Changelog

Unreleased

Fixed

Catch pickle.UnpicklingError in disruption checkpoint load so corrupt weights fail closed or fall back when opted in (CTL-G07 R7-S4 fidelity).

Changed

Began strict native Rust API-documentation enforcement with the PyO3/transport package, including crate-level missing-doc and broken-link denial for its library and benchmark binary.
Documented the public adaptive-mesh, Chebyshev-SOR, NURBS, Kuramoto, and symplectic state contracts and made missing or broken Rust API documentation a hard failure throughout control-math.
Documented the native configuration, constants, typed errors, grid, plasma, thermodynamics, and stability schemas and enabled strict rustdoc enforcement throughout control-types.
Documented the public BOUT++ validation, RF-heating parameters, radial transport state, and memory-kernel transport contracts, closing the first 16 control-core native-doc findings.
Documented the validated AMR solve policy/hierarchy outputs and the reduced EPED pedestal/ELM configuration and lifecycle, closing 24 additional control-core native-doc findings.
Documented MPI domain ownership, Cartesian-neighbour topology, and VMEC-compatible boundary/equilibrium contracts, closing 37 additional control-core native-doc findings.
Documented charged macro-particle phase-space fields and aggregate energy, current, weight, and runaway diagnostics, closing 20 additional control-core native-doc findings.
Documented inverse-profile Jacobian selection, regularisation controls, reconstructed outputs, and coupled kernel-convergence policy, closing 21 additional control-core native-doc findings.
Documented runtime kernel specialization and core Grad-Shafranov state, controls, solve results, and probe APIs; the crate now denies missing and broken-link rustdoc warnings at source.
Removed 16 redundant test-only configuration-path borrows so the complete control-core all-target Clippy gate passes on the current Rust toolchain.
Documented PID/isoflux state, self-organized-criticality learning state, and shattered-pellet disruption phases and snapshots, closing the first 31 control-control native-doc findings.
Documented H-infinity synthesis/observer state and MPC surrogate, decision, evidence-digest, and rollout contracts, closing 37 additional control-control native-doc findings.
Documented SNN synchronization and position-control state plus digital-twin noise, fault, delay, neural-policy, and plasma-state contracts, closing 45 additional control-control native-doc findings.
Documented multi-shot plans, command/phase logs, admission reports, evidence digests, and error contracts; the control-control crate now denies missing and broken-link rustdoc warnings at source.
Added warnings-denied workspace Cargo documentation to CI, local preflight, and the documented Makefile build path so native API regressions fail closed.
Added strict TypeDoc generation for every exported Control Studio entry point to CI, local preflight, and the documented Makefile build path.
Rewrite disruption checkpoint / safe-API / fallback tests to real torch train→pin→load→predict paths; remove FakeTorch and patched train/load surfaces (real-surface E2E policy).
Extract disruption checkpoint integrity and train/load orchestration into control/disruption_checkpoint.py (CTL-G07 R7-S4). The disruption predictor re-exports the checkpoint leaf; the optional torch model class remains on the owner. Inventory cascade: 196 modules / 546 test files.
Extract disruption fault/noise and anomaly-alarm campaigns into control/disruption_fault_campaigns.py (CTL-G07 R7-S3). The disruption predictor re-exports the campaigns leaf; checkpointed torch training remains on the owner. Inventory cascade: 195 modules / 545 test files.
Extract disruption physics proxies (tearing, features, risk, warning time) into control/disruption_physics_proxies.py (CTL-G07 R7-S2). The disruption predictor re-exports the proxies leaf; fault campaigns and checkpointed torch training remain on the owner. Inventory cascade: 194 modules / 544 test files.
Extract disruption-risk claim boundary and heuristic provenance into control/disruption_risk_claims.py (CTL-G07 R7-S1). The disruption predictor product surface re-exports the claim leaf; physics proxies and training remain on the owner. Inventory cascade: 193 modules / 543 test files.
Extract integrated-scenario Spitzer, gyro-Bohm, and diffusion-step helpers into core/integrated_scenario_micro_physics.py (CTL-G07 R5-S3). The IntegratedScenarioSimulator product surface re-exports the helpers; R5 ladder complete. Inventory cascade: 192 modules / 542 test files.
Extract integrated-scenario coupling audit, module-exchange records, and report I/O into core/integrated_scenario_coupling_audit.py (CTL-G07 R5-S2). The IntegratedScenarioSimulator product surface re-exports the audit leaf; transport micro-physics remains on the owner. Inventory cascade: 191 modules / 541 test files.
Extract integrated-scenario configuration presets and ScenarioConfig into core/integrated_scenario_presets.py (CTL-G07 R5-S1). The IntegratedScenarioSimulator product surface re-exports presets; coupling audit and micro-physics remain on the owner. Inventory cascade: 190 modules / 540 test files.
Extract SCPN artifact JSON schema emission into scpn/artifact_schema.py (CTL-G07 R4-S5). The Artifact product surface is a re-export facade over model, validate, codec, IO, and schema leaves. Inventory cascade: 189 modules / 539 test files.
Extract SCPN artifact load/save and payload hashing into scpn/artifact_io.py (CTL-G07 R4-S4). The Artifact product surface re-exports load_artifact / save_artifact / compute_artifact_payload_sha256; JSON schema remains on scpn/artifact.py. Inventory cascade: 188 modules / 538 test files.
Extract SCPN artifact compact packed-weight codec into scpn/artifact_codec.py (CTL-G07 R4-S3). The Artifact product surface re-exports encode_u64_compact / decode_u64_compact; load/save and JSON schema remain on scpn/artifact.py. Inventory cascade: 187 modules / 537 test files.
Extract SCPN artifact structural validation and safety-critical admit into scpn/artifact_validate.py (CTL-G07 R4-S2). The Artifact product surface re-exports validate_artifact / validate_safety_critical_artifact; load/save/schema/codec remain on scpn/artifact.py. Inventory cascade: 186 modules / 536 test files.
Extract SCPN artifact topology/payload model dataclasses into scpn/artifact_model.py (CTL-G07 R4-S1). The Artifact product surface and validate/load/save/schema/codec remain on scpn/artifact.py with re-exports. Inventory cascade: 185 modules / 535 test files.
Harden permanent privacy for docs/internal/ (gitignored forever, MkDocs exclude, preflight + CI gate tools/check_docs_internal_private.py). Internal TODO/audits/handovers must never be tracked or published.
Decompose free-boundary run_tracking_shot into cohesive private stage methods on FreeBoundaryTrackingController (CTL-G07 R3-S4): validate args, initialise shot, observe/plan correction, gain-search or recover, record history, summarise. Public shot entry and summary keys are unchanged; claims stay separate; dual-home C held. Inventory cascade: 184 modules / 533 test files (in-module only).
Extract free-boundary tracking response diagnostics, activation mask, coil headroom penalties, and Tikhonov coil correction into control/free_boundary_tracking_control_law.py (CTL-G07 R3-S3). The FreeBoundaryTrackingController product surface remains first-class with thin wrappers; kernel-coupled identify_response_matrix and actuator application stay on the owner; claims stay separate; shot orchestration remains for R3-S4. Inventory cascade: 184 modules / 533 test files.
Extract free-boundary tracking target/measurement vector builders into control/free_boundary_tracking_observation.py (CTL-G07 R3-S2). The FreeBoundaryTrackingController product surface remains first-class with thin wrappers; claims stay separate; shot orchestration remains on the controller. Inventory cascade: 183 modules / 532 test files.
Extract free-boundary tracking objective/supervisor limit resolvers into control/free_boundary_tracking_limits.py (CTL-G07 R3-S1). The FreeBoundaryTrackingController product surface remains first-class with thin wrappers; claims stay in free_boundary_tracking_claims (not re-merged). Inventory cascade: 182 modules / 531 test files.
Extract the Rust multigrid equilibrium bridge into core/gs_rust_multigrid_bridge.py (CTL-G07 R0-S9 under dual-home C). The CONTROL FusionKernel product surface remains first-class with a thin wrapper; Python SOR fallback paths for missing Rust and boundary-constrained solves are preserved. Rust algorithm semantics are unchanged. FUSION is not edited. Inventory cascade: 181 modules / 530 test files.
Extract reduced-order phase-sync step and multi-step Lyapunov helpers into core/gs_phase_sync.py (CTL-G07 R0-S8 under dual-home C). The CONTROL FusionKernel product surface remains first-class with thin wrappers that supply phase_sync config; Kuramoto numerics remain in scpn_control.phase.kuramoto. FUSION is not edited. Inventory cascade: 180 modules / 529 test files.
Extract free-boundary solve orchestration into core/gs_free_boundary_solve.py (CTL-G07 R0-S7 under dual-home C). The CONTROL FusionKernel product surface remains first-class with a thin wrapper over the outer coil/equilibrium loop; phase-sync and Rust multigrid stay on the owner. FUSION is not edited. Inventory cascade: 179 modules / 528 test files.
Extract free-boundary coil optimisation, objective tolerances/status, divertor configuration labels, and CoilSet into core/gs_free_boundary_control.py (CTL-G07 R0-S6 under dual-home C). The CONTROL FusionKernel product surface remains first-class with thin wrappers and re-exports CoilSet; full free-boundary solve orchestration stays on the owner (R0-S7). FUSION is not edited. Inventory cascade: 178 modules / 527 test files.
Extract mTanh pedestal profiles, normalised-flux guard, nonlinear plasma source, and profile Jacobian helpers into core/gs_profile_source.py (CTL-G07 R0-S5 under dual-home C). The CONTROL FusionKernel product surface remains first-class with thin wrappers; FUSION is not edited. Inventory cascade: 177 modules / 526 test files.
Extract linear elliptic iterators (Jacobi, Red-Black SOR, Anderson mixing, Python elliptic solve) into core/gs_elliptic_iterators.py (CTL-G07 R0-S4 under dual-home C). The CONTROL FusionKernel product surface remains first-class with thin wrappers including the HPC offload branch; FUSION is not edited. Inventory cascade: 176 modules / 525 test files.
Extract geometric multigrid primitives (restrict, prolongate, smooth, residual, V-cycle) into core/gs_multigrid.py (CTL-G07 R0-S3 under dual-home C). The CONTROL FusionKernel product surface remains first-class with thin wrappers; FUSION is not edited. Inventory cascade: 175 modules / 524 test files.
Extract toroidal Green's function, vacuum poloidal flux, and mutual-inductance helpers into core/gs_green_vacuum.py (CTL-G07 R0-S2 under dual-home C). The CONTROL FusionKernel product surface remains first-class with thin wrappers; FUSION is not edited. Inventory cascade: 174 modules / 523 test files.
Extract fusion-kernel configuration models and parse/dump helpers into core/fusion_kernel_config.py (CTL-G07 R0-S1 under dual-home C). The CONTROL FusionKernel product surface remains first-class and re-exports the public config contracts; FUSION is not edited. Inventory cascade: 173 modules / 522 test files.
Extract core Crank-Nicolson step and multi-step rollout numerics into core/differentiable_transport_core.py (CTL-G07 R1-S3). The facade remains an orchestration surface for validators and campaign metadata and re-exports the public step/rollout symbols; the leaf lazy-imports facade validators and the facade JAX gate. Inventory cascade: 172 modules / 521 test files.
Extract equilibrium-weighted transport losses, gradients, and radial weight helpers into core/differentiable_transport_equilibrium_weight.py (CTL-G07 R1-S6). The facade re-exports public symbols; the leaf lazy-imports step and rollout primitives plus the facade JAX gate so admission monkeypatches stay on the production path. Inventory cascade: 171 modules / 520 test files.
Extract multi-step rollout source gradients and finite-difference audit contracts into core/differentiable_transport_rollout_ad.py (CTL-G07 R1-S5). The facade re-exports public symbols; the leaf lazy-imports rollout primitives and the facade JAX gate so admission monkeypatches stay on the production path. Inventory cascade: 170 modules / 519 test files.
Extract one-step parameter / loss gradients and finite-difference audit contracts into core/differentiable_transport_parameter_ad.py (CTL-G07 R1-S4). The facade re-exports public symbols; the leaf lazy-imports step validators and the facade JAX gate so admission monkeypatches stay on the production path. Inventory cascade: 169 modules / 518 test files.
Extract local JAX gradient-admission latency benchmarks into core/differentiable_transport_latency.py (CTL-G07 R1-S7). The facade re-exports the public symbols; benchmarks lazy-import AD asserts so the measured path remains the production admission contract.

Changed

Extract neural and reduced gyrokinetic transport-closure adapters into core/differentiable_transport_closures.py (CTL-G07 R1-S2). The numerical facade re-exports the same public symbols so controller tuning imports stay stable while the facade owns only step/rollout/AD orchestration.

Fixed

Require FUSION IDA same-case latency evidence to identify synchronised, same-input solves from a converged equilibrium, bind cold/warm iteration counts below their declared caps, and project P50/P95 from the exact warm samples. Legacy v2 reports that relabelled JIT-warm cold continuation as steady-state latency can no longer cross the CONTROL evidence boundary.
Authenticate the default-off Rust UDP transport heartbeat with an exact SCPNHB01 frame, HMAC-SHA256, strict source-IP allowlist, private key-file policy, loopback-default bind host, and monotonically increasing counter. Invalid, spoofed, oversized, or repeated/reordered datagrams within a receiver lifetime no longer refresh liveness; public wording now treats the heartbeat as a transport-liveness hint rather than an independent safety function.
Harden the CODAC/EPICS actuation boundary: reject non-finite controller outputs, clamp every finite command to its declared channel envelope, export analog DRVH/DRVL drive limits, and make run_cycle return a zero-output packet without invoking the controller whenever a required plant signal or external interlock PV is missing, invalid, tripped, or outside its hard limit. Version runtime evidence to v2 so legacy reports cannot support the corrected fail-closed boundary claim.
Reject non-unit transition-weight envelopes for existential Z3 firing obligations so fractional token flow cannot satisfy a discrete firing claim. Version the formal report schema to v2 and distinguish sat, unsat, mixed, unknown, and not-run temporal solver outcomes instead of labelling every successful temporal bundle unsat; v1 evidence must be regenerated before admission.
Restored the elongation- and triangularity-shear (s_kappa, s_delta) terms in the Miller local-equilibrium radial derivatives (core.gk_geometry.miller_geometry, Miller et al. 1998 Eqs. 36-37). The parameters were accepted and validated but silently dropped from dR/dr and dZ/dr, leaving the metric coefficients (g_rr, g_rt, g_tt) and Jacobian incorrect for finite shaping-shear while the circular / fixed-shaping (s=0) domain stayed exact. Confirmed and fixed against an independent finite-difference reference that differentiates the flux-surface definition directly.

