Code review

Solid feature overall — happy/edge paths are covered and the .module-info + meta.yml AND-check correctly disambiguates remote modules from local includes (since setModule(true) is called by IncludeDef/ScriptLoaderV1/ScriptLoaderV2 for any include). Backward compatibility of the TaskRun positional constructor is preserved via Groovy's @Canonical defaults=true semantics.

Requesting changes for the following:

Important

1. Risk of persisting "null@null" — LinObserver.groovy:315

   return "${spec.name}@${spec.version}"

   ModuleSpecFactory.fromYaml does spec.name = data.name as String (and same for version). A valid-YAML manifest that happens to be missing those keys silently persists the GString "null@null" into the lineage record. Suggest:

   if( !spec.name || !spec.version ) {
       log.warn "Incomplete module manifest at '${manifestPath.toUriString()}'"
       return null
   }
   return "${spec.name}@${spec.version}".toString()

   The explicit .toString() is safer for downstream serializers (Kryo) than letting a GString flow into a String field.

2. Per-task overhead with no caching — storeTaskRun runs on every onTaskComplete. Each call does 2 Files.exists + a YAML parse on potentially remote FS. For workflows with thousands of tasks reusing the same module, this is O(tasks) instead of O(modules). Modules are immutable for the duration of a run, so caching is safe. Easiest fix: annotate extractModuleInfo(Path scriptPath) with @groovy.transform.Memoized — keyed on the script path, this turns it into a one-shot lookup per module.

3. catch( Throwable e ) is too broad — LinObserver.groovy:317. Catches OutOfMemoryError, StackOverflowError, ThreadDeath, etc. Use Exception (or IOException | RuntimeException if you want explicitness).

Minor

4. Test coverage gap on serialization — All 5 new tests exercise getTaskModule(task) in isolation with mocks; they do not cover storeTaskRun end-to-end nor the new field's encode/decode roundtrip. Consider extending LinEncoderTest's should encode and decode TaskRun to assert the module field survives the roundtrip.

5. Malformed-YAML test doesn't assert the warning log — Acceptable, but a regression that silently drops the warning would go unnoticed. A MemoryAppender assertion would lock it in.

6. Field naming — module is fine but slightly ambiguous given the rich nextflow.module.* package. moduleRef / moduleId would be more self-documenting and align with workflowRun (a reference id) rather than the noun "module". Not blocking.

7. Style nit — LinObserver.groovy:301: missing space before { — extractModuleInfo(Path scriptPath){.

8. Uncovered edge cases — symlinked module paths and subworkflow includes work with the current implementation (verified by reading loadModuleV2 + ScriptMeta), but a brief integration-style test would lock that behavior in.

Verification done

• Read LinObserver.groovy, TaskRun.groovy, IncludeDef.groovy, ScriptMeta.groovy, ModuleSpecFactory.groovy.
• grep -rn 'setModule\s*(' — confirmed local + remote includes both set module=true.
• grep -rn 'new TaskRun(' in test sources — confirmed pre-existing positional callers still compile under defaults=true.
• ./gradlew :nf-lineage:test — green.

Overall: changes requested, non-blocking. Once 1–3 are addressed, this is ready to merge.

Thanks @jorgee for addressing all the review points — the null-safety fix, memoization, and the extra test coverage look great. LGTM 👍