bug fix

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -33,5 +33,8 @@ jobs:
       - name: Install dependencies
         run: uv sync --frozen --dev
 
-      - name: Run test suite
-        run: uv run pytest
+      - name: Run linter
+        run: uv run ruff check .
+
+      - name: Run test suite with coverage
+        run: uv run pytest --cov=src --cov-report=term-missing --cov-fail-under=70

AGENTS.md

@@ -1,15 +1,22 @@
 
-# MathStudio — Agent Guidelines
+# MathWeave Studio — Agent Guidelines
 
 ## Project goals
-Build a cross-platform mathematics learning application using
-Python 3.14+, NiceGUI, SymPy, NumPy and Plotly.
+Build a cross-platform mathematics learning and research application using
+Python 3.14+, NiceGUI, SymPy, NumPy, and Plotly.
 
 ## Architecture
-- Follow Clean Architecture with clear dependency boundaries.
+- Follow Clean Architecture with clear dependency boundaries:
+  - `domain`: Pure business rules, enums, exceptions, and immutability models (no framework dependencies).
+  - `application`: Use cases (`SolveProblemUseCase`), ports (`Solver`, `SolverRegistry`, `Verifier`), and typed DTOs.
+  - `input`: AST-based validation, parser, and whitelist security bounds.
+  - `solvers`: Pure mathematical solvers (calculus, algebra, linear algebra).
+  - `verification`: Independent symbolic and numerical verifiers.
+  - `rendering`: LaTeX and MathML converters.
+  - `presentation`: NiceGUI UI components, services, and layout.
 - UI must call application use cases, never solvers directly.
-- Keep domain and solver code independent of NiceGUI and Plotly.
-- Use typed DTOs at application boundaries.
+- Keep domain, input, and solver code strictly independent of NiceGUI and Plotly.
+- Use typed DTOs (`ProblemRequest`, `SolutionResponse`, `VerificationResult`, `SolutionStep`) at application boundaries.
 - Prefer simple composition over unnecessary inheritance.
 - Add abstractions only when they solve a concrete problem.
 
@@ -20,6 +27,7 @@ Python 3.14+, NiceGUI, SymPy, NumPy and Plotly.
 - Use exact arithmetic where possible.
 - Verify results independently with SymPy or mathematical invariants.
 - If a step cannot be justified, report that limitation honestly.
+- Verification failures must never be reported as successful verification.
 
 ## Development workflow
 - Inspect the existing code before making changes.
@@ -29,9 +37,17 @@ Python 3.14+, NiceGUI, SymPy, NumPy and Plotly.
 - Do not add dependencies without explaining why.
 - Never delete user data or run destructive commands without approval.
 
+## Common commands
+- Sync environment: `uv sync`
+- Launch app: `uv run python run.py`
+- Run test suite: `uv run pytest`
+- Run coverage: `uv run pytest --cov=src --cov-report=term-missing`
+- Lint code: `uv run ruff check .`
+- Build package: `pyinstaller mathweave-studio.spec`
+
 ## Testing
-- Add tests for every new solver and transformation rule.
-- Include valid inputs, invalid inputs and boundary cases.
+- Add tests for every new solver, verifier, and transformation rule.
+- Include valid inputs, invalid inputs, boundary cases, and adversarial denial-of-service cases.
 - Run relevant tests after every change.
 - Run the full test suite before declaring a task complete.
 - Report commands executed and any tests that could not run.

CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.0] - 2026-10-23
+
+### Added
+- **Equation Solver**: Implemented algebraic equation solving (`SOLVE_EQUATION`) with standard form transformation, root finding, factor display, and independent root verification.
+- **Process Isolation & Hard Timeouts**: Added robust OS worker process isolation (`multiprocessing.Process` via `spawn`) with hard termination on configurable timeout for CPU-bound symbolic calculations.
+- **Expression Complexity Hardening**: Added AST node count bounds, constant magnitude limits, logarithmic power magnitude guards, and strict prevention of nested exponent towers (e.g. `x**(9**9**9)`, `9**9**9**9`).
+- **HTML Sanitization**: Added explicit HTML escaping in mathematical view fallback rendering to prevent script and event-handler injection.
+- **Independent Verifier Tests**: Added dedicated unit test suites for `IntegralVerifier` and `SurfaceAreaVerifier`.
+- **Release Readiness**: Added `SECURITY.md`, `CONTRIBUTING.md`, `.github/dependabot.yml`, and configured Ruff linter quality gates in CI.
+
+### Security
+- **certifi upgrade**: Verified and remediated `PYSEC-2026-4320` by updating `certifi` from `2026.7.22` to `2026.10.23` in `uv.lock`.

