Governed Empirical Closure Protocol · 受治理的独立实证闭环协议
No system warrants itself. · 任何系统都不能为自己作证。
ExoWarrant is a passive protocol and Codex plugin that carries a preregistered study from an exact contract to signed execution provenance, external replication, independent review, and a named human scientific decision. It does not become another AI scientist, analysis platform, or laboratory controller.
The central idea is simple: evidence must survive the world outside the model.
| Layer | Responsibility |
|---|---|
| GPT‑Rosalind | Scientific reasoning, hypothesis exploration, evidence synthesis |
| Rosalind Workbench / Codex | Human-visible orchestration, review, sharing and reuse |
| Life-science and NGS plugins | Evidence retrieval and approved scientific execution |
| BioNexus | Passive warrant assessment: what the observed evidence permits one to say |
| ExoWarrant | Contract lock, exact receipts, external replication, independence checks and named human closure |
OpenAI currently describes Rosalind Workbench as a research-preview, orchestrated workspace with connected scientific tools. ExoWarrant therefore integrates as an independent plugin through explicit, versioned artifacts; it does not assume a private cross-plugin API or automatic inclusion in the Rosalind launcher. See Rosalind and the current GPT‑Rosalind workflow announcement.
- Twelve versioned JSON artifact schemas plus shared definitions.
- A content-addressed artifact store and per-study append-only hash chain.
- External expected-head verification to detect rollback to an older valid prefix.
- Ed25519 signature verification against an operator-provisioned trust store.
- Exact, expiring, one-time scientific execution authorization.
- A signed, installed-profile preflight ledger that must pass before human authorization.
- Primary run receipts that bind inputs, parameters, backend, environment, container, outputs and every endpoint criterion.
- A separately signed external package containing its human authorization, run receipt, dataset lineage and every preregistered endpoint.
- A separately signed statistician attestation when that independence axis is required.
- Fail-closed warrant intake, dimensional independence checks, and a named-human decision gate.
- Append-only revocation and a separate productivity-evidence track.
- A local stdio MCP server with read tools and approval-prompted append tools.
- Five focused Codex skills for routing, preregistration, execution evidence, external review and closure.
- A
scrna.pseudobulk_deconformance profile and synthetic vertical-slice tests. - A cross-plugin Evidence/Receipt SDK with versioned JSON Schemas, Python and TypeScript reference implementations, exact-byte verification and portable conformance vectors.
- Deterministic, non-overwriting study dossier export with ZIP/member/hash/event-chain, external-head and optional pinned-signature verification.
- Institutional enrollment and key-ceremony audits that require a pre-existing human trust governor and never install anchors automatically.
- A read-only real-pilot intake/readiness gate that refuses to create authority or evidence.
It intentionally does not implement ELN/LIMS/instrument credentials, run an NGS workflow, mint institutional identities, create external evidence, prove reviewer independence, or demonstrate productivity gains. Those require real organizations and studies.
P1 includes passive connector reference implementations: root-pinned read-only export ingestion and a fail-closed write endpoint with exact signed scope, host-native approval evidence, server-side nonce/idempotency state, an operation allow-list and signed receipts. These are reusable controls and a filesystem conformance backend, not installed Benchling/LIMS/SLURM integrations or evidence of laboratory use.
DRAFT
-> PREREGISTERED
+ signed capability-profile preflight (same state, append-only)
-> HUMAN_AUTHORIZED
-> EXECUTING
-> EXECUTED
-> WARRANT_ASSESSED
-> INDEPENDENT_REVIEW_PENDING
+ external replication receipt (same state, append-only)
-> HUMAN_DECISION_PENDING
-> CLOSED
+ productivity evidence / revocations (same state, append-only)
There is deliberately no automatic VALIDATED state. FAILED, STOPPED, negative endpoints, NOT_ASSESSED, adverse review, DEFER, and REJECT remain valid closure records. Positive acceptance has stricter gates; negative closure is never censored.
PowerShell:
python -m venv .venv
.venv\Scripts\python -m pip install -e . pytest ruff
.venv\Scripts\python scripts/exowarrant.py validate standards/research-closure-protocol/conformance-fixtures/valid/study-contract.scrna-pseudobulk.v1.json
.venv\Scripts\python -m pytest -q
.venv\Scripts\python scripts/launch_mcp.py --checkThe bootstrap python used by python -m venv is a host prerequisite. Every subsequent command above uses the repository venv, so the check cannot silently fall back to unrelated global packages. requirements-tested.txt records the exact top-level versions used for this local conformance run; it is not a cross-platform transitive lock. The launcher prefers EXOWARRANT_PYTHON, then the repository venv, then the current interpreter, and fails with a setup message if dependencies are absent. The MCP host must itself be able to invoke the outer python command declared in .mcp.json; EXOWARRANT_PYTHON selects the dependency-ready child interpreter but cannot replace a missing outer launcher.
Create only a draft study:
.venv\Scripts\python scripts/exowarrant.py --store .exowarrant create standards/research-closure-protocol/conformance-fixtures/valid/study-contract.scrna-pseudobulk.v1.jsonThe returned head_digest should be retained outside the study directory before the next governed transition. Preregistration and later gates require exact digests and, where applicable, institutionally provisioned signed artifacts. Synthetic keys in tests/ are conformance fixtures only.
For MCP use, the operator supplies one read-only trust root through EXOWARRANT_TRUST_STORE_PATH when the server starts. Tool callers cannot select or replace it. The first accepted signed record pins its trust-store digest for that study. Trust-root rotation is deliberately unsupported in v0.1.
ExoWarrant's execution-authorization is a scientific-governance credential. It does not invoke a scientific plugin and never replaces that executor's own approval. For example, the NGS workbench's native execution approval must still be completed. The executor then returns a receipt that ExoWarrant verifies against the consumed scientific authorization.
Similarly, host approval of an MCP write tool only permits an append operation. It is not a PI signature and cannot satisfy a protocol gate.
The current BioNexus rc.3 adapter is intake-only: it preserves the exact embedded source record but always emits NOT_ASSESSED. Positive translation remains disabled until a deterministic, version-allowlisted BioNexus export can be independently verified.
.codex-plugin/plugin.json Codex plugin manifest
.mcp.json local stdio MCP and host approval policy
skills/ focused workflow skills
src/exowarrant/ deterministic protocol kernel
standards/research-closure-protocol/ schemas, state machine and threat model
workflows/scrna-pseudobulk-de/ first bounded profile
tests/ synthetic conformance and refusal tests
pilots/scrna-pseudobulk-de/ real-pilot intake, readiness gate and runbook
Read ARCHITECTURE.md, the normative state machine, and the threat model before adding connectors or stronger claims.
To begin the empirical phase without creating a synthetic study, use the
real pseudobulk pilot runbook. Its audit can
reach only READY_FOR_CONTRACT_DRAFT; signed preflight, authorization, execution,
external replication, review and PI closure remain separate gates.
The local test suite, schema validation, plugin validation, and MCP smoke checks are engineering evidence only. As of this v0.1 baseline, no real external laboratory, independent statistician, institutional key ceremony, cross-host public dataset closure, prospective productivity comparator, hosted CI run, or scientific certification has been established.
The Evidence/Receipt SDK is an observation-only interoperability layer for other scientific plugins. A conformant SDK bundle is not an ExoWarrant execution receipt and cannot authorize execution or assert a positive scientific claim.
For empirical-pilot operations, see the real evidence closure procedure and institutional trust-network onboarding. These tools make real inputs and institutional actions checkable; the current repository still contains no real institutionally closed study.