AURORA Agent (bioprism)

Query-compiled inference for executable biology.

Context engineering, with receipts.

An MCP server and CLI built on the FIBER decision-context compiler: a typed decision query is compiled into the smallest decision-sufficient evidence region, delivered with a Context Certificate stating exactly what was omitted.

Implementation of the AURORA BioPRISM / OncoWorld / FIBER blueprint (v0.6, 935 registered spec modules). A Rust workspace whose central idea is that context assembly is a compiler pass: instead of retrieval plus summarisation plus vibes-based compaction, a typed decision query is compiled into the smallest decision-sufficient evidence region, delivered as a Decision Section, and accompanied by a Context Certificate that states exactly what was omitted and whether the omission could have changed the decision.

Compile the smallest decision-sufficient evidence region. Never traverse the whole knowledge structure by default.

What the measurements actually say

The reference world ships 761 facts, 750 of them exploratory distractors that all consume the same protected cohort_id hub. FIBER compiles the query down to 11 facts (1.45% of the world) and the deterministic oracle still returns the correct verdict with all four leakage witnesses.

It is not alone in doing so. Under equal tuning, a 5-hop incidence walk and a BM25 retriever at k=11 select exactly the same eleven facts. The distribution's own compare_baselines.py measures the graph baseline only at depth 7 and unbounded — the two settings where it returns everything — and reports a 69× advantage that vanishes under equal tuning. That is a strawman comparison, and correcting it is what 43.38 and 43.41 require.

So the reference world cannot tell these methods apart. crates/worldgen makes the structure a parameter and builds one that can — distractors attached near the target instead of at a hub leaf, decisive facts behind a relay chain, and distractor tags camouflaged to tokenise into the protected vocabulary:

Three distinct failure modes appear. The graph walk has no usable depth: 5–10 pull in 98% of the world and still miss every decisive witness; 11 is the first sound setting and by then it has taken everything. BM25 reaches the right verdict from a 91% protected closure — right by luck, having dropped a protected fact that happened not to matter, and raising k to 50 never recovers it. FIBER is the only admissible strategy: right verdict and full closure, at 11 facts.

That last failure is why the harness ranks on admissibility rather than verdict alone — ranking on verdict would have crowned the strategy that violated the mandatory closure and got away with it.

This does not show FIBER wins generally: the discriminating world was built to expose these modes, just as the reference world was built to expose hub expansion. The full structural family sweep has now been run — 36 cells over attachment x relay depth x tag style x distractor count — and the two formerly missing baselines are in the panel. The sweep's headline is a negative result for FIBER: a plain backward walk over the directed factor edges, closure first, is admissible in all 36 cells at exactly FIBER's fact count, so on this family admissibility and cost cannot distinguish the compiler from that walk; the fixed-basis embedding retriever, by contrast, fails every camouflaged cell at the tight budget. Full analysis: docs/FINDINGS.md. How much of the blueprint the workspace actually covers, and which sections have nothing standing in for them: docs/COVERAGE.md. The crate layout and the blueprint path: docs/ARCHITECTURE.md.

Autonomous agent process boundary

The Python SDK includes a secret-safe operator entry point for the autonomous brain:

cd python
python -m prism_sdk catalogue
python -m prism_sdk evidence-plan --domain science
python -m prism_sdk provider-status --provider openai

For keyless local development, the same boundary supports an explicit credentialless fixture: python -m prism_sdk provider-status --provider local and run --provider local --model local-model use the runtime's bounded in-memory transport; no key or network provider is contacted.

Use run with a caller-owned MCP server when you are ready to invoke a provider. Keys are accepted only through a hidden prompt or an explicitly named environment variable; they are never command line arguments, MCP arguments, plans, or persisted state. See the autonomous brain guide for model discovery, durable inventory refresh, model-selection, approval, and credential-lifecycle details.

For post-run operations, both SDKs expose digest-bound, metadata-only trace analytics through analyze_autonomous_run_trace() / analyzeAutonomousRunTrace() and the corresponding agent facade methods. The report separates measured values from unmeasured domains, aggregates provider/model failure and latency observations, and emits conservative threshold alerts; it does not infer cost, task correctness, provider health, or domain truth. Longitudinal deployments can retain validated reports through the bounded AutonomousRunAnalyticsLedger with digest-checked restore and optional CAS persistence. TypeScript and Python application facades also provide restore-before-read analytics controllers that analyze verified traces, persist accepted reports, classify duplicates/conflicts, and expose safe all-domain rollups. See the analytics section. The TypeScript facade and Python agent also provide a run-observability controller, which restores and flushes both projections and coordinates publication plus analysis from one source snapshot so registry and analytics digests cannot drift during an append race. Partial persistence is reported explicitly and never retriggers execution. When configured, its caller-owned alert sink receives only deterministic, digest-keyed threshold metadata; delivery failures are isolated from analytics and execution outcomes.