Added

Add a public validate-ida-same-case command and strict CONTROL admission model for FUSION-owned IDA evidence. The validator rejects duplicate keys, digest/schema/threshold projection drift, forged claims, malformed gradient audits, and optionally verifies every upstream source byte from the exact bound Git commit. A valid integration-observed report remains explicitly blocked rather than becoming control, facility, PCS, safety, or scientific admission.
Add a bounded DIII-D IDA equilibrium adapter that keeps free-boundary Grad-Shafranov mathematics in SCPN-FUSION-CORE while exposing validated SI grids, PF-coil currents, compact p-prime/FF-prime coefficients, the FUSION 4.x implicit solve, and a three-input vector-Jacobian product at the CONTROL boundary. Require JAX FP64, bind exact upstream solver/profile source hashes, enforce finite shape and resource limits, and keep scientific, facility, control, PCS, and safety claims false.
Add a self-digested MAST dB/dt source-authority gate that measures the live five-row centre-column Mirnov source without transforming it, records the official T versus live Tesla/sec ambiguity, and admits exactly one of two source-attested branches: one derivative for magnetic field or no derivative for an existing field derivative. Require matching source units, content digest, row/geometry join, mapping-scale semantics, component/orientation/sign, reduction/missing/bad-channel/filter/edge policies, calibration uncertainty, and released geometry. Bind its blocker and digest into signal-binding and replay reports so the historical zero-fill/gradient/peak recipe remains a compatibility candidate only.
Add a self-digested MAST locked-mode authority gate that binds the official outer-midplane saddle observation to the existing saddle row/geometry gate, measures the legacy 201-sample boxcar in physical time without executing it, and keeps canonical locked_mode_amp blocked until the radial component, probe location, stationary frame, n=1 estimator, physical-frequency filter/edge policy, pickup/background/vessel corrections, calibration uncertainty, and estimator evidence are source-attested. Bind its digest into signal-binding and replay reports while retaining historical values as compatibility candidates only.
Add a self-digested MAST saddle-modal authority gate that pins the complete FAIR-MAST mapping and geometry identity, verifies per-row finite coverage and toroidal polygon centres without reducing them, and keeps canonical n1_amp and n2_amp blocked until the field/geometry row join, vertical saddle set, released geometry revision, calibration uncertainty, baseline, and bad-channel policies are source-attested. Bind the gate digest and blocker into signal-binding and replay reports.
Add a self-digested MAST normalised-beta authority gate that pins the FAIR-MAST and current IMAS definitions, treats the live EFM_BETAN T-to-1 conflict as a metadata-repair candidate without changing values, retains minor_radius without resampling, inventories the independent formula inputs, and keeps canonical beta_N blocked until sign, scale, negative-value validity, reconstruction quality, complete input lineage, and one-standard-deviation uncertainty are authoritative.
Add a self-digested MAST toroidal-field authority gate that distinguishes total bphi_rmag from vacuum bvac_rmag, binds the time-varying magnetic-axis radius and source generation, declares the complete TF-current alternative, and keeps canonical BT_T blocked until primary-source sign and one-standard-deviation uncertainty authority are content-digested. Extend acquisition to retain total field and reference radius without resampling.
Add a two-run FAIR-MAST regeneration verifier that reopens the exact SourceObjectManifest-v2 artifacts, producer-bound replay report/archive, and every lineage-bound dataset output; rejects tree or binding drift; requires native source-generation pins; seals complete per-file inventories; proves fixed-input/fixed-time byte identity; and preserves all proxy-label, training, scientific, reuse, facility, cohort, and control blockers.
Add a fresh-output FAIR-MAST dataset producer-lineage contract that verifies source-object manifest v2, replay report/archive v2, and a self-digested transform specification before labelling. It binds every dataset NPZ to its selected-array parent, acquisition transform, optional source generation, replay member, label record, transform, and output checksum; records exact replay exclusions; validates the sealed output against tampering; refuses overwrite or input-directory mutation; rolls back handled failures; and keeps proxy-label, training, scientific, reuse, facility, cohort, and control claims false.
Upgrade new disruption replay production to report schema v2 with an archive-first producer binding: the reopened channels.npz byte length and SHA-256, canonical per-shot digests over all eleven finite channel vectors, exact shot/member inventory, immutable source/output confinement, and exclusive archive/report publication with handled-failure rollback. Historical v1 campaign bytes remain untouched and retain their post-hoc-only claim boundary.
Admit replay report v2 into campaign reconciliation only when its exact embedded archive binding matches the already pinned archive byte snapshot, including whole-file and canonical per-shot digests. The legacy v1 path and its deterministic reconciliation report remain byte-surface compatible; v2 removes only the replay-producer-binding blocker and cannot promote any dataset, training, scientific, reuse, facility, or control claim.
Add an immutable post-hoc FAIR-MAST dataset-lineage manifest that binds each retained shot to verified source-parent, replay-member, transform-spec, and dataset-artifact digests, records the exact exclusion partition, and keeps producer-time, independent-label, training, scientific, facility, reuse, and control claims fail-closed.
validation/gk_geometry_independent_reference.py: a structurally independent finite-difference Miller-geometry reference, and validation/validate_gk_geometry_independent.py: a schema-versioned cross-check (scpn-control.gk-geometry-independent-crosscheck.v1) that validates the production metric against it across circular, shaped, high-shear, and both signs of finite shaping-shear local equilibria — closing the Miller geometry metric fidelity gap for external-validation tracker #47.

[0.23.0] - 2026-07-17

Added

Exposed the GK->UPDE coupling modulation gains as a configurable GKCouplingGains dataclass on phase.gk_upde_bridge.adaptive_knm, replacing the hard-coded turbulence/transport/pedestal gains and the diffusivity floor with documented, validated fields.
Added PhaseStreamServer.stop() to request a graceful shutdown of the phase-stream broadcast tick loop.

Changed

Split the CLI monolith further: the six evidence and data-manifest validation commands (validate, validate-release-evidence, validate-manifest, validate-data-manifests, validate-physics-traceability, validate-rmse) moved from cli.py into a new cli_evidence_validators.py as standalone @click.command objects, folded back onto the root scpn-control group via EVIDENCE_VALIDATOR_COMMANDS. The CLI surface is byte-identical (all 40 commands, names/options/behaviour unchanged); cli.py drops to a dispatcher over the core operational commands plus MDSplus acquisition. cli.py 1286 -> 856 L.
Split core.integrated_transport_solver further: the toroidal radial-grid geometry helpers moved to a new stateless core.transport_geometry module — the per-cell volume element (rho_volume_element), the Martin L-H plasma surface-area estimate (estimate_plasma_surface_area_m2), and canonical radial-grid validation/construction (is_canonical_radial_grid, canonical_radial_grid). _rho_volume_element stays a thin wrapper (patched by tests), _ensure_valid_radial_grid becomes a thin orchestrator over the pure validator, and the surface-area call site is repointed; behaviour is byte-identical. This resolves the transport-solver god-file (2103 -> 1619 L).
Split core.integrated_transport_solver further: the runtime numerical-hardening primitive moved from the private _sanitize_with_fallback static method to a new stateless core.runtime_sanitization module (sanitize_with_fallback) — replace non-finite profile entries from a fallback and clamp to optional physical bounds, reporting the recovered count. _sanitize_runtime_state and the Crank-Nicolson step now call the module function directly (18 call sites repointed); behaviour is byte-identical.
Split core.integrated_transport_solver further: the multi-ion (D/T/He-ash) species evolution moved from the private _evolve_species method to a new stateless core.species_evolution module (evolve_multi_ion_species + SpeciesEvolutionResult). One explicit time-step of the deuterium/tritium/ helium-ash densities under fusion burn, CFL-sub-stepped explicit diffusion, and helium pumping, then the quasineutral electron density, effective charge, and tungsten line radiation — with the species densities, temperatures, impurity density, grid, and pumping time passed explicitly and the mutated state returned for the caller to store. The confinement-time-derived pumping time stays in the thin _evolve_species orchestrator; the burn/transport/quasineutrality physics is byte-identical, so solver behaviour is unchanged.
Split core.integrated_transport_solver further: the auxiliary-heating source deposition (turning a requested auxiliary power into per-cell ion/electron temperature sources, power-normalised over the plasma volume) moved from the private _compute_aux_heating_sources method to a new stateless core.aux_heating module (aux_heating_source_profiles). The radial grid, density, and cell-volume element are passed explicitly; the fail-soft branches and power-balance telemetry are byte-identical, so solver behaviour is unchanged.
Split core.integrated_transport_solver further: the anomalous (turbulent) transport-coefficient models moved from private TransportSolver methods to a new stateless core.anomalous_transport module — the gyro-Bohm diffusivity scaling (gyro_bohm_chi_profile) and a single shared gyrokinetic per-flux-surface driver (gk_flux_surface_transport) that now backs both the external_gk and tglf_native transport models, removing ~100 lines of duplicated per-cell solver logic. The radial grid and plasma profiles are passed explicitly; the fail-closed guards, flux validation, and legacy gyro-Bohm fallback are byte-identical, so solver behaviour is unchanged.
Split core.integrated_transport_solver further: the Crank-Nicolson radial-diffusion numerics (the Thomas tridiagonal solve, the explicit cylindrical diffusion operator, and the Crank-Nicolson tridiagonal assembly) moved from private TransportSolver methods to a new stateless core.radial_diffusion module (thomas_solve, explicit_diffusion_rhs, build_cn_tridiag), which takes the radial grid explicitly. The discretisation is byte-identical; solver behaviour is unchanged.
Split core.integrated_transport_solver by responsibility: the stateless power source/sink kernels (D-T Bosch-Hale fusion reactivity, tungsten line radiation, bremsstrahlung) moved from private TransportSolver static methods to a new core.plasma_power_terms module (bosch_hale_dt_reactivity, tungsten_radiation_rate, bremsstrahlung_power_density). Solver behaviour is unchanged — the published formulae are identical; this trims the ~1670-line god-class and gives the microphysics kernels their own tested surface.
Split the cli monolith by responsibility: the 27 persisted reference-artifact validation commands (validate-gk-crosscode, validate-*-reference, validate-jax-gk-parity, validate-gk-ood-calibration, validate-gk-interface-artifacts) moved to a new cli_reference_validators module and are folded back onto the root scpn-control group via REFERENCE_VALIDATOR_COMMANDS. The CLI surface is unchanged — every command name, option, and behaviour is identical; this is an internal reorganisation that keeps the CLI entry point a thinner dispatcher.
Split the control.nmpc_controller megamodule by responsibility: the gradient-based transport-model tuning entry points (tune_transport_coefficients_for_tracking, tune_transport_sources_for_tracking, tune_transport_source_rollout_for_tracking, tune_neural_transport_closure_for_tracking) and their result dataclasses moved to a new control.nmpc_transport_tuning module, keeping transport-model fitting separate from receding-horizon control. Import these symbols from scpn_control.control.nmpc_transport_tuning; they are no longer available on scpn_control.control.nmpc_controller. NonlinearMPC and its configuration and runtime dataclasses are unchanged.
Split the scpn.z3_model_checking megamodule by responsibility: the schema-versioned formal-report evidence I/O (verify_z3_formal_contracts, write_z3_formal_report, build_z3_formal_report_payload, build_blocked_z3_formal_report_payload, load_z3_formal_report, validate_z3_formal_report_payload) and the Z3FormalVerificationReport dataclass moved to a new scpn.z3_formal_report module, keeping report persistence and schema validation separate from the Z3BoundedModelChecker proof engine. Import these symbols from scpn_control.scpn.z3_formal_report; they are no longer available on scpn_control.scpn.z3_model_checking. The checker engine, Z3ModelCheckingReport, and the SymbiYosys/RTI contract constants are unchanged.
Split the control.free_boundary_tracking megamodule by responsibility: the fail-closed claim-evidence surface (FreeBoundaryTrackingClaimEvidence, free_boundary_tracking_claim_evidence, assert_free_boundary_tracking_facility_claim_admissible, save_free_boundary_tracking_claim_evidence, and the summary/reference validators) moved to a new control.free_boundary_tracking_claims module, keeping run-summary claim admission separate from the FreeBoundaryTrackingController control loop. Import these symbols from scpn_control.control.free_boundary_tracking_claims; they are no longer available on scpn_control.control.free_boundary_tracking. The controller, run_free_boundary_tracking, and the acceptance/claims benchmark evidence are unchanged.
Split the scpn.formal_verification megamodule by responsibility: the bounded formal safety certificate I/O (SafetyCertificatePolicy, SafetyCertificateBundlePolicy, build_safety_certificate_payload, write_safety_certificate, generate_safety_certificate, validate_safety_certificate_payload, and the certificate-bundle and bundle-artifact build/validate/admit functions) moved to a new scpn.formal_safety_certificate module, keeping certificate persistence and admission separate from the FormalPetriNetVerifier reachability engine. Import these symbols from scpn_control.scpn.formal_safety_certificate; they are no longer available on scpn_control.scpn.formal_verification. The verifier engine, verify_formal_contracts, the reachability/property report dataclasses, and the CTL/LTL temporal specification dataclasses are unchanged.
Hardened the phase-stream WebSocket: the Origin allowlist can no longer be bypassed by a missing Origin header when origins are configured, malformed and non-object command frames now return a malformed_frame error and increment a malformed_frame_rejections counter instead of being dropped silently, and serve() always cancels and awaits its broadcast tick loop on exit so no orphan task survives shutdown.
adaptive_knm now logs a warning when handed a coupling matrix with fewer than six layers instead of silently returning it unmodulated.
Made the PyO3 crate testable in the Rust workspace: scpn-control-rs no longer enables PyO3 extension-module as a default Cargo feature, the native admission test uses the PyO3 0.29 initialization API, and CI now runs cargo test --workspace plus realtime PyO3 parity after the maturin build.
Unified UPDE tick snapshots across NumPy, Rust, and PyO3 paths: all runtime paths now return output-state R_layer, Psi_layer, R_global, Psi_global, Lyapunov fields, and per-oscillator dtheta derivatives.
Made controller artifact admission fail closed on inhibitor arcs: structure and formal-analysis paths may still opt into inhibitor compilation, but artifact export, artifact loading, and controller construction now reject negative dense input weights until the artifact schema carries inhibitor topology explicitly.
Added artifact-level firing-margin metadata to compiled controller artifacts so save/load, JSON schema validation, compiler export, and controller runtime share one explicit default margin contract.
Shipped the native Grad-Shafranov solver source and checksum manifest as scpn_control.core package data, with opt-in compile/load regression coverage for the package-local bridge path.
Aligned the public safe-RL paper wording with the implemented CPO-formulated Lagrangian constraint and control-barrier-function surface.
Down-scoped the public FPGA surface from bitstream export to generated HDL project/evidence export, preserving synthesis-evidence admission for any future hardware claim.
Wired runtime-bound safety certificate admission into NeuroSymbolicController, including loaded-artifact topology matching, certificate/binding/target/replay fail-closed admission, and focused 100% controller coverage.
Added bounded integrated-scenario closed-loop wiring for the combined CLI demo, connecting ScenarioSchedule feedback to IntegratedScenarioSimulator, exposing replay-audit evidence, and keeping measured-discharge claims blocked behind physics traceability.
Reclassified DIII-D repository reference artefacts as synthetic fixtures with generator/seed provenance, retained local checksum coverage for those fixtures, and renamed the CI/test surface away from real-shot validation.
Moved the untagged v1.0.0 roadmap block out of shipped history and reset it as a future production-readiness target gated by real release evidence.
Separated the public Paper 27 manuscript references from the related Kuramoto-Sakaguchi arXiv reference across pitch, README, and reviewer handoff surfaces.
Added the missing root streamlit_app.py Streamlit Cloud entry point as a thin adapter to the existing embedded WebSocket dashboard.
Synced the rendered MkDocs changelog mirror with the root changelog and added a CI/preflight drift guard to keep future release notes single-sourced.
Replaced LagrangianPPO random-action rollouts with a learned NumPy linear policy updated by clipped policy-gradient returns and Lagrangian safety costs.
Extended the version-sync guard to cover release notes, README PyPI/Python badges, the Pepy all-time downloads badge, and package metadata drift.
Added a JOSS submission guard covering canonical paper metadata, bibliography citation coverage, docs mirror links, and editorial claim-boundary text.
Added the SCPN Studio Web CI deploy step for the provisioned scpn-control remote, corrected the Windows CI runner label, and extended the deploy-key guard to verify the workflow.
Promoted Grad-Shafranov Python multigrid Solov'ev reconstruction into the sealed validation evidence contract and refreshed the Rust multigrid informational record.
Hardened the GitHub installation-token format readiness guard with canonical source headers, public API docstrings, repository traversal tests, binary-file skip coverage, and explicit development documentation.
Tightened the strict-mypy debt ratchet tests to cover subprocess wrappers, malformed ledger totals, and improvement reporting at 100% focused coverage, with development-guide documentation for the local preflight gate.
Aligned the generated SCPN Studio manifest with the deployed federation remote entry and stable ./Panel exposure, with focused emitter CLI tests and documentation for the generated Studio artifact.
Added a public-surface claim hygiene guard for outward-facing promotion terms, wired it into local preflight and CI, and cleaned existing public test labels.
Crosswired the Studio Web Vite remote to the generated manifest contract by building under /studios/scpn-control/, exposing ./Panel, and testing the shared federation constants.
Added the deployed Studio Web manifest.json sync guard, public artifact, CI check, focused 100% coverage, and documentation for keeping it aligned with the generated schema-A Studio manifest.
Added the SCPN Studio deploy public key artifact with a CI/preflight guard that validates the ed25519 public key and rejects private key-like tracked paths.
Wired Studio Web to the portal-owned identity path by loading GET /api/v1/auth/me with same-origin cookies and rendering only the portal session state in the federated panel.
Added a Studio offline-sealing guard that keeps publication signing keys out of tracked CI and deploy policy surfaces while preserving deploy-only credential lanes.
Wired the zero-debt public API docstring quality gate into local preflight and make lint, matching the existing CI documentation coverage lane.
Added architecture decision records for module and repository boundaries, Python/Rust/PyO3 dispatch, solver and algorithm selection, validation evidence strategy, and public versus internal API boundaries.
Breaking: FormalPetriNetVerifier and the scpn.formal_safety_certificate validators no longer accept backend="z3". The explicit-state reachability engine performs exact enumeration, not SMT, so it now raises ValueError on backend="z3" and never stamps an unearned z3 backend label; use Z3BoundedModelChecker in scpn_control.scpn.z3_model_checking for z3-backed evidence. The auto and explicit-state backends are unchanged.

