-
coreci-bot released this
2026-09-30 14:23:14 +00:00 | 14 commits to milestone/v0.3-hosted since this releasev0.3 Phase 3 — Live Surfaces (user-scoped).
REQ-75 (delegation-end): GeneratedApiClient is standalone —
extends MockApiClientdropped, every surface live-bound, zero component rewrites (D-112).
REQ-76..79: disk read-models — library folders/sorting, connections (shared-source + topical edges), graph, task inbox (answered-iff-DONE), suggestions (never synthetic, honest empty states). Registry-independent: every read correct on a fresh app over an existing data root (P-8 full closure).
REQ-80: refine dialogue on the per-user planner chain — real model calls, honest 503 when unreachable.
REQ-81: profile routes (display name/email, unique email 409).
REQ-82: Reading Room fidelity — report.json/evidence.json persisted at DONE, marker normalization ([p-N]→[^pN]) at the boundary only, hover shows the stored quoted passage, ledger panel real, exports carry real claims/quotes (fabricated fields dead — P-12).Verify: PASS-WITH-FIXES (core-loop CSRF test pin P0 fixed in-phase). 314 backend + 164 frontend tests green.
Downloads
-
2026-09-30 10:31:45 +00:00 | 16 commits to milestone/v0.3-hosted since this releasev0.3 Phase 2 — Per-User Settings + Model Keys.
REQ-72 per-user settings persistence (GET/PUT /api/config/settings; partial updates; null-poisoning P0 fixed in verify).
REQ-73 encrypted model keys: AES-256-GCM (KEK from env-file 'keys' scope, user_id as AAD, fresh nonce per write, 0600), masked-only API (last-4), honest disabled state without KEK (409 with reason).
REQ-74 per-run credential chain user → server → keyless via ModelAdapterFactory — one adapter per run (shared-adapter fallback bug dead), probe per resolved tier, credential_tier stamped on run state. Config rework: factory-resolved probe (P-1 closed), owner-keyed cost counters (P-13). Production entrypoint researchx.api.main (P-3 backend half): auth hardwired, cookie_secure=True, no fakes reachable.Verify: PASS-WITH-FIXES (P0 fixed in-phase). 264 backend + 131 frontend tests green.
Downloads
-
2026-09-29 21:36:50 +00:00 | 18 commits to milestone/v0.3-hosted since this releasev0.3 Phase 1 — Auth + Sessions + User Scoping.
REQ-69 user/pass auth: argon2id (argon2-cffi, to_thread), server-side sessions (token_urlsafe(32), sha256-at-rest, httpOnly SameSite=Lax cookies, 14-day sliding expiry, immediate revocation, token rotation), CSRF (X-ResearchX-Request on all non-GET), /healthz outside /api.
REQ-70 admin-managed accounts: first-registered-is-admin (atomic — 8-way race pinned), registration closed after, admin create/deactivate (kills sessions, retains data), password min length 12.
REQ-71 user scoping: runs/<user_id>/<run_id>/ partitioning, owner-keyed registry (cross-owner 404 across all 8 run endpoints), RunState.owner_id, restart sweep (G-101: PLANNING→CANCELLED), registry pruning.Security review (in-phase): P0 first-admin register race fixed; P1 corrupt-users.json fail-closed. Verify: PASS 4/4 layers. 184 backend + 119 frontend tests green.
Downloads
-
2026-09-29 17:14:09 +00:00 | 20 commits to milestone/v0.3-hosted since this releasev0.3 hosted milestone — pre-execution (phase 0).
Scope (owner-directed 2026-09-29): auth + sessions (user/pass, admin-managed, OAuth deferred), per-user model API keys (encrypted at rest), live-bound user-scoped surfaces (library, settings, suggestions, refine, graph/inbox, profile), backend hosting (SSE-safe), real inference as the product default.
Artifacts:
- REQUIREMENTS REQ-69..85 (supersession of the single-user constraint recorded)
- CLARIFY: D-101..D-115 (sessions, argon2id, CSRF, admin bootstrap, partitioning runs/<user_id>/<run_id>/, RESEARCHX_DATA_DIR, AES-256-GCM KEK envelope, per-run adapter factory, settings routes, mock fate, report.json/evidence.json, open questions, disk read-models)
- RESEARCH-v03: 12 topics, 20 conclusions, 14 verified multi-user pitfalls
- PLAN: P1..P4 vertical-slice plans (auth → keys → live surfaces → hosting) with MVP/UX sections
- GRILL: Proceed (0.68) — G-101..G-110 binding, G-111 escalated (P4 staged-deploy pre-authorization)
Gates at tag: backend 130 tests + ruff + mypy green; frontend 97 tests + tsc + eslint green.
Downloads
-
2026-09-29 14:31:07 +00:00 | 6 commits to main since this releaseResearchX v0.2 — MVP (APPROVED)
Owner approval recorded 2026-09-27 (decision
4721c2a, /ci-run APPROVED) following the owner-directed UAT staging at https://research.coreci.dev. G-009 ratified: live mode covers the core research loop; library/settings/suggestions/refine stay mock-backed until v0.3+. The milestone is merged to main; tags v0.2.0-v0.2.5 preserve the full history.The approved v0.1 prototype is now backed by a real research engine. All milestone requirements (REQ-01..26, 31..34) covered across six phases:
Phase Tag Delivered P0 pre-execution v0.2.0 14 clarify decisions (D-007..D-020), research (14 conclusions), P1 plan, adversarial grill (G-001..G-010, Proceed 0.72), MVP/UX gate PASS P1 methodology + adapters v0.2.1 12-dial typed schema, Rapid Answer + Deep Report registry, five adapter contracts, Ollama cloud-first fallback, Tavily/DDG, capability-probe contracts, fake adapters (REQ-01..06, 08..11, 31) P2 engine + trust v0.2.2 asyncio state machine with plan-approval halt, durable state + resume from any mid-run state, typed event bus + trace, visited-only evidence store, SSRF-guarded liveness, quote anchoring, citation ledger, verification checklist, confidence labels, live probe wiring (REQ-07, 12, 13..24) P3 API + integration v0.2.3 FastAPI routes + SSE, openapi.json snapshot + generated typed client, live ApiClient binding behind NEXT_PUBLIC_RESEARCHX_API_MODE, pauseRun/resumeRun extension (REQ-25, 26, 33) P4 hardening + E2E v0.2.4 14-attack adversarial suite, 3-click E2E on the real stack, export round-trip (REQ-17, 32, 34) P5 final v0.2.5 Multi-persona review (4 P0 fixed with attack-proofs), audit PASS-WITH-NOTES, the approved MVP release The trust thesis, attack-proven
- Every cited quote is anchored against the passage its citation ID names - a fabricated quote on a real passage ID fails the export gate
- Citations to never-stored passages count as unanchored claims and fail the export gate
- The export gate requires zero unanchored claims AND >=99% live citations (cited-URL scoped)
- Fetching and liveness re-guard every redirect hop - the metadata IP is unreachable by design
- A report citing nothing passes nothing: the ledger covers what the report actually cites
Try it
cd backend && uv sync && uv run pytest # 129 tests, zero keys cd frontend && corepack pnpm install && corepack pnpm test # 97 tests # live core loop: cd backend && uv run uvicorn researchx.api.app:app --port 8000 cd frontend && NEXT_PUBLIC_RESEARCHX_API_MODE=live corepack pnpm devDeployed (owner-directed staging): https://research.coreci.dev - v0.2.5 build, mock-backed frontend per the ratified G-009 scope; backend hosting is v0.3+ work.
Next
v0.3 planning unblocked (scope pending owner direction): live-bound library/settings/suggestions/refine surfaces, backend hosting for the LXC deployment, and the remaining 6 methodologies from the locked catalog. v1.0.0 remains owner-approved-release-only.
Downloads
-
2026-09-27 14:29:32 +00:00 | 8 commits to main since this releaseMilestone v0.2 phase 4: the trust thesis is attack-proven.
Adversarial suite (REQ-32) — 11 attacks, all caught: hallucinated citations to never-stored passages flag as unanchored claims and FAIL the export gate (the gate now requires zero unanchored claims, not just ≥99% liveness — the verify pass caught a fabricated report passing vacuously); fabricated quotes never match; the weak band (0.80–0.85) is pinned with a real 0.82 input; private-IP redirect attacks die at the SSRF guard; redirect chains to gone pages classify dead; 5MB responses are capped; deep-report runs pause/resume and cancel mid-depth-loop over the real HTTP API.
E2E (REQ-17) — the ≤3-click happy path (submit question, pick methodology, approve plan) validated against the real stack: live ApiClient binding → loopback FastAPI bridge → asyncio engine with trust loop — not the mock.
Round-trip (REQ-34) — markdown export carries citation URLs as links; JSON export uses the backend ledger schema and validates back into the CitationLedger pydantic model.
Live tier (G-004) — opt-in keyed tests (uv run pytest -m live) skip cleanly without secrets; the zero-key suite never asserts the 99% bar vacuously.
Gates: 126 backend (mypy strict, ruff) + 97 frontend (typecheck, lint, vitest, build).
Next: P5 final review + audit + milestone ship → v0.2.5 (the MVP release), presented at the owner gate.
Downloads
-
2026-09-27 13:45:36 +00:00 | 10 commits to main since this releaseMilestone v0.2 phase 3: the MVP goes live.
Delivered: FastAPI API surface (REQ-25) — POST /api/runs, methodology cards with ETA/cost heuristics, run lifecycle (approve/pause/cancel/resume), SSE event stream with sequence-watermark replay and terminal-state drain, GET /api/config with adapter status + advisory cost counters (G-007). OpenAPI-generated typed client (REQ-26): committed openapi.json snapshot (G-005), openapi-typescript + openapi-fetch, GeneratedApiClient binding behind NEXT_PUBLIC_RESEARCHX_API_MODE=live (mock stays default), pauseRun/resumeRun as the single planned ApiClient extension (G-003), live export of real report+ledger data. Zero component rewrites (REQ-54 held — the 90-test component suite passed untouched). Live mode covers the core research loop (G-002); library/settings/suggestions/refine stay mock-backed to v0.3+ (owner ratifies at the P5 gate).
