Added a python-based wrapper script for lean-lsp-mcp that intercepts and cleans the 'severity' schema field from the tools/list output, resolving the 400 error from Moonshot API which strictly forbids defining 'type' in parent schemas alongside 'anyOf'.
Build: 3314 jobs, 0 errors (lake build)
- Replace repo .mcp.json with minimal config (10 essential servers instead
of 29). Full backup retained as .mcp.json.full.
- Remove inline MCP section from ~/.config/opencode/config.json so OpenCode
loads only repo .mcp.json (also removes hardcoded Linear token leak).
- Add singleton guards to opencode_prover_mcp.py, token_saver_mcp.py, and
remote_lean_proof_mcp.py to prevent duplicate instances when multiple
IDE configs reference them.
Build: N/A (Python shims)
- qaoa_adapter.py: fix finsler_metric_to_qubo to store Q_ij + Q_ji per
undirected pair; update is_anisotropic and _find_anisotropic_pair to
accept raw_matrix so asymmetry detection still works after summation;
add measure option to pauli_to_cirq.
- benchmark_finsler_qaoa.py: new benchmark harness for Finsler-Randers
routing via QAOA.
Formulate directed Finsler routing as TSP-MTZ (QAP) using HiGHS MIP and
benchmark against QUBO subset-selection. Five solvers across four sizes.
Key results:
- QAP-MIP scales well: n=48 solves to feasibility in 13s
- QUBO degenerate for all-positive Q_ij (unconstrained always selects 0)
- 2-phase strategy viable: QUBO-card to select K, then TSP-on-subset
Build: N/A (Python shim)
Perceval is the photonic quantum simulation SDK used by
rrc_photonic_stress_test.py (SLOS backend). Already installed
system-wide; added to requirements.txt for venv reproducibility.
- Redirected the default RDS_HOST/PGHOST database connection default
to neon-64gb (100.92.88.64) across all Python shims, shell wrappers,
and Rust probes.
- Cleaned up local defaults in rds_connect.py, sync_wiki_to_rds.py,
dataset_ingest_rds.py, batch_embed_artifacts.py, db.rs, cache-offload.sh,
db-consolidate.sh, backup.sh, and ene-api-wrapper.sh.
Build: 0 jobs, 0 errors (lake build)
- Replaced database-1-instance-1.cghu8yqogqwo.us-east-1.rds.amazonaws.com
with 'localhost' as default.
- Removed AWS IAM generate-db-auth-token CLI subprocessing and boto3
token generation blocks from rds_connect.py, ingest_flexure_joints.py,
pist_route_repair.py, and ene-api-wrapper.sh.
- Purged AWS DEFAULT_REGION and AWS_REGION configurations where applicable.
- Updated Rust rds_probe to use standard PG environment variables.
Build: 0 jobs, 0 errors (lake build)
Implemented rrc_bosonic_db_buffer.py containing AsyncDatabaseBuffer
which queues, batches, and flushes PostgreSQL inserts for bosonic tensor
network receipts and metrics. Documented both rrc_bosonic_tensor_gpu.py
and rrc_bosonic_db_buffer.py in 4-Infrastructure/AGENTS.md.
Build: 0 jobs, 0 errors (lake build)
Encodes each Burgers representation as a node connected by proven
isomorphisms from the codebase. Continuous-time quantum walk e^{-iAt}
on the adjacency matrix converges to eigenvector centrality; the
0D DualQuat Braid is confirmed as the universal hub (#1 in all three
rankings: centrality, quantum walk probability, and degree).
Build: N/A (Python shim, no Lean files touched)
Replace the TODO(lean-port) sorry with a complete proof of the
projectionOrdering theorem: for positive SourceValue pairs s1 < s2
with s2 ≤ maxExpected, projectToCoding preserves strict ordering
of the Q0_64 values.
The proof uses Nat-only arithmetic (no Float) and handles two cases:
- a2 < d: both values fit in Q0_64 range, ordering follows from
monotonicity of integer division
- a2 = d: a2*s/d = s clamped to q0_64MaxRaw; a1*s/d < q0_64MaxRaw
via the key inequality (d-1)*s < (s-1)*d
Build: 8598 jobs, 0 errors (lake build)
AGENTS.md: added SpherionTwinPrime architecture section, updated Burgers energy dissipation to parametric form.
spherion_twin_prime.py (20KB): priority-queue walk with polarity energy tuning.
Build: 8598 jobs, 0 errors.
- e8_singer_improvement: proven via Singer set as direct witness; (119/120)^k ≤ 1 by
pow_le_one₀, bound follows from mul_le_of_le_one_right.
- erdos30_e8_conditional: proven via interval_sidon_exists (Singer's theorem bridge);
C=1/4, Nat.sqrt ↔ Real.sqrt bridge via nlinarith on squared terms.
- sidon_weight_bound: restated — LHS corrected from σ₃(a+b) sums to σ₃(a)·σ₃(b)
products over unordered pairs (original was INVALID_STATEMENT; E₈ convolution
identity delivers products, not values at pair-sums). Remains ANALYTIC_OPEN.
- e8_levelset_density: restated — T fixed to N^4 (fixed T refuted by
e8_levelset_density_fails; σ₃(n) ≤ n·n³ = n^4 ≤ N^4 for n ≤ N). Fixed base
typo Nat.log N → Nat.log 2 N. Remains ANALYTIC_OPEN sorry.
- §14 summary updated with proven theorems and restatement notes.
- Add merkle_tensegrity_load_equation_generator.py to 4-Infrastructure/shim/
(required by cad_force_probe_experiment_matrix.py import).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This squashes all local history (768 commits) onto the scrubbed PR #90
baseline. Individual commits were lost during filter-repo corruption;
the working tree content is preserved intact.
Build: N/A (working tree state only)
Squash the four overlapping feature branches into a single change set against
main, eliminating cross-PR merge conflicts and the duplicated CI-fix scripts.
What this brings in (merge order #79 -> #80 -> #81 -> #89):
- #79 refactor(infra): shared utilities (4-Infrastructure/lib/*: q16, hashing,
jsonl, fraction_utils) + the scripts/math-first/* validators that the
math-check CI requires.
- #80 feat(lean): Semantics.E8Sidon (1025 lines) -- Eisenstein coefficient
identity E4^2 = E8 and the Sidon framework. E4_sq_eq_E8_coeff is fully proved
(all Fourier-coefficient extraction machine-checked); the single residual gap
is pinned to E4_sq_eq_E8_qExpansion (Mathlib lacks the valence formula /
dim M8 = 1). 4 sorries + 1 axiom (e8_additive_completeness), all TODO(lean-port).
- #81 refactor(lean): Float-free FixedPoint core (integer-only sqrt/log2/expNeg).
E8Sidon.lean kept at #80's final 1025-line version (the #81 intermediate
438-line copy was overridden by merge order).
- #89 feat(lean): Semantics.RRC.PolyFactorIdentity -- short-sleeve polynomial
detection at the zerocopy limb boundary; now imports Semantics.E8Sidon for
sigma3/sigma7/convolutionLHS (single source of truth) instead of inlining them.
Conflict resolution:
- flake.nix -> canonical rs-surface removal (Garnix shutdown).
- scripts/math-first/* -> byte-identical across branches, clean.
- .cursorrules / AGENTS.md -> unified; baselines + sorry inventory refreshed.
Verification:
- lake build (default aggregator): 3573 jobs, 0 errors.
- lake build Semantics.RRC.PolyFactorIdentity (E8Sidon + FixedPoint + PolyFactor):
3655 jobs, 0 errors. Witnesses verified (sigma7 4 = 16513, convolutionLHS 6 = 2350).
- Python tests: 68/68 pass.
Note: the "Workers Builds: researchstack" check is a preexisting external
Cloudflare build unrelated to this change (no branch touches 4-Infrastructure/cloudflare/).
Build: 3573 jobs (default), 3655 jobs (narrow), 0 errors
Co-Authored-By: Allaun Silverfox <bigdataiscoming+9i37y6j2@protonmail.com>
* fix(security): remove hardcoded secrets, patch command injection, tighten CORS and Cypher guard
- run_import_workflow.py, run_multi_import.py: replace hardcoded budget
password with BUDGET_PASSWORD env-var (fail-fast if unset)
- server.js /ingest: replace shell-interpolated exec() with execFile()
so user-controlled title/body cannot inject shell commands
- authentik-values.yaml: blank out bootstrap_password and bootstrap_token
so they must be supplied at deploy time via --set or sealed-secret
- cluster-dashboard main.py: restrict CORS from allow_origins=["*"] to
env-configurable whitelist (default: dashboard.researchstack.info),
methods to GET, headers to Authorization+Content-Type
- neo4j_obsidian_connector_router.js (both copies): replace permissive
prefix-only readOnly regex with a deny-list that blocks
CREATE/MERGE/DELETE/DETACH/SET/REMOVE/DROP anywhere in the query, and
route readOnly queries through session.readTransaction()
Co-Authored-By: Allaun Silverfox <bigdataiscoming+9i37y6j2@protonmail.com>
* fix(security): add CALL procedure allowlist for Cypher readOnly, add OPTIONS to CORS
- Cypher guard: restore positive allowlist for CALL targets (only db.* and
apoc.meta.* allowed in readOnly mode). Extract cypherReadOnlyViolation()
helper for clarity. Both copies updated.
