pen-stack 7.1.2__tar.gz → 7.1.3__tar.gz

{pen_stack-7.1.2 → pen_stack-7.1.3}/CHANGELOG.md

@@ -3,6 +3,52 @@
 All notable changes to PEN-STACK are documented here. This file follows
 [Keep a Changelog](https://keepachangelog.com/).
 
+## [7.1.3] - 2026-06-26 - Designer correctness: Guardian biosecurity + calibrated confidence
+
+### Fixed
+- **CRITICAL (Designer / Guardian biosecurity):** Hazardous cargo functions (e.g. furin-cleavage viral
+  tropism-enhancement, dominant-negative tumor-suppressor ablation) passed the Designer as "Safety: Clear" with
+  full survivor tables. Several root causes, all fixed:
+  - The hazard registry (`configs/safety/hazard_registry.yaml`) had **no signatures** for engineered viral tropism
+    enhancement or oncogenic tumor-suppressor ablation. Added `FUNC-VIRAL-TROPISM-ENHANCE` (furin cleavage /
+    receptor-binding / tropism, high severity) and `FUNC-ONCOGENIC-SUPPRESSOR` (dominant-negative TP53 / RB / PTEN,
+    apoptosis-checkpoint ablation, high severity), both DURC / HHS-P3CO categories.
+  - **Oncogenic-manipulation PATTERN screen** (`oncogenic_manipulation` in the registry +
+    `HazardRegistry.oncogenic_flags`): a flat keyword list is brittle to paraphrase — a red-team pass found the
+    Guardian caught only **1/8** mechanism/synonym phrasings ("R175H p53 abolishing transactivation", "PTEN
+    knockout", "RAS G12D constitutive activation", "hTERT immortalization", "APC frameshift", "EGFR
+    ligand-independent activation", "NF1+BAX/BAK knockout"). The pattern screen flags the *combination*
+    `(tumor-suppressor + disruptive verb)` OR `(oncogene + activating signature)` OR `immortalization`, which
+    catches **8/8** while the deliberate asymmetry spares therapy with **no allow-list** — restoring a suppressor or
+    silencing an oncogene matches neither, so "p53 correction to restore apoptosis", "TRAC/CCR5 knockout",
+    "knock-down of mutant KRAS" stay clear (**11/11** benign). Disposition is escalate (dual-use → human review).
+  - **Keyword matcher hardened** (`_kw_match`): a plain substring test made the ricin abbreviation `"rip"` fire
+    inside **"transc-rip-tion"** (a word in almost every editing design → benign cassettes false-refused as ricin),
+    and let a hyphenated `"furin-cleavage"` slip past the space-form keyword. Matching is now separator-insensitive
+    (`-`/`_`/space unified) and word-boundary anchored, fixing both the false positive and the evasion.
+  - The goal-based candidate path (`pen_stack/design/space.py::candidate_space`) **dropped** the goal's
+    `cargo_function`, so the Guardian in `verify()` screened nothing. It is now propagated onto every swept
+    candidate. The `/generate` endpoint additionally screens the goal's cargo function FIRST and returns an explicit
+    biosecurity refusal (`refused: true` + the safety verdict) so an empty table is correctly attributed to a
+    refusal, not a silent "no candidates".
+- **CRITICAL (Designer / calibration):** Confidence was a constant `1.00 · [0.56, 0.71]` for every input because the
+  page hardcoded fake planner scores (0.7 / 0.6 / 0.5) on each candidate. The page now submits the design GOAL and
+  the engine plans real writable sites with grounded per-locus safety / durability / writer-activity, so the
+  confidence band is genuinely calibrated (it differs by locus/vehicle, e.g. F9 → `[0.866, 0.972]`, and is absent
+  for a refused design). `web/src/pages/Designer.jsx` rewritten to send a goal and render the refused / empty /
+  survivor states distinctly.
+- **Designer (cell types without a measured atlas):** a goal in a cell type with no writability atlas (cd8_t /
+  pbmc / h1_hesc / ipsc) returned an empty table, because the planner-backed `candidate_space` needs `plan_write`.
+  `generate_designs` now falls back to `space.vehicle_sweep(goal)`: it sweeps the capacity-compatible vehicles,
+  carries `cargo_function` (the Guardian still screens), runs full legality + biosecurity discrimination, and
+  ABSTAINS on the calibrated confidence (no fabricated band) — surfaced as "abstained, no measured atlas for this
+  cell type". `candidate_space` still returns `[]` without the atlas; `generate_designs(candidates=[])` still
+  returns `[]`.
+- **Designer (administration context):** the vehicle sweep now filters by the goal's `in_vivo` flag using the
+  curated `in_vivo` / `ex_vivo` route flags in `configs/delivery_vehicles.yaml` (an ex-vivo goal keeps
+  lentivirus / electroporation / eVLP; an in-vivo goal keeps AAV / LNP / HDAd / HSV / eVLP). Grounded from the
+  curated palette, not a clinical claim; `in_vivo=None` keeps all (existing callers/tests unchanged).
+
 ## [7.1.2] - 2026-06-25 - PEN-CHAT: chat-response latency fix
 
 ### Fixed

{pen_stack-7.1.2 → pen_stack-7.1.3}/CITATION.cff

@@ -1,8 +1,8 @@
 cff-version: 1.2.0
 message: "If you use PEN-STACK, please cite it as below."
 title: "PEN-STACK: open infrastructure for genome writing"
-version: 7.1.2
-date-released: 2026-06-25
+version: 7.1.3
+date-released: 2026-06-26
 authors:
   - family-names: "Mahaboob Ali"
     given-names: "Anees Ahmed"

{pen_stack-7.1.2 → pen_stack-7.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pen-stack
-Version: 7.1.2
+Version: 7.1.3
 Summary: Open infrastructure for genome writing: the Writable Genome atlas, the Writer Atlas, and the Write Planner.
 Author-email: Anees Ahmed Mahaboob Ali <ahmedaneesm@gmail.com>
 License: MIT
@@ -162,9 +162,10 @@ flowchart TB
 | Generative designer | `pen_stack.design` | Proposes candidate writing systems and keeps only those that pass safety, legality, and calibration, returning a Pareto frontier. |
 | Digital twin | `pen_stack.twin` | Calibrated, out-of-distribution-gated outcome prediction, bounded at phenotype. |
 | Experiment designer | `pen_stack.active` | Active learning by expected information gain, with a retrospective active-versus-random evaluation. |
-| Build interface | `pen_stack.build` | Safety-gated protocol export (draft only, never auto-run) and gated ingestion of results. |
-| Closed loop | `pen_stack.loop` | A gated design, build, test, learn loop with drift detection and versioned, reversible recalibration. |
-| Agent and co-scientist | `pen_stack.agent` | Goal to cited, auditable plan; MCP server; the co-scientist that drives the loop. |
+| Build interface | `pen_stack.build` | Safety-gated protocol export (draft only, never auto-run) and gated ingestion of results, with a cloud-lab connector that runs the biosecurity gate before any submission. |
+| Closed loop | `pen_stack.loop`, `pen_stack.active` | A gated design, build, test, learn loop with drift detection and versioned, reversible recalibration; an SDL-brain benchmark and a validation-campaign engine that orders the most-informative next measurements by expected information gain. |
+| Write intent (WriteSpec) | `pen_stack.spec` | A typed, ontology-backed `WriteRequest` (an SBOL3 profile) with a grounded extractor that resolves free text to verified ontology ids, asks clarifying questions on ambiguity, and runs a SAT feasibility check. |
+| Agent, co-scientist, and chat | `pen_stack.agent`, `pen_stack.web`, `pen_stack.rag` | Goal to cited, auditable plan; MCP server; the co-scientist that drives the loop; and the grounded conversational chat (four lanes: design, explain, meta, general; provenance-tagged retrieval; a swappable LLM provider). |
 | Bridge off-target engine | `pen_stack.bridge` | Off-target nomination and guide QC for bridge recombinases. |
 | Interfaces | `pen_stack.server`, `pen_stack.web`, `pen_stack.ui`, `pen_stack.cli` | REST API, web application, and command-line tools. |
 
@@ -249,20 +250,22 @@ A single assembly path (`pen_stack/atlas/universe.py`) feeds the classifier, the
 ```
 pen-stack/
   pen_stack/            the installable package
-    wgenome/            Writable Genome: features, safety, durability, writability, uncertainty, structure3d
-    atlas/              Writer Atlas, knowledge base, cross-link, variant proposal, canonical universe
+    spec/               WriteSpec: typed SBOL3-profile intent layer, grounded extractor, ontology resolvers, SAT feasibility
+    wgenome/            Writable Genome: features, safety, durability, writability, uncertainty, structure3d, off-target nomination
+    atlas/              Writer Atlas, knowledge base, cross-link, variant proposal, canonical universe, writer-efficiency predictor
     mech/  score/       mechanism classification at scale; re-grounded therapeutic-readiness axes
-    planner/            Write Planner: optimisation, cargo, routing, delivery palette, delivery immunology
+    planner/            Write Planner: optimisation, cargo, routing, delivery palette, delivery immunology, capsid fitness
     bridge/             bridge off-target engine and guide QC
-    oracles/            oracle mesh: the OracleResult contract and adapters over the foundation models
+    oracles/            oracle mesh: the OracleResult contract and adapters over the foundation models, with binding-affinity and per-oracle reliability
     graph/              living world-model knowledge graph (gated, propose-only)
-    rules/  verify/     machine-readable rule base and the verify(design) service
-    safety/             the biosecurity and dual-use gate
-    design/  twin/      generative designer; calibrated digital twin
-    active/  build/     experiment designer; safety-gated build interface
+    rules/  verify/     machine-readable rule base, the verify(design) service, and the proof-object with repair hints
+    safety/             the biosecurity and dual-use gate, with standards concordance
+    design/  twin/      generative designer; calibrated digital twin with a learned position-effect model
+    active/  build/     experiment designer with the SDL-brain benchmark and validation-campaign engine; safety-gated build interface and cloud-lab connector
     loop/               the gated design-build-test-learn loop
+    rag/                PEN-CHAT: provenance-tagged retrieval corpus, embedder, and four-branch ground router (social, cited, general, abstained)
     agent/              agent platform, co-scientist, MCP server
-    api/  web/  server/ ui/  cli.py    AI integration surface, web platform, REST API, CLI
+    api/  web/  server/ ui/  cli.py    AI integration surface, web platform with the grounded chat and swappable LLM provider, REST API, CLI
   benchmarks/           Genome-Writing Bench and the public Genome-Writing Challenge
   scripts/              reproducible pipeline drivers
   configs/              pinned datasets, thresholds, and curation (YAML)
@@ -296,7 +299,7 @@ All public: hg38 (UCSC); ENCODE and Roadmap chromatin (ATAC/DNase and histone ma
   author  = {Mahaboob Ali, Anees Ahmed},
   title   = {PEN-STACK: open infrastructure for genome writing (The Writable Genome)},
   year    = {2026},
-  version = {6.11.0},
+  version = {7.1.2},
   url     = {https://github.com/ahmedanees-m/pen-stack}
 }
 ```

