Added an opt-in, digest- and commit-bound SC-NeuroCore exact-current LIF
runtime for compiled transitions. It preserves complete membrane state across
calls, resets only at an explicit shot boundary, commits multi-transition
execution and checkpoint restore atomically, rejects checkpoints that splice
transitions from different shot timelines, and retains full canonical SC
state/event packets while leaving the existing stateless lif_fire contract
unchanged.
Kept the SC-NeuroCore packed stochastic forward path compatible with NumPy
versions before 2.0 by selecting the existing vector-popcount implementation
when numpy.bitwise_count is unavailable.
Bound reactor-semantic installation to the public SPO >=1.3.1,<1.4
contract and Python 3.11–3.13, with an exact hash-locked CI artifact. Generic
and MIF policy construction now rejects malformed clock objects, and MIF
circular-uncertainty bounds reject NaN and both infinities before admission.
Corrected hosted verification drift: traceability assertions and the
coverage-exception ledger now match their canonical inventories, scalar
H-infinity validation consumers narrow the multi-output API explicitly, the
notebook simulates the admitted augmented DGKF closed loop, and extreme
finite capacitor-bank steps return a numerical-domain error instead of
panicking.
Made reactor-semantic integration tests independent of a sibling FUSION
checkout by carrying the exact digest-verified evidence fixture without
copied source code. The public package-version collision for the required SPO
decoder is now stated explicitly instead of implying hosted reproducibility.
Replaced the advanced tutorial's deprecated mu-synthesis/D-K and pseudo
gain-margin claims with the implemented static D-scaled mu-bound and
normalized DGKF admission boundaries.
Removed rendered legal preambles from all generated validation Markdown
producers so reports open with user-facing content, and extended the public
surface gate to reject any validation producer that could reintroduce the
forbidden preamble on a future report refresh.
Removed the public shape-controller duplicate whose response matrix was a
fixed seed-42 random array and whose kernel argument and flux-map structure
were ignored. The existing FreeBoundaryTrackingController, which identifies
coil response through repeated full-kernel solves and applies explicit
objective, actuator, slew, supervisor, and fallback contracts, is now the
sole documented plasma shape-control owner.
Replaced the mislabeled H-infinity observer/LQR paths with the normalized
continuous-time DGKF central output-feedback controller. The public API now
requires explicit normalized feedthrough matrices, fails closed on every
existence condition, discretises the admitted controller realization by
exact ZOH, and gives Rust that same realization for fair runtime parity;
historical unlike-algorithm latency rows remain identified as historical.
Catch pickle.UnpicklingError in disruption checkpoint load so corrupt
weights fail closed or fall back when opted in.
Removed seven source-tree-only console scripts that were declared in wheel
metadata but could not resolve after installation, fixed local publication
commands to pass exact artifact paths, and made wheel/sdist builds
byte-reproducible with pinned build backends, private-path validation, and
installed-target validation.
Added a deterministic review-only admission boundary for portable reactor
semantics from SCPN-PHASE-ORCHESTRATOR. CONTROL now verifies the exact
handoff and embedded FUSION digest chain, caller-supplied clock freshness,
calibration identities, and observable usability before emitting a
canonical sealed decision with actionable=false; malformed, stale,
phase-relabeled, or action-bearing handoffs fail closed without constructing
a control action.
Replaced the density estimator's ignored chord_angles pseudo-Abel kernel
with exact, metre-dimensioned straight-chord lengths through declared
circular annular shells. The estimator now validates all state, geometry,
timestep, and covariance domains and uses a Cholesky gain solve with the
Joseph covariance update; the historical keyword remains a warning-emitting
compatibility alias for normalised impact coordinates until 0.25.0.
Separated Paper 27's abstract layer indices from the illustrative
plasma-labelled hierarchy. Plasma builders, frequencies, and monitor
construction now share one explicit L=1..8 or L=16 domain and reject
undefined implicit mappings before construction; public examples now route
future reactor binding through SPO and plant validation through FUSION.
Removed the integrated scenario's write-only phase pseudo-bridge and
reclassified the retained UPDE, adaptive Knm, monitor, and stream as example
oscillator-model surfaces. Public documentation now states that reactor use
requires scenario-specific signal identification, a coupled plant solver,
physical actuator mapping, and closed-loop validation.
Replaced local implementation-stage labels in controller artifacts, physics
comments, and focused polyglot tests with descriptive responsibilities while
retaining the stable MIF module identifiers used across repositories.
Preserved the stable studio.parity-refutation.v1 federation contract while
replacing its internal finding label with a descriptive test reference and
validating the result's numerical and source-reference domains.
Replaced the legacy in-memory IMAS-like facade with an immutable,
backend-neutral COCOS-1 equilibrium snapshot; added real IMAS-Python DD3/DD4
IDS and NetCDF DBEntry round trips, real OMAS DD3 ODS round trips, explicit
COCOS/shape/current-leaf conversion, fail-closed metadata validation,
optional dependency extras, and a hashed backend CI lane. Historical names
remain warning-emitting compatibility facades until 0.25.0.
Reclassified the former mu-synthesis surface as Riccati state feedback with
bounded static structured-mu analysis: the canonical API now exposes only
controls the algorithm actually uses, while the historical module and CLI
names are deprecated compatibility facades and full frequency-dependent D-K
synthesis remains an explicit external-backend gap.
Upgraded the state estimator from a fixed affine Kalman implementation to a
genuine n-dimensional extended Kalman filter with caller-supplied nonlinear
models and analytic Jacobians, explicit process-noise/residual/retraction
contracts, fail-closed covariance validation, Cholesky gain solves, and the
Joseph covariance update while preserving the existing plasma-observer
defaults.
Pinned the repository and hosted Rust builds to 1.98.0, pinned fuzzing to the
dated nightly-2026-08-18 toolchain, and added a deterministic drift gate so
local, preflight, and workflow selectors remain aligned.
Added a deterministic, registry-bound public-claim ledger that admits only
fresh validation reports with explicit scientific and public-claim approval;
the current empty ledger prevents historical or local-proxy evidence from
being promoted through release prose.
Removed the transitive proc-macro-error2 unmaintained advisory through the
compatible getset lock update without changing MKL/linalg features, made
transitive unmaintained advisories fail closed, restored strict Rust module
documentation, aligned Python lint scopes across local and hosted gates, and
retained the supported MkDocs 1/Material 9 boundary while taking the Material
9.7.7 search-security fix.
Rebuilt the competitive comparison from exact current releases and primary
papers, replaced unmatched latency/feature rankings with an evidence-scope
matrix, and added a fail-closed machine-readable source and fairness gate.
Normalised owned source, test, workflow, build, and commentable configuration
headers to one format-native seven-line identity contract, with a deterministic
gate and reviewed exemptions for formats that cannot safely carry comments.
Added intentional MkDocs navigation and a sanitised digest manifest for all
six public MAST evidence pages, plus deterministic source/rendered link gates
and a bounded scheduled external-link audit with cache provenance.
Added a digest-sealed ownership ledger for every configured coverage
exclusion, source pragma, skip/skipif, and strict xfail, separating executing
CI variants from explicit environment and external-data blockers.
Replaced three conditional test skips with deterministic runtime assertions
so absent packed-weight fixtures or unexpected synthetic trajectory classes
fail rather than disappearing from the test result.
Added a versioned native solver C ABI with typed status codes, retained the
five historical symbols as a compatibility surface, and made the Python
bridge prefer the new real library contract.
Added generated C/Lean API reference documentation and a deterministic
cross-language ownership registry covering Python, C, Lean, Rust, and
TypeScript exports.
Added append-only benchmark custody across the Python, Rust, and polyglot
producer inventory: persistent runs are sealed before latest selection,
failed and legacy artifacts remain retained, and baseline changes require a
separate digest-verified promotion command.
Reframed the mixed repository validator as a bounded reference-evidence
campaign with side-effect-free CLI help, per-lane evidence classes, and
independent provenance, computational, physics, real-shot, facility, public,
and production admission fields.
Added deterministic public-surface hygiene for operational task lists,
prioritisation, private paths, internal task identifiers, and unresolved-plan
JSON fields, while preserving reviewed tutorial and contribution contexts.
Removed unsupported current neural-transport and neural-equilibrium timing
claims; bound the retained native-handoff observation to its dated report,
exact source revision, CI run, host, sample definition, failed runtime
admission, and non-production claim state.
Published the physics traceability schema 1.1, replacing action-oriented
fields with declarative claim-admission requirements, and regenerated the
public traceability report.
Began strict native Rust API-documentation enforcement with the PyO3/transport
package, including crate-level missing-doc and broken-link denial for its library
and benchmark binary.
Documented the public adaptive-mesh, Chebyshev-SOR, NURBS, Kuramoto, and
symplectic state contracts and made missing or broken Rust API documentation a
hard failure throughout control-math.
Documented the native configuration, constants, typed errors, grid, plasma,
thermodynamics, and stability schemas and enabled strict rustdoc enforcement
throughout control-types.
Documented the public BOUT++ validation, RF-heating parameters, radial
transport state, and memory-kernel transport contracts, closing the first 16
control-core native-doc findings.
Documented the validated AMR solve policy/hierarchy outputs and the reduced
EPED pedestal/ELM configuration and lifecycle, closing 24 additional
control-core native-doc findings.
Documented runtime kernel specialization and core Grad-Shafranov state,
controls, solve results, and probe APIs; the crate now denies missing and
broken-link rustdoc warnings at source.
Removed 16 redundant test-only configuration-path borrows so the complete
control-core all-target Clippy gate passes on the current Rust toolchain.
Documented PID/isoflux state, self-organized-criticality learning state, and
shattered-pellet disruption phases and snapshots, closing the first 31
control-control native-doc findings.
Documented H-infinity synthesis/observer state and MPC surrogate, decision,
evidence-digest, and rollout contracts, closing 37 additional
control-control native-doc findings.
Documented SNN synchronization and position-control state plus digital-twin
noise, fault, delay, neural-policy, and plasma-state contracts, closing 45
additional control-control native-doc findings.
Documented multi-shot plans, command/phase logs, admission reports, evidence
digests, and error contracts; the control-control crate now denies missing
and broken-link rustdoc warnings at source.
Added warnings-denied workspace Cargo documentation to CI, local preflight,
and the documented Makefile build path so native API regressions fail closed.
Added strict TypeDoc generation for every exported Control Studio entry point
to CI, local preflight, and the documented Makefile build path.
Rewrite disruption checkpoint / safe-API / fallback tests to real torch
train→pin→load→predict paths; remove FakeTorch and patched train/load
surfaces (real-surface E2E policy).
Extract disruption checkpoint integrity and train/load orchestration into
control/disruption_checkpoint.py. The disruption predictor
re-exports the checkpoint leaf; the optional torch model class remains on the
owner. Inventory cascade: 196 modules / 546 test files.
Extract disruption fault/noise and anomaly-alarm campaigns into
control/disruption_fault_campaigns.py. The disruption
predictor re-exports the campaigns leaf; checkpointed torch training remains
on the owner. Inventory cascade: 195 modules / 545 test files.
Extract disruption physics proxies (tearing, features, risk, warning time)
into control/disruption_physics_proxies.py. The disruption
predictor re-exports the proxies leaf; fault campaigns and checkpointed torch
training remain on the owner. Inventory cascade: 194 modules / 544 test files.
Extract disruption-risk claim boundary and heuristic provenance into
control/disruption_risk_claims.py. The disruption
predictor product surface re-exports the claim leaf; physics proxies and
training remain on the owner. Inventory cascade: 193 modules / 543 test files.
