Update computational help for production and add the worker manifest

api/computations/store.py

@@ -47,7 +47,7 @@ class SubmissionCapacityError(RuntimeError):
 def _enforce_submission_budget(cur, *, user_id: str, project_id: str, cluster_name: str) -> None:
     allowed = {value.strip() for value in os.getenv("RCAC_ALLOWED_PROJECT_IDS", "").split(",") if value.strip()}
     if allowed and project_id not in allowed:
-        raise PermissionError("Computations are restricted to the approved pilot project")
+        raise PermissionError("Computations are not enabled for this project")
     per_user = int(os.getenv("RCAC_MAX_ACTIVE_RUNS_PER_USER", "0"))
     per_cluster = int(os.getenv("RCAC_MAX_ACTIVE_RUNS_PER_CLUSTER", "0"))
     if per_user < 0 or per_cluster < 0:
@@ -65,7 +65,7 @@ def _enforce_submission_budget(cur, *, user_id: str, project_id: str, cluster_na
     )
     counts = cur.fetchone()
     if (per_user and counts["user_count"] >= per_user) or (per_cluster and counts["cluster_count"] >= per_cluster):
-        raise SubmissionCapacityError("Pilot run limit reached; wait for an active run to finish")
+        raise SubmissionCapacityError("Run limit reached; wait for an active run to finish")
 
 
 def feature_enabled() -> bool:

geddes/k8s/10-computation-worker.yaml

@@ -0,0 +1,103 @@
+# RCAC computation worker for the production platform (ncn-digitaltwins-zchen).
+# Deployed 2026-10-08. It polls computation_runs, calls the registered Globus
+# gateway on Negishi/Gautschi, and stores results; it serves no traffic.
+#
+# Needs, in the same namespace:
+#   configmap dt-computation-config      RCAC_* and GLOBUS_COMPUTE_* settings
+#                                        (also loaded by dt-api via envFrom)
+#   secret dt-globus-confidential-client client-secret (also mounted in dt-api)
+#   secret dt-computation-materials-project api-key
+#   secret dt-api-secret                 PG_* including PG_WORKER_USER/PASS
+#
+# Roll out a new release after dt-db-migrate and dt-api:
+#   kubectl -n ncn-digitaltwins-zchen set image deployment/dt-computation-worker \
+#     worker=geddes-registry.rcac.purdue.edu/sdx/dt-computation-worker:<tag>@<digest>
+# Turn computations off: set RCAC_COMPUTE_ENABLED=false in dt-computation-config,
+# restart dt-api and this worker (cancel active runs first; see
+# RCAC_SIM2L_INTEGRATION.md, Rollback).
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: dt-computation-worker-data
+  namespace: ncn-digitaltwins-zchen
+  labels:
+    app: dt-computation-worker
+spec:
+  accessModes: ["ReadWriteOnce"]
+  storageClassName: geddes-standard-singlenode
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dt-computation-worker
+  namespace: ncn-digitaltwins-zchen
+  labels:
+    app: dt-computation-worker
+spec:
+  # One replica on purpose: Postgres leases protect each run, and one poller
+  # keeps Slurm status queries to one per cluster per cycle.
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: dt-computation-worker
+  template:
+    metadata:
+      labels:
+        app: dt-computation-worker
+    spec:
+      imagePullSecrets:
+      - name: sdx-registry-secret
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+      containers:
+      - name: worker
+        image: geddes-registry.rcac.purdue.edu/sdx/dt-computation-worker:computational-e543b59@sha256:dd413aef311189be1a3bee60a262c1e0b81206f94e3078afd7a441b643aaafcc
+        args: ["python", "-m", "computations.worker", "--poll-seconds", "30"]
+        envFrom:
+        - configMapRef:
+            name: dt-computation-config
+        env:
+        - name: USE_MOCK_DATABASE
+          value: "false"
+        - name: PG_HOST
+          valueFrom: {secretKeyRef: {name: dt-api-secret, key: PG_HOST}}
+        - name: PG_PORT
+          valueFrom: {secretKeyRef: {name: dt-api-secret, key: PG_PORT}}
+        - name: PG_DB
+          valueFrom: {secretKeyRef: {name: dt-api-secret, key: PG_DB}}
+        - name: PG_USER
+          valueFrom: {secretKeyRef: {name: dt-api-secret, key: PG_USER}}
+        - name: PG_PASS
+          valueFrom: {secretKeyRef: {name: dt-api-secret, key: PG_PASS}}
+        # Background role: not superuser, not BYPASSRLS.
+        - name: PG_WORKER_USER
+          valueFrom: {secretKeyRef: {name: dt-api-secret, key: PG_WORKER_USER}}
+        - name: PG_WORKER_PASS
+          valueFrom: {secretKeyRef: {name: dt-api-secret, key: PG_WORKER_PASS}}
+        - name: MATERIALS_PROJECT_API_KEY
+          valueFrom: {secretKeyRef: {name: dt-computation-materials-project, key: api-key}}
+        resources:
+          requests: {cpu: 100m, memory: 512Mi}
+          limits: {cpu: "1", memory: 2Gi}
+        volumeMounts:
+        - {name: globus, mountPath: /run/globus, readOnly: true}
+        - {name: worker-data, mountPath: /var/lib/dt-computation-worker}
+        - {name: worker-tmp, mountPath: /tmp}
+      volumes:
+      - name: globus
+        secret:
+          secretName: dt-globus-confidential-client
+          defaultMode: 0440
+      - name: worker-data
+        persistentVolumeClaim:
+          claimName: dt-computation-worker-data
+      - name: worker-tmp
+        emptyDir: {}

web/components/computational-faq.tsx

@@ -43,7 +43,7 @@ export function ComputationalFaq() {
           question: "Where do I start?",
           keywords: "login sign in nanoHUB Purdue VPN Rushik Justin RCAC-PILOT project access",
           answer: <>
-            <p>Sign in with your own nanoHUB account, open <Link href="/projects" className={linkClass}>Projects</Link>, and select your assigned project. Rushik and Justin use <strong>Computational Student Pilot (RCAC-PILOT)</strong> on the private pilot site, reached from Purdue’s network or VPN.</p>
+            <p>Sign in with your own nanoHUB account, open <Link href="/projects" className={linkClass}>Projects</Link>, and select a project where you are the PI or a member.</p>
             <p>On the project page, find <strong>Registered computational experiments</strong>. You can also click <strong>New RCAC Run</strong> beside a computational process step to open the form with its tool selected.</p>
           </>,
         },
@@ -72,7 +72,7 @@ export function ComputationalFaq() {
           keywords: "researcher student member owner administrator role permissions viewer PI forbidden restricted approved pilot project",
           answer: <>
             <p>No. <strong>Researcher</strong> is the normal student platform role. To submit or cancel a calculation, you must be a <strong>PI</strong> or <strong>member</strong> of the project; platform Administrators can also submit. A viewer of an open project can see its runs but cannot submit. <strong>Administrator</strong> is the highest platform role, used for managing users, registrations, and other platform settings.</p>
-            <p>In this pilot, calculations can be submitted only in <strong>Computational Student Pilot (RCAC-PILOT)</strong>. Other projects show “Computations are restricted to the approved pilot project.” You do not need to provide an RCAC password or SSH key in the run form.</p>
+            <p>Any project where you are the PI or a member can submit calculations. You do not need to provide an RCAC password or SSH key in the run form.</p>
           </>,
         },
         {
@@ -104,7 +104,8 @@ export function ComputationalFaq() {
           question: "What values can I use for my first pilot check?",
           keywords: "example defaults silicon graphene mp-149 mp-48 30 180 20 vacuum 1e-8 1e-4 pressure",
           answer: <>
-            <p>The 3D column is the explicit small silicon workflow check; the 2D column gives the current graphene pilot defaults. These examples exercise the workflow. Establish convergence-tested settings for your scientific comparisons.</p>
+            <p><strong>The form defaults and these examples are for testing the workflow, not for research results.</strong> They have not been convergence-tested for any material. Before you compare or publish results, test the cutoff and k-points for your own system.</p>
+            <p>The 3D column is the small silicon workflow check; the 2D column gives the current graphene defaults.</p>
             <div className="max-w-full overflow-x-auto rounded-lg border border-[hsl(var(--border))]">
               <table className="w-full min-w-[30rem] text-left text-xs sm:text-sm">
                 <caption className="sr-only">Input values for the first 3D silicon and 2D graphene pilot checks</caption>
@@ -149,7 +150,7 @@ export function ComputationalFaq() {
           answer: <>
             <p>Select one of the available clusters in <strong>RCAC cluster</strong>, review your inputs, and click <strong>Submit</strong> once. Negishi and Gautschi are available in the pilot. The selector shows each installation’s Quantum ESPRESSO version; record it when comparing results across clusters.</p>
             <p>An accepted request appears in the run list below the form. It may wait in Slurm’s queue before running.</p>
-            <p>The pilot allows at most <strong>two active runs per person</strong> and <strong>one active run per cluster</strong>, counted across everyone in the pilot. If another student’s run is active on Negishi, choose Gautschi or wait. When a limit is reached, the form shows “Pilot run limit reached; wait for an active run to finish.” If no cluster is ready, contact Navid.</p>
+            <p>The platform allows at most <strong>two active runs per person</strong> and <strong>four active runs per cluster</strong>, counted across everyone. If a cluster is full, choose the other cluster or wait. When a limit is reached, the form shows “Run limit reached; wait for an active run to finish.” If no cluster is ready, contact Navid.</p>
           </>,
         },
         {
@@ -186,7 +187,7 @@ export function ComputationalFaq() {
           question: "Can I choose cores, nodes, memory or walltime?",
           keywords: "resources cores ranks MPI nodes memory walltime time limit concurrent strain calculations allocation MaxRSS ReqMem",
           answer: <>
-            <p>Yes, within this pilot’s limits. Under <strong>Computational resources</strong> the form shows each cluster’s allowed range and default, and which controls that cluster offers. Leave a field blank to use the default.</p>
+            <p>Yes, within the platform’s limits. Under <strong>Computational resources</strong> the form shows each cluster’s allowed range and default, and which controls that cluster offers. Leave a field blank to use the default.</p>
             <ul className="list-disc space-y-2 pl-5">
               <li><strong>MPI ranks (CPU cores):</strong> 1 to 64 per calculation, or per ElasticDFT strain calculation. Each rank uses one CPU core. Default 64.</li>
               <li><strong>Nodes:</strong> fixed at one. The pilot does not run multi-node calculations, so the form does not offer them.</li>