Fixed

Un-rigged the SCPN/PID/MPC benchmark: removed the MPC's future-disturbance foresight so the comparison uses an honest offset-free persistence disturbance model, and removed the pass-by-construction gate. The published RMSE figures now reflect the fair model (PID 0.121, MPC 0.047, SCPN 0.050; SCPN/MPC RMSE ratio 1.07 — SCPN no longer "beats" a fairly-modelled MPC).
Failed closed across the shipped control path where a bare np.clip, a magnitude floor, or a skip-if-present loop previously let non-finite or sign-inverting inputs through silently (np.clip does not sanitise NaN):
- the actuator action decoder rejects a non-finite marking place, gain, limit, slew rate, or previous command before computing an actuator command;
- the actuator decoder rejects a negative abs_max or slew rate, which would otherwise invert the saturation/rate clamp;
- the feature-error kernel rejects a negative axis scale, which would otherwise invert the control-error sign;
- the controller marking setter rejects a non-finite marking assignment;
- the live controller's passthrough observation injection rejects a non-finite sensor value, matching its own public extract_features contract (it was previously clipped silently);
- the physics safety-invariant monitor treats a missing safety channel as a critical violation instead of silently skipping it;
- the G-EQDSK parser rejects any non-finite value in the data region or its arrays at parse time.

[0.22.1] - 2026-07-03

Fixed

Replaced NumPy scalar-percentile calls in the disruption mitigation replay path with deterministic linear interpolation, preventing local NumPy reload failures in SPI diagnostics and halo/runaway post-disruption summaries.
Hardened RZIPController so SciPy/NumPy Riccati validation failures fall back to a bounded NumPy discrete-Riccati gain before the zero-gain fail-closed path, preserving the vertical-feedback contract across validated numerical fallback paths.

Changed

Refreshed generated capability inventory metadata for the NTM coverage and statistics-helper additions, keeping README and generated documentation snapshots aligned with the tracked source and test inventory.
Consolidated the studio-web Dependabot stack on top of the green main branch, including Vite, Module Federation Vite, TypeScript ESLint, ESLint, Prettier, and lockfile transitive updates.

Security

Merged or superseded all open Dependabot pull requests, confirmed open Dependabot, code-scanning, and secret-scanning alerts remained clear, and purged failed or cancelled Actions history only after replacement CI and benchmark evidence was green.

[0.22.0] - 2026-06-26

Added

libFuzzer harness for the Rust parser, numeric-adapter, and FFI surfaces: reactor-configuration JSON, VMEC-like and BOUT++ text parsers, the capacitor-bank discharge ledger, and the Kuramoto phase kernel. Includes a fail-closed campaign orchestrator with provenance and seed-checksum evidence reports, a tracked seed corpus, and a nightly fuzzing workflow separate from per-commit CI.
Polyglot benchmark regression gate: a suite runner that records per-language p50/p95/p99 latency, throughput, and run provenance, and a fail-closed gate that compares a fresh report against a tracked baseline under an explicit threshold policy, rejecting tampered reports or baselines, missing metrics, and cross-CPU comparisons. Runs in evidence-only mode on the nightly workflow.
Runtime-bound formal safety certificate: binds a holding bounded CTL/LTL certificate to a structured controller runtime identity — controller configuration, Petri-net topology digest, SNN parameters, solver mode, runtime target, and a declared timing envelope. Issuance, proof replay, and facility-facing admission all fail closed unless the binding, runtime target, timing envelope, and re-proved obligations match on the declared stack.

Fixed

Bounded the scaling-and-squaring exponent in the Rust matrix exponential so an overflowing matrix norm can no longer stall the capacitor-bank discharge; the routine now fails closed on a non-finite norm and the discharge rejects the input instead of looping.

Changed

Bumped package, citation, Zenodo, API, README, release-note, MkDocs, generated capability, and SCPN Studio manifest metadata to 0.22.0.
Aligned the SCPN Studio manifest's advertised platform SDK range with the package extra and CI-pinned scpn-studio-platform dependency policy.

Security

Bumped GitHub Actions pins, Rust crates, Python dependencies, and studio-web dependencies through the green Dependabot maintenance lane, while preserving release-age safety for newly published package versions.

[0.21.0] - 2026-06-15

Added

Validated the Kuramoto phase-synchronisation runtime against published synchronisation results.
Validated the Grad-Shafranov equilibrium solver against the Solov'ev exact equilibrium.
Validated the structured-singular-value (mu) computation against exact mu identities.
Validated the guiding-centre orbit integrator against conservation laws.
Validated the transport heat-diffusion solver against analytic results.
Validated the neoclassical tearing-mode Modified Rutherford Equation against exact references.
Validated RZIP rigid vertical stability against exact eigenvalues.
Validated resistive-wall-mode feedback against exact closed forms.
Validated the Kadomtsev sawtooth crash against exact conservation laws.
Validated the two-point scrape-off-layer model against exact closed forms.
Validated the auxiliary current-drive model against exact closed forms.
Validated ideal-MHD stability metrics against exact closed forms.
Validated the EPED pedestal model against exact construction relations.
Validated the ELM peeling-ballooning boundary and crash against exact forms.
Validated toroidal momentum transport against exact closed forms.
Validated the runaway-electron avalanche model against exact closed forms.
Validated the Fitzpatrick halo-current L/R circuit against exact closed forms.
Validated the volt-second flux budget against exact closed forms.
Validated density-control particle balance against exact closed forms.
Validated DT burn-control alpha-heating algebra against exact closed forms.

Changed

Raised differentiable-transport facade test coverage to 99.5% with module-specific validation, evidence-guard, and JAX-path tests.
Enforced strict mypy typing for the admission, configuration, current-drive, and real-time EFIT modules.
Hardened the momentum-damping transport contract and capacitor-bank energy admission.
Resealed multi-shot campaign evidence payload digests.
Regenerated the capability manifest for current-drive typed dictionaries and the physics-traceability report.

Fixed

Restored ruff lint and format compliance on the control core.
Scoped per-module mypy strict flags and fixed the admission consumer.

Security

Bumped Rust pyo3 and numpy bindings from 0.25 to 0.29 to clear an advisory.
Bumped Rust sha2 0.10 to 0.11 and socket2 0.5 to 0.6.
Bumped numpy to 2.2.6, osqp to 1.1.2, tornado to 6.5.6, hypothesis to 6.155.2, pip-audit to 2.10.1, and ruff to 0.15.16.

Repository hygiene

Bumped codecov-action from 6 to 7 and stopped failing CI on transient Codecov upload errors.
Expanded user-oriented scope and orientation sections across the guides and normalised trailing newlines.

[0.20.7] - 2026-06-05

Added

Added a Lean-backed pulsed-scheduler liveness proof import path for MIF-compatible cyclic pulsed scenarios.
Added a capacitor-bank compatibility import surface for MIF pulsed-control lanes.

Changed

Hardened geometry-neutral replay v1.1 acceptance coverage with eight v1 back-compatibility fixtures and byte-stable v1.1 serialisation evidence.
Hardened pulsed-shot MPC adapter coverage with a ten-tick scheduler/action integration sequence spanning the full pulsed lifecycle.
Hardened AER control-observation property coverage and optional PyO3 parity.
Bumped package, citation, API, README capability, release-note, MkDocs, and generated capability metadata to 0.20.7.

[0.20.6] - 2026-06-05

Fixed

Restored the remote Ubuntu 3.12 coverage gate with focused module-specific rust_engine and quantum disruption bridge tests covering native handoff, fail-closed runtime behaviour, coefficient loading, contract tamper detection, and advisory evidence validation.
Merged the pending green Dependabot updates for click, z3-solver, hypothesis, GitHub Actions pins, and Rust log after refreshing stale PR branches and confirming fresh checks.
Reconfirmed zero open code-scanning, Dependabot, and secret-scanning alerts after the dependency maintenance lane.
Bumped package, citation, API, README capability, release-note, and public changelog metadata to 0.20.6.

[0.20.5] - 2026-06-05

Fixed

Bumped package, citation, archive, API, README capability, and release-note metadata to 0.20.5.
Added API documentation coverage for the native Rust engine wrapper.
Preserved the AER domain acronym in typo checks so Address-Event Representation surfaces are not rewritten.
Fixed the AER observation NumPy return annotation path for strict mypy pre-commit checks.
Kept internal documentation excluded from the MkDocs/GitHub Pages build and applied tracked validation-report whitespace fixes.

[0.20.4] - 2026-06-05

Added

Hardened AER control-observation admission with monotonic timestamp evidence, strict fail-closed decoding mode, Rust/PyO3 parity, and Python/Rust benchmark coverage.
Added digest-bound AER admission metadata for geometry-neutral replay v1.1 so replay artefacts preserve monotonic AER ingress evidence without changing replay numerics.
Added CONTROL-owned PulsedScenarioScheduler v2 for reusable pulsed-fusion shot lifecycles, with Python and Rust scheduler surfaces, audit-log semantics, guard validation, public API documentation, and direct tests.
Exposed the Rust pulsed-scenario scheduler through the optional PyO3 scpn_control_rs extension with direct parity tests.
Added the CONTROL-owned capacitor-bank series-RLC state model with Python, Rust, and optional PyO3 surfaces, scheduler telemetry adaptation, dedicated tests, public API documentation, and benchmark evidence.
Added total RLC energy-balance reporting to capacitor-bank discharge reports, including capacitor/inductor remaining energy, ohmic loss, prescribed-load extraction, residual admission, PyO3 fields, dedicated tests, public guide documentation, and Python/Rust benchmark harnesses.
Added the CONTROL-owned AER control-observation adapter with Python spike buffers, rate/temporal/ISI decoders, Rust parity surfaces, optional PyO3 bindings, dedicated tests, and public documentation.
Added geometry-neutral replay schema v1.1 for pulsed-shot metadata admission, with bundled schemas, v1 back-compatibility checks, report load/save helpers, dedicated tests, and public documentation.
Added the CONTROL-owned pulsed-shot MPC admission adapter with Python, Rust, and optional PyO3 surfaces, fail-closed scheduler-state admission, capacitor feasibility gating, module-specific tests, public documentation, and local regression benchmark tooling.
Added digest-bound pulsed-MPC admission decision evidence across Python, Rust, PyO3, and benchmark reports.
Added PyO3-inclusive pulsed-MPC local regression evidence and documented the editable bridge rebuild protocol for local native-extension development.
Added the CONTROL-owned multi-shot campaign orchestrator with Python, Rust, and optional PyO3 surfaces, deterministic lifecycle admission, replay v1.1 metadata fields, module-specific tests, public documentation, and local regression benchmark tooling.
Added optional pulsed-MPC admission digest propagation through multi-shot campaign reports, replay v1.1 extensions, Rust/PyO3 parity, and Python/Rust benchmark harnesses.
Added release-evidence admission for multi-shot pulsed-MPC campaign reports, requiring Python, PyO3, and Rust digest-chain evidence with benchmark-context metadata before the top-level release gate can pass.
Added release-evidence admission for PREEMPT_RT runtime-admission benchmark reports, requiring fail-closed production-claim boundaries, benchmark context, latency stats, and SHA-256 payload sealing.
Tightened native formal certificate release admission so production-class AOT certificate evidence cannot be accepted unless the evidence explicitly allows production benchmark claims and carries no validator errors.
Added PREEMPT_RT runtime admission for native hardware campaigns, including Python policy evaluation, PyO3 native snapshot evidence, CLI fail-closed --runtime-admission-policy require, public documentation, tests, and local admission benchmark tooling.

