PDep→QM network selection and hybrid Arkane input generation (I-008)

[alongd]

Status

Review gate lifted; the blocking marker that used to head this description has
been removed, from the title as well. One hard prerequisite remains, so do not merge on green
checks alone:

• RMG-Py fix(arkane): make PDep sensitivity meaningful for ILT-based path reactions RMG-Py#2990 must land first. T3's CI clones RMG-Py@main,
  so until it does there is zero CI coverage of the PDep SA path — the critical path of
  everything this PR adds. Merging before then puts ~18.7k lines of new t3/ source into main
  with its main path unexercised by CI. #2990 is open and mergeable as of this writing.

Checks: Lint (ruff), Analyze (python) and CodeQL green; Build and Test T3 green on the
previous head and re-running after the rebase. Rebased onto main, 127 commits, no conflicts.

Two things a reviewer should weigh, neither of them blocking:

• capture_ts_artifacts, the join, and the hybrid rewrite are still exercised only by fixtures.
  See Testing below for what the live trial did and did not reach.
• The Open questions at the bottom are still open, in particular durable refusal records.

What this adds (I-008 / D-020)

A T3 layer that decides which whole pressure-dependent (PDep) reaction networks deserve
expensive QM (PES exploration + master-equation refinement), and then computes them. The selection
criterion is observable-sensitivity × uncertainty.

The key architectural choice: this reasoning is network-level (ME solver, PES explorer). ARC
stays per-species / per-reaction and never learns that networks exist. Nothing in ARC was
touched; arc.* is consumed read-only.

The end-to-end capability, and the property the whole capture layer exists to provide:
T3.process_arc_run() writes hybrid Arkane P-dep network inputs — QM/RRKM for transition states
that were successfully computed, RMG/ILT for the rest — from the capture alone, with the ARC
project directory absent entirely.

New module t3/pdep/: discovery, join, capture, hybrid, selector, parser,
energy_settings, me_success, cache, yaml_safe, api, and mesolver/ (adapter + Arkane
implementation + factory).

Constraints held throughout

• No rmgpy and no arkane imports in T3. arc.* only; arc.molecule replaces
  rmgpy.molecule.
• RMG/Arkane .py files are parsed with ast.parse, never exec/eval. Parsing an RMG
  network.py would otherwise mean executing the RMG/Arkane DSL.
• Fail closed. Every ambiguous or unverifiable state refuses rather than proceeding.

Testing

Full suite: 2269 passed, 1 failed (~55m). The single failure is
tests/test_functional.py::test_computing_thermo (CanteraError) — pre-existing on main, not
from this branch.

The suite is not the evidence that matters most here. A NameError sat on the hot path of the
Arkane-output parser under 2267 passing tests, because every fixture in tests/data/pdep_me/ uses a
flat Arrhenius or Chebyshev and the crashing branch only fires on a nested kinetics call —
PDepArrhenius(arrhenius=[Arrhenius(...)]), which is exactly what interpolationModel = ('pdeparrhenius',) emits. A linter found it, not a test.

So the funnel was run end to end on real data (trial-005): RMG → Cantera SA → a real PDep network
discovered and assessed → assessment and budget records written. Real Arkane output parsed cleanly;
the CSE→MSC fallback fired for real, CSE having failed macroscopic equilibrium on that network; and
a refusal was recorded with its rationale. What that run did not reach: nothing qualified, so
capture/join/hybrid never ran live — the funnel correctly had nothing to send, but roughly a third
of the new surface is still fixture-only.

Roughly 1000 lines of the diff are tests. Beyond assertions, the new guards were mutation-tested:
each guard was individually neutered and a test confirmed to fail, then reverted. Where a mutation
was reported without evidence, it was re-run independently before being believed.