Extract integrated-scenario Spitzer, gyro-Bohm, and diffusion-step helpers
into core/integrated_scenario_micro_physics.py. The
IntegratedScenarioSimulator product surface re-exports the helpers;
R5 ladder complete. Inventory cascade: 192 modules / 542 test files.
Extract integrated-scenario coupling audit, module-exchange records, and
report I/O into core/integrated_scenario_coupling_audit.py.
The IntegratedScenarioSimulator product surface re-exports the audit leaf;
transport micro-physics remains on the owner. Inventory cascade: 191 modules /
541 test files.
Extract integrated-scenario configuration presets and ScenarioConfig into
core/integrated_scenario_presets.py. The
IntegratedScenarioSimulator product surface re-exports presets; coupling
audit and micro-physics remain on the owner. Inventory cascade: 190 modules /
540 test files.
Extract SCPN artifact JSON schema emission into scpn/artifact_schema.py. The Artifact product surface is a re-export facade over
model, validate, codec, IO, and schema leaves. Inventory cascade: 189
modules / 539 test files.
Extract SCPN artifact load/save and payload hashing into
scpn/artifact_io.py. The Artifact product surface
re-exports load_artifact / save_artifact /
compute_artifact_payload_sha256; JSON schema remains on
scpn/artifact.py. Inventory cascade: 188 modules / 538 test files.
Extract SCPN artifact compact packed-weight codec into
scpn/artifact_codec.py. The Artifact product surface
re-exports encode_u64_compact / decode_u64_compact; load/save and JSON
schema remain on scpn/artifact.py. Inventory cascade: 187 modules / 537
test files.
Extract SCPN artifact structural validation and safety-critical admit into
scpn/artifact_validate.py. The Artifact product surface
re-exports validate_artifact / validate_safety_critical_artifact;
load/save/schema/codec remain on scpn/artifact.py. Inventory cascade:
186 modules / 536 test files.
Extract SCPN artifact topology/payload model dataclasses into
scpn/artifact_model.py. The Artifact product surface and
validate/load/save/schema/codec remain on scpn/artifact.py with re-exports.
Inventory cascade: 185 modules / 535 test files.
Harden permanent privacy for non-public operational records (gitignored, MkDocs
exclude, preflight + CI gate tools/check_docs_internal_private.py). Internal
TODO/audits/handovers must never be tracked or published.
Decompose free-boundary run_tracking_shot into cohesive private stage methods
on FreeBoundaryTrackingController: validate args, initialise
shot, observe/plan correction, gain-search or recover, record history, summarise.
Public shot entry and summary keys are unchanged; claims stay separate; dual-home
C held. Inventory cascade: 184 modules / 533 test files (in-module only).
Extract free-boundary tracking response diagnostics, activation mask, coil
headroom penalties, and Tikhonov coil correction into
control/free_boundary_tracking_control_law.py. The
FreeBoundaryTrackingController product surface remains first-class with thin
wrappers; kernel-coupled identify_response_matrix and actuator application
stay on the owner; claims stay separate; shot orchestration remains on the
controller.
Inventory cascade: 184 modules / 533 test files.
Extract free-boundary tracking target/measurement vector builders into
control/free_boundary_tracking_observation.py. The
FreeBoundaryTrackingController product surface remains first-class with thin
wrappers; claims stay separate; shot orchestration remains on the controller.
Inventory cascade: 183 modules / 532 test files.
Extract free-boundary tracking objective/supervisor limit resolvers into
control/free_boundary_tracking_limits.py. The
FreeBoundaryTrackingController product surface remains first-class with thin
wrappers; claims stay in free_boundary_tracking_claims (not re-merged).
Inventory cascade: 182 modules / 531 test files.
Extract the Rust multigrid equilibrium bridge into
core/gs_rust_multigrid_bridge.py. The
CONTROL FusionKernel product surface remains first-class with a thin
wrapper; Python SOR fallback paths for missing Rust and boundary-constrained
solves are preserved. Rust algorithm semantics are unchanged. FUSION is not
edited. Inventory cascade: 181 modules / 530 test files.
Extract reduced-order phase-sync step and multi-step Lyapunov helpers into
core/gs_phase_sync.py. The CONTROL
FusionKernel product surface remains first-class with thin wrappers that
supply phase_sync config; Kuramoto numerics remain in
scpn_control.phase.kuramoto. FUSION is not edited. Inventory cascade: 180
modules / 529 test files.
Extract free-boundary solve orchestration into
core/gs_free_boundary_solve.py. The
CONTROL FusionKernel product surface remains first-class with a thin
wrapper over the outer coil/equilibrium loop; phase-sync and Rust multigrid
stay on the owner. FUSION is not edited. Inventory cascade: 179 modules /
528 test files.
Extract free-boundary coil optimisation, objective tolerances/status,
divertor configuration labels, and CoilSet into
core/gs_free_boundary_control.py. The
CONTROL FusionKernel product surface remains first-class with thin wrappers
and re-exports CoilSet; full free-boundary solve orchestration stays on the
owner. FUSION is not edited. Inventory cascade: 178 modules / 527
test files.
Extract mTanh pedestal profiles, normalised-flux guard, nonlinear plasma
source, and profile Jacobian helpers into core/gs_profile_source.py. The CONTROL FusionKernel product surface
remains first-class with thin wrappers; FUSION is not edited. Inventory
cascade: 177 modules / 526 test files.
Extract linear elliptic iterators (Jacobi, Red-Black SOR, Anderson mixing,
Python elliptic solve) into core/gs_elliptic_iterators.py. The CONTROL FusionKernel product surface remains
first-class with thin wrappers including the HPC offload branch; FUSION is
not edited. Inventory cascade: 176 modules / 525 test files.
Extract geometric multigrid primitives (restrict, prolongate, smooth,
residual, V-cycle) into core/gs_multigrid.py. The CONTROL FusionKernel product surface remains first-class with thin
wrappers; FUSION is not edited. Inventory cascade: 175 modules / 524 test
files.
Extract toroidal Green's function, vacuum poloidal flux, and mutual-inductance
helpers into core/gs_green_vacuum.py. The
CONTROL FusionKernel product surface remains first-class with thin wrappers;
FUSION is not edited. Inventory cascade: 174 modules / 523 test files.
Extract fusion-kernel configuration models and parse/dump helpers into
core/fusion_kernel_config.py. The CONTROL
FusionKernel product surface remains first-class and re-exports the public
config contracts; FUSION is not edited. Inventory cascade: 173 modules /
522 test files.
Extract core Crank-Nicolson step and multi-step rollout numerics into
core/differentiable_transport_core.py. The facade remains
an orchestration surface for validators and campaign metadata and re-exports
the public step/rollout symbols; the leaf lazy-imports facade validators and
the facade JAX gate. Inventory cascade: 172 modules / 521 test files.
Extract equilibrium-weighted transport losses, gradients, and radial weight
helpers into core/differentiable_transport_equilibrium_weight.py. The facade re-exports public symbols; the leaf lazy-imports step and
rollout primitives plus the facade JAX gate so admission monkeypatches stay
on the production path. Inventory cascade: 171 modules / 520 test files.
Extract multi-step rollout source gradients and finite-difference audit
contracts into core/differentiable_transport_rollout_ad.py. The facade re-exports public symbols; the leaf lazy-imports rollout
primitives and the facade JAX gate so admission monkeypatches stay on the
production path. Inventory cascade: 170 modules / 519 test files.
Extract one-step parameter / loss gradients and finite-difference audit
contracts into core/differentiable_transport_parameter_ad.py. The facade re-exports public symbols; the leaf lazy-imports step
validators and the facade JAX gate so admission monkeypatches stay on the
production path. Inventory cascade: 169 modules / 518 test files.
Extract local JAX gradient-admission latency benchmarks into
core/differentiable_transport_latency.py. The facade
re-exports the public symbols; benchmarks lazy-import AD asserts so the
measured path remains the production admission contract.
Extract neural and reduced gyrokinetic transport-closure adapters into
core/differentiable_transport_closures.py. The numerical
facade re-exports the same public symbols so controller tuning imports stay
stable while the facade owns only step/rollout/AD orchestration.
Require FUSION IDA same-case latency evidence to identify synchronised,
same-input solves from a converged equilibrium, bind cold/warm iteration
counts below their declared caps, and project P50/P95 from the exact warm
samples. Legacy v2 reports that relabelled JIT-warm cold continuation as
steady-state latency can no longer cross the CONTROL evidence boundary.
Authenticate the default-off Rust UDP transport heartbeat with an exact
SCPNHB01 frame, HMAC-SHA256, strict source-IP allowlist, private key-file
policy, loopback-default bind host, and monotonically increasing counter.
Invalid, spoofed, oversized, or repeated/reordered datagrams within a receiver
lifetime no longer refresh liveness; public wording now treats the heartbeat
as a transport-liveness hint rather than an independent safety function.
Harden the CODAC/EPICS actuation boundary: reject non-finite controller
outputs, clamp every finite command to its declared channel envelope, export
analog DRVH/DRVL drive limits, and make run_cycle return a zero-output
packet without invoking the controller whenever a required plant signal or
external interlock PV is missing, invalid, tripped, or outside its hard
limit. Version runtime evidence to v2 so legacy reports cannot support the
corrected fail-closed boundary claim.
Reject non-unit transition-weight envelopes for existential Z3 firing
obligations so fractional token flow cannot satisfy a discrete firing claim.
Version the formal report schema to v2 and distinguish sat, unsat,
mixed, unknown, and not-run temporal solver outcomes instead of
labelling every successful temporal bundle unsat; v1 evidence must be
regenerated before admission.
Restored the elongation- and triangularity-shear (s_kappa, s_delta) terms in
the Miller local-equilibrium radial derivatives (core.gk_geometry.miller_geometry,
Miller et al. 1998 Eqs. 36-37). The parameters were accepted and validated but
silently dropped from dR/dr and dZ/dr, leaving the metric coefficients
(g_rr, g_rt, g_tt) and Jacobian incorrect for finite shaping-shear while the
circular / fixed-shaping (s=0) domain stayed exact. Confirmed and fixed against
an independent finite-difference reference that differentiates the flux-surface
definition directly.
Add a public validate-ida-same-case command and strict CONTROL admission
model for FUSION-owned IDA evidence. The validator rejects duplicate keys,
digest/schema/threshold projection drift, forged claims, malformed gradient
audits, and optionally verifies every upstream source byte from the exact
bound Git commit. A valid integration-observed report remains explicitly
blocked rather than becoming control, facility, PCS, safety, or scientific
admission.
Add a bounded DIII-D IDA equilibrium adapter that keeps free-boundary
Grad-Shafranov mathematics in SCPN-FUSION-CORE while exposing validated SI
grids, PF-coil currents, compact p-prime/FF-prime coefficients, the FUSION
4.x implicit solve, and a three-input vector-Jacobian product at the CONTROL
boundary. Require JAX FP64, bind exact upstream solver/profile source hashes,
enforce finite shape and resource limits, and keep scientific, facility,
control, PCS, and safety claims false.
Add a self-digested MAST dB/dt source-authority gate that measures the live
five-row centre-column Mirnov source without transforming it, records the
official T versus live Tesla/sec ambiguity, and admits exactly one of two
source-attested branches: one derivative for magnetic field or no derivative
for an existing field derivative. Require matching source units, content
digest, row/geometry join, mapping-scale semantics, component/orientation/sign,
reduction/missing/bad-channel/filter/edge policies, calibration uncertainty,
and released geometry. Bind its blocker and digest into signal-binding and
replay reports so the historical zero-fill/gradient/peak recipe remains a
compatibility candidate only.
