pen-stack 5.10.0__tar.gz → 5.12.0__tar.gz

{pen_stack-5.10.0 → pen_stack-5.12.0}/CHANGELOG.md

@@ -3,6 +3,69 @@
 All notable changes to PEN-STACK are documented here. This file follows
 [Keep a Changelog](https://keepachangelog.com/) and the program's phase structure.
 
+## [5.12.0] - 2026-06-11 - v5.12 release: The Closed Loop (autonomy Level 3)
+
+**Closed-Loop arc, Cycle 6 of 7.** Integrate everything into one continual design→build→test→learn cycle —
+humans/lab in control, no fabrication, drift-aware. Reaches **autonomy Level 3** (the program's honest ceiling).
+Workstreams WS-{LOOP,CONTINUAL,DRIFT} (+ WS-DEMO, WS-AUTONOMY), SHA-locked.
+
+### Added
+- **WS-LOOP** — `pen_stack/loop/cycle.py`: `run_loop(goal, cell_state, …)` orchestrates every prior cycle each
+  round — generate (v5.8) → decide/batch (v5.10) → **safety-gated** export (v5.7 + v5.11) → run (sim-lab v5.11 /
+  real lab) → ingest (v4.5 gate) → drift (v5.12) → continual learn (v5.12). **Gated**: safety, build, and
+  belief-admission each await the `approver`. Returns `autonomy_level=3`, `human_in_control=True`,
+  `no_fabrication=True`. A hazardous candidate is discarded by the safety-gated pipeline before it is ever run.
+- **WS-DRIFT** — `pen_stack/loop/drift.py`: `detect_drift(designs, results)` compares the v5.9 twin's predictions
+  vs observed readouts; growing miscalibration → `severity:"high"` → `inflate_intervals` (widen, don't over-trust).
+- **WS-CONTINUAL** — `pen_stack/loop/continual.py`: `continual_update(...)` recalibrates trust + twin + immune
+  proxies on **admitted outcomes only**; each update is **versioned + reversible** (`rollback_to`); high drift
+  widens intervals; an admitted immune measurement **with a CI** can graduate a v5.6 proxy → outcome-validated.
+  Recalibration, **not** foundation-model retraining.
+- **WS-DEMO + WS-AUTONOMY** — `loop_converges_faster_than_random` reports the active-vs-random convergence with a
+  bootstrap CI (retrospective/simulated, honest either way); `docs/autonomy.md` asserts the **Level-3 criteria**
+  (closed loop · human in control at every gate · anomaly flagging · no fabrication) and that Levels 4/5 are
+  **not** claimed.
+- **WS-BENCH** — bench **v0.3.8**: new `closed_loop` hard-gate task — the gate is the loop's integrity (gated
+  end-to-end run + no-fabrication + Level-3 human-in-control + drift detection + versioned/reversible continual
+  learning); an ungated autopilot fails by construction. Convergence reported informationally.
+- Docs: `docs/{closed_loop,autonomy}.md`; prereg `ws_{loop,continual,drift}` + SHA locks; deposit `phase_5.12/`.
+
+### Notes
+- The loop is **Level 3 — closed, but with humans/lab in control at every gate, NOT autonomous.** It runs in
+  silico via the sim-lab (a real lab attaches at the same interface); continual learning recalibrates rather than
+  retrains; drift covers calibration/residual shift, not all failures; the convergence demo is retrospective/
+  simulated, reported with CIs.
+
+## [5.11.0] - 2026-06-11 - v5.11 release: The Build Interface (digital→physical bridge)
+
+**Closed-Loop arc, Cycle 5 of 7.** Make designs executable and results ingestible — loop-ready, lab-optional,
+safety-gated, with the immune-risk profile attached as protocol metadata. Workstreams WS-{PROTO,INGEST,SIMLAB},
+SHA-locked.
+
+### Added
+- **WS-PROTO** — `pen_stack/build/protocol.py`: `export_protocol(design, experiment, target, actor)` for
+  Opentrons / PyLabRobot / cloud-lab. Runs `verify()` **first**: a safety-`refuse` or illegal design raises
+  **`ProtocolExportError`** (no export path for a flagged design); a cleared design is emitted as a **DRAFT**
+  ("human/lab review required") carrying the v5.6 immune profile + provenance in its metadata. Never auto-run.
+- **WS-INGEST** — `pen_stack/build/ingest.py`: `ingest_result(result, ...)` validates a result (assay / readout /
+  provenance) and turns it into a **quarantined measured edge Candidate**; the ONLY path into the curated
+  world-model is the v4.5 gate (`gate_admit`) — automated checks **and** explicit human approval. No auto-edit
+  (Principle 1). Immune measurements can begin validating the v5.6 proxies on a later pass.
+- **WS-SIMLAB** — `pen_stack/build/simlab.py`: `run_simulated(protocol_ir, design, cell_state)` executes a
+  protocol in silico (samples from the v5.9 twin + measurement noise), **labelled `SIMULATED`**, so the closed
+  loop (v5.12) runs end-to-end **export → sim → ingest** without hardware; never enters the world-model as
+  measured truth.
+- **WS-BENCH** — bench **v0.3.7**: new `protocol_safety` hard-gate task (`pen_stack/validate/protocol_safety.py`)
+  — a cleared design exports with immune metadata, a safety-refused/illegal design is blocked, and the simulated
+  loop completes with quarantined SIMULATED results; an ungated exporter (which would emit the hazardous protocol)
+  fails by construction.
+- Docs: `docs/build_interface.md`; prereg `ws_{proto,ingest,simlab}` + SHA locks; deposit `phase_5.11/`.
+
+### Notes
+- PEN-STACK emits protocols and ingests results; it does **not** run experiments — protocols are drafts requiring
+  human/lab review, results enter only through the gate, and the simulated lab is for development / loop-validation,
+  never a substitute for real data. Export is hard-blocked for anything the safety gate flags.
+
 ## [5.10.0] - 2026-06-11 - v5.10 release: The Experiment Designer (active learning / EIG)
 
