muni-bdbv-gp

Agentic antiviral design environment for the Ebolathon hackathon: an LLM agent designs an improved, purchasable small-molecule inhibitor of Bundibugyo ebolavirus (BDBV) glycoprotein (GP)-mediated viral entry, starting from a known binder.

Each rollout runs in its own Prime sandbox (python:3.11-slim) provisioned at setup with muni, onepot, and rdkit-pypi. Auth uses MUNI_TOKEN (personal access token) — no OAuth-refresh sharing, safe for thousands of concurrent sandboxes — plus ONEPOT_API_KEY, both injected as sandbox secrets. The agent self-directs experiments; it never executes free-form code — only the typed tools below, which wrap HTTPS calls to the Muni platform and OnePot API.

Dataset

3 seed tasks (train = eval for hackathon scope), one per known BDBV GP entry inhibitor:

Target: DFF/inhibitor-binding cavity at the GP1–GP2 interface (PDB 6DZM).

Provenance caveats (seed labels kept as in code for now): Shaikh et al. 2019 (J Med Chem, PMID 30785281) measures compound 118 at IC50 3.1 µM — the headline 50 nM figure belongs to its chlorinated analog 118a (PDB 6HRO). All ligand-bound structures (6HS4, 6HRO, 5JQ7) are Zaire EBOV GP, not BDBV; transfer to BDBV rests on binding-site conservation (Zhao et al. 2016, Nature, PMID 27362232). 6DZM itself is a 4.3 Å cryo-EM antibody complex (Murin et al. 2018, PMID 30184505).

Tools (hard cap: 20 calls/rollout)

The DFF pocket box is pinned inside the env (mapped from PDB 6HS4 inhibitor-118 and 5JQ7 toremifene onto 6DZM via Kabsch superposition; both ligands agree within 2.7 Å) — agents cannot dock into arbitrary boxes.

Reward

score_candidate (weight 1.0), computed locally and deterministically:

• 0.35 × drug-likeness rules — mean of 6 checks with ideal bands (MW ≤ 550/≤ 500, cLogP 1–5/< 4.5, HBD ≤ 5, HBA ≤ 10, TPSA ≤ 140, rotors ≤ 8); PAINS alert → component halved (anti-promiscuity)
• 0.40 × OnePot plausibility — exact self-hit (similarity ≥ 0.999) = in the OnePot make-on-demand CORE library → 0.7 + 0.3 × price factor (≤ $150 → 1.0 … > $1000 → 0.3); near analog → 0.4 × best similarity; none → 0.1
• 0.25 × binding evidence — the submitted SMILES was docked in the pinned DFF box. Only posebusters_valid poses count. Primary term: MM-GBSA (−10 → 0 … −30 → 1.0); fallback: vina (−4 → 0 … −8 → 1.0). Blended 60/40 with ligand efficiency (|vina|/heavy atoms, bar 0.25; LE < 0.12 caps at 0.1) so adding atoms must pay for itself.

Guards: no submit_candidate, invalid SMILES, or resubmitting the seed in any form (canonical-SMILES comparison) → 0.0.

Drift-detection metrics (log-only): MW, cLogP, heavy atoms, price, LE, MM-GBSA, PAINS flag per rollout — if reward climbs while MW/logP climb, the policy is exploiting the docking oracle.

Usage

pip install -e environments/muni_bdbv_gp   # or prime env install prime/muni-bdbv-gp

# required: export MUNI_TOKEN=mcli_...   (mint: muni token create --name ci --ttl 90d)
# required: export ONEPOT_API_KEY=...    (falls back to the hackathon key)

prime eval run muni-bdbv-gp -m Qwen/Qwen3-30B-A3B-Thinking-2507 -n 3

Hosted (secrets never touch the Hub source archive):

prime eval run muni-bdbv-gp -m <model> -n 3 --hosted --allow-sandbox-access \
  --custom-secrets '{"MUNI_TOKEN": "mcli_...", "ONEPOT_API_KEY": "..."}' \
  --timeout-minutes 120 --follow

Changelog

• 0.2.0 — anti-reward-hacking hardening: pinned DFF pocket (no agent-chosen boxes), posebusters-valid gating, MM-GBSA-primary binding term, ligand efficiency, PAINS penalty, drift metrics; check_job polling (fixes sandbox gateway 504 on long docks); auth via MUNI_TOKEN PAT (fixes OAuth refresh-token revocation across sandboxes); removed detect_pockets (no longer needed).
• 0.1.1 — initial SandboxEnv release.

Presentation

Slide-ready charts + talk track (v0 prototype, observed reward hacking, v1 hardening, roadmap): presentation/ — chart1_v0_prototype.png · chart2_v1_agent_hacks.png · chart3_attack_surface.png · chart4_roadmap.png · PRESENTATION.md. Regenerate with .venv/bin/python presentation/make_charts.py.