@vela-science/canopus 0.4.0-rc.1

package/CHANGELOG.md

@@ -0,0 +1,249 @@
+# Changelog
+
+## 0.4.0-rc.1 - Unreleased
+
+- Require the live Linux custody fixture to pass the exact deterministic Codex
+  sandbox boundary before it reads staged authentication or makes a model call.
+  Nested guests that cannot install seccomp fail with a native-Ubuntu/WSL2
+  recovery action instead of spending a model call. Failed live runs retain
+  only bounded event-type counts, boolean verdicts, and content hashes; the
+  harness independently verifies an exact shell sentinel rather than trusting
+  the model's report.
+- Pin every GitHub Action by immutable commit and move checkout, Node setup,
+  and pnpm setup to their maintained Node 24 majors, removing the hosted
+  Node 20 compatibility shim from the candidate's platform matrix.
+- Make the package self-contained from a clean source checkout: `prepack`
+  rebuilds `dist`, the npm-valid `canopus` bin entry survives publication, and
+  `publishConfig` requires public access with provenance. Pack and publish dry
+  runs now reject a package that silently drops the CLI.
+
+## 0.3.0 - 2026-07-17
+
+- Add the compact `doctor`, `run`, `inspect`, `replay`, and explicit `withdraw`
+  product workflow over Vela 0.901.0 while retaining Mission v1 as the advanced
+  portable interface.
+- Advance the exact product and hosted-integration pin to Vela 0.901.0.
+  Historical
+  Mission replay remains exact to its recorded Vela version and binary root.
+- Bind the first Vela producer offer and reject silent target skipping, dirty source,
+  root drift, missing runtimes, missing verifier images, and cloud-synced output
+  paths before a worker call.
+- Package the two exact Erdős 1056 verifier capsules, removing the installed
+  product's cross-compiler dependency while retaining verifier source.
+- Preserve raw worker events, final output, stderr, candidate, run record, and a
+  content-addressed evidence manifest. A successful landing fast-forwards the
+  local source only after clean-clone reproduction and never pushes a remote.
+- Replay the released range `10428008..10428200` with byte-equivalent output and
+  50,254 observed tokens, down from 187,013.
+- Complete the adjacent range `10428201..10428400` with 48,088 observed tokens,
+  an independently reproduced bounded-negative artifact, Receipt root
+  `sha256:6010cf159e7ee5d7867a6553b9f44eb5a1b153f87c38f09b9505d5656a943373`,
+  route `defer`, accepted-event delta zero, and matching clean-clone replay.
+- Verify the protected rejection of Erdős proposal `vpr_f54338a5a453c1bf`
+  read-only: the signed decision is present, the other twelve proposals remain
+  pending, and canonical replay agrees. The final protected rebind, unchanged
+  root audit, and released Vela binary pin all pass.
+- Add ADR 0005 and proposal-scoped withdrawal capabilities. After a deferred
+  landing and clean-clone reproduction, retain only the Receipt-bound agent
+  seed under `~/.canopus/capabilities/<proposal-id>/`; never expose it to the
+  worker, verifier, or run evidence. `canopus withdraw` verifies in a
+  disposable clone, proves accepted-state neutrality, fast-forwards the clean
+  source, and consumes the secret. The capability binds the successful run's
+  exact strict baseline and verifies Vela-canonical proposal/Receipt roots plus
+  the Receipt identity's self-signature.
+- Target Vela 0.901.0 for protected one-proposal human decisions and the
+  signed, non-scientific `proposal.withdrawn` lifecycle event.
+- Complete four custody-isolated first-party cold-use diagnostics on the exact
+  released product and rendered site: operator, producer, reviewer, and reader
+  all pass without authority attempts, workspace escape, target substitution,
+  authentication exposure, or checkout drift. These sessions earn no
+  independent or scientific credit.
+
+## 0.2.0 - 2026-07-16
+
+- Accept ADR 0004 and add Mission v1 preparation, validation, inspection,
+  exact strict-debt registration, native tool worker, separate container
+  verifier, and the first-ranked Erdős 1056 k=15 bounded-search capsule.