 **Closed-Loop arc, Cycle 4 of 7.** The "Learn" brain of a self-driving lab: turn *"I'm uncertain"* into *"run

{pen_stack-5.10.0 → pen_stack-5.12.0}/CITATION.cff

@@ -1,7 +1,7 @@
 cff-version: 1.2.0
 message: "If you use PEN-STACK, please cite it as below."
 title: "PEN-STACK: open infrastructure for genome writing"
-version: 5.10.0
+version: 5.12.0
 date-released: 2026-06-11
 authors:
   - family-names: "Mahaboob Ali"

{pen_stack-5.10.0 → pen_stack-5.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pen-stack
-Version: 5.10.0
+Version: 5.12.0
 Summary: Open infrastructure for genome writing: the Writable Genome atlas, the Writer Atlas, and the Write Planner.
 Author-email: Anees Ahmed Mahaboob Ali <ahmedaneesm@gmail.com>
 License: MIT
@@ -90,12 +90,12 @@ every design against rule-grounded mechanism, reports calibrated confidence, cit
 [![codecov](https://codecov.io/gh/ahmedanees-m/pen-stack/branch/main/graph/badge.svg)](https://codecov.io/gh/ahmedanees-m/pen-stack)
 [![License: MIT](https://img.shields.io/badge/License-MIT-informational.svg)](LICENSE)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/)
-[![Version](https://img.shields.io/badge/version-5.10.0-blue.svg)](CHANGELOG.md)
-[![Tests](https://img.shields.io/badge/tests-330%20passing-success.svg)](tests/)
+[![Version](https://img.shields.io/badge/version-5.12.0-blue.svg)](CHANGELOG.md)
+[![Tests](https://img.shields.io/badge/tests-346%20passing-success.svg)](tests/)
 [![Lint: ruff](https://img.shields.io/badge/lint-ruff-purple.svg)](https://github.com/astral-sh/ruff)
 [![Runtime: Docker](https://img.shields.io/badge/runtime-docker-2496ED.svg)](docker/)
 [![Validation: pre-registered](https://img.shields.io/badge/validation-pre--registered-critical.svg)](prereg/)
-[![Genome-Writing Bench v0.3](https://img.shields.io/badge/benchmark-Genome--Writing%20Bench%20v0.3.6-6f42c1.svg)](benchmarks/genome_writing_bench/)
+[![Genome-Writing Bench v0.3](https://img.shields.io/badge/benchmark-Genome--Writing%20Bench%20v0.3.8-6f42c1.svg)](benchmarks/genome_writing_bench/)
 
 **Built on five prior, separately published repositories:**
 
@@ -134,6 +134,40 @@ Two questions gate every genome-writing project, and before PEN-STACK no resourc
 Everything is built on bulk-downloadable public data, runs on a single GPU, and is validated **blind** against
 a pre-registered, honest baseline before release.
 
+## What is new in v5.12 — The Closed Loop (autonomy Level 3)
+
+v5.12 (**Closed-Loop arc, Cycle 6 of 7**) integrates every prior cycle into one continual **design→build→test→learn**
+loop — humans/lab in control, no fabrication, drift-aware — reaching **autonomy Level 3** (the program's honest
+ceiling, not Level 5).
+
+| Workstream | What it adds | Result |
+|---|---|---|
+| **LOOP** | `loop/cycle.py` | `run_loop` orchestrates generate(v5.8)→decide(v5.10)→**safety-gated** export(v5.7+v5.11)→sim/real run(v5.11)→ingest(v4.5)→drift→learn; gates await the `approver`; `autonomy_level=3`, `human_in_control=True` |
+| **DRIFT** | `loop/drift.py` | predicted (twin) vs observed → growing miscalibration **widens uncertainty** (inflate, don't over-trust) |
+| **CONTINUAL** | `loop/continual.py` | recalibrate on **admitted** outcomes only; **versioned + reversible** (`rollback_to`); immune proxy → validated needs a CI'd measurement |
+| **DEMO+AUTONOMY** | `loop_converges_faster_than_random` · `docs/autonomy.md` | convergence reported with CI; **Level-3 criteria asserted** (closed · human-gated · anomaly-flagging · no-fabrication); Levels 4/5 not claimed |
+| **BENCH** | bench **v0.3.8** `closed_loop` hard gate | loop integrity vs an ungated autopilot (no gates, no drift, no versioned beliefs) |
+
+The loop is **Level 3 — closed, but with a human in control at every gate, NOT autonomous.** See
+[`docs/closed_loop.md`](docs/closed_loop.md), [`docs/autonomy.md`](docs/autonomy.md), and
+`prereg/ws_{loop,continual,drift}.yaml`.
+
+## What is new in v5.11 — The Build Interface (digital→physical bridge)
+
+v5.11 (**Closed-Loop arc, Cycle 5 of 7**) makes designs executable and results ingestible — loop-ready,
+lab-optional, **safety-gated**, with the immune-risk profile attached as protocol metadata. PEN-STACK emits
+protocols and ingests results; it does **not** run experiments.
+
+| Workstream | What it adds | Result |
+|---|---|---|
+| **PROTO** | `build/protocol.py` | `export_protocol` runs `verify()` first; a safety-refused/illegal design raises **`ProtocolExportError`**; a cleared design → a **DRAFT** (Opentrons/PyLabRobot/cloud-lab) carrying the v5.6 immune profile |
+| **INGEST** | `build/ingest.py` | a result → a **quarantined measured Candidate**; the only path into the curated world-model is the v4.5 gate (checks + human approval) — **no auto-edit** |
+| **SIMLAB** | `build/simlab.py` | `run_simulated` samples from the v5.9 twin (+ noise), **labelled SIMULATED**; the loop **export → sim → ingest** runs without hardware |
+| **BENCH** | bench **v0.3.7** `protocol_safety` hard gate | cleared exports w/ immune metadata · hazard+illegal blocked · sim loop completes; an ungated exporter fails by construction |
+
+Protocols are **drafts for human/lab review, never auto-executed**; export is hard-blocked for anything the safety
+gate flags. See [`docs/build_interface.md`](docs/build_interface.md) and `prereg/ws_{proto,ingest,simlab}.yaml`.
+
 ## What is new in v5.10 — The Experiment Designer (active learning / EIG)
 
