Restored the elongation- and triangularity-shear (s_kappa, s_delta) terms in
the Miller local-equilibrium radial derivatives (core.gk_geometry.miller_geometry,
Miller et al. 1998 Eqs. 36-37). The parameters were accepted and validated but
silently dropped from dR/dr and dZ/dr, leaving the metric coefficients
(g_rr, g_rt, g_tt) and Jacobian incorrect for finite shaping-shear while the
circular / fixed-shaping (s=0) domain stayed exact. Confirmed and fixed against
an independent finite-difference reference that differentiates the flux-surface
definition directly.
validation/gk_geometry_independent_reference.py: a structurally independent
finite-difference Miller-geometry reference, and validation/validate_gk_geometry_independent.py:
a schema-versioned cross-check (scpn-control.gk-geometry-independent-crosscheck.v1)
that validates the production metric against it across circular, shaped, high-shear,
and both signs of finite shaping-shear local equilibria — closing the Miller
geometry metric fidelity gap for external-validation tracker #47.
Exposed the GK->UPDE coupling modulation gains as a configurable
GKCouplingGains dataclass on phase.gk_upde_bridge.adaptive_knm, replacing
the hard-coded turbulence/transport/pedestal gains and the diffusivity floor
with documented, validated fields.
Added PhaseStreamServer.stop() to request a graceful shutdown of the
phase-stream broadcast tick loop.
Split the CLI monolith further: the six evidence and data-manifest validation
commands (validate, validate-release-evidence, validate-manifest,
validate-data-manifests, validate-physics-traceability, validate-rmse) moved
from cli.py into a new cli_evidence_validators.py as standalone @click.command
objects, folded back onto the root scpn-control group via
EVIDENCE_VALIDATOR_COMMANDS. The CLI surface is byte-identical (all 40 commands,
names/options/behaviour unchanged); cli.py drops to a dispatcher over the core
operational commands plus MDSplus acquisition. cli.py 1286 -> 856 L.
Split core.integrated_transport_solver further: the toroidal radial-grid geometry
helpers moved to a new stateless core.transport_geometry module — the per-cell
volume element (rho_volume_element), the Martin L-H plasma surface-area estimate
(estimate_plasma_surface_area_m2), and canonical radial-grid validation/construction
(is_canonical_radial_grid, canonical_radial_grid). _rho_volume_element stays a
thin wrapper (patched by tests), _ensure_valid_radial_grid becomes a thin orchestrator
over the pure validator, and the surface-area call site is repointed; behaviour is
byte-identical. This resolves the transport-solver god-file (2103 -> 1619 L).
Split core.integrated_transport_solver further: the runtime numerical-hardening
primitive moved from the private _sanitize_with_fallback static method to a new
stateless core.runtime_sanitization module (sanitize_with_fallback) — replace
non-finite profile entries from a fallback and clamp to optional physical bounds,
reporting the recovered count. _sanitize_runtime_state and the Crank-Nicolson
step now call the module function directly (18 call sites repointed); behaviour is
byte-identical.
Split core.integrated_transport_solver further: the multi-ion (D/T/He-ash)
species evolution moved from the private _evolve_species method to a new
stateless core.species_evolution module (evolve_multi_ion_species +
SpeciesEvolutionResult). One explicit time-step of the deuterium/tritium/
helium-ash densities under fusion burn, CFL-sub-stepped explicit diffusion, and
helium pumping, then the quasineutral electron density, effective charge, and
tungsten line radiation — with the species densities, temperatures, impurity
density, grid, and pumping time passed explicitly and the mutated state returned
for the caller to store. The confinement-time-derived pumping time stays in the
thin _evolve_species orchestrator; the burn/transport/quasineutrality physics is
byte-identical, so solver behaviour is unchanged.
Split core.integrated_transport_solver further: the auxiliary-heating source
deposition (turning a requested auxiliary power into per-cell ion/electron
temperature sources, power-normalised over the plasma volume) moved from the
private _compute_aux_heating_sources method to a new stateless
core.aux_heating module (aux_heating_source_profiles). The radial grid,
density, and cell-volume element are passed explicitly; the fail-soft branches
and power-balance telemetry are byte-identical, so solver behaviour is unchanged.
Split core.integrated_transport_solver further: the anomalous (turbulent)
transport-coefficient models moved from private TransportSolver methods to a new
stateless core.anomalous_transport module — the gyro-Bohm diffusivity scaling
(gyro_bohm_chi_profile) and a single shared gyrokinetic per-flux-surface driver
(gk_flux_surface_transport) that now backs both the external_gk and tglf_native
transport models, removing ~100 lines of duplicated per-cell solver logic. The radial
grid and plasma profiles are passed explicitly; the fail-closed guards, flux validation,
and legacy gyro-Bohm fallback are byte-identical, so solver behaviour is unchanged.
Split core.integrated_transport_solver further: the Crank-Nicolson radial-diffusion
numerics (the Thomas tridiagonal solve, the explicit cylindrical diffusion operator,
and the Crank-Nicolson tridiagonal assembly) moved from private TransportSolver
methods to a new stateless core.radial_diffusion module (thomas_solve,
explicit_diffusion_rhs, build_cn_tridiag), which takes the radial grid explicitly.
The discretisation is byte-identical; solver behaviour is unchanged.
Split core.integrated_transport_solver by responsibility: the stateless power
source/sink kernels (D-T Bosch-Hale fusion reactivity, tungsten line radiation,
bremsstrahlung) moved from private TransportSolver static methods to a new
core.plasma_power_terms module (bosch_hale_dt_reactivity,
tungsten_radiation_rate, bremsstrahlung_power_density). Solver behaviour is
unchanged — the published formulae are identical; this trims the ~1670-line
god-class and gives the microphysics kernels their own tested surface.
Split the cli monolith by responsibility: the 27 persisted reference-artifact
validation commands (validate-gk-crosscode, validate-*-reference,
validate-jax-gk-parity, validate-gk-ood-calibration,
validate-gk-interface-artifacts) moved to a new cli_reference_validators
module and are folded back onto the root scpn-control group via
REFERENCE_VALIDATOR_COMMANDS. The CLI surface is unchanged — every command
name, option, and behaviour is identical; this is an internal reorganisation
that keeps the CLI entry point a thinner dispatcher.
Split the control.nmpc_controller megamodule by responsibility: the
gradient-based transport-model tuning entry points
(tune_transport_coefficients_for_tracking, tune_transport_sources_for_tracking,
tune_transport_source_rollout_for_tracking,
tune_neural_transport_closure_for_tracking) and their result dataclasses moved
to a new control.nmpc_transport_tuning module, keeping transport-model fitting
separate from receding-horizon control. Import these symbols from
scpn_control.control.nmpc_transport_tuning; they are no longer available on
scpn_control.control.nmpc_controller. NonlinearMPC and its configuration and
runtime dataclasses are unchanged.
Split the scpn.z3_model_checking megamodule by responsibility: the
schema-versioned formal-report evidence I/O (verify_z3_formal_contracts,
write_z3_formal_report, build_z3_formal_report_payload,
build_blocked_z3_formal_report_payload, load_z3_formal_report,
validate_z3_formal_report_payload) and the Z3FormalVerificationReport
dataclass moved to a new scpn.z3_formal_report module, keeping report
persistence and schema validation separate from the Z3BoundedModelChecker
proof engine. Import these symbols from scpn_control.scpn.z3_formal_report;
they are no longer available on scpn_control.scpn.z3_model_checking. The
checker engine, Z3ModelCheckingReport, and the SymbiYosys/RTI contract
constants are unchanged.
Split the control.free_boundary_tracking megamodule by responsibility: the
fail-closed claim-evidence surface (FreeBoundaryTrackingClaimEvidence,
free_boundary_tracking_claim_evidence,
assert_free_boundary_tracking_facility_claim_admissible,
save_free_boundary_tracking_claim_evidence, and the summary/reference
validators) moved to a new control.free_boundary_tracking_claims module,
keeping run-summary claim admission separate from the
FreeBoundaryTrackingController control loop. Import these symbols from
scpn_control.control.free_boundary_tracking_claims; they are no longer
available on scpn_control.control.free_boundary_tracking. The controller,
run_free_boundary_tracking, and the acceptance/claims benchmark evidence are
unchanged.
