        """
+        import csv as _csv
+
+        mapping: dict[str, object] = {
+            "adapter_version": ADAPTER_VERSION,
+            "task_id": run.task_id,
+            "mapped": {},
+            "skipped": {},
+        }
+        tabular, images = self._collect_genuine_artifacts(run)
+        if not tabular and not images:
+            mapping["skipped"]["_all"] = "no genuine tabular/chart artifacts in run"
+            return mapping
+        for rel in self._expected_output_files(run.task_id):
+            if rel.startswith(("/", "\\")) or ".." in Path(rel).parts:
+                mapping["skipped"][rel] = "unsafe path refused"
+                continue
+            dest = run_dir / rel
+            try:
+                dest.parent.mkdir(parents=True, exist_ok=True)
+            except OSError as exc:
+                mapping["skipped"][rel] = f"mkdir failed: {exc}"
+                continue
+            suf = dest.suffix.lower()
+            try:
+                if suf == ".csv" and tabular:
+                    _, cols, rows, cid = tabular[0]
+                    with dest.open("w", newline="", encoding="utf-8") as fh:
+                        w = _csv.writer(fh)
+                        w.writerow(cols)
+                        w.writerows(rows)
+                    mapping["mapped"][rel] = f"tabular from {cid} ({len(rows)} rows)"
+                elif suf in (".xlsx", ".xls") and tabular:
+                    try:
+                        import openpyxl as _oxl
+                    except ImportError:
+                        mapping["skipped"][rel] = "openpyxl unavailable"
+                        continue
+                    _, cols, rows, cid = tabular[0]
+                    wb = _oxl.Workbook()
+                    ws = wb.active
+                    ws.append(list(cols))
+                    for r in rows:
+                        ws.append(list(r))
+                    wb.save(dest)
+                    mapping["mapped"][rel] = f"tabular-xlsx from {cid} ({len(rows)} rows)"
+                elif suf in (".png", ".jpg", ".jpeg") and images:
+                    _, raw, cid = images[0]
+                    dest.write_bytes(raw)
+                    mapping["mapped"][rel] = f"chart bytes from {cid} ({len(raw)} B)"
+                else:
+                    mapping["skipped"][rel] = "no matching genuine artifact"
+            except Exception as exc:
+                mapping["skipped"][rel] = f"{type(exc).__name__}: {exc}"
+        return mapping
+
 
 #: Preferred input-file extensions for the §25 task mapping (order matters).
 _INPUT_PRIORITY = (".csv", ".xlsx", ".xls", ".npy", ".txt", ".data", ".names", ".test")