 v5.10 (**Closed-Loop arc, Cycle 4 of 7**) is the **Learn** brain of a self-driving lab: it turns *"I'm
@@ -643,6 +677,8 @@ pen-stack/
 │   ├── design/                       v5.8 generative designer: space (candidate_space) / generate (verifier-as-discriminator; hazardous+illegal discarded) / pareto (frontier w/ grounded v5.6 immune axis)
 │   ├── twin/                         v5.9 digital twin: mechanistic (cassette expression, closed-form) / outcome (fuse mech+vcell+v5.6 immune; OOD widens interval; phenotype-bounded) / calibrate (honest two-sided)
 │   ├── active/                       v5.10 experiment designer: acquire (EIG/immune-VOI over the v5.9 twin) / design (diverse batch) / validate (retrospective active-vs-random, reps+CI, falsifiable)
+│   ├── build/                        v5.11 build interface: protocol (safety-gated export, DRAFT + v5.6 immune metadata) / ingest (typed gated -> v4.5 world-model, no auto-edit) / simlab (export->sim->ingest, SIMULATED)
+│   ├── loop/                         v5.12 closed loop (autonomy L3): cycle (run_loop, gated DBTL) / drift (predicted-vs-observed, inflate) / continual (admitted-only, versioned+reversible recalibration)
 │   ├── adapt/                        local recalibration / private-data adaptation behind a gate (v3.1, WS-F)
 │   ├── env/                          v3.4 full Gymnasium environment over router+verifier (genome_writing_env + policies; [env] extra)
 │   ├── monitor/                      PEN-MONITOR living database (Europe PMC)
@@ -656,12 +692,14 @@ pen-stack/
 │   │                                   v5.7 safety_screening (the Guardian hard-gate: benign 0-false-refusal · hazards refused/escalated · evasions never clear) /
 │   │                                   v5.8 generative_design (verifier-as-discriminator hard-gate: hazardous+illegal discarded; survivors calibrated+immune; grounded-immune Pareto) /
 │   │                                   v5.9 outcome_prediction (digital-twin hard-gate: two-sided calibration + OOD widening + immune dim + phenotype out-of-scope) /
-│   │                                   v5.10 experiment_design (active-learning hard-gate: EIG monotone + immune-VOI + diverse batch + retrospective active-vs-random reps+CI)
+│   │                                   v5.10 experiment_design (active-learning hard-gate: EIG monotone + immune-VOI + diverse batch + retrospective active-vs-random reps+CI) /
+│   │                                   v5.11 protocol_safety (build-interface hard-gate: cleared exports w/ immune metadata · hazard+illegal blocked · sim loop completes) /
+│   │                                   v5.12 closed_loop (loop-integrity hard-gate: gated end-to-end run · Level-3 human-in-control · drift detection · versioned/reversible continual learning)
 │   ├── data/                         ingestion (genome, chromatin, integration, TRIP, safety annotations)
 │   ├── server/api.py                 FastAPI REST (atlas, crosslink, writable, plan, bridge, ask)
 │   ├── ui/app.py                     Streamlit web app (16 pages; v3.2 PEN-Agent shows confidence + epistemic status)
 │   └── cli.py                        unified CLI
-├── benchmarks/genome_writing_bench/  Genome-Writing Bench v0.3.6 (T1-T16 + co_scientist + safety_screening + generative_design + outcome_prediction + experiment_design; tasks / harness / solvers / LEADERBOARD / SHAs)
+├── benchmarks/genome_writing_bench/  Genome-Writing Bench v0.3.8 (T1-T16 + co_scientist + safety_screening + generative_design + outcome_prediction + experiment_design + protocol_safety + closed_loop; tasks / harness / solvers / LEADERBOARD / SHAs)
 ├── bench/run.py                      one-command bench entrypoint (--agent, --verify)
 ├── scripts/                          reproducible pipeline drivers (p1_*, p2_*, p4_*, p52/p53 delivery-immunology oracle builds, ws_*_report)
 ├── configs/                          pinned datasets + thresholds + curation (YAML); v3.2 known_unknowns /
@@ -673,7 +711,8 @@ pen-stack/
 ├── prereg/                           SHA-locked success criteria (paper1..4 + ws_a..ws_h + v3.2-v5.9 ws_{uq,ep,mc,ba,
 │                                       r,v,route,env,bench,cal,o,wv,atlas,graph,mon,ct,plan,crit,cite,immune,
 │                                       genotox,epitope,innate,seroprev,peg,calib,profile,screen,policy,redteam,
-│                                       gen,pareto,orch,vcell,mech,outcome,twincal,acq,aldesign,alvalidate} + SHA256 locks)
+│                                       gen,pareto,orch,vcell,mech,outcome,twincal,acq,aldesign,alvalidate,
+│                                       proto,ingest,simlab,loop,continual,drift} + SHA256 locks)
 ├── data/curated/                     small committed tables (universe, gene coords, measured bridge profile,
 │                                       v3.2 bridge_offtarget_energetics.json)
 ├── data/llm_bench_cache/             28 cached ungrounded-LLM transcripts (T7, offline/CI replay)