Add a self-digested MAST locked-mode authority gate that binds the official
outer-midplane saddle observation to the existing saddle row/geometry gate,
measures the legacy 201-sample boxcar in physical time without executing it,
and keeps canonical locked_mode_amp blocked until the radial component,
probe location, stationary frame, n=1 estimator, physical-frequency
filter/edge policy, pickup/background/vessel corrections, calibration
uncertainty, and estimator
evidence are source-attested. Bind its digest into signal-binding and replay
reports while retaining historical values as compatibility candidates only.
Add a self-digested MAST saddle-modal authority gate that pins the complete
FAIR-MAST mapping and geometry identity, verifies per-row finite coverage and
toroidal polygon centres without reducing them, and keeps canonical n1_amp
and n2_amp blocked until the field/geometry row join, vertical saddle set,
released geometry revision, calibration uncertainty, baseline, and
bad-channel policies are source-attested. Bind the gate digest and blocker
into signal-binding and replay reports.
Add a self-digested MAST normalised-beta authority gate that pins the
FAIR-MAST and current IMAS definitions, treats the live EFM_BETAN T-to-1
conflict as a metadata-repair candidate without changing values, retains
minor_radius without resampling, inventories the independent formula
inputs, and keeps canonical beta_N blocked until sign, scale, negative-value
validity, reconstruction quality, complete input lineage, and
one-standard-deviation uncertainty are authoritative.
Add a self-digested MAST toroidal-field authority gate that distinguishes
total bphi_rmag from vacuum bvac_rmag, binds the time-varying
magnetic-axis radius and source generation, declares the complete TF-current
alternative, and keeps canonical BT_T blocked until primary-source sign and
one-standard-deviation uncertainty authority are content-digested. Extend
acquisition to retain total field and reference radius without resampling.
Add a two-run FAIR-MAST regeneration verifier that reopens the exact
SourceObjectManifest-v2 artifacts, producer-bound replay report/archive, and
every lineage-bound dataset output; rejects tree or binding drift; requires
native source-generation pins; seals complete per-file inventories; proves
fixed-input/fixed-time byte identity; and preserves all proxy-label,
training, scientific, reuse, facility, cohort, and control blockers.
Add a fresh-output FAIR-MAST dataset producer-lineage contract that verifies
source-object manifest v2, replay report/archive v2, and a self-digested
transform specification before labelling. It binds every dataset NPZ to its
selected-array parent, acquisition transform, optional source generation,
replay member, label record, transform, and output checksum; records exact
replay exclusions; validates the sealed output against tampering; refuses
overwrite or input-directory mutation; rolls back handled failures; and keeps
proxy-label, training, scientific, reuse, facility, cohort, and control claims
false.
Upgrade new disruption replay production to report schema v2 with an
archive-first producer binding: the reopened channels.npz byte length and
SHA-256, canonical per-shot digests over all eleven finite channel vectors,
exact shot/member inventory, immutable source/output confinement, and
exclusive archive/report publication with handled-failure rollback.
Historical v1 campaign bytes remain untouched and retain their post-hoc-only
claim boundary.
Admit replay report v2 into campaign reconciliation only when its exact
embedded archive binding matches the already pinned archive byte snapshot,
including whole-file and canonical per-shot digests. The legacy v1 path and
its deterministic reconciliation report remain byte-surface compatible; v2
removes only the replay-producer-binding blocker and cannot promote any
dataset, training, scientific, reuse, facility, or control claim.
Add an immutable post-hoc FAIR-MAST dataset-lineage manifest that binds each
retained shot to verified source-parent, replay-member, transform-spec, and
dataset-artifact digests, records the exact exclusion partition, and keeps
producer-time, independent-label, training, scientific, facility, reuse, and
control claims fail-closed.
validation/gk_geometry_independent_reference.py: a structurally independent
finite-difference Miller-geometry reference, and validation/validate_gk_geometry_independent.py:
a schema-versioned cross-check (scpn-control.gk-geometry-independent-crosscheck.v1)
that validates the production metric against it across circular, shaped, high-shear,
and both signs of finite shaping-shear local equilibria — closing the Miller
geometry metric fidelity gap for external-validation tracker #47.
Exposed the GK->UPDE coupling modulation gains as a configurable
GKCouplingGains dataclass on phase.gk_upde_bridge.adaptive_knm, replacing
the hard-coded turbulence/transport/pedestal gains and the diffusivity floor
with documented, validated fields.
Added PhaseStreamServer.stop() to request a graceful shutdown of the
phase-stream broadcast tick loop.
Split the CLI monolith further: the six evidence and data-manifest validation
commands (validate, validate-release-evidence, validate-manifest,
validate-data-manifests, validate-physics-traceability, validate-rmse) moved
from cli.py into a new cli_evidence_validators.py as standalone @click.command
objects, folded back onto the root scpn-control group via
EVIDENCE_VALIDATOR_COMMANDS. The CLI surface is byte-identical (all 40 commands,
names/options/behaviour unchanged); cli.py drops to a dispatcher over the core
operational commands plus MDSplus acquisition. cli.py 1286 -> 856 L.
Split core.integrated_transport_solver further: the toroidal radial-grid geometry
helpers moved to a new stateless core.transport_geometry module — the per-cell
volume element (rho_volume_element), the Martin L-H plasma surface-area estimate
(estimate_plasma_surface_area_m2), and canonical radial-grid validation/construction
(is_canonical_radial_grid, canonical_radial_grid). _rho_volume_element stays a
thin wrapper (patched by tests), _ensure_valid_radial_grid becomes a thin orchestrator
over the pure validator, and the surface-area call site is repointed; behaviour is
byte-identical. This resolves the transport-solver god-file (2103 -> 1619 L).
Split core.integrated_transport_solver further: the runtime numerical-hardening
primitive moved from the private _sanitize_with_fallback static method to a new
stateless core.runtime_sanitization module (sanitize_with_fallback) — replace
non-finite profile entries from a fallback and clamp to optional physical bounds,
reporting the recovered count. _sanitize_runtime_state and the Crank-Nicolson
step now call the module function directly (18 call sites repointed); behaviour is
byte-identical.
Split core.integrated_transport_solver further: the multi-ion (D/T/He-ash)
species evolution moved from the private _evolve_species method to a new
stateless core.species_evolution module (evolve_multi_ion_species +
SpeciesEvolutionResult). One explicit time-step of the deuterium/tritium/
helium-ash densities under fusion burn, CFL-sub-stepped explicit diffusion, and
helium pumping, then the quasineutral electron density, effective charge, and
tungsten line radiation — with the species densities, temperatures, impurity
density, grid, and pumping time passed explicitly and the mutated state returned
for the caller to store. The confinement-time-derived pumping time stays in the
thin _evolve_species orchestrator; the burn/transport/quasineutrality physics is
byte-identical, so solver behaviour is unchanged.
Split core.integrated_transport_solver further: the auxiliary-heating source
deposition (turning a requested auxiliary power into per-cell ion/electron
temperature sources, power-normalised over the plasma volume) moved from the
private _compute_aux_heating_sources method to a new stateless
core.aux_heating module (aux_heating_source_profiles). The radial grid,
density, and cell-volume element are passed explicitly; the fail-soft branches
and power-balance telemetry are byte-identical, so solver behaviour is unchanged.
Split core.integrated_transport_solver further: the anomalous (turbulent)
transport-coefficient models moved from private TransportSolver methods to a new
stateless core.anomalous_transport module — the gyro-Bohm diffusivity scaling
(gyro_bohm_chi_profile) and a single shared gyrokinetic per-flux-surface driver
(gk_flux_surface_transport) that now backs both the external_gk and tglf_native
transport models, removing ~100 lines of duplicated per-cell solver logic. The radial
grid and plasma profiles are passed explicitly; the fail-closed guards, flux validation,
and legacy gyro-Bohm fallback are byte-identical, so solver behaviour is unchanged.
Split core.integrated_transport_solver further: the Crank-Nicolson radial-diffusion
numerics (the Thomas tridiagonal solve, the explicit cylindrical diffusion operator,
and the Crank-Nicolson tridiagonal assembly) moved from private TransportSolver
methods to a new stateless core.radial_diffusion module (thomas_solve,
explicit_diffusion_rhs, build_cn_tridiag), which takes the radial grid explicitly.
The discretisation is byte-identical; solver behaviour is unchanged.
Split core.integrated_transport_solver by responsibility: the stateless power
source/sink kernels (D-T Bosch-Hale fusion reactivity, tungsten line radiation,
bremsstrahlung) moved from private TransportSolver static methods to a new
core.plasma_power_terms module (bosch_hale_dt_reactivity,
tungsten_radiation_rate, bremsstrahlung_power_density). Solver behaviour is
unchanged — the published formulae are identical; this trims the ~1670-line
god-class and gives the microphysics kernels their own tested surface.
Split the cli monolith by responsibility: the 27 persisted reference-artifact
validation commands (validate-gk-crosscode, validate-*-reference,
validate-jax-gk-parity, validate-gk-ood-calibration,
validate-gk-interface-artifacts) moved to a new cli_reference_validators
module and are folded back onto the root scpn-control group via
REFERENCE_VALIDATOR_COMMANDS. The CLI surface is unchanged — every command
name, option, and behaviour is identical; this is an internal reorganisation
that keeps the CLI entry point a thinner dispatcher.
Split the control.nmpc_controller megamodule by responsibility: the
gradient-based transport-model tuning entry points
(tune_transport_coefficients_for_tracking, tune_transport_sources_for_tracking,
tune_transport_source_rollout_for_tracking,
tune_neural_transport_closure_for_tracking) and their result dataclasses moved
to a new control.nmpc_transport_tuning module, keeping transport-model fitting
separate from receding-horizon control. Import these symbols from
scpn_control.control.nmpc_transport_tuning; they are no longer available on
scpn_control.control.nmpc_controller. NonlinearMPC and its configuration and
runtime dataclasses are unchanged.
Split the scpn.z3_model_checking megamodule by responsibility: the
schema-versioned formal-report evidence I/O (verify_z3_formal_contracts,
write_z3_formal_report, build_z3_formal_report_payload,
build_blocked_z3_formal_report_payload, load_z3_formal_report,
validate_z3_formal_report_payload) and the Z3FormalVerificationReport
dataclass moved to a new scpn.z3_formal_report module, keeping report
persistence and schema validation separate from the Z3BoundedModelChecker
proof engine. Import these symbols from scpn_control.scpn.z3_formal_report;
they are no longer available on scpn_control.scpn.z3_model_checking. The
checker engine, Z3ModelCheckingReport, and the SymbiYosys/RTI contract
constants are unchanged.
Split the control.free_boundary_tracking megamodule by responsibility: the
fail-closed claim-evidence surface (FreeBoundaryTrackingClaimEvidence,
free_boundary_tracking_claim_evidence,
assert_free_boundary_tracking_facility_claim_admissible,
save_free_boundary_tracking_claim_evidence, and the summary/reference
validators) moved to a new control.free_boundary_tracking_claims module,
keeping run-summary claim admission separate from the
FreeBoundaryTrackingController control loop. Import these symbols from
scpn_control.control.free_boundary_tracking_claims; they are no longer
available on scpn_control.control.free_boundary_tracking. The controller,
run_free_boundary_tracking, and the acceptance/claims benchmark evidence are
unchanged.
Split the scpn.formal_verification megamodule by responsibility: the bounded
formal safety certificate I/O (SafetyCertificatePolicy,
SafetyCertificateBundlePolicy, build_safety_certificate_payload,
write_safety_certificate, generate_safety_certificate,
validate_safety_certificate_payload, and the certificate-bundle and
bundle-artifact build/validate/admit functions) moved to a new
scpn.formal_safety_certificate module, keeping certificate persistence and
admission separate from the FormalPetriNetVerifier reachability engine.
