Commit History
10 days ago
-
feat(smoke): the scheduled smoke Job, and the plan's decisions
avoigt1121 +1: Claude Opus 5.5scripts/smoke_job.py creates, lists, fetches and deletes the Phase 3 smoke Job as decided 2026-10-29 (D1-D4): an HF Scheduled Job on cpu-basic in the project lead's organisation namespace (her user namespace holds lit-agent's Monday job, whose recreate script aborts on a second scheduled Job), every 3 hours, ending itself after 7 days (SMOKE_END_EPOCH), with no secret: each run clones the dev Space at a pinned sha, runs smoke_live.py in-process and prints its counts-only record behind RECORD_MARKER (new --print-record), and fetch reads the records back from the Job logs into .smoke/hf-job.jsonl. tests/test_smoke_job.py pins the spec (no secret, cpu-basic, org namespace, one Job at a time, the end guard, the pinned sha) and the log parsing. The addendum gets one sentence on the scheduled runs (plan C8); the plan records D1-D4. Slice: phase3-review-hardening/s3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>814e741 -
feat(smoke): a smoke harness against the live sources, and the week's report
avoigt1121 +1: Claude Opus 5.5scripts/smoke_live.py asks six fixed probes, reaching all six sources an endpoint uses (HGNC, Open Targets, ChEMBL, UniProt, ClinicalTrials.gov, Reactome). It runs in-process with the response cache off, so each call reaches its source, or with --target space through a deployed Space's machine endpoints. It grades every failure into a named class (the three source-error reasons, payload_error, unexpected_status, contract, too_few_rows, entity_missing, space_unreachable, unstructured), appends a counts-only record (no row content) to .smoke/results.jsonl, and --report gives the week's verdict: >= 95% of probes pass and no unstructured failure. It makes no model call: build_tooluniverse refuses to start with a provider key set. Each probe is a recorded Phase 0 scenario, so tests/test_smoke_live.py replays all six against their cassettes with sockets blocked. It also pins the grading classes, the cache bypass, the record's lack of row content and the 95% line. make smoke / make smoke-rep…84f7513
17 days ago
-
docs: name no institution in the public repo (the client's Tech Transfer rule)
avoigt1121 +1: Claude Opus 5.5Both Spaces are public. The client's sponsoring lab ruled 2026-10-21 that its technology-transfer office looks before anything public carries the institution's or the centre's name, and the contract needs written consent for either. Ten mentions in docs, docstrings and comments now say "the client" or "this agent's endpoints"; the title, card, README and UI never named either. tests/test_no_institution_name.py fails if a tracked file names them again. The paste-ready addendum in the business folder is unchanged. Comments and docs only: no behaviour change. 246 passed; host table current. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>081f1c7
18 days ago
-
fix(scripts): check_live_surface lists gradio's /_ endpoints instead of comparing them
avoigt1121 +1: Claude Opus 5.5hf_oauth makes gradio add /_check_login_status to view_api(); it is gradio's, not part of the frozen descriptor, so the first live run on the dev Space failed on it alone. Slice: phase1-knowledge-specialist-s3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>b598cb3 -
feat(scripts): check_live_surface.py — C9 against the live Space
avoigt1121 +1: Claude Opus 5.5Gate fails closed (no identity header, an unresolvable token), view_api() equals the descriptor, the caller's own identity is served, and --lookups runs one real lookup per endpoint. No payload is printed; --anonymous checks a public Space with no token at all. Slice: phase1-knowledge-specialist-s3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>6e55d2d -
docs(security): the knowledge specialist's security-review addendum (s4)
avoigt1121 +1: Claude Opus 5.5docs/security/addendum-knowledge-specialist.md, in the review's own language: the eighth component, the hosts it calls (a table generated from config/sources.yaml by scripts/render_host_table.py), identifiers-only egress, the honest no-egress-filter sentence, and the controls. tests/test_host_table.py fails if the table is stale or any number the addendum states (tools, rates, timeouts, caps, TTLs, the pinned version, the accepted findings) stops matching the code, or if a person is named. A paste-ready version for the OHSU form lives beside the review in the business folder; filing it is the project lead's. Slice: phase1-knowledge-specialist/s4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>a8943e8 -
security: D5-A — accept the 8 pillow 12.3.0 CVEs here until 2026-11-20
avoigt1121 +1: Claude Opus 5.5The project lead decided D5-A (2026-10-20): a justified acceptance in this repo only. This Space takes identifiers only and opens no caller-supplied image; the fix needs a fleet-wide gradio move (gradio 6.28.0 requires pillow<13). security/accepted-vulns.txt feeds pip-audit --ignore-vuln; the scan fails on an expired entry, and tests/test_accepted_vulns.py fails once the lock moves pillow off 12.3.0, so the acceptance cannot outlive its reason. Scan green. Slice: phase1-knowledge-specialist/s2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>17acd0c -
feat: the five knowledge endpoints, gradio_ui and frozen descriptor (s2)
avoigt1121 +1: Claude Opus 5.5- src/endpoints/: drugs_for_targets, trials_for_genes, annotate_genes, pathways_for_genes, targets_for_disease on the s1 core. Inputs validated before any call; every row and nested block (ChEMBL mechanisms, UniProt protein, HGNC mapping, disease resolution) stamped; deterministic "According to <source> (queried <date>)" narratives; unresolved inputs and structured source errors instead of guesses. - Loaded tool set narrowed 12 -> 8 once real responses were seen (HGNC gives Ensembl + UniProt ids; one batched UniProt search; Reactome's mapping is already lowest-level). The other 4 stay approved, unloaded. - 8 pinned output schemas, written from the recorded responses. - scripts/record_fixtures.py: the only live step. 11 cassettes recorded 2026-10-20 through ToolUniverse 1.5.6 (123 calls): the Phase 0 lookups Q1-Q9 plus the C1 SORD2P case and two edge cases. All Phase 0 expectations replay. - gradio_ui.py: machine gate first in every handler (x-orchestrator-token), ty…3ed6b66
19 days ago
-
feat: governed ToolUniverse core for the knowledge specialist (s1)
avoigt1121 +1: Claude Opus 5.5The repo from the pdac-spatial-agent template, plus the core every endpoint will sit on (ADR-0001, accepted 2026-10-20): - config/tools_allowlist.yaml: the memo's 28 tools by exact 1.5.6 name; the 12 the five endpoints use are the only ones loaded. - config/sources.yaml: 8 sources with hosts, licences checked 2026-10-20 (Reactome is CC0, not CC BY 4.0; DGIdb unconfirmed, so no DGIdb endpoint), TTLs, rate limits, timeouts, coverage notes. - src/tu_client.py, the only importer of tooluniverse: loads with keep_default_tools=False and load_workspace=False, refuses startup on any model-provider key, a version other than 1.5.6, an extra or forbidden tool, or ToolUniverse's own cache being on. load_workspace=False matters: with any workspace present, 1.5.6 seeds a profile that loads all 2,691 tools and reads workspace and ~/.tooluniverse .env files (found by these tests). - provenance (10 fields per row), pinned output schemas (drift = no rows), SQLite cache that keeps retr…377417d