pen-stack 5.7.0__tar.gz → 5.9.0__tar.gz

{pen_stack-5.7.0 → pen_stack-5.9.0}/CHANGELOG.md

@@ -3,6 +3,75 @@
 All notable changes to PEN-STACK are documented here. This file follows
 [Keep a Changelog](https://keepachangelog.com/) and the program's phase structure.
 
+## [5.9.0] - 2026-06-11 - v5.9 release: The Digital Twin (calibrated outcome prediction)
+
+**Closed-Loop arc, Cycle 3 of 7.** The missing layer: *what does the cell do after the write?* — predicted with
+calibrated honesty. The twin computes what mechanism allows, adds an in-distribution virtual-cell estimate
+(OOD-gated), screens immune outcome from the v5.6 profile, and is explicit about its boundary at phenotype.
+Workstreams WS-{VCELL,MECH,OUTCOME,CAL}, SHA-locked.
+
+### Added
+- **WS-VCELL** — `pen_stack/oracles/vcell.py` + scope cards `state`/`scgpt`: `predict_response(cell_state,
+  perturbation, model)` wraps **Arc STATE** / **scGPT** under the v4.0 `OracleResult` contract. A
+  perturbation-response prediction is a **candidate**, OOD-gated (a context outside the documented envelope →
+  `extrapolating`), cached/deferred (value `None` when absent — never fabricated). Encodes the field's own result
+  (Arc Virtual Cell Challenge): perturbation models don't yet consistently beat naive baselines.
+- **WS-MECH** — `pen_stack/twin/mechanistic.py`: `cassette_expression` = `promoter_strength × copy_number ×
+  accessibility` (closed-form steady state); assumptions + scope flags attached; **physics where computable, NOT
+  a phenotype**.
+- **WS-OUTCOME** — `pen_stack/twin/outcome.py`: `predict_outcome(design, cell_state)` fuses mechanism +
+  in-distribution virtual-cell response + the v5.6 immune profile into one prediction with an interval that
+  **widens under OOD**, an immune-outcome dimension, and an explicit **phenotype / in-vivo-magnitude boundary**.
+  In-vivo durability may be **conditioned on the grounded pre-existing-NAb axis** (no invented immune numbers);
+  `output_kind="candidate"`.
+- **WS-CAL** — `pen_stack/twin/calibrate.py`: `calibrate_outcome(...)` reports calibration **two-sided** — interval
+  coverage + a bootstrap CI on the MAE gap vs a naive mean baseline; the twin "beats" naive **only when the CI
+  excludes zero**, else the negative is reported verbatim; abstains at `N < 3`.
+- **WS-BENCH** — bench **v0.3.5**: new `outcome_prediction` hard-gate task (`pen_stack/validate/outcome_prediction.py`)
+  — the gate is the twin's **honesty properties** (two-sided calibration + OOD widening + immune dimension +
+  phenotype out-of-scope), which an overconfident predictor fails by construction; twin-vs-naive skill is reported
+  informationally on a labelled synthetic stream (no public perturbation-outcome calibration set exists).
+- Docs: `docs/digital_twin.md`; prereg `ws_{vcell,mech,outcome,twincal}` + SHA locks; deposit `phase_5.9/`.
+
+### Notes
+- The twin is a **hypothesis engine, not an oracle of truth**: predictions are candidates with intervals;
+  phenotype, in-vivo behaviour, immunogenicity *magnitude*, and durability beyond the computable stay
+  scope-flagged. The interval is a heuristic band, **not** a trained conformal interval (no public outcome
+  calibration set). Immune-outcome is sourced from v5.6, never invented.
+
+## [5.8.0] - 2026-06-11 - v5.8 release: The Live Agent & Generative Designer
+
+**Closed-Loop arc, Cycle 2 of 7.** PEN-STACK turns from a *checker* into a grounded *designer*: it generates
+candidate end-to-end writing systems, keeps only those that pass safety + legality + calibration
+(verifier-as-discriminator), and returns the **Pareto frontier** of real tradeoffs — in which immunogenicity-risk
+is, for the first time, a **grounded** axis sourced from the v5.6 profile rather than a placeholder. Workstreams
+WS-{ORCH,GEN,PARETO,BENCH}, SHA-locked.
+
+### Added
+- **WS-GEN** — `pen_stack/design/{space,generate}.py`: `generate_designs(goal|candidates)` PROPOSES candidates
+  (`candidate_space` = the validated Phase-3 planner × the compatible delivery palette) and the v3.3 `verify()`
+  — now **safety-gated (v5.7)** + legality + calibration + immune-profiled — DISPOSES. A candidate survives only
+  if **legal AND safe** (`clear`/`flag`); hazardous (`refuse`/`escalate`) and illegal proposals are **discarded,
+  never returned** (the `as_claim()` guard generalised to whole designs). Survivors carry calibrated confidence,
+  the v5.6 immune profile, the safety decision, and `output_kind="candidate"` — never asserted to work.
+- **WS-PARETO** — `pen_stack/design/pareto.py`: `pareto_front(designs)` over `(efficiency, durability, safety,
+  deliverability, neg_immune_risk, neg_cost)`. **`neg_immune_risk` is grounded by the v5.6 profile** — the
+  worst-case per-axis in-scope score with the per-axis uncertainty carried as a band; the profile is never
+  collapsed into one number and the in-vivo magnitude stays scope-flagged (`in_vivo_magnitude_unknown`).
+- **WS-ORCH** — `pen_stack/agent/orchestrator_live.py`: `orchestrate(goal)` — plan → generate → call an oracle
+  (cache-first/replayable) for a critique signal → dispose via `verify()` → refine. Every number is tool-sourced;
+  a seed-locked replay reproduces the trace (replay is the CI default); no fabrication.
+- **WS-BENCH** — bench **v0.3.4**: new `generative_design` hard-gate task (`pen_stack/validate/generative_design.py`)
+  — on a frozen mixed pool (benign + hazardous ricin payload + illegal oversize/mRNA-incompatible), the grounded
+  designer returns only legal+safe+calibrated+immune-profiled survivors on a grounded-immune-axis Pareto frontier,
+  while an ungrounded generator ships hazardous/illegal designs and fails by construction.
+- Docs: `docs/generative_design.md`; prereg `ws_{gen,pareto,orch}` + SHA locks; deposit `phase_5.8/`.
+
+### Notes
+- A generated output is a **candidate, never a claim**; novelty is bounded by the oracles' validity and the
+  rules' legality, and never asserted to work. The immune-risk Pareto axis is a worst-case **screen** — the
+  per-axis v5.6 profile (with its validation labels) remains authoritative; in-vivo magnitude is a known-unknown.
+
 ## [5.7.0] - 2026-06-11 - v5.7 release: The Guardian (biosecurity / dual-use safety gate)
 