Import these symbols from scpn_control.scpn.formal_safety_certificate; they
are no longer available on scpn_control.scpn.formal_verification. The verifier
engine, verify_formal_contracts, the reachability/property report dataclasses,
and the CTL/LTL temporal specification dataclasses are unchanged.
Hardened the phase-stream WebSocket: the Origin allowlist can no longer be
bypassed by a missing Origin header when origins are configured, malformed
and non-object command frames now return a malformed_frame error and
increment a malformed_frame_rejections counter instead of being dropped
silently, and serve() always cancels and awaits its broadcast tick loop on
exit so no orphan task survives shutdown.
adaptive_knm now logs a warning when handed a coupling matrix with fewer
than six layers instead of silently returning it unmodulated.
Made the PyO3 crate testable in the Rust workspace: scpn-control-rs no
longer enables PyO3 extension-module as a default Cargo feature, the native
admission test uses the PyO3 0.29 initialization API, and CI now runs
cargo test --workspace plus realtime PyO3 parity after the maturin build.
Unified UPDE tick snapshots across NumPy, Rust, and PyO3 paths: all runtime
paths now return output-state R_layer, Psi_layer, R_global,
Psi_global, Lyapunov fields, and per-oscillator dtheta derivatives.
Made controller artifact admission fail closed on inhibitor arcs: structure
and formal-analysis paths may still opt into inhibitor compilation, but
artifact export, artifact loading, and controller construction now reject
negative dense input weights until the artifact schema carries inhibitor
topology explicitly.
Added artifact-level firing-margin metadata to compiled controller artifacts
so save/load, JSON schema validation, compiler export, and controller runtime
share one explicit default margin contract.
Shipped the native Grad-Shafranov solver source and checksum manifest as
scpn_control.core package data, with opt-in compile/load regression coverage
for the package-local bridge path.
Aligned the public safe-RL paper wording with the implemented
CPO-formulated Lagrangian constraint and control-barrier-function surface.
Down-scoped the public FPGA surface from bitstream export to generated HDL
project/evidence export, preserving synthesis-evidence admission for any
future hardware claim.
Wired runtime-bound safety certificate admission into
NeuroSymbolicController, including loaded-artifact topology matching,
certificate/binding/target/replay fail-closed admission, and focused 100%
controller coverage.
Added bounded integrated-scenario closed-loop wiring for the combined CLI
demo, connecting ScenarioSchedule feedback to
IntegratedScenarioSimulator, exposing replay-audit evidence, and keeping
measured-discharge claims blocked behind physics traceability.
Reclassified DIII-D repository reference artefacts as synthetic fixtures with
generator/seed provenance, retained local checksum coverage for those
fixtures, and renamed the CI/test surface away from real-shot validation.
Moved the untagged v1.0.0 roadmap block out of shipped history and reset it
as a future production-readiness target gated by real release evidence.
Separated the public Paper 27 manuscript references from the related
Kuramoto-Sakaguchi arXiv reference across pitch, README, and reviewer
handoff surfaces.
Added the missing root streamlit_app.py Streamlit Cloud entry point as a
thin adapter to the existing embedded WebSocket dashboard.
Synced the rendered MkDocs changelog mirror with the root changelog and added
a CI/preflight drift guard to keep future release notes single-sourced.
Replaced LagrangianPPO random-action rollouts with a learned NumPy linear
policy updated by clipped policy-gradient returns and Lagrangian safety costs.
Extended the version-sync guard to cover release notes, README PyPI/Python
badges, the Pepy all-time downloads badge, and package metadata drift.
Added a JOSS submission guard covering canonical paper metadata, bibliography
citation coverage, docs mirror links, and editorial claim-boundary text.
Added the SCPN Studio Web CI deploy step for the provisioned
scpn-control remote, corrected the Windows CI runner label, and extended
the deploy-key guard to verify the workflow.
Promoted Grad-Shafranov Python multigrid Solov'ev reconstruction into the
sealed validation evidence contract and refreshed the Rust multigrid
informational record.
Hardened the GitHub installation-token format readiness guard with canonical
source headers, public API docstrings, repository traversal tests, binary-file
skip coverage, and explicit development documentation.
Tightened the strict-mypy debt ratchet tests to cover subprocess wrappers,
malformed ledger totals, and improvement reporting at 100% focused coverage,
with development-guide documentation for the local preflight gate.
Aligned the generated SCPN Studio manifest with the deployed federation
remote entry and stable ./Panel exposure, with focused emitter CLI tests
and documentation for the generated Studio artifact.
Added a public-surface claim hygiene guard for outward-facing promotion terms,
wired it into local preflight and CI, and cleaned existing public test labels.
Crosswired the Studio Web Vite remote to the generated manifest contract by
building under /studios/scpn-control/, exposing ./Panel, and testing the
shared federation constants.
Added the deployed Studio Web manifest.json sync guard, public artifact, CI
check, focused 100% coverage, and documentation for keeping it aligned with
the generated schema-A Studio manifest.
Added the SCPN Studio deploy public key artifact with a CI/preflight guard
that validates the ed25519 public key and rejects private key-like tracked
paths.
Wired Studio Web to the portal-owned identity path by loading
GET /api/v1/auth/me with same-origin cookies and rendering only the portal
session state in the federated panel.
Added a Studio offline-sealing guard that keeps publication signing keys out
of tracked CI and deploy policy surfaces while preserving deploy-only
credential lanes.
Wired the zero-debt public API docstring quality gate into local preflight and
make lint, matching the existing CI documentation coverage lane.
Added architecture decision records for module and repository boundaries,
Python/Rust/PyO3 dispatch, solver and algorithm selection, validation evidence
strategy, and public versus internal API boundaries.
Breaking:FormalPetriNetVerifier and the scpn.formal_safety_certificate
validators no longer accept backend="z3". The explicit-state reachability
engine performs exact enumeration, not SMT, so it now raises ValueError on
backend="z3" and never stamps an unearned z3 backend label; use
Z3BoundedModelChecker in scpn_control.scpn.z3_model_checking for z3-backed
evidence. The auto and explicit-state backends are unchanged.
Un-rigged the SCPN/PID/MPC benchmark: removed the MPC's future-disturbance
foresight so the comparison uses an honest offset-free persistence disturbance
model, and removed the pass-by-construction gate. The published RMSE figures now
reflect the fair model (PID 0.121, MPC 0.047, SCPN 0.050; SCPN/MPC RMSE
ratio 1.07 — SCPN no longer "beats" a fairly-modelled MPC).
Failed closed across the shipped control path where a bare np.clip, a
magnitude floor, or a skip-if-present loop previously let non-finite or
sign-inverting inputs through silently (np.clip does not sanitise NaN):
the actuator action decoder rejects a non-finite marking place, gain, limit,
slew rate, or previous command before computing an actuator command;
the actuator decoder rejects a negative abs_max or slew rate, which would
otherwise invert the saturation/rate clamp;
the feature-error kernel rejects a negative axis scale, which would otherwise
invert the control-error sign;
the controller marking setter rejects a non-finite marking assignment;
the live controller's passthrough observation injection rejects a non-finite
sensor value, matching its own public extract_features contract (it was
previously clipped silently);
the physics safety-invariant monitor treats a missing safety channel as a
critical violation instead of silently skipping it;
the G-EQDSK parser rejects any non-finite value in the data region or its
arrays at parse time.
Replaced NumPy scalar-percentile calls in the disruption mitigation replay
path with deterministic linear interpolation, preventing local NumPy reload
failures in SPI diagnostics and halo/runaway post-disruption summaries.
Hardened RZIPController so SciPy/NumPy Riccati validation failures fall
back to a bounded NumPy discrete-Riccati gain before the zero-gain fail-closed
path, preserving the vertical-feedback contract across validated numerical
fallback paths.
Refreshed generated capability inventory metadata for the NTM coverage and
statistics-helper additions, keeping README and generated documentation
snapshots aligned with the tracked source and test inventory.
Consolidated the studio-web Dependabot stack on top of the green main branch,
including Vite, Module Federation Vite, TypeScript ESLint, ESLint, Prettier,
and lockfile transitive updates.
Merged or superseded all open Dependabot pull requests, confirmed open
Dependabot, code-scanning, and secret-scanning alerts remained clear, and
purged failed or cancelled Actions history only after replacement CI and
benchmark evidence was green.
libFuzzer harness for the Rust parser, numeric-adapter, and FFI surfaces:
reactor-configuration JSON, VMEC-like and BOUT++ text parsers, the
capacitor-bank discharge ledger, and the Kuramoto phase kernel. Includes a
fail-closed campaign orchestrator with provenance and seed-checksum evidence
reports, a tracked seed corpus, and a nightly fuzzing workflow separate from
per-commit CI.
Polyglot benchmark regression gate: a suite runner that records per-language
p50/p95/p99 latency, throughput, and run provenance, and a fail-closed gate
that compares a fresh report against a tracked baseline under an explicit
threshold policy, rejecting tampered reports or baselines, missing metrics, and
cross-CPU comparisons. Runs in evidence-only mode on the nightly workflow.
Runtime-bound formal safety certificate: binds a holding bounded CTL/LTL
certificate to a structured controller runtime identity — controller
configuration, Petri-net topology digest, SNN parameters, solver mode, runtime
target, and a declared timing envelope. Issuance, proof replay, and
facility-facing admission all fail closed unless the binding, runtime target,
timing envelope, and re-proved obligations match on the declared stack.
Bounded the scaling-and-squaring exponent in the Rust matrix exponential so an
overflowing matrix norm can no longer stall the capacitor-bank discharge; the
routine now fails closed on a non-finite norm and the discharge rejects the
input instead of looping.
Bumped GitHub Actions pins, Rust crates, Python dependencies, and studio-web
dependencies through the green Dependabot maintenance lane, while preserving
release-age safety for newly published package versions.
Restored the remote Ubuntu 3.12 coverage gate with focused module-specific
rust_engine and quantum disruption bridge tests covering native handoff,
fail-closed runtime behaviour, coefficient loading, contract tamper
detection, and advisory evidence validation.
Merged the pending green Dependabot updates for click, z3-solver,
hypothesis, GitHub Actions pins, and Rust log after refreshing stale PR
branches and confirming fresh checks.
Reconfirmed zero open code-scanning, Dependabot, and secret-scanning alerts
after the dependency maintenance lane.
Bumped package, citation, API, README capability, release-note, and public
changelog metadata to 0.20.6.
Hardened AER control-observation admission with monotonic timestamp evidence,
strict fail-closed decoding mode, Rust/PyO3 parity, and Python/Rust benchmark
coverage.
Added digest-bound AER admission metadata for geometry-neutral replay v1.1 so
replay artefacts preserve monotonic AER ingress evidence without changing
replay numerics.
Added CONTROL-owned PulsedScenarioScheduler v2 for reusable pulsed-fusion
shot lifecycles, with Python and Rust scheduler surfaces, audit-log
semantics, guard validation, public API documentation, and direct tests.
Exposed the Rust pulsed-scenario scheduler through the optional PyO3
scpn_control_rs extension with direct parity tests.
Added the CONTROL-owned capacitor-bank series-RLC state model with Python,
Rust, and optional PyO3 surfaces, scheduler telemetry adaptation, dedicated
tests, public API documentation, and benchmark evidence.
Added total RLC energy-balance reporting to capacitor-bank discharge reports,
including capacitor/inductor remaining energy, ohmic loss, prescribed-load
extraction, residual admission, PyO3 fields, dedicated tests, public guide
documentation, and Python/Rust benchmark harnesses.
