feat(ui): collapsed 'what happened' provenance panel after every run

feat(de): surface the results-CSV schema; prompt bans schema-sniff re-reads

feat(datasets): dataset_load — execute the loading plan by dataset_id in one call

feat(de): nested-batch guard now recommends the de-confounded alternative

feat(de): default low-count gene filter pre-DESeq2 + stat-ranking prompt rule

fix(ui): scope exports to the current question's run, not the whole session

feat(upload): assemble raw counts/TPM/metadata into an h5ad inside the gate

fix(export): figures were drawn off the right edge of every PDF

feat(prompts): mouse ad-hoc data guidance (Gap 3 of the mouse-support scope)

Merge fix/de-libsize-preflight: library-size QC pre-flight in the DE tool

feat(de): sample-level library-size pre-flight in decoupler_differential_expression

feat(mouse-intake): read Carl's real Novogene metadata Excel directly

fix(enrichment): drop non-finite DE stat genes before ulm; report n_dropped_nonfinite

fix(de): apply subset_query on the DESeq2 branch too

feat(mouse): thin mouse-intake path — staging script, ENSMUSG→MGI map, nested-batch guard

fix(tools): select the contrast row positionally so top_table cannot fail the tool

fix(tools): keep top_table inside the executor's 4000-char output cap

merge: dev's n_post_analysis_reads instrumentation into the top_table fix

perf(tools): return the reporting table inline from every chain-terminating tool

Revert "perf(agent): pin results artifacts across the memory window"

feat(metrics): instrument n_post_analysis_reads to test the 808b91d claim

perf(agent): pin results artifacts across the memory window

fix(reporting): return the top table inline so the report needs no re-read

fix(planner): dataset_plan_analysis must say how to LOAD the dataset

merge: dev (cryptography 50.0.0 + run-export fix) into the step-waste branch

fix(agent,ui,prompt): cut the measured step waste, and stop mislabelling timeouts

merge: authenticated h5ad fetch + step-budget notes (feat/pseudobulk-aggregate)

fix(loaders): authenticate the h5ad fetch in decoupler_load_url_counts

merge: fix run exports crashing on non-string message content

fix(ui): normalise non-string message content so run exports arm

fix(scoring): resolve gene symbols from var; never let a sample filter no-op

fix(sc,ui): filter lowly-expressed genes after pseudobulk; sweep every output dir

feat(sc): add decoupler_pseudobulk_aggregate — the missing Path P step

fix(scoring): close the six PROGENy per-sample gaps from the GSE205154 eval

fix(tests): stop the executor shims squatting `managers` in sys.modules

fix(uploads): scan before parse; drop ungated URL/HF originals (ADR-0011)

fix(uploads): make the deployed malware-scan posture explicit and honest

feat(auth): OAuth + allow-list gate on the specialist UI (ADR-0012) (#1)

style: apply ruff lint --fix + ruff format across the tree

feat(uploads): wire ADR-0011 safety gate into the Gradio upload UI

Merge remote-tracking branch 'origin/main' into feat/sandbox-executor

feat(integrity): ADR-0010 on-load verify for GEO series-matrix loads

feat(uploads): local content scan + manifest drafting (ADR-0011)

feat(auth): ADR-0012 identity seam + identity into audit trace (Now slice)

feat(logging): ADR-0013 audit-trace redaction (secret/credential/PII scrubbing)

feat(exec): ADR-0007 Phase 2 local hardening for ContainerLauncher

feat(exec): real MCP handshake + container-launch fixes (ADR-0007 Phase 1 validation)

feat(exec): sandboxed per-session exec-kernel executor (ADR-0007 Phase 1)

feat(exec): extract Executor seam + EXECUTOR config switch (ADR-0007 Phase 0)

feat(integrity): wire ADR-0010 on-load verify + re-pin 0.1.9 (deploy slice)