Review-driven hardening

This branch went through 65 adversarial review rounds. That process found — and this PR fixes —
thirteen instances of the same fail-open / vacuous-truth defect, where a guard silently passed
on the case it existed to catch. Representative examples:

• verify_capture() never read the status field at all, so a manifest entry claiming
  status: usable with a null artifact path verified clean, counted zero artifacts, pruned the
  output tree, returned success, and let the finalization marker be written.
• The writer called verify_capture() and then separately re-read the same manifest, so path
  confinement applied to one parse while the use applied to another.
• use_atom_corrections='False' (a non-empty, therefore truthy, string) slipped past a falsy check
  while the generated file rendered a bare useAtomCorrections = False.
• A hybrid input could be written that turns a correction ON without pinning its values.
• The finalization marker was fsync+os.replace'd while input.py was a plain open(...,'w') —
  the marker was more durable than the output it certifies, so a torn file could be certified
  as complete.

Known limitation, recorded rather than hidden

The versioned finalization marker relies on every step of process_arc_run() being idempotent. The
RMG library append's contribution to that is dedup-by-label: verified to add no duplicates, but
it would silently keep stale values if a source library ever carried the same labels with different
values. No path in this feature produces that, it is pre-existing behavior, and it is documented at
the claim site rather than left implicit.

Open questions for you

1. Durable refusal records. When a network is refused (partial QM coverage), the only durable
   state is "no input.py plus a finalization marker" — indistinguishable later from not-selected,
   zero-artifact, manually deleted, or pruned. The reason exists only in logs. Review flagged this
   twice. I did not design it unilaterally because it interacts with the prune preflight and I
   think the shape should be your call.
2. t3/utils/libraries.py has two pre-existing defects I deliberately did not fix here, since
   they are outside I-008 and deserve their own PR: description_to_append is extracted from the
   destination's own longDesc and checked against it, so it never consults the source and is
   effectively a no-op; and the shared-library lock path is keyed by library_name, so two
   projects writing the same shared_library_name under different local library_names take
   different locks — a real concurrency hole in shared-library writes.
3. explore=True still raises NotImplementedError — no longer true; this PR now
   builds that piece. The standalone PES exploration entry point explore_pdep_network() and a
   concrete ArkaneExplorerAdapter are included (t3/pdep/api.py, t3/pdep/explorer/), along
   with the QM budget (t3/pdep/budget.py, pdep_QM_max_transition_states /
   pdep_QM_max_networks). select_pdep_network() itself never explores: the deprecated
   explore=True / how=... arguments now raise a ValueError redirecting the caller to
   explore_pdep_network().

Related

Depends on RMG-Py PR ReactionMechanismGenerator/RMG-Py#2990 (open, awaiting review) for the
P-dep sensitivity / ILT support this consumes.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.80%. Comparing base (0f0737c) to head (a2ad908).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #179      +/-   ##
==========================================
+ Coverage   72.76%   81.80%   +9.03%     
==========================================
  Files          37       66      +29     
  Lines        6004    10565    +4561     
  Branches     1307     2318    +1011     
==========================================
+ Hits         4369     8643    +4274     
- Misses       1187     1357     +170     
- Partials      448      565     +117     

Flag	Coverage Δ
unittests	81.80% <ø> (+9.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[alongd]

Pushed increments 22–24 (d663117..033ad82, 39 commits). Still DO NOT MERGE — draft for review.

What this stretch added. The layer stopped being only defended and became connected: the explorer config surface (PDepExplorerConfig), the result type (PDepExplorationResult), and the entry point t3.pdep.api.explore_pdep_network() all landed, plus the content-binding work below.

Two things need your call, neither blocking:

1. The D3 trigger changed shape. The scope doc says exploration is requested with explore=True on select_pdep_network(). It is now a separate function, explore_pdep_network(); explore/how remain in the old signature and raise a redirect ValueError. Reasoning is written into docs/t3-pdep-qm-scope.md D3 under "NEEDS ALON'S SIGN-OFF". That was your wording, so it is your interface to approve.
2. The select-first scope question carried over from an earlier round and is recorded in the working notes.

The substantive change worth reading first: network identity is now bound to CONTENT, not the file stem. A PDepNetworkSelection for network4_2 previously gated an exploration of any file with that stem. RMG rewrites pdep/network*.py on every iteration that touches the network, and a selection is routinely made in one process and acted on in another, so "same stem" and "same network" were not the same statement. PDepNetwork now carries source_hash (bytes read once and hashed before decoding), selections record it, and the hash is threaded down to the explorer input writer, which refuses if its own read does not match — the API-level check alone only proves what the bytes were at check time.

