47 lines
3.1 KiB
Plaintext
47 lines
3.1 KiB
Plaintext
Seed handling and input hardening (deferred from the B-list fixes)
|
|
=====================================================================
|
|
|
|
DONE - Validate ranSeed in the GUI and startSequence: it must be an integer in a
|
|
safe range (|v| <= 2^31-1, matching ISEED = IDINT(RI) in trimspNL.F). Enforced
|
|
in runSimulationSequence() (before any job is generated) AND in CreateInpFile()
|
|
(defense-in-depth), so a crafted share link or direct deck builder is blocked
|
|
with a "please change it" message. Non-numeric / NaN / non-integer / oversized
|
|
seeds no longer reach the engine.
|
|
DONE - Derive per-scan-point seeds deterministically from the base seed and the
|
|
scan index, so a multi-point run is reproducible in any finish order
|
|
(currently: initialSeed + iScan, only when the user set a valid seed).
|
|
DONE - Cap valEnergy magnitude at 60000 eV (positive incidence mode and the
|
|
Maxwellian transmission mode |E0| = temperature). Stopping fits (KDEE1=4) are
|
|
documented valid to ~50 keV for helium (meaning-of-params.txt:177-185), so 60
|
|
keV is the model's fitted ceiling. Applied to scanned energies and the base
|
|
value in runSimulationSequence() and CreateInpFile().
|
|
- Warn when a shared configuration fixed the RanSeed: every scan point then uses
|
|
the same generator, which can produce statistically misleading results.
|
|
- Cap client-controlled numberProj magnitude: an unbounded projectile count (e.g.
|
|
1e9) does not terminate within the 300 s watchdog and can flood scan points
|
|
(empirically verified: 1e9 did not finish in 15 s). GUI ProjNumberLimit() is
|
|
currently dead code (defined at TrimSPlib.js:3516, never wired to an event).
|
|
- Persisting the effective per-point seed: the seed already lives in each
|
|
archived *.inp (all three deck slots), so reproducibility does not require the
|
|
*.seq header change; extending *.seq would shift the 999(A20,1x) layer slots
|
|
and break getSequenceColumnInfo(). Surfacing it in run details instead is
|
|
deferred - not sure it is needed.
|
|
|
|
Deferred follow-ups from the C-list CGI hardening
|
|
=================================================
|
|
|
|
- The perl "Statement unlikely to be reached" warning at the exec/_exit(127)
|
|
child branch of run_bounded_command is intentional (matching muSRFlow) and
|
|
does not affect `perl -c`; tests run with -X to keep output clean.
|
|
- No global concurrency cap is implemented (by design, mirroring muSRFlow):
|
|
concurrent per-point engine runs are allowed; archive is serialized per run
|
|
with flock. Revisit if a runaway share link floods scan points.
|
|
- Auth (MUCH-need, muSRFlow parity): none is implemented, keeping the read-only
|
|
/tmp contract. If this CGI is ever exposed beyond a trusted LAN, gate it with
|
|
httpd authentication or a shared-token header.
|
|
- Restart integration (retch): the watchdog returns exit code 124 and the JSON
|
|
"log" carries the description; a deployment that wants automated retries can
|
|
key off exitCode === 124 and re-post the same .inp.
|
|
- A future client change could surface TRIMSP_TMPROOT behind a shared
|
|
configuration; the browser path regex is derived from the same env var, so
|
|
both sides stay consistent. |