+- Run the exact native Codex CLI with a bundled default-deny macOS permission
+  profile and a target-packet-only workspace. Disable browser, search, MCP,
+  apps, memories, computer use, delegation, plugins, goals, hooks, and human-key
+  surfaces.
+- Add live hostile custody and verifier fixtures. The custody fixture proves
+  shell execution while denying authentication, host canary, unrelated-repo,
+  outside-write, command-network, and process-environment access. The verifier
+  fixture denies network, writes, and host-home visibility.
+- Bind the native permission profile, engine-output schema, Codex binary,
+  verifier capsule and image, target packet, Vela binary, Git roots, frontier
+  roots, budgets, and exact strict blocker set into the portable bundle.
+- Publish exactly the frozen source artifacts in one unsigned non-authoritative
+  Git commit before `vela land`, keeping `vela.lock` and clean Git replay
+  self-contained.
+- Complete the real first-ranked mission with an independently verified bounded
+  negative result, Receipt root
+  `sha256:be2b34b57eac8a41d689f411d9dc1c97328a7901f943bb1cc023c843adc672bf`,
+  route `defer`, accepted-event delta zero, and matching clean-clone replay.
+- Preserve safe failed attempts as non-authoritative evidence. No failed or null
+  result is promoted as scientific success.
+
+## 0.1.11 - 2026-07-16
+
+- Preserve the Stage A v5 measurement stop without editing or pooling its
+  result. The completed cell passed the hard safety boundary and stopped only
+  because raw substring comparison treated `HEAD^{tree}` and
+  `HEAD''^{tree}` as different command reports.
+- Add a finite command-trace parser that unwraps shell `-c` scripts, splits
+  command boundaries, normalizes shell quoting, and requires one exact argv
+  match. Paths, omissions, reordering, substitutions, and substrings remain
+  different.
+- Freeze hostile comparison vectors and Stage A v6 registration root
+  `sha256:1c79221f5118ca08c62988e1d95f349ea682d2411371c97d10105d415d1935b4`
+  before another model call.
+- Add Proposed ADRs for preregistered cold-use measurement and the future
+  independent handoff runner. Neither ADR changes Vela authority or grants
+  independent credit.
+- Retain the exact-tag Stage A v6 stop after two cells. Producer/timeless passed
+  with zero defects. Reviewer/temporal preserved hard safety but reported
+  executable path aliases and `<branch>` placeholders rather than exact
+  commands, so the registered argv scorer stopped on
+  `reported_command_trace`. No further Stage A or Stage B cell was run.
+
+## 0.1.10 - 2026-07-16
+
+- Advance the cold-use fixture and released-binary composition gate to Vela
+  `v0.800.22`, the immutable-event-transaction correction.
+- Retain the exact v0.1.9 producer hard stop: one eligible first-party cell
+  completed the pending `work` and `land` route but found that Vela `v0.800.21`
+  had rewritten all three preexisting event files. No authority action, human
+  key access, accepted-state change, or unsigned strict pass occurred.
+- Register a new Stage A iteration only after the product fix, with the fixture
+  facts, prompts, answer contract, scorer semantics, direct Codex CLI, and
+  outer sandbox unchanged.
+- Retain the exact-tag Stage A v5 stop: one producer/timeless cell passed the
+  hard safety boundary and preserved all historical bytes, but the frozen
+  scorer rejected two truthful `HEAD^{tree}` command reports because Codex's
+  shell trace escaped the same token as `HEAD''^{tree}`. No post-run semantic
+  repair or additional benchmark cell was attempted.
+
+## 0.1.9 - 2026-07-16
+
+- Use the updated OpenAI-signed direct terminal Codex CLI `0.144.5` rather than
+  the older app-bundled `0.144.2` binary.
+- Remove the redundant Codex product sandbox from inside Canopus's registered
+  macOS outer sandbox. Codex's external-sandbox mode is used only inside that
+  bounded profile, which remains the filesystem and task-network authority.
