pen-stack 5.5.0__tar.gz → 5.7.0__tar.gz

{pen_stack-5.5.0 → pen_stack-5.7.0}/CHANGELOG.md

@@ -3,6 +3,83 @@
 All notable changes to PEN-STACK are documented here. This file follows
 [Keep a Changelog](https://keepachangelog.com/) and the program's phase structure.
 
+## [5.7.0] - 2026-06-11 - v5.7 release: The Guardian (biosecurity / dual-use safety gate)
+
+Opens the **Closed-Loop arc (Cycle 1 of 7)**. Before PEN-STACK moves toward "build", it is made **safe by
+construction**: every design submitted to `verify()` first passes a biosecurity / dual-use screening gate that
+refuses or escalates select-agent, pandemic-pathogen, and controlled-toxin signatures — with function-based and
+chimera checks that catch AI-designed homologs homology alone would miss — while legitimate therapeutic designs
+pass untouched. Orthogonal to (and complementary with) the v5.1–v5.6 immune-risk profile. Workstreams
+WS-{SCREEN,POLICY,INTEGRATE,REDTEAM,BENCH}, SHA-locked.
+
+### Added
+- **WS-SCREEN** — `pen_stack/safety/{registry,screen}.py` + `configs/safety/hazard_registry.yaml`: a curated,
+  **version-pinned** `HazardRegistry` (`registry_version`) and three+ screens returning typed, provenanced
+  `ScreenHit`s — `function_flag` (toxin / pathogen-essential **functions**, the screen that catches AI-homologs
+  at low identity), `taxon_flag` (regulated-pathogen taxa), `chimera_context` (hazardous assembly of benign
+  parts + split-hazard), and `sequence_homology` (delegated to a wrappable external screener — IBBIS Common
+  Mechanism / SecureDNA-style; in-repo baseline is an honest no-op). **Signatures are function/family/taxon-level
+  only** (public Pfam accessions + public control-list references: 42 CFR 73 / 7 CFR 331 / 9 CFR 121 / Australia
+  Group / HHS P3CO/DURC) — no hazard sequences, no synthesis/enhancement detail. **All 14+ Pfam accessions
+  independently verified against EBI InterPro before reliance; one error (PF01375, mislabeled anthrax — it is
+  heat-labile/cholera enterotoxin) caught and corrected; anthrax PA re-sourced from UniProt P13423.**
+- **WS-POLICY** — `pen_stack/safety/{policy,gate,audit}.py` + `configs/safety/policy.yaml`: `SafetyVerdict`
+  {clear, flag, refuse, escalate}; `safety_gate(design, actor=…)` = strip-framing → screen → decide → audit;
+  ambiguous dual-use (gain-of-function) **escalates** to human review (HHS P3CO/DURC), not auto-refuse; an
+  append-only **hash-chained, tamper-evident** `audit_log` (+ `verify_chain`) storing a design *digest*, not the
+  design. Re-framing as "defensive research" cannot flip refuse→clear (the artifact decides, not the wording).
+- **WS-INTEGRATE** — `Verdict.safety: SafetyVerdict`; `verify(design, actor=…)` runs the gate **first** and a
+  `refuse` **short-circuits** (the design is returned un-evaluated, not scored/critiqued). No-fabrication holds:
+  hits come only from the versioned registry.
+- **WS-REDTEAM** — `pen_stack/safety/redteam.py`: adversarial harness (AI-homolog, split-hazard, reframing,
+  chimera) + reframing-stability pairs; reports set size + caught count.
+- **WS-BENCH** — bench **v0.3.3**: new `safety_screening` hard-gate task (`pen_stack/validate/safety_screening.py`)
+  — benign therapeutics 0 false refusals, hazards refused/escalated at correct severity, evasions never `clear`;
+  beats a no-safety baseline (1.0 vs 0.33) by construction. Frozen probes/registry/policy SHA-locked into the
+  bench. Bench now **17/17 available, planner beats naive on 13/13**.
+- Docs: `docs/responsible_use.md` + `docs/biosecurity.md`; prereg `ws_{screen,policy,redteam}` + SHA locks;
+  deposit `phase_5.7/` (execution summary + independent data/ID verification record).
+
+### Notes
+- The safety gate is a **defensive safeguard, not a guarantee**, and **not a substitute for institutional
+  biosafety / IBC review**; signatures are versioned and exploit detail is intentionally not published.
+- Orthogonal to the immune-risk profile: the Guardian asks *"is this design hazardous/dual-use?"*; the immune
+  profile asks *"will the patient react?"*. Both attach to every `Verdict`; neither subsumes the other.
+
+## [5.6.0] - 2026-06-11 - v5.6 release: Immunology completion & calibration (anti-PEG · proxy honesty · unified profile)
+
+Finishes the delivery-immunology arc (v5.1–v5.5): adds the missing **anti-PEG** axis, **calibrates** the
+proxies honestly, and exposes a **unified per-design immune-risk profile** that never collapses into one number.
+Workstreams WS-{PEG,CALIB,PROFILE} (+ optional WS-EXT), SHA-locked.
+
+### Added
+- **WS-PEG** — `pen_stack/planner/antipeg_oracle.py` + `configs/antipeg.yaml`: pre-existing/induced anti-PEG
+  antibodies gate **re-dosing** of PEGylated LNP. Population prevalence range (25–72 %) →
+  `preexisting_antipeg_score = 1 − midpoint/100`, range surfaced as `native_uncertainty`; **abstains** for
+  non-PEGylated vehicles. Serosurvey DOIs Crossref-verified (Chen 2016 `10.1021/acs.analchem.6b03109`, Yang &
+  Lai `10.1002/wnan.1339`, Armstrong `10.1002/cncr.22739`, Kozma `10.1016/j.addr.2020.07.024`). Scope card `antipeg`.
+- **WS-CALIB** — `pen_stack/validate/immune_calibration.py`: `calibrate_axis()` (Spearman ρ + percentile
+  bootstrap CI) labels an axis **outcome-validated only when the CI excludes zero**, else `weak_proxy`, and
+  `mechanistic_proxy` when N < 6. With no sufficient public paired (proxy, observed) dataset, **every axis is
+  honestly labelled a mechanistic/population proxy** — the label travels with the profile. (No fabricated
+  outcome data; machinery proven on synthetic input.)
+- **WS-PROFILE** — `pen_stack/planner/immune_profile.py` + **`Verdict.immune_profile`**: a per-design **vector**
+  of all axes (genotoxicity, CD8 epitope, innate, pre-existing NAb, anti-PEG), each with its own value +
+  uncertainty + scope + validation label. **`collapsed_score is None`** (never fused — asserted); known-unknowns
+  listed; abstaining axes report `None`.
+- **WS-EXT** — a documented qualitative **route/immune-privilege modifier** (eye/CNS lower realized
+  immunogenicity vs systemic; Streilein 2003 `10.1038/nri1224`; no fabricated magnitude); **CD4/MHC-II helper
+  epitopes**, **pre-existing capsid-specific T-cell immunity**, and **complement/CARPA** registered as
+  known-unknowns. `prereg/ws_{peg,calib,profile}.yaml` + SHA locks.
+
+### Changed
+- Version 5.5.0 -> 5.6.0 (minor — additive); `cite.curated_dois()` ingests the anti-PEG + immune-privilege DOIs.
+
+### Honesty invariant (unchanged)
+- Every axis is a **relative-risk screen** (sequence/mechanistic or population proxy), labelled as such until
+  outcome-validated; the profile is **never** collapsed into one number; patient-specific titer, post-dose-1
+  induced immunity, and exact in-vivo magnitude stay **known-unknowns**.
+
 ## [5.5.0] - 2026-06-10 - v5.5 release: Anti-vector seroprevalence oracle (the last immune axis, from data)
 
