fix(validation): wire consensus param + harden conda guard + audit fixes

Fixes surfaced while live-testing the both-method validation + consensus path on
real multi-barcode data and a follow-up code audit.

- parameter_mapping: pass generate_consensus / consensus_min_depth to the
  pipeline (gated on run_validation_enabled). The pipeline accepted these params
  but the GUI never sent them, so consensus was unreachable from the GUI.
- nextflow_manager: harden the conda-env launch guard. _purge_broken_conda_envs
  now also purges envs that have a history marker but an empty bin/ (a build that
  wrote history then failed to install binaries -> "command not found", exit 127).
  Add _strip_appledouble_files to remove macOS AppleDouble (._*) sidecars from the
  conda cache before launch; they corrupt conda-meta and make conda abort env
  creation ("corrupted file: ._<pkg>.json").
- blast_validation_parser: guard parse_blast_per_read against an IndexError when a
  malformed TSV has an all-null subject column; drop unknown keys in
  ValidationResult.from_dict (mirrors the sibling from_dict guards).
- validation_layout: remove an orphan consensus-summary-container Div (no writer).
- consensus_helpers: default the consensus selector to an organism that actually
  produced a sequence, so the panel does not open on a "no consensus" warning.
- Tests: empty-bin / AppleDouble-strip guard cases, all-null-subject per-read case.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: druvus

nanometa_live/app/layouts/validation_layout.py

@@ -577,8 +577,6 @@ def _create_consensus_tab() -> dbc.Tab:
         label="Consensus",
         tab_id="consensus-tab",
         children=html.Div([
-            html.Div(id="consensus-summary-container", className="mb-3"),
-
             # Empty state (no consensus artifacts on disk)
             html.Div(
                 id="consensus-empty-message",

nanometa_live/app/tabs/consensus_helpers.py

@@ -64,11 +64,24 @@ def build_consensus_selector_options(
     valid_values = {o["value"] for o in options if not o.get("disabled")}
     if current_value and current_value in valid_values:
         return options, current_value
-    first_value = next(
-        (o["value"] for o in options if not o.get("disabled")),
+    # Prefer a species that actually produced a consensus for the default
+    # selection, so the panel does not open on a "no consensus" warning.
+    with_seq = {
+        f"{r.get('sample_id', '')}_{r.get('taxid', '')}"
+        for r in results
+        if r.get("has_sequence", r.get("consensus_length", 0) > 0)
+    }
+    default_value = next(
+        (o["value"] for o in options
+         if not o.get("disabled") and o["value"] in with_seq),
         None,
     )
-    return options, first_value
+    if default_value is None:
+        default_value = next(
+            (o["value"] for o in options if not o.get("disabled")),
+            None,
+        )
+    return options, default_value
 
 
 def find_consensus_result(

nanometa_live/core/config/parameter_mapping.py

@@ -610,6 +610,11 @@ def _build_base_params(config: Dict[str, Any], main_dir: str, kraken_db: str,
         "validation_identity_threshold": config.get("validation_identity_threshold", 90.0),
         "minimap2_preset": config.get("minimap2_preset", "map-ont"),
         "minimap2_min_mapq": config.get("minimap2_min_mapq", 10),
+        # Consensus sequence generation (amplicon-focused). Off unless the
+        # operator enables it; only meaningful when validation runs (it reuses
+        # the extracted reads + reference genome).
+        "generate_consensus": config.get("generate_consensus", False) and run_validation_enabled,
+        "consensus_min_depth": config.get("consensus_min_depth", 10),
         # NOTE: ``min_reads_for_validation`` (default 50) is a CUMULATIVE reporting
         # threshold applied in the GUI/aggregation layer -- an organism needs this
         # many reads across the whole run to be treated as validated. It is