Two related fixes came out of it: PDepNetworkSelection.combine() was silently dropping evaluation_status, turning never-evaluated components into a confident "evaluated, does not qualify" aggregate; and _record_pdep_network_identity() re-hashed the network file at record time although its own docstring promised the hash the selection examined.

Green: 938 fast pdep tests (~29 s) plus 105 in test_main_wiring.py/test_main.py (~33 min). Every fix in this stretch is mutation-confirmed — the mutants and which tests caught them are named in the commit messages.

[alongd]

Increment 25 — 033ad82..a8d3707 (8 commits), pushed. Fast pdep suite 981 passed (~29 s, was 938); slow pair test_main_wiring.py + test_main.py 105 passed re-run at tip. Still DO NOT MERGE.

What landed

Persistence is now round-trippable. save_pdep_exploration_results() plus strict loaders for both formats (load_pdep_network_selections, load_pdep_exploration_results). Loading is not Selection(**record) — as_dict() flattens types, so reconstruction restores tuples, nested frozen SensitiveTransitionState, PDepArkaneReaction, and an optional nested selection. The load-bearing test is round-trip equality on fully-populated objects, derived from the objects rather than a hand-written expected dict.

SELECTOR_VERSION was doing three jobs and is now four constants. It simultaneously decided whether a cached Arkane SA run was still usable, described the on-disk selection schema, and recorded which selector logic produced a decision. Adding network_source_hash last increment changed the schema but not the cache contract, and bumping the shared number would have thrown away every cached SA run for nothing — there was no way to be right about both. Now SA_CACHE_CONTRACT_VERSION, SELECTION_SCHEMA_VERSION, SELECTION_ALGORITHM_VERSION, EXPLORATION_RESULT_SCHEMA_VERSION. The two selection versions are dataclass fields, not envelope keys, so a selection nested inside an exploration result still describes itself.

Two findings worth your attention

Tests that passed for the wrong reason. A mutation sweep of validate_sa_cache — disabling each of its eight rejection branches in turn — found only three were tested. Five could be deleted outright with the whole cache suite green, including the network_file_hash check that catches RMG rewriting a network under its cache. Every test asserted only status == cached_rejected, a verdict all eight branches produce, so removing the intended branch just fell through to a later one. All eight now pin their own warning text. The same sweep then found both select_pdep_network early-return sites could drop network_source_hash with the suite still green.

A FullLoader on a caller-supplied path. The loaders initially used arc.common.read_yaml_file. t3/pdep/yaml_safe.py's own module docstring already says t3.pdep.api is a public entrypoint reading caller-supplied paths and must not do that — the argument against the code was already written down in this repo. Now plain yaml.safe_load, which is stricter than read_sa_yaml_file (that exists only for Arkane's legitimate !!python/tuple).

Still open

One round-37 P1 is deliberately not yet fixed: in select_from_sa_dict, when the SA transition-state rows carry no signal, evaluation_status may remain 'evaluated' with qualified=False — a confident negative from data that could not answer the question. Same defect class as the combine() fail-open fixed last increment. I want to probe it against the sidecar-backed path before changing anything, since the premise may not hold.

Still needs your call (unchanged, neither blocks)

1. The select-first scope question.
2. The D3 API trigger amendment — I replaced explore=True with a separate explore_pdep_network(); explore=True was your wording, so docs/t3-pdep-qm-scope.md D3 is marked NEEDS ALON'S SIGN-OFF.

[alongd]

Increment 26 — the layer's tests made true, then its inputs made untrusted

Branch is at 8b91136, 96 ahead of main. Fast pdep suite 1034 passed; the slow pair
(test_main_wiring.py + test_main.py) 105 passed, re-run at tip three times. Still DO NOT MERGE.

The one you should look at first: a persisted selection could forge its way past the budget gate
(4211442). qualified: "yes" is a truthy string, and the gate only refuses a non-evaluated
selection when not qualified — so a hand-edited or corrupted selections YAML ran an expensive
exploration that was never authorised. Every field reconstructed by the loader is now type- and
enum-validated.

Twelve commits, in three groups.

Coverage. A mechanical sweep — rewrite each if in a function to if False: and see what fails —
found nine untested branches. The headline: rank_pdep_networks' ranking had no test at all. Its
docstring promises a three-tier ordering, a delta_ln_k ranking and a determinism tiebreak; none of
the three was pinned, so all three could be deleted with the suite green. The code was correct — it
was simply unguarded. A docstring that states a contract turns out to be the best place to point this
sweep, because prose promises are exactly what no assertion checks.

Correctness. select_from_sa_dict had one branch, max_abs_ts < floor, standing in for five
different situations, and its message ("criterion (b) cannot be evaluated") was true for only some of
them while the status said evaluated. Split into: no TS rows at all; rows unreadable; rows seen but
none usable; all exactly zero; and a real sub-floor measurement. Only the last is an answer, and it
keeps evaluated — the others are non-answers now marked as such. Related: an unjoinable sensitive TS
carried uncertain=None, which is falsy, so it silently voted "not uncertain" and produced a confident
negative.

The exactly-zero case is a judgement call worth flagging for you: an all-ILT network reports zero TS
sensitivity because perturbing a synthesized TS's E0 never enters an ILT-derived rate. Those are
precisely the networks whose kinetics are least trustworthy, so T3 now reports not evaluated rather
than silently declining to refine them. Adversarial review argued this was over-refusal and withdrew
the objection.

Hardening. Threshold validation (a nan relative_threshold selected every TS); validating the
derived floor rather than only its inputs; the explorer gate now reports every reason a selection can't
be used instead of one per round trip; and three remaining as_dict() leaks that let a caller rewrite a
decision already reported.

---

Still waiting on you, and neither blocks the work (both also in docs/t3-pdep-qm-scope.md):

1. The select-first scope question.
2. The D3 API trigger amendment — explore=True becoming a separate explore_pdep_network().
   Marked "NEEDS ALON'S SIGN-OFF" in D3.

[alongd]

Update: the per-network qualification GATE is now a budget-limited RANKING

Three commits implement the reframe you asked for. Still DO NOT MERGE.

commit	what
354476f	T3 decides the QM queue with the whole field of networks in view, instead of queueing each one as it is found
e43349d	the budget itself: t3/pdep/budget.py, plus two opt-in knobs, pdep_QM_max_transition_states and pdep_QM_max_networks (both default None = no limit)
dcc8d97	the public explore_pdep_network() gate becomes an admission policy

Two things to look at specifically.

Behaviour is NOT preserved by 354476f, and my earlier note claiming otherwise was wrong.
Deferring the queue changes the ORDER in which species are added, add_reaction cascades into
add_species, and add_species assigns key = len(self.species) — from which the ARC-facing QM
label is derived. So species keys and QM labels churn. The SET of species queued is unchanged and no
work is lost, but species.yml / reactions.yml restart state is no longer bit-for-bit comparable
across that commit. Stated in the commit message rather than left to be discovered.

dcc8d97 is a public API change. explore_pdep_network() takes a keyword-only admission_policy.
The default is exactly today's behaviour. Under 'caller_admitted' the qualification checks stand
aside — for a caller that ranked the network and chose to spend on it — while method,
network_id, network_source_hash and evaluation_status stay enforced, because admitting a
network is a budget statement and no budget statement makes a stale decision current.
PDepExplorationResult gained an admission_policy field recording what admitted each run.

Design points worth your disagreement:

1. A network the budget cannot afford is skipped whole, never sliced.
   uncertain_ts_labels() is sorted alphabetically, not by sensitivity, so taking "the first k"
   would mean choosing quantum chemistry by label. The cost charged is the network's uncertain-TS
   count, deliberately an over-estimate of the ARC jobs it will produce.
2. A refused network is not recorded durably yet — only logged. That is the next commit.
3. T3's own path does not use 'caller_admitted': t3.main still offers only qualified selections
   to the budget. Qualification (physics) and affordability (budget) stayed separate questions.

Verification: 1264 fast tests, 70 in test_main_wiring.py, and 24 mutations applied and killed
across the three commits.