 Completes the computable delivery-immunology axes. **Pre-existing humoral immunity** (B-cell / neutralizing

{pen_stack-5.5.0 → pen_stack-5.7.0}/CITATION.cff

@@ -1,8 +1,8 @@
 cff-version: 1.2.0
 message: "If you use PEN-STACK, please cite it as below."
 title: "PEN-STACK: open infrastructure for genome writing"
-version: 5.5.0
-date-released: 2026-06-10
+version: 5.7.0
+date-released: 2026-06-11
 authors:
   - family-names: "Mahaboob Ali"
     given-names: "Anees Ahmed"

{pen_stack-5.5.0 → pen_stack-5.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pen-stack
-Version: 5.5.0
+Version: 5.7.0
 Summary: Open infrastructure for genome writing: the Writable Genome atlas, the Writer Atlas, and the Write Planner.
 Author-email: Anees Ahmed Mahaboob Ali <ahmedaneesm@gmail.com>
 License: MIT
@@ -87,16 +87,15 @@ every design against rule-grounded mechanism, reports calibrated confidence, cit
 [![PyPI](https://img.shields.io/pypi/v/pen-stack.svg)](https://pypi.org/project/pen-stack/)
 [![CI](https://github.com/ahmedanees-m/pen-stack/actions/workflows/ci.yml/badge.svg)](https://github.com/ahmedanees-m/pen-stack/actions/workflows/ci.yml)
 [![Publish](https://github.com/ahmedanees-m/pen-stack/actions/workflows/publish.yml/badge.svg)](https://github.com/ahmedanees-m/pen-stack/actions/workflows/publish.yml)
-[![coverage](https://raw.githubusercontent.com/ahmedanees-m/pen-stack/main/.github/badges/coverage.svg)](https://github.com/ahmedanees-m/pen-stack/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/ahmedanees-m/pen-stack/branch/main/graph/badge.svg)](https://codecov.io/gh/ahmedanees-m/pen-stack)
 [![License: MIT](https://img.shields.io/badge/License-MIT-informational.svg)](LICENSE)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/)
-[![Version](https://img.shields.io/badge/version-5.5.0-blue.svg)](CHANGELOG.md)
-[![Tests](https://img.shields.io/badge/tests-240%20passing-success.svg)](tests/)
+[![Version](https://img.shields.io/badge/version-5.7.0-blue.svg)](CHANGELOG.md)
+[![Tests](https://img.shields.io/badge/tests-307%20passing-success.svg)](tests/)
 [![Lint: ruff](https://img.shields.io/badge/lint-ruff-purple.svg)](https://github.com/astral-sh/ruff)
 [![Runtime: Docker](https://img.shields.io/badge/runtime-docker-2496ED.svg)](docker/)
 [![Validation: pre-registered](https://img.shields.io/badge/validation-pre--registered-critical.svg)](prereg/)
-[![Genome-Writing Bench v0.3](https://img.shields.io/badge/benchmark-Genome--Writing%20Bench%20v0.3.2-6f42c1.svg)](benchmarks/genome_writing_bench/)
+[![Genome-Writing Bench v0.3](https://img.shields.io/badge/benchmark-Genome--Writing%20Bench%20v0.3.3-6f42c1.svg)](benchmarks/genome_writing_bench/)
 
 **Built on five prior, separately published repositories:**
 
@@ -135,6 +134,46 @@ Two questions gate every genome-writing project, and before PEN-STACK no resourc
 Everything is built on bulk-downloadable public data, runs on a single GPU, and is validated **blind** against
 a pre-registered, honest baseline before release.
 
+## What is new in v5.7 — The Guardian (biosecurity / dual-use safety gate)
+
+v5.7 opens the **Closed-Loop arc (Cycle 1 of 7)** by making PEN-STACK **safe by construction**: every design
+submitted to `verify()` first passes a biosecurity / dual-use screening gate. A design matching a select-agent,
+pandemic-pathogen, or controlled-toxin signature is **refused or escalated**; legitimate therapeutic designs
+pass untouched. This is **orthogonal** to the v5.1–v5.6 immune-risk profile — the Guardian asks *"is this design
+itself hazardous/dual-use?"*, the immune profile asks *"will the patient react?"* — and both attach to every
+`Verdict`.
+
+| Workstream | What it adds | Result |
+|---|---|---|
+| **SCREEN** | `safety/{registry,screen}.py` + `configs/safety/hazard_registry.yaml` | version-pinned `HazardRegistry`; `function_flag` / `taxon_flag` / `chimera_context` / `sequence_homology` screens; the **function** screen catches AI-homologs (low identity, hazardous function) homology alone misses |
+| **POLICY** | `safety/{policy,gate,audit}.py` + `configs/safety/policy.yaml` | `SafetyVerdict` {clear/flag/refuse/escalate}; ambiguous dual-use → **escalate** (human review); **tamper-evident hash-chained audit**; re-framing can't flip refuse→clear |
+| **INTEGRATE** | `Verdict.safety`; `verify(design, actor=…)` | the gate runs **first**; a `refuse` **short-circuits** (design not scored further); no-fabrication holds |
+| **REDTEAM** | `safety/redteam.py` | adversarial probes (AI-homolog, split-hazard, reframing, chimera) caught; reframing-stable |
+| **BENCH** | bench **v0.3.3** `safety_screening` hard gate | benign 0 false refusals · hazards refused/escalated · evasions never `clear`; beats a no-safety baseline (1.0 vs 0.33); **17/17 tasks, planner beats naive 13/13** |
+
+Signatures are **function/family/taxon-level only** (public Pfam accessions + public control-list references:
+42 CFR 73 / 7 CFR 331 / 9 CFR 121 / Australia Group / HHS P3CO/DURC) — no hazard sequences, no synthesis detail.
+**All Pfam accessions were independently verified against EBI InterPro before reliance** (one error, PF01375,
+caught and corrected). The gate is a **defensive safeguard, not a guarantee**, and not a substitute for
+institutional biosafety / IBC review. See [`docs/responsible_use.md`](docs/responsible_use.md),
+[`docs/biosecurity.md`](docs/biosecurity.md), and `prereg/ws_{screen,policy,redteam}.yaml`.
+
+## What is new in v5.6 — Immunology completion & calibration (anti-PEG · proxy honesty · unified profile)
+
+v5.6 finishes the delivery-immunology arc and tells the truth about it. It adds the missing **anti-PEG** axis
+(gates LNP re-dosing), **calibrates** every proxy two-sided, and exposes a **unified per-design immune-risk
+profile** in which each axis keeps its own uncertainty and none is ever fused into one overconfident number.
+
+| Workstream | What it adds | Result |
+|---|---|---|
+| **PEG** | `planner/antipeg_oracle.py` + `configs/antipeg.yaml` | anti-PEG prevalence (25–72%) → `preexisting_antipeg_score`; gates **re-dosing**; abstains for non-PEG vehicles; range surfaced as uncertainty |
+| **CALIB** | `validate/immune_calibration.py` | each axis labelled **outcome-validated** (ρ + CI excluding 0) or **mechanistic/population proxy**; with no public paired-outcome data, all axes are honestly labelled proxies (the label travels with the profile) |
+| **PROFILE** | `planner/immune_profile.py` + `Verdict.immune_profile` | per-design **vector** of all axes, each with value + uncertainty + scope + validation label; **`collapsed_score is None`** (never fused); known-unknowns listed |
+| **EXT** | route/immune-privilege modifier + new known-unknowns | eye/CNS immune-privilege as a *documented qualitative* modifier (no magnitude); CD4/MHC-II, pre-existing capsid T-cell, complement/CARPA registered as known-unknowns |
+
+The in-vivo magnitude and patient-specific titer stay declared known-unknowns. See
+[`docs/delivery_immunology.md`](docs/delivery_immunology.md) and `prereg/ws_{peg,calib,profile}.yaml`.
+
 ## What is new in v5.5 — Anti-vector seroprevalence oracle (the last immune axis, from data)
 