Both SDKs also expose a tenant-scoped AutonomousAuthorizationLedger and fail-closed AutonomousAuthorizationGate. Caller-issued grants can cover one or all twelve domains and explicitly scope planning, provider invocation, evidence, connectors, tools, effects, evaluation, learning, memory, trace, or analytics by tenant, actor, session, capability, risk class, expiry, and bounded use count. The ledger is restart-safe and CAS-persistable, with hash-linked metadata events and request-digest replay protection. It never accepts task text, prompts, credentials, headers, provider payloads, tool arguments, or results; authentication, grant issuance, encrypted storage, distributed leases, and external effect reconciliation remain deployment-owned. See the tenant authorization contract.

For live model calls, bind an AutonomousAuthorizationContext created from the caller's grant to LLMRuntime.invoke(), invokeStream(), collectStream(), or invokeToolLoop() (and to the high-level autonomous run options). The runtime mints a fresh, metadata-only request immediately before every provider attempt and every tool-loop turn, then checks it before credential resolution, quota reservation, observers, effect journaling, or transport. A denied domain or exhausted grant therefore cannot contact a provider, while failover and streaming retain the same tenant/session boundary. The context never carries a key, prompt, message, response, or tool result; credentials remain caller-supplied opaque handles.

The same context can be passed to AutonomousEvidenceRuntime.execute() or the reviewed evidence execution controller. It authorizes evidence_acquisition immediately before each source adapter and evaluation immediately before each evaluator callback, binding the decision to a request or receipt digest rather than a raw value. Journal replay does not reacquire or consume an acquisition grant; reevaluatePending authorizes the fresh evaluator revision separately. A refusal raises the typed authorization error before the callback and does not create a misleading failed-evidence receipt. The Python high-level acquire_evidence() facade forwards the same options, preserving least-privilege behavior across direct, reviewed, resumable, and facade entry points.

The same least-privilege process now covers the remaining durable boundaries: provider planning authorizes plan before the planner invocation; episodic recall and recording authorize memory_retrieval and memory_write; evaluator-to-bandit settlement authorizes learning; and metadata-only trace append/complete plus longitudinal analytics ingestion authorize trace_write and analytics_write. These checks use only domain and digest metadata, are propagated through cross-domain helpers, and rethrow typed authorization refusals instead of converting them into provider, memory, or persistence failures. Applications can therefore issue one twelve-domain grant for a complete run or narrow grants to each worker boundary.

The same boundary is enforced by the high-level learning surfaces, not only by the primitive brain methods: workflow and mission learning, delayed trajectory settlement, cross-domain fan-out and synthesis, automatic decision cycles, replans, and consolidated-lesson recall all authorize the final memory operation immediately before it reaches a caller-owned store. Nested runs also forward the authorization context into each exact domain, so a convenience facade cannot silently turn a permitted provider call into an unscoped memory read or evaluation write.

Status

83 crates, 538,938 lines, clippy -D warnings enforced in CI. Byte-level parity with the CPython reference runtime is enforced by test and holds across three implementations: CPython, the Rust eager path, and the Rust indexed store.

The table below is generated. It used to be hand-maintained and drifted to claiming twenty-three crates and 820 tests — the same hand-copy drift crates/devx's exit-code audit exists to catch, sitting in the README of the repository that wrote the audit. Regenerate it, and the test count, with:

tools/status.sh --tests

The Blueprint column is derived rather than declared: it lists the sections whose module ids a crate actually cites in its own source, using the token rule tools/coverage.sh runs. A crate that stops citing a section drops it here without anyone remembering to edit a row.

How much of the blueprint is covered, and what the remainder is: docs/COVERAGE.md and docs/BACKLOG.md. Every uncovered module carries a typed verdict in crates/residue explaining why nothing implements it.

Cross-language parity

Certificate hashes are taken over canonical bytes, so Rust and Python must agree exactly or a certificate produced by one cannot be replayed by the other. Both the Decision Section and the Certificate are byte-identical to reference/fiber_runtime/fiber_compile.py:

certificate_sha256      c0da17ffc80465258345c8a538171bfd868100cd883e9a20780a0dc5477e7ea4
decision_section_sha256 7439b2262c52c1c794b59be86d922b723a2ea5646362d529f57fb11b5f7e93ce
world_sha256            b3809731cf93040fcd8aef43deb2a552492064b49154e07ea58caa724c10cbb5

Getting there required matching CPython in two places a naive port gets wrong: repr float formatting (CPython switches to exponential at a different threshold than Rust and zero-pads the exponent) and JSON object iteration order, which the reference relies on when building leakage witnesses.

Quickstart

cargo build --release --offline

./target/release/bioprism context explain --world fixtures/fiber-v0.1/radiogenomic_world.json --query fixtures/fiber-v0.1/leakage_query.json

That prints a database-style explain plan: which passes ran and what each retained, the backend, selection ratios, omissions grouped by influence class, the oracle verdict with its witnesses, and — importantly — which passes did not run and why.

./target/release/bioprism --json context compile --world fixtures/fiber-v0.1/radiogenomic_world.json --query fixtures/fiber-v0.1/leakage_query.json --certificate-out cert.json

./target/release/bioprism context verify --certificate cert.json

Scale

Compiling from a JSON document parses the whole world on every query. Index it once instead:

./target/release/bioprism world index --world big-world.json --store big-world.bpw

--world then accepts the store directory anywhere it accepted a document, and the certificate is identical. On a one-million-fact world this takes query time from 26.5 s to 41.6 ms (638×), and compile cost becomes roughly logarithmic in corpus size rather than linear. The reasoning and the full measurements are in ADR-001.

Exit codes

Ten codes, and every failure code carries exactly one retry decision, so a caller holding nothing but the process status can decide whether to re-send. bioprism --help prints the table; --json puts the same decision in the envelope as error.retryability.

Codes 0 and 1 report a verdict rather than a failure — the checked property held, or it did not — so they publish no retry decision rather than a third state every consumer would special-case.

This is a breaking change. The registry previously had six codes, and 6–9 were all 4 compile_failed. Two of them are the reason for the split: a script reading exit 4 could not tell a policy refusal from an oracle abstention from a snapshot that had moved under it, and stale was advertised as not retryable when re-reading and re-sending the identical request is exactly what clears it. bioprism-devx's exit-code audit found both against blueprint 40.36 and now reports neither; the registry it found them in is retained there as the audit's known-positive input.

Installing (Claude surfaces)

• Claude Desktop: download aurora-agent.mcpb (prebuilt for Windows only) from the latest release and double-click it (or Settings → Extensions). Ships with the reference fixtures; the "AURORA data root" setting can point at a full checkout.
• Claude Code: this repo is a plugin marketplace — claude plugin marketplace add AURORA-NEURO/aurora-agent then claude plugin install aurora-agent@aurora (see plugins/README.md).
• VS Code: sideload aurora-agent-0.1.3.vsix from the v0.1.3 release (code --install-extension aurora-agent-0.1.3.vsix). The extension registers the MCP server with VS Code (1.101+) so Copilot agent mode can call the 264 tools, and adds workflow/autopilot/pipeline views (see editors/vscode).
• MCP registry: listed as io.github.MurariAmbati/aurora-agent on registry.modelcontextprotocol.io.
• Privacy: local program, no network, no data collection — PRIVACY.md.

Documentation

Project site: aurora-neuro.github.io/aurora-agent. The full reference lives in docs/; contribution workflow in CONTRIBUTING.md.

Autonomous workflows, with receipts

bioprism autopilot drives an instantiated workflow's mission autonomously under an explicit AutonomyGrant — the only source of authority; there is no default grant. The driver dispatches the mission in-process, classifies every failed step by its declared 40.36 retry class (terminal, retryable_after_change, retryable_as_is, or unknown), and re-dispatches only what the grant authorises, as a repair subset with rematerialised bindings. Terminal and cancelled steps are never re-dispatched; an unknown failure is never retried unless the grant explicitly opts in.

Success is never inferred: it requires full step coverage, a succeeded mission report, and — by default — a complete workflow reconciliation with valid integrity. Every drive emits a digest-sealed autopilot report chaining the grant digest, every mission and report digest, and every reconciliation digest; bioprism autopilot verify recomputes it and detects a single tampered byte. --dry-run plans attempt 1 only — no dispatch, zero writes.

bioprism workflow instantiate --workflow decision_context --mission-id demo --goal "compile and verify" --steps steps.json
bioprism autopilot grant-template --json > grant.json
bioprism autopilot run --instantiation instantiation.json --grant grant.json --report-out report.json
bioprism autopilot verify --report report.json

What it deliberately does not do: no recurrence, no MCP tool exposure of the driver itself, and no ownership of wall-clock deadlines. Grants can authorize deterministic logical-tick retry backoff; the host supplies the wait/deadline implementation. Restart is supported only through a caller-owned, metadata-only checkpoint: mission/report material is rehydrated by the host and matched by digest before the planner can continue. Full reference: docs/AUTOPILOT.md.

Autonomous research

bioprism research executes a fixed protocol over synthetic decision worlds — generate, compile and certify, equal-engineering baseline panel, then optional structural sweep, metamorphic mutation, and minimization — and writes a digest-sealed dossier, a rendered report, and figures. Findings are derived by fixed public rules and locked to level observation: a single-variant enum, so no stronger level is representable. Each finding cites the sha256 of every artifact it was derived from, and each figure's footer carries the sha256 of the exact value rendered. research verify recomputes the seal and detects a one-byte tamper; --dry-run prints the plan and writes nothing.

bioprism --json research template > request.json
  # edit request.json: research_id, question, family, distractor_points, seed
bioprism research run --request request.json --out-dir out
bioprism research verify --dossier out/dossier.json

A committed worked example lives in docs/research-example/: the discriminating family at distractor points 50/250/750, 12 steps in about four seconds, 9 findings of which 7 are negative, and 7 figures. Its headline is a negative about this repository's own compiler — FIBER is tied by directed-walk-full at every declared distractor level (both admissible at 11 facts) and is not separated in 36 of 36 sweep cells. The run is deterministic: an independent re-run reproduced it byte-identically across all nine files.

Limitations, carried verbatim in every dossier: measurement over synthetic decision worlds only; no biology, no literature or prior-work coverage, and no external-world claims; oracle review is a human gate; the sweep deliberately does not vary decision-defining knobs; and negative findings are first-class results. Full reference: docs/RESEARCH.md.

Using it from an agent

./target/release/bioprism-mcp --root .

Speaks JSON-RPC 2.0 over newline-delimited stdio. The session follows the MCP lifecycle: the client calls initialize, waits for the notifications/initialized acknowledgement, and only then calls tools or resources. fiber_compile returns the L0 decision contract — goal, verdict, what was omitted, whether the sufficiency claim holds — plus a versioned, content-addressed refinement handle, and not the evidence. An agent passes that handle to fiber_refine only when the contract is insufficient to act; the server recompiles and verifies the certificate digest before disclosing the requested layer. On the reference world L0 is ~204 estimated tokens against ~1,900 for the full section.

The invariant that makes that safe: omissions are reported at every layer, so an agent that stops at L0 still knows what it does not have. Layering hides volume, never the fact of an omission. Paths are confined to --root; absolute paths, .., and symlink escapes are refused. The shipped research-contract JSON schemas (including evaluation, release, instrument preflight, multimodal harmonization and replication, analysis qualification, and protocol-matrix receipts) and the capability catalog are available through read-only MCP resources, so a client can build valid documents and route work without reading arbitrary files. world_index previews its write unless called with confirm: true.

The repository also ships a dependency-free Python client in python/. It supports synchronous and asyncio MCP sessions, enforces the initialize/initialized lifecycle, keeps transport/protocol/remote-refusal errors distinct, bounds JSON-RPC frames, and provides thin helpers for developer_delivery_audit, developer_workbench, developer_workbench_verify, developer_workbench_import, developer_workbench_query, developer_workbench_get, ci_provider_normalize, ci_execution_evidence_audit, agent_mission, capability_discover, mission_evaluator_discover, mission_evaluator_review, mission_evaluator_replay, capability_audit, capability_dashboard, capability_route, adapter_plan, tabular_ingest, conformance_run, release_audit, operations_catalog, ops_acceptance, safety_release_gate, medical_boundary_check, biocapability_evidence_audit, bioql_compile, world_claim_check, observed_world_declare, lineage_audit, preanalytic_apply, contradiction_review, lab_plan, onco_boundary_check, onco_response_assess, onco_worldline_view, onco_classification_check, oncoworlds_identity_join, onco_outcome_analyze, oracle_combine, oracle_reference_panel, oracle_missingness, bioeval_reference_audit, evaluation_worldline_audit, evaluation_reproduction_check, evaluation_trajectory_check, routing_decide, repository_catalog, repository_bundle, repository_impact, telemetry_project, bioatlas_publication_audit, and the full fiber_compile → fiber_refine/fiber_explain/fiber_verify → projection_bundle lifecycle. Typed evaluator-candidate discovery, reviewed binding, replay, audit, dashboard, delivery, evidence, publication, adapter-plan, tabular-ingest, conformance, release-audit, operations, safety, lineage, pre-analytic, contradiction, inference-lab, oracle/evaluation, and oncology-boundary projections retain cross-domain metadata, schema-quality evidence, parity gaps, readiness gates, explicit blockers, claim prerequisites, omission accounting, publication gates, candidate refusal reasons, semantic-loss boundaries, conformance checks, fixture drift, delegated refusal state, advisory-only observations, storage promise parity, service-contract divergence, metric debt, three-way acceptance verdicts, risk-gate decision drivers, unrated dimensions, structured clinical refusal, partial aggregate release, privacy exclusions, tiered evidence ledgers, temporal leakage witnesses, reproducibility divergence, and strict release-conjunction evidence for operators and SDK callers. It is an integration foundation above the Rust kernel, not a claim that the full Python data-adapter, benchmark-statistics, or biological-format ecosystem is complete. Its authoring layer now builds digest-bound packs, decision cells, deterministic mutation plans, versioned oracle judgements, reference-panel requests, evaluation requests, and bounded FHIR JSON/NDJSON, FASTA, FASTQ, SAM, GFF3, PDB, SDF/MOL, mzML, DICOM, NIfTI, AnnData, VCF, BAM, and OME-Zarr projection audits, plus bounded heterogeneous projection batches, while leaving final health and oracle decisions to Rust. prism_sdk.ApiClient and AsyncApiClient also speak the bounded HTTP gateway described in docs/HTTP_API.md.

The Python clients also expose capability_route_plan, which composes caller-selected route candidates with authoritative mission preflight across MCP and REST. It returns a digest-bound mission and plan_digest with explicit dispatch: "not_started"; route-review and preflight blockers remain structured, and no nested domain tool is dispatched. They also expose capability_route_plan_verify, which rechecks a retained plan without dispatch; supplying the original route and selections enables full route-review replay, while a shape-only check is reported explicitly as verified_without_route_replay.