Split the scpn.formal_verification megamodule by responsibility: the bounded
formal safety certificate I/O (SafetyCertificatePolicy,
SafetyCertificateBundlePolicy, build_safety_certificate_payload,
write_safety_certificate, generate_safety_certificate,
validate_safety_certificate_payload, and the certificate-bundle and
bundle-artifact build/validate/admit functions) moved to a new
scpn.formal_safety_certificate module, keeping certificate persistence and
admission separate from the FormalPetriNetVerifier reachability engine.
Import these symbols from scpn_control.scpn.formal_safety_certificate; they
are no longer available on scpn_control.scpn.formal_verification. The verifier
engine, verify_formal_contracts, the reachability/property report dataclasses,
and the CTL/LTL temporal specification dataclasses are unchanged.
Hardened the phase-stream WebSocket: the Origin allowlist can no longer be
bypassed by a missing Origin header when origins are configured, malformed
and non-object command frames now return a malformed_frame error and
increment a malformed_frame_rejections counter instead of being dropped
silently, and serve() always cancels and awaits its broadcast tick loop on
exit so no orphan task survives shutdown.
adaptive_knm now logs a warning when handed a coupling matrix with fewer
than six layers instead of silently returning it unmodulated.
Made the PyO3 crate testable in the Rust workspace: scpn-control-rs no
longer enables PyO3 extension-module as a default Cargo feature, the native
admission test uses the PyO3 0.29 initialization API, and CI now runs
cargo test --workspace plus realtime PyO3 parity after the maturin build.
Unified UPDE tick snapshots across NumPy, Rust, and PyO3 paths: all runtime
paths now return output-state R_layer, Psi_layer, R_global,
Psi_global, Lyapunov fields, and per-oscillator dtheta derivatives.
Made controller artifact admission fail closed on inhibitor arcs: structure
and formal-analysis paths may still opt into inhibitor compilation, but
artifact export, artifact loading, and controller construction now reject
negative dense input weights until the artifact schema carries inhibitor
topology explicitly.
Added artifact-level firing-margin metadata to compiled controller artifacts
so save/load, JSON schema validation, compiler export, and controller runtime
share one explicit default margin contract.
Shipped the native Grad-Shafranov solver source and checksum manifest as
scpn_control.core package data, with opt-in compile/load regression coverage
for the package-local bridge path.
Aligned the public safe-RL paper wording with the implemented
CPO-formulated Lagrangian constraint and control-barrier-function surface.
Down-scoped the public FPGA surface from bitstream export to generated HDL
project/evidence export, preserving synthesis-evidence admission for any
future hardware claim.
Wired runtime-bound safety certificate admission into
NeuroSymbolicController, including loaded-artifact topology matching,
certificate/binding/target/replay fail-closed admission, and focused 100%
controller coverage.
Added bounded integrated-scenario closed-loop wiring for the combined CLI
demo, connecting ScenarioSchedule feedback to
IntegratedScenarioSimulator, exposing replay-audit evidence, and keeping
measured-discharge claims blocked behind physics traceability.
Reclassified DIII-D repository reference artefacts as synthetic fixtures with
generator/seed provenance, retained local checksum coverage for those
fixtures, and renamed the CI/test surface away from real-shot validation.
Moved the untagged v1.0.0 roadmap block out of shipped history and reset it
as a future production-readiness target gated by real release evidence.
Separated the public Paper 27 manuscript references from the related
Kuramoto-Sakaguchi arXiv reference across pitch, README, and reviewer
handoff surfaces.
Added the missing root streamlit_app.py Streamlit Cloud entry point as a
thin adapter to the existing embedded WebSocket dashboard.
Synced the rendered MkDocs changelog mirror with the root changelog and added
a CI/preflight drift guard to keep future release notes single-sourced.
Replaced LagrangianPPO random-action rollouts with a learned NumPy linear
policy updated by clipped policy-gradient returns and Lagrangian safety costs.
Extended the version-sync guard to cover release notes, README PyPI/Python
badges, the Pepy all-time downloads badge, and package metadata drift.
Added a JOSS submission guard covering canonical paper metadata, bibliography
citation coverage, docs mirror links, and editorial claim-boundary text.
Added the SCPN Studio Web CI deploy step for the provisioned
scpn-control remote, corrected the Windows CI runner label, and extended
the deploy-key guard to verify the workflow.
Promoted Grad-Shafranov Python multigrid Solov'ev reconstruction into the
sealed validation evidence contract and refreshed the Rust multigrid
informational record.
Hardened the GitHub installation-token format readiness guard with canonical
source headers, public API docstrings, repository traversal tests, binary-file
skip coverage, and explicit development documentation.
Tightened the strict-mypy debt ratchet tests to cover subprocess wrappers,
malformed ledger totals, and improvement reporting at 100% focused coverage,
with development-guide documentation for the local preflight gate.
Aligned the generated SCPN Studio manifest with the deployed federation
remote entry and stable ./Panel exposure, with focused emitter CLI tests
and documentation for the generated Studio artifact.
Added a public-surface claim hygiene guard for outward-facing promotion terms,
wired it into local preflight and CI, and cleaned existing public test labels.
Crosswired the Studio Web Vite remote to the generated manifest contract by
building under /studios/scpn-control/, exposing ./Panel, and testing the
shared federation constants.
Added the deployed Studio Web manifest.json sync guard, public artifact, CI
check, focused 100% coverage, and documentation for keeping it aligned with
the generated schema-A Studio manifest.
Added the SCPN Studio deploy public key artifact with a CI/preflight guard
that validates the ed25519 public key and rejects private key-like tracked
paths.
Wired Studio Web to the portal-owned identity path by loading
GET /api/v1/auth/me with same-origin cookies and rendering only the portal
session state in the federated panel.
Added a Studio offline-sealing guard that keeps publication signing keys out
of tracked CI and deploy policy surfaces while preserving deploy-only
credential lanes.
Wired the zero-debt public API docstring quality gate into local preflight and
make lint, matching the existing CI documentation coverage lane.
Added architecture decision records for module and repository boundaries,
Python/Rust/PyO3 dispatch, solver and algorithm selection, validation evidence
strategy, and public versus internal API boundaries.
Breaking:FormalPetriNetVerifier and the scpn.formal_safety_certificate
validators no longer accept backend="z3". The explicit-state reachability
engine performs exact enumeration, not SMT, so it now raises ValueError on
backend="z3" and never stamps an unearned z3 backend label; use
Z3BoundedModelChecker in scpn_control.scpn.z3_model_checking for z3-backed
evidence. The auto and explicit-state backends are unchanged.
Un-rigged the SCPN/PID/MPC benchmark: removed the MPC's future-disturbance
foresight so the comparison uses an honest offset-free persistence disturbance
model, and removed the pass-by-construction gate. The published RMSE figures now
reflect the fair model (PID 0.121, MPC 0.047, SCPN 0.050; SCPN/MPC RMSE
ratio 1.07 — SCPN no longer "beats" a fairly-modelled MPC).
Failed closed across the shipped control path where a bare np.clip, a
magnitude floor, or a skip-if-present loop previously let non-finite or
sign-inverting inputs through silently (np.clip does not sanitise NaN):
the actuator action decoder rejects a non-finite marking place, gain, limit,
slew rate, or previous command before computing an actuator command;
the actuator decoder rejects a negative abs_max or slew rate, which would
otherwise invert the saturation/rate clamp;
the feature-error kernel rejects a negative axis scale, which would otherwise
invert the control-error sign;
the controller marking setter rejects a non-finite marking assignment;
the live controller's passthrough observation injection rejects a non-finite
sensor value, matching its own public extract_features contract (it was
previously clipped silently);
the physics safety-invariant monitor treats a missing safety channel as a
critical violation instead of silently skipping it;
the G-EQDSK parser rejects any non-finite value in the data region or its
arrays at parse time.
Replaced NumPy scalar-percentile calls in the disruption mitigation replay
path with deterministic linear interpolation, preventing local NumPy reload
failures in SPI diagnostics and halo/runaway post-disruption summaries.
Hardened RZIPController so SciPy/NumPy Riccati validation failures fall
back to a bounded NumPy discrete-Riccati gain before the zero-gain fail-closed
path, preserving the vertical-feedback contract across validated numerical
fallback paths.
Refreshed generated capability inventory metadata for the NTM coverage and
statistics-helper additions, keeping README and generated documentation
snapshots aligned with the tracked source and test inventory.