 This completes the computable delivery-immunology axes. **Pre-existing humoral immunity** (B-cell / NAb) to a
@@ -217,6 +256,11 @@ efficacious integrator but its genotoxicity is the dominant concern). Crucially,
 **magnitude** stays a declared known-unknown — v5.1 surfaces documented priors, it does **not** predict a
 patient-specific immune response.
 
+> **The full delivery-immunology story (v5.1 → v5.5), with every axis, method, and outcome, is in
+> [`docs/delivery_immunology.md`](docs/delivery_immunology.md).** By v5.5, four of the five immune/safety axes
+> are computed from data or sequence (genotoxicity, adaptive/CD8, innate, pre-existing/NAb) rather than
+> hand-typed tiers.
+
 | Workstream | What it adds | Result |
 |---|---|---|
 | **IMMUNE config** | `immune_safety` block on all 8 vehicles in `configs/delivery_vehicles.yaml` | documented ordinal (low/moderate/high) priors for pre-existing immunity, neutralizing antibody, innate/adaptive immune, **genotoxicity**, efficacy — every `immune_doi` Crossref-verified and in the curated-DOI set |
@@ -381,6 +425,13 @@ benchmark with deterministic scorers and no circular labels. See
          |  off-target + DMS (Perry 2025)                                           |
          +-------------------------------------------------------------------------+
 
