feat: ship the hardened scientific research harness

[Ishaan Gangwani (ishaan1124)]

Summary

• harden the single Research harness with bounded delegation, owned runtime cancellation, warm Python/R lifecycle controls, and exact observable trajectories
• stop repeated 404, oversize-download, and timed-out-kernel loops with durable failure-family guards and evidence-backed recovery paths
• make tool-output and parent-to-child handoff session-owned, sandboxed, and fail closed across broad filesystem grants
• restore the published review API and regenerate the Bun 1.3.14 OpenAPI/SDK contracts deterministically
• refine the workspace UI across model routing, Compute, Files, artifacts, mobile composer geometry, typography, and non-overlapping long diffs
• harden isolated browser orchestration, protected-main publishing, docs, and release verification

Verification

• backend: 2,152 passed, 10 skipped, 0 failed
• browser E2E: 82 passed, 1 intentional skip, 0 failed
• root Bun 1.3.14 typechecks: 7/7 packages
• workspace and docs production builds: passed
• SDK: 12 passed, typecheck passed, OpenAPI and generated client reproducible byte-for-byte under Bun 1.3.14
• staged Prettier, diff checks, actionlint, and gitleaks: passed

Release notes

Package versions intentionally remain at 2.0.23 in this PR. The protected-main publish workflow owns the patch bump and release PR. Homebrew publication remains a warning-only skip until the repository has HOMEBREW_TAP_TOKEN.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openscience	Ready	Preview	Aug 14, 2026 7:18am