 Opens the **Closed-Loop arc (Cycle 1 of 7)**. Before PEN-STACK moves toward "build", it is made **safe by

{pen_stack-5.7.0 → pen_stack-5.9.0}/CITATION.cff

@@ -1,7 +1,7 @@
 cff-version: 1.2.0
 message: "If you use PEN-STACK, please cite it as below."
 title: "PEN-STACK: open infrastructure for genome writing"
-version: 5.7.0
+version: 5.9.0
 date-released: 2026-06-11
 authors:
   - family-names: "Mahaboob Ali"

{pen_stack-5.7.0 → pen_stack-5.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pen-stack
-Version: 5.7.0
+Version: 5.9.0
 Summary: Open infrastructure for genome writing: the Writable Genome atlas, the Writer Atlas, and the Write Planner.
 Author-email: Anees Ahmed Mahaboob Ali <ahmedaneesm@gmail.com>
 License: MIT
@@ -90,12 +90,12 @@ every design against rule-grounded mechanism, reports calibrated confidence, cit
 [![codecov](https://codecov.io/gh/ahmedanees-m/pen-stack/branch/main/graph/badge.svg)](https://codecov.io/gh/ahmedanees-m/pen-stack)
 [![License: MIT](https://img.shields.io/badge/License-MIT-informational.svg)](LICENSE)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/)
-[![Version](https://img.shields.io/badge/version-5.7.0-blue.svg)](CHANGELOG.md)
-[![Tests](https://img.shields.io/badge/tests-307%20passing-success.svg)](tests/)
+[![Version](https://img.shields.io/badge/version-5.9.0-blue.svg)](CHANGELOG.md)
+[![Tests](https://img.shields.io/badge/tests-324%20passing-success.svg)](tests/)
 [![Lint: ruff](https://img.shields.io/badge/lint-ruff-purple.svg)](https://github.com/astral-sh/ruff)
 [![Runtime: Docker](https://img.shields.io/badge/runtime-docker-2496ED.svg)](docker/)
 [![Validation: pre-registered](https://img.shields.io/badge/validation-pre--registered-critical.svg)](prereg/)
-[![Genome-Writing Bench v0.3](https://img.shields.io/badge/benchmark-Genome--Writing%20Bench%20v0.3.3-6f42c1.svg)](benchmarks/genome_writing_bench/)
+[![Genome-Writing Bench v0.3](https://img.shields.io/badge/benchmark-Genome--Writing%20Bench%20v0.3.5-6f42c1.svg)](benchmarks/genome_writing_bench/)
 
 **Built on five prior, separately published repositories:**
 
@@ -134,6 +134,42 @@ Two questions gate every genome-writing project, and before PEN-STACK no resourc
 Everything is built on bulk-downloadable public data, runs on a single GPU, and is validated **blind** against
 a pre-registered, honest baseline before release.
 
+## What is new in v5.9 — The Digital Twin (calibrated outcome prediction)
+
+v5.9 (**Closed-Loop arc, Cycle 3 of 7**) adds the missing layer — *what does the cell do after the write?* —
+predicted with calibrated honesty. The twin computes what mechanism allows, adds an in-distribution virtual-cell
+estimate (OOD-gated), screens immune outcome from the v5.6 profile, and is explicit about its boundary at
+phenotype. A **hypothesis engine, not an oracle of truth**.
+
+| Workstream | What it adds | Result |
+|---|---|---|
+| **VCELL** | `oracles/vcell.py` + scope cards `state`/`scgpt` | Arc STATE / scGPT under the OracleResult contract; perturbation prediction is a **candidate**, **OOD-gated**, deferred value never fabricated |
+| **MECH** | `twin/mechanistic.py` | `cassette_expression` = promoter × copy × accessibility (closed form); **physics where computable, NOT a phenotype** |
+| **OUTCOME** | `twin/outcome.py` | fuses mechanism + in-dist VC + v5.6 immune; interval **widens under OOD**; in-vivo durability conditioned on the **grounded NAb axis**; phenotype/in-vivo-magnitude scope-flagged |
+| **CAL** | `twin/calibrate.py` | calibration reported **two-sided** (coverage + MAE-gap-vs-naive bootstrap CI); beats naive **only if CI excludes 0**, else the negative is reported |
+| **BENCH** | bench **v0.3.5** `outcome_prediction` hard gate | gate = the twin's honesty properties (two-sided cal + OOD widening + immune dim + phenotype out-of-scope); an overconfident predictor fails by construction |
+
+The interval is a **heuristic band, not a trained conformal interval** (no public perturbation-outcome calibration
+set; Arc's Virtual Cell Challenge shows models don't yet consistently beat naive baselines). See
+[`docs/digital_twin.md`](docs/digital_twin.md) and `prereg/ws_{vcell,mech,outcome,twincal}.yaml`.
+
+## What is new in v5.8 — The Live Agent & Generative Designer
+
+v5.8 (**Closed-Loop arc, Cycle 2 of 7**) turns PEN-STACK from a *checker* into a grounded *designer*: it
+**generates** candidate end-to-end writing systems, keeps only those that pass safety + legality + calibration
+(**verifier-as-discriminator**), and returns the **Pareto frontier** of real tradeoffs — with immunogenicity-risk
+now a **grounded** axis sourced from the v5.6 profile, not a placeholder.
+
+| Workstream | What it adds | Result |
+|---|---|---|
+| **GEN** | `design/{space,generate}.py` | generate → `verify()` discriminates; **hazardous + illegal candidates discarded, never returned**; survivors are calibrated, immune-profiled, `output_kind="candidate"` |
+| **PARETO** | `design/pareto.py` | non-dominated frontier over efficiency/durability/safety/deliverability/**neg_immune_risk**/neg_cost; immune axis = worst-case per-axis from v5.6 (uncertainty band carried, in-vivo magnitude flagged) |
+| **ORCH** | `agent/orchestrator_live.py` | plan → generate → oracle critique (cache-first) → `verify()` → refine; every number tool-sourced; **seed-locked replay reproduces the trace** |
+| **BENCH** | bench **v0.3.4** `generative_design` hard gate | grounded designer keeps only legal+safe+calibrated+immune survivors on a grounded-immune Pareto frontier; an ungrounded generator ships hazardous/illegal designs and fails by construction |
+
+A generated output is a **candidate, never a claim**; novelty is bounded by the oracles' validity and the rules'
+legality. See [`docs/generative_design.md`](docs/generative_design.md) and `prereg/ws_{gen,pareto,orch}.yaml`.
+
 ## What is new in v5.7 — The Guardian (biosecurity / dual-use safety gate)
 
 v5.7 opens the **Closed-Loop arc (Cycle 1 of 7)** by making PEN-STACK **safe by construction**: every design
@@ -579,13 +615,15 @@ pen-stack/
 │   │                                   + v5.6 immune_profile (unified per-axis immune-risk vector; never collapsed)
 │   ├── bridge/                       bridge off-target engine (Paper 4): offtarget / fold_qc / guide_qc / pipeline / cli
 │   │                                   + v3.2 offtarget_energetics (position x substitution; held-out 0.88, ships)
-│   ├── agent/                        agentic platform: tools / orchestrator / pen_agent / mcp_server / guardrails; v5.0 co_scientist + cite (multi-strategy, self-critique, cited rationale, scope ledger)
+│   ├── agent/                        agentic platform: tools / orchestrator / pen_agent / mcp_server / guardrails; v5.0 co_scientist + cite (multi-strategy, self-critique, cited rationale, scope ledger); v5.8 orchestrator_live (live, cache-replayable, generate→oracle→verify→refine)
 │   │                                   + v3.2 epistemic (3-tier status) / scope (known-unknowns matcher)
 │   ├── graph/                        v4.5 living world-model knowledge graph (schema/build/query/ingest/cell_types); typed provenanced edges; gated living loop (propose-only)
-│   ├── oracles/                      v4.0 L1 oracle mesh: OracleResult contract + adapters (genome/structure/protein_design/rna/energetics) over the foundation models; version-pinned cache; v5.2-5.6 delivery-immunology scope cards (delivery_genotoxicity/capsid_epitope/innate_sensing/seroprevalence/antipeg)
+│   ├── oracles/                      v4.0 L1 oracle mesh: OracleResult contract + adapters (genome/structure/protein_design/rna/energetics) over the foundation models; version-pinned cache; v5.2-5.6 delivery-immunology scope cards (delivery_genotoxicity/capsid_epitope/innate_sensing/seroprevalence/antipeg); v5.9 vcell (Arc STATE/scGPT, OOD-gated, output_kind=candidate)
 │   ├── rules/                        v3.3 machine-readable rules engine (schema/evaluators/loader/solver) over configs/rules/*.yaml
 │   ├── verify/                       v3.3 verification service: verify(design) -> Verdict (legal+reasons+confidence+scope; v4.0 writer_critique; v5.1 delivery_profile; v5.6 immune_profile per-axis vector; v5.7 safety SafetyVerdict)
 │   ├── safety/                       v5.7 the Guardian: biosecurity/dual-use gate (registry/screen/policy/gate/audit/redteam); runs first in verify(); refuse short-circuits; tamper-evident audit
+│   ├── design/                       v5.8 generative designer: space (candidate_space) / generate (verifier-as-discriminator; hazardous+illegal discarded) / pareto (frontier w/ grounded v5.6 immune axis)
+│   ├── twin/                         v5.9 digital twin: mechanistic (cassette expression, closed-form) / outcome (fuse mech+vcell+v5.6 immune; OOD widens interval; phenotype-bounded) / calibrate (honest two-sided)
 │   ├── adapt/                        local recalibration / private-data adaptation behind a gate (v3.1, WS-F)
 │   ├── env/                          v3.4 full Gymnasium environment over router+verifier (genome_writing_env + policies; [env] extra)
 │   ├── monitor/                      PEN-MONITOR living database (Europe PMC)
@@ -596,12 +634,14 @@ pen-stack/
 │   │                                   out_of_scope_refusal / target_site_controls / offtarget_energetics_eval /
 │   │                                   v3.3 bench_rule_tasks (T12) / v3.4 bench_writetype_tasks + bench_adversarial_tasks (T13-16) + outcome_calibration /
 │   │                                   v5.6 immune_calibration (proxy-vs-observed; labels each axis validated-or-proxy, two-sided) /
-│   │                                   v5.7 safety_screening (the Guardian hard-gate: benign 0-false-refusal · hazards refused/escalated · evasions never clear)
+│   │                                   v5.7 safety_screening (the Guardian hard-gate: benign 0-false-refusal · hazards refused/escalated · evasions never clear) /
+│   │                                   v5.8 generative_design (verifier-as-discriminator hard-gate: hazardous+illegal discarded; survivors calibrated+immune; grounded-immune Pareto) /
+│   │                                   v5.9 outcome_prediction (digital-twin hard-gate: two-sided calibration + OOD widening + immune dim + phenotype out-of-scope)
 │   ├── data/                         ingestion (genome, chromatin, integration, TRIP, safety annotations)
 │   ├── server/api.py                 FastAPI REST (atlas, crosslink, writable, plan, bridge, ask)
 │   ├── ui/app.py                     Streamlit web app (16 pages; v3.2 PEN-Agent shows confidence + epistemic status)
 │   └── cli.py                        unified CLI
-├── benchmarks/genome_writing_bench/  Genome-Writing Bench v0.3.3 (T1-T16 + co_scientist + safety_screening; tasks / harness / solvers / LEADERBOARD / SHAs)
+├── benchmarks/genome_writing_bench/  Genome-Writing Bench v0.3.5 (T1-T16 + co_scientist + safety_screening + generative_design + outcome_prediction; tasks / harness / solvers / LEADERBOARD / SHAs)
 ├── bench/run.py                      one-command bench entrypoint (--agent, --verify)
 ├── scripts/                          reproducible pipeline drivers (p1_*, p2_*, p4_*, p52/p53 delivery-immunology oracle builds, ws_*_report)
 ├── configs/                          pinned datasets + thresholds + curation (YAML); v3.2 known_unknowns /
@@ -610,9 +650,10 @@ pen-stack/
 │                                       seroprevalence / antipeg + oracles/scope_cards (+ v5.6 known_unknowns:
 │                                       cd4_mhcii_help / preexisting_capsid_tcell / complement_carpa);
 │                                       v5.7 safety/{hazard_registry,policy,probes} (Guardian; function/family/taxon-level only)
-├── prereg/                           SHA-locked success criteria (paper1..4 + ws_a..ws_h + v3.2-v5.7 ws_{uq,ep,mc,ba,
+├── prereg/                           SHA-locked success criteria (paper1..4 + ws_a..ws_h + v3.2-v5.9 ws_{uq,ep,mc,ba,
 │                                       r,v,route,env,bench,cal,o,wv,atlas,graph,mon,ct,plan,crit,cite,immune,
-│                                       genotox,epitope,innate,seroprev,peg,calib,profile,screen,policy,redteam} + SHA256 locks)
+│                                       genotox,epitope,innate,seroprev,peg,calib,profile,screen,policy,redteam,
+│                                       gen,pareto,orch,vcell,mech,outcome,twincal} + SHA256 locks)
 ├── data/curated/                     small committed tables (universe, gene coords, measured bridge profile,
 │                                       v3.2 bridge_offtarget_energetics.json)
 ├── data/llm_bench_cache/             28 cached ungrounded-LLM transcripts (T7, offline/CI replay)