+   Delivery immunology (v5.1-5.6, feeds the planner): a safety<->efficacy balance over the 8-vehicle palette,
+   with the immune/safety axes computed/grounded from data + sequence (genotoxicity = VISDB x COSMIC;
+   adaptive/CD8 = MHCflurry over the capsid; innate = CpG/dsRNA of the cargo; pre-existing/NAb = serosurveys;
+   anti-PEG = serosurveys, gates LNP re-dosing) -> a unified per-axis immune-risk PROFILE (Verdict.immune_profile),
+   each axis labelled validated-or-proxy (WS-CALIB), never collapsed into one number; in-vivo magnitude + patient
+   titer stay declared known-unknowns.
+
    Platform services (on top of the validated core): PEN-MONITOR (Europe PMC living database),
    grounded RAG/Q&A, a tool-using agent + MCP server, and a Streamlit web app.
 ```
@@ -395,6 +446,7 @@ PEN-STACK is organised as **two reference layers + one engine + a services layer
 | **Writer Atlas** (companion) | `pen_stack.atlas`, `.mech`, `.score` | cross-family enzyme catalogue + Writer-Targeting KB | Paper 2 |
 | **Cross-link** | `pen_stack.atlas.crosslink` | bidirectional writer to locus queries | Paper 2 |
 | **Write Planner** (engine) | `pen_stack.planner` | inverse design, `edit_intent`-conditioned | Paper 3 |
+| **Delivery immunology** (v5.1-5.6) | `pen_stack.planner.delivery_immunology` + `{genotoxicity,capsid_epitope,seroprevalence,antipeg}_oracle`, `innate_sensing`, `immune_profile`; `validate.immune_calibration` | safety↔efficacy balance over the 8-vehicle palette; immune axes **computed/grounded from data+sequence** + anti-PEG (gates LNP re-dosing) → a unified per-axis `Verdict.immune_profile` (each axis validated-or-proxy, never collapsed); magnitude + patient titer stay known-unknowns ([docs](docs/delivery_immunology.md)) | M2 |
 | **Agentic platform** | `pen_stack.agent` | goal to cited, auditable plan; MCP server; one-command deploy | Paper 3 |
 | **Bridge off-target engine** | `pen_stack.bridge` | "CRISPOR for bridge recombinases" + guide QC (v3.1) | Paper 4 |
 | **Genome-Writing Bench** (v3.1) | `benchmarks/`, `bench/run.py` | first writing-side benchmark; deterministic scorers, leaderboard | M2 |
@@ -519,14 +571,21 @@ pen-stack/
 │   ├── planner/                      Write Planner (Paper 3): optimize / cargo / cargo_polish / multiplex / pipeline
 │   │                                   + v3.2 target_site (hard PAM/att/core reject) / delivery_constraints
 │   │                                   + v3.3 router (write-type dispatch) / delivery_vehicles (8-vehicle palette)
+│   │                                   + v5.1-5.6 delivery_immunology (safety<->efficacy balance) and the five
+│   │                                     immune-axis oracles: genotoxicity_oracle (VISDB x COSMIC) /
+│   │                                     capsid_epitope_oracle (MHCflurry) / innate_sensing (CpG-O/E + dsRNA) /
+│   │                                     seroprevalence_oracle (anti-vector NAb serosurveys) /
+│   │                                     antipeg_oracle (anti-PEG, gates LNP re-dosing) [v5.6]
+│   │                                   + v5.6 immune_profile (unified per-axis immune-risk vector; never collapsed)
 │   ├── bridge/                       bridge off-target engine (Paper 4): offtarget / fold_qc / guide_qc / pipeline / cli
 │   │                                   + v3.2 offtarget_energetics (position x substitution; held-out 0.88, ships)
 │   ├── agent/                        agentic platform: tools / orchestrator / pen_agent / mcp_server / guardrails; v5.0 co_scientist + cite (multi-strategy, self-critique, cited rationale, scope ledger)
 │   │                                   + v3.2 epistemic (3-tier status) / scope (known-unknowns matcher)
 │   ├── graph/                        v4.5 living world-model knowledge graph (schema/build/query/ingest/cell_types); typed provenanced edges; gated living loop (propose-only)
-│   ├── oracles/                      v4.0 L1 oracle mesh: OracleResult contract + adapters (genome/structure/protein_design/rna/energetics) over the foundation models; version-pinned cache
+│   ├── oracles/                      v4.0 L1 oracle mesh: OracleResult contract + adapters (genome/structure/protein_design/rna/energetics) over the foundation models; version-pinned cache; v5.2-5.6 delivery-immunology scope cards (delivery_genotoxicity/capsid_epitope/innate_sensing/seroprevalence/antipeg)
 │   ├── rules/                        v3.3 machine-readable rules engine (schema/evaluators/loader/solver) over configs/rules/*.yaml
-│   ├── verify/                       v3.3 verification service: verify(design) -> Verdict (legal+reasons+confidence+scope; v4.0 writer_critique)
+│   ├── verify/                       v3.3 verification service: verify(design) -> Verdict (legal+reasons+confidence+scope; v4.0 writer_critique; v5.1 delivery_profile; v5.6 immune_profile per-axis vector; v5.7 safety SafetyVerdict)
+│   ├── safety/                       v5.7 the Guardian: biosecurity/dual-use gate (registry/screen/policy/gate/audit/redteam); runs first in verify(); refuse short-circuits; tamper-evident audit
 │   ├── adapt/                        local recalibration / private-data adaptation behind a gate (v3.1, WS-F)
 │   ├── env/                          v3.4 full Gymnasium environment over router+verifier (genome_writing_env + policies; [env] extra)
 │   ├── monitor/                      PEN-MONITOR living database (Europe PMC)
@@ -535,17 +594,25 @@ pen-stack/
 │   │                                   within_locus_ranking / agent_eval / ungrounded_baseline (T7) / adapt_demo /
 │   │                                   v3.2 selective_prediction / uncertainty_eval / bench_trust_tasks (T8-T11) /
 │   │                                   out_of_scope_refusal / target_site_controls / offtarget_energetics_eval /
-│   │                                   v3.3 bench_rule_tasks (T12) / v3.4 bench_writetype_tasks + bench_adversarial_tasks (T13-16) + outcome_calibration
+│   │                                   v3.3 bench_rule_tasks (T12) / v3.4 bench_writetype_tasks + bench_adversarial_tasks (T13-16) + outcome_calibration /
+│   │                                   v5.6 immune_calibration (proxy-vs-observed; labels each axis validated-or-proxy, two-sided) /
+│   │                                   v5.7 safety_screening (the Guardian hard-gate: benign 0-false-refusal · hazards refused/escalated · evasions never clear)
 │   ├── data/                         ingestion (genome, chromatin, integration, TRIP, safety annotations)
 │   ├── server/api.py                 FastAPI REST (atlas, crosslink, writable, plan, bridge, ask)
 │   ├── ui/app.py                     Streamlit web app (16 pages; v3.2 PEN-Agent shows confidence + epistemic status)
 │   └── cli.py                        unified CLI
-├── benchmarks/genome_writing_bench/  Genome-Writing Bench v0.2 (T1-T11; tasks / harness / solvers / LEADERBOARD / SHAs)
+├── benchmarks/genome_writing_bench/  Genome-Writing Bench v0.3.3 (T1-T16 + co_scientist + safety_screening; tasks / harness / solvers / LEADERBOARD / SHAs)
 ├── bench/run.py                      one-command bench entrypoint (--agent, --verify)
-├── scripts/                          reproducible pipeline drivers (p1_*, p2_*, p4_*, ws_*_report)
-├── configs/                          pinned datasets + thresholds + curation (YAML); v3.2: known_unknowns /
-│                                       target_sites / delivery_constraints
-├── prereg/                           SHA-locked success criteria (paper1..4 + ws_a..ws_h + v3.2 ws_{uq,ep,mc,ba} + locks)
+├── scripts/                          reproducible pipeline drivers (p1_*, p2_*, p4_*, p52/p53 delivery-immunology oracle builds, ws_*_report)
+├── configs/                          pinned datasets + thresholds + curation (YAML); v3.2 known_unknowns /
+│                                       target_sites / delivery_constraints; v5.1-5.6 delivery_vehicles immune_safety /
+│                                       genotoxicity_oracle / capsid_epitope_oracle + capsid_sequences.fasta /
+│                                       seroprevalence / antipeg + oracles/scope_cards (+ v5.6 known_unknowns:
+│                                       cd4_mhcii_help / preexisting_capsid_tcell / complement_carpa);
+│                                       v5.7 safety/{hazard_registry,policy,probes} (Guardian; function/family/taxon-level only)
+├── prereg/                           SHA-locked success criteria (paper1..4 + ws_a..ws_h + v3.2-v5.7 ws_{uq,ep,mc,ba,
+│                                       r,v,route,env,bench,cal,o,wv,atlas,graph,mon,ct,plan,crit,cite,immune,