[alongd]

Increment 32 — a budget refusal is now a durable record (2 commits, pushed)

3d00fa7 feat(pdep): give the QM budget a record of what it admitted and refused
1404c47 feat(pdep): write the QM budget's decision to disk each iteration

Until now, a network that qualified for QM refinement and then went unrefined because the budget was
spent left nothing behind but two log lines. For a long unattended campaign that is the outcome most
worth being able to reconstruct afterwards, and it was the only decision in this package that
vanished with the process.

The plan I inherited for this was built on a false premise, and probing killed it. It said to
record the refusal as a field on PDepNetworkSelection. But t3/main.py never persists selections
at all — save_pdep_network_selections has no caller outside tests/, and
self.pdep_network_selections is in-memory only. That approach would have left the task's entire
purpose unmet while appearing met. It would also have conflated a physics judgement ("is this
network's rate sensitive to estimated kinetics?") with an affordability one, which is the separation
t3/pdep/budget.py exists to maintain — and budget outcomes are iteration-relative, so the same
byte-identical selection is admitted in one iteration and refused in the next.

Reusing the existing TS-join sidecar was considered and rejected on review, for a reason I had not
found myself: has_pending_ts_join() makes restart treat that sidecar's existence as evidence that
ARC finalization needs rescue, so writing refusals into it would have perturbed restart semantics
rather than merely reusing a convenient file.

What landed instead: a PDepBudgetRecord written per iteration into the iteration directory,
covering admitted and refused networks alike. Refusals-only would collapse "no file", "empty
file", "nothing refused", "nothing was a candidate" and "no budget configured" into one ambiguous
silence. Refusal reasons gained stable machine codes alongside their prose, since the prose is
written to be read by a human and is free to be reworded.

Two defects worth naming, both found before the tests were green:

• The builder could construct a record its own validator rejected. Two networks with an empty
  network_id are explicitly supported by the budget and both get admitted, but the record refused a
  repeated network_id. Fixed by recording the budget's own identity rather than pretending
  network_id is always the key — not by refusing to describe such networks, which would have made
  the record fail on input the decision itself allows.
• A decision claiming two admissions rendered as a record reporting that nothing was considered,
  silently. That is an authoritative-looking lie in the one artifact whose purpose is to be
  authoritative. The builder now refuses an incoherent decision, at the point where authority is
  claimed rather than where the value is made.

The builder originally re-derived the budget's grouping, ranking and remaining-budget bookkeeping.
On review that was replaced: apply_pdep_qm_budget now returns the walk it already made, and the
builder consumes only that. Two maintained copies of the same ranking would have failed by
attributing the wrong refusal to the wrong network — silent corruption rather than a crash. The
builder no longer takes the selections at all, so a mismatched pair is unconstructible.

Verification. Fast suite 1317 passed; tests/test_pdep/test_main_wiring.py 71 passed
(29:17) run against the exact committed tree. Eight mutations applied, eight killed, tree restored
byte-identical each time — including three that silently drop a field from as_dict() or the loader,
which every round-trip test over default values would have missed.

One caveat worth flagging: the record has no in-repo consumer today. Its intended reader is human
or external audit. Using it to change the next iteration's behaviour would be a mistake — reusing a
prior refusal risks over-refusal, so the budget is still recomputed from the current field every
iteration.

Still DO NOT MERGE — this is for your review.

[alongd]

Follow-up on the comment above — adversarial review of the write path found six defects

1404c47 was amended to 38452ad (force-pushed with lease; no other branch or worktree was based
on it, so nothing was orphaned). The SHA in my previous comment is therefore dead — the review fixes
are squashed into the commit that owns the code rather than stacked on top of it, so what you review
is one coherent commit.

Two of the six are worth calling out, because they were real and neither was caught by a green suite:

The write followed a symlink. A symlink sitting at iteration_N/t3_pdep_qm_budget.yml redirected
the write outside the iteration directory. This was demonstrated before fixing it, not assumed: a test
that put a symlink at the target pointing at a sentinel file watched the sentinel get overwritten with
budget YAML. It is fixed by the same change that made the write atomic — staging beside the
destination and os.replace-ing into place replaces the link rather than writing through it.