{pen_stack-5.7.0 → pen_stack-5.9.0}/README.md

@@ -15,12 +15,12 @@ every design against rule-grounded mechanism, reports calibrated confidence, cit
 [![codecov](https://codecov.io/gh/ahmedanees-m/pen-stack/branch/main/graph/badge.svg)](https://codecov.io/gh/ahmedanees-m/pen-stack)
 [![License: MIT](https://img.shields.io/badge/License-MIT-informational.svg)](LICENSE)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/)
-[![Version](https://img.shields.io/badge/version-5.7.0-blue.svg)](CHANGELOG.md)
-[![Tests](https://img.shields.io/badge/tests-307%20passing-success.svg)](tests/)
+[![Version](https://img.shields.io/badge/version-5.9.0-blue.svg)](CHANGELOG.md)
+[![Tests](https://img.shields.io/badge/tests-324%20passing-success.svg)](tests/)
 [![Lint: ruff](https://img.shields.io/badge/lint-ruff-purple.svg)](https://github.com/astral-sh/ruff)
 [![Runtime: Docker](https://img.shields.io/badge/runtime-docker-2496ED.svg)](docker/)
 [![Validation: pre-registered](https://img.shields.io/badge/validation-pre--registered-critical.svg)](prereg/)
-[![Genome-Writing Bench v0.3](https://img.shields.io/badge/benchmark-Genome--Writing%20Bench%20v0.3.3-6f42c1.svg)](benchmarks/genome_writing_bench/)
+[![Genome-Writing Bench v0.3](https://img.shields.io/badge/benchmark-Genome--Writing%20Bench%20v0.3.5-6f42c1.svg)](benchmarks/genome_writing_bench/)
 
 **Built on five prior, separately published repositories:**
 
@@ -59,6 +59,42 @@ Two questions gate every genome-writing project, and before PEN-STACK no resourc
 Everything is built on bulk-downloadable public data, runs on a single GPU, and is validated **blind** against
 a pre-registered, honest baseline before release.
 
+## What is new in v5.9 — The Digital Twin (calibrated outcome prediction)
+
+v5.9 (**Closed-Loop arc, Cycle 3 of 7**) adds the missing layer — *what does the cell do after the write?* —
+predicted with calibrated honesty. The twin computes what mechanism allows, adds an in-distribution virtual-cell
+estimate (OOD-gated), screens immune outcome from the v5.6 profile, and is explicit about its boundary at
+phenotype. A **hypothesis engine, not an oracle of truth**.
+
+| Workstream | What it adds | Result |
+|---|---|---|
+| **VCELL** | `oracles/vcell.py` + scope cards `state`/`scgpt` | Arc STATE / scGPT under the OracleResult contract; perturbation prediction is a **candidate**, **OOD-gated**, deferred value never fabricated |
+| **MECH** | `twin/mechanistic.py` | `cassette_expression` = promoter × copy × accessibility (closed form); **physics where computable, NOT a phenotype** |
+| **OUTCOME** | `twin/outcome.py` | fuses mechanism + in-dist VC + v5.6 immune; interval **widens under OOD**; in-vivo durability conditioned on the **grounded NAb axis**; phenotype/in-vivo-magnitude scope-flagged |
+| **CAL** | `twin/calibrate.py` | calibration reported **two-sided** (coverage + MAE-gap-vs-naive bootstrap CI); beats naive **only if CI excludes 0**, else the negative is reported |
+| **BENCH** | bench **v0.3.5** `outcome_prediction` hard gate | gate = the twin's honesty properties (two-sided cal + OOD widening + immune dim + phenotype out-of-scope); an overconfident predictor fails by construction |
+
+The interval is a **heuristic band, not a trained conformal interval** (no public perturbation-outcome calibration
+set; Arc's Virtual Cell Challenge shows models don't yet consistently beat naive baselines). See
+[`docs/digital_twin.md`](docs/digital_twin.md) and `prereg/ws_{vcell,mech,outcome,twincal}.yaml`.
+
+## What is new in v5.8 — The Live Agent & Generative Designer
+
+v5.8 (**Closed-Loop arc, Cycle 2 of 7**) turns PEN-STACK from a *checker* into a grounded *designer*: it
+**generates** candidate end-to-end writing systems, keeps only those that pass safety + legality + calibration
+(**verifier-as-discriminator**), and returns the **Pareto frontier** of real tradeoffs — with immunogenicity-risk
+now a **grounded** axis sourced from the v5.6 profile, not a placeholder.
+
+| Workstream | What it adds | Result |
+|---|---|---|
+| **GEN** | `design/{space,generate}.py` | generate → `verify()` discriminates; **hazardous + illegal candidates discarded, never returned**; survivors are calibrated, immune-profiled, `output_kind="candidate"` |
+| **PARETO** | `design/pareto.py` | non-dominated frontier over efficiency/durability/safety/deliverability/**neg_immune_risk**/neg_cost; immune axis = worst-case per-axis from v5.6 (uncertainty band carried, in-vivo magnitude flagged) |
+| **ORCH** | `agent/orchestrator_live.py` | plan → generate → oracle critique (cache-first) → `verify()` → refine; every number tool-sourced; **seed-locked replay reproduces the trace** |
+| **BENCH** | bench **v0.3.4** `generative_design` hard gate | grounded designer keeps only legal+safe+calibrated+immune survivors on a grounded-immune Pareto frontier; an ungrounded generator ships hazardous/illegal designs and fails by construction |
+
+A generated output is a **candidate, never a claim**; novelty is bounded by the oracles' validity and the rules'
+legality. See [`docs/generative_design.md`](docs/generative_design.md) and `prereg/ws_{gen,pareto,orch}.yaml`.
+
 ## What is new in v5.7 — The Guardian (biosecurity / dual-use safety gate)
 