Added the CONTROL-owned AER control-observation adapter with Python spike
buffers, rate/temporal/ISI decoders, Rust parity surfaces, optional PyO3
bindings, dedicated tests, and public documentation.
Added geometry-neutral replay schema v1.1 for pulsed-shot metadata admission,
with bundled schemas, v1 back-compatibility checks, report load/save helpers,
dedicated tests, and public documentation.
Added the CONTROL-owned pulsed-shot MPC admission adapter with Python, Rust,
and optional PyO3 surfaces, fail-closed scheduler-state admission, capacitor
feasibility gating, module-specific tests, public documentation, and local
regression benchmark tooling.
Added digest-bound pulsed-MPC admission decision evidence across Python,
Rust, PyO3, and benchmark reports.
Added PyO3-inclusive pulsed-MPC local regression evidence and documented the
editable bridge rebuild protocol for local native-extension development.
Added the CONTROL-owned multi-shot campaign orchestrator with Python, Rust,
and optional PyO3 surfaces, deterministic lifecycle admission, replay v1.1
metadata fields, module-specific tests, public documentation, and local
regression benchmark tooling.
Added optional pulsed-MPC admission digest propagation through multi-shot
campaign reports, replay v1.1 extensions, Rust/PyO3 parity, and Python/Rust
benchmark harnesses.
Added release-evidence admission for multi-shot pulsed-MPC campaign reports,
requiring Python, PyO3, and Rust digest-chain evidence with benchmark-context
metadata before the top-level release gate can pass.
Added release-evidence admission for PREEMPT_RT runtime-admission benchmark
reports, requiring fail-closed production-claim boundaries, benchmark
context, latency stats, and SHA-256 payload sealing.
Tightened native formal certificate release admission so production-class
AOT certificate evidence cannot be accepted unless the evidence explicitly
allows production benchmark claims and carries no validator errors.
Added PREEMPT_RT runtime admission for native hardware campaigns, including
Python policy evaluation, PyO3 native snapshot evidence, CLI fail-closed
--runtime-admission-policy require, public documentation, tests, and local
admission benchmark tooling.
Runtime telemetry now preserves the latest runtime-admission report in
extract_slab_telemetry() so emergency dumps retain scheduler, affinity,
governor, heartbeat, and PREEMPT_RT assumptions.
Lean proof-report admission now rejects non-Lean solver declarations, solver
strings that do not include the declared Lean version, and proved-contract
overclaims outside the admitted PID/SNN proof surface.
Lean proof-report admission now also rejects unrelated theorem namespaces,
module paths, and safety-case IDs so valid PID/SNN evidence cannot be padded
with stale or unrelated proof links.
Lean proof evidence in .scpnctl artifact manifests now applies the same
solver/version, proved-contract, namespace, module-path, and safety-case-ID
admission policy before safety-critical artifact loading can pass.
Lean report payloads and artifact formal-verification manifests now reject
unknown proof fields so stale or foreign evidence cannot be silently ignored.
Lean report admission now requires the canonical payload_sha256 self-digest
instead of accepting otherwise valid digestless reports.
Lean report loading now rejects duplicate JSON keys at the public API boundary,
matching the release validation executable.
Safety-critical artifact admission now uses the same duplicate-key-safe Lean
report loader for report-root manifest checks.
Z3 formal report loading now rejects duplicate JSON keys and artifact
report-root admission uses the same loader.
Z3 formal report admission now rejects unknown top-level and proof-section
fields even when the payload digest is recomputed.
Z3 formal report admission now schema-checks serialized counterexample
records before accepting bounded proof evidence.
Z3 formal report admission now rejects inconsistent section solver statuses,
including sat sections that claim to hold and unsat sections carrying
counterexamples.
Blocked Z3 formal reports now fail closed unless they carry the unavailable
solver label, zero proof depth, and only the z3_solver_available checked
spec.
Z3 proof-section checked_specs now reject duplicate or malformed entries
instead of relying only on top-level report de-duplication.
Z3 proof sections with solver_status="unknown" now reject
counterexamples because unknown solver states are not discovered
violation paths.
Z3 pass/fail reports now reject the unavailable-solver label so
missing z3-solver remains blocked evidence rather than proof
evidence.
Z3 pass/fail reports now require solver metadata to identify
z3-solver, preventing foreign SMT labels from being admitted as
Z3 proof evidence.
Bumped package, citation, API, README capability, and release-note metadata to 0.20.4.
Added v0.20.4 release notes and exposed them in the MkDocs navigation.
Updated documentation, benchmark, validation, deployment, onboarding, notebook, and pricing surfaces for the native runtime evidence lane and local-regression benchmark boundary.
Replaced regex-based Lean theorem, module, and safety-case identifier
admission with linear-time validators to remove the CodeQL ReDoS finding
while preserving the formal-evidence identifier contract.
Bumped package, citation, archive, API, README capability, and release-note
metadata to 0.20.2.
Reworked the README into clearer product, reading-path, feature, evidence,
and limitation sections while preserving existing project content.
Added v0.20.2 release notes and exposed them in the MkDocs navigation.
Tightened public wording for gyrokinetic, real-time latency, disruption,
validation-summary, and coverage claims so external-code, measured-shot,
target-hardware, peer-reviewed, and plant-deployment claims remain blocked
until strict evidence admission exists.
Documented the benchmark-regression and native C++ build-hardening changes
as release-readiness improvements.
Bumped the package and citation metadata to 0.20.0 for the release-preparation candidate.
Reworked the README, documentation landing page, onboarding guide, use-case page, tutorial index, notebook gallery, API version snippet, MkDocs navigation, and release notes so new users can understand the controller-facing evidence layer, application value, collaboration needs, and strict production-readiness boundary.
Regenerated the capability manifest and README capability snapshot from the current tree.
Added a repository-published MAST EFM neural-equilibrium campaign report that aggregates the six-shot public EFM evaluation, records storage-relative artefact references and digests, and keeps predictive EFIT/P-EFIT admission blocked pending full-output evidence.
Added a storage-hosted MAST EFM neural-equilibrium supervised dataset builder and repository-published dataset evidence report with deterministic shot-held-out train, validation, and test splits, padded LCFS geometry metadata, SHA-256 traceability, and an explicit block on predictive EFIT/P-EFIT admission pending full-output model validation.
Added a neural-equilibrium training-campaign planner that verifies prepared MAST EFM storage-host payloads, tracks deferred QLKNN/QuaLiKiz and external EFIT/P-EFIT dataset lanes, publishes run-order evidence, and records GPU-hour planning budgets without launching long training jobs.
Added a dry-run-first MAST EFM neural-equilibrium trainer that validates the prepared dataset/report contract by default, emits a launch report, and requires explicit --execute before writing deterministic full-output baseline weights or holdout metrics.
Added a MAST EFM feature-provenance audit and storage host dry-run launch evidence showing the prepared storage-host dataset validates on the storage host while Ip_MA, Bt_T, and ffprime_scale remain blocked because the converted public EFM bundles do not contain direct source keys.
Added an original public MAST Level 1 EFM Zarr source audit that admits plasma_current_x for Ip_MA and bphi_rmag for Bt_T, while keeping dataset rebuild blocked until the ffprime profile-to-scalar policy for ffprime_scale is declared.
Declared and implemented the public ffprime RMS-to-campaign-median policy, regenerated the MAST EFM converted references and supervised dataset on storage-host dataset storage, and updated the dataset, provenance, original-source, and dry-run launch reports so the former fallback feature list is empty.
Clarified neural-equilibrium campaign execution policy: the storage host is storage-only, while any --execute training must run on an admitted compute host or external cloud compute with storage-mounted or copied data.
Added a fail-closed MAST EFM compute-execution package: --execute now requires explicit compute-host or external-cloud admission, matching dataset SHA-256, passing feature/source provenance reports, non-storage-host weight output, and repository-published result templates for holdout, latency, GPU-cost, and admission-certificate evidence.
Hardened the MAST EFM neural-equilibrium launch and result-template evidence path with explicit report validators, canonical payload digests, storage-host storage-only output checks, and tamper-detection tests before any future admitted compute run can be cited.
Hardened JAX gyrokinetic parity evidence with aggregate case/backend coverage digests, portable report paths, a separate local CPU timing benchmark report, and refreshed CPU parity artifacts while preserving the backend-parity-only claim boundary.
Added validation/convert_mast_efm_neural_equilibrium_reference.py
to convert public MAST Level 1 EFM measured-shot Zarr campaigns into
checksum-bound neural-equilibrium reference-candidate arrays while
keeping predictive EFIT/P-EFIT claims blocked until exact-model
predictions, pressure reconstruction, declared metrics, and strict
admission artefacts exist.
Added validation/evaluate_mast_efm_neural_equilibrium.py to run
current neural-equilibrium weights against the converted public MAST EFM
reference-candidate arrays, persist prediction artefacts on storage-host dataset storage,
persist exact public EFM profile_r/profile_z coordinate grids,
report flux RMSE plus derived magnetic-axis and LCFS residual evidence
for 527 slices, and keep predictive EFIT/P-EFIT admission blocked until
full pressure, q-profile, and exact-input evidence exists.
Hardened neural equilibrium reference admission so
validation/validate_neural_equilibrium_reference.py now emits
schema-versioned, digest-bound reports with portable paths, explicit
predictive-claim state, artefact-file SHA-256 digests, duplicate
model/weight/reference-set rejection, fail-closed strict-mode report
persistence, and an explicit block on predictive EFIT/P-EFIT claims until
real P-EFIT or documented public-reference artefacts are supplied.
Hardened external GK interface artefact admission so
validation/validate_gk_interface_artifacts.py now emits schema-versioned,
digest-bound reports with portable paths, explicit public-claim state,
artefact-file SHA-256 digests, duplicate interface-code/run-id rejection,
fail-closed strict-mode report persistence, and an explicit block on
external-interface and full GK cross-code claims until real executable or
documented public-reference artefacts are supplied.
Hardened GK OOD calibration admission so
validation/validate_gk_ood_calibration.py now emits schema-versioned,
digest-bound reports with portable paths, explicit feature-schema and public
claim state, raw and canonical calibration-artefact SHA-256 digests,
Mahalanobis-metric provenance checks, duplicate-campaign rejection,
fail-closed strict-mode report persistence, and an explicit block on
deployment-calibration claims until real published, external-code, or
facility GK campaign evidence is supplied.
Hardened GK geometry reference admission so
validation/validate_gk_geometry_reference.py now emits schema-versioned,
digest-bound evidence with immutable reference-file SHA-256, per-case
digests, explicit SI units, bounded local Miller-geometry admission status,
duplicate-case rejection, direct source-checkout execution support, and an
explicit block on full equilibrium-reconstruction claims pending independent
Miller-geometry implementation or external equilibrium-code evidence.
Hardened GK species reference admission so
validation/validate_gk_species_reference.py now emits schema-versioned,
digest-bound evidence with immutable reference-file SHA-256, per-case
digests, explicit SI units, bounded-operator admission status, duplicate-case
rejection, direct source-checkout execution support, and an explicit block on
full collision-operator claims pending field-particle and external
Fokker-Planck evidence.
Hardened nonlinear Cyclone Base Case evidence so
validation/gk_nonlinear_cyclone.py writes schema-versioned JSON/Markdown
reports with canonical payload SHA-256, separates diagnostic checks from
saturated chi_i admission, emits boolean-safe persisted evidence, supports
direct source-checkout execution, and keeps the current 200-step V4 run
blocked for saturated nonlinear CBC claims.