The write was not atomic, and a truncated record still validates. A partial file can parse and
pass validation — an all-refused prefix, or an admitted prefix whose total_cost still matches — so a
crash mid-write produced silent authoritative under-reporting in the one artifact whose entire purpose
is to be authoritative. This repo had already hardened exactly this class twice (the ARC finalization
marker, the capture manifest); this now reuses the capture manifest's staging idiom rather than
inventing a third.

The other four: version gates compared with == accepted true and 1.0 as version 1 (Python's
True == 1); a record left by an earlier run of the same iteration survived a re-run with the feature
turned off, which silently falsified the "absence means the feature was off" invariant the commit
depends on (now cleared, the way a superseded ARC finalization marker already is); the loader accepted
a negative remaining_transition_states that apply_pdep_qm_budget cannot produce; and one test that
claimed to prove JSON-serializability could not fail, since json.dumps((1, 2)) succeeds and it read
back with the permissive loader rather than the strict one.

Verification. Fast suite 1324 passed; tests/test_pdep/test_main_wiring.py 72 passed
(30:18) against the exact committed tree. Every fix is pinned by a test confirmed to fail against the
unfixed code first.

One disclosure: the save_/load_ pair was written before its tests (an implementation agent's
context compacted mid-task), so those are the weakest-tested lines in the increment. I compensated with
mutations — silently defaulting a loader field, and disabling each version gate — all killed. Eight
mutations total this increment, eight killed.

Still DO NOT MERGE — for your review.

[alongd]

Dropped the DO NOT MERGE prefix from the title, so recording what replaces it as a merge prerequisite rather than losing the warning.

Blocking: RMG-Py #2990 must land first. T3's CI clones RMG-Py@main, so until it does there is zero CI coverage of the PDep SA path — the critical path of everything this PR adds. Merging before then puts ~18.7k lines of new t3/ source into main with its main path untested by CI.

Not blocking, but worth knowing before review:

• The funnel is now validated end-to-end on real data (trial-005, 2026-08-13), not just fixtures. RMG → Cantera SA → PDep network assessed → assessment + budget records written. Real Arkane output parsed cleanly, the CSE→MSC method fallback fired for real (CSE failed macroscopic equilibrium on that network), and a refusal was recorded with its rationale.
• capture_ts_artifacts, the join, and the hybrid rewrite are still fixture-only. Nothing qualified in that trial, so the funnel correctly had nothing to send — roughly a third of the new surface has not run live.
• Two pre-existing main bugs were found while running it, both out of scope here and headed for their own small PR: rmg_incore_script.py passes RMG [2] instead of 2 for --maxiter (nargs=1, never unwrapped), and write_submit_script() cannot work under incore RMG because SUBMIT_FILENAME is '' unless execution is local. Separately, examples/pressure_dependence/input.yml cannot run as written — its job types conformers/fine are not ARC's names.

Rebased onto main (127 commits, no conflicts) and both CodeQL alerts now have a code answer rather than needing a dismissal — see the last commit.

[Copilot]

Pull request overview

Adds end-to-end, network-level PDep selection and QM refinement while keeping ARC species/reaction scoped.

Changes:

• Adds sensitivity/uncertainty assessment, budgeting, persistence, and queueing.
• Adds Arkane exploration/ME adapters, artifact capture, and hybrid input generation.
• Extends schemas, runner validation, documentation, fixtures, and regression coverage.