 v5.7 opens the **Closed-Loop arc (Cycle 1 of 7)** by making PEN-STACK **safe by construction**: every design
@@ -504,13 +540,15 @@ pen-stack/
 │   │                                   + v5.6 immune_profile (unified per-axis immune-risk vector; never collapsed)
 │   ├── bridge/                       bridge off-target engine (Paper 4): offtarget / fold_qc / guide_qc / pipeline / cli
 │   │                                   + v3.2 offtarget_energetics (position x substitution; held-out 0.88, ships)
-│   ├── agent/                        agentic platform: tools / orchestrator / pen_agent / mcp_server / guardrails; v5.0 co_scientist + cite (multi-strategy, self-critique, cited rationale, scope ledger)
+│   ├── agent/                        agentic platform: tools / orchestrator / pen_agent / mcp_server / guardrails; v5.0 co_scientist + cite (multi-strategy, self-critique, cited rationale, scope ledger); v5.8 orchestrator_live (live, cache-replayable, generate→oracle→verify→refine)
 │   │                                   + v3.2 epistemic (3-tier status) / scope (known-unknowns matcher)
 │   ├── graph/                        v4.5 living world-model knowledge graph (schema/build/query/ingest/cell_types); typed provenanced edges; gated living loop (propose-only)
-│   ├── oracles/                      v4.0 L1 oracle mesh: OracleResult contract + adapters (genome/structure/protein_design/rna/energetics) over the foundation models; version-pinned cache; v5.2-5.6 delivery-immunology scope cards (delivery_genotoxicity/capsid_epitope/innate_sensing/seroprevalence/antipeg)
+│   ├── oracles/                      v4.0 L1 oracle mesh: OracleResult contract + adapters (genome/structure/protein_design/rna/energetics) over the foundation models; version-pinned cache; v5.2-5.6 delivery-immunology scope cards (delivery_genotoxicity/capsid_epitope/innate_sensing/seroprevalence/antipeg); v5.9 vcell (Arc STATE/scGPT, OOD-gated, output_kind=candidate)
 │   ├── rules/                        v3.3 machine-readable rules engine (schema/evaluators/loader/solver) over configs/rules/*.yaml
 │   ├── verify/                       v3.3 verification service: verify(design) -> Verdict (legal+reasons+confidence+scope; v4.0 writer_critique; v5.1 delivery_profile; v5.6 immune_profile per-axis vector; v5.7 safety SafetyVerdict)
 │   ├── safety/                       v5.7 the Guardian: biosecurity/dual-use gate (registry/screen/policy/gate/audit/redteam); runs first in verify(); refuse short-circuits; tamper-evident audit
+│   ├── design/                       v5.8 generative designer: space (candidate_space) / generate (verifier-as-discriminator; hazardous+illegal discarded) / pareto (frontier w/ grounded v5.6 immune axis)
+│   ├── twin/                         v5.9 digital twin: mechanistic (cassette expression, closed-form) / outcome (fuse mech+vcell+v5.6 immune; OOD widens interval; phenotype-bounded) / calibrate (honest two-sided)
 │   ├── adapt/                        local recalibration / private-data adaptation behind a gate (v3.1, WS-F)
 │   ├── env/                          v3.4 full Gymnasium environment over router+verifier (genome_writing_env + policies; [env] extra)
 │   ├── monitor/                      PEN-MONITOR living database (Europe PMC)
@@ -521,12 +559,14 @@ pen-stack/
 │   │                                   out_of_scope_refusal / target_site_controls / offtarget_energetics_eval /
 │   │                                   v3.3 bench_rule_tasks (T12) / v3.4 bench_writetype_tasks + bench_adversarial_tasks (T13-16) + outcome_calibration /
 │   │                                   v5.6 immune_calibration (proxy-vs-observed; labels each axis validated-or-proxy, two-sided) /
-│   │                                   v5.7 safety_screening (the Guardian hard-gate: benign 0-false-refusal · hazards refused/escalated · evasions never clear)
+│   │                                   v5.7 safety_screening (the Guardian hard-gate: benign 0-false-refusal · hazards refused/escalated · evasions never clear) /
+│   │                                   v5.8 generative_design (verifier-as-discriminator hard-gate: hazardous+illegal discarded; survivors calibrated+immune; grounded-immune Pareto) /
+│   │                                   v5.9 outcome_prediction (digital-twin hard-gate: two-sided calibration + OOD widening + immune dim + phenotype out-of-scope)
 │   ├── data/                         ingestion (genome, chromatin, integration, TRIP, safety annotations)
 │   ├── server/api.py                 FastAPI REST (atlas, crosslink, writable, plan, bridge, ask)
 │   ├── ui/app.py                     Streamlit web app (16 pages; v3.2 PEN-Agent shows confidence + epistemic status)
 │   └── cli.py                        unified CLI
-├── benchmarks/genome_writing_bench/  Genome-Writing Bench v0.3.3 (T1-T16 + co_scientist + safety_screening; tasks / harness / solvers / LEADERBOARD / SHAs)
+├── benchmarks/genome_writing_bench/  Genome-Writing Bench v0.3.5 (T1-T16 + co_scientist + safety_screening + generative_design + outcome_prediction; tasks / harness / solvers / LEADERBOARD / SHAs)
 ├── bench/run.py                      one-command bench entrypoint (--agent, --verify)
 ├── scripts/                          reproducible pipeline drivers (p1_*, p2_*, p4_*, p52/p53 delivery-immunology oracle builds, ws_*_report)
 ├── configs/                          pinned datasets + thresholds + curation (YAML); v3.2 known_unknowns /
@@ -535,9 +575,10 @@ pen-stack/
 │                                       seroprevalence / antipeg + oracles/scope_cards (+ v5.6 known_unknowns:
 │                                       cd4_mhcii_help / preexisting_capsid_tcell / complement_carpa);
 │                                       v5.7 safety/{hazard_registry,policy,probes} (Guardian; function/family/taxon-level only)
-├── prereg/                           SHA-locked success criteria (paper1..4 + ws_a..ws_h + v3.2-v5.7 ws_{uq,ep,mc,ba,
+├── prereg/                           SHA-locked success criteria (paper1..4 + ws_a..ws_h + v3.2-v5.9 ws_{uq,ep,mc,ba,
 │                                       r,v,route,env,bench,cal,o,wv,atlas,graph,mon,ct,plan,crit,cite,immune,
-│                                       genotox,epitope,innate,seroprev,peg,calib,profile,screen,policy,redteam} + SHA256 locks)
+│                                       genotox,epitope,innate,seroprev,peg,calib,profile,screen,policy,redteam,
+│                                       gen,pareto,orch,vcell,mech,outcome,twincal} + SHA256 locks)
 ├── data/curated/                     small committed tables (universe, gene coords, measured bridge profile,
 │                                       v3.2 bridge_offtarget_energetics.json)
 ├── data/llm_bench_cache/             28 cached ungrounded-LLM transcripts (T7, offline/CI replay)