CONTRIBUTING.md

@@ -0,0 +1,61 @@
+# Contributing to MathWeave Studio
+
+Thank you for your interest in contributing to MathWeave Studio! This guide describes how to set up the development environment, follow repository conventions, and submit contributions.
+
+## Code of Conduct & Architectural Principles
+
+MathWeave Studio adheres to Clean Architecture and strict mathematical correctness:
+
+1. **Clean Architecture Boundaries**:
+   - `domain`: Pure business models, immutability, enums, and exceptions.
+   - `application`: Use cases, solver/verifier interfaces, and typed DTOs.
+   - `input`: AST-based validation and parsing with strict whitelists and complexity bounds.
+   - `solvers`: Pure mathematical solvers (calculus, algebra, linear algebra).
+   - `verification`: Independent symbolic and numerical verifiers.
+   - `rendering`: LaTeX and MathML rendering.
+   - `presentation`: NiceGUI components and user interface.
+   - Domain and solver code must **never** import or depend on NiceGUI or Plotly.
+
+2. **Mathematical Correctness**:
+   - Never invent a mathematical rule or step.
+   - Distinguish the final result from the derivation steps.
+   - Preserve domain restrictions and relevant assumptions.
+   - Use exact arithmetic where feasible.
+   - Verify results independently using invariants or alternative mathematical methods.
+
+## Development Setup
+
+The project uses `uv` for fast, reproducible dependency management and Python 3.14+.
+
+```bash
+# 1. Clone repository
+git clone https://github.com/TqvNoCode/math_app.git
+cd math_app
+
+# 2. Sync virtual environment and dependencies
+uv sync
+
+# 3. Launch application in development mode
+uv run python run.py
+```
+
+## Running Tests and Linting
+
+Before submitting a Pull Request, ensure that all automated checks pass:
+
+```bash
+# Run full automated test suite
+uv run pytest
+
+# Run tests with coverage report
+uv run pytest --cov=src --cov-report=term-missing
+
+# Run code linter
+uv run ruff check .
+```
+
+## Pull Request Guidelines
+
+1. Keep PRs focused on a single feature, bug fix, or mathematical rule.
+2. Include unit tests covering valid inputs, invalid inputs, and boundary cases.
+3. Verify that regression suites and Clean Architecture boundaries remain intact.

SECURITY.md

@@ -0,0 +1,36 @@
+# Security Policy
+
+## Supported Versions
+
+MathWeave Studio is under active development. Security updates are applied to the latest stable release line.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.1.x   | :white_check_mark: |
+| < 0.1.0 | :x:                |
+
+## Reporting a Vulnerability
+
+We take the security of MathWeave Studio seriously. If you discover a security vulnerability, we appreciate your help in disclosing it responsibly.
+
+### How to report
+
+1. **Do not disclose the issue publicly** in open GitHub issues, pull requests, or public forums.
+2. Please report security issues via GitHub's **Private Vulnerability Reporting** feature on the repository:
+   - Navigate to the repository's **Security** tab.
+   - Select **Report a vulnerability**.
+3. Alternatively, if private vulnerability reporting is unavailable, reach out to the project maintainers via the email address listed in `pyproject.toml` (`92263302+TqvNoCode@users.noreply.github.com`).
+
+### Information to include in your report
+
+To help us investigate and triage effectively, please include:
+- A clear description of the vulnerability and its potential impact.
+- Step-by-step instructions or a minimal Proof of Concept (PoC) expression/input demonstrating the issue.
+- Operating system, Python version, and dependency versions.
+- Any suggested remediation or patch if available.
+
+### Handling and resolution process
+
+- Maintainers will acknowledge receipt of the report and review the vulnerability in an isolated environment.
+- If verified, a patch will be developed, tested against regression suites, and published in a subsequent release.
+- A security advisory will be published upon release crediting the reporter if desired.

pyproject.toml

@@ -32,4 +32,34 @@ module-name = "math_app"
 dev = [
     "pyinstaller>=6.22.3",
     "pytest>=8.0.0",
+    "pytest-cov>=7.1.0",
+    "ruff>=0.17.2",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+python_files = ["test_*.py"]
+addopts = "-ra --strict-markers"
+
+[tool.ruff]
+line-length = 120
+target-version = "py314"
+
+[tool.ruff.lint]
+select = ["E", "F", "W"]
+ignore = ["E501"]
+
+[tool.ruff.lint.per-file-ignores]
+"run.py" = ["E402"]
+
+[tool.coverage.run]
+source = ["src"]
+omit = ["*/__pycache__/*"]
+
+[tool.coverage.report]
+exclude_lines = [
+    "pragma: no cover",
+    "if TYPE_CHECKING:",
+    "raise NotImplementedError",
+    "if __name__ == .__main__.:",
 ]

src/math_app/__init__.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 try:
-    from importlib.metadata import PackageNotFoundError, version
+    from importlib.metadata import version
 
     __version__ = version("mathweave-studio")
 except Exception: