Record an advanced Python calculation

Bounded pilot, qualified 24 September 2026. One LAS value curve, one portable LAS output. This is a reference client, not a stable SDK or hosted Python service. SQL, OSDU and native application writers are not part of this workflow.

For reading, plotting or saving files locally, start with read-first Python. That path needs no binding, output declaration, compute permission or run. This page describes the optional advanced workflow under Connect → Use Python → Advanced: configure a recorded calculation.

Before you start

Your deployment needs browser identity, managed sources and the application routes enabled. Execution: your computer. Workspace saves input/output configuration and run records. It does not upload or launch your program.

There are three supported input routes:

• Your live LAS selection: a project administrator selects a permitted LAS file in Connections → Data sources, then chooses it in Python access. This existing route is account-owned; exact old reads fail if the file is replaced.

• An authorized retained LAS snapshot: an administrator creates a permitted snapshot under Data → Snapshots & releases (review is optional), then selects that exact LAS in Connect → Use Python → Advanced: configure a recorded calculation → Connect Python input. They explicitly check the allowed runners. A runner needs project member status, compute permission and distribution access to the retained input. They do not need administrator rights or the administrator’s upstream credentials.

• A reusable derived result: its author grants read and reuse separately. Open it in the catalogue, select Build on it in Python and save your own configuration. You need project member/compute access, but not administrator rights.

The deployment administrator still controls the maximum distribution audience. Selecting a person in the application does not widen that policy. Candidate or withdrawn packages cannot be used as inputs. A retained input pins its manifest, asset index, payload checksum and source revision.

Name the configuration, choose a value curve such as GR and keep the output as Portable LAS. The depth index is not editable. Save and open the configuration for its binding ID and a runnable example. Following an input never starts Python. Retained inputs remain exact snapshots; they do not silently follow source changes.

Use your own account to authorize Python below. Developer → Application access shows pending/approved clients and supports revocation. Consent limits requests; it does not grant data access or permission to execute a binding.

Run locally

Download both the curve client and application login helper into the same folder. They use Python 3.10+ and only the standard library; no internal packages or SDK installation.

python3 application_access.py login --url https://YOUR-WORKSPACE \
  --project YOUR-PROJECT --write

1. The browser opens your deployment’s identity provider. Sign in with the account that owns the live-source configuration or has been explicitly authorized to run the retained-input configuration.
2. Approve the provider’s device request. Python then opens Application access in Workspace. Sign into Workspace if needed; it returns to that request.
3. Verify the account, project, permissions and confirmation code against your terminal. Check the confirmation box and choose Approve application.
4. Return to Python. No bearer secret is copied. Then run:

python3 curve_application.py --url https://YOUR-WORKSPACE \
  --project YOUR-PROJECT --binding YOUR-BINDING \
  --start 100 --stop 103 --offset 2 --output my-result

Use --no-browser on the login command for an SSH terminal; open its displayed URLs on a browser that can reach the same deployment. The short device/confirmation codes are not bearer credentials. Only approve a request you started: script labels are not verified publisher identities.

Create the input configuration from Python

On a gateway with the one-API update, you can replace --binding YOUR-BINDING with --asset ASSET --revision REVISION --curve GR --name "My correction". Choose an exact uploaded original or derived result that your account may reuse; member/compute access and write-scoped consent are still required. This does not grant access or launch code on the server. The downloadable client records its configuration command in run.json before sending it. If a response is lost, retry using the same output directory and unchanged inputs. A different task needs a new directory. Older gateways require a browser-created binding; consult their OpenAPI or ask the operator before using these flags.

The pilot CLI also accepts these input flags on prepare and correct when the configuration file has no binding. ophiolite share --asset ASSET --read ACCOUNT --reuse ACCOUNT sets read and reuse recipients for an asset you own. Sharing replaces the recipient sets; include everyone intended to retain access. A lost sharing response is not proof of failure: inspect current access in Workspace before issuing a new sharing command. Provider grants can share derived results; sharing uploaded originals requires a delegate with the appropriate scope.