{pen_stack-5.7.0 → pen_stack-5.9.0}/benchmarks/genome_writing_bench/SHA256SUMS

@@ -1,4 +1,4 @@
-61903ba95b3ac8fd132a9507341ebc975a21d834ff01b76f2fb1376a4a494e07  benchmarks/genome_writing_bench/tasks.yaml
+8a88af94053456909a2a03561d721a97e82d012f867eaf1d632ff3518a2bf0d1  benchmarks/genome_writing_bench/tasks.yaml
 5ca511c6763b4e3703e8009031ff8dc385c2a99540e2731d875a9fbbb16f5ecd  configs/gsh_validated_heldout.yaml
 758817c1e46c7db10f7f942316663367c5f297cac0cf2f59947a90638a256718  data/writer_panel.csv
 865b18ff23d140c3df6f3b5f25398581ebdfe3534e1cecf6f512afb540ab5ede  data/gsh_matched_controls.parquet

{pen_stack-5.7.0 → pen_stack-5.9.0}/benchmarks/genome_writing_bench/tasks.yaml

@@ -8,7 +8,7 @@
 # A task names a `scorer` (module.function in pen_stack.validate / pen_stack.bridge) and a `metric` key to
 # read from its report. Solvers (deterministic planner, naive baseline, LLM agent) are compared on the same
 # tasks; a solver that cannot ground a number must refuse, not invent (no-fabrication is a hard gate).
-version: "0.3.3"
+version: "0.3.5"
 prepared: "2026-06-11"
 
 taxonomy:
@@ -39,6 +39,10 @@ taxonomy:
   CS_co_scientist:      "end-to-end grounded design: multiple materially-distinct legal confidence-tagged strategies, each citation-grounded + scope-ledgered, no-fabrication across the full reasoning stack (vs an ungrounded agent producing none of these)"
   # v0.3.3 (v5.7): the Guardian - biosecurity / dual-use screening as a hard gate.
   SF_safety_screening:  "screen a design for select-agent / pandemic-pathogen / controlled-toxin signatures: benign therapeutics pass (0 false refusals), hazards refused/escalated, AI-homolog + chimera + reframing evasions never `clear` (vs a no-safety baseline that clears everything)"
+  # v0.3.4 (v5.8): the generative designer - verifier-as-discriminator over a mixed candidate pool.
+  GD_generative_design: "generate candidate writing systems and keep ONLY legal+safe+calibrated+immune-profiled survivors (hazardous toxin payload + illegal oversize/form-incompatible designs DISCARDED), returning a Pareto frontier with a grounded immune-risk axis (vs an ungrounded generator that ships hazardous/illegal designs)"
+  # v0.3.5 (v5.9): the digital twin - calibrated, OOD-aware, immune-aware, phenotype-bounded outcome prediction.
+  OP_outcome_prediction: "predict a write's computable outcome with HONEST calibration (two-sided MAE-vs-naive with bootstrap CI), an interval that WIDENS under OOD, an immune-outcome dimension from v5.6, and phenotype out of scope (vs an overconfident predictor with a fixed narrow interval and no scope awareness)"
 
 tasks:
   - id: site_selection_blind_gsh
@@ -243,3 +247,36 @@ tasks:
     note: "v5.7 the Guardian: the no-safety baseline clears everything (passes benign, fails every hazard +
       evasion), so the gate beats it by construction. Function/chimera screens catch AI-homologs homology alone
       would miss; re-framing cannot flip refuse->clear (the artifact decides)."
+
+  - id: generative_design
+    family: GD_generative_design
+    scorer: "pen_stack.validate.generative_design:run"
+    metric: "grounded_designer_valid"
+    baseline_metric: "ungrounded_designer_valid"
+    higher_is_better: true
+    hard_gate: true
+    gate_rule: "grounded_designer_valid == True (survivors all legal+safe+calibrated+immune; hazard+illegal discarded; Pareto immune axis grounded)"
+    ground_truth: "frozen mixed candidate pool (benign FIX-style + hazardous ricin payload + illegal oversize/
+      mRNA-incompatible); validity decided by verify() (safety+legality+calibration+immune), NOT the generator's
+      own claim - non-circular"
+    circular: false
+    note: "v5.8 verifier-as-discriminator: the ungrounded generator returns the raw pool (ships hazardous +
+      illegal designs) and fails by construction; the grounded designer discards them and returns calibrated,
+      immune-profiled candidates on a Pareto frontier with a grounded immune-risk axis."
+
+  - id: outcome_prediction
+    family: OP_outcome_prediction
+    scorer: "pen_stack.validate.outcome_prediction:run"
+    metric: "twin_honest_and_calibrated"
+    baseline_metric: "overconfident_predictor_honest"
+    higher_is_better: true
+    hard_gate: true
+    gate_rule: "twin_honest_and_calibrated == True (calibration two-sided w/ CI AND OOD widens interval AND immune-outcome present AND phenotype out-of-scope)"
+    ground_truth: "structural honesty properties of the outcome prediction (two-sided calibration + OOD widening +
+      immune dimension from v5.6 + phenotype out-of-scope), NOT a beat-the-world claim - non-circular; twin-vs-naive
+      skill is reported informationally on a labelled synthetic stream because no public perturbation-outcome
+      calibration set exists (Arc Virtual Cell Challenge: models do not yet consistently beat naive baselines)"
+    circular: false
+    note: "v5.9 the digital twin: a trustworthy predictor is calibrated + OOD-aware + immune-aware + phenotype-
+      bounded; an overconfident predictor (fixed narrow interval, no OOD/scope awareness) fails the gate by
+      construction. Honest about what the field cannot yet do."