Reviewed changes

Copilot reviewed 68 out of 110 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
.gitignore	Tracks required PDep fixtures.
docs/input_reference.md	Documents PDep sensitivity settings.
t3/common.py	Adds shared PDep constants.
t3/logger.py	Adds PDep reporting.
t3/main.py	Integrates the PDep workflow.
t3/pdep/__init__.py	Initializes the PDep package.
t3/pdep/api.py	Exposes selection and exploration APIs.
t3/pdep/assessment.py	Models and persists assessments.
t3/pdep/budget.py	Applies network-level QM budgets.
t3/pdep/cache.py	Validates SA cache provenance.
t3/pdep/capture.py	Captures and verifies ARC artifacts.
t3/pdep/discovery.py	Discovers PDep networks.
t3/pdep/energy_settings.py	Resolves energy settings.
t3/pdep/explorer/__init__.py	Initializes explorer adapters.
t3/pdep/explorer/adapter.py	Defines the explorer interface.
t3/pdep/explorer/arkane.py	Implements Arkane PES exploration.
t3/pdep/explorer/config.py	Defines exploration configuration.
t3/pdep/explorer/factory.py	Constructs explorer adapters.
t3/pdep/explorer/input_file.py	Generates exploration inputs.
t3/pdep/explorer/result.py	Represents exploration results.
t3/pdep/hashing.py	Provides artifact hashing.
t3/pdep/hybrid.py	Generates hybrid Arkane inputs.
t3/pdep/join.py	Joins networks with ARC results.
t3/pdep/me_success.py	Validates ME output success.
t3/pdep/mesolver/__init__.py	Initializes ME adapters.
t3/pdep/mesolver/adapter.py	Defines the ME interface.
t3/pdep/mesolver/arkane.py	Implements Arkane ME solving.
t3/pdep/mesolver/factory.py	Constructs ME adapters.
t3/pdep/parser.py	Safely parses network inputs.
t3/pdep/reason_codes.py	Centralizes refusal reasons.
t3/pdep/selector.py	Implements network qualification.
t3/pdep/yaml_safe.py	Restricts YAML deserialization.
t3/runners/rmg_runner.py	Strengthens Arkane success checks.
t3/schema.py	Adds PDep configuration fields.
t3/utils/network_thermo.py	Adds network thermo helpers.
t3/utils/uncertainty.py	Classifies kinetics uncertainty.
t3/utils/writer.py	Supports ME method rewriting.
tests/data/pdep_arkane_log/arkane.log	Supplies Arkane log data.
tests/data/pdep_energy_settings/composite_level_project/calcs/statmech/thermo/input.py	Composite-level input fixture.
tests/data/pdep_energy_settings/composite_level_project/output/output.yml	Composite-level output fixture.
tests/data/pdep_energy_settings/missing_model_chemistry_project/calcs/statmech/kinetics/input.py	Missing-chemistry input fixture.
tests/data/pdep_energy_settings/missing_model_chemistry_project/output/output.yml	Missing-chemistry output fixture.
tests/data/pdep_energy_settings/xl1001_project/calcs/statmech/kinetics/input.py	XL1001 kinetics fixture.
tests/data/pdep_energy_settings/xl1001_project/calcs/statmech/thermo/input.py	XL1001 thermo fixture.
tests/data/pdep_energy_settings/xl1001_project/output/output.yml	XL1001 output fixture.
tests/data/pdep_hybrid/arc_ts/TS1.py	Hybrid TS fixture.
tests/data/pdep_hybrid/arc_ts/TS2.py	Hybrid TS fixture.
tests/data/pdep_hybrid/arc_ts/TS_colliding.py	Collision fixture.
tests/data/pdep_hybrid/arc_ts/TS_dup_path_text.py	Duplicate-path fixture.
tests/data/pdep_hybrid/arc_ts/TS_missing_log.py	Missing-log fixture.
tests/data/pdep_hybrid/arc_ts/logs/freq_a1235/output.out	Frequency-log fixture.
tests/data/pdep_hybrid/arc_ts/logs/scan_a1236/output.out	Scan-log fixture.
tests/data/pdep_hybrid/arc_ts/logs/sp_a1234/output.out	Single-point fixture.
tests/data/pdep_hybrid/arc_ts/logs/ts1_freq.out	TS1 frequency fixture.
tests/data/pdep_hybrid/arc_ts/logs/ts1_scan.out	TS1 scan fixture.
tests/data/pdep_hybrid/arc_ts/logs/ts1_sp.out	TS1 energy fixture.
tests/data/pdep_hybrid/arc_ts/logs/ts2_freq.out	TS2 frequency fixture.
tests/data/pdep_hybrid/arc_ts/logs/ts2_sp.out	TS2 energy fixture.
tests/data/pdep_me/hard_failure/output.py	Hard-failure ME fixture.
tests/data/pdep_me/overlapping_channels/input.py	Overlapping-channel input.