Hardened the TORAX code-to-code benchmark evidence boundary with a
schema-versioned JSON/Markdown report, canonical scenario and payload
SHA-256 digests, direct source-checkout execution support, explicit
admitted/blocked/not-requested external-reference states, finite-metric
admission checks, and a --require-external gate that fails closed unless a
real TORAX comparison is present.
Added a fail-closed differentiable-transport full-fidelity readiness gate
that binds campaign metadata, one-step and rollout latency reports, gradient
audit digests, controller formal-proof digests, equilibrium-coupled metadata,
and admitted external reference evidence before any full-fidelity claim can
pass, and extended the benchmark/validator evidence path to publish and
structurally admit the corresponding blocked readiness artefact.
Added a GitHub Pages compute-validation financing page that explains GPU-hour,
storage, public-data, and external-code validation needs while preserving the
repository claim boundary.
Added public QLKNN and QuaLiKiz Zenodo acquisition metadata, strict
public-data acquisition manifest validation, module-specific regression
tests, and documentation that separates acquired normalised metadata from
deferred multi-GB tensor payloads and neural-transport validation evidence.
Added strict NTM island-dynamics reference-artifact admission so
full-fidelity q-profile, rational-surface, island-growth, saturated-width,
suppression-time, seed-island, and ECCD-alignment claims require
schema-versioned scpn-control.ntm-reference.v1 evidence with measured NTM
campaign or documented public-reference provenance, safe q-profile,
rational-surface, island-width-trace, and ECCD-alignment artifact URIs,
SHA-256 digests for every artifact and the canonical payload, NTM unit
contracts, ordered rho grids, positive q-profile domains, rational-surface
tokamak-ordering metadata, positive seed-island domains, tolerance-checked
physical metrics, and module-specific tamper/domain tests.
Added strict MARFE radiation-condensation reference-artifact admission so
full-fidelity onset-temperature, density-limit, Greenwald-fraction,
front-temperature, radiative-growth, impurity-fraction, connection-length,
and power-balance claims require schema-versioned
scpn-control.marfe-reference.v1 evidence with measured MARFE campaign or
documented public-reference provenance, safe temperature-profile,
density-limit, radiation-curve, and power-balance artifact URIs, SHA-256
digests for every artifact and the canonical payload, MARFE unit contracts,
ordered temperature and density scans, bounded impurity-fraction domains,
finite tokamak geometry and power-balance metadata, tolerance-checked
physical metrics, and module-specific tamper/domain tests.
Added strict EPED pedestal reference-artifact admission so full-fidelity
pedestal height, pedestal width, peeling-ballooning pressure-limit,
bootstrap-current, collisionality-width-ordering, and shaping-input claims
require schema-versioned scpn-control.eped-reference.v1 evidence with
measured pedestal-database or documented public-reference provenance, safe
pedestal-profile, EPED-prediction, bootstrap-current, and
peeling-ballooning artifact URIs, SHA-256 digests for every artifact and the
canonical payload, EPED unit contracts, ordered rho grids, positive
width/beta domains, finite tokamak shaping metadata, tolerance-checked
physical metrics, and module-specific tamper/domain tests.
Added strict ELM crash and RMP suppression reference-artifact admission so
full-fidelity ELM frequency, crash-depth, pedestal-drop, RMP-window, and
heat-flux claims require schema-versioned scpn-control.elm-reference.v1
evidence with measured H-mode campaign or documented public-reference
provenance, safe pre-crash/post-crash/event/RMP artifact URIs, SHA-256
digests for every artifact and the canonical payload, ELM/RMP unit
contracts, ordered pedestal grids, Type-I energy-fraction bounds,
tolerance-checked physical metrics, and module-specific tamper/domain tests.
Added strict SOL blob-transport reference-artifact admission so full-fidelity
blob velocity, spreading, wall-flux, and detector-event claims require
schema-versioned scpn-control.blob-transport-reference.v1 evidence with
measured probe-campaign or documented public-reference provenance, safe
reference/profile/detector artifact URIs, SHA-256 digests for every artifact
and the canonical payload, SOL unit contracts, strictly ordered
separatrix-to-wall coordinates, positive detector and blob-size domains,
positive magnetic-geometry metadata, tolerance-checked physical metrics, and
module-specific tamper/domain tests.
Hardened neural equilibrium reference-artifact admission so predictive
EFIT/P-EFIT or documented-reference equilibrium claims must use
schema-versioned scpn-control.neural-equilibrium-reference.v1 evidence with
safe reference/prediction artifact URIs, trained-weight,
reference-artifact, prediction-artifact, and canonical payload SHA-256
digests, explicit target schema, grid/unit contracts, finite
tolerance-checked psi/pressure/q-profile/boundary/axis metrics, admitted real
P-EFIT executable provenance, and tamper-detection tests.
Hardened neural transport reference-artifact admission so quantitative
QuaLiKiz, QLKNN, or documented-reference transport claims must use
schema-versioned scpn-control.neural-transport-reference.v1 evidence with
safe reference/prediction artifact URIs, trained-weight,
reference-artifact, prediction-artifact, and canonical payload SHA-256
digests, explicit target schema, QLKNN-10D feature order, unit contracts,
finite tolerance-checked metrics, admitted real QuaLiKiz executable
provenance, and tamper-detection tests.
Hardened persisted external gyrokinetic interface artifact admission so real
executable and documented public-reference parser evidence must use
schema-versioned scpn-control.gk-interface-artifact.v1 reports with safe
deck/raw-output/parsed-output artifact URIs, SHA-256 digests for each
artifact, a canonical payload digest, explicit transport/frequency/wavenumber
unit declarations, finite physical fields, admitted executable provenance,
and tamper-detection tests.
Hardened the real external-code linear gyrokinetic cross-code admission gate
so full-fidelity GK agreement evidence must use schema-versioned
scpn-control.gk-crosscode.v1 reports with SHA-256 digests for the external
input deck, external output, native input, and canonical payload, finite
growth-rate/frequency/wavenumber fields, admitted executable provenance, and
bounded native-vs-external tolerances.
Added strict admission for persisted differentiable transport one-step and
rollout gradient-latency reports, including duplicate-key rejection, backend,
dtype, claim-boundary, audit-error, sampled-index, run-count, and latency
percentile checks before the reports can support release evidence.
Hardened local preflight release-evidence admission so the non-test
release-evidence gate now generates a temporary scpn-control validate
--json-out report and admits it through scpn-control
validate-release-evidence, matching the CI artifact-admission path.
Exposed release-evidence report admission as
scpn-control validate-release-evidence REPORT, so operators can validate
CI or release JSON reports through the public CLI instead of importing the
Python validation module directly.
Added strict release-evidence report admission for the CI artifact produced
by scpn-control validate --json-out, including duplicate-key rejection,
mandatory pass status for data manifests, JAX GK parity, and physics
traceability, complete CPU/GPU parity case coverage, and an admission JSON
artifact with the source report SHA-256 digest.
Added a CI release-evidence-gate job that runs top-level
scpn-control validate --json-out and uploads the JSON report, so remote
runs now publish auditable data-manifest, JAX GK parity, and physics
traceability admission evidence.
Added the top-level scpn-control validate --json-out path to local
preflight as a non-test release-evidence gate, with source-tree import
precedence, so make preflight and make preflight-fast now catch data
provenance, JAX GK parity, and physics traceability drift before push.
Promoted physics traceability validation into the top-level
scpn-control validate command with staged-registry and scoped-skip controls
so local release validation now fails on bounded-claim registry drift in the
same path as data provenance and JAX GK parity evidence.
Promoted strict persisted JAX gyrokinetic CPU/GPU parity evidence admission
into the top-level scpn-control validate command, added scoped staging and
skip flags, and exposed case/backend requirements on
validate-jax-gk-parity so local release validation matches the CI gate.
Wired strict persisted JAX gyrokinetic CPU/GPU parity evidence admission into
the jax-parity CI job and added a module-specific repository-evidence
regression so missing CBC, kinetic-electron TEM, or stable-mode backend
pairs cannot silently drift out of release evidence.
Persisted the current JAX gyrokinetic CPU parity campaign alongside the
existing GPU campaign, regenerated the strict parity summary, and updated the
traceability and validation docs so backend parity is admitted for CPU/GPU
reproducibility without promoting quantitative external-code GK claims.
Replaced WebSocket runtime-configuration raw SHA-256 digests with a
domain-separated HMAC-SHA256 evidence digest so deterministic admission
remains stable while code scanning no longer treats the configuration proof
as weak sensitive-data hashing.
Hardened mu-synthesis claim evidence persistence so bounded static
robust-control reports now carry canonical payload SHA-256 digests and load
admission rejects duplicate keys, schema drift, edited metrics, and bounded
evidence presented as validated robust-control evidence.
Added schema-versioned geometry-neutral replay evidence admission so
stellarator replay claims bind the validated report, scenario, trace,
metrics, thresholds, magnetic-configuration provenance, actuator
calibration, latency model, and fault model by SHA-256 digest while keeping
synthetic W7-X-like replay separate from measured or benchmark device claims.
Added schema-versioned Kuramoto phase-runtime evidence admission so
deployment-target phase claims bind deterministic input digests, Python
reference output digests, optional Rust parity errors, deployment-target
oscillator coverage, and timestep-refinement convergence before runtime
claims can cite the optional Rust fast path.
Hardened controller safety-case readiness so promotion now also requires a
typed websocket_runtime_evidence artifact that resolves under the declared
evidence root, matches its SHA-256 bytes, and passes qualified WebSocket
runtime admission before deployment readiness can cite authenticated command
streams, TLS enforcement, payload caps, token-bucket limiting, broadcast
delivery, or backpressure absence.
Added schema-versioned FPGA HDL export evidence admission so generated
Verilog/VHDL project claims bind controller artifact SHA-256, generated HDL,
weight memory, timing constraints, Makefile, resource estimates, synthesis
report digests, safe report URIs, non-negative timing slack, and local-only
versus qualified synthesis claim status before safety-case readiness can cite
hardware export evidence.
Hardened controller safety-case readiness so promotion now also requires a
typed codac_runtime_evidence artifact that resolves under the declared
evidence root, matches its SHA-256 bytes, and passes qualified CODAC/EPICS
runtime admission before deployment readiness can cite CODAC timing,
interlock, export, or backpressure evidence.
Added schema-versioned CODAC/EPICS runtime evidence admission so control
boundary claims bind generated EPICS database and OPC-UA nodeset hashes,
cycle-deadline percentiles, exercised interlock blocking, backpressure
counts, local-only versus qualified claim status, duplicate-key-safe JSON
loading, and canonical SHA-256 payload digests before facility runtime
claims can cite CODAC evidence.
Hardened controller safety-case readiness so promotion now requires a typed
hil_replay_evidence artefact in addition to external physics validation,
target-hardware timing, and independent review; the artifact must resolve
under the declared evidence root, match its SHA-256 bytes, and pass
qualified-target HIL replay admission before deployment readiness can cite it.
Added schema-versioned HIL replay evidence admission for CONTROL-owned
runtime deployment claims, including canonical SHA-256 payload digests,
replay digests over controller, timing, target-hardware, interlock, and
backpressure fields, fail-closed target-hardware promotion checks, duplicate
JSON key rejection on load, and module-specific behavioural tests that keep
local replay evidence separate from qualified deployment evidence.
Hardened reviewed control-runtime defects by replacing fixed-window
WebSocket command limiting with token buckets per connection and peer,
adding structured WebSocket security audit logs, arming native-solver cleanup
only after a C++ library loads successfully, rejecting degenerate
Grad-Shafranov flux normalisation, fixing multigrid restriction on
rectangular odd grids, vectorising free-boundary coil Green's flux over the
grid, tightening NMPC SPD symmetry admission, and adding optional JAX
autodiff plant linearisation.
Added schema-versioned JAX gyrokinetic parity artifact production and
stricter admission so native/JAX local-dispersion comparisons bind backend,
device, platform, dtype, X64 state, solver kwargs, tolerances, and canonical
SHA-256 payload digests while keeping the evidence boundary limited to
backend parity until external GK validation artifacts are supplied; admission
now requires named CBC, kinetic-electron TEM, and low-drive stable-mode case
coverage when requested, binds case-parameter digests, rejects mode-spectrum
replay, and supports backend coverage requirements.
Added a quantum-enhanced disruption bridge facade that keeps quantum backend
ownership in scpn-quantum-control, lazily imports optional quantum
dependencies, maps the CONTROL 8-feature disruption contract to the ITER
11-feature contract with explicit default provenance, emits bounded
amplitude-kernel evidence, records admission evidence with feature digests
and external-evidence requirements, adds schema-versioned advisory
certificates for bridge and kernel reports, publishes a machine-readable
dependency contract for the scpn-quantum-control backend, embeds that
dependency contract in advisory reports, pins the Qiskit simulator dependency
name, records backend-contract attestation when the optional backend exposes
its own contract, adds certificate-bound advisory decision evidence with
score-basis provenance, deterministic risk-band thresholds, backend-contract
validation state, and blocked control action, and fail-closes advisory reports
behind tamper-evident claim boundaries.
Aligned the CI and local coverage gate to the current validated 93.74%
repository result as explicit temporary debt after the quantum-disruption and
physics-debugging surfaces expanded; the policy remains module-specific
behavioural tests only, with no synthetic gate-chasing tests.
Added a local-first physics debugging assistant for validation-gap analysis,
falsifiable hypothesis generation, and campaign suggestions with endpoint
allowlisting, secret redaction, cited-evidence enforcement, advisory
safety-policy admission, reviewed-draft digest binding, provider quorum
admission, and tamper-evident advisory report digests.
Added hash-addressed formal safety certificate bundle artifact admission so
release gates verify safe relative bundle URIs, bundle SHA-256 bytes,
tamper-evident artifact metadata digests, UTC creation timestamps, embedded
certificate digests, artifact binding, backend, and required certificate
policy before replaying certificate evidence.
Added formal safety certificate admission policies so certification campaigns
can require minimum proof depth, controller artifact binding, CTL/LTL
evidence, and named checked specifications before JSON/Markdown certificate
artifacts are emitted or admitted.
Added a one-call formal safety certificate workflow that resolves one
Petri-net verifier backend, runs base safety/liveness plus CTL/LTL
obligations, binds optional controller artifact bytes by SHA-256, and
persists certificate JSON/Markdown evidence.
Hardened formal safety certificate publication with JSON/Markdown writers and
semantic section-admission checks that reject internally inconsistent
certificate evidence even when the payload digest is recomputed.
Added bounded CTL/LTL formula facades and schema-versioned formal safety
certificate payloads for SCPN Petri-net controllers, including
tamper-evident payload digests and shared explicit-state/Z3 formula checking.
Hardened stellarator geometry configuration with a Pydantic v2 schema/export
path, construction-time physics-bound validation, and immutable validated
config objects so ISS04, Boozer-surface, and neoclassical calculations cannot
observe post-validation mutation.
Hardened EPED pedestal configuration with a Pydantic v2 schema/export path,
construction-time physics-bound validation, and immutable validated config
objects so solver calls cannot observe post-validation mutation.
Hardened FusionKernel configuration loading so runtime JSON is retained as a
typed Pydantic v2 model with schema-normalised boundary variants while the
legacy dict view remains a compatibility export for solver internals.
Hardened controller safety-case readiness artefacts so target-hardware timing evidence must resolve under a supplied artifact root, match the declared SHA-256 bytes, and pass the schema-versioned E2E latency validator before promotion readiness can cite it.
Hardened end-to-end control-latency evidence so benchmark reports now use a
schema-versioned canonical payload digest and admission rejects tampering,
non-positive run counts, unordered percentiles, mismatched overhead factors,
unqualified target-hardware metadata, and altered local-evidence boundaries
before runtime-readiness claims can cite latency reports.
Hardened Z3-backed SCPN formal-verification evidence so pass, fail, and
blocked reports use a schema-versioned payload, canonical SHA-256 integrity
digest, explicit solver metadata, and manifest-matching status, depth, solver,
and checked-specification admission before safety-critical controller
artifacts can reference SMT proof reports.
Hardened differentiable-transport evidence admission so gradient-audit
evidence revalidates finite non-negative losses, tolerance agreement with
campaign metadata, unique in-domain sampled audit indices, pass/fail
consistency with maximum audit error, strict integer latency run counts, and
ordered latency percentiles before controller-tuning evidence is persisted or
admitted; the rollout source-gradient loss now remains inside the traced JAX
graph and the module enables JAX x64 before importing jax.numpy so dtype
evidence is not silently downgraded.
Hardened digital-twin online-update evidence admission so bounded Bayesian
update claims revalidate finite non-negative losses, loss-history minima,
source binding, unique bounded parameter priors, best-parameter domains,
strict integer campaign settings, and simulator units for every observation
target before evidence digests are admitted.
Hardened geometry-neutral stellarator replay admission so scenarios fail
closed on nonzero initial frames, missing objective metrics, impossible
current constraints, unsupported stuck-fault modes, and non-integer runtime
report inputs before replay evidence or manifest digests are produced.
Added tamper-evident SHA-256 payload digests to persisted RZIP
calibration evidence and benchmark reports so admission rejects modified
evidence payloads before facility-claim promotion.
Hardened RZIP facility-claim admission so calibration evidence is
revalidated against source class, reference growth-rate presence, finite
physical fields, and declared growth-rate tolerance at admission time.
Hardened the JAX traceable runtime public boundary so single-loop rollouts
reject batched command arrays, reject vector initial states deterministically,
and validate parity integer seeds before reproducibility campaigns are built.
Added tamper-evident geometry-neutral stellarator replay manifests that bind
scenario, trace, metric, and threshold payloads with SHA-256 digests and
fail closed on manifest, trace, or acceptance tampering.
Renamed the IMAS ODS adapter contract test file to avoid the retired generic
test filename pattern while preserving the same module-specific behaviour.
Added a fail-closed formal proof-manifest gate for safety-critical SCPN
controller artifacts, including bounded-claim enforcement, hash-addressed
report metadata, and mandatory counterexample paths for failed proof
evidence.
Hardened safety-critical proof-manifest admission by binding evidence to the
canonical controller-artifact payload SHA-256, rejecting unsafe report URIs,
constraining formal backends, and optionally verifying report bytes under a
caller-supplied report root.
Added tamper-evident differentiable transport admission evidence that binds
JAX campaign metadata, sampled gradient-audit results, equilibrium coupling,
and optional safety-critical controller proof artifact digests before
controller-tuning claims can be promoted.
Added tamper-evident digital-twin online-update evidence that binds TRANSP
and TSC simulator metadata, observation and prior digests, Bayesian-update
result digests, baseline-improvement status, and optional safety-critical
controller proof artifact digests.
Added a bounded controller safety-case evidence workflow that links a passing
formal controller proof manifest, audited differentiable-transport evidence,
and TRANSP/TSC-backed digital-twin update evidence to the same canonical
controller artifact digest.
Added schema-versioned controller safety-case manifest persistence with an
integrity digest so archived evidence bundles fail closed on malformed schema
or payload tampering before replay admission.
Added an explicit controller safety-case readiness gate that remains blocked
until external physics validation, target-hardware timing evidence, and
independent safety-review digests are all present and bound to the current
safety-case bundle.
Added schema-versioned controller safety-case readiness manifest persistence
with an integrity digest so promotion decisions fail closed on malformed
schema or payload tampering before replay.
Added typed controller safety-case readiness artefacts so promotion evidence
requires kind-specific external validation, target-hardware timing, and
independent-review artifacts with safe relative URIs, producers, timestamps,
and SHA-256 digests.
Hardened the phase WebSocket stream with explicit payload-size limits,
server-side frame caps, default client authentication, TLS-required startup
mode, disabled-by-default query-token authentication, fail-closed plaintext
non-loopback binding, browser-origin allowlisting, command allowlisting, and
CLI/documentation coverage for authenticated remote exposure.
Added a Pydantic v2 schema/export path to TokamakConfig, extended E2E
latency evidence with target-hardware metadata, and exposed NMPC optional
casadi/fail-closed acados solver backend contracts.
Implemented the optional NMPC acados OCP interface with injected runtime
factories, symbolic discrete dynamics support, augmented-state slew-rate path
constraints, SQP/partial-condensing HPIPM defaults, exact-Hessian mode,
warm-start staging, and fail-closed solver-status handling.
Hardened NMPC acados result admission with finite state/control trajectory
checks, state and terminal-set enforcement, slew-rate revalidation, and a
runtime plant-consistency residual gate for symbolic-dynamics drift.
Added a strict E2E latency-evidence validator so unqualified local benchmark
runs cannot be admitted as target-hardware or real-time performance evidence.
Double-gated controller bit-flip fault injection behind both constructor and
environment opt-ins, and hardened controller JSONL append handling against
symlink-target writes where platform support is available.
Hardened real-data manifest artefact verification so checksum-covered local
evidence must use relative, non-traversing paths resolved under the manifest
evidence tree or repository root.
Added shared external-reference URI admission for density, RZIP, orbit, and
VMEC validation gates so external artifact claims reject ambiguous relative
paths, arbitrary local file URIs, hosted file URIs, and traversal paths.
Hardened external executable provenance admission for GK cross-code, GK
interface, and neural transport reference validators so real external-code
claims reject URI, relative, traversal, temporary, and system-control
binary_path values.
Added a public production-readiness boundary that separates
production-oriented library engineering from facility deployment, external
validation, measured-shot validation, and certification claims.
Hardened fail-closed physics and mathematics boundaries across MHD,
pedestal, edge, transport, orbit-following, scenario, and uncertainty
surfaces without promoting unsupported facility or full-fidelity claims.
Added release-blocking boundary coverage for edge cases, invalid inputs,
monotonicity contracts, conservation boundaries, and finite-output contracts
in module-specific test files.
Persisted differentiable transport campaign metadata and added a replay guard
that rejects backend, grid, boundary, closure, tolerance, and equilibrium
drift before controller-tuning reruns.
Added differentiable transport source-schedule gradients so controller
tuning can optimise additive heating, fuelling, and impurity-source inputs
through the same JAX Crank-Nicolson facade as transport coefficients.
Added bounded multi-step differentiable transport rollout gradients so
controller tuning can optimise time-distributed source schedules without
finite-difference plant evaluations.
Wired NMPC source-rollout tuning to the multi-step differentiable transport
gradient path with explicit source bounds and sampled finite-difference
audit admission.
Added audited multi-step differentiable transport rollout-gradient latency
reporting for bounded NMPC source-rollout admission evidence.
Added Grad-Shafranov flux-weighted multi-step transport rollout loss and
source/equilibrium gradients for bounded controller-tuning studies.
Added a bounded reduced-gyrokinetic transport closure adapter for mapping
existing quasilinear GK profile outputs into differentiable transport
coefficient channels with explicit provenance.
Added explicit gyrokinetic species diamagnetic-frequency bookkeeping with
charge-direction, density-gradient, temperature-gradient, and zero-drive
regression coverage.
Added the Miller geometry contravariant metric-determinant identity to the
public geometry result and regression coverage.