+│                                       genotox,epitope,innate,seroprev,peg,calib,profile,screen,policy,redteam} + SHA256 locks)
 ├── data/curated/                     small committed tables (universe, gene coords, measured bridge profile,
 │                                       v3.2 bridge_offtarget_energetics.json)
 ├── data/llm_bench_cache/             28 cached ungrounded-LLM transcripts (T7, offline/CI replay)

{pen_stack-5.5.0 → pen_stack-5.7.0}/README.md

@@ -12,16 +12,15 @@ every design against rule-grounded mechanism, reports calibrated confidence, cit
 [![PyPI](https://img.shields.io/pypi/v/pen-stack.svg)](https://pypi.org/project/pen-stack/)
 [![CI](https://github.com/ahmedanees-m/pen-stack/actions/workflows/ci.yml/badge.svg)](https://github.com/ahmedanees-m/pen-stack/actions/workflows/ci.yml)
 [![Publish](https://github.com/ahmedanees-m/pen-stack/actions/workflows/publish.yml/badge.svg)](https://github.com/ahmedanees-m/pen-stack/actions/workflows/publish.yml)
-[![coverage](https://raw.githubusercontent.com/ahmedanees-m/pen-stack/main/.github/badges/coverage.svg)](https://github.com/ahmedanees-m/pen-stack/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/ahmedanees-m/pen-stack/branch/main/graph/badge.svg)](https://codecov.io/gh/ahmedanees-m/pen-stack)
 [![License: MIT](https://img.shields.io/badge/License-MIT-informational.svg)](LICENSE)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/)
-[![Version](https://img.shields.io/badge/version-5.5.0-blue.svg)](CHANGELOG.md)
-[![Tests](https://img.shields.io/badge/tests-240%20passing-success.svg)](tests/)
+[![Version](https://img.shields.io/badge/version-5.7.0-blue.svg)](CHANGELOG.md)
+[![Tests](https://img.shields.io/badge/tests-307%20passing-success.svg)](tests/)
 [![Lint: ruff](https://img.shields.io/badge/lint-ruff-purple.svg)](https://github.com/astral-sh/ruff)
 [![Runtime: Docker](https://img.shields.io/badge/runtime-docker-2496ED.svg)](docker/)
 [![Validation: pre-registered](https://img.shields.io/badge/validation-pre--registered-critical.svg)](prereg/)
-[![Genome-Writing Bench v0.3](https://img.shields.io/badge/benchmark-Genome--Writing%20Bench%20v0.3.2-6f42c1.svg)](benchmarks/genome_writing_bench/)
+[![Genome-Writing Bench v0.3](https://img.shields.io/badge/benchmark-Genome--Writing%20Bench%20v0.3.3-6f42c1.svg)](benchmarks/genome_writing_bench/)
 
 **Built on five prior, separately published repositories:**
 
@@ -60,6 +59,46 @@ Two questions gate every genome-writing project, and before PEN-STACK no resourc
 Everything is built on bulk-downloadable public data, runs on a single GPU, and is validated **blind** against
 a pre-registered, honest baseline before release.
 
+## What is new in v5.7 — The Guardian (biosecurity / dual-use safety gate)
+
+v5.7 opens the **Closed-Loop arc (Cycle 1 of 7)** by making PEN-STACK **safe by construction**: every design
+submitted to `verify()` first passes a biosecurity / dual-use screening gate. A design matching a select-agent,
+pandemic-pathogen, or controlled-toxin signature is **refused or escalated**; legitimate therapeutic designs
+pass untouched. This is **orthogonal** to the v5.1–v5.6 immune-risk profile — the Guardian asks *"is this design
+itself hazardous/dual-use?"*, the immune profile asks *"will the patient react?"* — and both attach to every
+`Verdict`.
+
+| Workstream | What it adds | Result |
+|---|---|---|
+| **SCREEN** | `safety/{registry,screen}.py` + `configs/safety/hazard_registry.yaml` | version-pinned `HazardRegistry`; `function_flag` / `taxon_flag` / `chimera_context` / `sequence_homology` screens; the **function** screen catches AI-homologs (low identity, hazardous function) homology alone misses |
+| **POLICY** | `safety/{policy,gate,audit}.py` + `configs/safety/policy.yaml` | `SafetyVerdict` {clear/flag/refuse/escalate}; ambiguous dual-use → **escalate** (human review); **tamper-evident hash-chained audit**; re-framing can't flip refuse→clear |
+| **INTEGRATE** | `Verdict.safety`; `verify(design, actor=…)` | the gate runs **first**; a `refuse` **short-circuits** (design not scored further); no-fabrication holds |
+| **REDTEAM** | `safety/redteam.py` | adversarial probes (AI-homolog, split-hazard, reframing, chimera) caught; reframing-stable |
+| **BENCH** | bench **v0.3.3** `safety_screening` hard gate | benign 0 false refusals · hazards refused/escalated · evasions never `clear`; beats a no-safety baseline (1.0 vs 0.33); **17/17 tasks, planner beats naive 13/13** |
+
+Signatures are **function/family/taxon-level only** (public Pfam accessions + public control-list references:
+42 CFR 73 / 7 CFR 331 / 9 CFR 121 / Australia Group / HHS P3CO/DURC) — no hazard sequences, no synthesis detail.
+**All Pfam accessions were independently verified against EBI InterPro before reliance** (one error, PF01375,
+caught and corrected). The gate is a **defensive safeguard, not a guarantee**, and not a substitute for
+institutional biosafety / IBC review. See [`docs/responsible_use.md`](docs/responsible_use.md),
+[`docs/biosecurity.md`](docs/biosecurity.md), and `prereg/ws_{screen,policy,redteam}.yaml`.
+
+## What is new in v5.6 — Immunology completion & calibration (anti-PEG · proxy honesty · unified profile)
+
+v5.6 finishes the delivery-immunology arc and tells the truth about it. It adds the missing **anti-PEG** axis
+(gates LNP re-dosing), **calibrates** every proxy two-sided, and exposes a **unified per-design immune-risk
+profile** in which each axis keeps its own uncertainty and none is ever fused into one overconfident number.
+
+| Workstream | What it adds | Result |
+|---|---|---|
+| **PEG** | `planner/antipeg_oracle.py` + `configs/antipeg.yaml` | anti-PEG prevalence (25–72%) → `preexisting_antipeg_score`; gates **re-dosing**; abstains for non-PEG vehicles; range surfaced as uncertainty |
+| **CALIB** | `validate/immune_calibration.py` | each axis labelled **outcome-validated** (ρ + CI excluding 0) or **mechanistic/population proxy**; with no public paired-outcome data, all axes are honestly labelled proxies (the label travels with the profile) |
+| **PROFILE** | `planner/immune_profile.py` + `Verdict.immune_profile` | per-design **vector** of all axes, each with value + uncertainty + scope + validation label; **`collapsed_score is None`** (never fused); known-unknowns listed |
+| **EXT** | route/immune-privilege modifier + new known-unknowns | eye/CNS immune-privilege as a *documented qualitative* modifier (no magnitude); CD4/MHC-II, pre-existing capsid T-cell, complement/CARPA registered as known-unknowns |
+
+The in-vivo magnitude and patient-specific titer stay declared known-unknowns. See
+[`docs/delivery_immunology.md`](docs/delivery_immunology.md) and `prereg/ws_{peg,calib,profile}.yaml`.
+
 ## What is new in v5.5 — Anti-vector seroprevalence oracle (the last immune axis, from data)
 
 This completes the computable delivery-immunology axes. **Pre-existing humoral immunity** (B-cell / NAb) to a
@@ -142,6 +181,11 @@ efficacious integrator but its genotoxicity is the dominant concern). Crucially,
 **magnitude** stays a declared known-unknown — v5.1 surfaces documented priors, it does **not** predict a
 patient-specific immune response.
 
+> **The full delivery-immunology story (v5.1 → v5.5), with every axis, method, and outcome, is in
+> [`docs/delivery_immunology.md`](docs/delivery_immunology.md).** By v5.5, four of the five immune/safety axes
+> are computed from data or sequence (genotoxicity, adaptive/CD8, innate, pre-existing/NAb) rather than
+> hand-typed tiers.
+
 | Workstream | What it adds | Result |
 |---|---|---|
 | **IMMUNE config** | `immune_safety` block on all 8 vehicles in `configs/delivery_vehicles.yaml` | documented ordinal (low/moderate/high) priors for pre-existing immunity, neutralizing antibody, innate/adaptive immune, **genotoxicity**, efficacy — every `immune_doi` Crossref-verified and in the curated-DOI set |
@@ -306,6 +350,13 @@ benchmark with deterministic scorers and no circular labels. See
          |  off-target + DMS (Perry 2025)                                           |
          +-------------------------------------------------------------------------+
 
+   Delivery immunology (v5.1-5.6, feeds the planner): a safety<->efficacy balance over the 8-vehicle palette,
+   with the immune/safety axes computed/grounded from data + sequence (genotoxicity = VISDB x COSMIC;
+   adaptive/CD8 = MHCflurry over the capsid; innate = CpG/dsRNA of the cargo; pre-existing/NAb = serosurveys;
+   anti-PEG = serosurveys, gates LNP re-dosing) -> a unified per-axis immune-risk PROFILE (Verdict.immune_profile),