Changed

Runtime telemetry now preserves the latest runtime-admission report in extract_slab_telemetry() so emergency dumps retain scheduler, affinity, governor, heartbeat, and PREEMPT_RT assumptions.
Lean proof-report admission now rejects non-Lean solver declarations, solver strings that do not include the declared Lean version, and proved-contract overclaims outside the admitted PID/SNN proof surface.
Lean proof-report admission now also rejects unrelated theorem namespaces, module paths, and safety-case IDs so valid PID/SNN evidence cannot be padded with stale or unrelated proof links.
Lean proof evidence in .scpnctl artifact manifests now applies the same solver/version, proved-contract, namespace, module-path, and safety-case-ID admission policy before safety-critical artifact loading can pass.
Lean report payloads and artifact formal-verification manifests now reject unknown proof fields so stale or foreign evidence cannot be silently ignored.
Lean report admission now requires the canonical payload_sha256 self-digest instead of accepting otherwise valid digestless reports.
Lean report loading now rejects duplicate JSON keys at the public API boundary, matching the release validation executable.
Safety-critical artifact admission now uses the same duplicate-key-safe Lean report loader for report-root manifest checks.
Z3 formal report loading now rejects duplicate JSON keys and artifact report-root admission uses the same loader.
Z3 formal report admission now rejects unknown top-level and proof-section fields even when the payload digest is recomputed.
Z3 formal report admission now schema-checks serialized counterexample records before accepting bounded proof evidence.
Z3 formal report admission now rejects inconsistent section solver statuses, including sat sections that claim to hold and unsat sections carrying counterexamples.
Blocked Z3 formal reports now fail closed unless they carry the unavailable solver label, zero proof depth, and only the z3_solver_available checked spec.
Z3 proof-section checked_specs now reject duplicate or malformed entries instead of relying only on top-level report de-duplication.
Z3 proof sections with solver_status="unknown" now reject counterexamples because unknown solver states are not discovered violation paths.
Z3 pass/fail reports now reject the unavailable-solver label so missing z3-solver remains blocked evidence rather than proof evidence.
Z3 pass/fail reports now require solver metadata to identify z3-solver, preventing foreign SMT labels from being admitted as Z3 proof evidence.

Changed

Bumped package, citation, API, README capability, and release-note metadata to 0.20.4.
Added v0.20.4 release notes and exposed them in the MkDocs navigation.
Updated documentation, benchmark, validation, deployment, onboarding, notebook, and pricing surfaces for the native runtime evidence lane and local-regression benchmark boundary.

[0.20.3] - 2026-06-02

Changed

Bumped package, citation, archive, API, README capability, and release-note metadata to 0.20.3.
Added v0.20.3 release notes so the public release tag includes the Lean formal-evidence security remediation.

Security

Replaced regex-based Lean theorem, module, and safety-case identifier admission with linear-time validators to remove the CodeQL ReDoS finding while preserving the formal-evidence identifier contract.

[0.20.2] - 2026-06-02

Changed

Bumped package, citation, archive, API, README capability, and release-note metadata to 0.20.2.
Reworked the README into clearer product, reading-path, feature, evidence, and limitation sections while preserving existing project content.
Added v0.20.2 release notes and exposed them in the MkDocs navigation.
Tightened public wording for gyrokinetic, real-time latency, disruption, validation-summary, and coverage claims so external-code, measured-shot, target-hardware, peer-reviewed, and plant-deployment claims remain blocked until strict evidence admission exists.
Documented the benchmark-regression and native C++ build-hardening changes as release-readiness improvements.

[0.20.1] - 2026-06-02

Changed

Bumped package, citation, and archive metadata to 0.20.1 for the documentation and evidence-polish release candidate.
Expanded the README, documentation landing page, onboarding guide, tutorials, notebook gallery, use-case page, production-readiness boundary, and compute-validation financing page so new users can understand the software purpose, applications, market value, collaboration needs, and strict evidence boundaries.
Added v0.20.1 release notes and exposed additional public documentation pages in the MkDocs navigation.
Preserved the release boundary: predictive EFIT/P-EFIT, external-code GK, target-hardware real-time, and plant-deployment claims remain blocked until strict admission artefacts exist.

[0.20.0] - 2026-06-01

Changed

Bumped the package and citation metadata to 0.20.0 for the release-preparation candidate.
Reworked the README, documentation landing page, onboarding guide, use-case page, tutorial index, notebook gallery, API version snippet, MkDocs navigation, and release notes so new users can understand the controller-facing evidence layer, application value, collaboration needs, and strict production-readiness boundary.
Regenerated the capability manifest and README capability snapshot from the current tree.
Added a repository-published MAST EFM neural-equilibrium campaign report that aggregates the six-shot public EFM evaluation, records storage-relative artefact references and digests, and keeps predictive EFIT/P-EFIT admission blocked pending full-output evidence.
Added a storage-hosted MAST EFM neural-equilibrium supervised dataset builder and repository-published dataset evidence report with deterministic shot-held-out train, validation, and test splits, padded LCFS geometry metadata, SHA-256 traceability, and an explicit block on predictive EFIT/P-EFIT admission pending full-output model validation.
Added a neural-equilibrium training-campaign planner that verifies prepared MAST EFM storage-host payloads, tracks deferred QLKNN/QuaLiKiz and external EFIT/P-EFIT dataset lanes, publishes run-order evidence, and records GPU-hour planning budgets without launching long training jobs.
Added a dry-run-first MAST EFM neural-equilibrium trainer that validates the prepared dataset/report contract by default, emits a launch report, and requires explicit --execute before writing deterministic full-output baseline weights or holdout metrics.
Added a MAST EFM feature-provenance audit and storage host dry-run launch evidence showing the prepared storage-host dataset validates on the storage host while Ip_MA, Bt_T, and ffprime_scale remain blocked because the converted public EFM bundles do not contain direct source keys.
Added an original public MAST Level 1 EFM Zarr source audit that admits plasma_current_x for Ip_MA and bphi_rmag for Bt_T, while keeping dataset rebuild blocked until the ffprime profile-to-scalar policy for ffprime_scale is declared.
Declared and implemented the public ffprime RMS-to-campaign-median policy, regenerated the MAST EFM converted references and supervised dataset on storage-host dataset storage, and updated the dataset, provenance, original-source, and dry-run launch reports so the former fallback feature list is empty.
Clarified neural-equilibrium campaign execution policy: the storage host is storage-only, while any --execute training must run on an admitted compute host or external cloud compute with storage-mounted or copied data.
Added a fail-closed MAST EFM compute-execution package: --execute now requires explicit compute-host or external-cloud admission, matching dataset SHA-256, passing feature/source provenance reports, non-storage-host weight output, and repository-published result templates for holdout, latency, GPU-cost, and admission-certificate evidence.
Hardened the MAST EFM neural-equilibrium launch and result-template evidence path with explicit report validators, canonical payload digests, storage-host storage-only output checks, and tamper-detection tests before any future admitted compute run can be cited.
Hardened JAX gyrokinetic parity evidence with aggregate case/backend coverage digests, portable report paths, a separate local CPU timing benchmark report, and refreshed CPU parity artifacts while preserving the backend-parity-only claim boundary.

