One output is one file, named by the spec

[EiffL]

An output was a directory a recipe filled, so nothing declared what was in it. In a real agent-run project that meant one output holding chain.npz and run_config.json, with the filename contract living only inside three consumer scripts; a recipe exiting 0 having written nothing committing a well-formed digest of an empty directory; and MySTRA guessing which file in a figure's directory was the figure (its own output shows data-canonical-url=…corner.pdf next to src=…corner.png).

ASTRA now declares the missing half — Output.format, astra-spec 0.0.14 / astra-tools 0.2.17 — the counterpart of Input.source having always carried a path with an extension.

The layout

results/<universe>/<output_id>.<format>          the output
results/<universe>/.<output_id>.manifest.json    its manifest, in git

format comes from the spec, so lc composes the filename rather than a recipe choosing it — which makes the whole contents of results/ a pure function of the spec.

Scope: a flat analysis, deliberately

This PR handles an analysis without sub-analyses, and nothing else. An earlier revision carried a results tree per sub-analysis, with the guards that needed — a path-collision refusal, an escape refusal, a missing-universe-file refusal, a broadened **/results/** routing rule, a path-shaped dirty-tree split, and a multi-root crate walk. All of it was removed: none is required by the change this PR is for.

The consequence, stated plainly because it is a real capability removed: a nested spec is no longer buildable. ASTRA qualifies an output declared in a sub-analysis as <analysis>.<output>, and output_path refuses an id carrying a dot — the sidecar is recovered by partitioning the filename on its first dot, so a dotted id would name a manifest two outputs could silently share. On main such an output landed in a flat directory named by its dotted id. #202 records what supporting it properly would take.

What this buys

• The multiplicity has nowhere to come from. No directory to compose a second name into, so savefig(args.out) writes exactly one file at exactly the declared path.
• The producer/consumer filename contract is gone — {inputs.X} renders to the upstream's file.
• A consumer that never runs anything knows what every output is, from astra.yaml alone.
• One digest, not two. data_version drops its file: frame, so the manifest, the crate's sha256 and sha256sum agree:

  manifest data_version: sha256:4f2680c28efa…
  sha256sum            : sha256:4f2680c28efa…
  

Refusals over guesses

All before anything is spent: an output with no format (named, all of them at once); an id or format that cannot compose a path; a payload that is not a regular file (mkdir {output} used to commit a directory digest); and a manifest the attributes would route into the annex.

One reversal, recorded

The sandbox scope widens from the per-output directory to the directory an output lands in. Not a preference — a mechanism can only grant creating a file through the directory that will hold it, and the Landlock shim masks a non-directory grant to _FILE_ONLY_BITS. Outputs declared side by side are mutually writable again; data_version remains what answers for an output's bytes.

Breaking, deliberately

Every project restages; old results/<u>/<o>/ directories are invisible to the new code (git rm -r results/ and re-materialize — no migration path, per the no-back-compat rule); a spec without format on every executable output is refused; multi-file outputs must become separate outputs or a container format; and nested specs are refused (above).

Verification

614 passed, ruff and mypy clean. Beyond the suite, a real project materialized end to end: payloads annexed and manifests git-carried, tar.gz yielding .chain.manifest.json (first-dot partition, not .stem), tree clean after, and a bytes-free clone fetching its inputs and landing on up-to-date with nothing remade — which only happens if every manifest stayed readable without content.

Noted, not fixed

All pre-existing and independent of this change, recorded in CLAUDE.md:

• A malformed astra.yaml tracebacks out of lc status and lc materialize --check #200 — a malformed astra.yaml tracebacks out of lc status and lc materialize --check as a raw ScannerError, contradicting the invariant it now sits under.
• A sub-analysis's declared source: resolves against the project root, not its own analysis root #201 — a declared source: resolves against the project root wherever it is declared.
• lc cannot materialize a spec with sub-analyses #202 — nested specs are not buildable, and what deciding it would take (including an astra-tools bug: validate_universe_file validates against the unresolved tree, so a nested external sub-analysis fails with [UNKNOWN_ANALYSIS] at depth 2+).

🤖 Generated with Claude Code

https://claude.ai/code/session_01PybSgBiP8pjZeWxxCxiAXi

[github-actions]

✅ Eval

Metric	Value
Outputs check	success
Agent run	success
Turns	35
Tool calls	33
Cost	$0.72
Agent wall time	4m13s
Model	claude-sonnet-5

lc status

  mode:    direct
  sandbox: landlock (fs: declared, network: allowed)
  crate:   up to date with the outputs

  · current  baseline/best_fit        4397a86
  · current  baseline/hubble_diagram  4397a86
  · current  baseline/residuals       4397a86

3 current

Confusion & pain points (Claude analysis)

Confusion & pain points

• RO-Crate publication view required a second, unguided round-trip. The agent's spec had no [project].license, so the first lc materialize silently skipped RO-Crate generation with only a warning line (! no [project].license in pyproject.toml…). The agent had to notice the warning, invent a license value (CC-BY-4.0) unprompted by any spec/task requirement, edit pyproject.toml, commit, and re-materialize just to get ro-crate-metadata.json produced. This is a case where publication intent is derived rather than declared by the task, forcing the agent to make an editorial decision (which license) that wasn't part of the actual analysis.
• Reverse-engineered the data file format from scratch. Rather than any documented schema, the agent ran multiple ad hoc awk/grep probes on data/SCPUnion2.1_mu_vs_z.txt (column counts, min/max redshift, error-column semantics) to figure out which of the 5 columns were which and how error_model decisions (stat_only vs stat_and_sys) should combine them. This is inherent to the task (no data dictionary shipped), but it cost several exploratory Bash calls before any code was written.
• Manually validated the stat/error-column mapping via an out-of-band lc run. After materializing the baseline, the agent used lc run on fit.py with --error-model stat_only to spot-check that H0≈70/reduced χ²≈0.97 matched textbook expectations — effectively a manual sanity test the harness/spec gave no built-in way to assert. This is reasonable diligence but highlights there's no lightweight "does this recipe make physical sense" check short of eyeballing numbers.
• Otherwise a clean run. No failed commands, no sandbox denials, no misreadings of the CLI surface — lc materialize, lc status, and astra validate all worked as expected on the first try after the spec was filled in.

Full trace: agent-trace artifact on this run.

[EiffL]

Claude Code review — 1 finding(s)

nit — evals/prompt.md:33-34

The manifest sidecar was renamed to .<output_id>.manifest.json, but two doc references to the old .lightcone-manifest.json name were missed: evals/prompt.md:34 (the very next line was updated to the new results/baseline/<output_id>.<format> layout) and CLAUDE.md:481 in the storage invariants (whose own Recorded decision, added by this PR, documents the new pattern). Both are one-line doc drift with no runtime impact — but CLAUDE.md's own rule is "document only what exists," and the eval prompt is fixture text every future eval agent reads.

---

Generated by Claude Code

[cailmdaley]

this is the most Opus 5 PR i've ever seen haha. i got clickbaited by the PR name

[EiffL]

Left some comments