# Launch report — AutoScholar.ai (2026-10-30)

This report separates what was verified on real infrastructure from what is blocked or untested. Live run evidence: docs/TEST_REPORT.md ("Live research runs").

First publication: AS-WP-2026-0001 — Sharp Zero-Forcing Bounds for Generalized Petersen Graphs: Computational Discovery and Certified Proofs for P(n,5) — produced end to end on MacLustr (worker M4M64c, Fable 5.1), auto-published 2026-10-30 22:17 after all 15 hard gates passed; https://www.autoscholar.ai/research/as-wp-2026-0001-sharp-zero-forcing-bounds-for-generalized-petersen-graphs-computationa

# URLs and services

# Verified end to end (real infrastructure)

• Admin sign-in with admin123 → forced rotation → admin123 rejected (production, 2026-10-30).
• Upload of a research CLAUDE.md → immutable version with SHA-256 → idempotent launch (second identical launch returned the same run, HTTP 200).
• A real MacLustr worker (M4M64c, dedicated low-privilege user) leased the job, created an isolated workspace, loaded the frozen CLAUDE.md as project instructions (passphrase self-test), ran Claude Agent SDK sessions per stage, streamed structured events to the admin timeline, uploaded hashed artifacts, and verified real references through Crossref during the literature stage.
• Enforcement: writes outside the workspace, LAN access and non-research tools were denied by the platform hook and the Seatbelt sandbox even when the instructions requested them (self-test transcript in TEST_REPORT.md).
• Crash recovery: an HTTP 500 in the control plane during attempt 1 made the worker report a failed attempt; the scheduler re-queued the run and the worker resumed from the preflight checkpoint on attempt 2 with a new fencing token. The 500 (write-once artifact collision) was fixed and redeployed with a ~5 s gap.
• Invalid brief (clinical trial on patients, fabricated data, skipped review): preflight judged it infeasible; the run ended failed after USD 0.13 and never appeared publicly.
• Backup and isolated restore test executed; digests verified.

# Blocked / needs the founder

1. DNS (optional): add A autoscholar.ai → 51.161.112.61 so the bare domain redirects to www (route already configured).
2. The Okun test paper was removed at the founder's request before the first real paper; the library contains only AS-WP-2026-0001.

# Not done / limitations

• Cost ledger misses sessions that end without an SDK result (crash/abort): true spend can exceed the recorded total (documented per run in TEST_REPORT.md).
• Research agents cannot keep tool-level background tasks; long jobs must be detached (nohup) and are killed when a session ends. The reproduction re-run is capped at 90 min; certificate-heavy studies must ship a bounded reproduce.sh (as WP00001 now does) with optional full verification.
• No MFA (schema ready). No mTLS (LAN tokens). No Linux containers on MacLustr (Seatbelt + user isolation instead).
• Provider spend is the SDK client-side estimate.
• Only one worker (M4M64c) is enrolled; onboarding another node takes one installer run (docs/OPERATIONS.md).

# Next priorities

1. DNS fix → public HTTPS smoke test (curl -I https://www.autoscholar.ai, admin login over HTTPS, PDF download).
2. Second worker for throughput; worker-side artifact download endpoint so a run can resume on a different node.
3. MFA (TOTP) for the admin account; alerting hook (e.g., e-mail/Slack) on failed/quality_failed.