[0.19.3] - 2026-06-01

Fixed

Added validation/convert_mast_efm_neural_equilibrium_reference.py to convert public MAST Level 1 EFM measured-shot Zarr campaigns into checksum-bound neural-equilibrium reference-candidate arrays while keeping predictive EFIT/P-EFIT claims blocked until exact-model predictions, pressure reconstruction, declared metrics, and strict admission artefacts exist.
Added validation/evaluate_mast_efm_neural_equilibrium.py to run current neural-equilibrium weights against the converted public MAST EFM reference-candidate arrays, persist prediction artefacts on storage-host dataset storage, persist exact public EFM profile_r/profile_z coordinate grids, report flux RMSE plus derived magnetic-axis and LCFS residual evidence for 527 slices, and keep predictive EFIT/P-EFIT admission blocked until full pressure, q-profile, and exact-input evidence exists.
Hardened neural equilibrium reference admission so validation/validate_neural_equilibrium_reference.py now emits schema-versioned, digest-bound reports with portable paths, explicit predictive-claim state, artefact-file SHA-256 digests, duplicate model/weight/reference-set rejection, fail-closed strict-mode report persistence, and an explicit block on predictive EFIT/P-EFIT claims until real P-EFIT or documented public-reference artefacts are supplied.
Hardened external GK interface artefact admission so validation/validate_gk_interface_artifacts.py now emits schema-versioned, digest-bound reports with portable paths, explicit public-claim state, artefact-file SHA-256 digests, duplicate interface-code/run-id rejection, fail-closed strict-mode report persistence, and an explicit block on external-interface and full GK cross-code claims until real executable or documented public-reference artefacts are supplied.
Hardened GK OOD calibration admission so validation/validate_gk_ood_calibration.py now emits schema-versioned, digest-bound reports with portable paths, explicit feature-schema and public claim state, raw and canonical calibration-artefact SHA-256 digests, Mahalanobis-metric provenance checks, duplicate-campaign rejection, fail-closed strict-mode report persistence, and an explicit block on deployment-calibration claims until real published, external-code, or facility GK campaign evidence is supplied.
Hardened GK geometry reference admission so validation/validate_gk_geometry_reference.py now emits schema-versioned, digest-bound evidence with immutable reference-file SHA-256, per-case digests, explicit SI units, bounded local Miller-geometry admission status, duplicate-case rejection, direct source-checkout execution support, and an explicit block on full equilibrium-reconstruction claims pending independent Miller-geometry implementation or external equilibrium-code evidence.
Hardened GK species reference admission so validation/validate_gk_species_reference.py now emits schema-versioned, digest-bound evidence with immutable reference-file SHA-256, per-case digests, explicit SI units, bounded-operator admission status, duplicate-case rejection, direct source-checkout execution support, and an explicit block on full collision-operator claims pending field-particle and external Fokker-Planck evidence.
Hardened nonlinear Cyclone Base Case evidence so validation/gk_nonlinear_cyclone.py writes schema-versioned JSON/Markdown reports with canonical payload SHA-256, separates diagnostic checks from saturated chi_i admission, emits boolean-safe persisted evidence, supports direct source-checkout execution, and keeps the current 200-step V4 run blocked for saturated nonlinear CBC claims.
Hardened the TORAX code-to-code benchmark evidence boundary with a schema-versioned JSON/Markdown report, canonical scenario and payload SHA-256 digests, direct source-checkout execution support, explicit admitted/blocked/not-requested external-reference states, finite-metric admission checks, and a --require-external gate that fails closed unless a real TORAX comparison is present.
Added a fail-closed differentiable-transport full-fidelity readiness gate that binds campaign metadata, one-step and rollout latency reports, gradient audit digests, controller formal-proof digests, equilibrium-coupled metadata, and admitted external reference evidence before any full-fidelity claim can pass, and extended the benchmark/validator evidence path to publish and structurally admit the corresponding blocked readiness artefact.
Added a GitHub Pages compute-validation financing page that explains GPU-hour, storage, public-data, and external-code validation needs while preserving the repository claim boundary.
Added public QLKNN and QuaLiKiz Zenodo acquisition metadata, strict public-data acquisition manifest validation, module-specific regression tests, and documentation that separates acquired normalised metadata from deferred multi-GB tensor payloads and neural-transport validation evidence.
Added strict NTM island-dynamics reference-artifact admission so full-fidelity q-profile, rational-surface, island-growth, saturated-width, suppression-time, seed-island, and ECCD-alignment claims require schema-versioned scpn-control.ntm-reference.v1 evidence with measured NTM campaign or documented public-reference provenance, safe q-profile, rational-surface, island-width-trace, and ECCD-alignment artifact URIs, SHA-256 digests for every artifact and the canonical payload, NTM unit contracts, ordered rho grids, positive q-profile domains, rational-surface tokamak-ordering metadata, positive seed-island domains, tolerance-checked physical metrics, and module-specific tamper/domain tests.
Added strict MARFE radiation-condensation reference-artifact admission so full-fidelity onset-temperature, density-limit, Greenwald-fraction, front-temperature, radiative-growth, impurity-fraction, connection-length, and power-balance claims require schema-versioned scpn-control.marfe-reference.v1 evidence with measured MARFE campaign or documented public-reference provenance, safe temperature-profile, density-limit, radiation-curve, and power-balance artifact URIs, SHA-256 digests for every artifact and the canonical payload, MARFE unit contracts, ordered temperature and density scans, bounded impurity-fraction domains, finite tokamak geometry and power-balance metadata, tolerance-checked physical metrics, and module-specific tamper/domain tests.
Added strict EPED pedestal reference-artifact admission so full-fidelity pedestal height, pedestal width, peeling-ballooning pressure-limit, bootstrap-current, collisionality-width-ordering, and shaping-input claims require schema-versioned scpn-control.eped-reference.v1 evidence with measured pedestal-database or documented public-reference provenance, safe pedestal-profile, EPED-prediction, bootstrap-current, and peeling-ballooning artifact URIs, SHA-256 digests for every artifact and the canonical payload, EPED unit contracts, ordered rho grids, positive width/beta domains, finite tokamak shaping metadata, tolerance-checked physical metrics, and module-specific tamper/domain tests.
Added strict ELM crash and RMP suppression reference-artifact admission so full-fidelity ELM frequency, crash-depth, pedestal-drop, RMP-window, and heat-flux claims require schema-versioned scpn-control.elm-reference.v1 evidence with measured H-mode campaign or documented public-reference provenance, safe pre-crash/post-crash/event/RMP artifact URIs, SHA-256 digests for every artifact and the canonical payload, ELM/RMP unit contracts, ordered pedestal grids, Type-I energy-fraction bounds, tolerance-checked physical metrics, and module-specific tamper/domain tests.
Added strict SOL blob-transport reference-artifact admission so full-fidelity blob velocity, spreading, wall-flux, and detector-event claims require schema-versioned scpn-control.blob-transport-reference.v1 evidence with measured probe-campaign or documented public-reference provenance, safe reference/profile/detector artifact URIs, SHA-256 digests for every artifact and the canonical payload, SOL unit contracts, strictly ordered separatrix-to-wall coordinates, positive detector and blob-size domains, positive magnetic-geometry metadata, tolerance-checked physical metrics, and module-specific tamper/domain tests.
Hardened neural equilibrium reference-artifact admission so predictive EFIT/P-EFIT or documented-reference equilibrium claims must use schema-versioned scpn-control.neural-equilibrium-reference.v1 evidence with safe reference/prediction artifact URIs, trained-weight, reference-artifact, prediction-artifact, and canonical payload SHA-256 digests, explicit target schema, grid/unit contracts, finite tolerance-checked psi/pressure/q-profile/boundary/axis metrics, admitted real P-EFIT executable provenance, and tamper-detection tests.
Hardened neural transport reference-artifact admission so quantitative QuaLiKiz, QLKNN, or documented-reference transport claims must use schema-versioned scpn-control.neural-transport-reference.v1 evidence with safe reference/prediction artifact URIs, trained-weight, reference-artifact, prediction-artifact, and canonical payload SHA-256 digests, explicit target schema, QLKNN-10D feature order, unit contracts, finite tolerance-checked metrics, admitted real QuaLiKiz executable provenance, and tamper-detection tests.
Hardened persisted external gyrokinetic interface artifact admission so real executable and documented public-reference parser evidence must use schema-versioned scpn-control.gk-interface-artifact.v1 reports with safe deck/raw-output/parsed-output artifact URIs, SHA-256 digests for each artifact, a canonical payload digest, explicit transport/frequency/wavenumber unit declarations, finite physical fields, admitted executable provenance, and tamper-detection tests.
Hardened the real external-code linear gyrokinetic cross-code admission gate so full-fidelity GK agreement evidence must use schema-versioned scpn-control.gk-crosscode.v1 reports with SHA-256 digests for the external input deck, external output, native input, and canonical payload, finite growth-rate/frequency/wavenumber fields, admitted executable provenance, and bounded native-vs-external tolerances.
Added strict admission for persisted differentiable transport one-step and rollout gradient-latency reports, including duplicate-key rejection, backend, dtype, claim-boundary, audit-error, sampled-index, run-count, and latency percentile checks before the reports can support release evidence.
Hardened local preflight release-evidence admission so the non-test release-evidence gate now generates a temporary scpn-control validate --json-out report and admits it through scpn-control validate-release-evidence, matching the CI artifact-admission path.
Exposed release-evidence report admission as scpn-control validate-release-evidence REPORT, so operators can validate CI or release JSON reports through the public CLI instead of importing the Python validation module directly.
Added strict release-evidence report admission for the CI artifact produced by scpn-control validate --json-out, including duplicate-key rejection, mandatory pass status for data manifests, JAX GK parity, and physics traceability, complete CPU/GPU parity case coverage, and an admission JSON artifact with the source report SHA-256 digest.
Added a CI release-evidence-gate job that runs top-level scpn-control validate --json-out and uploads the JSON report, so remote runs now publish auditable data-manifest, JAX GK parity, and physics traceability admission evidence.
Added the top-level scpn-control validate --json-out path to local preflight as a non-test release-evidence gate, with source-tree import precedence, so make preflight and make preflight-fast now catch data provenance, JAX GK parity, and physics traceability drift before push.
Promoted physics traceability validation into the top-level scpn-control validate command with staged-registry and scoped-skip controls so local release validation now fails on bounded-claim registry drift in the same path as data provenance and JAX GK parity evidence.
Promoted strict persisted JAX gyrokinetic CPU/GPU parity evidence admission into the top-level scpn-control validate command, added scoped staging and skip flags, and exposed case/backend requirements on validate-jax-gk-parity so local release validation matches the CI gate.
Wired strict persisted JAX gyrokinetic CPU/GPU parity evidence admission into the jax-parity CI job and added a module-specific repository-evidence regression so missing CBC, kinetic-electron TEM, or stable-mode backend pairs cannot silently drift out of release evidence.
Persisted the current JAX gyrokinetic CPU parity campaign alongside the existing GPU campaign, regenerated the strict parity summary, and updated the traceability and validation docs so backend parity is admitted for CPU/GPU reproducibility without promoting quantitative external-code GK claims.
Replaced WebSocket runtime-configuration raw SHA-256 digests with a domain-separated HMAC-SHA256 evidence digest so deterministic admission remains stable while code scanning no longer treats the configuration proof as weak sensitive-data hashing.
Hardened mu-synthesis claim evidence persistence so bounded static robust-control reports now carry canonical payload SHA-256 digests and load admission rejects duplicate keys, schema drift, edited metrics, and bounded evidence presented as validated robust-control evidence.
Added schema-versioned geometry-neutral replay evidence admission so stellarator replay claims bind the validated report, scenario, trace, metrics, thresholds, magnetic-configuration provenance, actuator calibration, latency model, and fault model by SHA-256 digest while keeping synthetic W7-X-like replay separate from measured or benchmark device claims.
Added schema-versioned Kuramoto phase-runtime evidence admission so deployment-target phase claims bind deterministic input digests, Python reference output digests, optional Rust parity errors, deployment-target oscillator coverage, and timestep-refinement convergence before runtime claims can cite the optional Rust fast path.
Hardened controller safety-case readiness so promotion now also requires a typed websocket_runtime_evidence artifact that resolves under the declared evidence root, matches its SHA-256 bytes, and passes qualified WebSocket runtime admission before deployment readiness can cite authenticated command streams, TLS enforcement, payload caps, token-bucket limiting, broadcast delivery, or backpressure absence.
Added schema-versioned FPGA HDL export evidence admission so generated Verilog/VHDL project claims bind controller artifact SHA-256, generated HDL, weight memory, timing constraints, Makefile, resource estimates, synthesis report digests, safe report URIs, non-negative timing slack, and local-only versus qualified synthesis claim status before safety-case readiness can cite hardware export evidence.
Hardened controller safety-case readiness so promotion now also requires a typed codac_runtime_evidence artifact that resolves under the declared evidence root, matches its SHA-256 bytes, and passes qualified CODAC/EPICS runtime admission before deployment readiness can cite CODAC timing, interlock, export, or backpressure evidence.
Added schema-versioned CODAC/EPICS runtime evidence admission so control boundary claims bind generated EPICS database and OPC-UA nodeset hashes, cycle-deadline percentiles, exercised interlock blocking, backpressure counts, local-only versus qualified claim status, duplicate-key-safe JSON loading, and canonical SHA-256 payload digests before facility runtime claims can cite CODAC evidence.
Hardened controller safety-case readiness so promotion now requires a typed hil_replay_evidence artefact in addition to external physics validation, target-hardware timing, and independent review; the artifact must resolve under the declared evidence root, match its SHA-256 bytes, and pass qualified-target HIL replay admission before deployment readiness can cite it.
Added schema-versioned HIL replay evidence admission for CONTROL-owned runtime deployment claims, including canonical SHA-256 payload digests, replay digests over controller, timing, target-hardware, interlock, and backpressure fields, fail-closed target-hardware promotion checks, duplicate JSON key rejection on load, and module-specific behavioural tests that keep local replay evidence separate from qualified deployment evidence.
Hardened reviewed control-runtime defects by replacing fixed-window WebSocket command limiting with token buckets per connection and peer, adding structured WebSocket security audit logs, arming native-solver cleanup only after a C++ library loads successfully, rejecting degenerate Grad-Shafranov flux normalisation, fixing multigrid restriction on rectangular odd grids, vectorising free-boundary coil Green's flux over the grid, tightening NMPC SPD symmetry admission, and adding optional JAX autodiff plant linearisation.
Added schema-versioned JAX gyrokinetic parity artifact production and stricter admission so native/JAX local-dispersion comparisons bind backend, device, platform, dtype, X64 state, solver kwargs, tolerances, and canonical SHA-256 payload digests while keeping the evidence boundary limited to backend parity until external GK validation artifacts are supplied; admission now requires named CBC, kinetic-electron TEM, and low-drive stable-mode case coverage when requested, binds case-parameter digests, rejects mode-spectrum replay, and supports backend coverage requirements.
Added a quantum-enhanced disruption bridge facade that keeps quantum backend ownership in scpn-quantum-control, lazily imports optional quantum dependencies, maps the CONTROL 8-feature disruption contract to the ITER 11-feature contract with explicit default provenance, emits bounded amplitude-kernel evidence, records admission evidence with feature digests and external-evidence requirements, adds schema-versioned advisory certificates for bridge and kernel reports, publishes a machine-readable dependency contract for the scpn-quantum-control backend, embeds that dependency contract in advisory reports, pins the Qiskit simulator dependency name, records backend-contract attestation when the optional backend exposes its own contract, adds certificate-bound advisory decision evidence with score-basis provenance, deterministic risk-band thresholds, backend-contract validation state, and blocked control action, and fail-closes advisory reports behind tamper-evident claim boundaries.
Aligned the CI and local coverage gate to the current validated 93.74% repository result as explicit temporary debt after the quantum-disruption and physics-debugging surfaces expanded; the policy remains module-specific behavioural tests only, with no synthetic gate-chasing tests.
Added a local-first physics debugging assistant for validation-gap analysis, falsifiable hypothesis generation, and campaign suggestions with endpoint allowlisting, secret redaction, cited-evidence enforcement, advisory safety-policy admission, reviewed-draft digest binding, provider quorum admission, and tamper-evident advisory report digests.
Added hash-addressed formal safety certificate bundle artifact admission so release gates verify safe relative bundle URIs, bundle SHA-256 bytes, tamper-evident artifact metadata digests, UTC creation timestamps, embedded certificate digests, artifact binding, backend, and required certificate policy before replaying certificate evidence.
Added formal safety certificate admission policies so certification campaigns can require minimum proof depth, controller artifact binding, CTL/LTL evidence, and named checked specifications before JSON/Markdown certificate artifacts are emitted or admitted.
Added a one-call formal safety certificate workflow that resolves one Petri-net verifier backend, runs base safety/liveness plus CTL/LTL obligations, binds optional controller artifact bytes by SHA-256, and persists certificate JSON/Markdown evidence.
Hardened formal safety certificate publication with JSON/Markdown writers and semantic section-admission checks that reject internally inconsistent certificate evidence even when the payload digest is recomputed.
Added bounded CTL/LTL formula facades and schema-versioned formal safety certificate payloads for SCPN Petri-net controllers, including tamper-evident payload digests and shared explicit-state/Z3 formula checking.
Hardened stellarator geometry configuration with a Pydantic v2 schema/export path, construction-time physics-bound validation, and immutable validated config objects so ISS04, Boozer-surface, and neoclassical calculations cannot observe post-validation mutation.
Hardened EPED pedestal configuration with a Pydantic v2 schema/export path, construction-time physics-bound validation, and immutable validated config objects so solver calls cannot observe post-validation mutation.
Hardened FusionKernel configuration loading so runtime JSON is retained as a typed Pydantic v2 model with schema-normalised boundary variants while the legacy dict view remains a compatibility export for solver internals.
Hardened controller safety-case readiness artefacts so target-hardware timing evidence must resolve under a supplied artifact root, match the declared SHA-256 bytes, and pass the schema-versioned E2E latency validator before promotion readiness can cite it.
Hardened end-to-end control-latency evidence so benchmark reports now use a schema-versioned canonical payload digest and admission rejects tampering, non-positive run counts, unordered percentiles, mismatched overhead factors, unqualified target-hardware metadata, and altered local-evidence boundaries before runtime-readiness claims can cite latency reports.
Hardened Z3-backed SCPN formal-verification evidence so pass, fail, and blocked reports use a schema-versioned payload, canonical SHA-256 integrity digest, explicit solver metadata, and manifest-matching status, depth, solver, and checked-specification admission before safety-critical controller artifacts can reference SMT proof reports.
Hardened differentiable-transport evidence admission so gradient-audit evidence revalidates finite non-negative losses, tolerance agreement with campaign metadata, unique in-domain sampled audit indices, pass/fail consistency with maximum audit error, strict integer latency run counts, and ordered latency percentiles before controller-tuning evidence is persisted or admitted; the rollout source-gradient loss now remains inside the traced JAX graph and the module enables JAX x64 before importing jax.numpy so dtype evidence is not silently downgraded.
Hardened digital-twin online-update evidence admission so bounded Bayesian update claims revalidate finite non-negative losses, loss-history minima, source binding, unique bounded parameter priors, best-parameter domains, strict integer campaign settings, and simulator units for every observation target before evidence digests are admitted.
Hardened geometry-neutral stellarator replay admission so scenarios fail closed on nonzero initial frames, missing objective metrics, impossible current constraints, unsupported stuck-fault modes, and non-integer runtime report inputs before replay evidence or manifest digests are produced.
Added tamper-evident SHA-256 payload digests to persisted RZIP calibration evidence and benchmark reports so admission rejects modified evidence payloads before facility-claim promotion.
Hardened RZIP facility-claim admission so calibration evidence is revalidated against source class, reference growth-rate presence, finite physical fields, and declared growth-rate tolerance at admission time.
Hardened the JAX traceable runtime public boundary so single-loop rollouts reject batched command arrays, reject vector initial states deterministically, and validate parity integer seeds before reproducibility campaigns are built.
Added tamper-evident geometry-neutral stellarator replay manifests that bind scenario, trace, metric, and threshold payloads with SHA-256 digests and fail closed on manifest, trace, or acceptance tampering.
Renamed the IMAS ODS adapter contract test file to avoid the retired generic test filename pattern while preserving the same module-specific behaviour.
Added a fail-closed formal proof-manifest gate for safety-critical SCPN controller artifacts, including bounded-claim enforcement, hash-addressed report metadata, and mandatory counterexample paths for failed proof evidence.
Hardened safety-critical proof-manifest admission by binding evidence to the canonical controller-artifact payload SHA-256, rejecting unsafe report URIs, constraining formal backends, and optionally verifying report bytes under a caller-supplied report root.
Added tamper-evident differentiable transport admission evidence that binds JAX campaign metadata, sampled gradient-audit results, equilibrium coupling, and optional safety-critical controller proof artifact digests before controller-tuning claims can be promoted.
Added tamper-evident digital-twin online-update evidence that binds TRANSP and TSC simulator metadata, observation and prior digests, Bayesian-update result digests, baseline-improvement status, and optional safety-critical controller proof artifact digests.
Added a bounded controller safety-case evidence workflow that links a passing formal controller proof manifest, audited differentiable-transport evidence, and TRANSP/TSC-backed digital-twin update evidence to the same canonical controller artifact digest.
Added schema-versioned controller safety-case manifest persistence with an integrity digest so archived evidence bundles fail closed on malformed schema or payload tampering before replay admission.
Added an explicit controller safety-case readiness gate that remains blocked until external physics validation, target-hardware timing evidence, and independent safety-review digests are all present and bound to the current safety-case bundle.
Added schema-versioned controller safety-case readiness manifest persistence with an integrity digest so promotion decisions fail closed on malformed schema or payload tampering before replay.
Added typed controller safety-case readiness artefacts so promotion evidence requires kind-specific external validation, target-hardware timing, and independent-review artifacts with safe relative URIs, producers, timestamps, and SHA-256 digests.
Hardened the phase WebSocket stream with explicit payload-size limits, server-side frame caps, default client authentication, TLS-required startup mode, disabled-by-default query-token authentication, fail-closed plaintext non-loopback binding, browser-origin allowlisting, command allowlisting, and CLI/documentation coverage for authenticated remote exposure.
Added a Pydantic v2 schema/export path to TokamakConfig, extended E2E latency evidence with target-hardware metadata, and exposed NMPC optional casadi/fail-closed acados solver backend contracts.
Implemented the optional NMPC acados OCP interface with injected runtime factories, symbolic discrete dynamics support, augmented-state slew-rate path constraints, SQP/partial-condensing HPIPM defaults, exact-Hessian mode, warm-start staging, and fail-closed solver-status handling.
Hardened NMPC acados result admission with finite state/control trajectory checks, state and terminal-set enforcement, slew-rate revalidation, and a runtime plant-consistency residual gate for symbolic-dynamics drift.
Added a strict E2E latency-evidence validator so unqualified local benchmark runs cannot be admitted as target-hardware or real-time performance evidence.
Double-gated controller bit-flip fault injection behind both constructor and environment opt-ins, and hardened controller JSONL append handling against symlink-target writes where platform support is available.
Hardened real-data manifest artefact verification so checksum-covered local evidence must use relative, non-traversing paths resolved under the manifest evidence tree or repository root.
Added shared external-reference URI admission for density, RZIP, orbit, and VMEC validation gates so external artifact claims reject ambiguous relative paths, arbitrary local file URIs, hosted file URIs, and traversal paths.
Hardened external executable provenance admission for GK cross-code, GK interface, and neural transport reference validators so real external-code claims reject URI, relative, traversal, temporary, and system-control binary_path values.
Added a public production-readiness boundary that separates production-oriented library engineering from facility deployment, external validation, measured-shot validation, and certification claims.
Hardened fail-closed physics and mathematics boundaries across MHD, pedestal, edge, transport, orbit-following, scenario, and uncertainty surfaces without promoting unsupported facility or full-fidelity claims.
Added release-blocking boundary coverage for edge cases, invalid inputs, monotonicity contracts, conservation boundaries, and finite-output contracts in module-specific test files.
Persisted differentiable transport campaign metadata and added a replay guard that rejects backend, grid, boundary, closure, tolerance, and equilibrium drift before controller-tuning reruns.
Added differentiable transport source-schedule gradients so controller tuning can optimise additive heating, fuelling, and impurity-source inputs through the same JAX Crank-Nicolson facade as transport coefficients.
Added bounded multi-step differentiable transport rollout gradients so controller tuning can optimise time-distributed source schedules without finite-difference plant evaluations.
Wired NMPC source-rollout tuning to the multi-step differentiable transport gradient path with explicit source bounds and sampled finite-difference audit admission.
Added audited multi-step differentiable transport rollout-gradient latency reporting for bounded NMPC source-rollout admission evidence.
Added Grad-Shafranov flux-weighted multi-step transport rollout loss and source/equilibrium gradients for bounded controller-tuning studies.
Added a bounded reduced-gyrokinetic transport closure adapter for mapping existing quasilinear GK profile outputs into differentiable transport coefficient channels with explicit provenance.
Added explicit gyrokinetic species diamagnetic-frequency bookkeeping with charge-direction, density-gradient, temperature-gradient, and zero-drive regression coverage.
Added the Miller geometry contravariant metric-determinant identity to the public geometry result and regression coverage.
Added an explicit reduced-gyrokinetic saturation-rate utility with monotone, non-negative, and field-line-rate-bounded regression coverage.
Added a differentiable transport gradient audit that compares JAX transport coefficient and source-schedule gradients against sampled finite-difference perturbations before controller-tuning admission.
Added differentiable transport gradient-latency reporting for the audited controller-tuning admission path with persisted bounded benchmark artefacts.
Wired the NMPC transport-tuning path to require that gradient audit by default and to persist the audit result with each coefficient update.
Added audited NMPC source-schedule tuning for additive heating, fuelling, and impurity-source controls with explicit finite source bounds.
Added RZIP vertical-stability calibration evidence and fail-closed facility-claim admission with bounded local benchmark artefacts.
Added resistive-wall-mode feedback claim evidence and fail-closed facility-claim admission with bounded wall, rotation, coil, and latency provenance reports.
Added EFIT-lite reconstruction claim evidence and fail-closed facility-claim admission with bounded diagnostic and shape provenance reports.
Added kinetic-EFIT pressure and q-profile claim evidence with fail-closed facility-claim admission for matched pressure, q-profile, anisotropy, diagnostic, profile, fast-ion, MSE-calibration, and interpolation provenance.
Added VMEC-lite spectral facade claim evidence with fail-closed full-VMEC admission for matched Fourier geometry, rotational transform, residual, and convergence provenance.
Added orbit-following claim evidence with fail-closed external-code admission for matched banana-width, first-orbit-loss, particle, geometry, collision-model, and loss-boundary provenance.
Added uncertainty-quantification claim evidence with fail-closed calibrated predictive-UQ admission for matched central values, sigma statistics, seed, prior, scenario, propagation-chain, and sensitivity provenance.
Added density-control claim evidence with fail-closed facility-calibrated admission for matched Greenwald fraction, particle inventory, geometry, transport, actuator, diagnostic, and CFL provenance.
Added neural-equilibrium claim evidence with fail-closed predictive-claim admission for matched P-EFIT or documented public reference artefacts, weight checksums, flux, pressure, q-profile, boundary, and axis tolerances.
Added neural-transport claim evidence with fail-closed quantitative admission for matched QuaLiKiz or documented public reference artefacts, weight checksums, QLKNN-10D feature ordering, diffusivity errors, and branch accuracy.
Added neural-turbulence claim evidence with fail-closed quantitative admission for matched gyrokinetic campaign or documented public reference artefacts, weight checksums, QLKNN-class feature ordering, gyro-Bohm flux errors, and critical-gradient accuracy.
Added disruption-mitigation claim evidence with fail-closed mitigation admission for measured, external-benchmark, or documented public reference artefacts covering warning lead time, mitigation outcome, halo-current envelope, runaway-beam envelope, and tritium-breeding-ratio metrics.
Added free-boundary tracking claim evidence with fail-closed facility-control admission for matched public, measured-replay, or external equilibrium artefacts covering shape, X-point, divertor, coil-current, response-rank, latency, and supervisor provenance.
Added DT burn-control claim evidence with fail-closed reactor-control admission for matched public, integrated-transport benchmark, or measured burn replay artefacts covering alpha power, Q, Lawson margin, burn fraction, reactivity exponent, and controller-limit provenance.
Added volt-second claim evidence with fail-closed pulse-duration admission for matched public, measured loop-voltage replay, or external scenario artefacts covering total flux, flat-top duration, Ejima flux, bootstrap current, and budget-margin provenance.
Added current-drive claim evidence with fail-closed external deposition admission for matched public, ray-tracing, Fokker-Planck, or measured deposition artefacts covering absorbed power, driven current, deposition centroid, peak current density, and NBI slowing-down provenance.
Added mu-synthesis claim evidence with fail-closed validated robust-control admission for matched public, external mu-toolbox, or measured replay artefacts covering mu upper bounds, robustness margin, controller gain, D-scaling, and closed-loop spectral-abscissa provenance.
Hardened SCPN formal verification with algebraic place-invariant proofs and bounded temporal response and recurrence specifications over all bounded firing paths.
Added optional Z3 bounded model checking for compiled SCPN control logic, including SMT-backed marking-bound counterexamples, temporal exclusivity and response specs, and JSON/Markdown evidence publication with explicit blocked status when z3-solver is unavailable.
Hardened federated disruption prediction with per-facility array ingestion, facility-update differential privacy accounting, serialisable privacy ledgers, and a deterministic synthetic multi-facility benchmark report. This remains bounded synthetic evidence, not measured cross-facility validation.
Added neural equilibrium synthetic pretraining with deterministic JAX-compatible weights, benchmark reports, and a fail-closed real EFIT/P-EFIT fine-tuning admission gate backed by persisted reference artefacts.
Added digital-twin online model updating with fail-closed TRANSP/TSC simulator artifact metadata validation, deterministic Bayesian optimisation over bounded density, effective-charge, and actuator parameters, and a synthetic online-update benchmark report.
Hardened the gyrokinetic online learner with OOD-threshold sample admission, auditable retraining decisions, persisted update reports, and a deterministic synthetic online-retraining benchmark.
Added integrated-scenario coupling audits with deterministic replay metadata, module-by-module exchange records, timestep consistency checks, and bounded current and thermal-energy diagnostics while preserving the external validation claim boundary.
Preserved JAX gyrokinetic stiffness-closure monotonicity under the CI JAX backend while keeping the closure explicitly bounded as a controller-tuning surrogate.
Applied the formatter changes required by the remote pre-commit workflow so release-candidate CI starts from the same formatting state as local checks.

