Merge pull request #63 from rsolerortuno/agent/codex/507-v0-5-real-release-closure

Close the reproducible v0.5.0 DepMap workflow

Author: rsolerortuno

contexts/melanoma_anti_pd1/release/real_run_config.template.json

@@ -0,0 +1 @@
+{"configuration_format_version":"v0.5.0","evidence_classification":"local_real_public_release","release_manifest":"REPLACE_WITH_LOCAL_RELEASE_MANIFEST.json","data_root":"REPLACE_WITH_LOCAL_DATA_DIRECTORY","target_subset":"REPLACE_WITH_TARGET_SUBSET.tsv","benchmark":"REPLACE_WITH_BENCHMARK.tsv","discovery_sources":"REPLACE_WITH_DISCOVERY_SOURCES.tsv","discovery_policy":"REPLACE_WITH_DISCOVERY_POLICY.json","universe_context":"REPLACE_WITH_UNIVERSE_CONTEXT.json","profile_context":"REPLACE_WITH_PROFILE_CONTEXT.json","profile_policy":"REPLACE_WITH_PROFILE_POLICY.json","baseline_ranking":"REPLACE_WITH_EXPLICIT_REAL_BASELINE.tsv","benchmark_policy":"REPLACE_WITH_BENCHMARK_POLICY.json","integration_policy":"REPLACE_WITH_INTEGRATION_POLICY.json","integration_context":"REPLACE_WITH_INTEGRATION_CONTEXT.json","release_policy":"REPLACE_WITH_RELEASE_POLICY.json","expected_context_identity":"melanoma_anti_pd1:v1","limitations":["Template only: replace every placeholder after human provenance review.","This file is not a completed real-data run."]}

docs/audits/v0.5.0_release_closure_current_state.md

@@ -0,0 +1,20 @@
+# v0.5.0 release-closure current-state audit
+
+Reviewed surfaces: the Issue 501–506 specifications and audits, canonical
+`targetintel.functional_dependency` modules, melanoma context package,
+existing release documentation, benchmark baseline fixture, and existing
+DepMap local-layout and checksum contracts.
+
+Findings: ingestion is local-only and validates release-manifest bytes;
+profiles, universe freezing, benchmark evaluation, and integration are
+separate APIs. Issue 506 already keeps its overlay diagnostic and defaults to
+the baseline, but its activation state is not a module-release decision.
+Fixture manifests are visibly synthetic in their release identifiers and
+limitations, but a release-level classification boundary was previously
+absent. No existing module creates tags or changes production scoring.
+
+Issue 507 addresses the gap with explicit evidence classification, strict
+configuration and policy contracts, preflight, stage orchestration, baseline
+preservation checks, and separately retained module and activation readiness.
+The included execution is synthetic fixture validation only; it is not a real
+DepMap release or melanoma finding.

docs/releases/v0.5.0.md

@@ -0,0 +1,21 @@
+# v0.5.0 — functional-dependency release closure architecture
+
+Implemented architecture: local-only release preflight, immutable run and
+policy identities, deterministic orchestration of Issues 501–506, explicit
+release criteria, baseline-preservation recording, and deterministic artifact
+comparison.
+
+Fixture validation: compact synthetic fixtures exercise the complete workflow
+and end in `blocked_fixture_evidence`. They do not establish real melanoma
+findings, real-data readiness, or candidate activation.
+
+Real-data execution status: no completed real-data run is included in this
+repository. A valid human-reviewed local public release may become eligible
+for research-preview human review only after its required criteria and
+reproducibility review pass. Candidate activation remains separately governed
+by Issue 506 and is never automatic.
+
+Remaining human actions include provenance and licensing review, benchmark and
+holdout review, unresolved-target review, reproducibility review, a separate
+module-release decision, a separate candidate decision, and any manual tag or
+later public release metadata update.

docs/specs/v0.5.0_real_data_release_closure.md

@@ -0,0 +1,22 @@
+# v0.5.0 real-data release closure
+
+Issue 507 adds an offline orchestration boundary around the Issue 501–506
+functional-dependency contracts. It requires an immutable, checksum-derived
+run configuration and a local release manifest before any scientific stage is
+run. Local paths are operational references and are excluded from scientific
+identity.
+
+The module release decision is distinct from the Issue 506 candidate activation
+decision. A real, release-pinned and reproducible run may be submitted for
+human research-preview review while its candidate overlay remains blocked.
+Neither state activates production ranking, creates authorization, creates a
+tag, or changes package metadata.
+
+The only evidence classifications are `synthetic_fixture`,
+`local_real_public_release`, and `externally_validated_real_release`. Fixture
+manifest identities cannot be relabelled as real. Missing, malformed, remote,
+credential-bearing, or hidden-reasoning configuration inputs fail closed.
+
+Use `examples/depmap/run_v0_5_release_closure.py` with an explicit reviewed
+configuration. The supplied context template is intentionally incomplete and
+is not evidence of a completed real-data run.