For every current or future MCP domain, the Python layer also exposes a schema-aware fallback: tool_catalogue() snapshots the live definitions, plan_tool() performs bounded transport-shape preflight, and tool_checked() executes only after that review. This does not claim domain validity or suppress refusals; unsupported schema features remain visible as warnings. Mission requests can additionally pass through mission_preflight() for digest-bound graph, wave, binding, authorization, and per-step schema review before the Rust mission executor is called. The executor is serial by default; an explicit execution_mode: "parallel_waves" policy dispatches independent wave members concurrently with bounded width and reserved output budget. Executed missions also return a deterministic clock-free trace of lifecycle, wave, step, refusal, block, digest, and byte-accounting transitions. Mission requests can additionally provide bounded caller-authored claim_requests; terminal reports then include a non-semantic claim_lineage projection that maps each claim to explicit step results, retained-output digests, omission states, and durable non-claims. The HTTP gateway exposes the same projection at /v1/missions/{mission_id}/claims, and the Python/TypeScript clients provide typed helpers for it. claimable describes retained evidence posture only: it never means the claim is true or release-ready. Claims can also declare explicit evaluator/adapter bindings to source-step output pointers; coverage and pointer/refusal/omission posture are reported separately, so every domain can plug in a named evaluator without giving the orchestration layer semantic authority. Multiple retained evaluator outputs also expose canonical-digest agreement/disagreement as an explicit witness, never as an automatic adjudication. Retained outcomes also distinguish refused, blocked, cancelled, output-omitted, pointer-missing, and successful evaluator rows, including output source/type/size and digest groups. A ready mission_evaluator_review can be supplied back as evaluator_review; agent_mission rechecks its catalogue digest and exact binding rows before any nested call, then preserves review provenance in the report and claim lineage. The Rust executor also performs bounded authoritative JSON Schema preflight against the live tools/list definitions: static arguments are checked before a mission is accepted or planned, and bound arguments are checked again after upstream payloads are materialized, before either serial or parallel nested dispatch. Refusals include the schema digest and bounded JSON-pointer diagnostics, so malformed calls cannot be mistaken for domain-level refusals or successes. The HTTP gateway adds bounded asynchronous mission jobs with typed status polling and cooperative cancellation between nested calls or parallel batches; a cancellation report records what completed and what was never dispatched rather than implying force-kill or rollback. POST /v1/missions/preflight provides the matching synchronous handoff: it validates the original execution policy and static schemas, returns the authoritative digest-bound plan, and forcibly marks dispatch as not_started. It never creates a job or invokes a domain tool. GET /v1/missions provides a bounded deterministic inventory with status filtering, lifecycle links, and step/refusal/byte summaries without returning unbounded terminal reports.

For browser and Node consumers, typescript/ provides the corresponding dependency-free Fetch client. It enforces request/response bounds, timeout and abort semantics, typed API errors, SSE cursor parsing, webhook outbox lifecycle, and typed facades for the evidence, BioAtlas, OTLP, runtime, bioethics, and developer-delivery workflows. See docs/TYPESCRIPT_SDK.md for the compatibility, workbench, mission, secret-handling, and schema-aware full-catalogue invocation contract. toolCatalogue() and planTool() make arbitrary domain calls reviewable before toolChecked() executes them; missionPreflight() extends that review across dependency graphs, bindings, and execution policy before agentMission() is sent. Remote refusals remain visible rather than becoming success. missionFromRoute() connects the generic capability catalogue to that review while keeping candidate selection and arguments explicit.

The repository ships bioprism-api for deployments that need a network boundary:

cargo run -p bioprism-api -- --root . --bind 127.0.0.1:8787 --token <visible-token> \
  --mission-state .local/mission-state.json --mission-queue-state .local/mission-queue.json \
  --event-state .local/event-state.json \
  --reconciliation-state .local/reconciliation-state.json