{pen_stack-5.10.0 → pen_stack-5.12.0}/README.md

@@ -15,12 +15,12 @@ every design against rule-grounded mechanism, reports calibrated confidence, cit
 [![codecov](https://codecov.io/gh/ahmedanees-m/pen-stack/branch/main/graph/badge.svg)](https://codecov.io/gh/ahmedanees-m/pen-stack)
 [![License: MIT](https://img.shields.io/badge/License-MIT-informational.svg)](LICENSE)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/)
-[![Version](https://img.shields.io/badge/version-5.10.0-blue.svg)](CHANGELOG.md)
-[![Tests](https://img.shields.io/badge/tests-330%20passing-success.svg)](tests/)
+[![Version](https://img.shields.io/badge/version-5.12.0-blue.svg)](CHANGELOG.md)
+[![Tests](https://img.shields.io/badge/tests-346%20passing-success.svg)](tests/)
 [![Lint: ruff](https://img.shields.io/badge/lint-ruff-purple.svg)](https://github.com/astral-sh/ruff)
 [![Runtime: Docker](https://img.shields.io/badge/runtime-docker-2496ED.svg)](docker/)
 [![Validation: pre-registered](https://img.shields.io/badge/validation-pre--registered-critical.svg)](prereg/)
-[![Genome-Writing Bench v0.3](https://img.shields.io/badge/benchmark-Genome--Writing%20Bench%20v0.3.6-6f42c1.svg)](benchmarks/genome_writing_bench/)
+[![Genome-Writing Bench v0.3](https://img.shields.io/badge/benchmark-Genome--Writing%20Bench%20v0.3.8-6f42c1.svg)](benchmarks/genome_writing_bench/)
 
 **Built on five prior, separately published repositories:**
 
@@ -59,6 +59,40 @@ Two questions gate every genome-writing project, and before PEN-STACK no resourc
 Everything is built on bulk-downloadable public data, runs on a single GPU, and is validated **blind** against
 a pre-registered, honest baseline before release.
 
+## What is new in v5.12 — The Closed Loop (autonomy Level 3)
+
+v5.12 (**Closed-Loop arc, Cycle 6 of 7**) integrates every prior cycle into one continual **design→build→test→learn**
+loop — humans/lab in control, no fabrication, drift-aware — reaching **autonomy Level 3** (the program's honest
+ceiling, not Level 5).
+
+| Workstream | What it adds | Result |
+|---|---|---|
+| **LOOP** | `loop/cycle.py` | `run_loop` orchestrates generate(v5.8)→decide(v5.10)→**safety-gated** export(v5.7+v5.11)→sim/real run(v5.11)→ingest(v4.5)→drift→learn; gates await the `approver`; `autonomy_level=3`, `human_in_control=True` |
+| **DRIFT** | `loop/drift.py` | predicted (twin) vs observed → growing miscalibration **widens uncertainty** (inflate, don't over-trust) |
+| **CONTINUAL** | `loop/continual.py` | recalibrate on **admitted** outcomes only; **versioned + reversible** (`rollback_to`); immune proxy → validated needs a CI'd measurement |
+| **DEMO+AUTONOMY** | `loop_converges_faster_than_random` · `docs/autonomy.md` | convergence reported with CI; **Level-3 criteria asserted** (closed · human-gated · anomaly-flagging · no-fabrication); Levels 4/5 not claimed |
+| **BENCH** | bench **v0.3.8** `closed_loop` hard gate | loop integrity vs an ungated autopilot (no gates, no drift, no versioned beliefs) |
+
+The loop is **Level 3 — closed, but with a human in control at every gate, NOT autonomous.** See
+[`docs/closed_loop.md`](docs/closed_loop.md), [`docs/autonomy.md`](docs/autonomy.md), and
+`prereg/ws_{loop,continual,drift}.yaml`.
+
+## What is new in v5.11 — The Build Interface (digital→physical bridge)
+
+v5.11 (**Closed-Loop arc, Cycle 5 of 7**) makes designs executable and results ingestible — loop-ready,
+lab-optional, **safety-gated**, with the immune-risk profile attached as protocol metadata. PEN-STACK emits
+protocols and ingests results; it does **not** run experiments.
+
+| Workstream | What it adds | Result |
+|---|---|---|
+| **PROTO** | `build/protocol.py` | `export_protocol` runs `verify()` first; a safety-refused/illegal design raises **`ProtocolExportError`**; a cleared design → a **DRAFT** (Opentrons/PyLabRobot/cloud-lab) carrying the v5.6 immune profile |
+| **INGEST** | `build/ingest.py` | a result → a **quarantined measured Candidate**; the only path into the curated world-model is the v4.5 gate (checks + human approval) — **no auto-edit** |
+| **SIMLAB** | `build/simlab.py` | `run_simulated` samples from the v5.9 twin (+ noise), **labelled SIMULATED**; the loop **export → sim → ingest** runs without hardware |
+| **BENCH** | bench **v0.3.7** `protocol_safety` hard gate | cleared exports w/ immune metadata · hazard+illegal blocked · sim loop completes; an ungated exporter fails by construction |
+
+Protocols are **drafts for human/lab review, never auto-executed**; export is hard-blocked for anything the safety
+gate flags. See [`docs/build_interface.md`](docs/build_interface.md) and `prereg/ws_{proto,ingest,simlab}.yaml`.
+
 ## What is new in v5.10 — The Experiment Designer (active learning / EIG)
 