nanometa_live/core/parsers/blast_validation_parser.py

@@ -121,7 +121,10 @@ def from_dict(cls, data: Dict[str, Any]) -> 'ValidationResult':
             raw = data['status']
             data = dict(data)
             data['status'] = ValidationStatus(_status_map.get(raw, raw))
-        return cls(**data)
+        # Drop unknown keys so a dict from a newer schema does not raise
+        # TypeError (mirrors NCBIResult/GTDBResult.from_dict in this codebase).
+        return cls(**{k: v for k, v in data.items()
+                      if k in cls.__dataclass_fields__})
 
     def determine_status(self) -> ValidationStatus:
         """Determine validation status based on metrics."""
@@ -847,8 +850,11 @@ def parse_blast_per_read(
              "mean_pident": round(float(r.mean_pident), 1)}
             for r in top.itertuples(index=False)
         ]
+        # Guard top.iloc[0]: a malformed TSV whose sseqid column is all-null
+        # yields an empty groupby, so check not-empty as well as total_reads.
         subject_agreement = (
-            float(top.iloc[0]['reads']) / total_reads if total_reads else 0.0
+            float(top.iloc[0]['reads']) / total_reads
+            if total_reads and not top.empty else 0.0
         )
 
         # Per-read table: cap to top-N by bitscore for the DOM.

nanometa_live/core/workflow/nextflow_manager.py

@@ -213,7 +213,15 @@ def _purge_broken_conda_envs(work_dir: str) -> list:
             if not os.path.isdir(env_path):
                 continue
             history_marker = os.path.join(env_path, "conda-meta", "history")
-            if os.path.isfile(history_marker):
+            bin_dir = os.path.join(env_path, "bin")
+            has_history = os.path.isfile(history_marker)
+            # A history marker normally means "fully built". But a build that
+            # failed midway (e.g. conda aborting on an AppleDouble-corrupted
+            # conda-meta file) can leave the history file with an EMPTY bin/ --
+            # the env then activates but every tool is "command not found"
+            # (exit 127). Treat an env with no executables as broken too.
+            has_binaries = os.path.isdir(bin_dir) and bool(os.listdir(bin_dir))
+            if has_history and has_binaries:
                 # Fully-built env; leave it alone.
                 continue
             try:
@@ -226,6 +234,30 @@ def _purge_broken_conda_envs(work_dir: str) -> list:
                 )
         return removed
 
+    @staticmethod
+    def _strip_appledouble_files(work_dir: str) -> int:
+        """Delete macOS AppleDouble ``._*`` sidecars under ``<work_dir>/conda``.
+
+        macOS writes ``._<name>`` files carrying resource-fork/xattr data; when
+        they land in a conda env's ``conda-meta/`` (observed from Spotlight or
+        cloud-sync activity even on APFS), ``conda env create`` treats the env
+        as corrupt (``corrupted file: ._<pkg>.json``) and fails. They are always
+        safe to remove. Returns the count deleted.
+        """
+        conda_cache = os.path.join(work_dir, "conda")
+        if not os.path.isdir(conda_cache):
+            return 0
+        removed = 0
+        for root, _dirs, files in os.walk(conda_cache):
+            for fname in files:
+                if fname.startswith("._"):
+                    try:
+                        os.remove(os.path.join(root, fname))
+                        removed += 1
+                    except OSError:
+                        pass
+        return removed
+
     def _parse_pipeline_source(self) -> Tuple[str, Optional[str]]:
         """
         Parse the pipeline source configuration.
@@ -526,6 +558,19 @@ def start(
                             len(purged),
                             ", ".join(os.path.basename(p) for p in purged),
                         )
+                    # Strip macOS AppleDouble (._*) sidecars from the conda
+                    # cache. On some volumes (Spotlight/cloud-sync churn) these
+                    # appear inside env conda-meta/ dirs; conda then reports the
+                    # env as "corrupted file: ._<pkg>.json" and aborts trying to
+                    # recreate an env that already has a history marker -- so the
+                    # half-built-env purge above does not catch it. Removing them
+                    # lets the pre-built env activate cleanly.
+                    stripped = self._strip_appledouble_files(self.work_dir)
+                    if stripped:
+                        logging.warning(
+                            "Stripped %d macOS AppleDouble file(s) from the "
+                            "conda cache before launch.", stripped,
+                        )
 