Changed

Package version bumped to 0.19.3.
Documented the hardening release-candidate scope, residual validation gaps, and tag gate before creating a release tag.
Retained the physics traceability boundary: public full-fidelity claims remain blocked until the required external artefacts are supplied and validated.
Hardened traceability summary checks so generated report, roadmap, and release documentation derive open-gap counts from the live registry instead of stale fixed numbers.
GitHub Actions for the current main head are green after the documentation, traceability, formatter, and JAX stiffness fixes.

Validation

pre-commit run --all-files
python tools/check_test_quality_policy.py
python validation/validate_physics_traceability.py --registry validation/physics_traceability.json --json-out
python validation/benchmark_federated_disruption.py
python validation/benchmark_neural_equilibrium_pretraining.py
python validation/benchmark_differentiable_transport_latency.py
python validation/benchmark_rzip_calibration.py
python validation/benchmark_rwm_claims.py
python validation/benchmark_efit_lite_claims.py
python validation/benchmark_kinetic_efit_claims.py
python validation/benchmark_vmec_lite_claims.py
python validation/benchmark_orbit_following_claims.py
python validation/benchmark_uq_claims.py
python validation/benchmark_density_control_claims.py
python validation/benchmark_neural_transport_claims.py
python validation/benchmark_neural_turbulence_claims.py
python validation/benchmark_disruption_mitigation_claims.py
python validation/benchmark_digital_twin_online_update.py
python validation/benchmark_gk_online_learner.py
python validation/benchmark_integrated_scenario_coupling.py
python tools/capability_manifest.py --check
python -m tools.check_generated_traceability

[0.19.1] — 2026-05-21

Fixed

Hardened fail-closed contracts across external GK solver surfaces: QuaLiKiz, GENE, GS2, and CGYRO now require explicit dual-gate opt-in for degraded fallback behaviour.
Hardened integrated transport GK acceptance criteria: converged results must also be finite and non-negative for chi_i, chi_e, and D_e, otherwise fail closed by default.
Hardened hybrid-GK control-plane contracts: scheduler config/runtime input validation, OOD detector result/ensemble schema checks, online learner sample/weight validation, corrector config/profile validation, and verification-report telemetry guards.

Changed

Package version bumped to 0.19.1.
Regenerated capability manifest and README capability snapshot to match current repository state.

[0.19.0] — 2026-03-18

Fixed — Physics Audit (33 equation corrections)

Integration wiring: sawtooth crash→psi writeback, NTM seeding from crash energy, ELM/stability/L-H modules connected to scenario loop, beta_N and li computed from profiles (were hardcoded placeholders)
GK: Te/Ti ratio in quasilinear (was trivially 1.0), omega_r←gamma_net in TGLF native output, electron drive phi→phi_eff for EM flutter, Ampere skin-depth term, CFL k→k² for Poisson bracket, Sugama conservation via 3×3 Gram matrix
MHD: NTM MRE prefactor (extra r_s removed), polarization (w_pol/w)³, Porcelli Condition 2 units, EPED q95 sqrt→linear, TAE k_∥=1/(2qR₀), locked-mode I_eff from geometry (was 5 orders too small)
Transport: Sauter L31 collisionality denominator, banana boundary ε^(3/2), GS residual → GS* operator, tau_eq from Braginskii, halo f_halo=0.3, orbit drift ÷B³, ISS04 s_ref=(2/3)²
Edge: Connor-Hastie h(Z) E_ratio removed, hot-tail→erfc, SOL sheath BC two-point model, GS source full weight (was 50/50 blend), BH Table VII citation, noqa dead code removed
3,300+ tests (235 files), 100% coverage, 20 CI jobs

[0.18.0] — 2026-03-17

Added

Nonlinear δf gyrokinetic solver (gk_nonlinear.py): 5D Vlasov in flux-tube geometry with dealiased E×B bracket (Orszag 2/3 rule), 4th-order parallel streaming, curvature/grad-B drift, Krook collision operator, RK4 with CFL-adaptive dt, zonal flow diagnostics. JAX-accelerated variant (jax_gk_nonlinear.py) with jax.checkpoint. CBC validation: linear recovery, energy conservation, zonal flows, saturated state.
Native TGLF-like approximation (gk_tglf_native.py): SAT0/SAT1/SAT2 spectral saturation (Staebler 2007/2017), E×B shear quench (Waltz 1997), trapped-particle damping (Connor 1974), multi-scale ITG-ETG cross-scale coupling (Maeyama 2015, α_cs=3.0), quasilinear weights with Γ₀ FLR + particle pinch. Implements GKSolverBase — usable as drop-in for external TGLF.
"tglf_native" transport mode in integrated_transport_solver.py
validation/gk_nonlinear_cyclone.py — CBC benchmark (4 tests, all passing)
Dimits shift proven at n_kx=256: zero transport below critical gradient
Electromagnetic A_∥ via Ampere's law (KBM/MTM capable)
Sugama collision operator: pitch-angle scattering with ν(v) ∝ v⁻³, particle/momentum/energy conservation (<3e-8/<1e-23/<2e-8)
Kinetic electron species: semi-implicit backward-Euler, removes adiabatic approximation. chi_i = 1.3 χ_gB (kinetic) vs 2.0 χ_gB (adiabatic)
Ballooning connection BC: kx shift at θ boundaries via FFT phase multiply
Rosenbluth-Hinton zonal Krook damping: dynamic relaxation on bounce time
53 new tests (27 TGLF native + 26 nonlinear)
Physics deepening sprint — 18 modules, ~50 paper citations, 118 new tests:
- Neoclassical: Pfirsch-Schlüter regime, regime auto-detection, full Sauter L31/L32/L34 bootstrap
- EPED pedestal: collisionality-dependent width (Snyder 2011), shaping factor (Connor 1998)
- Sawtooth: Porcelli 1996 three-condition trigger, Bussac δW_MHD
- RWM feedback: rotation stabilization (Fitzpatrick 2001), wall geometry, critical rotation
- NTM dynamics: diamagnetic shear (Sauter 1997), GGJ Δ' (Glasser 1975), bootstrap from local params
- Alfvén eigenmodes: electron Landau damping (Rosenbluth 1975), Fu-Van Dam resonance, RSAE+BAE
- Integrated scenario: transport solver wired, Strang splitting, bootstrap+ohmic, NTM coupling
- Current drive: Fisch-Boozer ECCD, Stix slowing-down, Prater geometric efficiency
- L-H transition: Martin 2008 scaling, low-density branch (Ryter 2014), Kim-Diamond predator-prey
- Momentum transport: Prandtl number (Peeters 2011), Rice rotation, Burrell ExB shear
- Orbit following: Boozer 2004 equations, Stix slowing-down, Goldston first-orbit loss
- Locked mode: Fitzpatrick 1993 EM torque, La Haye locking condition
- Tearing coupling: Chirikov 1979 overlap, La Haye-Buttery 2009 coupling
- MARFE: Drake 1987 instability, Greenwald 2002, Lipschultz 1987 onset
- Impurity transport: Hirshman-Sigmar 1981 pinch, Post 1977 radiation
- Runaway electrons: Wesson Coulomb log, R&P full avalanche, Martin-Solis synchrotron limit
- Plasma startup: Lieberman-Lichtenberg Townsend, Janev ionization rate
- Current diffusion: temperature-dependent ln_Λ, Jardin 2010 citations
Python 3.14 added to CI matrix and classifiers

Changed

Nengo replaced with pure LIF+NEF engine (numpy 2.x compatible, no external dependency)
All mypy errors fixed across 10 source files
3,300+ tests (235 files), 100% coverage, 20 CI jobs

Fixed

CFL fix for hyperdiffusion stability in nonlinear GK solver
Subprocess PYTHONPATH in test_controller_oracle_serve for Python 3.14
Martin L-H scaling 10x density unit bug (n_e19 → n_e20 conversion)