{pen_stack-7.1.2 → pen_stack-7.1.3}/README.md

@@ -85,9 +85,10 @@ flowchart TB
 | Generative designer | `pen_stack.design` | Proposes candidate writing systems and keeps only those that pass safety, legality, and calibration, returning a Pareto frontier. |
 | Digital twin | `pen_stack.twin` | Calibrated, out-of-distribution-gated outcome prediction, bounded at phenotype. |
 | Experiment designer | `pen_stack.active` | Active learning by expected information gain, with a retrospective active-versus-random evaluation. |
-| Build interface | `pen_stack.build` | Safety-gated protocol export (draft only, never auto-run) and gated ingestion of results. |
-| Closed loop | `pen_stack.loop` | A gated design, build, test, learn loop with drift detection and versioned, reversible recalibration. |
-| Agent and co-scientist | `pen_stack.agent` | Goal to cited, auditable plan; MCP server; the co-scientist that drives the loop. |
+| Build interface | `pen_stack.build` | Safety-gated protocol export (draft only, never auto-run) and gated ingestion of results, with a cloud-lab connector that runs the biosecurity gate before any submission. |
+| Closed loop | `pen_stack.loop`, `pen_stack.active` | A gated design, build, test, learn loop with drift detection and versioned, reversible recalibration; an SDL-brain benchmark and a validation-campaign engine that orders the most-informative next measurements by expected information gain. |
+| Write intent (WriteSpec) | `pen_stack.spec` | A typed, ontology-backed `WriteRequest` (an SBOL3 profile) with a grounded extractor that resolves free text to verified ontology ids, asks clarifying questions on ambiguity, and runs a SAT feasibility check. |
+| Agent, co-scientist, and chat | `pen_stack.agent`, `pen_stack.web`, `pen_stack.rag` | Goal to cited, auditable plan; MCP server; the co-scientist that drives the loop; and the grounded conversational chat (four lanes: design, explain, meta, general; provenance-tagged retrieval; a swappable LLM provider). |
 | Bridge off-target engine | `pen_stack.bridge` | Off-target nomination and guide QC for bridge recombinases. |
 | Interfaces | `pen_stack.server`, `pen_stack.web`, `pen_stack.ui`, `pen_stack.cli` | REST API, web application, and command-line tools. |
 
@@ -172,20 +173,22 @@ A single assembly path (`pen_stack/atlas/universe.py`) feeds the classifier, the
 ```
 pen-stack/
   pen_stack/            the installable package
-    wgenome/            Writable Genome: features, safety, durability, writability, uncertainty, structure3d
-    atlas/              Writer Atlas, knowledge base, cross-link, variant proposal, canonical universe
+    spec/               WriteSpec: typed SBOL3-profile intent layer, grounded extractor, ontology resolvers, SAT feasibility
+    wgenome/            Writable Genome: features, safety, durability, writability, uncertainty, structure3d, off-target nomination
+    atlas/              Writer Atlas, knowledge base, cross-link, variant proposal, canonical universe, writer-efficiency predictor
     mech/  score/       mechanism classification at scale; re-grounded therapeutic-readiness axes
-    planner/            Write Planner: optimisation, cargo, routing, delivery palette, delivery immunology
+    planner/            Write Planner: optimisation, cargo, routing, delivery palette, delivery immunology, capsid fitness
     bridge/             bridge off-target engine and guide QC
-    oracles/            oracle mesh: the OracleResult contract and adapters over the foundation models
+    oracles/            oracle mesh: the OracleResult contract and adapters over the foundation models, with binding-affinity and per-oracle reliability
     graph/              living world-model knowledge graph (gated, propose-only)
-    rules/  verify/     machine-readable rule base and the verify(design) service
-    safety/             the biosecurity and dual-use gate
-    design/  twin/      generative designer; calibrated digital twin
-    active/  build/     experiment designer; safety-gated build interface
+    rules/  verify/     machine-readable rule base, the verify(design) service, and the proof-object with repair hints
+    safety/             the biosecurity and dual-use gate, with standards concordance
+    design/  twin/      generative designer; calibrated digital twin with a learned position-effect model
+    active/  build/     experiment designer with the SDL-brain benchmark and validation-campaign engine; safety-gated build interface and cloud-lab connector
     loop/               the gated design-build-test-learn loop
+    rag/                PEN-CHAT: provenance-tagged retrieval corpus, embedder, and four-branch ground router (social, cited, general, abstained)
     agent/              agent platform, co-scientist, MCP server
-    api/  web/  server/ ui/  cli.py    AI integration surface, web platform, REST API, CLI
+    api/  web/  server/ ui/  cli.py    AI integration surface, web platform with the grounded chat and swappable LLM provider, REST API, CLI
   benchmarks/           Genome-Writing Bench and the public Genome-Writing Challenge
   scripts/              reproducible pipeline drivers
   configs/              pinned datasets, thresholds, and curation (YAML)
@@ -219,7 +222,7 @@ All public: hg38 (UCSC); ENCODE and Roadmap chromatin (ATAC/DNase and histone ma
   author  = {Mahaboob Ali, Anees Ahmed},
   title   = {PEN-STACK: open infrastructure for genome writing (The Writable Genome)},
   year    = {2026},
-  version = {6.11.0},
+  version = {7.1.2},
   url     = {https://github.com/ahmedanees-m/pen-stack}
 }
 ```

{pen_stack-7.1.2 → pen_stack-7.1.3}/configs/safety/hazard_registry.yaml

@@ -133,6 +133,69 @@ controlled_functions:
     keywords: ["pathogen_essential", "virulence_factor", "pathogen essential"]
     control_ref: "DURC policy"
     severity: medium
+  - id: FUNC-VIRAL-TROPISM-ENHANCE
+    # v7.1.2 CRITICAL: Added to catch furin-cleavage and other viral enhancement modifications.
+    # Furin is a ubiquitous human protease; inserting furin cleavage sites increases proteolytic
+    # activation of viral glycoproteins, broadening cell tropism and transmissibility (GOF concern).
+    name: "engineered enhancement of viral cell tropism / proteolytic activation (furin cleavage, PRRA inserts)"
+    keywords: ["furin cleavage", "furin_cleavage", "protease activation", "receptor binding enhancement",
+               "tropism enhancement", "tropism_expansion", "virulence enhancement"]
+    control_ref: "DURC policy (GOF concern, HHS P3CO oversight)"
+    severity: high
+  - id: FUNC-ONCOGENIC-SUPPRESSOR
+    # v7.1.2 CRITICAL: Added to catch dominant-negative tumor suppressors and oncogenic manipulations.
+    # Deleting or inhibiting tumor suppressors (TP53, RB, PTEN) ablates apoptosis/cell-cycle checkpoints,
+    # enabling unrestricted proliferation and malignant transformation (oncogenic context).
+    name: "dominant-negative / ablation of tumor-suppressor checkpoints (TP53, RB, PTEN, APC)"
+    keywords: ["dominant-negative", "dominant negative", "tp53_suppressor", "p53_ablation", "rb_suppressor",
+               "pten_suppressor", "apc_suppressor", "apoptosis_checkpoint_ablation", "cell_cycle_checkpoint_ablation",
+               "tumor_suppressor_knockout", "unrestricted_proliferation", "apoptosis_evasion"]
+    control_ref: "DURC policy (oncogenic context, malignant transformation risk)"
+    severity: high
+
+# --- Oncogenic-manipulation PATTERN screen (v7.1.2). -----------------------------------
+# A flat keyword list (FUNC-ONCOGENIC-SUPPRESSOR above) catches only literal phrasings; an adversary (or an
+# honest user) describing the same edit by MECHANISM or SYNONYM evades it ("R175H p53 that abolishes
+# transactivation", "PTEN knockout", "RAS G12D constitutive activation", "hTERT immortalization"). This pattern
+# screen flags the COMBINATION rather than a fixed phrase:
+#   (tumor-suppressor gene token  +  a disruptive verb)        -> losing a growth/apoptosis brake
+#   (oncogene token               +  an activating signature)  -> flooring a growth accelerator
+#   (an immortalization signature)                             -> bypassing replicative senescence
+# The asymmetry is deliberate and is what spares legitimate therapy WITHOUT an explicit allow-list: RESTORING a
+# suppressor or SILENCING/knocking-down an oncogene does not match (restoration verbs are not disruptive; silencing
+# is not an activating signature), so "wild-type p53 correction to restore apoptosis" or "knock down mutant KRAS"
+# stay clear. Disposition is ESCALATE (medium): deliberate oncogenic transformation is dual-use, but cancer-model
+# research is legitimate and has an IBC/oversight path, so it routes to human review rather than a blanket refuse;
+# the blatant dominant-negative phrasings still REFUSE via FUNC-ONCOGENIC-SUPPRESSOR. Tokens are public gene
+# symbols / standard molecular-biology verbs - no exploit detail.
+oncogenic_manipulation:
+  id: FUNC-ONCOGENIC-PATTERN
+  name: "engineered oncogenic transformation (tumor-suppressor disruption / oncogene activation / immortalization)"
+  control_ref: "DURC policy (oncogenic transformation); cancer-model research has a legitimate IBC/oversight path"
+  severity: medium
+  tumor_suppressors: ["tp53", "trp53", " p53", "rb1", "retinoblastoma protein", "pten", " apc ", "cdkn2a",
+                      "ink4a", " p16", " arf ", " nf1", "neurofibromin", "brca1", "brca2", " vhl", "smad4",
+                      "stk11", " lkb1", " bax", " bak", "pro-apoptotic", "tumor suppressor", "tumour suppressor"]
+  oncogenes: ["kras", "nras", "hras", "k-ras", "n-ras", "h-ras", " ras ", " myc", "c-myc", "mycn", "braf",
+              "egfr", "erbb2", " her2", "pik3ca", " akt ", " alk ", " met ", " ret ", "bcr-abl", "ccnd1",
+              "cyclin d", " mdm2", "ezh2", "beta-catenin", "wnt-target", "mapk flux", "pi3k/akt"]
+  disrupt_verbs: ["knockout", "knock out", "knock-out", "knocked out", "disrupt", "ablat", "dominant-negative",
+                  "dominant negative", "frameshift", "inactivat", "abolish", "sequester", "loss-of-function",
+                  "loss of function", "null allele", "truncat", "silence the suppressor", "remove the",
+                  "release the", "derepress", "lipid-phosphatase brake"]
+  activate_signatures: ["constitutive activ", "constitutively active", "gain-of-function", "gain of function",
+                        "activating mutation", "oncogenic mutation", "ligand-independent", "ligand independent",
+                        "autoinhibition", "g12d", "g12v", "g12c", "g13d", "q61", "v600e", "gtp-bound active",
+                        "switch in its gtp", "constitutive mapk", "constitutive wnt", "constitutive signaling",
+                        "constitutive survival", "hyperactivat", "independent of ligand", "sustain constitutive"]
+  immortalization: ["immortaliz", "telomerase", "htert", "unlimited replicative", "unlimited proliferat",
+                    "unrestricted proliferat", "indefinite proliferat", "replicative lifespan", "bypass senescence",
+                    "evade senescence", "escape senescence"]
+  # restoration verbs that, when no disruptive/activating/immortalization signal is present, keep a suppressor /
+  # oncogene mention CLEAR (therapeutic gene correction). Belt-and-braces on top of the asymmetric logic.
+  therapy_context: ["restore", "restoration", "correct the", "gene correction", "wild-type replacement",
+                    "replace the defective", "reconstitute the wild-type", "functional copy", "supplementation",
+                    "wild-type p53 gene correction"]
 
 # --- Chimera / context rules: hazardous ASSEMBLY of individually-benign parts. ---------
 chimera_rules:

{pen_stack-7.1.2 → pen_stack-7.1.3}/pen_stack/__init__.py

@@ -1,2 +1,2 @@
 """PEN-STACK v3.0 - open infrastructure for genome writing."""
-__version__ = "7.1.2"
+__version__ = "7.1.3"

{pen_stack-7.1.2 → pen_stack-7.1.3}/pen_stack/design/generate.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 
 from typing import Any
 
-from pen_stack.design.space import candidate_space
+from pen_stack.design.space import candidate_space, vehicle_sweep
 from pen_stack.verify import verify
 
 # a survivor must be legal AND safe (cleared or low-severity advisory); refuse/escalate are discarded.
@@ -29,8 +29,19 @@ def generate_designs(goal: dict | None = None, *, candidates: list[dict] | None
     by confidence. Hazardous (refuse/escalate) or illegal proposals are discarded, never returned.
 
     Pass an explicit ``candidates`` list to discriminate a known pool (atlas-independent); otherwise candidates
-    are enumerated from ``goal`` via the planner-backed candidate space."""
-    pool = candidates if candidates is not None else candidate_space(goal or {}, n=n)
+    are enumerated from ``goal`` via the planner-backed candidate space.
+
+    v7.1.2: when the goal's cell type has NO measured writability atlas (so the planner-backed candidate_space
+    yields nothing), fall back to an atlas-free vehicle sweep so the legality + biosecurity discrimination still
+    runs; those survivors carry no calibrated confidence (it abstains honestly, surfaced in the UI) rather than
+    the page showing an empty table for a perfectly legal, screened design. The explicit-``candidates`` path is
+    untouched (``generate_designs(candidates=[])`` still returns [])."""
+    if candidates is not None:
+        pool = candidates
+    else:
+        pool = candidate_space(goal or {}, n=n)
+        if not pool and goal: # atlas absent for this cell type -> atlas-free sweep (confidence will abstain)
+            pool = vehicle_sweep(goal, n=n)
     survivors: list[dict] = []
     for d in pool:
         v = verify(dict(d), actor=actor)