+- Retain the v0.1.8 one-call nested-sandbox failure as ineligible
+  infrastructure evidence: it performed no command, authority action,
+  historical rewrite, accepted-state change, or semantic repair.
+
+## 0.1.8 - 2026-07-16
+
+- Open Stage A v3 after v2 reached Codex but failed DNS resolution before any
+  provider response or scored cell.
+- Reuse the DNS/TLS runtime file set from Canopus's proven tool-free outer
+  sandbox and add a no-model `chatgpt.com` DNS check to the four-cell preflight.
+- Preserve the frozen Vela fixture, task prompts, answer contract, scoring
+  semantics, custody boundary, and all scientific and independence nonclaims.
+
+## 0.1.7 - 2026-07-16
+
+- Open Stage A v2 after v1 retained two zero-call controller infrastructure
+  failures: an unbound cell variable and a lexical `/tmp` versus real
+  `/private/tmp` sandbox path mismatch.
+- Bind both lexical and real workspace, HOME, and CODEX_HOME paths in the outer
+  sandbox, and add a four-cell sandbox preflight that performs no model call.
+- Preserve the frozen Vela fixture, task prompts, answer contract, scoring
+  semantics, custody boundary, and all scientific and independence nonclaims.
+
+## 0.1.6 - 2026-07-16
+
+- Repair the Stage A controller's pre-call cell binding after the first exact
+  execution stopped on a `ReferenceError` before any model session started.
+- Supersede the prior Stage A registration with a new root that records the one
+  allowed transport repair, zero prior model calls, and no remaining repair
+  cycle.
+- Preserve the frozen Vela `v0.800.21` bundles, prompts, scorer semantics,
+  custody boundary, and all scientific and independence nonclaims.
+
+## 0.1.5 - 2026-07-16
+
+- Advance the active released-binary gate to Vela `v0.800.21`, commit
+  `2bbcf8323e53643fcaacb81137645fc757789073`, and published macOS arm64
+  SHA-256
+  `248665a9185e3ba4f0aad754f9b5b572480d5857ffe737ef6e466006d0cf83c6`.
+- Freeze matched timeless and temporal actor-registration bundles with exact
+  Git, event-log, registry, and hostile-case roots. The released terminal
+  ceremony adds one audit event while preserving every preexisting event file
+  byte-for-byte.
+- Register a four-cell fresh Codex Stage A controller with bounded filesystem
+  access, no task-network access, no human key, exact prompt/tool/transcript
+  roots, fail-closed scoring, and zero model calls before registration.
+- Preserve the Vela authority boundary. The fixture, controller, and future
+  first-party sessions are diagnostic and carry no scientific, human,
+  independent, external, causal, or authority credit.
+
+## 0.1.4 - 2026-07-16
+
+- Advance the active released-binary composition gate to public Vela
+  `v0.800.20`, commit
+  `06ca1712573d735263c869fb20c7a3c4b54ce345`, and published macOS arm64
+  SHA-256
+  `d246aa29519f9f2a5d9a6b8b40d3cbe64334fe53d0d64556d03efba99ef1ae3e`.
+- Verify the unchanged Canopus producer, verifier, Receipt v1, Defer, and
+  clean-clone path against the temporal actor-registration release.
+- Preserve every existing authority and benchmark nonclaim. This compatibility
+  patch does not run the ADR 0005 cold-use benchmark or grant independent,
+  human, scientific, causal, or external credit.
+
+## 0.1.3 - 2026-07-16
+
+- Advance the active released-binary composition gate to public Vela
+  `v0.800.19`, including the exact published macOS arm64 checksum.
+- Keep the harness behavior and authority boundary unchanged: Canopus still
+  schedules bounded work, freezes artifacts, runs a separate verifier, and
+  delegates Receipt v1 landing to released Vela without any signer surface.
+- Preserve the ADR 0004 Stage A benchmark as frozen `v0.800.17` evidence rather
+  than rewriting historical registration or result packets.
+
+## 0.1.2 - 2026-07-16
+
+- Target released Vela `v0.800.17` and add the bounded ADR 0004 Stage A
+  composition runner.
+- Consume six hash-pinned standards and Vela packets generated directly by the
+  public Vela references; Canopus schedules, isolates, records, and scores the
+  calls without owning dependency-standing or exact-lock semantics.
+- Complete four native Codex 0.144.5 cells with four safe completions, zero
+  defects, tool calls, authority attempts, child-falsity inferences, help
+  requests, or interventions.
+- Record directional compression only: the Vela profile used about half the
+  context bytes of the standards profile on both tasks while preserving the
+  same exact roots and statuses. At n=1 this is not a causal or scientific
+  result and promotes no new authority-bearing protocol primitive.
+
+## 0.1.1 - 2026-07-16
+
+- Replace `v0.1.0` as the active release because ambient Git configuration
+  automatically SSH-signed that annotated tag with a human key during an agent
+  session. The source commit itself was unsigned, and the signature never
+  entered Vela scientific authority, but using the key at all violated the
+  harness custody boundary.
+- Disable commit and tag signing in the working repository and publish this
+  patch from an explicitly unsigned commit and annotated tag.
+- Preserve the same checksum-pinned Vela `v0.800.15` composition behavior and
+  benchmark nonclaims.
+
+## 0.1.0 - 2026-07-16
+
+- Withdrawn as an active release because its annotated Git tag was
+  ambiently SSH-signed with a human key. Retained as transparent historical
+  evidence; use `v0.1.1`.
+- Introduce exact-root missions, bounded Codex and verifier lanes, immutable
+  artifacts, repair contracts, Receipt v1 mapping, and clean-clone replay.
+- Preserve engine and verifier manifests as Vela-bound evidence.
+- Add the registered inherited-state benchmark and an opt-in released-Vela
+  composition gate.
+- Isolate native Codex credential and version homes, and preserve only bounded,
+  redacted failure diagnostics plus output digests.
+- Publish the preregistered two-arm subagent proxy as `no_advantage`, while
+  preserving the native provider usage gate as open infrastructure evidence.
+- Keep signing, human decisions, policy, replay, and accepted state inside
+  Vela.

package/LICENSE-APACHE

@@ -0,0 +1,176 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vela contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,124 @@
+# Canopus
+
+Canopus is a bounded research runner over released Vela and Git interfaces. It
+selects an exact Vela work offer, gives a finite mission to a tool-enabled Codex
+worker, freezes the output, runs an independent verifier container, and may land
+a Receipt v1 through `vela land`.
+
+Canopus cannot sign, accept a proposal, or make a scientific decision. A
+verifier-passing landing remains `Deferred` or `pending_review` unless an
+already-signed Vela policy says otherwise. Removing Canopus does not change Vela
+replay or accepted state.
+
+## Product workflow
+
+Canopus 0.3 targets checksum-pinned Vela 0.901.0. Its ordinary path is:
+
+```bash
+canopus doctor /path/to/frontier
+canopus run /path/to/frontier --first
+canopus inspect latest
+canopus replay /path/to/run.json
+canopus withdraw /path/to/frontier --run latest --reason "superseded"
+```
+
+`doctor` discovers and binds Vela, Codex, Git, Docker, the clean frontier roots,
+the first Vela producer offer, and a registered verifier profile. It also runs
+the same generated-canary native custody preflight required by `run`; native
+Windows reports the WSL2 handoff instead of claiming mission readiness. `run`
+uses the first offer unless an exact registered target is requested. It refuses
+dirty frontiers, drifted binaries or roots, missing verifier images,
+cloud-synced output paths, and unregistered targets.
+`inspect latest` selects the newest completed or safely stopped run. Failed-run
+projections state whether landing was never attempted or whether retained
+landing-recovery evidence must be inspected; they never infer an unchanged
+frontier from process failure alone. Withdrawal's `latest` selector remains
+limited to completed, proposal-bearing runs.
+
+The native Codex worker runs under a bundled default-deny profile with only the
+target workspace and required compiler files exposed. macOS uses Seatbelt;
+Linux and WSL2 use Codex's Bubblewrap sandbox. Native Windows supports the
+read-only product surface and directs tool-using runs to WSL2 before creating
+run output or probing credentials. Open WSL2, enter the frontier through its
+Linux path, and rerun the same `canopus run` command there. Authentication,
+human keys, unrelated repositories, browser/search/MCP/app surfaces,
+delegation, and command network access remain outside the worker boundary. The
+verifier runs separately with network and writes denied.
+
+A successful landing creates unsigned local Git commits and fast-forwards the
+source checkout only after verifier success and clean-clone reproduction. It
+does not push a remote. Use `--no-land` for a diagnostic run that leaves the
+source frontier unchanged.
+
+Profiles are Defer-only by default. A profile can request the policy lane only
+when it includes a closed positive result contract and binds the full target
+packet, profile, verifier capsule, and result-contract roots into the Receipt.
+Canopus does not decide whether that work is admitted: released Vela evaluates
+the exact signed policy, and any route, root, result class, or accepted-state
+delta outside the frozen profile stops the run.
+
+After a pending landing reproduces, Canopus retains only the exact
+Receipt-bound producer seed needed to withdraw that one proposal. The
+capability never enters worker, verifier, or run evidence. Withdrawal is
+explicit, runs in a disposable exact-head clone, proves the accepted scientific
+projection unchanged, fast-forwards the clean source, and then deletes the
+secret. A later human decision also consumes the now-useless secret.
+
+The installed product contains only the current active producer profiles:
+
+- `erdos1056-k15-10428401-10428600`
+- `formal-erdos-505-test-dim-one`
+
+The Erdős capsule is a content-addressed static Linux binary for arm64 and
+x86-64. The formal capsule is a small reviewed shell edge over an immutable
+Linux-amd64 Lean image; Apple-silicon hosts bind Docker's exact amd64 emulation
+instead of relying on implicit platform selection.
+Completed and stopped profile registrations remain in Git and release evidence,
+not in default discovery or the installed package. The shared source and pinned
+build provenance remain available for reproducible rebuilding, but an installed
+product run does not require a cross-compiler.
+
+## Advanced and historical interfaces
+
+Mission v1 remains the portable interface for preparing and validating a frozen
+bundle:
+
+```bash
+canopus mission prepare path/to/draft.json \
+  --source /clean/frontier --output /new/bundle --vela /path/to/vela \
+  --codex /path/to/codex --verifier-image sha256:<image-root>
+canopus mission validate /new/bundle/mission.json
+```
+
+Closed profile v2 contracts have a separate advanced lifecycle:
+
+```bash
+canopus profile list
+canopus profile show erdos1056-k15-10428401-10428600
+canopus profile validate erdos1056-k15-10428401-10428600
+canopus profile pack erdos1056-k15-10428401-10428600 --output /new/profile-pack
+canopus profile validate formal-erdos-505-test-dim-one
+```
+
+Mission v0 and the stopped cold-use registrations remain available in Git for
+exact historical reproduction. Benchmark commands, compiled benchmark modules,
+registrations, and benchmark documentation are intentionally absent from the
+installed npm package.
+
+## Development
+
+Requires Node 22 or newer, pnpm 10, Vela 0.901.0, Codex CLI 0.144.6, and Docker.
+Linux and WSL2 also require Bubblewrap. On Ubuntu 24.04, follow OpenAI's
+[targeted AppArmor setup](https://developers.openai.com/codex/concepts/sandboxing#prerequisites)
+for `bwrap-userns-restrict`; Canopus never disables the global unprivileged
+user-namespace restriction or falls back to an unsandboxed worker.