Consolidated the studio-web Dependabot stack on top of the green main branch,
including Vite, Module Federation Vite, TypeScript ESLint, ESLint, Prettier,
and lockfile transitive updates.
Merged or superseded all open Dependabot pull requests, confirmed open
Dependabot, code-scanning, and secret-scanning alerts remained clear, and
purged failed or cancelled Actions history only after replacement CI and
benchmark evidence was green.
libFuzzer harness for the Rust parser, numeric-adapter, and FFI surfaces:
reactor-configuration JSON, VMEC-like and BOUT++ text parsers, the
capacitor-bank discharge ledger, and the Kuramoto phase kernel. Includes a
fail-closed campaign orchestrator with provenance and seed-checksum evidence
reports, a tracked seed corpus, and a nightly fuzzing workflow separate from
per-commit CI.
Polyglot benchmark regression gate: a suite runner that records per-language
p50/p95/p99 latency, throughput, and run provenance, and a fail-closed gate
that compares a fresh report against a tracked baseline under an explicit
threshold policy, rejecting tampered reports or baselines, missing metrics, and
cross-CPU comparisons. Runs in evidence-only mode on the nightly workflow.
Runtime-bound formal safety certificate: binds a holding bounded CTL/LTL
certificate to a structured controller runtime identity — controller
configuration, Petri-net topology digest, SNN parameters, solver mode, runtime
target, and a declared timing envelope. Issuance, proof replay, and
facility-facing admission all fail closed unless the binding, runtime target,
timing envelope, and re-proved obligations match on the declared stack.
Bounded the scaling-and-squaring exponent in the Rust matrix exponential so an
overflowing matrix norm can no longer stall the capacitor-bank discharge; the
routine now fails closed on a non-finite norm and the discharge rejects the
input instead of looping.
Bumped GitHub Actions pins, Rust crates, Python dependencies, and studio-web
dependencies through the green Dependabot maintenance lane, while preserving
release-age safety for newly published package versions.
Restored the remote Ubuntu 3.12 coverage gate with focused module-specific
rust_engine and quantum disruption bridge tests covering native handoff,
fail-closed runtime behaviour, coefficient loading, contract tamper
detection, and advisory evidence validation.
Merged the pending green Dependabot updates for click, z3-solver,
hypothesis, GitHub Actions pins, and Rust log after refreshing stale PR
branches and confirming fresh checks.
Reconfirmed zero open code-scanning, Dependabot, and secret-scanning alerts
after the dependency maintenance lane.
Bumped package, citation, API, README capability, release-note, and public
changelog metadata to 0.20.6.
Hardened AER control-observation admission with monotonic timestamp evidence,
strict fail-closed decoding mode, Rust/PyO3 parity, and Python/Rust benchmark
coverage.
Added digest-bound AER admission metadata for geometry-neutral replay v1.1 so
replay artefacts preserve monotonic AER ingress evidence without changing
replay numerics.
Added CONTROL-owned PulsedScenarioScheduler v2 for reusable pulsed-fusion
shot lifecycles, with Python and Rust scheduler surfaces, audit-log
semantics, guard validation, public API documentation, and direct tests.
Exposed the Rust pulsed-scenario scheduler through the optional PyO3
scpn_control_rs extension with direct parity tests.
Added the CONTROL-owned capacitor-bank series-RLC state model with Python,
Rust, and optional PyO3 surfaces, scheduler telemetry adaptation, dedicated
tests, public API documentation, and benchmark evidence.
Added total RLC energy-balance reporting to capacitor-bank discharge reports,
including capacitor/inductor remaining energy, ohmic loss, prescribed-load
extraction, residual admission, PyO3 fields, dedicated tests, public guide
documentation, and Python/Rust benchmark harnesses.
Added the CONTROL-owned AER control-observation adapter with Python spike
buffers, rate/temporal/ISI decoders, Rust parity surfaces, optional PyO3
bindings, dedicated tests, and public documentation.
Added geometry-neutral replay schema v1.1 for pulsed-shot metadata admission,
with bundled schemas, v1 back-compatibility checks, report load/save helpers,
dedicated tests, and public documentation.
Added the CONTROL-owned pulsed-shot MPC admission adapter with Python, Rust,
and optional PyO3 surfaces, fail-closed scheduler-state admission, capacitor
feasibility gating, module-specific tests, public documentation, and local
regression benchmark tooling.
Added digest-bound pulsed-MPC admission decision evidence across Python,
Rust, PyO3, and benchmark reports.
Added PyO3-inclusive pulsed-MPC local regression evidence and documented the
editable bridge rebuild protocol for local native-extension development.
Added the CONTROL-owned multi-shot campaign orchestrator with Python, Rust,
and optional PyO3 surfaces, deterministic lifecycle admission, replay v1.1
metadata fields, module-specific tests, public documentation, and local
regression benchmark tooling.
Added optional pulsed-MPC admission digest propagation through multi-shot
campaign reports, replay v1.1 extensions, Rust/PyO3 parity, and Python/Rust
benchmark harnesses.
Added release-evidence admission for multi-shot pulsed-MPC campaign reports,
requiring Python, PyO3, and Rust digest-chain evidence with benchmark-context
metadata before the top-level release gate can pass.
Added release-evidence admission for PREEMPT_RT runtime-admission benchmark
reports, requiring fail-closed production-claim boundaries, benchmark
context, latency stats, and SHA-256 payload sealing.
Tightened native formal certificate release admission so production-class
AOT certificate evidence cannot be accepted unless the evidence explicitly
allows production benchmark claims and carries no validator errors.
Added PREEMPT_RT runtime admission for native hardware campaigns, including
Python policy evaluation, PyO3 native snapshot evidence, CLI fail-closed
--runtime-admission-policy require, public documentation, tests, and local
admission benchmark tooling.
Runtime telemetry now preserves the latest runtime-admission report in
extract_slab_telemetry() so emergency dumps retain scheduler, affinity,
governor, heartbeat, and PREEMPT_RT assumptions.
Lean proof-report admission now rejects non-Lean solver declarations, solver
strings that do not include the declared Lean version, and proved-contract
overclaims outside the admitted PID/SNN proof surface.
Lean proof-report admission now also rejects unrelated theorem namespaces,
module paths, and safety-case IDs so valid PID/SNN evidence cannot be padded
with stale or unrelated proof links.
Lean proof evidence in .scpnctl artifact manifests now applies the same
solver/version, proved-contract, namespace, module-path, and safety-case-ID
admission policy before safety-critical artifact loading can pass.
Lean report payloads and artifact formal-verification manifests now reject
unknown proof fields so stale or foreign evidence cannot be silently ignored.
Lean report admission now requires the canonical payload_sha256 self-digest
instead of accepting otherwise valid digestless reports.
Lean report loading now rejects duplicate JSON keys at the public API boundary,
matching the release validation executable.
Safety-critical artifact admission now uses the same duplicate-key-safe Lean
report loader for report-root manifest checks.
Z3 formal report loading now rejects duplicate JSON keys and artifact
report-root admission uses the same loader.
Z3 formal report admission now rejects unknown top-level and proof-section
fields even when the payload digest is recomputed.
Z3 formal report admission now schema-checks serialized counterexample
records before accepting bounded proof evidence.
Z3 formal report admission now rejects inconsistent section solver statuses,
including sat sections that claim to hold and unsat sections carrying
counterexamples.
Blocked Z3 formal reports now fail closed unless they carry the unavailable
solver label, zero proof depth, and only the z3_solver_available checked
spec.
Z3 proof-section checked_specs now reject duplicate or malformed entries
instead of relying only on top-level report de-duplication.
Z3 proof sections with solver_status="unknown" now reject
counterexamples because unknown solver states are not discovered
violation paths.
Z3 pass/fail reports now reject the unavailable-solver label so
missing z3-solver remains blocked evidence rather than proof
evidence.
Z3 pass/fail reports now require solver metadata to identify
z3-solver, preventing foreign SMT labels from being admitted as
Z3 proof evidence.
Bumped package, citation, API, README capability, and release-note metadata to 0.20.4.
Added v0.20.4 release notes and exposed them in the MkDocs navigation.
Updated documentation, benchmark, validation, deployment, onboarding, notebook, and pricing surfaces for the native runtime evidence lane and local-regression benchmark boundary.
Replaced regex-based Lean theorem, module, and safety-case identifier
admission with linear-time validators to remove the CodeQL ReDoS finding
while preserving the formal-evidence identifier contract.
Bumped package, citation, archive, API, README capability, and release-note
metadata to 0.20.2.
Reworked the README into clearer product, reading-path, feature, evidence,
and limitation sections while preserving existing project content.
Added v0.20.2 release notes and exposed them in the MkDocs navigation.
Tightened public wording for gyrokinetic, real-time latency, disruption,
validation-summary, and coverage claims so external-code, measured-shot,
target-hardware, peer-reviewed, and plant-deployment claims remain blocked
until strict evidence admission exists.
Documented the benchmark-regression and native C++ build-hardening changes
as release-readiness improvements.
Bumped the package and citation metadata to 0.20.0 for the release-preparation candidate.
Reworked the README, documentation landing page, onboarding guide, use-case page, tutorial index, notebook gallery, API version snippet, MkDocs navigation, and release notes so new users can understand the controller-facing evidence layer, application value, collaboration needs, and strict production-readiness boundary.
Regenerated the capability manifest and README capability snapshot from the current tree.
Added a repository-published MAST EFM neural-equilibrium campaign report that aggregates the six-shot public EFM evaluation, records storage-relative artefact references and digests, and keeps predictive EFIT/P-EFIT admission blocked pending full-output evidence.
Added a storage-hosted MAST EFM neural-equilibrium supervised dataset builder and repository-published dataset evidence report with deterministic shot-held-out train, validation, and test splits, padded LCFS geometry metadata, SHA-256 traceability, and an explicit block on predictive EFIT/P-EFIT admission pending full-output model validation.
Added a neural-equilibrium training-campaign planner that verifies prepared MAST EFM storage-host payloads, tracks deferred QLKNN/QuaLiKiz and external EFIT/P-EFIT dataset lanes, publishes run-order evidence, and records GPU-hour planning budgets without launching long training jobs.
Added a dry-run-first MAST EFM neural-equilibrium trainer that validates the prepared dataset/report contract by default, emits a launch report, and requires explicit --execute before writing deterministic full-output baseline weights or holdout metrics.
Added a MAST EFM feature-provenance audit and storage host dry-run launch evidence showing the prepared storage-host dataset validates on the storage host while Ip_MA, Bt_T, and ffprime_scale remain blocked because the converted public EFM bundles do not contain direct source keys.
Added an original public MAST Level 1 EFM Zarr source audit that admits plasma_current_x for Ip_MA and bphi_rmag for Bt_T, while keeping dataset rebuild blocked until the ffprime profile-to-scalar policy for ffprime_scale is declared.
Declared and implemented the public ffprime RMS-to-campaign-median policy, regenerated the MAST EFM converted references and supervised dataset on storage-host dataset storage, and updated the dataset, provenance, original-source, and dry-run launch reports so the former fallback feature list is empty.
Clarified neural-equilibrium campaign execution policy: the storage host is storage-only, while any --execute training must run on an admitted compute host or external cloud compute with storage-mounted or copied data.
Added a fail-closed MAST EFM compute-execution package: --execute now requires explicit compute-host or external-cloud admission, matching dataset SHA-256, passing feature/source provenance reports, non-storage-host weight output, and repository-published result templates for holdout, latency, GPU-cost, and admission-certificate evidence.
Hardened the MAST EFM neural-equilibrium launch and result-template evidence path with explicit report validators, canonical payload digests, storage-host storage-only output checks, and tamper-detection tests before any future admitted compute run can be cited.
Hardened JAX gyrokinetic parity evidence with aggregate case/backend coverage digests, portable report paths, a separate local CPU timing benchmark report, and refreshed CPU parity artifacts while preserving the backend-parity-only claim boundary.
Added validation/convert_mast_efm_neural_equilibrium_reference.py
to convert public MAST Level 1 EFM measured-shot Zarr campaigns into
checksum-bound neural-equilibrium reference-candidate arrays while
keeping predictive EFIT/P-EFIT claims blocked until exact-model
predictions, pressure reconstruction, declared metrics, and strict
admission artefacts exist.
Added validation/evaluate_mast_efm_neural_equilibrium.py to run
current neural-equilibrium weights against the converted public MAST EFM
reference-candidate arrays, persist prediction artefacts on storage-host dataset storage,
persist exact public EFM profile_r/profile_z coordinate grids,
report flux RMSE plus derived magnetic-axis and LCFS residual evidence
for 527 slices, and keep predictive EFIT/P-EFIT admission blocked until
full pressure, q-profile, and exact-input evidence exists.
Hardened neural equilibrium reference admission so
validation/validate_neural_equilibrium_reference.py now emits
schema-versioned, digest-bound reports with portable paths, explicit
predictive-claim state, artefact-file SHA-256 digests, duplicate
model/weight/reference-set rejection, fail-closed strict-mode report
persistence, and an explicit block on predictive EFIT/P-EFIT claims until
real P-EFIT or documented public-reference artefacts are supplied.
Hardened external GK interface artefact admission so
validation/validate_gk_interface_artifacts.py now emits schema-versioned,
digest-bound reports with portable paths, explicit public-claim state,
artefact-file SHA-256 digests, duplicate interface-code/run-id rejection,
fail-closed strict-mode report persistence, and an explicit block on
external-interface and full GK cross-code claims until real executable or
documented public-reference artefacts are supplied.
Hardened GK OOD calibration admission so
validation/validate_gk_ood_calibration.py now emits schema-versioned,
digest-bound reports with portable paths, explicit feature-schema and public
claim state, raw and canonical calibration-artefact SHA-256 digests,
Mahalanobis-metric provenance checks, duplicate-campaign rejection,
fail-closed strict-mode report persistence, and an explicit block on
deployment-calibration claims until real published, external-code, or
facility GK campaign evidence is supplied.
Hardened GK geometry reference admission so
validation/validate_gk_geometry_reference.py now emits schema-versioned,
digest-bound evidence with immutable reference-file SHA-256, per-case
digests, explicit SI units, bounded local Miller-geometry admission status,
duplicate-case rejection, direct source-checkout execution support, and an
explicit block on full equilibrium-reconstruction claims pending independent
Miller-geometry implementation or external equilibrium-code evidence.
Hardened GK species reference admission so
validation/validate_gk_species_reference.py now emits schema-versioned,
digest-bound evidence with immutable reference-file SHA-256, per-case
digests, explicit SI units, bounded-operator admission status, duplicate-case
rejection, direct source-checkout execution support, and an explicit block on
full collision-operator claims pending field-particle and external
Fokker-Planck evidence.
Hardened nonlinear Cyclone Base Case evidence so
validation/gk_nonlinear_cyclone.py writes schema-versioned JSON/Markdown
reports with canonical payload SHA-256, separates diagnostic checks from
saturated chi_i admission, emits boolean-safe persisted evidence, supports
direct source-checkout execution, and keeps the current 200-step V4 run
blocked for saturated nonlinear CBC claims.
Hardened the TORAX code-to-code benchmark evidence boundary with a
schema-versioned JSON/Markdown report, canonical scenario and payload
SHA-256 digests, direct source-checkout execution support, explicit
admitted/blocked/not-requested external-reference states, finite-metric
admission checks, and a --require-external gate that fails closed unless a
real TORAX comparison is present.
Added a fail-closed differentiable-transport full-fidelity readiness gate
that binds campaign metadata, one-step and rollout latency reports, gradient
audit digests, controller formal-proof digests, equilibrium-coupled metadata,
and admitted external reference evidence before any full-fidelity claim can
pass, and extended the benchmark/validator evidence path to publish and
structurally admit the corresponding blocked readiness artefact.
Added a GitHub Pages compute-validation financing page that explains GPU-hour,
storage, public-data, and external-code validation needs while preserving the
repository claim boundary.
Added public QLKNN and QuaLiKiz Zenodo acquisition metadata, strict
public-data acquisition manifest validation, module-specific regression
tests, and documentation that separates acquired normalised metadata from
deferred multi-GB tensor payloads and neural-transport validation evidence.
Added strict NTM island-dynamics reference-artifact admission so
full-fidelity q-profile, rational-surface, island-growth, saturated-width,
suppression-time, seed-island, and ECCD-alignment claims require
schema-versioned scpn-control.ntm-reference.v1 evidence with measured NTM
campaign or documented public-reference provenance, safe q-profile,
rational-surface, island-width-trace, and ECCD-alignment artifact URIs,
SHA-256 digests for every artifact and the canonical payload, NTM unit
contracts, ordered rho grids, positive q-profile domains, rational-surface
tokamak-ordering metadata, positive seed-island domains, tolerance-checked
physical metrics, and module-specific tamper/domain tests.