 v5.10 (**Closed-Loop arc, Cycle 4 of 7**) is the **Learn** brain of a self-driving lab: it turns *"I'm
@@ -568,6 +602,8 @@ pen-stack/
 │   ├── design/                       v5.8 generative designer: space (candidate_space) / generate (verifier-as-discriminator; hazardous+illegal discarded) / pareto (frontier w/ grounded v5.6 immune axis)
 │   ├── twin/                         v5.9 digital twin: mechanistic (cassette expression, closed-form) / outcome (fuse mech+vcell+v5.6 immune; OOD widens interval; phenotype-bounded) / calibrate (honest two-sided)
 │   ├── active/                       v5.10 experiment designer: acquire (EIG/immune-VOI over the v5.9 twin) / design (diverse batch) / validate (retrospective active-vs-random, reps+CI, falsifiable)
+│   ├── build/                        v5.11 build interface: protocol (safety-gated export, DRAFT + v5.6 immune metadata) / ingest (typed gated -> v4.5 world-model, no auto-edit) / simlab (export->sim->ingest, SIMULATED)
+│   ├── loop/                         v5.12 closed loop (autonomy L3): cycle (run_loop, gated DBTL) / drift (predicted-vs-observed, inflate) / continual (admitted-only, versioned+reversible recalibration)
 │   ├── adapt/                        local recalibration / private-data adaptation behind a gate (v3.1, WS-F)
 │   ├── env/                          v3.4 full Gymnasium environment over router+verifier (genome_writing_env + policies; [env] extra)
 │   ├── monitor/                      PEN-MONITOR living database (Europe PMC)
@@ -581,12 +617,14 @@ pen-stack/
 │   │                                   v5.7 safety_screening (the Guardian hard-gate: benign 0-false-refusal · hazards refused/escalated · evasions never clear) /
 │   │                                   v5.8 generative_design (verifier-as-discriminator hard-gate: hazardous+illegal discarded; survivors calibrated+immune; grounded-immune Pareto) /
 │   │                                   v5.9 outcome_prediction (digital-twin hard-gate: two-sided calibration + OOD widening + immune dim + phenotype out-of-scope) /
-│   │                                   v5.10 experiment_design (active-learning hard-gate: EIG monotone + immune-VOI + diverse batch + retrospective active-vs-random reps+CI)
+│   │                                   v5.10 experiment_design (active-learning hard-gate: EIG monotone + immune-VOI + diverse batch + retrospective active-vs-random reps+CI) /
+│   │                                   v5.11 protocol_safety (build-interface hard-gate: cleared exports w/ immune metadata · hazard+illegal blocked · sim loop completes) /
+│   │                                   v5.12 closed_loop (loop-integrity hard-gate: gated end-to-end run · Level-3 human-in-control · drift detection · versioned/reversible continual learning)
 │   ├── data/                         ingestion (genome, chromatin, integration, TRIP, safety annotations)
 │   ├── server/api.py                 FastAPI REST (atlas, crosslink, writable, plan, bridge, ask)
 │   ├── ui/app.py                     Streamlit web app (16 pages; v3.2 PEN-Agent shows confidence + epistemic status)
 │   └── cli.py                        unified CLI
-├── benchmarks/genome_writing_bench/  Genome-Writing Bench v0.3.6 (T1-T16 + co_scientist + safety_screening + generative_design + outcome_prediction + experiment_design; tasks / harness / solvers / LEADERBOARD / SHAs)
+├── benchmarks/genome_writing_bench/  Genome-Writing Bench v0.3.8 (T1-T16 + co_scientist + safety_screening + generative_design + outcome_prediction + experiment_design + protocol_safety + closed_loop; tasks / harness / solvers / LEADERBOARD / SHAs)
 ├── bench/run.py                      one-command bench entrypoint (--agent, --verify)
 ├── scripts/                          reproducible pipeline drivers (p1_*, p2_*, p4_*, p52/p53 delivery-immunology oracle builds, ws_*_report)
 ├── configs/                          pinned datasets + thresholds + curation (YAML); v3.2 known_unknowns /
@@ -598,7 +636,8 @@ pen-stack/
 ├── prereg/                           SHA-locked success criteria (paper1..4 + ws_a..ws_h + v3.2-v5.9 ws_{uq,ep,mc,ba,
 │                                       r,v,route,env,bench,cal,o,wv,atlas,graph,mon,ct,plan,crit,cite,immune,
 │                                       genotox,epitope,innate,seroprev,peg,calib,profile,screen,policy,redteam,
-│                                       gen,pareto,orch,vcell,mech,outcome,twincal,acq,aldesign,alvalidate} + SHA256 locks)
+│                                       gen,pareto,orch,vcell,mech,outcome,twincal,acq,aldesign,alvalidate,
+│                                       proto,ingest,simlab,loop,continual,drift} + SHA256 locks)
 ├── data/curated/                     small committed tables (universe, gene coords, measured bridge profile,
 │                                       v3.2 bridge_offtarget_energetics.json)
 ├── data/llm_bench_cache/             28 cached ungrounded-LLM transcripts (T7, offline/CI replay)

{pen_stack-5.10.0 → pen_stack-5.12.0}/benchmarks/genome_writing_bench/SHA256SUMS

@@ -1,4 +1,4 @@
-e00a8a901015eac185ac75366cf1ce5b0783451c9bc862d27d745b7d038887a8  benchmarks/genome_writing_bench/tasks.yaml
+757da90182c83025a1dc4da7075b4f378a311f03db23be29145a23356e95ea9a  benchmarks/genome_writing_bench/tasks.yaml
 5ca511c6763b4e3703e8009031ff8dc385c2a99540e2731d875a9fbbb16f5ecd  configs/gsh_validated_heldout.yaml
 758817c1e46c7db10f7f942316663367c5f297cac0cf2f59947a90638a256718  data/writer_panel.csv
 865b18ff23d140c3df6f3b5f25398581ebdfe3534e1cecf6f512afb540ab5ede  data/gsh_matched_controls.parquet

