Implementation status — AutoScholar.ai
Last updated: 2026-10-30 (first build day). Phases follow the master build instructions §13. "Evidence" points to docs/TEST_REPORT.md.
| Phase | Status | Evidence / notes |
|---|---|---|
| 0 Discovery | done | docs/INFRA_DISCOVERY.md, docs/DECISIONS.md; health probes of M3U96b/M4M64c; SDK docs verified. |
| 1 Foundation | done | pnpm monorepo, Biome, Vitest, zod schemas, Drizzle schema (42 tables) + migration, storage/auth/observability/research-contract/maclustr-adapter packages, .env.example. pnpm lint, pnpm typecheck, unit tests green. |
| 2 Public experience | done | All public routes, design system, PDF viewer, citation exports, JSON-LD, sitemap/robots/RSS/Atom, staging-only sample flagged synthetic and excluded in production. 25/25 Playwright e2e incl. axe a11y and responsive screenshots. |
| 3 Auth + admin | done | One-time bootstrap admin123 → forced rotation (verified in production on 2026-10-30; admin123 now rejected), Argon2id, sessions/CSRF/rate limits/lockout/audit, full admin console (overview, new research, projects, runs with live timeline, MacLustr, manuscripts, quality, publications, templates, settings). |
| 4 Persistent orchestration | done | Postgres queue with SKIP LOCKED, leases + fencing tokens, heartbeats, checkpoints, cancel/retry, event ledger with reconnect cursors (SSE), artifact ingestion with digests, simulated worker for tests. 12 integration tests (duplicate launch, fencing, crash/expiry/resume, cancel, runtime cap, synthetic never publishes, idempotent publication). |
| 5 Real MacLustr execution | done | Worker installed on M4M64c as asworker (LaunchDaemon, pf egress rules, Seatbelt sandbox); enrolled with the control plane on M3U96b over the LAN; self-test proves CLAUDE.md loading, in-workspace output, and enforcement denials (hook + sandbox). Milestone research run launched from the admin API (see Phase 6). |
| 6 End-to-end research production | in progress | Stages 0–8 implemented as checkpointed SDK sessions (preflight → framing → literature → design → execute → robustness → manuscript → independent review → revision/reproduction), scholarly connectors (OpenAlex/Crossref/arXiv/Semantic Scholar/PubMed) with platform-side verification and generated BibTeX, tectonic builds, page previews. First real run (empirical, Okun's law G7) and an intentionally invalid run (clinical brief) launched 2026-10-30; a second-mode run follows. Results recorded in TEST_REPORT.md when complete. |
| 7 Quality + publication | done (code), pending live evidence | 16 deterministic gates incl. hard blockers; server-side decision; transactional idempotent publication with AS-WP-YYYY-NNNN sequence, promotion allow-list, corrections/retractions/withdrawal; founder halts. Live auto-publication awaits the milestone run. |
| 8 Hardening + deployment | mostly done | Deployed via mld (M3U96b:8470, pm2 web + scheduler + nightly backup), tunnel route autoscholar.ai → M3U96b:8470 created on BHS64; restore test executed; security headers/CSP; docs/SECURITY.md. Public HTTPS verified on https://www.autoscholar.ai (A record added by the founder; canonical host switched to www; apex redirect configured, inactive until an apex A record exists). |
| 9 Launch readiness | pending | Founder guide + LAUNCH_REPORT after the milestone run and DNS fix; test papers to be removed from production before launch. |
Deviations from the build instructions (see DECISIONS.md)
- D-02 single Next.js app serves API + UI; D-07 filesystem artifact store (no S3 in the cluster); D-15 qa/publisher run inside the scheduler process; D-16 development happened on the laptop until first deployment, then
mld adoptmadeM3U96b:~/apps/autoscholarthe git source of truth (origin spbgitautoscholar.git); later changes were pushed through spbgit and pulled on the node (remote-first from launch on).
Known gaps
www.autoscholar.aihas no DNS record (not created).- No MFA yet (schema ready).
- Reproduction of analyses runs under a Seatbelt profile with network access (needed for package installs); no Linux container isolation available on the cluster.
- Opus 5 safety classifier can flag adversarial self-test prompts; the self-test uses Sonnet for the boundary session and the production policy prompt makes the research model decline boundary-crossing instructions on its own (enforcement still verified by hooks/sandbox).