docs: public HTTPS verified on www.autoscholar.ai
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2 changed files +2 −2
modified
docs/IMPLEMENTATION_STATUS.md
+1 −1
@@ -12,7 +12,7 @@ Last updated: 2026-10-30 (first build day). Phases follow the master build instr | ||
| 12 | 12 | | 5 Real MacLustr execution | **done** | Worker installed on M4M64c as `asworker` (LaunchDaemon, pf egress rules, Seatbelt sandbox); enrolled with the control plane on M3U96b over the LAN; self-test proves CLAUDE.md loading, in-workspace output, and enforcement denials (hook + sandbox). Milestone research run launched from the admin API (see Phase 6). | |
| 13 | 13 | | 6 End-to-end research production | **in progress** | Stages 0–8 implemented as checkpointed SDK sessions (preflight → framing → literature → design → execute → robustness → manuscript → independent review → revision/reproduction), scholarly connectors (OpenAlex/Crossref/arXiv/Semantic Scholar/PubMed) with platform-side verification and generated BibTeX, tectonic builds, page previews. First real run (empirical, Okun's law G7) and an intentionally invalid run (clinical brief) launched 2026-10-30; a second-mode run follows. Results recorded in TEST_REPORT.md when complete. | |
| 14 | 14 | | 7 Quality + publication | **done (code), pending live evidence** | 16 deterministic gates incl. hard blockers; server-side decision; transactional idempotent publication with `AS-WP-YYYY-NNNN` sequence, promotion allow-list, corrections/retractions/withdrawal; founder halts. Live auto-publication awaits the milestone run. | |
| 15 | −| 8 Hardening + deployment | **mostly done** | Deployed via `mld` (M3U96b:8470, pm2 web + scheduler + nightly backup), tunnel route `autoscholar.ai → M3U96b:8470` created on BHS64; restore test executed; security headers/CSP; docs/SECURITY.md. **Blocker:** public HTTPS is down because the GoDaddy zone for `autoscholar.ai` currently has **no A record** (the record seen at discovery was removed the same day; Let's Encrypt refuses issuance). Founder must re-add `A @ → 51.161.112.61` (no change made by the build, per rule 7). | | |
| 15 | +| 8 Hardening + deployment | **mostly done** | Deployed via `mld` (M3U96b:8470, pm2 web + scheduler + nightly backup), tunnel route `autoscholar.ai → M3U96b:8470` created on BHS64; restore test executed; security headers/CSP; docs/SECURITY.md. Public HTTPS verified on **https://www.autoscholar.ai** (A record added by the founder; canonical host switched to www; apex redirect configured, inactive until an apex A record exists). | | |
| 16 | 16 | | 9 Launch readiness | **pending** | Founder guide + LAUNCH_REPORT after the milestone run and DNS fix; test papers to be removed from production before launch. | |
| 17 | 17 | |
| 18 | 18 | ## Deviations from the build instructions (see DECISIONS.md) |
modified
docs/TEST_REPORT.md
+1 −1
@@ -17,7 +17,7 @@ Updated 2026-10-30. Every line below was actually executed; results are copied, | ||
| 17 | 17 | | Check | Result | |
| 18 | 18 | |---|---| |
| 19 | 19 | | Control plane deployed via `mld deploy autoscholar --node M3U96b` | pm2 `autoscholar`, `autoscholar-scheduler` online; local health 200; tunnel route `autoscholar.ai → M3U96b:8470` created on BHS64 | |
| 20 | −| Public HTTPS | **blocked**: GoDaddy zone has no A record (Caddy: `no valid A records found for autoscholar.ai`) — founder action required | | |
| 20 | +| Public HTTPS | `www.autoscholar.ai` A record added by the founder in the afternoon → canonical host switched to www, tunnel route re-pointed (`www.autoscholar.ai → M3U96b:8470`, apex redirect prepared). Verified over the public gateway: 8 public routes 200; HSTS/CSP/nosniff/X-Frame headers present; `/api/internal/*` through the gateway → 403; admin login over HTTPS (Secure cookie) → session 200, admin page 200, mutation without CSRF 403, logout 200; staging sample absent (`total: 0`, 404 on its page). Apex `autoscholar.ai` still has no A record (redirect inactive). | | |
| 21 | 21 | | Admin bootstrap in production | login `admin123` → `mustChangePassword: true`; privileged call before rotation → 403; rotation accepted; `admin123` → 401 afterwards; new password login ok (`mustChangePassword: false`). Executed from M1M32 over the LAN with an explicit cookie header. | |
| 22 | 22 | | Worker install (M4M64c) | user `asworker` (uid 502, non-admin, hidden), LaunchDaemon running, `/etc/autoscholar/worker.env` root:asworker 0640, pf anchor loaded (LAN/Tailscale/CGNAT blocked for uid 502 except 192.168.2.85:8470 and DNS), tectonic bundle cached, enrolled (`compute_workers`: online, sandboxAvailable=true, Tectonic 0.17.0) | |
| 23 | 23 | | Worker self-test (`node dist/main.js selftest`, as asworker) | `ok: true` — CLAUDE.md passphrase recalled and written to `results/passphrase.txt` (instruction loading proven); denials recorded by enforcement: `Write: write outside the run workspace`, `Bash: LAN/loopback network access`, `ToolSearch` (then allowed); Seatbelt blocked `cp … /tmp/passphrase-backup.txt` (`Operation not permitted`); no write outside the workspace observed; LaTeX class compiled (2 pages); cost USD 0.13. With the production policy prompt the model declines the same steps on its own; enforcement was verified with the policy prompt removed. | |
| 24 | 24 | |