{pen_stack-5.10.0 → pen_stack-5.12.0}/benchmarks/genome_writing_bench/tasks.yaml

@@ -8,7 +8,7 @@
 # A task names a `scorer` (module.function in pen_stack.validate / pen_stack.bridge) and a `metric` key to
 # read from its report. Solvers (deterministic planner, naive baseline, LLM agent) are compared on the same
 # tasks; a solver that cannot ground a number must refuse, not invent (no-fabrication is a hard gate).
-version: "0.3.6"
+version: "0.3.8"
 prepared: "2026-06-11"
 
 taxonomy:
@@ -45,6 +45,10 @@ taxonomy:
   OP_outcome_prediction: "predict a write's computable outcome with HONEST calibration (two-sided MAE-vs-naive with bootstrap CI), an interval that WIDENS under OOD, an immune-outcome dimension from v5.6, and phenotype out of scope (vs an overconfident predictor with a fixed narrow interval and no scope awareness)"
   # v0.3.6 (v5.10): the experiment designer - active learning / EIG, falsifiable vs random/greedy.
   ED_experiment_design: "choose the experiment(s) that most reduce model uncertainty: EIG from the calibrated twin (monotone in uncertainty), immune-VOI rewarding proxy-validating experiments, a diverse batch, and a RETROSPECTIVE active-vs-random validation with reps + bootstrap CI (vs a random selector with no acquisition signal and no falsifiable curve)"
+  # v0.3.7 (v5.11): the build interface - safety-gated protocol export + gated ingestion + simulated loop.
+  PS_protocol_safety: "export a cleared design as a runnable protocol DRAFT carrying its v5.6 immune profile, BLOCK any safety-refused/illegal design (ProtocolExportError), and complete the simulated loop export->sim->ingest with results quarantined (no auto-edit) + labelled SIMULATED (vs an ungated exporter that would emit the hazardous protocol)"
+  # v0.3.8 (v5.12): the closed loop - one gated, drift-aware DBTL cycle at autonomy Level 3.
+  CL_closed_loop: "run the full generate->predict->decide->safety->build->ingest->learn loop end-to-end (sim-lab) with a human in control at every gate, drift detection that widens uncertainty, and versioned+reversible continual learning - autonomy Level 3, no fabrication (vs an ungated autopilot with no human gates, no drift, no versioned beliefs)"
 
 tasks:
   - id: site_selection_blind_gsh
@@ -298,3 +302,34 @@ tasks:
     note: "v5.10 the experiment designer: a trustworthy Learn engine computes acquisition from the calibrated twin,
       rewards proxy-validating experiments, selects a diverse batch, and validates active-vs-random retrospectively
       with CIs; a random selector has no acquisition signal and no falsifiable curve and fails by construction."
+
+  - id: protocol_safety
+    family: PS_protocol_safety
+    scorer: "pen_stack.validate.protocol_safety:run"
+    metric: "build_safety_honored"
+    baseline_metric: "ungated_exporter_safe"
+    higher_is_better: true
+    hard_gate: true
+    gate_rule: "build_safety_honored == True (cleared exports w/ immune metadata AND hazard+illegal blocked AND sim labelled AND export->sim->ingest completes w/ quarantine)"
+    ground_truth: "export blocking decided by the v5.7 safety gate + the rules (not the exporter); ingestion gated by
+      the v4.5 world-model gate (no auto-edit of curated truth); sim results labelled SIMULATED - non-circular"
+    circular: false
+    note: "v5.11 the build interface: a cleared design exports a DRAFT carrying its immune profile; a safety-refused
+      or illegal design raises ProtocolExportError; the simulated loop completes with quarantined, SIMULATED-labelled
+      results. An ungated exporter would emit the hazardous protocol and fails by construction."
+
+  - id: closed_loop
+    family: CL_closed_loop
+    scorer: "pen_stack.validate.closed_loop:run"
+    metric: "closed_loop_honest"
+    baseline_metric: "ungated_autopilot_honest"
+    higher_is_better: true
+    hard_gate: true
+    gate_rule: "closed_loop_honest == True (gated end-to-end run + no-fabrication + Level-3 human-in-control + drift detection + versioned/reversible continual learning)"
+    ground_truth: "structural integrity properties of a Level-3 DBTL loop (gated end-to-end run, human-in-control,
+      drift detection, versioned + reversible continual learning), NOT a beat-the-world claim - non-circular; the
+      active-vs-random convergence is reported with a CI either way (retrospective/simulated)"
+    circular: false
+    note: "v5.12 the closed loop: one command runs generate->predict->decide->safety->build->ingest->learn with a
+      human in control at every gate; drift widens uncertainty; continual learning is versioned + reversible.
+      Stops deliberately at autonomy Level 3. An ungated autopilot fails by construction."