{pen_stack-5.7.0 → pen_stack-5.9.0}/configs/oracles/scope_cards.yaml

@@ -179,3 +179,26 @@ oracles:
     generalizes_to_unseen_loci: false
     license: "open (this work; Chen 10.1021/acs.analchem.6b03109, Yang&Lai 10.1002/wnan.1339,
       Armstrong 10.1002/cncr.22739, Kozma 10.1016/j.addr.2020.07.024)"
+
+  state:                          # v5.9 WS-VCELL: Arc STATE virtual-cell perturbation-response model
+    family: vcell
+    version: "state-2025"
+    output_kind: candidate        # a perturbation-response PREDICTION is a candidate/hypothesis, never a claim
+    valid_for: "IN-DISTRIBUTION single-gene / chemical / cytokine perturbation transcriptional-response estimates
+      in TRAINED human cell contexts (Arc STATE; ~70 contexts, 167M+100M cells)"
+    not_valid_for: "OUT-OF-DISTRIBUTION cell types / perturbations (Arc's own Virtual Cell Challenge result:
+      perturbation models do NOT yet consistently beat naive baselines -> OOD sets extrapolating=True); phenotype;
+      in-vivo behaviour; clinical endpoints"
+    generalizes_to_unseen_loci: false
+    license: "Arc Institute (github.com/ArcInstitute/state)"
+
+  scgpt:                          # v5.9 WS-VCELL: scGPT single-cell foundation model (perturbation prediction)
+    family: vcell
+    version: "scgpt-2024"
+    output_kind: candidate
+    valid_for: "IN-DISTRIBUTION genetic-perturbation transcriptional-response estimates within trained single-cell
+      contexts (scGPT; >33M cells)"
+    not_valid_for: "OOD cell types / perturbations (does not consistently beat naive baselines); phenotype; in-vivo;
+      absolute expression"
+    generalizes_to_unseen_loci: false
+    license: "MIT (github.com/bowang-lab/scGPT; Nature Methods 10.1038/s41592-024-02201-0)"

pen_stack-5.9.0/docs/digital_twin.md

@@ -0,0 +1,55 @@
+# The digital twin (v5.9)
+
+From v5.9, PEN-STACK can predict *what the cell does after the write* — calibrated, OOD-gated, and scope-bounded.
+It computes what mechanism allows, adds an in-distribution virtual-cell estimate, screens immune outcome from the
+v5.6 profile, and is honest about its boundary at phenotype. The twin is a **hypothesis engine, not an oracle of
+truth**.
+
+```python
+from pen_stack.twin import predict_outcome
+o = predict_outcome(design, cell_state="k562")
+o["predicted_outcome"]   # {relative_expression, vcell_response, units}
+o["interval"]            # heuristic band; WIDENS under OOD
+o["immune_outcome"]      # the v5.6 per-axis profile (sourced, not invented)
+o["scope_flags"]         # phenotype_not_modeled, in_vivo_magnitude_unknown, (vcell_OOD if extrapolating)
+```
+
+## Mechanism where computable (`pen_stack/twin/mechanistic.py`)
+
+`cassette_expression(design, chromatin_ctx)` = `promoter_strength × copy_number × accessibility` — a closed-form
+steady-state estimate. Assumptions (steady-state, no silencing, linear copy scaling) and scope flags
+(`episomal_durability_unknown`, `phenotype_not_modeled`) travel with the output. It is **physics where
+computable, never a phenotype**.
+
+## Virtual-cell oracle, OOD-gated (`pen_stack/oracles/vcell.py`)
+
+`predict_response(cell_state, perturbation, model="state")` wraps Arc **STATE** / **scGPT** under the v4.0
+`OracleResult` contract. A perturbation-response prediction is a **candidate**, never a claim; a cell context or
+perturbation outside the documented validity envelope sets `extrapolating=True` / `in_scope=False`. The backend is
+deferred/cache-replayed (value `None` when absent — never fabricated). This encodes the field's own result (Arc's
+Virtual Cell Challenge): **perturbation models do not yet consistently beat naive baselines** and do not
+generalize to unseen contexts.
+
+## Fused outcome (`pen_stack/twin/outcome.py`)
+
+`predict_outcome(design, cell_state)` fuses the computable mechanistic estimate (backbone) + an in-distribution
+virtual-cell response (when available) + the v5.6 immune profile. The interval **widens under OOD** rather than
+over-trusting an extrapolating model. For in-vivo vehicles, durability **may be conditioned on the grounded
+pre-existing-NAb axis** (no invented immune numbers). Phenotype and in-vivo magnitude stay scope-flagged.
+
+> The interval is a heuristic band, **not** a trained conformal interval — there is no public
+> perturbation-outcome calibration set. The twin says so.
+
+## Honest calibration (`pen_stack/twin/calibrate.py`)
+
+`calibrate_outcome(predictions, observations, intervals=…)` reports calibration **two-sided, whatever the shape**:
+interval coverage vs nominal, and a skill comparison against a naive mean baseline with a **bootstrap CI on the
+MAE gap**. The twin "beats" the baseline **only when the CI excludes zero** — otherwise the negative is reported
+verbatim. At `N < 3` it abstains honestly.
+
+## Honest scope
+
+The twin predicts what mechanism computes, what an in-distribution virtual-cell model supports, and what the v5.6
+immune profile screens — with calibrated intervals. It does **not** predict phenotype, in-vivo behaviour,
+immunogenicity *magnitude*, or durability beyond the computable; these stay scope-flagged. Perturbation prediction
+is an open problem; the twin is a calibrated hypothesis engine, honest where it is weak.