+   each axis labelled validated-or-proxy (WS-CALIB), never collapsed into one number; in-vivo magnitude + patient
+   titer stay declared known-unknowns.
+
    Platform services (on top of the validated core): PEN-MONITOR (Europe PMC living database),
    grounded RAG/Q&A, a tool-using agent + MCP server, and a Streamlit web app.
 ```
@@ -320,6 +371,7 @@ PEN-STACK is organised as **two reference layers + one engine + a services layer
 | **Writer Atlas** (companion) | `pen_stack.atlas`, `.mech`, `.score` | cross-family enzyme catalogue + Writer-Targeting KB | Paper 2 |
 | **Cross-link** | `pen_stack.atlas.crosslink` | bidirectional writer to locus queries | Paper 2 |
 | **Write Planner** (engine) | `pen_stack.planner` | inverse design, `edit_intent`-conditioned | Paper 3 |
+| **Delivery immunology** (v5.1-5.6) | `pen_stack.planner.delivery_immunology` + `{genotoxicity,capsid_epitope,seroprevalence,antipeg}_oracle`, `innate_sensing`, `immune_profile`; `validate.immune_calibration` | safety↔efficacy balance over the 8-vehicle palette; immune axes **computed/grounded from data+sequence** + anti-PEG (gates LNP re-dosing) → a unified per-axis `Verdict.immune_profile` (each axis validated-or-proxy, never collapsed); magnitude + patient titer stay known-unknowns ([docs](docs/delivery_immunology.md)) | M2 |
 | **Agentic platform** | `pen_stack.agent` | goal to cited, auditable plan; MCP server; one-command deploy | Paper 3 |
 | **Bridge off-target engine** | `pen_stack.bridge` | "CRISPOR for bridge recombinases" + guide QC (v3.1) | Paper 4 |
 | **Genome-Writing Bench** (v3.1) | `benchmarks/`, `bench/run.py` | first writing-side benchmark; deterministic scorers, leaderboard | M2 |
@@ -444,14 +496,21 @@ pen-stack/
 │   ├── planner/                      Write Planner (Paper 3): optimize / cargo / cargo_polish / multiplex / pipeline
 │   │                                   + v3.2 target_site (hard PAM/att/core reject) / delivery_constraints
 │   │                                   + v3.3 router (write-type dispatch) / delivery_vehicles (8-vehicle palette)
+│   │                                   + v5.1-5.6 delivery_immunology (safety<->efficacy balance) and the five
+│   │                                     immune-axis oracles: genotoxicity_oracle (VISDB x COSMIC) /
+│   │                                     capsid_epitope_oracle (MHCflurry) / innate_sensing (CpG-O/E + dsRNA) /
+│   │                                     seroprevalence_oracle (anti-vector NAb serosurveys) /
+│   │                                     antipeg_oracle (anti-PEG, gates LNP re-dosing) [v5.6]
+│   │                                   + v5.6 immune_profile (unified per-axis immune-risk vector; never collapsed)
 │   ├── bridge/                       bridge off-target engine (Paper 4): offtarget / fold_qc / guide_qc / pipeline / cli
 │   │                                   + v3.2 offtarget_energetics (position x substitution; held-out 0.88, ships)
 │   ├── agent/                        agentic platform: tools / orchestrator / pen_agent / mcp_server / guardrails; v5.0 co_scientist + cite (multi-strategy, self-critique, cited rationale, scope ledger)
 │   │                                   + v3.2 epistemic (3-tier status) / scope (known-unknowns matcher)
 │   ├── graph/                        v4.5 living world-model knowledge graph (schema/build/query/ingest/cell_types); typed provenanced edges; gated living loop (propose-only)
-│   ├── oracles/                      v4.0 L1 oracle mesh: OracleResult contract + adapters (genome/structure/protein_design/rna/energetics) over the foundation models; version-pinned cache
+│   ├── oracles/                      v4.0 L1 oracle mesh: OracleResult contract + adapters (genome/structure/protein_design/rna/energetics) over the foundation models; version-pinned cache; v5.2-5.6 delivery-immunology scope cards (delivery_genotoxicity/capsid_epitope/innate_sensing/seroprevalence/antipeg)
 │   ├── rules/                        v3.3 machine-readable rules engine (schema/evaluators/loader/solver) over configs/rules/*.yaml
-│   ├── verify/                       v3.3 verification service: verify(design) -> Verdict (legal+reasons+confidence+scope; v4.0 writer_critique)
+│   ├── verify/                       v3.3 verification service: verify(design) -> Verdict (legal+reasons+confidence+scope; v4.0 writer_critique; v5.1 delivery_profile; v5.6 immune_profile per-axis vector; v5.7 safety SafetyVerdict)
+│   ├── safety/                       v5.7 the Guardian: biosecurity/dual-use gate (registry/screen/policy/gate/audit/redteam); runs first in verify(); refuse short-circuits; tamper-evident audit
 │   ├── adapt/                        local recalibration / private-data adaptation behind a gate (v3.1, WS-F)
 │   ├── env/                          v3.4 full Gymnasium environment over router+verifier (genome_writing_env + policies; [env] extra)
 │   ├── monitor/                      PEN-MONITOR living database (Europe PMC)
@@ -460,17 +519,25 @@ pen-stack/
 │   │                                   within_locus_ranking / agent_eval / ungrounded_baseline (T7) / adapt_demo /
 │   │                                   v3.2 selective_prediction / uncertainty_eval / bench_trust_tasks (T8-T11) /
 │   │                                   out_of_scope_refusal / target_site_controls / offtarget_energetics_eval /
-│   │                                   v3.3 bench_rule_tasks (T12) / v3.4 bench_writetype_tasks + bench_adversarial_tasks (T13-16) + outcome_calibration
+│   │                                   v3.3 bench_rule_tasks (T12) / v3.4 bench_writetype_tasks + bench_adversarial_tasks (T13-16) + outcome_calibration /
+│   │                                   v5.6 immune_calibration (proxy-vs-observed; labels each axis validated-or-proxy, two-sided) /
+│   │                                   v5.7 safety_screening (the Guardian hard-gate: benign 0-false-refusal · hazards refused/escalated · evasions never clear)
 │   ├── data/                         ingestion (genome, chromatin, integration, TRIP, safety annotations)
 │   ├── server/api.py                 FastAPI REST (atlas, crosslink, writable, plan, bridge, ask)
 │   ├── ui/app.py                     Streamlit web app (16 pages; v3.2 PEN-Agent shows confidence + epistemic status)
 │   └── cli.py                        unified CLI
-├── benchmarks/genome_writing_bench/  Genome-Writing Bench v0.2 (T1-T11; tasks / harness / solvers / LEADERBOARD / SHAs)
+├── benchmarks/genome_writing_bench/  Genome-Writing Bench v0.3.3 (T1-T16 + co_scientist + safety_screening; tasks / harness / solvers / LEADERBOARD / SHAs)
 ├── bench/run.py                      one-command bench entrypoint (--agent, --verify)
-├── scripts/                          reproducible pipeline drivers (p1_*, p2_*, p4_*, ws_*_report)
-├── configs/                          pinned datasets + thresholds + curation (YAML); v3.2: known_unknowns /
-│                                       target_sites / delivery_constraints
-├── prereg/                           SHA-locked success criteria (paper1..4 + ws_a..ws_h + v3.2 ws_{uq,ep,mc,ba} + locks)
+├── scripts/                          reproducible pipeline drivers (p1_*, p2_*, p4_*, p52/p53 delivery-immunology oracle builds, ws_*_report)
+├── configs/                          pinned datasets + thresholds + curation (YAML); v3.2 known_unknowns /
+│                                       target_sites / delivery_constraints; v5.1-5.6 delivery_vehicles immune_safety /
+│                                       genotoxicity_oracle / capsid_epitope_oracle + capsid_sequences.fasta /
+│                                       seroprevalence / antipeg + oracles/scope_cards (+ v5.6 known_unknowns:
+│                                       cd4_mhcii_help / preexisting_capsid_tcell / complement_carpa);
+│                                       v5.7 safety/{hazard_registry,policy,probes} (Guardian; function/family/taxon-level only)
+├── prereg/                           SHA-locked success criteria (paper1..4 + ws_a..ws_h + v3.2-v5.7 ws_{uq,ep,mc,ba,
+│                                       r,v,route,env,bench,cal,o,wv,atlas,graph,mon,ct,plan,crit,cite,immune,
+│                                       genotox,epitope,innate,seroprev,peg,calib,profile,screen,policy,redteam} + SHA256 locks)
 ├── data/curated/                     small committed tables (universe, gene coords, measured bridge profile,
 │                                       v3.2 bridge_offtarget_energetics.json)
 ├── data/llm_bench_cache/             28 cached ungrounded-LLM transcripts (T7, offline/CI replay)