The helper stores access and refresh credentials in an owner-only file at ~/.config/ophiolite/application.json. This is not encrypted keychain storage. For separate installations/projects, pass --credentials /PRIVATE/PATH.json before login, status or logout, and pass that same option to the curve client.

python3 application_access.py status
python3 application_access.py logout

Logout revokes the application grant, asks the provider to revoke its refresh token, and removes the local file. If remote revocation fails, the CLI reports it; use Workspace Developer or provider account management to finish revocation. Revocation stops subsequent requests, not an already-authorized operation or downloaded copies.

Bounded online-session pilot, qualified with Keycloak. Access tokens refresh automatically while the provider session is valid. The qualification configuration uses five-minute tokens, ten-minute idle expiry and a thirty-minute session maximum. After session expiry, run browser login and approve again. Consent expires after at most seven days but never extends provider-session validity. This is not an unattended service identity. Browser logout and application revocation are separate actions. A different self-registered account—even with a familiar email—does not inherit demo or project access. Ask your administrator for explicit account enrollment and project permissions. Live-source configurations still require administration. Retained-input runs instead require member/compute permission, an execution grant and current data rights.

Manual fallback: create a read/write delegate in Developer, set OPHIOLITE_TOKEN privately using a hidden terminal prompt, and run the curve command without an explicit credentials file. That delegate lasts five minutes and requires the parent browser session. Remove the environment variable before using browser-authorized access.

Use your actual Workspace origin, project and binding. HTTP is permitted only for loopback demos. The interval is inclusive, in the input depth unit; the offset uses the curve’s unit. These numbers fit the synthetic fixture below, not every real log.

The client reads an exact input revision and its original LAS, calculates an interval offset locally, and publishes changed samples. It skips missing samples, preserves the axis and other curves, and never edits the source file. At most 1,000 changed samples per publication; choose a bounded interval for a long log. A zero offset or an interval containing only missing values produces no result.

Return to your configuration and refresh Runs. Retained-input outputs also appear under Data → Results, where you can preview values, inspect provenance and download the LAS. Both routes create private scientific catalogue assets. Live-source outputs also retain their run-download location; collaborative reuse requires a retained distribution policy. Following an input does not run Python; publishing does not apply data to another application. Review is not compulsory.

What the result means

The output directory contains original.las, input.json, changes.json, run.json, result.las and receipt.json. Preserve this directory for retries. A receipt records the exact input, binding version, output checksum and publishing account. The application version and parameters are script-declared; the server did not observe or certify the calculation.

Normalized samples use JSON null for missingness. A genuine 0 remains zero. The original LAS retains its declared NULL sentinel. The derived LAS writes missing samples with the LAS NULL marker; it does not fill gaps. Reader/mapping versions and parsing policy accompany the input and run. Unknown units or datum are never inferred from project defaults.

For a synthetic input with depths [100,101,102,103,104] and GR [0,10,null,30,40], the example produces [2,12,null,32,40]. Independent verification, using optional lasio and numpy:

import hashlib, json, lasio, numpy as np
from pathlib import Path
folder = Path("my-result")
receipt = json.loads((folder / "receipt.json").read_text())
assert hashlib.sha256((folder / "result.las").read_bytes()).hexdigest() == receipt["receipt"]["manifest"]["sha256"]
log = lasio.read(folder / "result.las")
assert np.array_equal(log.index, [100,101,102,103,104])
assert np.array_equal(log["GR"], [2,12,np.nan,32,40], equal_nan=True)

The fixed assertions are for the synthetic fixture only. The qualification also exercised a downloaded HON-GT-01 NLOG log with 32,401 samples and a bounded correction; this does not qualify every LAS variant.

Recovery and limits

• Expired provider session or revoked grant: repeat browser login and approve a new request, then repeat the same curve command and output directory. Existing manual delegates still require their parent browser session. Revoke obsolete grants in Developer.
• Interrupted publication: repeat the identical command. Saved changes allow receipt recovery after commit even if the original file subsequently changes, provided source configuration and permissions remain valid. Different output for the same run is refused.
• Source changed before commit: refresh and review the source selection; update a pinned binding if appropriate. Start with a new output directory. Old exact file reads are not guaranteed.
• Binding changed: reload its configuration and start a new output directory. Earlier runs keep their original configuration.
• No eligible LAS input: register and select a supported LAS source under the same account. An OSDU Parquet representation is not a LAS input for this profile.
• Capacity: 100 bindings and 100 runs per account/project, plus100 retained results/project and512MiB retained bytes/journal. New application outputs no longer consume manual draft slots. This pilot does not offer automatic archival/reset.