It exposes the exact MCP tool catalogue through REST and JSON-RPC, bounded health/capability routes, cursor-addressable event pages/SSE snapshots, receipt-correlated event queries, signed webhook outbox registration, retry, and acknowledgement. --mission-state adds an optional bounded, atomic checkpoint for mission status, progress, traces, and size-limited result metadata; interrupted queued/running missions are marked failed after restart instead of being falsely resumed. Mission checkpoints emit schema 2 with a content SHA-256 state_digest; schema-1 snapshots are accepted for migration and rewritten after startup, while tampered schema-2 state is rejected. Persistence status reports both the digest and observation-time integrity_verified state. --mission-queue-state adds a separate content-addressed factory checkpoint for mission leases, idempotency class, attempts, staged/committed output boundaries, and explicit startup recovery. --mission-queue-max-jobs and --mission-queue-max-active-leases add explicit local queue backpressure; the queue status reports per-resource-class fair-share limits and observed lease occupancy. Each lease attempt is also a fencing token, preventing stale attempts from committing after recovery. The queue checkpoint is now an execution-authority envelope: queue state and a bounded hash-chained transition journal are atomically replaced together, and cooperating API processes sharing the same local filesystem serialize mutations through a bounded lock. Status reports both the queue digest and authority digest, revision, event count, lock state, and integrity result. POST /v1/missions/queue/authority/release-lock is an attributed, audited operator override for a lock whose owner is known to be gone. This is local shared-file coordination; it does not provide tenant isolation, multi-host consensus, or network-partition tolerance. GET /v1/missions/queue exposes that queue projection without returning the original mission specification. Expired idempotent work is requeued and ambiguous non-idempotent work is quarantined, but no recovered job is automatically dispatched; the authority is a local recovery and audit boundary, not multi-host scheduling, provider authentication, or proof of external effect completion. --event-state checkpoints retained events, subscription metadata, and signed pending outbox rows while never persisting webhook secrets; the current schema-5 checkpoint is content-addressed with a SHA-256 state_digest, and startup rejects tampering before restoring rows. It also retains a bounded, cursor-addressable delivery-attempt journal for enqueue, send, retry, replay, acknowledgement, and secret-rebind outcomes without claiming receiver state beyond explicit worker acknowledgement; receipt-bearing attempts also retain the validated receipt ID and content digest for exact joins. Schema-1 through schema-4 checkpoints remain readable for migration and are upgraded on the next flush. Restored subscriptions pause until an explicit in-memory /rebind call. It deliberately reports gRPC, TLS termination, distributed scheduling, and external delivery as absent rather than inferring them from an HTTP listener. GET /v1/recovery and the Python/TypeScript recovery_matrix/recoveryMatrix helpers provide one operator matrix that keeps mission restoration, event rows, subscription metadata, pending outbox evidence, delivery-attempt provenance, secrets, and external effects separate. The GET /v1/operations/snapshot?after=N&limit=M route and matching typed SDK helpers compose that matrix with one bounded event page, event metrics, mission status counts, persistence digests, capability transport flags, exact domain-group/tool coverage, and actionable operator follow-ups. The same snapshot includes reconciliation_summary plus reconciliation checkpoint status: stored report counts are split into completion statuses, structural-ready rows, explicit review requirements, integrity-invalid rows, and evidence-invalid rows. These are derived audit counters only; they do not authorize execution or upgrade a domain, scientific, clinical, safety, or release claim. The summary also carries a per-workflow status matrix and distinct workflow count, so the cross-domain view cannot hide an unobserved or failed capability group inside one aggregate. The domain projection compares the authoritative workspace capability groups with the advertised tool catalogue, preserving missing names and omission counts without inferring semantic readiness. It is designed as a dashboard bootstrap and handoff surface: it never returns unbounded mission reports, executes no tools, and does not turn local observations into scientific validity, receiver acceptance, or automatic recovery claims. The event cursor remains authoritative, so consumers should persist recent_events.next_after and inspect gap before declaring continuity. POST /v1/operations/handoff turns caller-selected domains or capability groups into a content-addressed, non-executing capability_route request. It preserves unresolved selectors, catalogue gaps, complete-group omissions, and explicit next steps through capability review and mission preflight; it never dispatches the generated route or authorizes execution. GET /v1/operations/domains?after=N&limit=M adds bounded local activity observations per capability group, allowing operators to distinguish catalogued-but-unobserved tools from tools that actually emitted events in the requested cursor page. This is activity evidence only, not runtime, scientific, safety, or release readiness. GET /v1/operations/gates?after=N&limit=M turns the same bounded page into separate catalogue, activity, transport-completion, pooled evaluation, domain-evaluator, safety, and release evidence gates for every capability group. Domain-evaluator evidence is bound to a completed evaluation tool by exact name or the workspace catalogue; it does not assert scientific validity, evaluator calibration, or independence. A completed local call is never promoted into a readiness verdict: groups remain catalogue_blocked, insufficient_evidence, or review_required, with readiness_claimed: false. Each group also carries gates.reconciliation_evidence, joined only by the exact capability-group workflow_id against the bounded digest-valid reconciliation registry. missing means no retained matching report and never passes by inference; incomplete or invalid retained posture forces insufficient_evidence; structurally_ready remains review-required evidence and is never a release, safety, clinical, or scientific authorization. The summary exposes groups_reconciliation_blocked, and the same posture is typed by the Python and TypeScript SDKs, so all currently advertised workspace groups receive the same fail-closed join contract. The same gate response now carries an advisory gates.artifact_evidence posture for every group. It counts only records already admitted to the digest-verified artifact registry, matching explicit registration domains after case normalization or an artifact body's explicit group_id; it never infers membership from subjects, kind names, or free text. The posture reports artifact families, verification states, parent-linked records, match basis, and registry generation/size. Missing artifact evidence remains visible but is not a required gate and cannot change gate_state or create readiness. Python exposes a typed OperationsArtifactEvidencePosture with an explicit legacy-response fallback, and TypeScript exposes the corresponding group/summary posture fields. Handoffs now carry an operations_gate_acceptance execution prerequisite; preflight binds the mission’s exact tools to matching capability groups and the current gate_digest, while executable HTTP missions are refused until an operator acceptance covers every required gate for every group. Operators can persist that acceptance through POST /v1/operations/gate-reviews and replay it by content-addressed review_id; executable missions require the retained review record to survive the same event checkpoint and still match current evidence. Accepted executable missions retain a bioprism-mission-execution-provenance/0.1 projection in mission status, inventory, and /v1/missions/{mission_id}/provenance. It correlates the review, gate digest, domain-evaluator evidence, bounded preflight projection, and the accepted-dispatch event; mission checkpoints retain it when mission_state_path is configured. It is an audit and replay boundary, never a readiness or scientific-validity claim. GET /v1/webhooks/subscriptions/{id}/attempts route and matching SDK helpers expose the provenance cursor with explicit retention gaps and dropped-row accounting. Receipt-bearing rows are also available through /v1/delivery-receipts/{receipt_id}/attempts, which joins the same evidence across subscriptions without claiming external receiver state. Embedded Rust consumers can plug an egress-controlled DeliverySender into ApiRouter::deliver_once(...) to acknowledge successful signed webhook sends and classify bounded retryable/permanent failures without giving the gateway arbitrary network access. Delivery pages expose pending, retryable, failed, exhausted, and secret_rebind_required state with the last transport error; POST .../{id}/replay is an explicit operator reset that preserves the delivery ID, resets the attempt budget, and re-signs without claiming delivery. The serving path uses one immutable shared router across connection threads, atomically allocates request IDs, and clones ready MCP dispatch sessions per request. Mission, event, subscription, and delivery state remain independently bounded and synchronized, so unrelated domain calls do not serialize behind a global router mutex.