examples/depmap/README.md

@@ -84,3 +84,14 @@ python examples/depmap/run_dependency_integration_gate.py \
   --evidence-scope synthetic_fixture \
   --output-dir /tmp/targetintel-dependency-integration
 ```
+## v0.5.0 release closure
+
+The local-only closure runner orchestrates the isolated functional-dependency
+stages and never changes production ranking or creates a release. The compact
+fixture is deliberately blocked as synthetic evidence:
+
+```bash
+python examples/depmap/run_v0_5_release_closure.py \
+  --run-config tests/fixtures/depmap/release_closure/run_config.json \
+  --evidence-classification synthetic_fixture --output-dir /tmp/targetintel-v050-closure
+```

examples/depmap/run_v0_5_release_closure.py

@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+"""Run the local-only v0.5.0 DepMap release-closure workflow."""
+from __future__ import annotations
+import argparse
+from pathlib import Path
+import sys
+
+PROJECT_ROOT = Path(__file__).resolve().parents[2]
+if str(PROJECT_ROOT) not in sys.path:
+    sys.path.insert(0, str(PROJECT_ROOT))
+
+from targetintel.functional_dependency import ReleaseClosureError, V050ReleaseRunConfiguration, run_release_closure
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--run-config", required=True)
+    parser.add_argument("--evidence-classification", required=True)
+    parser.add_argument("--output-dir", required=True)
+    args = parser.parse_args()
+    try:
+        configuration = V050ReleaseRunConfiguration.from_file(args.run_config)
+        result = run_release_closure(configuration, args.evidence_classification, Path(args.output_dir))
+    except ReleaseClosureError as error:
+        parser.error(str(error))
+    print(result["terminal_state"])
+    return 0
+
+if __name__ == "__main__":
+    raise SystemExit(main())

targetintel/functional_dependency/__init__.py

@@ -38,6 +38,11 @@
     validate_evidence_scope, validate_integration_state,
     write_dependency_integration_artifacts,
 )
+from .release_closure import (
+    ReleaseClosureError, V050ReleaseClosurePolicy, V050ReleaseRunConfiguration,
+    compare_release_runs, preflight_release, run_release_closure, validate_evidence_classification,
+    validate_release_state,
+)
 
 __all__ = [
     "DepMapFileManifest",
@@ -81,4 +86,12 @@
     "validate_evidence_scope",
     "validate_integration_state",
     "write_dependency_integration_artifacts",
+    "ReleaseClosureError",
+    "V050ReleaseClosurePolicy",
+    "V050ReleaseRunConfiguration",
+    "preflight_release",
+    "compare_release_runs",
+    "run_release_closure",
+    "validate_evidence_classification",
+    "validate_release_state",
 ]

targetintel/functional_dependency/dependency_integration.py

@@ -325,6 +325,7 @@ def build_dependency_integration(benchmark_dir: Path | str, baseline_ranking: Pa
     mandatory_bad = any(row["mandatory"] and row["result"] != "pass" for row in criteria)
     if not compatible: status = "blocked_incompatible_inputs"
     elif evidence_scope == "synthetic_fixture": status = "blocked_fixture_evidence"
+    elif any(row["criterion_id"] in {"benchmark_coverage", "holdout_coverage", "eligible_target_count", "permitted_missing_profile_fraction"} and row["mandatory"] and row["result"] != "pass" for row in criteria): status = "blocked_insufficient_evidence"
     elif mandatory_bad: status = "blocked_policy_failure"
     else: status = "eligible_for_human_activation"
     candidate = DependencyAwareProfileCandidate(FORMAT_VERSION, "dependency_aware_melanoma_anti_pd1_candidate_v1", context["context_identity"], baseline_id, str(manifest["dependency_profile_run_id"]), str(manifest["candidate_ranking_ids"]["bounded_overlay"]), policy.policy_id, policy.permitted_candidate_construction_method, policy.fixed_rank_band_size, policy.tie_handling_rule, policy.minimum_dependency_component_count, policy.missing_profile_fallback, "dependency_aware_melanoma_anti_pd1_candidate_v1", status, ("Experimental analysis-only candidate; it is not clinically validated.", "Explicit future human authorization is required."))

targetintel/functional_dependency/depmap_models.py

@@ -7,6 +7,7 @@
 from hashlib import sha256
 import json
 from pathlib import Path, PurePosixPath
+import re
 from types import MappingProxyType
 from typing import Any, Mapping
 from urllib.parse import urlparse
@@ -72,15 +73,26 @@ def _safe_release_directory(value: str) -> bool:
 
 
 def _forbidden_nested(value: Any) -> bool:
-    forbidden = ("credential", "password", "secret", "token", "authorization", "reasoning", "thinking", "chain_of_thought")
+    # Keys, rather than ordinary domain prose, are controlled.  In particular
+    # legitimate limitations may mention future human authorization without
+    # becoming a credential-bearing artifact.
+    forbidden = frozenset({"credential", "credentials", "password", "secret", "token", "api_key", "apikey", "access_key", "access_token", "private_key", "reasoning", "hidden_reasoning", "thinking", "chain_of_thought"})
     if isinstance(value, Mapping):
         return any(
-            _forbidden_nested(str(key)) or _forbidden_nested(item)
+            str(key).casefold() in forbidden or _forbidden_nested(item)
             for key, item in value.items()
         )
     if isinstance(value, (tuple, list)):
         return any(_forbidden_nested(item) for item in value)
-    return isinstance(value, str) and any(marker in value.casefold() for marker in forbidden)
+    if not isinstance(value, str):
+        return False
+    # Detect structured secret/reasoning disclosures, while allowing normal
+    # domain language such as "future authorization is required".
+    return bool(re.search(
+        r"(?:authorization\s*:\s*bearer\b|(?:secret|token|password|api[_-]?key|access[_-]?token)\s*[:=]|(?:chain_of_thought|hidden_reasoning)\s*:|-----BEGIN(?: [A-Z]+)? PRIVATE KEY-----)",
+        value,
+        flags=re.IGNORECASE,
+    ))
 
 
 def _require(condition: bool, message: str) -> None: