Replace main with the verified Kubernetes research platform

.dockerignore

@@ -0,0 +1,5 @@
+.git
+web-interface/node_modules
+web-interface/dist
+logs
+**/__pycache__

.gitignore

@@ -1 +1,6 @@
 bin/
+/logs/
+__pycache__/
+*.py[cod]
+auth-service/node_modules/
+auth-service/data/

README.md

@@ -1,53 +1,115 @@
 # Mist
 
-Mist: UTMIST's Compute Platform
+UTMIST's compute platform. The Kubernetes pilot runs submitted CPU, NVIDIA,
+and Tenstorrent workloads as real Jobs. The Jobs page and CLI use the same
+API for submission, status, logs, and cancellation. The local foundation adds
+live hardware inventory, self-service container images, team workspaces,
+scoped shared storage and a durable fair job queue.
 
-## Runtime requirements
+## Current pilot
 
-- Go 1.25.1 (also satisfies the backend's Go 1.24.6 requirement)
-- Node.js 22.16.0 or newer, with npm
-- Docker Engine and the Docker Compose plugin (`docker compose`)
-- Permission to run `docker ps` as the same user that runs the backend
+- `utmist-z1opa08`: k3s server, CPU workloads, two NVIDIA RTX A4000 GPUs.
+- `utmist-tt`: QuietBox worker, four n300 boards with two Wormhole chips each.
+- Request one or two NVIDIA GPUs, or one to four Tenstorrent boards. Other
+  jobs can use the remaining devices; requests wait when capacity is occupied.
+- Website: http://100.73.139.66:8088. API on that origin: `/api`; auth: `/auth`.
 
-## Run locally
+The department rollout includes admin/member login, team common/member folders,
+explicit cross-team read/use grants, enforced storage/resource limits, durable
+fair admission and revocation. The portal uses interactive compute choices,
+clear feature panels and searchable, paginated job rows that expand for details.
+Use **http://100.73.139.66:8088** privately through Tailscale.
 
-Ensure `go version`, `node --version`, and `docker ps` work before starting.
-Run the following from the repository root:
+See [the current department operating guide](docs/department-rollout.md),
+[private deployment operations](deploy/private/README.md),
+[completed execution plan and evidence](docs/department-rollout-execution.md),
+[portal design](docs/design-system.md), and
+[release testing](docs/testing.md). The earlier foundation guides record
+historical phases.
+
+Credits, Jupyter, chaining, browser image archives/builds and arbitrary distributed
+training remain outside this release. Custom TT code/images must use compatible
+TT libraries. Automatic backups, HTTPS and monitoring/cleanup products were
+explicitly excluded. Hosting remains private HTTP over Tailscale.
+
+## Developer preview against this cluster
+
+**Keep production authentication/team enforcement enabled for research users.**
+The standalone trusted-owner mode below is only for development.
+
+Use Go 1.25.1 and Node.js 22.16.0 or newer. Apply the workload prerequisites
+and claim templates described in the deployment guide first. Kubernetes is
+now the default executor; Redis and Docker supervisors are unnecessary for
+this path. This server has both runtimes under `~/.local/share/mist-runtimes`:
 
 ```bash
-docker compose up -d redis
-docker build -t pytorch-cpu src/docker/pytorch-cpu
+export PATH=/home/utmist/.local/share/mist-runtimes/go-1.25.1/bin:/home/utmist/.local/share/mist-runtimes/node-22.16.0/bin:$PATH
 ```
 
-Start the backend in one terminal. Run it from `src` so it finds its logging configuration:
-
 ```bash
+export KUBECONFIG=/home/utmist/.kube/config
+# Standalone development defaults to a trusted local owner with auth disabled.
+# For the deployed authenticated/shared API, use its existing port-forward.
+export MIST_PILOT_OWNER=local-dev
 cd src
 go run .
 ```
 
-Start the frontend in another terminal:
+If the deployed API's port-forward already occupies port 3000, use that API
+or stop only `mist-api-forward.service` before starting a local backend.
+Standalone `go run` uses the default base-image allowlist. Set
+`MIST_ALLOWED_IMAGES` to the deployment's approved references when developing
+with the packaged example images or other custom images.
+
+In another terminal:
 
 ```bash
 cd web-interface
-npm install --package-lock=false
-npm run dev -- --port 3001
+npm ci
+npm run dev -- --host 127.0.0.1 --port 3001 --strictPort
 ```
 
-Open http://localhost:3001/jobs. The API uses http://localhost:3000.
-The repository includes a Bun lockfile; npm installation does not use that lockfile.
+The Vite proxy forwards `/api` and `/auth` to the API on port 3000. The installed user
+services already run both endpoints on this machine:
 
-The optional CLI can be built from a third terminal:
+```bash
+systemctl --user status mist-api-forward mist-web
+```
+
+## CLI
+
+From the repository root:
 
 ```bash
-cd cli
-go build -o ../bin/mist .
-../bin/mist --help
+go -C cli build -o ../bin/mist .
+printf "print('Hello from a real Mist job')\n" > /tmp/hello.py
+export MIST_API_URL=http://100.73.139.66:8088/api
+bin/mist auth login --email your-member-email@example.org
+bin/mist job submit /tmp/hello.py --compute CPU
+bin/mist job list --all
+bin/mist job status <job-id>
+bin/mist job logs <job-id>
+bin/mist job cancel <active-job-id>
 ```
 
-The frontend and CLI currently contain mock data and placeholder actions. The
-backend's job execution is also incomplete; starting these services does not yet
-provide end-to-end workload execution.
+Use `--compute NVIDIA --devices 1` for one GPU, or
+`--compute TT --devices 1` for one two-chip board. The submitted script must
+actually use the chosen accelerator. `--api-url` or `MIST_API_URL` selects an
+API endpoint. See [CLI setup](cli/docs/setup.md) for resource options.
+
+## Tests and legacy development
+
+```bash
+go -C src test -run 'Test(Kubernetes|Hardware|GPURequest|CustomImage|TenstorrentCustom|Shared|Member)' ./...
+go -C cli test ./...
+cd web-interface
+npm test -- --run
+npm run build
+npx tsc --noEmit
+```
 
-Stop the backend/frontend with Ctrl+C in their terminals, then run
-`docker compose stop redis` from the repository root to stop Redis without deleting its data.
+The older Docker/Redis executor is available with `MIST_EXECUTOR=docker`.
+Its supervisor execution is incomplete. For its existing tests, start a
+local Redis instance and run `go -C src test ./...`; Docker integration tests
+also need Docker permissions and their test image. This path is retained for
+compatibility and is separate from the validated Kubernetes executor.

auth-service/.dockerignore

@@ -0,0 +1,2 @@
+node_modules
+data

auth-service/Dockerfile

@@ -0,0 +1,13 @@
+FROM node:22.16.0-bookworm-slim AS dependencies
+WORKDIR /app
+RUN apt-get update && apt-get install -y --no-install-recommends python3 make g++ && rm -rf /var/lib/apt/lists/*
+COPY package*.json ./
+RUN npm ci --omit=dev
+FROM node:22.16.0-bookworm-slim
+ENV NODE_ENV=production HOST=0.0.0.0 PORT=3002 MIST_AUTH_DATABASE=/data/auth.sqlite
+WORKDIR /app
+COPY --from=dependencies /app/node_modules ./node_modules
+COPY package.json server.mjs ./
+USER 65532:65532
+EXPOSE 3002
+CMD ["node", "server.mjs"]

auth-service/README.md

@@ -0,0 +1,25 @@
+# Mist member authentication
+
+Small Node service using maintained Better Auth 1.7.7 and better-sqlite3 13.0.3.
+It is internal to `mist-system`; the Go gateway proxies `/auth` on the website's
+origin and checks sessions before authorizing data routes. No public signup.
+
+`npm ci && npm start` requires Node 22.16 or newer and these environment variables:
+
+- `BETTER_AUTH_SECRET`: protected random secret, at least 32 characters.
+- `MIST_SITE_ORIGIN`: exact website origin; HTTPS enables Secure cookies.
+- `MIST_ALLOWED_ORIGINS`: comma-separated trusted origins.
+- `MIST_AUTH_DATABASE`: local SQLite path (default `./data/auth.sqlite`).
+- `MIST_ADMIN_EMAIL`, `MIST_ADMIN_PASSWORD`: only needed when initializing an empty
+  database. The first user is an administrator. Existing users are never reset.
+- `HOST`, `PORT`: listener (default localhost:3002).
+
+Never put a real secret or bootstrap password in the image, Git, shell arguments
+or logs. Kubernetes injects the protected Secret. SQLite uses WAL, a busy timeout
+and startup migrations on a persistent local PVC, with one Recreate replica.
+Database-backed rate limiting survives restarts. Upload/storage metadata live
+in Go/NFS, not in this auth database. Member passwords use the library's password
+implementation; Go does not hash passwords or mint authentication tokens.
+
+See [operations and recovery](../deploy/private/README.md) for online backups,
+restoration, private HTTP/HTTPS configuration and deployment.