[aaronphifer]

Summary

VariaQ 0.7.0 adds the first optional local, self-hosted research interface while keeping VariaQ authoritative for storage, planning, solving, analysis, and reporting.

• shared VariaQService application layer over existing VariaQ subsystems
• versioned local API under /api/v1
• Dashboard, Problems, Runs, Campaigns, Analysis, Reports, and Capabilities views
• plan-first, bounded local campaign execution with one in-process task
• responsive desktop, laptop, and mobile layouts
• provenance for campaigns, runs, reruns, reports, and source-run counts
• safe report downloads restricted to known VariaQ artifacts beneath the configured report root
• loopback default (127.0.0.1) with a prominent warning for non-loopback binds
• optional [web] dependencies; Node.js is not required at runtime

The browser does not read SQLite, implement campaign planning, generate reports, run solvers, or duplicate scientific calculations. Objective, expectation, BQM energy, feasible samples, infeasible samples, and status remain distinct. This release adds no physical-QPU or remote-provider support and makes no quantum-advantage claim.

Security model

The UI is local-first, has no authentication, and is not hardened for direct public-internet exposure. Report artifact downloads enforce known-report lookup, exact exporter filename forms, configured-root containment, absolute/traversal rejection, and symlink containment. Capability, dashboard, and campaign-plan reads do not persist scientific records or problem/report files.

Verification

• 178 tests passed
• ruff check . passed
• ruff format --check . passed (94 files already formatted)
• python -m build passed
• built variaq-0.7.0.tar.gz and variaq-0.7.0-py3-none-any.whl
• fresh wheel installed with [web]; version, CLI help, loopback server, capabilities API, dashboard, problems/runs pages, templates, CSS, JavaScript, and vendored Chart.js verified
• report-security regression passed: valid artifact, unknown report, unknown prefixed artifact, traversal, absolute/outside-root path, and symlink escape
• capability-read-only regression passed with unchanged problems, runs, campaigns, campaign links, problem files, and report files
• Node syntax checks passed; Node is not required by the packaged runtime
• browser visual QA completed in Chromium 151 at desktop, laptop, and 390 px mobile widths, including empty/error states, long IDs, failed/unavailable and quantum/classical runs, analysis, reports, capabilities, keyboard, focus, and accessibility behavior
• security diff review completed with no reportable findings

Known 0.7 limitations

• campaign task state is in-process and lost on server restart
• no authentication or public-internet hardening
• analysis is primarily presented inside campaign detail
• chart interaction remains modest
• upstream FastAPI/Starlette/CUDA-Q warnings remain
• Graph Partition quantum support is not advertised

No PyPI publication is part of this PR.