Add traceable, output-aware sources to Life Science Research skills

[kk-oai]

Summary

• add a shared source registry and sanitized provenance metadata across the 49 script-backed Life Science Research skills
• apply an output-aware source-presentation contract to all 50 skills: substantive external claims keep claim-adjacent citations, while connectivity checks, metadata, empty results, failures, routing, and checked-but-empty sources do not force evidence links
• make the research router propagate only downstream evidence sources and make locus-to-gene synthesis distinguish sources that were queried, contributed evidence, or returned no evidence
• preserve NCT IDs and titles in ClinicalTrials summaries and return reproducible request URLs for ClinicalTrials and GTEx
• harden request-URL sanitization across 31 generic clients by removing URL credentials and fragments and redacting secret-like query values
• make all 31 generic clients emit authoritative human-readable provenance names, with regression coverage against the shared registry
• add contract, canonical-link, URL-safety, query-provenance, and locus-provenance regression tests; bump the plugin to version 1.0.4

The sources field is additive. Raw output remains unchanged when requested, and sources are not presented as supporting evidence when their responses do not support a claim.

Tests

• python3 /Users/kenny.kim/.codex/skills/.system/plugin-creator/scripts/validate_plugin.py plugins/life-science-research
• python plugins/life-science-research/scripts/validate_source_presentation.py
• python -m unittest discover -s plugins/life-science-research/tests -p 'test_*.py'
• python plugins/life-science-research/skills/eqtl-catalogue-skill/scripts/test_rest_request.py
• python plugins/life-science-research/skills/locus-to-gene-mapper-skill/scripts/test_map_locus_to_gene.py
• python plugins/life-science-research/skills/ncbi-blast-skill/scripts/test_ncbi_blast.py
• ruff check on every changed Python file
• ruff format --check plugins/life-science-research/scripts/validate_source_presentation.py plugins/life-science-research/tests/test_source_presentation.py
• git diff --check
• live GTEx, ClinicalTrials.gov, and bounded seed-only locus-to-gene probes

All 29 automated tests pass; source-presentation validation covers 50 skills and 49 script-backed skills. All 31 generic clients pass the hardened URL-safety and human-readable provenance-name contract audits.

Preview evaluation

An isolated local preview of life-science-research@life-science-preview passed 6/6 representative output checks:

• narrow record lookup: canonical UniProtKB record and claim-adjacent links
• broad router synthesis: only evidence-contributing UniProt and Reactome lanes cited
• search result list: canonical NCT links plus one reproducible query link
• empty result: attempted source named without invented evidence links
• failure/connectivity: real network error reported without scientific claims
• raw JSON: machine-readable output preserved without Markdown injection

Rendered transcript snapshots and full JSONL event logs were captured locally for all six scenarios.

Follow-up validation

• confirm the native Sources side-panel presentation in the Codex desktop app before marking ready; the isolated CLI preview verifies final-answer behavior and links but does not expose that UI-only surface