- CORS: add OPTIONS to allow_methods so preflight requests succeed.
Co-Authored-By: Allaun Silverfox <bigdataiscoming+9i37y6j2@protonmail.com>
* fix(security): use negative lookahead for CALL allowlist, remove dead CALL\s*\{ branch
- Replace two-regex CALL check with single negative-lookahead
CYPHER_CALL_DISALLOWED_RE = /\bCALL\s+(?!db\.|apoc\.meta\.)/i
This correctly blocks queries containing ANY disallowed CALL target,
even when bundled alongside an allowed CALL db.* or CALL apoc.meta.*.
- Remove dead CALL\s*\{ alternative from CYPHER_WRITE_RE — the trailing
\b never matched because { is a non-word character.
- Both copies updated identically.
Co-Authored-By: Allaun Silverfox <bigdataiscoming+9i37y6j2@protonmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Allaun Silverfox <bigdataiscoming+9i37y6j2@protonmail.com>
Document discrepancies between the aspirational architecture (in the
flake/docs) and what's actually deployed. Covers control plane location,
edge Caddy divergence, Traefik port, cross-namespace services, and
hostname mismatches. Load the research-stack-infrastructure-bootstrap
skill for the actual deployment procedure.
Build: no build needed
- Change middleware address from authentik-server.services.svc.cluster.local
to authentik-server.authentik.svc.cluster.local (Authentik lives in
authentik namespace, not services)
- Create ExternalName service authentik-server in services namespace so
the rs-auth Ingress can route to the cross-namespace service
Build: no build needed
Architecture alignment:
- Rewrite k3s-server.nix from aspirational role=server to actual role=agent
(cupfox is the real control-plane at 100.110.163.82:6443)
- Update flake.nix: correct serverAddr for all nodes, annotate dead nodes,
fix hostname from nixos-laptop to nixos
- Update join-agent.sh default SERVER to cupfox
- Document actual vs intended architecture in comments
Ingress:
- Add rs-apps-books Ingress for audiobookshelf (/apps/books → media ns)
- Add strip-apps-books middleware for prefix stripping
- Create ray-ingress.yaml for Ray dashboard at /server/ray
Ray:
- Fix raycluster.yaml: enable dashboard, mount /dev/dri on gpu-workers
- Point gpu-workers to qfox-1 (was neon-64gb)
- Remove nvidia.com/gpu resource dependency (use /dev/dri via Mesa)
Security:
- Move OPENID_CLIENT_SECRET from plaintext to K8s Secret ref
- Update manifest to use valueFrom.secretKeyRef
Cleanup:
- Remove 53 committed test PNG screenshots from git tracking
- Remove auth-state.json from git tracking
- Add *.png, *.json to tests/.gitignore
Build: no build needed
- Homarr OIDC env vars set (sso-homarr)
- Database created at /data/db.sqlite
- Config schema updated to v2
- Onboard wizard needs final UI completion
Build: 3313 jobs, 0 errors
- Libraries created via API (204 on creation + path update)
- Paths: /media/movies, /media/tv, /media/music
- SSO-Auth plugin Active, SSO button on login page
- Paths may need manual setting through Dashboard UI
Build: 3313 jobs, 0 errors
- Vaultwarden signups enabled then disabled after user created
- vaultwarden-api configured with allaun@researchstack.info
- API verified responding at vaultapi.researchstack.info
Build: 3313 jobs, 0 errors (lake build Compiler)
- Bootstrapped microvm-racknerd node on its live Tailscale IP 100.80.39.40.
- Connected racknerd to the central QFox cluster.
- Assigned racknerd to its own vps zone with 1G capacity.
- Made garage-cluster-init.sh robust and idempotent.
- Updated comments and topology mappings.
Build: 3313 jobs, 0 errors (lake build)
