@vela-science/canopus 0.4.0-rc.1 → 0.4.2

package/CHANGELOG.md

@@ -1,6 +1,27 @@
 # Changelog
 
-## 0.4.0-rc.1 - Unreleased
+## 0.4.2 - 2026-07-19
+
+- Preserve the failed `v0.4.1` tag and its verified GitHub build attestation as
+  audit evidence. npm received no package and no GitHub release was created.
+- Pass npm an explicit local tarball path (`./release/*.tgz`). Without the
+  leading `./`, npm interpreted the relative path as a GitHub repository
+  shorthand and stopped before the OIDC exchange.
+
+## 0.4.1 - 2026-07-19
+
+- Preserve the failed `v0.4.0` tag as audit evidence. Its release workflow
+  stopped in validation before packing, attestation, npm publication, or a
+  GitHub release.
+- Run the complete historical/macOS suite in a dedicated macOS validation job,
+  then run the portable product and release-contract subset in the Ubuntu OIDC
+  publisher. Stable publication remains conditional on both jobs.
+- Publish the stable npm package through the exact GitHub Actions trusted
+  publisher, with long-lived npm tokens disabled. The one-time `0.4.0-rc.1`
+  namespace bootstrap remains an explicitly unprovenanced prerelease;
+  provenance-backed `0.4.1` is the release and default install target.
+
+## 0.4.0 - 2026-07-19 (failed release tag; not published)
 
 - Require the live Linux custody fixture to pass the exact deterministic Codex
   sandbox boundary before it reads staged authentication or makes a model call.
@@ -16,6 +37,8 @@
   rebuilds `dist`, the npm-valid `canopus` bin entry survives publication, and
   `publishConfig` requires public access with provenance. Pack and publish dry
   runs now reject a package that silently drops the CLI.
+- Prepare the stable npm package and accept ADR 0006 after its product,
+  isolation, package, and provenance gates.
 
 ## 0.3.0 - 2026-07-17
 

package/README.md

@@ -12,7 +12,13 @@ replay or accepted state.
 
