@vela-science/canopus 0.4.0-rc.1

package/docs/RUN_RECORD.md

@@ -0,0 +1,70 @@
+# Canopus run records
+
+A completed run writes these local records beneath its run root:
+
+- `activity.jsonl`: append-only orchestration events linked by full SHA-256
+  digests, including the exact `vela next` offer digest and selected rank;
+- `candidate.json`: the frozen candidate and verifier facts;
+- `worker-events.jsonl`: the raw Codex event stream used as the tool trace;
+- `worker-final.json`: the exact final worker response;
+- `worker-stderr.bin`: the bounded raw worker stderr stream;
+- `engine-result.json`: the parsed worker outcome and usage;
+- `run.json`: the compact run record, exact roots, landing result, costs, and
+  clean-clone reproduction result;
+- `evidence-manifest.json`: content roots for the worker, run, candidate,
+  artifacts, verifier result, Receipt when present, and final frontier roots;
+- `projection.json`: a read-only view for another consumer;
+- `landing-command.json`: the exact argv, exit status, raw streams, and stream
+  digests observed at the potentially effectful `vela land` boundary;
+- `landing-observation.json`: the parsed raw Vela result, retained before any
+  Canopus interpretation.
+
+If anything fails at or after that boundary, `landing-recovery.json` records
+the last command, raw result when available, parsed route when available, and
+freshly inspected roots. `failure.json` points to that recovery record. A
+command timeout may have changed external state even when no complete stdout
+was captured, so recovery roots are authoritative over assumptions.
+
+These files are operational evidence, not Vela authority. The projection says
+so in its schema and can be rebuilt with `canopus inspect run.json`. Deleting
+the run-record files must not change Vela replay, a policy route, or accepted
+state.
+
+The run root also contains isolated checkouts and content-addressed artifacts.
+The landing clone uses a disposable attached branch so Vela can publish exact
+deltas; the immutable input clone remains detached and read-only. Successful
+runs delete the isolated Vela home and its agent-only key. Failed runs may
+retain local diagnostic state until explicit cleanup. Never publish a run root
+or Codex credential directory wholesale. After verification, Mission v1 makes
+one unsigned non-authoritative Git commit containing exactly the frozen source
+artifacts before invoking `vela land`; `activity.jsonl` records that commit,
+tree, and path set. The terminal Vela commit then contains the Receipt, activity
+record, proposal, and `records/artifacts/sha256/<digest>` copies. This ordering
+keeps `vela.lock` and every clean Git checkout self-contained.
+
+A `--no-land` run writes `canopus.diagnostic-run.v1`, invokes the same frozen
+worker and verifier path, and leaves the source frontier at its starting commit
+and tree. It has no Receipt or proposal. A landed product run performs all work
+in isolated clones, verifies the clean clone, then fast-forwards the clean local
+source checkout to the exact verified landing commit. It never pushes a remote.
+
+Product output must live outside the source frontier and outside known
+cloud-synced Desktop or cloud-storage roots. Docker bind mounts over cloud-backed
+paths can stall without producing a verifier verdict, so Canopus refuses that
+placement rather than weakening the verification timeout.
+
+`route: defer` with `accepted_event_delta: 0` means the Receipt v1 record is
+pending human review. It is a successful producer handoff, not scientific
+acceptance. `route: permit` is valid only when an already signed Vela policy
+admits the exact proposal; Canopus still does not hold a human key.
+
+## Budget semantics
+
+The mission hard-bounds prompt bytes, artifact bytes, attempts, spawned
+research-lane processes, and captured research-lane output. The same ledger
+covers the first verifier and clean-clone verifier. `max_observed_tokens` is an
+honest postcondition over provider-reported usage; the Codex subscription
+surface does not expose a portable pre-call token cutoff. Git and Vela are the
+control plane and retain their own fixed command timeout/output bounds. The
+mission therefore does not advertise a hard end-to-end subprocess or billing
+budget it cannot enforce.