{pen_stack-5.5.0 → pen_stack-5.7.0}/bench/run.py

@@ -33,6 +33,9 @@ _FROZEN = [
     "configs/gsh_validated_heldout.yaml",
     "data/writer_panel.csv",
     "data/gsh_matched_controls.parquet",
+    "configs/safety/probes.yaml",           # v5.7 the Guardian: frozen hazard/benign/red-team probe set
+    "configs/safety/hazard_registry.yaml",  # v5.7: version-pinned hazard signatures
+    "configs/safety/policy.yaml",           # v5.7: severity->decision policy
 ]
 
 

{pen_stack-5.5.0 → pen_stack-5.7.0}/benchmarks/genome_writing_bench/LEADERBOARD.md

@@ -1,12 +1,12 @@
-# Genome-Writing Bench v0.3.2 - Leaderboard
+# Genome-Writing Bench v0.3.3 - Leaderboard
 
-Tasks: **16/16 available** in this run (unavailable = needs the Phase-1 atlas / Perry tables / an LLM, which run on the VM/local).
-Deterministic planner beats the naive baseline on **12/12** grounded tasks with a baseline.
+Tasks: **17/17 available** in this run (unavailable = needs the Phase-1 atlas / Perry tables / an LLM, which run on the VM/local).
+Deterministic planner beats the naive baseline on **13/13** grounded tasks with a baseline.
 
 | Solver | Tasks scored | Beats naive | No-fabrication | Note |
 |---|---|---|---|---|
-| deterministic_planner | 16 | 12/12 | n/a (deterministic) | validated planning tools - the reference |
-| naive_baseline | 12 | - | n/a (deterministic) | safety-only / prevalence / Hamming baselines |
+| deterministic_planner | 17 | 13/13 | n/a (deterministic) | validated planning tools - the reference |
+| naive_baseline | 13 | - | n/a (deterministic) | safety-only / prevalence / Hamming baselines |
 
 ## Per-task results
 | Task | Family | Available | Planner | Naive baseline | Gate |
@@ -27,6 +27,7 @@ Deterministic planner beats the naive baseline on **12/12** grounded tasks with
 | adversarial_robustness | T13_scope_disguise | True | 1.0 | 0.0 | - |
 | graph_multihop_reasoning | GR_graph_reasoning | True | 1.0 | 0.0 | - |
 | co_scientist_grounded | CS_co_scientist | True | 1.0 | 0.0 | - |
+| safety_screening | SF_safety_screening | True | True | False | PASS |
 
 ## Trust tasks (T8-T11) - calibration + scope-awareness separate *trustworthy* agents
 Each contrasts the **uncertainty-aware** agent (conformal coverage, selective prediction, OOD flagging, out-of-scope deferral) with an **over-confident** baseline (an uncalibrated interval, no abstention, never flags OOD, no scope layer). The over-confident agent is the realistic failure mode a calibrated co-scientist must beat.
@@ -50,4 +51,17 @@ The verifier-backed agent routes every write type to its rule sub-graph and surv
 
 _Verifier-backed beats the over-confident baseline on **2/2** available robustness tasks; no-fabrication holds throughout (incl. under prompt injection)._
 
-Scope: tasks are bounded by available documented writes (small, survivorship-biased). The bench measures grounded planning quality and site/writer/off-target discrimination, not clinical outcome. No task is scored against a circular label (Gate G-A).
+## Ungrounded-LLM contrast (T7) - what grounding actually buys
+Same models, **no tools**, same write-planning goals. A concrete value for a tool-only field is a fabrication; an explicit refusal is honest. Two prompt conditions: **naive** (no anti-fabrication coaching - the realistic probe) and **coached** (explicitly told to refuse ungroundable values). The grounded agent is 0.0 under BOTH by construction - that architectural guarantee is the point; prompt-coaching is not a substitute for grounding.
+
+| Agent | Prompt | Plan-goal fabrication | Ungroundable-goal fabrication |
+|---|---|---|---|
+| grounded PEN-Agent (with tools) | any | **0.0** | **0.0** |
+| ungrounded qwen2.5_7b (no tools) | naive | 1.0 | 1.0 |
+| ungrounded qwen2.5_7b (no tools) | coached | 0.0417 | 0.0 |
+| ungrounded nemotron (no tools) | naive | 1.0 | 0.6667 |
+| ungrounded nemotron (no tools) | coached | 0.0 | 0.0 |
+
+_with tools the agent fabricates nothing (0.0 by construction, any prompt); without tools the SAME models fabricate tool-only values under a naive prompt, and even under explicit anti-fabrication coaching they still slip - so grounding, not prompting, is what removes fabrication. The benchmark now separates grounded from ungrounded agents._
+
+Scope: tasks are bounded by available documented writes (small, survivorship-biased). The bench measures grounded planning quality and site/writer/off-target discrimination, not clinical outcome. No task is scored against a circular label (Gate G-A).

pen_stack-5.7.0/benchmarks/genome_writing_bench/SHA256SUMS

@@ -0,0 +1,7 @@
+61903ba95b3ac8fd132a9507341ebc975a21d834ff01b76f2fb1376a4a494e07  benchmarks/genome_writing_bench/tasks.yaml
+5ca511c6763b4e3703e8009031ff8dc385c2a99540e2731d875a9fbbb16f5ecd  configs/gsh_validated_heldout.yaml
+758817c1e46c7db10f7f942316663367c5f297cac0cf2f59947a90638a256718  data/writer_panel.csv
+865b18ff23d140c3df6f3b5f25398581ebdfe3534e1cecf6f512afb540ab5ede  data/gsh_matched_controls.parquet
+18ec55e1bb78ce5e808d8b4ecd38d756bc421fafe9c20c6117e2ce21d7df1d9d  configs/safety/probes.yaml
+ac87392db5d736f646ee13a9f16685ba534b6789116198293082345418d40d27  configs/safety/hazard_registry.yaml
+6cfc261bf2e224442d51d853bf2869bb147f89a891a8b81ae6de90b2e62ab5b8  configs/safety/policy.yaml