Added strict MARFE radiation-condensation reference-artifact admission so
full-fidelity onset-temperature, density-limit, Greenwald-fraction,
front-temperature, radiative-growth, impurity-fraction, connection-length,
and power-balance claims require schema-versioned
scpn-control.marfe-reference.v1 evidence with measured MARFE campaign or
documented public-reference provenance, safe temperature-profile,
density-limit, radiation-curve, and power-balance artifact URIs, SHA-256
digests for every artifact and the canonical payload, MARFE unit contracts,
ordered temperature and density scans, bounded impurity-fraction domains,
finite tokamak geometry and power-balance metadata, tolerance-checked
physical metrics, and module-specific tamper/domain tests.
Added strict EPED pedestal reference-artifact admission so full-fidelity
pedestal height, pedestal width, peeling-ballooning pressure-limit,
bootstrap-current, collisionality-width-ordering, and shaping-input claims
require schema-versioned scpn-control.eped-reference.v1 evidence with
measured pedestal-database or documented public-reference provenance, safe
pedestal-profile, EPED-prediction, bootstrap-current, and
peeling-ballooning artifact URIs, SHA-256 digests for every artifact and the
canonical payload, EPED unit contracts, ordered rho grids, positive
width/beta domains, finite tokamak shaping metadata, tolerance-checked
physical metrics, and module-specific tamper/domain tests.
Added strict ELM crash and RMP suppression reference-artifact admission so
full-fidelity ELM frequency, crash-depth, pedestal-drop, RMP-window, and
heat-flux claims require schema-versioned scpn-control.elm-reference.v1
evidence with measured H-mode campaign or documented public-reference
provenance, safe pre-crash/post-crash/event/RMP artifact URIs, SHA-256
digests for every artifact and the canonical payload, ELM/RMP unit
contracts, ordered pedestal grids, Type-I energy-fraction bounds,
tolerance-checked physical metrics, and module-specific tamper/domain tests.
Added strict SOL blob-transport reference-artifact admission so full-fidelity
blob velocity, spreading, wall-flux, and detector-event claims require
schema-versioned scpn-control.blob-transport-reference.v1 evidence with
measured probe-campaign or documented public-reference provenance, safe
reference/profile/detector artifact URIs, SHA-256 digests for every artifact
and the canonical payload, SOL unit contracts, strictly ordered
separatrix-to-wall coordinates, positive detector and blob-size domains,
positive magnetic-geometry metadata, tolerance-checked physical metrics, and
module-specific tamper/domain tests.
Hardened neural equilibrium reference-artifact admission so predictive
EFIT/P-EFIT or documented-reference equilibrium claims must use
schema-versioned scpn-control.neural-equilibrium-reference.v1 evidence with
safe reference/prediction artifact URIs, trained-weight,
reference-artifact, prediction-artifact, and canonical payload SHA-256
digests, explicit target schema, grid/unit contracts, finite
tolerance-checked psi/pressure/q-profile/boundary/axis metrics, admitted real
P-EFIT executable provenance, and tamper-detection tests.
Hardened neural transport reference-artifact admission so quantitative
QuaLiKiz, QLKNN, or documented-reference transport claims must use
schema-versioned scpn-control.neural-transport-reference.v1 evidence with
safe reference/prediction artifact URIs, trained-weight,
reference-artifact, prediction-artifact, and canonical payload SHA-256
digests, explicit target schema, QLKNN-10D feature order, unit contracts,
finite tolerance-checked metrics, admitted real QuaLiKiz executable
provenance, and tamper-detection tests.
Hardened persisted external gyrokinetic interface artifact admission so real
executable and documented public-reference parser evidence must use
schema-versioned scpn-control.gk-interface-artifact.v1 reports with safe
deck/raw-output/parsed-output artifact URIs, SHA-256 digests for each
artifact, a canonical payload digest, explicit transport/frequency/wavenumber
unit declarations, finite physical fields, admitted executable provenance,
and tamper-detection tests.
Hardened the real external-code linear gyrokinetic cross-code admission gate
so full-fidelity GK agreement evidence must use schema-versioned
scpn-control.gk-crosscode.v1 reports with SHA-256 digests for the external
input deck, external output, native input, and canonical payload, finite
growth-rate/frequency/wavenumber fields, admitted executable provenance, and
bounded native-vs-external tolerances.
Added strict admission for persisted differentiable transport one-step and
rollout gradient-latency reports, including duplicate-key rejection, backend,
dtype, claim-boundary, audit-error, sampled-index, run-count, and latency
percentile checks before the reports can support release evidence.
Hardened local preflight release-evidence admission so the non-test
release-evidence gate now generates a temporary scpn-control validate
--json-out report and admits it through scpn-control
validate-release-evidence, matching the CI artifact-admission path.
Exposed release-evidence report admission as
scpn-control validate-release-evidence REPORT, so operators can validate
CI or release JSON reports through the public CLI instead of importing the
Python validation module directly.
Added strict release-evidence report admission for the CI artifact produced
by scpn-control validate --json-out, including duplicate-key rejection,
mandatory pass status for data manifests, JAX GK parity, and physics
traceability, complete CPU/GPU parity case coverage, and an admission JSON
artifact with the source report SHA-256 digest.
Added a CI release-evidence-gate job that runs top-level
scpn-control validate --json-out and uploads the JSON report, so remote
runs now publish auditable data-manifest, JAX GK parity, and physics
traceability admission evidence.
Added the top-level scpn-control validate --json-out path to local
preflight as a non-test release-evidence gate, with source-tree import
precedence, so make preflight and make preflight-fast now catch data
provenance, JAX GK parity, and physics traceability drift before push.
Promoted physics traceability validation into the top-level
scpn-control validate command with staged-registry and scoped-skip controls
so local release validation now fails on bounded-claim registry drift in the
same path as data provenance and JAX GK parity evidence.
Promoted strict persisted JAX gyrokinetic CPU/GPU parity evidence admission
into the top-level scpn-control validate command, added scoped staging and
skip flags, and exposed case/backend requirements on
validate-jax-gk-parity so local release validation matches the CI gate.
Wired strict persisted JAX gyrokinetic CPU/GPU parity evidence admission into
the jax-parity CI job and added a module-specific repository-evidence
regression so missing CBC, kinetic-electron TEM, or stable-mode backend
pairs cannot silently drift out of release evidence.
Persisted the current JAX gyrokinetic CPU parity campaign alongside the
existing GPU campaign, regenerated the strict parity summary, and updated the
traceability and validation docs so backend parity is admitted for CPU/GPU
reproducibility without promoting quantitative external-code GK claims.
Replaced WebSocket runtime-configuration raw SHA-256 digests with a
domain-separated HMAC-SHA256 evidence digest so deterministic admission
remains stable while code scanning no longer treats the configuration proof
as weak sensitive-data hashing.
Hardened mu-synthesis claim evidence persistence so bounded static
robust-control reports now carry canonical payload SHA-256 digests and load
admission rejects duplicate keys, schema drift, edited metrics, and bounded
evidence presented as validated robust-control evidence.
Added schema-versioned geometry-neutral replay evidence admission so
stellarator replay claims bind the validated report, scenario, trace,
metrics, thresholds, magnetic-configuration provenance, actuator
calibration, latency model, and fault model by SHA-256 digest while keeping
synthetic W7-X-like replay separate from measured or benchmark device claims.
Added schema-versioned Kuramoto phase-runtime evidence admission so
deployment-target phase claims bind deterministic input digests, Python
reference output digests, optional Rust parity errors, deployment-target
oscillator coverage, and timestep-refinement convergence before runtime
claims can cite the optional Rust fast path.
Hardened controller safety-case readiness so promotion now also requires a
typed websocket_runtime_evidence artifact that resolves under the declared
evidence root, matches its SHA-256 bytes, and passes qualified WebSocket
runtime admission before deployment readiness can cite authenticated command
streams, TLS enforcement, payload caps, token-bucket limiting, broadcast
delivery, or backpressure absence.