 ## Product workflow
 
-Canopus 0.3 targets checksum-pinned Vela 0.901.0. Its ordinary path is:
+Canopus 0.4 targets checksum-pinned Vela 0.901.0. Install the released CLI:
+
+```bash
+npm install --global @vela-science/canopus
+```
+
+Its ordinary path is:
 
 ```bash
 canopus doctor /path/to/frontier

package/docs/RELEASES.md

@@ -1,12 +1,22 @@
 # Release evidence
 
-## Canopus v0.4.0 candidate
-
-The source package advertises `0.4.0-rc.1` while this train remains
-unreleased. The prerelease identity prevents candidate tarballs from being
-mistaken for released `v0.3.0`; it grants no release or provenance credit.
-Final publication still requires the exact `v0.4.0` tag/version pair and the
-gates below.
+## Canopus v0.4.2
+
+The source package advertises `0.4.0`. The public npm namespace was bootstrapped
+once with `0.4.0-rc.1` under the `next` tag so the package could bind its exact
+GitHub Actions trusted publisher. That bootstrap used interactive human 2FA,
+has no provenance attestation, and earns no release credit. Package publishing
+now disallows reusable npm tokens. The first stable tag, `v0.4.0`, stopped in
+its Ubuntu validation step before packing, attestation, npm publication, or a
+GitHub release because the job selected historical macOS-only tests. The
+corrected `v0.4.1` workflow passed both validation jobs and verified its GitHub
+build attestation, but npm interpreted `release/*.tgz` as a GitHub repository
+shorthand and stopped before OIDC publication; no npm package or GitHub release
+was created. Both tags are retained as failure evidence and are not moved. The
+corrected exact `v0.4.2` tag/version pair is
+published only by `.github/workflows/release.yml` in environment `npm`; the
+workflow must produce and verify both npm SLSA provenance and a GitHub build
+attestation before creating the matching GitHub release.
 
 The first registered quantum mission stopped safely before verification or
 landing because provider-reported usage exceeded its frozen 100,000-token

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vela-science/canopus",
-  "version": "0.4.0-rc.1",
+  "version": "0.4.2",
   "description": "A bounded, replaceable research harness over released Vela interfaces",
   "type": "module",
   "private": false,
@@ -16,7 +16,6 @@
   "engines": {
     "node": ">=22 <23 || >=24 <25"
   },
-  "packageManager": "pnpm@10.33.0",
   "bin": {
     "canopus": "dist/src/cli.js"
   },
@@ -71,19 +70,18 @@
     "LICENSE-APACHE",
     "LICENSE-MIT"
   ],
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.9.0"
+  },
   "scripts": {
     "build": "node scripts/clean-dist.mjs && tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "lint": "tsc -p tsconfig.json --noEmit",
     "test": "pnpm run build && node --test 'dist/tests/**/*.test.js' 'tests/**/*.test.mjs'",
     "check": "pnpm run lint && pnpm run test",
-    "prepack": "pnpm run build",
     "pack:check": "pnpm pack --dry-run",
     "fixture:hostile-custody": "node scripts/run-hostile-native-custody-fixture.mjs",
     "fixture:hostile-verifier": "node scripts/run-hostile-verifier-fixture.mjs"
-  },
-  "devDependencies": {
-    "@types/node": "^24.0.0",
-    "typescript": "^5.9.0"
   }
-}
+}

package/capsules/erdos1056-k15/README.md

@@ -1,35 +0,0 @@
-# Erdős 1056 k=15 capsule
-
-This non-authoritative verifier independently recomputes the exact inclusive
-prime range selected by its compile-time bounds. The active build covers
-`10428401..10428600`. It accepts one byte-exact artifact describing
-either the first 16-cut factorial-residue witness in that range or the complete
-negative scan. A negative result is only about this finite range.
-
-Build the active static Linux ARM64 capsule with
-`aarch64-linux-gnu-g++ (GCC) 15.2.0`:
-
-```bash
-mkdir -p capsules/erdos1056-k15/bin/linux-arm64/10428401-10428600
-aarch64-linux-gnu-g++ -O3 -std=c++20 -static -s \
-  -DCANOPUS_RANGE_START=10428401 -DCANOPUS_RANGE_END=10428600 \
-  capsules/erdos1056-k15/verifier.cpp \
-  -o capsules/erdos1056-k15/bin/linux-arm64/10428401-10428600/verifier
-```
-
-The active Linux ARM64 capsule SHA-256 root is
-`a6fc0d2ad4dd8e665474d6efd530e8a574880b7191d246b1c245d8cf4db175aa`.
-
-The Linux x86-64 capsule was built in `alpine:3.22.1` for `linux/amd64`,
-pinned at
-`sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1`,
-using exact package `g++ 14.2.0-r6` with the same flags. Its SHA-256 root is
-`3cdcb487db4907b63230548a7c7fd94d4be6acf003ca532971f9cf1650f19546`.
-
-Completed range binaries and registrations remain recoverable from their
-recorded Git commits and release evidence; they are intentionally absent from
-the active package.
-
-The prepared mission copies the executable into its content-addressed bundle.
-The separate verifier container has no network and no writable persistent
-mounts.

package/capsules/formal-erdos-505-test-dim-one/README.md

@@ -1,20 +0,0 @@
-# Erdős 505 dimension-one verifier
-
-This target-specific capsule verifies one raw Lean proof term against the exact
-statement of `Erdos505.erdos_505.test_dim_one` from
-`google-deepmind/formal-conjectures` commit
-`c252a41054125b5fd9c8356e2137cd9b55337657`.
-
-The image build verifies that exact upstream commit, tree, and source-file
-hash, but the runtime deliberately does not import the admitted upstream
-theorem or the `FormalConjecturesUtil` whole-Mathlib umbrella. It retains only
-the transitive cache closure of `Mathlib.Analysis.InnerProductSpace.PiL2` and
-`Mathlib.Topology.MetricSpace.Bounded`; the reviewed capsule owns an exact copy
-of the target signature.
-
-The producer supplies only the term beginning with `by`. The capsule invokes
-Lean 4.27.0 inside the pinned verifier image and rejects `sorryAx` or any axiom
-outside `propext`, `Classical.choice`, and `Quot.sound`. Kernel success does not
-by itself establish statement fidelity or scientific acceptance; the exact
-source-bound target packet, capsule review, and Vela review boundary retain
-those distinctions.