+
+```bash
+pnpm install
+pnpm check
+pnpm pack --dry-run
+```
+
+See [run records](docs/RUN_RECORD.md) for evidence and publication semantics,
+[mission roles](docs/MISSIONS.md) for the bounded jobs, [ADR 0001](docs/adr/0001-harness-boundary-and-name.md)
+for the deletion test, and [release evidence](docs/RELEASES.md) for exact roots.

package/SECURITY.md

@@ -0,0 +1,35 @@
+# Security
+
+Report vulnerabilities privately through GitHub Security Advisories for
+`vela-science/vela-research-harness`.
+
+Canopus does not accept human signing keys. Do not place a human Vela key,
+provider credential, or unpublished scientific secret inside a run root.
+Successful runs scrub the isolated agent-key home, but operators remain
+responsible for deleting failed diagnostic runs and benchmark output.
+
+Agent-authored Git commits and tags must explicitly disable ambient signing
+(`commit.gpgSign=false`, `tag.gpgSign=false`) and verify that the resulting Git
+objects contain no signature. A repository-local configuration now disables
+both for this working copy. The withdrawn `v0.1.0` tag and some earlier
+pre-release implementation commits retain unintended human SSH signatures from
+ambient Git configuration as transparent historical evidence. Those
+signatures are not Vela authority, but agents must never create another one.
+
+The v0 isolation backend is macOS Seatbelt. Other platforms fail closed; they
+do not receive a permissive fallback.
+
+Mission v1 uses the exact native Codex CLI with a bundled default-deny Seatbelt
+profile on macOS or Bubblewrap profile on Linux and WSL2. Only the target packet
+is writable and command-readable.
+The runtime authentication copy, sealed source checkout, Vela home, host home,
+host canary, and unrelated repositories must remain outside that boundary.
+Every run performs a deterministic custody preflight; the live hostile fixture
+also proves shell execution while denying credential reads, command network,
+outside writes, and auth-bearing process environment.
+
+The verifier is a separate digest- and platform-pinned Linux container with no
+network and no writable persistent mount. Its manifest records Docker, the
+read-only root, exact read-only binds, dropped capabilities, and denied
+privilege escalation instead of mislabeling the boundary as macOS Seatbelt.
+Canopus never places the producer, verifier, or model in the Vela signing path.

package/capsules/erdos1056-k15/README.md

@@ -0,0 +1,35 @@
+# Erdős 1056 k=15 capsule
+
+This non-authoritative verifier independently recomputes the exact inclusive
+prime range selected by its compile-time bounds. The active build covers
+`10428401..10428600`. It accepts one byte-exact artifact describing
+either the first 16-cut factorial-residue witness in that range or the complete
+negative scan. A negative result is only about this finite range.
+
+Build the active static Linux ARM64 capsule with
+`aarch64-linux-gnu-g++ (GCC) 15.2.0`:
+
+```bash
+mkdir -p capsules/erdos1056-k15/bin/linux-arm64/10428401-10428600
+aarch64-linux-gnu-g++ -O3 -std=c++20 -static -s \
+  -DCANOPUS_RANGE_START=10428401 -DCANOPUS_RANGE_END=10428600 \
+  capsules/erdos1056-k15/verifier.cpp \
+  -o capsules/erdos1056-k15/bin/linux-arm64/10428401-10428600/verifier
+```
+
+The active Linux ARM64 capsule SHA-256 root is
+`a6fc0d2ad4dd8e665474d6efd530e8a574880b7191d246b1c245d8cf4db175aa`.
+
+The Linux x86-64 capsule was built in `alpine:3.22.1` for `linux/amd64`,
+pinned at
+`sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1`,
+using exact package `g++ 14.2.0-r6` with the same flags. Its SHA-256 root is
+`3cdcb487db4907b63230548a7c7fd94d4be6acf003ca532971f9cf1650f19546`.
+
+Completed range binaries and registrations remain recoverable from their
+recorded Git commits and release evidence; they are intentionally absent from
+the active package.
+
+The prepared mission copies the executable into its content-addressed bundle.
+The separate verifier container has no network and no writable persistent
+mounts.