Added schema-versioned FPGA HDL export evidence admission so generated
Verilog/VHDL project claims bind controller artifact SHA-256, generated HDL,
weight memory, timing constraints, Makefile, resource estimates, synthesis
report digests, safe report URIs, non-negative timing slack, and local-only
versus qualified synthesis claim status before safety-case readiness can cite
hardware export evidence.
Hardened controller safety-case readiness so promotion now also requires a
typed codac_runtime_evidence artifact that resolves under the declared
evidence root, matches its SHA-256 bytes, and passes qualified CODAC/EPICS
runtime admission before deployment readiness can cite CODAC timing,
interlock, export, or backpressure evidence.
Added schema-versioned CODAC/EPICS runtime evidence admission so control
boundary claims bind generated EPICS database and OPC-UA nodeset hashes,
cycle-deadline percentiles, exercised interlock blocking, backpressure
counts, local-only versus qualified claim status, duplicate-key-safe JSON
loading, and canonical SHA-256 payload digests before facility runtime
claims can cite CODAC evidence.
Hardened controller safety-case readiness so promotion now requires a typed
hil_replay_evidence artefact in addition to external physics validation,
target-hardware timing, and independent review; the artifact must resolve
under the declared evidence root, match its SHA-256 bytes, and pass
qualified-target HIL replay admission before deployment readiness can cite it.
Added schema-versioned HIL replay evidence admission for CONTROL-owned
runtime deployment claims, including canonical SHA-256 payload digests,
replay digests over controller, timing, target-hardware, interlock, and
backpressure fields, fail-closed target-hardware promotion checks, duplicate
JSON key rejection on load, and module-specific behavioural tests that keep
local replay evidence separate from qualified deployment evidence.
Hardened reviewed control-runtime defects by replacing fixed-window
WebSocket command limiting with token buckets per connection and peer,
adding structured WebSocket security audit logs, arming native-solver cleanup
only after a C++ library loads successfully, rejecting degenerate
Grad-Shafranov flux normalisation, fixing multigrid restriction on
rectangular odd grids, vectorising free-boundary coil Green's flux over the
grid, tightening NMPC SPD symmetry admission, and adding optional JAX
autodiff plant linearisation.
Added schema-versioned JAX gyrokinetic parity artifact production and
stricter admission so native/JAX local-dispersion comparisons bind backend,
device, platform, dtype, X64 state, solver kwargs, tolerances, and canonical
SHA-256 payload digests while keeping the evidence boundary limited to
backend parity until external GK validation artifacts are supplied; admission
now requires named CBC, kinetic-electron TEM, and low-drive stable-mode case
coverage when requested, binds case-parameter digests, rejects mode-spectrum
replay, and supports backend coverage requirements.
Added a quantum-enhanced disruption bridge facade that keeps quantum backend
ownership in scpn-quantum-control, lazily imports optional quantum
dependencies, maps the CONTROL 8-feature disruption contract to the ITER
11-feature contract with explicit default provenance, emits bounded
amplitude-kernel evidence, records admission evidence with feature digests
and external-evidence requirements, adds schema-versioned advisory
certificates for bridge and kernel reports, publishes a machine-readable
dependency contract for the scpn-quantum-control backend, embeds that
dependency contract in advisory reports, pins the Qiskit simulator dependency
name, records backend-contract attestation when the optional backend exposes
its own contract, adds certificate-bound advisory decision evidence with
score-basis provenance, deterministic risk-band thresholds, backend-contract
validation state, and blocked control action, and fail-closes advisory reports
behind tamper-evident claim boundaries.
Aligned the CI and local coverage gate to the current validated 93.74%
repository result as explicit temporary debt after the quantum-disruption and
physics-debugging surfaces expanded; the policy remains module-specific
behavioural tests only, with no synthetic gate-chasing tests.
Added a local-first physics debugging assistant for validation-gap analysis,
falsifiable hypothesis generation, and campaign suggestions with endpoint
allowlisting, secret redaction, cited-evidence enforcement, advisory
safety-policy admission, reviewed-draft digest binding, provider quorum
admission, and tamper-evident advisory report digests.
Added hash-addressed formal safety certificate bundle artifact admission so
release gates verify safe relative bundle URIs, bundle SHA-256 bytes,
tamper-evident artifact metadata digests, UTC creation timestamps, embedded
certificate digests, artifact binding, backend, and required certificate
policy before replaying certificate evidence.
Added formal safety certificate admission policies so certification campaigns
can require minimum proof depth, controller artifact binding, CTL/LTL
evidence, and named checked specifications before JSON/Markdown certificate
artifacts are emitted or admitted.
Added a one-call formal safety certificate workflow that resolves one
Petri-net verifier backend, runs base safety/liveness plus CTL/LTL
obligations, binds optional controller artifact bytes by SHA-256, and
persists certificate JSON/Markdown evidence.
Hardened formal safety certificate publication with JSON/Markdown writers and
semantic section-admission checks that reject internally inconsistent
certificate evidence even when the payload digest is recomputed.
Added bounded CTL/LTL formula facades and schema-versioned formal safety
certificate payloads for SCPN Petri-net controllers, including
tamper-evident payload digests and shared explicit-state/Z3 formula checking.
Hardened stellarator geometry configuration with a Pydantic v2 schema/export
path, construction-time physics-bound validation, and immutable validated
config objects so ISS04, Boozer-surface, and neoclassical calculations cannot
observe post-validation mutation.
Hardened EPED pedestal configuration with a Pydantic v2 schema/export path,
construction-time physics-bound validation, and immutable validated config
objects so solver calls cannot observe post-validation mutation.
Hardened FusionKernel configuration loading so runtime JSON is retained as a
typed Pydantic v2 model with schema-normalised boundary variants while the
legacy dict view remains a compatibility export for solver internals.
Hardened controller safety-case readiness artefacts so target-hardware timing evidence must resolve under a supplied artifact root, match the declared SHA-256 bytes, and pass the schema-versioned E2E latency validator before promotion readiness can cite it.
Hardened end-to-end control-latency evidence so benchmark reports now use a
schema-versioned canonical payload digest and admission rejects tampering,
non-positive run counts, unordered percentiles, mismatched overhead factors,
unqualified target-hardware metadata, and altered local-evidence boundaries
before runtime-readiness claims can cite latency reports.
Hardened Z3-backed SCPN formal-verification evidence so pass, fail, and
blocked reports use a schema-versioned payload, canonical SHA-256 integrity
digest, explicit solver metadata, and manifest-matching status, depth, solver,
and checked-specification admission before safety-critical controller
artifacts can reference SMT proof reports.
Hardened differentiable-transport evidence admission so gradient-audit
evidence revalidates finite non-negative losses, tolerance agreement with
campaign metadata, unique in-domain sampled audit indices, pass/fail
consistency with maximum audit error, strict integer latency run counts, and
ordered latency percentiles before controller-tuning evidence is persisted or
admitted; the rollout source-gradient loss now remains inside the traced JAX
graph and the module enables JAX x64 before importing jax.numpy so dtype
evidence is not silently downgraded.
Hardened digital-twin online-update evidence admission so bounded Bayesian
update claims revalidate finite non-negative losses, loss-history minima,
source binding, unique bounded parameter priors, best-parameter domains,
strict integer campaign settings, and simulator units for every observation
target before evidence digests are admitted.
Hardened geometry-neutral stellarator replay admission so scenarios fail
closed on nonzero initial frames, missing objective metrics, impossible
current constraints, unsupported stuck-fault modes, and non-integer runtime
report inputs before replay evidence or manifest digests are produced.
Added tamper-evident SHA-256 payload digests to persisted RZIP
calibration evidence and benchmark reports so admission rejects modified
evidence payloads before facility-claim promotion.
Hardened RZIP facility-claim admission so calibration evidence is
revalidated against source class, reference growth-rate presence, finite
physical fields, and declared growth-rate tolerance at admission time.
Hardened the JAX traceable runtime public boundary so single-loop rollouts
reject batched command arrays, reject vector initial states deterministically,
and validate parity integer seeds before reproducibility campaigns are built.
Added tamper-evident geometry-neutral stellarator replay manifests that bind
scenario, trace, metric, and threshold payloads with SHA-256 digests and
fail closed on manifest, trace, or acceptance tampering.
Renamed the IMAS ODS adapter contract test file to avoid the retired generic
test filename pattern while preserving the same module-specific behaviour.
