spb/autoscholar

1# Launch report — AutoScholar.ai (2026-10-30)23This report separates what was **verified on real infrastructure** from what is **blocked** or **untested**. Live run evidence: docs/TEST_REPORT.md ("Live research runs").45**First publication:** AS-WP-2026-0001 — *Sharp Zero-Forcing Bounds for Generalized Petersen Graphs: Computational Discovery and Certified Proofs for P(n,5)* — produced end to end on MacLustr (worker M4M64c, Fable 5.1), auto-published 2026-10-30 22:17 after all 15 hard gates passed; https://www.autoscholar.ai/research/as-wp-2026-0001-sharp-zero-forcing-bounds-for-generalized-petersen-graphs-computationa67## URLs and services89| Item | Value | State |10|---|---|---|11| Public site | https://www.autoscholar.ai | canonical host; `www` A record present; apex `autoscholar.ai` redirect configured but inactive until an apex A record exists |12| LAN access (operator) | http://192.168.2.85:8470 (M3U96b) | serving (public pages, admin, APIs) |13| Admin console | `/admin` | serving; bootstrap password rotated 2026-10-30 |14| Control plane processes | pm2 `autoscholar`, `autoscholar-scheduler`, `autoscholar-backup` on M3U96b | online |15| Research worker | M4M64c, LaunchDaemon `io.autoscholar.worker`, user `asworker` | online, enrolled, sandbox available |16| Database | PostgreSQL 17 `autoscholar` on M3U96b | migrated (42 tables), nightly dump + offsite copy on M3U96a |17| Artifact store | `M3U96b:~/apps/autoscholar-data/artifacts` | private `runs/`, public `public/` |18| Source of truth | `M3U96b:~/apps/autoscholar` (git, origin spbgit `autoscholar.git`) | adopted by mld |1920## Verified end to end (real infrastructure)21- Admin sign-in with `admin123` → forced rotation → `admin123` rejected (production, 2026-10-30).22- Upload of a research `CLAUDE.md` → immutable version with SHA-256 → idempotent launch (second identical launch returned the same run, HTTP 200).23- A real MacLustr worker (M4M64c, dedicated low-privilege user) leased the job, created an isolated workspace, loaded the frozen `CLAUDE.md` as project instructions (passphrase self-test), ran Claude Agent SDK sessions per stage, streamed structured events to the admin timeline, uploaded hashed artifacts, and verified real references through Crossref during the literature stage.24- Enforcement: writes outside the workspace, LAN access and non-research tools were denied by the platform hook and the Seatbelt sandbox even when the instructions requested them (self-test transcript in TEST_REPORT.md).25- Crash recovery: an HTTP 500 in the control plane during attempt 1 made the worker report a failed attempt; the scheduler re-queued the run and the worker resumed from the preflight checkpoint on attempt 2 with a new fencing token. The 500 (write-once artifact collision) was fixed and redeployed with a ~5 s gap.26- Invalid brief (clinical trial on patients, fabricated data, skipped review): preflight judged it infeasible; the run ended `failed` after USD 0.13 and never appeared publicly.27- Backup and isolated restore test executed; digests verified.2829## Blocked / needs the founder301. **DNS (optional)**: add `A autoscholar.ai → 51.161.112.61` so the bare domain redirects to www (route already configured).312. The Okun test paper was removed at the founder's request before the first real paper; the library contains only AS-WP-2026-0001.3233## Not done / limitations34- Cost ledger misses sessions that end without an SDK result (crash/abort): true spend can exceed the recorded total (documented per run in TEST_REPORT.md).35- Research agents cannot keep tool-level background tasks; long jobs must be detached (`nohup`) and are killed when a session ends. The reproduction re-run is capped at 90 min; certificate-heavy studies must ship a bounded `reproduce.sh` (as WP00001 now does) with optional full verification.36- No MFA (schema ready). No mTLS (LAN tokens). No Linux containers on MacLustr (Seatbelt + user isolation instead).37- Provider spend is the SDK client-side estimate.38- Only one worker (M4M64c) is enrolled; onboarding another node takes one installer run (docs/OPERATIONS.md).3940## Next priorities411. DNS fix → public HTTPS smoke test (`curl -I https://www.autoscholar.ai`, admin login over HTTPS, PDF download).422. Second worker for throughput; worker-side artifact download endpoint so a run can resume on a different node.433. MFA (TOTP) for the admin account; alerting hook (e.g., e-mail/Slack) on `failed`/`quality_failed`.44