The same server exposes the broader workspace: world_validate checks a world before compilation, context_compare runs the equal-engineering baseline panel, bioworlds_catalog runs the reference vertical slices, modality_catalog exposes assay resolution and failure-mode contracts, modality_support_check evaluates typed claim eligibility and analysis-unit independence across the 17 modality families; modality_transport_check reports loss and fidelity, and modality_comparability_check preserves modality-first refusals, and literature_bind_check binds source claims to typed populations and historical horizons while keeping citation support separate from biological measurement support; reviews cannot be silently laundered into primary evidence, unstated populations refuse, and flagged sources require a recorded warrant, mutation_family validates metamorphic families with effective diversity, prism_minimize reduces and re-checks a diagnostic world, registry_gate fail-closes attested benchmark packs, registry_lifecycle_simulate replays the local content-addressed publication lifecycle with continuation state, append-only events, supersession, withdrawal, promotion, demotion and integrity verification, operations_catalog executes the local/team topology parity and service-contract audit while keeping undefined metrics explicit, capability_rank compares serialized metric vectors without collapsing holes or trade-offs and can apply a declared weighting with sensitivity evidence, while research_ci_check runs the claim, split, figure, regression, environment, egress, non-claim and provenance predicates, metrics_profile_audit emits per-capability leaders, measured populations, missing systems and uncontested-lead warnings for public-card construction without inventing a scalar score, biocapability_evidence_audit composes metric profiles with explicit evidence states across grounding, information acquisition, resource efficiency, temporal validity, cross-modal agreement, causal identification, reproducibility, translation maturity, and multi-agent coordination. It validates support fields, blocks future evidence and unknown dimensions, keeps declared evidence visible without counting it as measured, and releases only explicitly requested claims whose required dimensions are eligible; optional information-value, reference-distribution, worldline, and reexecution subaudits remain bounded projections rather than biological truth or clinical inference, cache_invalidation_simulate rebuilds typed cache keys and replays dependency-aware invalidation, partial unknown regions, fail-closed lookup misses and explicit re-proving, while storage_lifecycle_simulate plans pin-aware hot/warm/cold tiering and non-copyable quota delegation with reserve-protected accounting, policy_screen enforces caller-supplied policy rules before selection and preserves typed refusals, safety_posture reports section-13 threat populations without claiming runtime enforcement, and safety_release_gate applies the complete dual-use risk gate with unrated dimensions still blocking, hub_search performs bounded federated exact-facet discovery with typed authority, tier, digest, freshness, and near-miss provenance, measurement_compare checks standards declarations without silent unit or ontology coercion and returns typed conversion receipts and first blocking reasons; governance_schema_check checks the shipped schema contracts, medical_boundary_check admits research use cases and structurally refuses clinical outputs, tabular_ingest runs the real CSV/TSV adapter with independent conformance and loss accounting, observed_world_declare seals pinned observed-world declarations, world_claim_check enforces the provenance claim ladder, hub_resolve resolves a federated pack request with digest and freshness provenance, hub_lock builds a transitive provenance-preserving dependency lock, safety_posture reports residual threat populations, and security_redteam_simulate replays the section-13 safety loop across confirmed-finding regression cells, sequential vulnerability disclosure, evaluator/artifact trust boundaries, across-trial feedback paths, incident blast-radius containment gates, forensic timelines, hash-linked audit records, and observed-versus-asserted attestations. It keeps the crucial nonclaims beside every result: this is a bounded contract simulation, not a fuzzer, runtime sandbox, detector, credential revoker, incident channel, containment executor, notification service, or durable audit store. weave_protocol_catalog exposes typed agent-act antecedents. bioatlas_publication_audit composes atlas coverage, optional evidence-conditioned claim readiness, moderation/card rendering, and leaderboard ranking into explicit publication targets. It keeps atlas holes, withheld scores, unranked entries, and absent evidence visible; numeric public scores require both the disclosure-gated card result and an evidence audit, and no release claim is emitted without an explicit target request. It remains an in-memory contract workflow rather than a web publisher, identity service, assay runner, leakage detector, scientific truth oracle, or clinical approval. bioethics_action_review partitions research plans from physical actions and only produces an external referral after both required human approvals are present; bioethics_human_subject_screen keeps institutional review, consent, and return-of-results checks separate; bioethics_dual_use_review adds an explicit misuse-surface assessment in front of the section-13 release