Sync local main: README revision, DE-59 renumber, gitignore cleanup

.dockerignore

@@ -0,0 +1,43 @@
+.git
+.github
+.claude
+.codex
+.env*
+*.xml
+graphify-out
+logs
+*.log
+.playwright-mcp
+.pytest_cache
+.ruff_cache
+**/__pycache__
+**/*.pyc
+web
+docs
+scripts
+tests
+notebooks
+app
+archive
+v4_build
+data/drugbank
+data/training
+data/docking
+data/chembl
+data/compounds
+data/features
+data/reference
+data/validation/*
+!data/validation/development_residual_interval.json
+!data/validation/feature_schema_v1.json
+!data/validation/solver_settings_v1.json
+models/**/*.bak
+models/adme/logp_correction.json
+models/adme/xgboost_clint_expanded.json
+models/meta_learner
+models/sbi
+models/surrogate
+models/e2e_mlp.pt
+*.pdf
+*.pkl
+*.docx

.github/workflows/ci.yml

@@ -31,8 +31,24 @@ jobs:
           pip install -r requirements-lock.txt
           pip install -e . --no-deps
 
+      - name: Installed-wheel prediction smoke
+        run: |
+          python -m pip wheel . --no-deps --wheel-dir /tmp/sisyphus-wheel
+          python -m pip install --no-deps --target /tmp/sisyphus-installed /tmp/sisyphus-wheel/*.whl
+          cd /tmp
+          SISYPHUS_ROOT="$GITHUB_WORKSPACE" PYTHONPATH=/tmp/sisyphus-installed \
+            python -c "from sisyphus.pipeline.predict import predict; r=predict('CCO', 10.0, strict=True); assert r.execution_status == 'ok'"
+
       - name: Ruff (gating; pre-existing violations baselined via inline noqa)
-        run: ruff check src tests
+        run: >-
+          ruff check src tests server
+          scripts/build_n50_exclusion.py
+          scripts/gen_console_data.py
+          scripts/audit_external_holdout_manifest.py
+          scripts/predict_external_holdout_manifest.py
+          scripts/score_external_holdout.py
+          scripts/sync_public_model_metrics.py
+          scripts/prediction_trace.py
 
       - name: Unit tests
         run: pytest tests/unit -v --tb=short
@@ -47,12 +63,9 @@ jobs:
         run: pytest tests/benchmark/test_holdout.py -v --tb=short
 
   server-security:
-    # The engine API security contract (CORS allow-list + /predict rate limit).
-    # Deliberately engine-free: server/config.py + server/tests import neither the
-    # heavy engine graph nor torch, so this job stays fast and gates the security
-    # behavior that the main `test` job's testpaths=["tests"] does not collect.
+    # Exercise the API contract with the same CPU-only runtime deps as the image.
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v6
 
@@ -62,15 +75,38 @@ jobs:
           python-version: "3.10"
           cache: pip
 
-      - name: Install server deps (no engine)
+      - name: Install production API dependencies and test tools
         run: |
           python -m pip install --upgrade pip
-          pip install fastapi slowapi httpx pytest ruff
+          pip install -r server/requirements.txt pytest==9.0.3 ruff==0.15.11 httpx==0.28.1
+          pip install -e . --no-deps
 
-      - name: Ruff (server policy module + tests)
-        run: ruff check server/config.py server/tests
+      - name: Ruff (server adapter, policy, and tests)
+        run: ruff check server
 
-      - name: Server security tests (CORS + rate limit, engine-import-free)
-        # `python -m pytest` puts the repo root (CWD) on sys.path so the
-        # top-level `server` package imports without an editable install.
+      - name: Server API and security tests
         run: python -m pytest server/tests -v --tb=short
+
+  container:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build exact-source API image
+        run: docker build -f server/Dockerfile -t sisyphus-api:ci .
+      - name: Smoke-test prediction in built image
+        run: |
+          docker run -d --rm -p 127.0.0.1:7860:7860 --name sisyphus-api-ci sisyphus-api:ci
+          trap 'docker stop sisyphus-api-ci' EXIT
+          curl --retry 30 --retry-all-errors --retry-delay 1 --fail --silent --show-error http://127.0.0.1:7860/health
+          curl --fail --silent --show-error -X POST http://127.0.0.1:7860/predict \
+            -H 'Content-Type: application/json' \
+            -d '{"smiles":"CCO","dose_mg":100}' -o /tmp/sisyphus-predict.json
+          python -c 'import json; p=json.load(open("/tmp/sisyphus-predict.json")); assert p["executionStatus"] == "ok" and p["meta"]["cmax"] > 0'
+      - name: Build and smoke-test holdout evaluator image
+        run: |
+          docker build -f scripts/Dockerfile.holdout -t sisyphus-holdout:ci .
+          docker run --rm -v "$PWD:/repo:ro" sisyphus-holdout:ci \
+            python scripts/audit_external_holdout_manifest.py --help
+          docker run --rm -v "$PWD:/repo:ro" sisyphus-holdout:ci \
+            python -c 'from sisyphus.pipeline.predict import predict; assert predict("CCO", 10, strict=True).execution_status == "ok"'

.github/workflows/web-ci.yml

@@ -7,10 +7,10 @@ name: web-ci
 
 on:
   pull_request:
-    paths: ["web/**"]
+    paths: ["web/**", "app/**", "index.html"]
   push:
     branches: [main]
-    paths: ["web/**"]
+    paths: ["web/**", "app/**", "index.html"]
   workflow_dispatch:
 
 jobs:
@@ -27,5 +27,9 @@ jobs:
           cache: npm
           cache-dependency-path: web/package-lock.json
       - run: npm ci
-      - run: npm run build
-      - run: npm run smoke # headless render guard for all six workflows
+      - run: npm run build:pages
+      - run: npm run smoke # headless render guard for supported workflows
+      - name: Production /app bundle is synchronized
+        run: git diff --exit-code -- ../app
+      - run: VITE_API_URL=http://localhost:8000 npm run build
+      - run: SMOKE_LIVE_RACE=1 npm run smoke

.gitignore

@@ -81,6 +81,11 @@ AGENTS.md
 # scratchpad (untracked 2026-05-30 / 2026-06-18).
 docs/_internal/
 
+# Internal research notes + oracle/ablation experiments and their artifacts
+# (scripts/JSON/PNG). Local-only research scratchpad; not for the public tree
+# (name echoes the retired docs/claude/ convention) (untracked 2026-07-08).
+docs/claude_science/
+
 # Manuscript / preprint / FDA-essay drafts and any binary document (local-only;
 # binary, frequently revised — not version-tracked). The repo tracks ZERO binary
 # documents (verified 2026-06-02), so these formats are ignored everywhere. To
@@ -109,3 +114,14 @@ predict.png
 
 # N50 exclusion inventory is a build artifact (regenerated by scripts/build_n50_exclusion.py)
 data/reference/n50_exclusion_ik14.json
+
+# Preprint build/draft artifacts and submission metadata (local-only, 2026-10-01)
+Sisyphus_Preprint_*.md
+ChemRxiv_*
+*.pkl
+v4_build/
+
+# Internal planning material (local-only, untracked 2026-10-01)
+.planning/
+.superpowers/
+docs/breakthrough_path.md