pen_stack-5.12.0/docs/autonomy.md

@@ -0,0 +1,36 @@
+# Autonomy levels — PEN-STACK stops at Level 3 (v5.12, WS-AUTONOMY)
+
+PEN-STACK's closed loop (v5.12) is a **Level-3** design→build→test→learn engine: closed, but with **humans/lab in
+control at every gate**. This is the program's deliberate, honest ceiling — not Level 5.
+
+## The levels (for self-driving labs)
+
+| Level | Description | PEN-STACK |
+|---|---|---|
+| 0 | Manual — a human does everything | — |
+| 1 | Assisted — tools score/check, human decides each step | v3.3 verifier |
+| 2 | Partial — the system proposes designs + experiments; human runs + decides | v5.8–v5.11 |
+| **3** | **Closed loop with human control at every gate** — the system runs the full cycle, but pauses for human approval at safety, build, and belief-admission, and flags anomalies | **v5.12 (here)** |
+| 4 | Supervised autonomy — runs many cycles with human oversight, escalating exceptions | not claimed |
+| 5 | Full autonomy — no human in the loop | **not claimed; not a goal** |
+
+## What "Level 3" means here (asserted criteria)
+
+1. **Closed loop.** One command runs generate → predict → decide → safety → build → ingest → learn end-to-end
+   (`run_loop`), in silico (sim-lab) or with a real lab at the same interface.
+2. **Human in control at every gate.** The loop pauses for the `approver` at **safety** (export is refused for a
+   flagged design), **build** (protocols are DRAFTs requiring human/lab review), and **belief-admission** (results
+   enter the curated world-model only via the v4.5 gate with explicit approval).
+3. **Anomaly flagging.** Drift between predictions and observations is detected and **widens uncertainty** rather
+   than over-trusting a stale model; continual updates are versioned + reversible.
+4. **No fabrication.** Every number is tool-sourced; no stage invents a value.
+
+## What PEN-STACK deliberately does NOT do
+
+- It does **not** run experiments autonomously (protocols are drafts; a human/lab runs them).
+- It does **not** auto-edit the curated world-model (admission requires human approval).
+- It does **not** retrain the foundation models (continual learning is recalibration).
+- It does **not** claim Level 4 or 5. The human is in the loop by design.
+
+> Level 3 is a trustworthy ceiling: a closed, gated, drift-aware loop that a scientist drives — not an autonomous
+> agent acting in the world. The convergence demonstration is retrospective/simulated, reported with CIs.

pen_stack-5.12.0/docs/build_interface.md

@@ -0,0 +1,50 @@
+# The build interface (v5.11)
+
+From v5.11, PEN-STACK reaches the **digital→physical** interface — responsibly. A cleared, legal design becomes a
+runnable protocol DRAFT carrying its v5.6 immune-risk profile (refused outright if the v5.7 safety gate flags it);
+a typed ingestion API returns experimental results as candidate evidence admitted only through the v4.5
+world-model gate; and a simulated lab runs the whole loop before any hardware exists. PEN-STACK **emits protocols
+and ingests results — it does not run experiments.**
+
+## Safety-gated protocol export (`pen_stack/build/protocol.py`)
+
+```python
+from pen_stack.build import export_protocol, ProtocolExportError
+code = export_protocol(design, {"round": 0}, target="opentrons", actor="lab-alice")
+```
+
+`export_protocol` runs `verify(design, actor)` **first**. If the safety gate returns `refuse`, or the design is
+illegal, it raises **`ProtocolExportError`** — there is no export path for a flagged design. A cleared design is
+emitted for one of `opentrons` / `pylabrobot` / `cloudlab`, **stamped "DRAFT — human/lab review required"**, with
+the v5.6 immune profile and full provenance in the metadata. Protocols are drafts; nothing is auto-run.
+
+## Typed, gated ingestion (`pen_stack/build/ingest.py`)
+
+```python
+from pen_stack.build import ingest_result
+cand = ingest_result(result)                       # quarantined measured Candidate (no auto-merge)
+ingest_result(result, admitted_by="human", graph=g, approved=True)   # the ONLY path into the curated graph
+```
+
+A result is validated (assay / readout / provenance with a source) and turned into a **quarantined measured edge
+Candidate**. The only way it enters the curated world-model is the v4.5 gate (`gate_admit`) — automated checks
+**and** explicit human approval. No process auto-edits curated truth (Principle 1). Immune-measurement results can
+begin validating the v5.6 proxies on a later pass.
+
+## Simulated lab (`pen_stack/build/simlab.py`)
+
+```python
+from pen_stack.build import run_simulated
+res = run_simulated(protocol_ir, design, cell_state="k562", seed=0)
+```
+
+`run_simulated` executes a protocol in silico: it samples an "observed" readout from the v5.9 twin + measurement
+noise, **labelled `SIMULATED`**. This lets the closed loop (v5.12) run end-to-end **export → sim → ingest** without
+a wet lab. Sim outcomes inherit the twin's limits and **never** enter the curated world-model as measured truth.
+
+## Honest scope
+
+PEN-STACK emits protocols and ingests results; it does **not** run experiments — protocols are drafts requiring
+human/lab review, results enter only through the gate, and the simulated lab is for development and loop-validation,
+never a substitute for real data. Export is hard-blocked for anything the safety gate flags; the attached immune
+profile is a screen carrying its known-unknowns, not a patient prediction.