pen_stack-7.1.3/pen_stack/design/space.py

@@ -0,0 +1,136 @@
+"""Candidate-space generation for the generative designer (v5.8, WS-GEN support).
+
+`candidate_space(goal)` enumerates candidate end-to-end writing systems, writer x site x cargo x delivery,
+by wrapping the validated Phase-3 inverse-design planner (`plan_write`) for the site x writer x scores, then
+pairing each with every *compatible* delivery vehicle from the curated palette (cargo fits the vehicle
+capacity). Every candidate carries the planner's grounded scores (safety / p_durable / writer_activity) so the
+verifier-as-discriminator can compute a calibrated confidence and the v5.6 immune profile downstream.
+
+Atlas-dependent: when the Phase-1 writability atlas is absent (e.g. a bare laptop checkout), `plan_write`
+yields nothing and `candidate_space` returns []. The discriminator/Pareto logic is independent of the atlas and
+is exercised on explicit candidates (tests/bench fixtures); the atlas path runs on the VM/with data.
+"""
+from __future__ import annotations
+
+from typing import Any
+
+from pen_stack.planner.delivery_vehicles import names as _vehicle_names
+from pen_stack.planner.delivery_vehicles import vehicle as _vehicle
+
+# edit-intent -> write_type (the router/verifier dispatches on write_type)
+_INTENT_WRITE_TYPE = {
+    "safe_harbour_insertion": "insertion",
+    "high_durability_insertion": "insertion",
+    "knock_in_with_disruption": "insertion",
+    "landing_pad_insertion": "landing_pad",
+    "regulatory_element_excision": "excision",
+    "repeat_excision": "excision",
+    "regulatory_rewrite": "regulatory_rewrite",
+}
+
+
+def _compatible_vehicles(cargo_bp: int, in_vivo: bool | None = None) -> list[str]:
+    """Vehicles whose curated cargo capacity fits the cargo (capacity None = no DNA-packaging limit).
+
+    v7.1.2: when an administration ``in_vivo`` context is given, also filter by the vehicle's curated route
+    (the `in_vivo` / `ex_vivo` flags in configs/delivery_vehicles.yaml) - an in-vivo goal keeps the in-vivo-capable
+    vehicles, an ex-vivo goal keeps the ex-vivo-capable ones (e.g. lentivirus / electroporation / eVLP). This is a
+    grounded compatibility filter from the curated palette, not a clinical claim. ``in_vivo=None`` keeps all."""
+    out = []
+    for n in _vehicle_names():
+        v = _vehicle(n) or {}
+        cap = v.get("cargo_capacity_bp")
+        if cap is not None and cargo_bp > cap:
+            continue
+        if in_vivo is True and not v.get("in_vivo"):
+            continue
+        if in_vivo is False and not v.get("ex_vivo"):
+            continue
+        out.append(n)
+    return out
+
+
+def deliverability_score(vehicle_name: str, cargo_bp: int) -> float:
+    """Grounded deliverability proxy: capacity headroom (more spare capacity = more deliverable),
+    clipped to [0,1]. Vehicles with no packaging limit score 1.0. NOT a clinical claim."""
+    cap = (_vehicle(vehicle_name) or {}).get("cargo_capacity_bp")
+    if cap is None:
+        return 1.0
+    if cargo_bp > cap:
+        return 0.0
+    return max(0.0, min(1.0, (cap - cargo_bp) / cap))
+
+
+def candidate_space(goal: dict, *, n: int = 200, k: int = 8) -> list[dict[str, Any]]:
+    """Enumerate candidate designs for a goal {gene, intent, cargo_bp, cell_type, cargo_function?}. Each candidate
+    is a plain dict consumable by `verify()` and carries the planner's grounded scores. Returns [] if the atlas is
+    absent.
+
+    v7.1.2: the goal's screening-relevant fields (cargo_function, cargo_seq, in_vivo, delivery_tropism,
+    replication_competent) are PROPAGATED onto every candidate so the Guardian biosecurity gate in verify() screens
+    the cargo function for each swept vehicle. Previously these were dropped here, so a hazardous cargo function
+    reached NO screen on the goal-based path."""
+    gene = goal["gene"]
+    intent = goal.get("intent") or goal.get("edit_intent") or "safe_harbour_insertion"
+    cargo_bp = int(goal.get("cargo_bp") or goal.get("payload_bp") or 3000)
+    ct = goal.get("cell_type") or goal.get("ct") or "k562"
+    write_type = _INTENT_WRITE_TYPE.get(intent, "insertion")
+    # screening-relevant goal fields propagated onto every candidate (the Guardian reads cargo_function).
+    screen_extra = {f: goal[f] for f in ("cargo_function", "cargo_seq", "in_vivo", "delivery_tropism",
+                                         "replication_competent") if goal.get(f) is not None}
+
+    from pen_stack.planner.pipeline import plan_write
+    try:
+        plans = plan_write(gene, intent, cargo_bp, ct, k=k)
+    except Exception: # atlas/data absent -> no candidates (discriminator/Pareto unaffected)
+        return []
+
+    vehicles = _compatible_vehicles(cargo_bp, in_vivo=goal.get("in_vivo"))
+    cands: list[dict] = []
+    for p in plans:
+        for veh in vehicles:
+            cands.append({
+                **screen_extra, # v7.1.2: cargo_function et al. so the Guardian screens this candidate
+                "write_type": write_type, "gene": gene, "chrom": p["site"]["chrom"],
+                "edit_intent": intent, "writer_family": p["writer"], "cargo_bp": cargo_bp,
+                "cell_type": ct, "delivery_vehicle": veh,
+                # grounded planner scores (model_extra) -> verify() calibrated confidence + downstream:
+                "safety": p["safety"], "p_durable": p["durability"], "writer_activity": p["writer_activity"],
+                "on_target": p["on_target"], "reachability_tier": p.get("reachability_tier"),
+                "deliverability": deliverability_score(veh, cargo_bp),
+                "_planner_score": p["score"],
+                "provenance": {**p.get("provenance", {}), "candidate_space": "v5.8 plan_write x delivery palette"},
+            })
+            if len(cands) >= n:
+                return cands
+    return cands
+
+
+def vehicle_sweep(goal: dict, *, n: int = 200) -> list[dict[str, Any]]:
+    """Atlas-FREE candidate enumeration: sweep the compatible delivery vehicles for the goal WITHOUT planner
+    scores. Used when the writability atlas has no coverage for the requested cell type (e.g. cd8_t / pbmc /
+    h1_hesc), so `candidate_space` (which needs `plan_write`) yields nothing.
+
+    Each candidate carries the goal's cargo_function (so the Guardian still screens it), the cargo size (so the
+    capacity rules still filter oversize vehicles), and NO safety/p_durable/writer_activity (so verify() honestly
+    ABSTAINS on the calibrated confidence rather than inventing one). The legality + biosecurity discrimination is
+    fully exercised; only the calibrated-confidence column is left uncomputed (and labelled as such in the UI)."""
+    intent = goal.get("intent") or goal.get("edit_intent") or "safe_harbour_insertion"
+    cargo_bp = int(goal.get("cargo_bp") or goal.get("payload_bp") or 3000)
+    ct = goal.get("cell_type") or goal.get("ct") or "k562"
+    write_type = _INTENT_WRITE_TYPE.get(intent, "insertion")
+    screen_extra = {f: goal[f] for f in ("cargo_function", "cargo_seq", "in_vivo", "delivery_tropism",
+                                         "replication_competent") if goal.get(f) is not None}
+    cands: list[dict] = []
+    for veh in _compatible_vehicles(cargo_bp, in_vivo=goal.get("in_vivo")):
+        cands.append({
+            **screen_extra,
+            "write_type": write_type, "gene": goal.get("gene"), "chrom": goal.get("chrom"),
+            "edit_intent": intent, "cargo_bp": cargo_bp, "cell_type": ct, "delivery_vehicle": veh,
+            "deliverability": deliverability_score(veh, cargo_bp),
+            "provenance": {"candidate_space": "v7.1.2 atlas-free vehicle sweep "
+                           "(no measured writability atlas for this cell type; confidence abstains)"},
+        })
+        if len(cands) >= n:
+            break
+    return cands

{pen_stack-7.1.2 → pen_stack-7.1.3}/pen_stack/safety/registry.py

@@ -12,6 +12,7 @@ sequence still carries a hazardous FUNCTION annotation, and function, not homolo
 """
 from __future__ import annotations
 
+import re
 from dataclasses import dataclass, field
 from typing import Any, Callable
 
@@ -27,6 +28,26 @@ def _norm(s: Any) -> str:
     return str(s or "").strip().lower()
 
 
+def _sep_norm(s: Any) -> str:
+    """Lowercase and collapse separator runs (whitespace / hyphen / underscore) to a single space, so
+    "furin-cleavage", "furin_cleavage" and "furin cleavage" are one token. Keeps the matcher robust to the
+    hyphen/space/underscore variation that is ubiquitous in free-text function descriptions."""
+    return re.sub(r"[\s_\-]+", " ", _norm(s)).strip()
+
+
+def _kw_match(kw: str, text: str) -> bool:
+    """Separator-insensitive, word-boundary keyword match (v7.1.2). Two failure modes of a plain substring test:
+    (1) over-broad - the short ricin keyword "rip" matches inside "transc-RIP-tion", a word in almost every
+    genome-editing design, so a benign promoter cassette would false-refuse as ricin; (2) too-narrow - a
+    hyphenated "furin-cleavage" would slip past the space-form keyword "furin cleavage". Normalising separators
+    then matching on alphanumeric boundaries fixes both: "rip" matches "RIP" standalone but not inside a longer
+    word, and "furin cleavage" / "furin-cleavage" / "furin_cleavage" all match."""
+    k = _sep_norm(kw)
+    if not k:
+        return False
+    return re.search(r"(?<![a-z0-9])" + re.escape(k) + r"(?![a-z0-9])", _sep_norm(text)) is not None
+
+
 def _design_function_tokens(design: dict) -> set[str]:
     """Normalised function annotations declared on a design (NOT free-text justification)."""
     toks: set[str] = set()
@@ -57,6 +78,7 @@ class HazardRegistry:
     regulated_taxa: list[dict] = field(default_factory=list)
     controlled_functions: list[dict] = field(default_factory=list)
     chimera_rules: list[dict] = field(default_factory=list)
+    oncogenic_manipulation: dict = field(default_factory=dict)
     external_enabled: bool = False
     external_hook: Callable[[str], list[ScreenHit]] | None = None
 
@@ -71,6 +93,7 @@ class HazardRegistry:
             regulated_taxa=raw.get("regulated_taxa", []),
             controlled_functions=raw.get("controlled_functions", []),
             chimera_rules=raw.get("chimera_rules", []),
+            oncogenic_manipulation=raw.get("oncogenic_manipulation", {}),
             external_enabled=external_hook is not None,
             external_hook=external_hook,
         )
@@ -88,7 +111,7 @@ class HazardRegistry:
         pfam = _design_pfam(design)
         for entry in self.toxin_functions + self.controlled_functions:
             by_pfam = pfam & {_norm(p) for p in entry.get("pfam", [])}
-            by_kw = {kw for kw in (entry.get("keywords") or []) if any(_norm(kw) in t or t == _norm(kw) for t in toks)}
+            by_kw = {kw for kw in (entry.get("keywords") or []) if any(_kw_match(kw, t) for t in toks)}
             if by_pfam or by_kw:
                 ev = {}
                 if by_pfam:
@@ -100,6 +123,47 @@ class HazardRegistry:
                                       provenance=self._prov(entry), evidence=ev))
         return hits
 
+    def oncogenic_flags(self, design: dict) -> list[ScreenHit]:
+        """Oncogenic-manipulation PATTERN screen (v7.1.2). Flags the COMBINATION that a flat keyword list misses:
+        a tumor-suppressor gene with a disruptive verb, an oncogene with an activating signature, or an
+        immortalization signature. The asymmetry spares therapy without an allow-list (restoring a suppressor /
+        silencing an oncogene matches neither). Escalates to human review (dual-use, legitimate cancer-model path)."""
+        cfg = self.oncogenic_manipulation
+        if not cfg:
+            return []
+        # screen the declared function annotations only (the artifact, not any free-text justification)
+        text = " " + " | ".join(sorted(_design_function_tokens(design))) + " "
+        if not text.strip(" |"):
+            return []
+
+        def has(keys: list[str]) -> list[str]:
+            return [k for k in (keys or []) if _norm(k) in text]
+
+        supp = has(cfg.get("tumor_suppressors"))
+        onco = has(cfg.get("oncogenes"))
+        disrupt = has(cfg.get("disrupt_verbs"))
+        activate = has(cfg.get("activate_signatures"))
+        immortal = has(cfg.get("immortalization"))
+        therapy = has(cfg.get("therapy_context"))
+
+        reasons = []
+        if supp and disrupt:
+            reasons.append(f"tumor-suppressor disruption ({supp[0]} + {disrupt[0]})")
+        if onco and activate:
+            reasons.append(f"oncogene activation ({onco[0]} + {activate[0]})")
+        if immortal:
+            reasons.append(f"immortalization signature ({immortal[0]})")
+        if not reasons:
+            return []
+        # therapeutic restoration / supplementation with NO disruptive/activating/immortalization signal -> clear.
+        if therapy and not (disrupt or activate or immortal):
+            return []
+        return [ScreenHit(kind="oncogenic_flag", detail=cfg.get("name", "oncogenic manipulation"),
+                          severity=cfg.get("severity", "medium"), provenance=self._prov(cfg),
+                          evidence={"patterns": reasons,
+                                    "suppressor": supp[:2], "oncogene": onco[:2], "disrupt": disrupt[:2],
+                                    "activate": activate[:2], "immortalization": immortal[:2]})]
+
     def taxon_flags(self, design: dict) -> list[ScreenHit]:
         """Regulated-pathogen-TAXON screen (Select Agent / Australia Group membership by declared source)."""
         hits: list[ScreenHit] = []
@@ -121,8 +185,9 @@ class HazardRegistry:
         hits: list[ScreenHit] = []
         rules = {r["id"]: r for r in self.chimera_rules}
 
-        has_toxin = bool(self.function_flags(design)) or _norm(design.get("cargo_function")) and any(
-            _norm(kw) in _norm(design.get("cargo_function")) for e in self.toxin_functions for kw in (e.get("keywords") or []))
+        cf = _norm(design.get("cargo_function"))
+        has_toxin = bool(self.function_flags(design)) or bool(cf) and any(
+            _kw_match(kw, cf) for e in self.toxin_functions for kw in (e.get("keywords") or []))
         broad = _norm(design.get("delivery_tropism")) in {"broad", "broad_systemic", "systemic"} or \
             _norm(design.get("delivery_vehicle")) in {"aav9", "aavrh10"}
         replicating = bool(design.get("replication_competent"))

{pen_stack-7.1.2 → pen_stack-7.1.3}/pen_stack/safety/screen.py

@@ -15,7 +15,7 @@ from typing import Literal
 
 from pydantic import BaseModel, Field
 
-ScreenKind = Literal["sequence_homology", "function_flag", "taxon_flag", "chimera_context"]
+ScreenKind = Literal["sequence_homology", "function_flag", "taxon_flag", "chimera_context", "oncogenic_flag"]
 Severity = Literal["low", "medium", "high"]
 
 
@@ -43,6 +43,7 @@ def screen_design(design: dict, registry=None) -> list[ScreenHit]:
         design = dict(design)
     hits: list[ScreenHit] = []
     hits += reg.function_flags(design) # toxin / pathogen-essential function domains
+    hits += reg.oncogenic_flags(design) # v7.1.2 oncogenic-manipulation pattern (mechanism/synonym-robust)
     hits += reg.taxon_flags(design) # regulated pathogen taxa
     hits += reg.chimera_context(design) # hazardous assembly of benign parts
     seq = _assemble_cargo(design)

{pen_stack-7.1.2 → pen_stack-7.1.3}/pen_stack/server/api.py

@@ -440,11 +440,30 @@ def delivery_tropism_endpoint(target_tissue: str):
 @app.post("/generate", tags=["v6.1 AI surface"])
 def generate_endpoint(req: dict):
     """v5.8 generative designer: verifier-as-discriminator. Body: {goal?, candidates?, keep?}. Hazardous/illegal
-    candidates are discarded; survivors are calibrated + immune-profiled candidates (never asserted to work)."""
+    candidates are discarded; survivors are calibrated + immune-profiled candidates (never asserted to work).
+
+    v7.1.2: the GOAL'S cargo function is screened by the Guardian FIRST, before the vehicle x cargo sweep. A
+    hazardous goal (e.g. a furin-cleavage tropism-enhancement or a dominant-negative tumor-suppressor ablation) is
+    REFUSED up front and the response carries the explicit safety verdict, so an empty result is correctly
+    attributed to a biosecurity refusal (not a silent 'no candidates'). The per-candidate Guardian still runs in
+    verify() as defence in depth."""
     from pen_stack.design import generate_designs
-    return {"survivors": generate_designs(req.get("goal"), candidates=req.get("candidates"),
+    goal = req.get("goal")
+    # Guardian pre-screen on the goal's declared cargo function (the artifact, not any free-text justification).
+    if isinstance(goal, dict) and any(goal.get(f) for f in ("cargo_function", "cargo_seq")):
+        from pen_stack.safety.gate import safety_gate
+        screen = {f: goal[f] for f in ("cargo_function", "cargo_seq", "gene", "delivery_vehicle", "in_vivo",
+                                       "delivery_tropism", "replication_competent") if goal.get(f) is not None}
+        gv = safety_gate(screen, actor=str(req.get("actor", "api")))
+        if gv.decision in ("refuse", "escalate"):
+            return {"survivors": [], "refused": True,
+                    "safety": {"decision": gv.decision, "reason": gv.reason,
+                               "hits": [{"detail": h.detail, "severity": h.severity, "kind": h.kind}
+                                        for h in gv.hits]},
+                    "disclaimer": _DISCLAIMER}
+    return {"survivors": generate_designs(goal, candidates=req.get("candidates"),
                                           keep=int(req.get("keep", 25)), actor=str(req.get("actor", "api"))),
-            "disclaimer": _DISCLAIMER}
+            "refused": False, "disclaimer": _DISCLAIMER}
 
 
 @app.post("/predict", tags=["v6.1 AI surface"])