                 # Parse pipeline source configuration
                 pipeline_path, revision = self._parse_pipeline_source()

tests/test_blast_per_read_parser.py

@@ -78,6 +78,23 @@ def test_12_column_file(tmp_path):
     assert all(r["qcovs"] == 0.0 for r in res["records"])
 
 
+def test_all_null_subject_does_not_crash(tmp_path):
+    # A malformed TSV whose subject column is empty must not raise on the
+    # top-subject access; it should still return per-read records.
+    p = tmp_path / "s_taxid1.blast.tsv"
+    rows = []
+    for i in range(3):
+        # sseqid (col 2) left empty
+        rows.append("\t".join(str(v) for v in [
+            f"r{i}", "", 96.0, 400, 2, 0, 1, 400, 1, 400, "1e-50", 700,
+            450, 1900000, 90]))
+    _write(p, rows)
+    res = parse_blast_per_read(p, "s", 1)
+    assert res["total_reads"] == 3
+    # subject_agreement is well-defined (0.0..1.0), no IndexError
+    assert 0.0 <= res["subject_agreement"] <= 1.0
+
+
 def test_empty_or_missing_file(tmp_path):
     missing = tmp_path / "nope.blast.tsv"
     res = parse_blast_per_read(missing, "s", 1)

tests/test_purge_broken_conda_envs.py

@@ -23,14 +23,17 @@ def _make_env(parent: Path, name: str, *, complete: bool) -> Path:
     """Build a fake conda env directory under parent.
 
     A complete env carries a `conda-meta/history` file (which conda
-    writes last). An incomplete env is missing that marker, exactly
-    like a build that was killed by SIGTERM partway through.
+    writes last) AND at least one executable under `bin/`. An incomplete
+    env is missing the marker (build killed by SIGTERM partway through)
+    or has an empty `bin/` (build that wrote history but installed no
+    binaries, e.g. conda aborting on an AppleDouble-corrupted file).
     """
     env = parent / name
     (env / "conda-meta").mkdir(parents=True)
     (env / "bin").mkdir()
     if complete:
         (env / "conda-meta" / "history").write_text("# fake history\n")
+        (env / "bin" / "tool").write_text("#!/bin/sh\n")
     return env
 
 
@@ -106,3 +109,38 @@ def test_empty_env_dir_is_treated_as_broken(self, tmp_path):
 
         assert removed == [str(env)]
         assert not env.exists()
+
+    def test_history_but_empty_bin_is_broken(self, tmp_path):
+        # A build that wrote the history marker but installed no binaries
+        # (e.g. conda aborting on an AppleDouble-corrupted conda-meta file):
+        # the env activates but every tool is "command not found" (exit 127).
+        cache = tmp_path / "conda"
+        cache.mkdir()
+        env = cache / "env-deadbeef"
+        (env / "conda-meta").mkdir(parents=True)
+        (env / "bin").mkdir()
+        (env / "conda-meta" / "history").write_text("# fake history\n")
+
+        removed = NextflowManager._purge_broken_conda_envs(str(tmp_path))
+
+        assert removed == [str(env)]
+        assert not env.exists()
+
+
+class TestStripAppleDoubleFiles:
+    def test_no_op_when_no_conda_cache(self, tmp_path):
+        assert NextflowManager._strip_appledouble_files(str(tmp_path)) == 0
+
+    def test_strips_appledouble_from_conda_meta(self, tmp_path):
+        cache = tmp_path / "conda"
+        env = cache / "env-abc" / "conda-meta"
+        env.mkdir(parents=True)
+        (env / "gzip-1.13.json").write_text("{}")
+        (env / "._gzip-1.13.json").write_text("appledouble")
+        (cache / "env-abc" / "._conda-meta").write_text("appledouble")
+
+        count = NextflowManager._strip_appledouble_files(str(tmp_path))
+
+        assert count == 2
+        assert (env / "gzip-1.13.json").exists()  # real file untouched
+        assert not (env / "._gzip-1.13.json").exists()