pen_stack-5.9.0/docs/generative_design.md

@@ -0,0 +1,63 @@
+# The generative designer (v5.8)
+
+From v5.8, PEN-STACK does not only *score* a design you give it — it *generates* candidate end-to-end writing
+systems and returns the **Pareto frontier** of real tradeoffs, with every candidate passing safety, legality,
+and calibration or being discarded. Generation proposes; `verify()` disposes.
+
+## Verifier-as-discriminator (`pen_stack/design/generate.py`)
+
+```python
+from pen_stack.design import generate_designs
+survivors = generate_designs({"gene": "AAVS1", "intent": "safe_harbour_insertion",
+                              "cargo_bp": 3000, "cell_type": "k562"})
+```
+
+Each candidate is run through the v3.3 `verify()` — now **safety-gated (v5.7)**, legality-checked (v3.3),
+calibrated (v3.2), and immune-profiled (v5.6). A candidate **survives only if it is legal AND its safety
+decision is `clear`/`flag`**; hazardous (`refuse`/`escalate`) and illegal candidates are **discarded, never
+returned as claims**. Survivors carry:
+
+- `confidence` + `interval` — calibrated (or an explicit `None` abstention),
+- `immune_profile` — the v5.6 per-axis vector (`collapsed_score` stays `None`),
+- `safety_decision`, `scope_flags`,
+- `output_kind: "candidate"` — never asserted to work.
+
+This generalises the v4.0 `as_claim()` guard from single oracle outputs to whole designs. A novel writer
+sequence in a candidate routes to v4.0 writer-verification (critiqued, never claimed).
+
+Pass an explicit `candidates=[...]` pool to discriminate a known set (atlas-independent); otherwise candidates
+are enumerated by `candidate_space(goal)` — the validated Phase-3 planner (`plan_write`) crossed with every
+compatible delivery vehicle.
+
+## Pareto frontier with a grounded immune-risk axis (`pen_stack/design/pareto.py`)
+
+```python
+from pen_stack.design import pareto_front
+front = pareto_front(survivors)        # non-dominated set
+```
+
+Axes (higher is better on each): `efficiency` (writer activity), `durability` (TRIP model), `safety`
+(genotoxicity-risk), `deliverability` (capacity headroom), **`neg_immune_risk`**, `neg_cost`.
+
+`neg_immune_risk` is **grounded by the v5.6 profile, not a placeholder**: it is the **worst-case per-axis
+in-scope score** (lower score = higher risk) with the largest per-axis uncertainty carried as a **band** — the
+profile is never collapsed into one confident number, and the in-vivo magnitude stays scope-flagged
+(`in_vivo_magnitude_unknown`). Each frontier design exposes `neg_immune_risk_detail` (value + band + axes used +
+flag); the per-axis profile remains the source of truth.
+
+## Live orchestration (`pen_stack/agent/orchestrator_live.py`)
+
+```python
+from pen_stack.agent.orchestrator_live import orchestrate
+run = orchestrate(goal)                # plan -> generate -> oracle critique -> verify -> refine
+```
+
+The agent picks *which* oracle to call; the *number* always comes from the oracle (cache-first, version-pinned,
+**replayable** — replay is the CI default). A seed-locked replay reproduces the trace exactly. No stage
+fabricates a value.
+
+## Honest scope
+
+Generation explores within the oracles' validity and the rules' legality; novelty is bounded and **never
+asserted to work**. The immune-risk Pareto axis is a worst-case **screen** over per-axis proxies — the per-axis
+profile (with its validation labels) is authoritative, and in-vivo magnitude remains a known-unknown.

{pen_stack-5.7.0 → pen_stack-5.9.0}/pen_stack/__init__.py

@@ -1,2 +1,2 @@
 """PEN-STACK v3.0 - open infrastructure for genome writing."""
-__version__ = "5.7.0"
+__version__ = "5.9.0"

pen_stack-5.9.0/pen_stack/agent/orchestrator_live.py

@@ -0,0 +1,56 @@
+"""Live foundation-model orchestration (v5.8, WS-ORCH).
+
+A reasoning loop that GENERATES grounded candidates, calls oracles (cache-first / replayable) for a critique
+signal, and disposes via `verify()` (safety + legality + immune). The agent picks WHICH oracle to call; the
+NUMBER always comes from the oracle/tool, never invented. Live calls are cache-keyed and version-pinned, so a
+seed-locked replay reproduces a run from the committed cache (replay is the CI default).
+"""
+from __future__ import annotations
+
+from typing import Any
+
+
+def _oracle_critique(design: dict, *, seed: int = 0) -> dict:
+    """A grounded critique number for the top candidate, sourced from an oracle adapter (cache-first). When the
+    candidate carries a writer sequence, use the structure-consistency oracle; otherwise abstain (no fabricated
+    value). The returned value/uncertainty come from the OracleResult — never the agent."""
+    seq = design.get("writer_candidate_seq") or design.get("writer_seq")
+    if not seq:
+        return {"oracle": None, "value": None, "available": False, "note": "no sequence supplied; abstaining"}
+    from pen_stack.oracles.structure import consistency
+    r = consistency(seq)
+    return {"oracle": "structure.consistency", "value": (r.value or {}),
+            "available": bool(r.available), "cached": bool(getattr(r, "cached", False)),
+            "source": getattr(r, "source", None), "output_kind": r.output_kind}
+
+
+def orchestrate(goal: dict, *, candidates: list[dict] | None = None, max_rounds: int = 4,
+                seed: int = 0) -> dict[str, Any]:
+    """Plan -> generate grounded candidates -> call an oracle (cache-first) -> critique via verify() -> refine.
+    Returns the chosen design + a trace in which every number is tool-sourced. Deterministic given the inputs +
+    seed (replayable from cache). No stage fabricates a value."""
+    from pen_stack.design.generate import generate_designs
+    from pen_stack.verify import verify
+
+    state: dict[str, Any] = {"goal": goal, "design": None, "candidates": []}
+    trace: list[dict] = []
+    for r in range(max_rounds):
+        cands = generate_designs(goal, candidates=candidates, keep=5, actor="orchestrator")
+        if not cands:
+            trace.append({"round": r, "action": "generate", "n": 0,
+                          "note": "no surviving candidates (atlas absent or all discarded by the discriminator)"})
+            break
+        top = cands[0]
+        oracle = _oracle_critique(top, seed=seed)
+        v = verify(dict(top), actor="orchestrator")
+        trace.append({"round": r, "action": "generate+oracle+verify", "n": len(cands),
+                      "oracle": oracle, "verdict": v.summary(), "legal": v.legal,
+                      "safety": (v.safety.decision if v.safety is not None else None),
+                      "confidence": v.confidence})
+        state["design"], state["candidates"] = top, cands
+        if v.legal is True and v.safety is not None and v.safety.decision in ("clear", "flag"):
+            break
+        # refine: on a non-passing round, narrow the pool to the survivors for the next iteration
+        candidates = cands
+    return {"goal": goal, "design": state["design"], "trace": trace,
+            "no_fabrication": True, "replayable": True}

pen_stack-5.9.0/pen_stack/design/__init__.py

@@ -0,0 +1,14 @@
+"""pen_stack.design — the grounded generative designer (v5.8).
+
+Generate candidate end-to-end writing systems, keep only those that pass safety + legality + calibration
+(verifier-as-discriminator), and return the Pareto frontier of real tradeoffs — including an immune-risk axis
+grounded in the v5.6 profile. Nothing unvalidated is asserted: every survivor is `output_kind="candidate"`.
+"""
+from __future__ import annotations
+
+from pen_stack.design.generate import generate_designs
+from pen_stack.design.pareto import AXES, neg_immune_risk, pareto_front
+from pen_stack.design.space import candidate_space, deliverability_score
+
+__all__ = ["generate_designs", "candidate_space", "deliverability_score",
+           "pareto_front", "neg_immune_risk", "AXES"]