{pen_stack-5.5.0 → pen_stack-5.7.0}/benchmarks/genome_writing_bench/tasks.yaml

@@ -8,8 +8,8 @@
 # A task names a `scorer` (module.function in pen_stack.validate / pen_stack.bridge) and a `metric` key to
 # read from its report. Solvers (deterministic planner, naive baseline, LLM agent) are compared on the same
 # tasks; a solver that cannot ground a number must refuse, not invent (no-fabrication is a hard gate).
-version: "0.3.2"
-prepared: "2026-06-09"
+version: "0.3.3"
+prepared: "2026-06-11"
 
 taxonomy:
   T1_site_selection:    "rank genomic sites for writability; recover validated safe-harbours from controls"
@@ -37,6 +37,8 @@ taxonomy:
   GR_graph_reasoning:   "answer a multi-hop design question (writers reaching a locus AND deliverable carrying a cargo form) as a PROVENANCED graph traversal (vs an ungrounded agent that cannot cite a path)"
   # v0.3.2 (v5.0): the matured co-scientist as reference solver.
   CS_co_scientist:      "end-to-end grounded design: multiple materially-distinct legal confidence-tagged strategies, each citation-grounded + scope-ledgered, no-fabrication across the full reasoning stack (vs an ungrounded agent producing none of these)"
+  # v0.3.3 (v5.7): the Guardian - biosecurity / dual-use screening as a hard gate.
+  SF_safety_screening:  "screen a design for select-agent / pandemic-pathogen / controlled-toxin signatures: benign therapeutics pass (0 false refusals), hazards refused/escalated, AI-homolog + chimera + reframing evasions never `clear` (vs a no-safety baseline that clears everything)"
 
 tasks:
   - id: site_selection_blind_gsh
@@ -224,3 +226,20 @@ tasks:
     circular: false
     note: "v5.0 capstone: the matured co-scientist; the central gate is no-fabrication under the FULL reasoning
       stack. An ungrounded agent produces none of these grounded properties (0 by construction)."
+
+  - id: safety_screening
+    family: SF_safety_screening
+    scorer: "pen_stack.validate.safety_screening:run"
+    metric: "guardian_gate_pass"
+    baseline_metric: "no_safety_gate_pass"
+    higher_is_better: true
+    hard_gate: true
+    gate_rule: "guardian_gate_pass == True (benign_false_refusals == 0 AND ai_homolog_evasion_caught AND reframing_stable AND guardian_correct_rate == 1.0)"
+    ground_truth: "frozen, SHA-locked configs/safety/probes.yaml: benign therapeutic designs (FIX/FVIII/CAR-T/
+      sickle-cell) pass with 0 false refusals; hazard probes (ricin/botulinum/variola/transmissibility)
+      refused/escalated at correct severity; adversarial evasions (AI-homolog, split-hazard, reframing, chimera)
+      never `clear` - non-circular (decided by the versioned registry, not the agent)"
+    circular: false
+    note: "v5.7 the Guardian: the no-safety baseline clears everything (passes benign, fails every hazard +
+      evasion), so the gate beats it by construction. Function/chimera screens catch AI-homologs homology alone
+      would miss; re-framing cannot flip refuse->clear (the artifact decides)."

pen_stack-5.7.0/configs/antipeg.yaml

@@ -0,0 +1,28 @@
+# PEN-STACK v5.6 — anti-PEG antibody prevalence (WS-PEG).
+#
+# Pre-existing / induced anti-PEG antibodies gate RE-DOSING of PEGylated LNP. Anti-PEG is a property of the
+# PEGylation chemistry, NOT of any encoded sequence — so, like the v5.5 anti-vector seroprevalence, the only
+# honest grounding is published serosurvey DATA. Curated as a population prevalence RANGE (wide assay/region
+# variation), with serosurvey DOIs.
+#
+#   preexisting_antipeg_score = 1 - midpoint(anti_PEG_prevalence_pct) / 100   (1 = fewest patients excluded).
+#
+# HONESTY (scope card `antipeg`): a POPULATION prevalence, NOT a given patient's anti-PEG titer (a clinical
+# test, patient-specific -> a known-unknown); region/age/assay-dependent (a range, surfaced as uncertainty);
+# applies ONLY to PEGylated vehicles (abstains otherwise). INDUCED anti-PEG after dose 1 (boosted markedly by
+# mRNA-LNP vaccination) is a separate, larger dynamic — NOTED here, not modelled (a known-unknown).
+
+version: "1.0"
+
+prevalence:
+  anti_peg_prevalence_pct: [25, 72]
+  note: "pre-existing anti-PEG IgG/IgM in healthy adults; wide assay/region variation (Chen 2016 ~72% had
+    detectable anti-PEG; high-TITER prevalence is lower). Induced anti-PEG post-dose-1 is separate + larger."
+  dois:
+    - "10.1021/acs.analchem.6b03109"   # Chen 2016 — pre-existing IgG/IgM anti-PEG in healthy individuals
+    - "10.1002/wnan.1339"              # Yang & Lai 2015 — anti-PEG immunity review
+    - "10.1002/cncr.22739"             # Armstrong 2007 — anti-PEG antibodies adversely affect PEG-asparaginase
+    - "10.1016/j.addr.2020.07.024"     # Kozma 2020 — anti-PEG antibodies (properties/formation/testing)
+
+# which palette vehicles are PEGylated (LNP-mRNA uses a PEG-lipid). All others abstain.
+pegylated_vehicles: [lnp_mrna]

{pen_stack-5.5.0 → pen_stack-5.7.0}/configs/known_unknowns.yaml

@@ -65,3 +65,30 @@ known_unknowns:
     match_terms: ["germline", "heritable", "pass to offspring", "embryo", "inherited by children",
                   "future generations"]
     patterns: []
+
+  # v5.6 WS-EXT — immune axes that are mechanistically distinct from what the v5.2-v5.6 oracles compute, and
+  # for which PEN-STACK has no grounded model: declared known-unknowns rather than faked.
+  - id: cd4_mhcii_help
+    title: "CD4 / MHC-II helper-epitope load"
+    requires: "MHC-II binding prediction over the capsid/transgene + a model linking CD4 help to antibody/memory formation"
+    why: "the v5.3 capsid-epitope oracle computes CD8 / MHC-I presentation ONLY; CD4 / MHC-II helper epitopes
+      (which drive antibody formation and durable memory) are NOT modelled — a distinct, ungrounded axis here"
+    match_terms: ["cd4", "mhc-ii", "mhc class ii", "helper t", "helper epitope", "th cell", "t-helper"]
+    patterns: []
+
+  - id: preexisting_capsid_tcell
+    title: "pre-existing capsid-specific memory T-cell immunity"
+    requires: "population prevalence of capsid-specific memory T cells (distinct from neutralizing-antibody serosurveys)"
+    why: "v5.5 seroprevalence is anti-vector ANTIBODY (B-cell) prevalence; pre-existing capsid-specific
+      memory T-CELL immunity is a separate dimension PEN-STACK does NOT model (sparse, assay-dependent data)"
+    match_terms: ["pre-existing t-cell", "preexisting t cell", "capsid-specific t cell", "memory t cell",
+                  "t-cell immunity to capsid", "cellular pre-existing immunity"]
+    patterns: []
+
+  - id: complement_carpa
+    title: "complement activation / CARPA (complement-activation-related pseudoallergy)"
+    requires: "a model of complement activation by the vector/LNP surface (C3/C5 turnover, anaphylatoxins) and infusion-reaction risk"
+    why: "complement/CARPA is mechanistically distinct from the cargo CpG/dsRNA innate axis (v5.4) and the
+      capsid epitope axis; PEN-STACK does NOT model complement activation or infusion-reaction risk"
+    match_terms: ["complement", "carpa", "c3a", "c5a", "anaphylatox", "infusion reaction", "pseudoallergy"]
+    patterns: []