Milestone 0: close the parser RCE, fix silent wrong answers, add a test net

[rudimk]

Reviews the Sisyphus plan against the code, then implements Milestone 0.

Why this is urgent

parse_expr eval()s its transformed input, and attribute access passes straight through. An ordinary-looking equation value reaches the Python object graph and runs arbitrary code. Verified end-to-end against the tool on main:

equation = 'sqrt.__globals__["__builtins__"]["__import__"]("os").getpid()'
→ {"solution": {"value": 7172.0}, ...}   # that's the server's PID

The SSE transport binds 0.0.0.0:4242 with no auth, so on an exposed instance this is pre-auth RCE, reachable from any prompt an LLM can be talked into emitting.

Every published v0.1.0 binary has this. They are still on the releases page. Cutting a replacement release is tracked in M6 and is not part of this PR.

The plan's prescribed remediation (size limit + restricted local_dict) was measured and does not work — local_dict alone and global_dict={} plus a curated local_dict both still execute the payload, because the escape is attribute traversal off whatever SymPy object is in scope, not name resolution. A size cap is moot; the payload is 60 characters.

What actually fixes it

guard.py parses the normalized code SymPy is about to evaluate and walks it against an AST allowlist — Attribute, Subscript, keyword args and non-whitelisted Call are rejected — then evaluates.

Ordering is load-bearing. An allowlist applied to the raw string rejects x^2 (a BitXor node) and 2x (a SyntaxError) — the very syntax LLMs emit and that normalization exists to accept. The pipeline is normalize → AST-guard → parse, and there is a test pinning that ordering.

Exponent towers and oversized exponents are rejected separately: 10**10**8 is pure arithmetic that any syntax-only filter passes, and it exhausts memory on eval.

Silent wrong answers

The a == 0 check only caught polynomials with no linear term, so anything with one was mis-solved without an error:

Input	On main	Here
x**2 + x = 4	1.5615… — one of two roots, with a fabricated linear derivation	error: not_linear
x**3 - 2*x = 0	0.0, silently dropping ±sqrt(2)	error: not_linear

Back-substitution cannot catch this — the returned root does satisfy the equation. Only a degree check does, so degree is now asserted before solving. This is the sharp edge of the guardrail the project is built on: verification proves soundness, not completeness.

Also fixed

• Exact values. solution.value is the exact form as a string with float_value alongside, so 3*x = 1 gives "1/3" rather than 0.3333333333333333, and I*x = 1 returns "-I" instead of raising TypeError: Cannot convert complex to float.
• Typed outcomes. solved | no_solution | infinite_solutions | error, discriminated by outcome. x = x + 1, x = x and an unknown variable were all IndexError: list index out of range before. Both envelope changes land together so clients break once, not twice.
• Coherent steps. Generated from the operations actually performed, so a label can no longer contradict the equation printed beside it (2*x + 3 = 7 said "Add 4 to both sides"), and the symbolic-form line no longer renders SymPy's Eq(...) repr.
• Parametric input. a*x + b = c raised TypeError: cannot determine truth value of Relational from a sign comparison in step generation. Sign now comes from SymPy's tri-state assumptions, and unknown sign gets neutral phrasing.
• Wall-clock timeout. A thread cannot be cancelled, so the old executor could time out the caller but never the work. Solving runs in a reusable spawned worker that is killed and replaced on overrun. Verified inside the frozen PyInstaller binary — a 17s input with a 3s budget returned a timeout outcome in 4.7s with no fallback.
• asyncio.to_thread replaces the deprecated get_event_loop pattern; logging is scoped to this package instead of setting the root logger to DEBUG; errors no longer forward raw Python exception text to clients.

Three things surfaced while implementing

• pipenv install --dev silently upgraded fastmcp 2.3.3 → 3.4.5, a different API whose wheel resolves to a fastmcp_slim namespace package with no Client. Adding a test runner shouldn't ship a major runtime upgrade, so fastmcp is pinned to ==2.3.3 — what the committed lock already had. Upgrading is its own task.
• The first timeout draft charged worker startup to the request budget, so a cold first request would time out at any sensible setting. Fixed with a readiness handshake; a test asserts a 2s budget survives a cold worker.
• implicit_multiplication_application bundles split_symbols, which rewrites factorial(9) into 9*a**2*c*f*i*l*o*r*t and solves that. Quietly answering a different question is the exact failure this project exists to avoid, so it is replaced with plain implicit_multiplication; unknown function names are now parse errors. 2x and x^2 still normalize.

Tests

74 tests, green. Happy paths pin the full step list, not just the value — a suite that checks only value passes even when every label is wrong, which is how the mislabelling survived. tests/test_sandbox.py drives real worker processes and really kills them; a mocked worker would prove nothing about a mechanism that exists because the work can't be interrupted from inside.

One thing this PR does not deliver

The CI test job is written but not installed. Pushes touching .github/workflows/ need GitHub's workflow scope, which the authoring session's token lacked, and the contents API returns 404 for the same reason. It is parked at ci/test-workflow.yml with ci/README.md giving the two commands to move it into place, and the M0 checkbox is left unticked. Until someone runs that git mv, nothing runs the suite automatically — build.yml still triggers only on tag pushes.

Note on scope

README and docs/ example outputs were regenerated from the working code. That is nominally M7, but this PR changes the tool contract and leaving docs describing the removed schema would be worse than the scope creep. The false "non-linear input raises ValueError" claim in docs/ and CLAUDE.md was M0's to fix and is corrected.

---

Generated by Claude Code