Added a fail-closed formal proof-manifest gate for safety-critical SCPN
controller artifacts, including bounded-claim enforcement, hash-addressed
report metadata, and mandatory counterexample paths for failed proof
evidence.
Hardened safety-critical proof-manifest admission by binding evidence to the
canonical controller-artifact payload SHA-256, rejecting unsafe report URIs,
constraining formal backends, and optionally verifying report bytes under a
caller-supplied report root.
Added tamper-evident differentiable transport admission evidence that binds
JAX campaign metadata, sampled gradient-audit results, equilibrium coupling,
and optional safety-critical controller proof artifact digests before
controller-tuning claims can be promoted.
Added tamper-evident digital-twin online-update evidence that binds TRANSP
and TSC simulator metadata, observation and prior digests, Bayesian-update
result digests, baseline-improvement status, and optional safety-critical
controller proof artifact digests.
Added a bounded controller safety-case evidence workflow that links a passing
formal controller proof manifest, audited differentiable-transport evidence,
and TRANSP/TSC-backed digital-twin update evidence to the same canonical
controller artifact digest.
Added schema-versioned controller safety-case manifest persistence with an
integrity digest so archived evidence bundles fail closed on malformed schema
or payload tampering before replay admission.
Added an explicit controller safety-case readiness gate that remains blocked
until external physics validation, target-hardware timing evidence, and
independent safety-review digests are all present and bound to the current
safety-case bundle.
Added schema-versioned controller safety-case readiness manifest persistence
with an integrity digest so promotion decisions fail closed on malformed
schema or payload tampering before replay.
Added typed controller safety-case readiness artefacts so promotion evidence
requires kind-specific external validation, target-hardware timing, and
independent-review artifacts with safe relative URIs, producers, timestamps,
and SHA-256 digests.
Hardened the phase WebSocket stream with explicit payload-size limits,
server-side frame caps, default client authentication, TLS-required startup
mode, disabled-by-default query-token authentication, fail-closed plaintext
non-loopback binding, browser-origin allowlisting, command allowlisting, and
CLI/documentation coverage for authenticated remote exposure.
Added a Pydantic v2 schema/export path to TokamakConfig, extended E2E
latency evidence with target-hardware metadata, and exposed NMPC optional
casadi/fail-closed acados solver backend contracts.
Implemented the optional NMPC acados OCP interface with injected runtime
factories, symbolic discrete dynamics support, augmented-state slew-rate path
constraints, SQP/partial-condensing HPIPM defaults, exact-Hessian mode,
warm-start staging, and fail-closed solver-status handling.
Hardened NMPC acados result admission with finite state/control trajectory
checks, state and terminal-set enforcement, slew-rate revalidation, and a
runtime plant-consistency residual gate for symbolic-dynamics drift.
Added a strict E2E latency-evidence validator so unqualified local benchmark
runs cannot be admitted as target-hardware or real-time performance evidence.
Double-gated controller bit-flip fault injection behind both constructor and
environment opt-ins, and hardened controller JSONL append handling against
symlink-target writes where platform support is available.
Hardened real-data manifest artefact verification so checksum-covered local
evidence must use relative, non-traversing paths resolved under the manifest
evidence tree or repository root.
Added shared external-reference URI admission for density, RZIP, orbit, and
VMEC validation gates so external artifact claims reject ambiguous relative
paths, arbitrary local file URIs, hosted file URIs, and traversal paths.
Hardened external executable provenance admission for GK cross-code, GK
interface, and neural transport reference validators so real external-code
claims reject URI, relative, traversal, temporary, and system-control
binary_path values.
Added a public production-readiness boundary that separates
production-oriented library engineering from facility deployment, external
validation, measured-shot validation, and certification claims.
Hardened fail-closed physics and mathematics boundaries across MHD,
pedestal, edge, transport, orbit-following, scenario, and uncertainty
surfaces without promoting unsupported facility or full-fidelity claims.
Added release-blocking boundary coverage for edge cases, invalid inputs,
monotonicity contracts, conservation boundaries, and finite-output contracts
in module-specific test files.
Persisted differentiable transport campaign metadata and added a replay guard
that rejects backend, grid, boundary, closure, tolerance, and equilibrium
drift before controller-tuning reruns.
Added differentiable transport source-schedule gradients so controller
tuning can optimise additive heating, fuelling, and impurity-source inputs
through the same JAX Crank-Nicolson facade as transport coefficients.
Added bounded multi-step differentiable transport rollout gradients so
controller tuning can optimise time-distributed source schedules without
finite-difference plant evaluations.
Wired NMPC source-rollout tuning to the multi-step differentiable transport
gradient path with explicit source bounds and sampled finite-difference
audit admission.
Added audited multi-step differentiable transport rollout-gradient latency
reporting for bounded NMPC source-rollout admission evidence.
Added Grad-Shafranov flux-weighted multi-step transport rollout loss and
source/equilibrium gradients for bounded controller-tuning studies.
Added a bounded reduced-gyrokinetic transport closure adapter for mapping
existing quasilinear GK profile outputs into differentiable transport
coefficient channels with explicit provenance.
Added explicit gyrokinetic species diamagnetic-frequency bookkeeping with
charge-direction, density-gradient, temperature-gradient, and zero-drive
regression coverage.
Added the Miller geometry contravariant metric-determinant identity to the
public geometry result and regression coverage.
Added an explicit reduced-gyrokinetic saturation-rate utility with monotone,
non-negative, and field-line-rate-bounded regression coverage.
Added a differentiable transport gradient audit that compares JAX transport
coefficient and source-schedule gradients against sampled finite-difference
perturbations before controller-tuning admission.
Added differentiable transport gradient-latency reporting for the audited
controller-tuning admission path with persisted bounded benchmark artefacts.
Wired the NMPC transport-tuning path to require that gradient audit by
default and to persist the audit result with each coefficient update.
Added audited NMPC source-schedule tuning for additive heating, fuelling, and
impurity-source controls with explicit finite source bounds.
Added RZIP vertical-stability calibration evidence and fail-closed
facility-claim admission with bounded local benchmark artefacts.
Added resistive-wall-mode feedback claim evidence and fail-closed
facility-claim admission with bounded wall, rotation, coil, and latency
provenance reports.
Added EFIT-lite reconstruction claim evidence and fail-closed facility-claim
admission with bounded diagnostic and shape provenance reports.
Added kinetic-EFIT pressure and q-profile claim evidence with fail-closed
facility-claim admission for matched pressure, q-profile, anisotropy,
diagnostic, profile, fast-ion, MSE-calibration, and interpolation provenance.
Added VMEC-lite spectral facade claim evidence with fail-closed full-VMEC
admission for matched Fourier geometry, rotational transform, residual, and
convergence provenance.
Added orbit-following claim evidence with fail-closed external-code
admission for matched banana-width, first-orbit-loss, particle, geometry,
collision-model, and loss-boundary provenance.
Added uncertainty-quantification claim evidence with fail-closed calibrated
predictive-UQ admission for matched central values, sigma statistics, seed,
prior, scenario, propagation-chain, and sensitivity provenance.
Added density-control claim evidence with fail-closed facility-calibrated
admission for matched Greenwald fraction, particle inventory, geometry,
transport, actuator, diagnostic, and CFL provenance.
Added neural-equilibrium claim evidence with fail-closed predictive-claim
admission for matched P-EFIT or documented public reference artefacts,
weight checksums, flux, pressure, q-profile, boundary, and axis tolerances.
Added neural-transport claim evidence with fail-closed quantitative
admission for matched QuaLiKiz or documented public reference artefacts,
weight checksums, QLKNN-10D feature ordering, diffusivity errors, and branch
accuracy.
Added neural-turbulence claim evidence with fail-closed quantitative
admission for matched gyrokinetic campaign or documented public reference
artefacts, weight checksums, QLKNN-class feature ordering, gyro-Bohm flux
errors, and critical-gradient accuracy.
Added disruption-mitigation claim evidence with fail-closed mitigation
admission for measured, external-benchmark, or documented public reference
artefacts covering warning lead time, mitigation outcome, halo-current
envelope, runaway-beam envelope, and tritium-breeding-ratio metrics.
Added free-boundary tracking claim evidence with fail-closed facility-control
admission for matched public, measured-replay, or external equilibrium
artefacts covering shape, X-point, divertor, coil-current, response-rank,
latency, and supervisor provenance.
Added DT burn-control claim evidence with fail-closed reactor-control
admission for matched public, integrated-transport benchmark, or measured
burn replay artefacts covering alpha power, Q, Lawson margin, burn fraction,
reactivity exponent, and controller-limit provenance.
Added volt-second claim evidence with fail-closed pulse-duration admission
for matched public, measured loop-voltage replay, or external scenario
artefacts covering total flux, flat-top duration, Ejima flux, bootstrap
current, and budget-margin provenance.
Added current-drive claim evidence with fail-closed external deposition
admission for matched public, ray-tracing, Fokker-Planck, or measured
deposition artefacts covering absorbed power, driven current, deposition
centroid, peak current density, and NBI slowing-down provenance.
Added mu-synthesis claim evidence with fail-closed validated robust-control
admission for matched public, external mu-toolbox, or measured replay
artefacts covering mu upper bounds, robustness margin, controller gain,
D-scaling, and closed-loop spectral-abscissa provenance.
Hardened SCPN formal verification with algebraic place-invariant proofs and
bounded temporal response and recurrence specifications over all bounded
firing paths.
Added optional Z3 bounded model checking for compiled SCPN control logic,
including SMT-backed marking-bound counterexamples, temporal exclusivity and
response specs, and JSON/Markdown evidence publication with explicit blocked
status when z3-solver is unavailable.
Hardened federated disruption prediction with per-facility array ingestion,
facility-update differential privacy accounting, serialisable privacy
ledgers, and a deterministic synthetic multi-facility benchmark report. This
remains bounded synthetic evidence, not measured cross-facility validation.
Added neural equilibrium synthetic pretraining with deterministic
JAX-compatible weights, benchmark reports, and a fail-closed real EFIT/P-EFIT
fine-tuning admission gate backed by persisted reference artefacts.
Added digital-twin online model updating with fail-closed TRANSP/TSC
simulator artifact metadata validation, deterministic Bayesian optimisation
over bounded density, effective-charge, and actuator parameters, and a
synthetic online-update benchmark report.
Hardened the gyrokinetic online learner with OOD-threshold sample admission,
auditable retraining decisions, persisted update reports, and a deterministic
synthetic online-retraining benchmark.
Added integrated-scenario coupling audits with deterministic replay metadata,
module-by-module exchange records, timestep consistency checks, and bounded
current and thermal-energy diagnostics while preserving the external
validation claim boundary.
Preserved JAX gyrokinetic stiffness-closure monotonicity under the CI JAX
backend while keeping the closure explicitly bounded as a controller-tuning
surrogate.
Applied the formatter changes required by the remote pre-commit workflow so
release-candidate CI starts from the same formatting state as local checks.
Documented the hardening release-candidate scope, residual validation gaps,
and tag gate before creating a release tag.
Retained the physics traceability boundary: public full-fidelity claims remain
blocked until the required external artefacts are supplied and validated.
Hardened traceability summary checks so generated report, roadmap, and
release documentation derive open-gap counts from the live registry instead of
stale fixed numbers.
GitHub Actions for the current main head are green after the documentation,
traceability, formatter, and JAX stiffness fixes.
Hardened fail-closed contracts across external GK solver surfaces:
QuaLiKiz, GENE, GS2, and CGYRO now require explicit dual-gate opt-in
for degraded fallback behaviour.
Hardened integrated transport GK acceptance criteria:
converged results must also be finite and non-negative for
chi_i, chi_e, and D_e, otherwise fail closed by default.
Integration wiring: sawtooth crash→psi writeback, NTM seeding from crash
energy, ELM/stability/L-H modules connected to scenario loop, beta_N and li
computed from profiles (were hardcoded placeholders)
GK: Te/Ti ratio in quasilinear (was trivially 1.0), omega_r←gamma_net in
TGLF native output, electron drive phi→phi_eff for EM flutter, Ampere skin-depth
term, CFL k→k² for Poisson bracket, Sugama conservation via 3×3 Gram matrix
gyrokinetic_transport.py — quasilinear TGLF-10 instability spectrum (ITG/TEM/ETG
growth rates and mode identification from local plasma parameters)
ballooning_solver.py — second-order ODE eigenvalue solver in s-alpha geometry;
binary-search marginal-stability finder; full stability diagram computation
current_diffusion.py — parallel current evolution PDE with neoclassical
resistivity (Sauter-Angioni), ohmic heating, and bootstrap source
current_drive.py — ECCD, NBI, LHCD auxiliary current-drive models with
absorption efficiency and radial deposition profiles
ntm_dynamics.py — modified Rutherford equation for neoclassical tearing modes
(2/1, 3/2); ECCD stabilization factor; NTM controller with mode-tracking
rwm_feedback.py — resistive wall mode n=1 feedback with active coils, Galerkin
gain computation, and passive-wall eigenvalue analysis
sawtooth.py — Porcelli-like trigger (shear at q=1), Kadomtsev reconnection
crash model, density/energy conservation, SawtoothCycler with crash history
sol_model.py — two-point SOL model (upstream-to-target), Eich heat-flux width
scaling (Goldston heuristic), sheath-limited and conduction-limited regimes
rzip_model.py — linearised tokamak vertical stability model (RZIp plant);
eigenvalue-based growth rate; passive structure model
integrated_scenario.py — full integrated scenario simulator coupling transport,
current diffusion, current drive, sawteeth, NTM, and SOL models; ships with
ITER baseline, ITER hybrid, and NSTX-U preset scenarios
Phase 4 — Absolute control (10 modules in control/):
nmpc_controller.py — nonlinear MPC with SQP over 20-step horizon; state/input
box constraints and slew-rate limits on Ip, beta_N, q95, li, Te, nbar
mu_synthesis.py — D-K iteration for structured robust control; D-scaling
optimization minimising structured singular value mu; MuSynthesisController
sliding_mode_vertical.py — sliding-mode controller for vertical stability;
continuous control law with dead-band saturation; configurable sliding surface
scenario_scheduler.py — shot timeline manager for startup→ramp→flattop→
rampdown; actuator scheduling with power budgets; scipy.optimize trajectory
fault_tolerant_control.py — sensor/actuator fault detection via innovation
monitoring; reduced-rank operation under faults; stuck-sensor reconstruction
GS* stencil sign bug: east/west coefficients in Jacobi, SOR, multigrid,
and JAX solvers had the 1/(2R·dR) sign swapped — implementing the cylindrical
Laplacian (∂²ψ/∂R² + (1/R)∂ψ/∂R) instead of the correct GS* operator
(∂²ψ/∂R² − (1/R)∂ψ/∂R). Python now matches Rust sor.rs. Verified via
Solov'ev exact solution (< 1% error on 33×33 grid).
beta_N formula (TokamakEnv): replaced dimensionally incorrect sqrt(Ip)
expression with Troyon scaling β_N = c·T/Ip, calibrated to ITER baseline
gain_margin_db misnomer: renamed to stability_margin_db (eigenvalue-based,
not Bode gain margin); backward-compat alias retained
MPC docstring: states clearly this is gradient-based trajectory optimization,
not Rawlings-Mayne MPC
Physics citations: Braginskii tau_eq, Martin L-H threshold, Troyon beta_N,
Wesson q95 — all hardcoded constants now cite source
H-infinity Y Riccati tolerance: tightened from 1.0 to 0.01
QLKNN-10D trained neural transport model: 3-layer MLP (10→128→64→3) trained
on synthetic critical-gradient data (5000 samples, van de Plassche et al. 2020 paradigm)
Training script tools/train_neural_transport_qlknn.py with --synthetic CI mode
and --data-dir for real Zenodo dataset
Auto-discovery: NeuralTransportModel() loads weights from weights/ if present
PPO agent on TokamakEnv via stable-baselines3 (tools/train_rl_tokamak.py)
Gymnasium-compatible GymTokamakEnv wrapper with proper spaces.Box definitions
PID and 1-step MPC baseline controllers for comparison
RL vs classical benchmark (benchmarks/rl_vs_classical.py): PPO vs PID vs MPC
[rl] optional dependency group (stable-baselines3, gymnasium)
JAX-accelerated transport primitives (scpn_control.core.jax_solvers):
Thomas tridiagonal solver, Crank-Nicolson diffusion operator, and batched
transport via jax.vmap — all JIT-compiled, GPU-compatible, and
differentiable via jax.grad for sensitivity analysis