[0.17.0] — 2026-03-14

Added

Gyrokinetic Three-Path Transport System (16 new modules):
- Path A — External GK coupling (5 codes): gk_interface.py (universal ABC + GKLocalParams/GKOutput), gk_tglf.py (TGLF namelist generation + subprocess), gk_gene.py (GENE parameters + nrg parsing), gk_gs2.py (GS2 namelist + NetCDF/omega parsing), gk_cgyro.py (CGYRO input + freq parsing), gk_qualikiz.py (Python API + subprocess fallback)
- Path B — Native linear GK eigenvalue solver: gk_geometry.py (Miller flux-tube parameterisation, metric coefficients, curvature), gk_species.py (species, Gauss-Legendre velocity grid, Sugama collision operator), gk_eigenvalue.py (response-matrix eigenvalue solver in ballooning space), gk_quasilinear.py (mixing-length saturation, quasilinear chi_i/chi_e/D_e)
- Path C — Hybrid surrogate+GK validation layer: gk_ood_detector.py (Mahalanobis + range + ensemble OOD detection), gk_scheduler.py (periodic/adaptive/critical-region spot-check scheduling), gk_corrector.py (multiplicative/additive/replace correction with EMA smoothing), gk_online_learner.py (buffer-based retraining with validation holdout + rollback), gk_verification_report.py (per-session verification stats, JSON export)
- SCPN phase bridge: phase/gk_upde_bridge.py (GK fluxes → adaptive K_nm for P0↔P1 microturbulence↔zonal, P1↔P4 zonal↔barrier, P3↔P4 sawtooth↔barrier)
- "external_gk" transport mode wired into integrated_transport_solver.py
- Cyclone Base Case validation (Dimits et al. 2000) with reference data
- validation/benchmark_gk_linear.py — CBC, gradient scan, multi-code, SPARC/ITER
- validation/benchmark_hybrid_accuracy.py — end-to-end hybrid accuracy
- examples/tutorial_08_gyrokinetic_solver.py — 5-section GK demo
- 163 new tests across 15 test files

Changed

License: MIT OR Apache-2.0 → GNU AGPL v3 | Commercial licensing available
Removed Michal Reiprich from all authorship records
3,015 tests (220+ files), 100% coverage, 20 CI jobs

[0.16.0] — 2026-03-13

Added

Phase 3 — Frontier physics (10 modules in core/):
- gyrokinetic_transport.py — quasilinear TGLF-10 instability spectrum (ITG/TEM/ETG growth rates and mode identification from local plasma parameters)
- ballooning_solver.py — second-order ODE eigenvalue solver in s-alpha geometry; binary-search marginal-stability finder; full stability diagram computation
- current_diffusion.py — parallel current evolution PDE with neoclassical resistivity (Sauter-Angioni), ohmic heating, and bootstrap source
- current_drive.py — ECCD, NBI, LHCD auxiliary current-drive models with absorption efficiency and radial deposition profiles
- ntm_dynamics.py — modified Rutherford equation for neoclassical tearing modes (2/1, 3/2); ECCD stabilization factor; NTM controller with mode-tracking
- rwm_feedback.py — resistive wall mode n=1 feedback with active coils, Galerkin gain computation, and passive-wall eigenvalue analysis
- sawtooth.py — Porcelli-like trigger (shear at q=1), Kadomtsev reconnection crash model, density/energy conservation, SawtoothCycler with crash history
- sol_model.py — two-point SOL model (upstream-to-target), Eich heat-flux width scaling (Goldston heuristic), sheath-limited and conduction-limited regimes
- rzip_model.py — linearised tokamak vertical stability model (RZIp plant); eigenvalue-based growth rate; passive structure model
- integrated_scenario.py — full integrated scenario simulator coupling transport, current diffusion, current drive, sawteeth, NTM, and SOL models; ships with ITER baseline, ITER hybrid, and NSTX-U preset scenarios
Phase 4 — Absolute control (10 modules in control/):
- nmpc_controller.py — nonlinear MPC with SQP over 20-step horizon; state/input box constraints and slew-rate limits on Ip, beta_N, q95, li, Te, nbar
- mu_synthesis.py — D-K iteration for structured robust control; D-scaling optimization minimising structured singular value mu; MuSynthesisController
- realtime_efit.py — streaming equilibrium reconstruction from partial measurements; coil-current-to-psi mapping; sub-10ms latency target
- gain_scheduled_controller.py — PID gains scheduled on operating regime (Ip, beta_N); automatic interpolation with hysteresis-aware regime detection
- shape_controller.py — plasma shape feedback via divertor/shaping coils; boundary-geometry Jacobian; x-point and separatrix tracking
- safe_rl_controller.py — policy-gradient wrapper with MHD constraint checker; vetoes actions violating stability limits; Gymnasium-compatible
- sliding_mode_vertical.py — sliding-mode controller for vertical stability; continuous control law with dead-band saturation; configurable sliding surface
- scenario_scheduler.py — shot timeline manager for startup→ramp→flattop→ rampdown; actuator scheduling with power budgets; scipy.optimize trajectory
- fault_tolerant_control.py — sensor/actuator fault detection via innovation monitoring; reduced-rank operation under faults; stuck-sensor reconstruction
- control_benchmark_suite.py — standardised benchmark scenarios (step tracking, disturbance rejection, noise resilience) with JSON+Markdown report generation

Fixed

np.trapz → scipy.integrate.trapezoid across all files (numpy 2.x compat)
Ballooning test hardened (alpha 0.9→1.5) for cross-platform robustness
46 mypy errors fixed across 17 files (no-any-return, attr-defined, assignment)
scipy event function pattern refactored to class-based callable

Changed

2,786 tests (178 files), 100% coverage, 26 CI jobs
Version bump: v0.15.0 → v0.16.0

[0.15.0] — 2026-03-11

Fixed

GS* stencil sign bug: east/west coefficients in Jacobi, SOR, multigrid, and JAX solvers had the 1/(2R·dR) sign swapped — implementing the cylindrical Laplacian (∂²ψ/∂R² + (1/R)∂ψ/∂R) instead of the correct GS* operator (∂²ψ/∂R² − (1/R)∂ψ/∂R). Python now matches Rust sor.rs. Verified via Solov'ev exact solution (< 1% error on 33×33 grid).
beta_N formula (TokamakEnv): replaced dimensionally incorrect sqrt(Ip) expression with Troyon scaling β_N = c·T/Ip, calibrated to ITER baseline
gain_margin_db misnomer: renamed to stability_margin_db (eigenvalue-based, not Bode gain margin); backward-compat alias retained
MPC docstring: states clearly this is gradient-based trajectory optimization, not Rawlings-Mayne MPC
Physics citations: Braginskii tau_eq, Martin L-H threshold, Troyon beta_N, Wesson q95 — all hardcoded constants now cite source
H-infinity Y Riccati tolerance: tightened from 1.0 to 0.01
IPB98(y,2) RMSE gate: tightened from 200% to 80%

Added

Solov'ev analytic equilibrium test (GS solver vs exact ψ)
Crank-Nicolson CN-vs-Euler convergence test and pure diffusion decay test
validate-rmse CLI command (full RMSE dashboard)
16 analytic regression tests in test_p0_regression.py

Changed

2,420 tests, 0 failures, 105 skipped
Version bump: v0.14.1 → v0.15.0

[0.14.1] — 2026-03-11

Fixed

Jacobi step: add 1/R toroidal stencil (was Cartesian Laplacian, affecting fallback solver path)
Vacuum field: multiply coil current by turns (was ignoring multi-turn coils)
JAX GS boundary: use ψ_bdry=0.0 Dirichlet BC (was reading corner value)
UPDE Rust fast-path: return "Psi_global" key (was "Psi", breaking downstream code when Rust backend active)
Green's function: divide by k² not k in toroidal formula
Bootstrap current: use minor radius a, not domain extent R_max−R_min
lyapunov_v docstring: range is [0, 2] not [0, 1]
Neural transport docstring: honest about MLP architecture (not full QLKNN-10D)

Added

13 analytic regression tests (test_p0_regression.py): Jacobi toroidal stencil, vacuum field turns scaling, UPDE key parity, GS boundary conditions, 2-oscillator Kuramoto exponential convergence, sub/supercritical phase transition thresholds
tutorial-smoke CI job (tutorials 01, 04, 05)
[all] optional-dependency group in pyproject.toml

Changed

MG parity tolerance widened (Rust multigrid uses Cartesian smoother)
Historical v0.14 snapshot: 2,417 tests, 99.99% coverage, 26 CI jobs

[0.14.0] — 2026-03-10

Added

PPO 500K cloud training on JarvisLabs RTX5000 (3 seeds x 500K timesteps)
PPO reward=121.1 beats MPC (59.4) and PID (-911.2), 0% disruption rate over 50 benchmark episodes
Reproducible benchmark artifact records PPO mean reward 121.1 +/- 31.5 over 50 episodes
Per-seed weights: ppo_tokamak_seed{42,123,456}.zip
Benchmark report: benchmarks/rl_vs_classical.json
Cloud training script: tools/train_rl_upcloud.sh (multi-seed, best-select)
JarvisLabs automation: tools/jarvislabs_train.py

[0.13.0] — 2026-03-10

Added

JAX-differentiable Grad-Shafranov solver (jax_gs_solver.py): full Picard iteration via jax.lax.fori_loop with damped Jacobi inner sweeps
jax.grad through the complete equilibrium solve — closes autodiff depth gap with TORAX (JAX) and FUSE (Julia AD)
jax_gs_solve() public API with NumPy fallback
jax_gs_grad_Ip() convenience function for d(psi)/d(Ip) gradient
20 JAX GS tests: NumPy parity, boundary conditions, symmetry, autodiff (finite, nonzero, sign, beta_mix, finite-difference agreement)
examples/quickstart.py — 30-second Python demo (equilibrium + transport + SNN compile + autodiff)
README "Python in 30 Seconds" quickstart block

Changed

TokamakEnv reward: added survival bonus, progress shaping (Ng et al. 1999), increased disruption penalty — improves PPO learning speed
JOSS paper updated: 57 modules, ~22,900 LOC, 2,201 tests, JAX GS mention
Competitive analysis: equilibrium autodiff depth marked RESOLVED (5/6 gaps closed)

[0.12.0] — 2026-03-10

Added

QLKNN-10D trained neural transport model: 3-layer MLP (10→128→64→3) trained on synthetic critical-gradient data (5000 samples, van de Plassche et al. 2020 paradigm)
Training script tools/train_neural_transport_qlknn.py with --synthetic CI mode and --data-dir for real Zenodo dataset
Auto-discovery: NeuralTransportModel() loads weights from weights/ if present
PPO agent on TokamakEnv via stable-baselines3 (tools/train_rl_tokamak.py)
Gymnasium-compatible GymTokamakEnv wrapper with proper spaces.Box definitions
PID and 1-step MPC baseline controllers for comparison
RL vs classical benchmark (benchmarks/rl_vs_classical.py): PPO vs PID vs MPC
[rl] optional dependency group (stable-baselines3, gymnasium)
20 QLKNN tests + 14 RL tests (weight loading, inference, training E2E, benchmark)

Fixed

NumPy 2.x deprecation: int(data["version"]) → int(data["version"].item())
TokamakEnv q95 formula: added elongation factor (q95 ≈ 3.0 at 15 MA, was 1.77)

[0.11.0] — 2026-03-10

Added

JAX-accelerated neural equilibrium (scpn_control.core.jax_neural_equilibrium): JIT-compiled PCA + MLP surrogate for Grad-Shafranov equilibrium with GPU dispatch, jax.grad for adjoint-based shape optimization, and jax.vmap batch inference
13 new tests: JAX/NumPy parity, autodiff gradients, batched vmap, weight conversion
JAX neural equilibrium tests added to jax-parity CI job

[0.10.0] — 2026-03-10

Added

JAX-accelerated transport primitives (scpn_control.core.jax_solvers): Thomas tridiagonal solver, Crank-Nicolson diffusion operator, and batched transport via jax.vmap — all JIT-compiled, GPU-compatible, and differentiable via jax.grad for sensitivity analysis
Synthetic DIII-D-like reference fixture validation (tests/test_synthetic_diiid_reference_shots.py): 95 tests validating data integrity, physical ranges, disruption labels, phase-sync pipeline handling, and disruption-precursor feature extraction against 17 synthetic DIII-D-like disruption fixtures (H-mode, VDE, beta-limit, locked-mode, density-limit, tearing, snowflake, negative-delta, high-beta)
CI Job: synthetic-diiid-reference — validates synthetic DIII-D-like reference fixtures (25 CI jobs total)
CI: JAX solver parity tests added to jax-parity job
JOSS paper (paper.md, paper.bib): submission-ready for Journal of Open Source Software review
API docs: JAX transport primitives added to docs/api.md

[0.9.0] — 2026-03-10

Added

py.typed PEP 561 marker for downstream IDE type inference
[jax] optional dependency group (jax>=0.4.20, jaxlib>=0.4.20)
[loihi] optional dependency group (nengo>=4.0, nengo-loihi>=1.0)
CI Job 16: JAX backend parity (jax-parity) — validates jax_traceable_runtime.py
CI Job 17: Nengo Loihi test (nengo-loihi) — validates nengo_snn_wrapper.py
CI: Windows and macOS runners in python-tests matrix (Python 3.12)
API docs: 16 previously undocumented modules added to docs/api.md (neural_equilibrium, neural_transport, stability_mhd, hpc_bridge, adaptive_knm, plasma_knm, analytic_solver, bio_holonomic, digital_twin_ingest, director_interface, fueling_mode, halo_re, hil_harness, jax_traceable, neuro_cybernetic, torax_hybrid_loop)
VALIDATION.md: RMSE regression threshold table with sources

Changed

mypy: disallow_untyped_defs = true, warn_return_any = true across all 54 modules (134 annotations added)
mypy: files simplified to ["src/scpn_control/"] (full package)
Codecov: fail_ci_if_error: true (was false with TODO)
Removed black from dev extras (redundant with ruff-format)
Cleaned 49 unused imports across 30+ test files (ruff auto-fix)
U-002 (Nengo Loihi) marked RESOLVED
U-006 (JAX CI) marked RESOLVED
All 7 UNDERDEVELOPED_REGISTER items now RESOLVED

[0.8.1] — 2026-03-10

Added

Rust H-inf: Padé(6,6) scaling-and-squaring matrix_exp replacing Euler discretization
Rust H-inf: zoh_discretize matching Python _zoh_discretize (exact ZOH via matrix exponential)
6 new Rust tests for matrix_exp + ZOH (diagonal, nilpotent, large-norm, Euler agreement)
benchmarks/e2e_control_latency.py — honest E2E pipeline benchmark (sensor→equilibrium→transport→control→actuator)

Changed

README, pitch.md, use_cases.md, VALIDATION.md, competitive_analysis.md: honesty sweep
- "formal verification" → "contract-based checking"
- "DIII-D shot replay" → stated as synthetic mock data
- Comparison table: kernel step ≠ full control cycle caveat
- VALIDATION.md: Scope & Limitations table, "What does NOT exist" list
- use_cases.md: added "Real tokamak data" and "Peer-reviewed papers" rows (both No)
U-001 marked RESOLVED in UNDERDEVELOPED_REGISTER
Stale doc counts: 2019 tests, 118 files, 54 modules

[0.8.0] — 2026-03-09

Added

Python fallback for rust_svd_optimal_correction(): truncated SVD pseudoinverse with singular-value cutoff (_python_svd_optimal_correction)
Python fallback for RustSPIMitigation: 3-phase disruption sim matching Rust spi.rs constants (Assimilation → ThermalQuench → CurrentQuench)
Python fallback for rust_multigrid_vcycle(): delegates to FusionKernel._multigrid_vcycle with isolated instance
require_bounded_float validator: arbitrary inclusive/exclusive bound checks
require_finite_array validator: ndim/shape constraints + finiteness
tests/test_rust_fallbacks.py — 16 tests (SVD, SPI, multigrid fallbacks)
Input validation on RustSPIMitigation.__init__() for both Rust and Python paths

Changed

h_infinity_controller.py: inline np.isfinite checks replaced with shared validators
disruption_predictor.py: 7 inline checks replaced with shared validators
advanced_soc_fusion_learning.py: 8 inline checks replaced with shared validators
U-003, U-004, U-005 marked RESOLVED in UNDERDEVELOPED_REGISTER
U-007 marked RESOLVED (shared validators in place, P1 modules converted)

[0.7.1] — 2026-03-09

Added

Enterprise root files: SUPPORT.md, GOVERNANCE.md, CONTRIBUTORS.md, NOTICE.md, ARCHITECTURE.md, VALIDATION.md, REUSE.toml, .gitattributes, .dockerignore, Makefile, requirements-dev.txt
Workflows: pre-commit.yml, codeql.yml, scorecard.yml, release.yml, stale.yml
.github/ISSUE_TEMPLATE/config.yml (Security Advisories + SUPPORT.md links)
_typos.toml domain allowlist (46 terms: physics, plasma, Rust identifiers)
17 GitHub labels (dependencies, ci, security, performance, plasma-control, etc.)