pen_stack-5.12.0/docs/closed_loop.md

@@ -0,0 +1,54 @@
+# The closed loop (v5.12)
+
+From v5.12, PEN-STACK integrates every prior cycle into one continual **design→build→test→learn** loop — humans/lab
+in control at every gate, no fabrication, drift-aware. One command runs it end-to-end.
+
+```python
+from pen_stack.loop import run_loop
+result = run_loop(goal, cell_state="k562", candidates=pool, rounds=5, approver="human")
+result["autonomy_level"]      # 3
+result["human_in_control"]    # True
+result["history"]             # per-round: n, blocked, best_readout, drift, versioned update
+```
+
+## The DBTL orchestrator (`pen_stack/loop/cycle.py`)
+
+Each round composes the whole stack:
+
+1. **generate** (v5.8) — safe + legal + calibrated + immune-profiled candidates (the verifier-as-discriminator
+   discards hazardous/illegal proposals);
+2. **decide** (v5.10) — `select_batch` picks a diverse, informative batch (EIG + immune-VOI);
+3. **safety + build** (v5.7 + v5.11) — `export_protocol` is **safety-gated** (a flagged design is blocked);
+4. **test** (v5.11) — `run_simulated` (sim-lab) or a real lab at the same interface;
+5. **ingest** (v4.5) — results enter as candidate evidence, admitted only through the gate;
+6. **drift** (v5.12) — predicted vs observed;
+7. **learn** (v5.12) — `continual_update` recalibrates, versioned + reversible.
+
+The loop **pauses for the approver at safety, build, and belief-admission** — it is not autonomous.
+
+## Drift detection (`pen_stack/loop/drift.py`)
+
+`detect_drift(designs, results)` compares the twin's predictions against observed readouts. Growing
+miscalibration → `severity: "high"` → `action: "inflate_intervals"` — widen uncertainty rather than over-trust a
+stale model. Covers calibration/residual shift, not every failure mode.
+
+## Continual learning (`pen_stack/loop/continual.py`)
+
+`continual_update(admitted_results, drift=…, approver=…, prev_version=…)` recalibrates the trust layer, the v5.9
+twin, and the v5.6 immune proxies **on admitted outcomes only**. Every update is **versioned** (evidence digest)
+and **reversible** (`rollback_to` the prior version), attributable to the approver. High drift widens intervals.
+An admitted immune measurement **with a CI** can move a v5.6 axis proxy → outcome-validated. This is
+**recalibration, not foundation-model retraining**.
+
+## Convergence demonstration
+
+`loop_converges_faster_than_random` reports — retrospectively, with a bootstrap CI — whether the loop's active
+Learn stage reaches a target model quality in fewer rounds than random selection (the v5.10 validation). It is
+reported honestly either way; the demonstration is retrospective/simulated.
+
+## Honest scope
+
+The loop is **Level 3** — closed, but with humans/lab in control at every gate, **not autonomous**. It runs in
+silico via the sim-lab (a real lab attaches at the same interface); continual learning recalibrates rather than
+retrains; drift detection covers calibration/residual shift, not all failures; immune-proxy graduation requires an
+admitted measurement with a CI. See [Autonomy levels](autonomy.md).

{pen_stack-5.10.0 → pen_stack-5.12.0}/pen_stack/__init__.py

@@ -1,2 +1,2 @@
 """PEN-STACK v3.0 - open infrastructure for genome writing."""
-__version__ = "5.10.0"
+__version__ = "5.12.0"

pen_stack-5.12.0/pen_stack/build/__init__.py

@@ -0,0 +1,16 @@
+"""pen_stack.build — the digital→physical bridge (v5.11).
+
+Make designs executable and results ingestible, loop-ready and lab-optional, with safety wired in at the point
+where software reaches for the physical world: a cleared, legal design becomes a runnable protocol DRAFT
+carrying its v5.6 immune-risk profile (refused outright if the v5.7 safety gate flags it); a typed ingestion API
+returns experimental results as candidate evidence admitted only through the v4.5 world-model gate; and a
+simulated lab runs the whole loop before any hardware exists. PEN-STACK emits protocols and ingests results — it
+does NOT run experiments.
+"""
+from __future__ import annotations
+
+from pen_stack.build.ingest import ResultSchemaError, ingest_result
+from pen_stack.build.protocol import ProtocolExportError, export_protocol
+from pen_stack.build.simlab import run_simulated
+
+__all__ = ["export_protocol", "ProtocolExportError", "ingest_result", "ResultSchemaError", "run_simulated"]

pen_stack-5.12.0/pen_stack/build/ingest.py

@@ -0,0 +1,47 @@
+"""Typed, gated result-ingestion API — the digital→physical bridge (v5.11, WS-INGEST).
+
+An experimental result enters PEN-STACK as CANDIDATE evidence, never auto-merged: it is turned into a measured
+edge Candidate and quarantined. The ONLY path into the curated world-model is the v4.5 gate (`gate_admit`) with
+automated checks AND explicit human approval — inheriting Principle 1 (no process auto-edits the world-model).
+Immune-measurement results can begin validating the v5.6 proxies on a later pass (v5.6 WS-CALIB).
+"""
+from __future__ import annotations
+
+from typing import Any
+
+from pen_stack.graph.ingest import Candidate, gate_admit
+
+
+class ResultSchemaError(ValueError):
+    """Raised when an ingested result is missing required fields (assay / readout / provenance)."""
+
+
+def _validate_result_schema(result: dict) -> dict:
+    for k in ("assay", "readout", "provenance"):
+        if result.get(k) is None:
+            raise ResultSchemaError(f"result missing required field {k!r}")
+    prov = result["provenance"]
+    if not (prov.get("source") or prov.get("doi") or prov.get("europepmc")):
+        raise ResultSchemaError("result provenance must carry source / doi / europepmc id")
+    return result
+
+
+def _as_candidate(result: dict) -> Candidate:
+    """A measured outcome -> a quarantined measured EDGE candidate (design --measured_outcome--> outcome)."""
+    src = result.get("design_id", "design:anon")
+    payload = {"src": src, "dst": f"outcome:{result['assay']}", "etype": "measured_outcome",
+               "confidence": result.get("confidence"), "scope": result.get("scope"),
+               "readout": result["readout"], "units": result.get("units")}
+    return Candidate(kind="edge", payload=payload, provenance=result["provenance"], evidence="measured",
+                     note="ingested experimental result (quarantined; admit only via the v4.5 gate)")
+
+
+def ingest_result(result: dict, *, admitted_by: str | None = None, graph: Any = None,
+                  approved: bool = False) -> Any:
+    """Validate + quarantine an experimental result as a measured Candidate. With `admitted_by` + a `graph` +
+    explicit `approved=True`, route it through the v4.5 gate (the ONLY path into the curated world-model);
+    otherwise return the quarantined Candidate (never auto-merged)."""
+    cand = _as_candidate(_validate_result_schema(result))
+    if admitted_by is not None and graph is not None and approved:
+        return gate_admit(graph, cand, approved=True, admitted_by=admitted_by)
+    return cand                                         # quarantined; no auto-edit of curated truth