Single gateway process; up to 100,000 samples and 64 curves; no axis or unit edits. Transfers preserve meaning; applications may deliberately alter values or missingness through explicit changed samples. Browser SQL-well subscriptions, Python curve publication and native-host integration remain separately qualified capabilities.

See the application HTTP contract.

Share and reuse a retained result

1. Open Data → Results. Inspect your result’s first200 samples, units and exact revision.
2. Select Can view and download for a permitted colleague. Select Can build on it separately if they may calculate from it; save recipients. The source distribution ceiling still applies.
3. The colleague opens Data’s catalogue, selects the result and Build on it in Python. They name their configuration and choose its curve. It runs only under their identity.
4. They run curve_application.py locally with the new binding and a fresh output directory. For the synthetic example, an additional offset1 over100–103 gives [3,13,null,33,40]. Their output is a new private catalogue asset.
5. Share that output explicitly. Root withdrawal can block the whole chain; removing an intermediate result’s reuse grant blocks new/unfinished calculations but does not delete already published descendants. Exported files cannot be recalled.

Publication is not scientific approval. Method/parameters are script-declared and exact references do not capture the execution environment. Private parent details are omitted when a recipient has only downstream access. Native synchronization, resampling, new curve columns and hosted execution remain separate capabilities.

Recovery and limits

• Missing binding: check project membership, compute permission, runner grant and deployment distribution audience with the administrator.
• Unavailable retained input: check withdrawal/review state and permissions. An upstream file replacement alone does not remove a retained snapshot.
• Login expired: reconnect in the browser and repeat the same client command/output directory. A committed result is recovered instead of published again.
• Storage full: this pilot caps retained results at 32 MiB each, 100 per project, and 512 MiB shared with retained releases. Ask the deployment operator; there is no automatic data-deletion policy.

The qualified deployment runs one gateway process. Small concurrent-client checks are not a 100-user capacity guarantee. Local dependencies belong to the application owner; these reference clients use only the Python standard library. Optional managed workers require a separate operating model, admission limits, isolation, cancellation and recovery qualification. Installing Workspace does not enable hosted Python.

Inspect a colleague’s result before using it

In Data → Catalogue, find the result explicitly shared with your account and open its inspector. Check the asset ID and exact revision, Derived result origin, review label, units and missing samples. Numeric zero is a value; Missing is not zero. The table shows only the first200 samples. Export the full LAS for further inspection.

Unreviewed means publication has not established scientific approval. Method and supplied execution details are declarations, not proof that the external program ran as described. What this record does not show lists recorded omissions. Restricted parents have withheld details; this does not mean there was no ancestry. Use Data → Results for the result author, publication time and declared parameters.

The inspector distinguishes read availability from reuse availability. If reuse is not available, do not infer its cause or try a different asset ID to bypass it; ask the administrator or author to check the applicable grants. When allowed, Build on it in Python saves an exact configuration; it does not run code. Export uses fixed filenames, so save different asset/revision downloads in separate folders.

Preparing a team handoff trial

Use a real, authorized bounded LAS correction and the same task in your existing handoff process. Agree the expected scientific result and principal success measure before testing. Count installation, account enrollment, network access, administrator source transfer and retained-input setup separately from recurring handoff effort. The complete reader/client package uses Python3.11+; record the interpreter path and version. Linux and Mac have pilot evidence; Windows is not yet qualified.

Both Workspace and the identity provider must be reachable from the participant’s machine. A local demo address is not an external deployment. Confirm data retention, sharing and any backup arrangements before transfer. Give participants their own scoped identities, not an administrator’s credentials.

The receiving colleague can inspect without coding. Testing composition additionally requires a named authorized person to run the second local Python calculation from that exact result. Record documentation use, peer/AI assistance and engineering help separately. An internal rehearsal is useful preparation, not external-user acceptance. The pilot remains limited to the documented curve operation and size limits.

For new output channels on the same LAS depth axis, use the explicitly selected derived-curves profile. The existing interval-offset client still edits one existing curve; it does not create velocity or impedance channels.

For a LAS on your computer, self-service upload and the local Python kit provide a simpler starting path. They preserve explicit local execution and publication.