Changed

ci.yml, docs-pages.yml, publish-pypi.yml: SHA-pinned all actions, permissions: {}, concurrency groups, SPDX headers
pyproject.toml: ruff UP/SIM rules, coverage exclude_lines, dev deps added
.pre-commit-config.yaml: check-toml + crate-ci/typos hooks
dependabot.yml: commit-message prefixes, dependency groups
FUNDING.yml: github sponsor link
SECURITY.md: Security Advisories as preferred reporting method
scorecard-action bumped v2.4.0 → v2.4.3
black bumped 25.1.0 → 25.11.0

Repository

Squash-only merge, delete-branch-on-merge, discussions enabled
10 topic tags, homepage set to GH Pages docs URL
Dependabot PR triage: 1 merged (#21 black), 4 closed (incompatible Cargo bumps)

[0.7.0] — 2026-03-02

Added

tests/test_nengo_snn_wrapper.py — 14 mocked tests for the only untested module (389 LOC)
tests/test_e2e_compile_to_control.py — 5 E2E integration tests (compile → artifact → controller → step)
require_range validator in core/_validators.py
/// doc comments on 11 public Rust functions (mpi_domain.rs, vmec_interface.rs)
keywords and categories in all 5 Rust Cargo.toml files
Paper 27 Reviewer Integration page in mkdocs nav

Fixed

Public API typo: TokamakTopoloy → TokamakTopology (deprecated alias retained)
print() → logging in 13 control modules (58 call sites total)
Remaining Union[str, Path] → str | Path in 3 files (eqdsk.py, realtime_monitor.py, artifact.py)
CLI hardcoded module/test counts → dynamic Path.rglob computation
Magic number b0=5.3 → named constant ITER_B0_VACUUM_T with citation
Stale doc counts across README, architecture, pitch, use_cases, CONTRIBUTING (53 modules, 115 files, 1969 tests, 15 CI)
Dead grid_index() function removed from Rust gmres.rs

Changed

Coverage gate ratcheted: fail_under = 62 → 85
from __future__ import annotations added to core/__init__.py and scpn/__init__.py
4 duplicate validators in halo_re_physics.py replaced with core._validators imports
ROADMAP.md rewritten: v0.6.0 moved to Shipped, unshipped items to v0.7.0+
12 additional tests across 5 thin test files

[0.6.0] — 2026-03-02

Added

.editorconfig and .github/CODEOWNERS
Copyright headers on all 3 CI workflow files
repository field in all 5 Rust Cargo.toml files
tests/test_validators.py — 49 parametrized tests for core/_validators.py
tests/test_phase_properties_extended.py — 14 Hypothesis property tests (knm, upde, adaptive_knm)
Paper 27 citations on OMEGA_N_16 and build_knm_paper27 constants

Fixed

.zenodo.json license "MIT" → "AGPL-3.0-or-later" (matches pyproject.toml)
docs/api.md version stuck at "0.5.0" → "0.6.0"
print() → logger.info() in spi_mitigation.py (3 sites)
Anti-slop: renamed unused param proposed_action → _proposed_action, deleted 4 narration comments in cli.py
Flaky timing test: absolute 5s threshold → relative warmup baseline
Dead DEFAULT_GAIN constant removed from Rust optimal.rs

Changed

Typing modernization: from __future__ import annotations + Optional[X] → X | None in 21 files
Shared test fixtures extracted to conftest.py (3 controller test files deduplicated)
pyproject.toml keywords + author email added

[0.5.2] — 2026-03-02

Fixed

Codecov fail_ci_if_error: false → true (matches v0.5.0 CHANGELOG claim)
Stale doc counts: architecture.md (17→21 modules, 1243→~1900 tests), pitch.md, use_cases.md
Bug report template version placeholder 0.3.0 → 0.5.x
Development.md release example v0.2.1 → vX.Y.Z
Magic number citations: ITER Physics Basis for SHOT_DURATION, TARGET_R, TARGET_Z, u_max
Anti-slop: "leveraging" → "using" (nengo), narration → TMR median voter (hil), dead pass block (eqdsk)

Changed

docs/changelog.md synced with root CHANGELOG (was frozen at v0.3.3)
ROADMAP.md rewritten for v0.5.x shipped state
require_non_negative_float added to core/_validators.py; scaling_laws and spi_mitigation use shared validators
control/__init__.__all__ includes normalize_bounds
Legacy typing imports replaced in 7 files (phase/ + scpn/): Optional→|None, List→list, Dict→dict, Tuple→tuple

[0.5.1] — 2026-03-02

Fixed

CITATION.cff DOI description said v0.4.0 (now v0.5.0)
docs/api.md version string stuck at 0.3.3 (now 0.5.0)
CONTRIBUTING.md stale test count (1243→~1900), coverage (50→62%), CI jobs (17→16)
docs/development.md stale coverage (55→62%) and release process (no longer uses __init__.py)
Two "Approximate" comments cleaned per anti-slop rule #4

Changed

require_int deduplicated: canonical core/_validators.py replaces 3 copies
deny.toml wildcards: "allow" → "deny"
Pre-commit: added check-merge-conflict, detect-private-key hooks
Paper 27 phase dynamics page added to mkdocs nav

Added

SECURITY.md responsible disclosure policy
CODE_OF_CONDUCT.md (Contributor Covenant v2.1)
U-007 in UNDERDEVELOPED_REGISTER (np.isfinite boilerplate)
GitHub issues gh-13, gh-14, gh-15 for U-003/004/005 Rust fallback gaps

[0.5.0] — 2026-03-02

Fixed

__version__ now derived from package metadata (PEP 621), was stuck at 0.3.3
Rust H-inf update_discretization TODO tracked as gh-10, param renamed _dt → dt
README test/CI job counts updated to actual values

Added

27 new tests: 9 Rust (h_infinity, xpoint, bfield, chebyshev) + 18 Python (rust_compat_wrapper)
cargo-deny supply-chain policy (deny.toml) + CI Job 15
ruff format --check CI gate + pre-commit hook
UNDERDEVELOPED_REGISTER.md tracking 6 known gaps
Python 3.13 in CI matrix

Changed

Coverage gate: 55% → 62% (actual: 93%)
Codecov fail_ci_if_error: true
Pre-commit: Rust hooks no longer gated to stages: [manual]
Removed unused proptest dev-dependency from 3 Cargo.toml files

[0.4.0] — 2026-03-01

Added

Real-time adaptive Knm engine driven by tokamak diagnostics (AdaptiveKnmEngine, DiagnosticSnapshot, AdaptiveKnmConfig)
Five adaptation channels: beta scaling, MHD risk amplification, coherence PI control, per-element rate limiting, Lyapunov guard veto
K_override parameter on UPDESystem.step(), .run(), .run_lyapunov()
RealtimeMonitor.from_plasma() constructor with adaptive engine support
Diagnostic kwargs (beta_n, q95, disruption_risk, mirnov_rms) on tick()
46 new tests (1888 total)

Changed

.zenodo.json: complete Zenodo metadata (related identifiers, communities, notes)
CITATION.cff: version bump, date update

[0.3.3] — 2026-02-27

Changed

License: AGPL-3.0 → AGPL-3.0-or-later dual (137 files, zero AGPL remaining)
README: pip install -e "." → pip install scpn-control (PyPI install path)
CONTRIBUTING: CI job count 14 → 17

[0.3.2] — 2026-02-27

Added

VectorizedSCLayer + Rust backend path in SNN compiler (512× real-time)
Two-tier import: v3.8.0+ preferred → legacy bit-ops → numpy float fallback
Test for v3.8 detection and VectorizedSCLayer forward-path benchmark
sc-neurocore listed first in optional deps table as the preferred SNN backend

Changed

README: engine callout and dep table updated for sc-neurocore

[0.3.0] — 2026-02-27

Added

Ruff linter (E/F/W/I/B rules) — CI job + pyproject.toml config
Property-based tests for phase/ module (Hypothesis, 11 properties)
Gymnasium-compatible TokamakEnv (control/gym_tokamak_env.py, 10 tests)
IMAS/OMAS equilibrium adapter (core/imas_adapter.py)
CLI scpn-control info command (version, Rust status, weights, Python/NumPy)
Weight provenance manifest (reproduction commands, hardware, training config)
Paper 27 + H-infinity notebooks in CI smoke tests

Fixed

API docs: wrong snapshot keys (R→R_global, V→V_global, lambda→lambda_exp)
API docs: wrong UPDESystem constructor and LyapunovGuard API examples
README/CHANGELOG: "14 CI jobs" → actual count, test counts updated
_rust_compat.py: calculate_thermodynamics/vacuum_field now delegate to Python
163 ruff auto-fixes (whitespace, import sorting, unused imports)
26 manual ruff fixes (raise-from, unused variables, one-liners, E402)
Bandit now fails on medium+ severity (was --exit-zero)
TeX build artifacts (.aux/.log/.out/.toc) excluded from repo

Changed

Coverage threshold raised from 50% → 55% (actual: 61%)
CI: 12 → 13 jobs (added python-lint)
Test suite: 680 → 701 tests (50 test files)

[0.2.0] — 2026-02-26

Added

Paper 27 phase dynamics engine (src/scpn_control/phase/, 7 modules)
Kuramoto-Sakaguchi step with global field driver (kuramoto.py)
16x16 Knm coupling matrix builder with calibration anchors (knm.py)
UPDE multi-layer solver with PAC gating (upde.py)
LyapunovGuard sliding-window stability monitor (lyapunov_guard.py)
RealtimeMonitor tick-by-tick UPDE + trajectory recorder (realtime_monitor.py)
PhaseStreamServer async WebSocket live stream (ws_phase_stream.py)
CLI scpn-control live command for real-time WS phase sync server
Streamlit WS client (examples/streamlit_ws_client.py)
Streamlit Cloud deployment (streamlit_app.py, .streamlit/config.toml)
Mock DIII-D shot generator (tests/mock_diiid.py)
E2E phase sync with shot data tests (tests/test_e2e_phase_diiid.py)
Phase sync convergence video (MP4 + GIF) and generator script
PyPI publish script (tools/publish.py)
Rust upde_tick() in control-math + PyRealtimeMonitor PyO3 binding

Changed

CI expanded from 6 to 12 jobs
Test suite expanded from 482 to 680 tests (680 passing, 94 skipped)
README updated with <video> MP4 embed, Streamlit Cloud badge
.gitignore updated to allow docs GIF/PNG and Streamlit config

[0.1.0] — 2026-02-19

Added

Initial extraction from scpn-fusion-core v3.4.0
41 Python source files (minimal control transitive closure)
5 Rust crates (control-types, control-math, control-core, control-control, control-python)
Slim PyO3 bindings (~474 LOC, control-only)
Clean __init__.py files (no matplotlib/GPU/ML import bombs)
Click CLI with 4 commands (demo, benchmark, validate, hil-test)
Streamlit dashboard (optional, [dashboard] extra)
CI workflow (6 jobs: python-tests, rmse-gate, rust-tests, rust-python-interop, rust-benchmarks, rust-audit)
37 test files (482 passing, 122 skipped, 0 failures)
16 disruption shot reference data files
8 SPARC EFIT equilibria
3 pretrained weight files
Validation scripts and tools
Stochastic Petri Net logic map header (docs/scpn_control_header.png)

Changed (vs scpn-fusion-core)

Required deps: numpy, scipy, click ONLY (was: numpy, scipy, matplotlib, streamlit)
matplotlib, streamlit, torch, nengo moved to optional extras
All imports renamed: scpn_fusion -> scpn_control, scpn_fusion_rs -> scpn_control_rs
Rust workspace reduced from 11 crates to 5
CI reduced from 13 jobs to 6
hpc_bridge.py relocated from hpc/ to core/ subpackage
Import guards added for excluded modules (stability_analyzer, global_design_scanner, imas_connector, diagnostics.forward, fusion_ignition_sim)

Uh oh!

FilesExpand file tree

changelog.md

Latest commit

History

changelog.md

File metadata and controls

Changelog

Unreleased

Fixed

Changed

Changed

Fixed

Added

[0.23.0] - 2026-07-17

Added

Changed

Fixed

[0.22.1] - 2026-07-03

Fixed

Changed

Security

[0.22.0] - 2026-06-26

Added

Fixed

Changed

Security

[0.21.0] - 2026-06-15

Added

Changed

Fixed

Security

Repository hygiene

[0.20.7] - 2026-06-05

Added

Changed

[0.20.6] - 2026-06-05

Fixed

[0.20.5] - 2026-06-05

Fixed

[0.20.4] - 2026-06-05

Added

Changed

Changed

[0.20.3] - 2026-06-02

Changed

Security

[0.20.2] - 2026-06-02

Changed

[0.20.1] - 2026-06-02

Changed

[0.20.0] - 2026-06-01

Changed

[0.19.3] - 2026-06-01

Fixed

Changed

Validation

[0.19.1] — 2026-05-21

Fixed

Changed

[0.19.0] — 2026-03-18

Fixed — Physics Audit (33 equation corrections)

[0.18.0] — 2026-03-17

Added

Changed

Fixed

[0.17.0] — 2026-03-14

Added

Changed

[0.16.0] — 2026-03-13

Added

Fixed

Changed

[0.15.0] — 2026-03-11

Fixed

Added

Changed

[0.14.1] — 2026-03-11

Fixed

Added