Verify: 1 P0 (mode flag invisible to the browser bundle — Next.js strips non-NEXT_PUBLIC env) + 4 P1 (SSE replay race, subscriber leak, override validation 500→422, fabricated live export) — all fixed in-phase with tests.
Gates: backend 115 tests + mypy strict + ruff; frontend 95 tests + typecheck + lint + build.
Next: P4 Hardening + Adversarial Suite + E2E → v0.2.4.
Downloads
-
2026-09-27 11:48:28 +00:00 | 12 commits to main since this releaseMilestone v0.2 phase 2: the engine runs.
Delivered: asyncio state machine PLANNING → AWAITING_APPROVAL → SEARCHING → EXTRACTING → REFLECTING (depth loop) → SYNTHESIZING → VERIFYING → DONE (REQ-13/14); durable JSON state with atomic rewrites + position-aware resume from any mid-run state (REQ-15); typed event bus + append-only trace.jsonl per run (REQ-16); evidence store with stable passage IDs — the writer context is the evidence store and nothing else (REQ-18, pinned by a recording-model test); SSRF-guarded URL liveness with live/stale/dead + per-hop redirect re-guarding (REQ-19); quote anchoring with real mismatch detection (REQ-20); citation ledger JSON (REQ-21); exportable verification checklist with the REQ-23 ≥99% export gate; single-source vs corroborated confidence labels (REQ-24); live capability probing wired into run state (REQ-07/12 complete).
Verify: found 2 P0 (SSRF guard unwired at fetch; evidence slot missing from writer prompts — both masked by fake tests) + 9 P1; all fixed in-phase with regression pins. 108 backend tests, zero API keys.
Try it: cd backend && uv run python -m researchx.engine.demo
Next: P3 API Layer + Integration → v0.2.3.
Downloads
-
2026-09-27 11:28:15 +00:00 | 14 commits to main since this releaseMilestone v0.2 phase 1: the backend arrives.
Delivered: uv-managed Python 3.12 src-layout package (researchx) with strict gates from the first commit; 12-dial typed schema with safe defaults (REQ-01); methodology registry shipping Rapid Answer + Deep Report with proven behavior differences (REQ-02/03/05); per-run resolved-dial snapshots (REQ-04); five adapter contracts — model/search/storage/memory/secrets — all I/O behind adapters (REQ-06/10/11); Ollama cloud-first with keyless localhost fallback (REQ-08); Tavily default + DuckDuckGo keyless degraded-mode fallback (REQ-09); capability-probe contracts with conservative caps (context min(claim, 8192), embedding batch 8) and structured-output warning + degrade path (REQ-07/12 contracts; live probing in P2 per G-001); fake model/search adapters for zero-API-key engine tests (REQ-31).
Verify: PASS — 4 layers; 0 P0; 2 P1 fixed in-phase (storage path-traversal guard with fsync+unique-tmp atomic writes; capability-probe test coverage); 9 P2 flagged for post-hoc (SSRF allowlist, fetch size cap, Tavily bearer, run-id consolidation).
Gates: backend ruff + mypy strict + 71 tests; frontend typecheck + lint + 90 tests + build. All green.
Next: P2 Research Engine + Trust Loop → v0.2.2.
Downloads
-
2026-09-27 10:58:39 +00:00 | 16 commits to main since this releaseMilestone v0.2 (MVP) phase 0 — pre-execution pipeline complete.
Stages: SPECIFY (spec validated for v0.2) → CLARIFY (14 decisions D-007..D-020: backend layout, uv+Python 3.12, ports, DDG fallback, openapi-typescript, SSE, difflib anchoring, durable JSON state, owner-gate halt, no-deploy policy) → RESEARCH (8 topics, 14 conclusions — RESEARCH-v02.md; PERSONAS v0.2 roster) → PLAN (P1 vertical-slice plan, 4 waves, 14 tasks) → GRILL (nine-axis mechanical review — verdict Proceed 0.72, 17 challenges, 10 binding decisions G-001..G-010) → MVP/UX CHECK (PASS — three sections authored, decisions promoted).
Key scope rulings: live-mode surface = core research loop only (G-002, owner ratifies at P5 gate); probe contracts in P1, live probing in P2 (G-001); pauseRun/resumeRun as the single P3 ApiClient extension (G-003); REQ-23 liveness = per-run export gate + opt-in keyed tier (G-004); openapi.json snapshot discipline (G-005); P2 split lever (G-006).
Gates: frontend typecheck ✓ lint ✓ tests 90/90 ✓ build ✓ (backend does not exist yet — scaffolds in P1).
Next: P1 Methodology Framework + Adapter Layer (REQ-01..06, 08..11, 31) → v0.2.1.
Downloads