tests/data/pdep_me/overlapping_channels/output.py	Overlapping-channel output.
tests/data/pdep_me/soft_failure_cse/output.py	Soft-failure ME fixture.
tests/data/pdep_me/success/output.py	Successful ME fixture.
tests/data/pdep_me/success_multi/input.py	Multi-channel ME input.
tests/data/pdep_me/success_multi/output.py	Multi-channel ME output.
tests/data/pdep_network_variants/network_arity_asymmetry.py	Arity edge-case fixture.
tests/data/pdep_network_variants/network_explicit_products.py	Explicit-product fixture.
tests/data/pdep_real_networks/README.md	Documents real fixtures.
tests/data/pdep_real_networks/network21_1/arkane.log	Network 21 log.
tests/data/pdep_real_networks/network21_1/network21_1.py	Network 21 input.
tests/data/pdep_real_networks/network21_1/sensitivity/sa_coefficients.yml	Network 21 sensitivity data.
tests/data/pdep_real_networks/network21_1/sensitivity/t3_sa_cache.yml	Network 21 cache metadata.
tests/data/pdep_real_networks/network799_1/arkane.log	Network 799 log.
tests/data/pdep_real_networks/network799_1/network799_1.py	Network 799 input.
tests/data/pdep_real_networks/network799_1/sensitivity/sa_coefficients.yml	Network 799 sensitivity data.
tests/data/pdep_real_networks/network799_1/sensitivity/t3_sa_cache.yml	Network 799 cache metadata.
tests/data/pdep_sa/network4_2_MSC/sa_coefficients.yml	SA parsing fixture.
tests/test_main.py	Tests main workflow integration.
tests/test_pdep/_wiring_helpers.py	Provides wiring-test helpers.
tests/test_pdep/test_api.py	Tests public PDep APIs.
tests/test_pdep/test_arkane_mesolver.py	Tests Arkane ME adapter.
tests/test_pdep/test_assessment.py	Tests assessment logic.
tests/test_pdep/test_assessment_persistence.py	Tests assessment persistence.
tests/test_pdep/test_budget.py	Tests QM budgeting.
tests/test_pdep/test_cache.py	Tests cache validation.
tests/test_pdep/test_capture.py	Tests artifact capture.
tests/test_pdep/test_discovery.py	Tests network discovery.
tests/test_pdep/test_energy_settings.py	Tests energy resolution.
tests/test_pdep/test_explorer_arkane.py	Tests Arkane exploration.
tests/test_pdep/test_explorer_config.py	Tests explorer configuration.
tests/test_pdep/test_explorer_factory.py	Tests explorer construction.
tests/test_pdep/test_explorer_input_file.py	Tests explorer input generation.
tests/test_pdep/test_explorer_result.py	Tests explorer results.
tests/test_pdep/test_hybrid.py	Tests hybrid generation.
tests/test_pdep/test_join.py	Tests network-result joining.
tests/test_pdep/test_main_funnel.py	Tests workflow funneling.
tests/test_pdep/test_main_wiring.py	Tests orchestration wiring.
tests/test_pdep/test_me_success.py	Tests ME success validation.
tests/test_pdep/test_mesolver_factory.py	Tests ME construction.
tests/test_pdep/test_parser.py	Tests safe parsing.
tests/test_pdep/test_real_networks.py	Tests real network chains.
tests/test_pdep/test_selector.py	Tests network selection.
tests/test_pdep/test_selector_diagnostics.py	Tests selection diagnostics.
tests/test_pdep/test_yaml_safe.py	Tests restricted YAML loading.
tests/test_runners/test_rmg_runner.py	Tests Arkane artifact gates.
tests/test_schema.py	Tests new schema fields.
tests/test_utils/test_libraries.py	Tests append idempotency.
tests/test_utils/test_network_thermo.py	Tests network thermo helpers.
tests/test_utils/test_uncertainty.py	Tests uncertainty classification.
tests/test_utils/test_writer.py	Tests writer changes.

Suppressed comments (1)

t3/pdep/cache.py:366

• This metadata path is derived from the caller-supplied sa_path, but it is deserialized with ARC's read_yaml_file/yaml.FullLoader before the cache can be rejected. That bypasses the restricted-loader guarantee of the public PDep API for a file the caller controls. Use the restricted loader already imported by this module.

        metadata = read_yaml_file(metadata_path) or dict()

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.