gate; bioethics_validation_check audits evidence completeness and independent reproduction; and bioethics_representation_audit preserves unmeasured and small-cell-suppressed strata while refusing attribution across unmatched resource context. influence_analyze computes caller-scoped numeric influence bounds over declared factor regions, defaults to structural-only analysis, and keeps unknown preconditions distinct from vacuous bounds. The Python and TypeScript SDKs expose the same factor-region request and report boundary, including hard budgets, attempted-method provenance, exact versus conservative validity, and typed unknown reasons; they never turn an uncomputable influence into infinity or a fabricated numeric bound. routing_decide selects only among an explicitly approved architecture panel, abstains on weak coverage or margins, and refuses held-out evidence leakage when a task identity is supplied; the Python and TypeScript SDKs preserve the selected architecture, structured abstention reason, considered panel, neighbourhood evidence, confidence score, and holdout check without treating a safe-default abstention as a routing win; token_context_plan checks mandatory token closure, dry-run restricted-data privacy, and policy-only comparisons while preserving estimator provenance; bioql_compile type-checks explicit biological schemas for units, frames, builds, clocks, labels, provenance, and cost bounds without executing a query; weavelang_compile compiles source to deterministic WeaveIR and can inspect or replay its local semantics, with replay as the default and world-mutating transitions refused. projection_bundle derives graph, hypergraph, timeline, and table views from the same compiled section and certificate, preserving provenance, fidelity, and unresolved-obstruction coverage; view bodies are opt-in and are never treated as proof. lens_catalogue exposes the implemented section-42 questions, evidence requirements, scope preconditions, and declared refusals before a run; lens_leakage_check executes the typed cohort leakage lens with sealed nonvisual witness rows, explicit underdetermination, and no split repair. choreography_check checks serialized multiparty protocols, projects every role, and preserves bounded or inconclusive model-checking results; conformance_run verifies shipped fixture digests before running the FIBER suite and returns its noncompensatory release decision. provider_capability_gate gates runtime/provider claims on passed correctness and security evidence, keeps performance values as measurements without invented thresholds, and marks cross-provider comparisons indeterminate when either side is untested. The Python and TypeScript SDKs expose the same evidence boundary with typed claim states, gate outcomes, run witnesses, measurement counts, and differential drift; a cleared gate never implies that runtime execution occurred or that unmeasured capabilities are safe. scale_family_split_verify verifies imported benchmark tiers against lineage roots and refuses family straddles; stewardship_review_check concludes evaluator reviews only when mandatory dimensions, corpus support, and independence hold, keeping unreviewed dimensions explicit. quality_gate_run preserves pass, fail-with-witness, and not-runnable data-quality outcomes; the Python SDK exposes typed witnesses, not-runnable reasons, check-level outcomes, and the separate failed-versus-obstructed verdict sets, while TypeScript preserves the serialized gate/check union and report shape without turning an indeterminate run into a pass; ledger_ingest appends bitemporal events while exposing quarantine, idempotency, causal release, hash-chain, clock-anomaly, temporal-cut, and digest-only projection state; the Python and TypeScript SDKs preserve those admission, release, and projection witnesses without implying durable storage or a live clock. fabric_synthesize evaluates typed agent-composition candidates against hard effects, privacy, budget, assurance, and terminal-state constraints, then returns the rejection map and Pareto frontier without inventing a weighted winner. interweave_workflow_catalogue exposes the six reference workflows and derives their 54 owed deliverables from the typed catalogue, keeping specification inventory separate from artefact availability. epistemic_voi prices explicit evidence actions and non-adaptive bundles while keeping gross risk reduction, declared cost, net value, action changes, complementarity, and exhaustive limits visible; the Python and TypeScript SDKs expose the same boundary with typed problem, belief, acquisition, value, bundle, action-identity, and fail-closed refusal projections; epistemic_adaptive_acquisition extends that boundary with an exact finite-horizon policy tree: each outcome can stop or choose a different unused acquisition, while expected terminal risk, expected scalarized cost, posterior branches, state caps, conditional-independence assumptions, and fail-closed refusals remain visible; it plans only and never executes an acquisition or claims causal, clinical, biological, or predictive truth. See docs/EPISTEMIC_ADAPTIVE_ACQUISITION.md; epistemic_adaptive_execute is the explicit next boundary: it requires a plan-scoped provider grant, validates one provider outcome against the selected branch at a time, preserves partial and refused prefixes, and replays through a receipt-only executor with no live fallback. The built-in MCP adapter is simulation-only and labels its rows simulated; Python and TypeScript expose typ