Added an explicit reduced-gyrokinetic saturation-rate utility with monotone,
non-negative, and field-line-rate-bounded regression coverage.
Added a differentiable transport gradient audit that compares JAX transport
coefficient and source-schedule gradients against sampled finite-difference
perturbations before controller-tuning admission.
Added differentiable transport gradient-latency reporting for the audited
controller-tuning admission path with persisted bounded benchmark artefacts.
Wired the NMPC transport-tuning path to require that gradient audit by
default and to persist the audit result with each coefficient update.
Added audited NMPC source-schedule tuning for additive heating, fuelling, and
impurity-source controls with explicit finite source bounds.
Added RZIP vertical-stability calibration evidence and fail-closed
facility-claim admission with bounded local benchmark artefacts.
Added resistive-wall-mode feedback claim evidence and fail-closed
facility-claim admission with bounded wall, rotation, coil, and latency
provenance reports.
Added EFIT-lite reconstruction claim evidence and fail-closed facility-claim
admission with bounded diagnostic and shape provenance reports.
Added kinetic-EFIT pressure and q-profile claim evidence with fail-closed
facility-claim admission for matched pressure, q-profile, anisotropy,
diagnostic, profile, fast-ion, MSE-calibration, and interpolation provenance.
Added VMEC-lite spectral facade claim evidence with fail-closed full-VMEC
admission for matched Fourier geometry, rotational transform, residual, and
convergence provenance.
Added orbit-following claim evidence with fail-closed external-code
admission for matched banana-width, first-orbit-loss, particle, geometry,
collision-model, and loss-boundary provenance.
Added uncertainty-quantification claim evidence with fail-closed calibrated
predictive-UQ admission for matched central values, sigma statistics, seed,
prior, scenario, propagation-chain, and sensitivity provenance.
Added density-control claim evidence with fail-closed facility-calibrated
admission for matched Greenwald fraction, particle inventory, geometry,
transport, actuator, diagnostic, and CFL provenance.
Added neural-equilibrium claim evidence with fail-closed predictive-claim
admission for matched P-EFIT or documented public reference artefacts,
weight checksums, flux, pressure, q-profile, boundary, and axis tolerances.
Added neural-transport claim evidence with fail-closed quantitative
admission for matched QuaLiKiz or documented public reference artefacts,
weight checksums, QLKNN-10D feature ordering, diffusivity errors, and branch
accuracy.
Added neural-turbulence claim evidence with fail-closed quantitative
admission for matched gyrokinetic campaign or documented public reference
artefacts, weight checksums, QLKNN-class feature ordering, gyro-Bohm flux
errors, and critical-gradient accuracy.
Added disruption-mitigation claim evidence with fail-closed mitigation
admission for measured, external-benchmark, or documented public reference
artefacts covering warning lead time, mitigation outcome, halo-current
envelope, runaway-beam envelope, and tritium-breeding-ratio metrics.
Added free-boundary tracking claim evidence with fail-closed facility-control
admission for matched public, measured-replay, or external equilibrium
artefacts covering shape, X-point, divertor, coil-current, response-rank,
latency, and supervisor provenance.
Added DT burn-control claim evidence with fail-closed reactor-control
admission for matched public, integrated-transport benchmark, or measured
burn replay artefacts covering alpha power, Q, Lawson margin, burn fraction,
reactivity exponent, and controller-limit provenance.
Added volt-second claim evidence with fail-closed pulse-duration admission
for matched public, measured loop-voltage replay, or external scenario
artefacts covering total flux, flat-top duration, Ejima flux, bootstrap
current, and budget-margin provenance.
Added current-drive claim evidence with fail-closed external deposition
admission for matched public, ray-tracing, Fokker-Planck, or measured
deposition artefacts covering absorbed power, driven current, deposition
centroid, peak current density, and NBI slowing-down provenance.
Added mu-synthesis claim evidence with fail-closed validated robust-control
admission for matched public, external mu-toolbox, or measured replay
artefacts covering mu upper bounds, robustness margin, controller gain,
D-scaling, and closed-loop spectral-abscissa provenance.
Hardened SCPN formal verification with algebraic place-invariant proofs and
bounded temporal response and recurrence specifications over all bounded
firing paths.
Added optional Z3 bounded model checking for compiled SCPN control logic,
including SMT-backed marking-bound counterexamples, temporal exclusivity and
response specs, and JSON/Markdown evidence publication with explicit blocked
status when z3-solver is unavailable.
Hardened federated disruption prediction with per-facility array ingestion,
facility-update differential privacy accounting, serialisable privacy
ledgers, and a deterministic synthetic multi-facility benchmark report. This
remains bounded synthetic evidence, not measured cross-facility validation.
Added neural equilibrium synthetic pretraining with deterministic
JAX-compatible weights, benchmark reports, and a fail-closed real EFIT/P-EFIT
fine-tuning admission gate backed by persisted reference artefacts.
Added digital-twin online model updating with fail-closed TRANSP/TSC
simulator artifact metadata validation, deterministic Bayesian optimisation
over bounded density, effective-charge, and actuator parameters, and a
synthetic online-update benchmark report.
Hardened the gyrokinetic online learner with OOD-threshold sample admission,
auditable retraining decisions, persisted update reports, and a deterministic
synthetic online-retraining benchmark.
Added integrated-scenario coupling audits with deterministic replay metadata,
module-by-module exchange records, timestep consistency checks, and bounded
current and thermal-energy diagnostics while preserving the external
validation claim boundary.
Preserved JAX gyrokinetic stiffness-closure monotonicity under the CI JAX
backend while keeping the closure explicitly bounded as a controller-tuning
surrogate.
Applied the formatter changes required by the remote pre-commit workflow so
release-candidate CI starts from the same formatting state as local checks.
Documented the hardening release-candidate scope, residual validation gaps,
and tag gate before creating a release tag.
Retained the physics traceability boundary: public full-fidelity claims remain
blocked until the required external artefacts are supplied and validated.
Hardened traceability summary checks so generated report, roadmap, and
release documentation derive open-gap counts from the live registry instead of
stale fixed numbers.
GitHub Actions for the current main head are green after the documentation,
traceability, formatter, and JAX stiffness fixes.
Hardened fail-closed contracts across external GK solver surfaces:
QuaLiKiz, GENE, GS2, and CGYRO now require explicit dual-gate opt-in
for degraded fallback behaviour.
Hardened integrated transport GK acceptance criteria:
converged results must also be finite and non-negative for
chi_i, chi_e, and D_e, otherwise fail closed by default.
Integration wiring: sawtooth crash→psi writeback, NTM seeding from crash
energy, ELM/stability/L-H modules connected to scenario loop, beta_N and li
computed from profiles (were hardcoded placeholders)
GK: Te/Ti ratio in quasilinear (was trivially 1.0), omega_r←gamma_net in
TGLF native output, electron drive phi→phi_eff for EM flutter, Ampere skin-depth
term, CFL k→k² for Poisson bracket, Sugama conservation via 3×3 Gram matrix
gyrokinetic_transport.py — quasilinear TGLF-10 instability spectrum (ITG/TEM/ETG
growth rates and mode identification from local plasma parameters)
ballooning_solver.py — second-order ODE eigenvalue solver in s-alpha geometry;
binary-search marginal-stability finder; full stability diagram computation
current_diffusion.py — parallel current evolution PDE with neoclassical
resistivity (Sauter-Angioni), ohmic heating, and bootstrap source
current_drive.py — ECCD, NBI, LHCD auxiliary current-drive models with
absorption efficiency and radial deposition profiles
ntm_dynamics.py — modified Rutherford equation for neoclassical tearing modes
(2/1, 3/2); ECCD stabilization factor; NTM controller with mode-tracking
rwm_feedback.py — resistive wall mode n=1 feedback with active coils, Galerkin
gain computation, and passive-wall eigenvalue analysis
sawtooth.py — Porcelli-like trigger (shear at q=1), Kadomtsev reconnection
crash model, density/energy conservation, SawtoothCycler with crash history
sol_model.py — two-point SOL model (upstream-to-target), Eich heat-flux width
scaling (Goldston heuristic), sheath-limited and conduction-limited regimes
rzip_model.py — linearised tokamak vertical stability model (RZIp plant);
eigenvalue-based growth rate; passive structure model
integrated_scenario.py — full integrated scenario simulator coupling transport,
current diffusion, current drive, sawteeth, NTM, and SOL models; ships with
ITER baseline, ITER hybrid, and NSTX-U preset scenarios
Phase 4 — Absolute control (10 modules in control/):
nmpc_controller.py — nonlinear MPC with SQP over 20-step horizon; state/input
box constraints and slew-rate limits on Ip, beta_N, q95, li, Te, nbar
mu_synthesis.py — historical name for the original Riccati state-feedback
plus static D-scaled structured-mu analysis surface; reclassified in v0.23.0
gain_scheduled_controller.py — PID gains scheduled on operating regime
(Ip, beta_N); automatic interpolation with hysteresis-aware regime detection
shape_controller.py — historical synthetic shape-control reference,
removed in v0.24.0 after the kernel-coupled free-boundary tracker became
the sole public shape-control owner
sliding_mode_vertical.py — sliding-mode controller for vertical stability;
continuous control law with dead-band saturation; configurable sliding surface
scenario_scheduler.py — shot timeline manager for startup→ramp→flattop→
rampdown; actuator scheduling with power budgets; scipy.optimize trajectory
fault_tolerant_control.py — sensor/actuator fault detection via innovation
monitoring; reduced-rank operation under faults; stuck-sensor reconstruction
GS* stencil sign bug: east/west coefficients in Jacobi, SOR, multigrid,
and JAX solvers had the 1/(2R·dR) sign swapped — implementing the cylindrical
Laplacian (∂²ψ/∂R² + (1/R)∂ψ/∂R) instead of the correct GS* operator
(∂²ψ/∂R² − (1/R)∂ψ/∂R). Python now matches Rust sor.rs. Verified via
Solov'ev exact solution (< 1% error on 33×33 grid).
beta_N formula (TokamakEnv): replaced dimensionally incorrect sqrt(Ip)
expression with Troyon scaling β_N = c·T/Ip, calibrated to ITER baseline
gain_margin_db misnomer: renamed to stability_margin_db (eigenvalue-based,
not Bode gain margin); backward-compat alias retained
MPC docstring: states clearly this is gradient-based trajectory optimization,
not Rawlings-Mayne MPC
Physics citations: Braginskii tau_eq, Martin L-H threshold, Troyon beta_N,
Wesson q95 — all hardcoded constants now cite source
H-infinity Y Riccati tolerance: tightened from 1.0 to 0.01
QLKNN-10D trained neural transport model: 3-layer MLP (10→128→64→3) trained
on synthetic critical-gradient data (5000 samples, van de Plassche et al. 2020 paradigm)
Training script tools/train_neural_transport_qlknn.py with --synthetic CI mode
and --data-dir for real Zenodo dataset
Auto-discovery: NeuralTransportModel() loads weights from weights/ if present
PPO agent on TokamakEnv via stable-baselines3 (tools/train_rl_tokamak.py)
Gymnasium-compatible GymTokamakEnv wrapper with proper spaces.Box definitions
PID and 1-step MPC baseline controllers for comparison
RL vs classical benchmark (benchmarks/rl_vs_classical.py): PPO vs PID vs MPC
[rl] optional dependency group (stable-baselines3, gymnasium)
JAX-accelerated transport primitives (scpn_control.core.jax_solvers):
Thomas tridiagonal solver, Crank-Nicolson diffusion operator, and batched
transport via jax.vmap — all JIT-compiled, GPU-compatible, and
differentiable via jax.grad for sensitivity analysis