package/missions/erdos1056-k15-next/mission.draft.json

@@ -0,0 +1,40 @@
+{
+  "id": "mission_erdos1056_k15_range_10428401_10428600_native1",
+  "target": "auto",
+  "frontier": ".",
+  "actor": "agent:canopus-local",
+  "role": "producer",
+  "claim_type": "computational",
+  "replayability": "exact",
+  "objective": "Perform one finite exhaustive search for an Erdős 1056 k=15 witness over every prime p in the exact inclusive range 10428401..10428600. Use a compiled C++ program, one prime at a time; a flat open-addressed table keyed by the factorial residue keeps this bounded computation inside the registered memory and time limits. For each prime, compute t! modulo p for every cut t in 0..p-1 and count every residue fiber. For each p choose its largest fiber, breaking a tie by the smallest residue. If any largest fiber has at least 16 cuts, stop at the first such prime and report status=witness. Otherwise report status=negative and the greatest multiplicity over the whole range, breaking ties by the earliest prime and then the smallest residue. In both cases list every increasing cut in the selected fiber. Produce exactly one UTF-8 artifact at artifacts/erdos1056-k15-range-10428401-10428600.txt with these newline-terminated lines in order: schema=canopus.erdos1056-k15-search.v1; status=witness or status=negative; problem=1056; k=15; range_start=10428401; range_end=10428600; primes_tested=<exact count>; max_multiplicity=<exact count>; best_p=<prime>; best_residue=<residue>; cuts=<comma-separated cuts>. Return engine status success only after the program completes the entire registered range and writes the exact artifact. This is an exact bounded computation, not a universal answer to Erdős 1056.",
+  "completion_condition": "The independent frozen capsule recomputes the full exact range in a separate network-denied and write-denied container and byte-matches the single artifact.",
+  "allowed_paths": [
+    "artifacts/erdos1056-k15-range-10428401-10428600.txt"
+  ],
+  "budgets": {
+    "max_research_wall_time_ms": 1800000,
+    "max_research_processes": 16,
+    "max_research_output_bytes": 16777216,
+    "max_prompt_bytes": 2097152,
+    "max_artifact_bytes": 1048576,
+    "max_attempts": 1,
+    "max_observed_tokens": 100000
+  },
+  "worker": {
+    "model": "gpt-5.4"
+  },
+  "verifier": {
+    "argv": [
+      "capsule/verifier",
+      "{artifact:artifacts/erdos1056-k15-range-10428401-10428600.txt}"
+    ],
+    "cwd": "site",
+    "timeout_ms": 300000,
+    "max_output_bytes": 65536,
+    "capsule_path": "capsule/verifier"
+  },
+  "scientific_chain": {
+    "predicted_observable": "The frozen verifier independently obtains the same first witness or complete bounded-negative result for all primes in 10428401..10428600 and exits zero on the exact candidate bytes.",
+    "performed_test": "capsule/verifier artifacts/erdos1056-k15-range-10428401-10428600.txt"
+  }
+}

package/missions/formal-erdos-505-test-dim-one/mission.draft.json

@@ -0,0 +1,40 @@
+{
+  "id": "mission_formal_erdos_505_test_dim_one_native1",
+  "target": "auto",
+  "frontier": ".",
+  "actor": "agent:canopus-local",
+  "role": "producer",
+  "claim_type": "theoretical",
+  "replayability": "exact",
+  "objective": "Produce one exactly checkable, sorry-free Lean proof term for Erdos505.erdos_505.test_dim_one in the frozen Lean 4.27.0 and Mathlib environment bound by the target packet. Write exactly one UTF-8 artifact at artifacts/erdos505-test-dim-one-proof.lean. The file must begin with by and contain only the proof term: no imports, theorem declaration, JSON, markdown fence, or surrounding prose. Do not use sorry, admit, an axiom declaration, or an unsafe declaration. Return engine status success only after the exact artifact exists. This bounded mission proves only the frozen one-dimensional category test; it does not prove the general Erdős 505 statement or establish scientific acceptance.",
+  "completion_condition": "The independent frozen capsule supplies the exact theorem statement, elaborates the candidate with Lean 4.27.0 against the frozen formal-conjectures and Mathlib commits, and confirms that its axiom closure contains only propext, Classical.choice, and Quot.sound and never sorryAx.",
+  "allowed_paths": [
+    "artifacts/erdos505-test-dim-one-proof.lean"
+  ],
+  "budgets": {
+    "max_research_wall_time_ms": 1800000,
+    "max_research_processes": 8,
+    "max_research_output_bytes": 16777216,
+    "max_prompt_bytes": 2097152,
+    "max_artifact_bytes": 131072,
+    "max_attempts": 1,
+    "max_observed_tokens": 120000
+  },
+  "worker": {
+    "model": "gpt-5.4"
+  },
+  "verifier": {
+    "argv": [
+      "capsule/verifier",
+      "{artifact:artifacts/erdos505-test-dim-one-proof.lean}"
+    ],
+    "cwd": "targets",
+    "timeout_ms": 600000,
+    "max_output_bytes": 65536,
+    "capsule_path": "capsule/verifier"
+  },
+  "scientific_chain": {
+    "predicted_observable": "The frozen Lean verifier elaborates the exact candidate against Erdos505.erdos_505.test_dim_one, reports only the registered standard axioms, and exits zero on the unchanged proof bytes.",
+    "performed_test": "capsule/verifier artifacts/erdos505-test-dim-one-proof.lean"
+  }
+}

package/package.json

@@ -0,0 +1,89 @@
+{
+  "name": "@vela-science/canopus",
+  "version": "0.4.0-rc.1",
+  "description": "A bounded, replaceable research harness over released Vela interfaces",
+  "type": "module",
+  "private": false,
+  "license": "Apache-2.0 OR MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vela-science/vela-research-harness.git"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "engines": {
+    "node": ">=22 <23 || >=24 <25"
+  },
+  "packageManager": "pnpm@10.33.0",
+  "bin": {
+    "canopus": "dist/src/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "import": "./dist/src/index.js"
+    }
+  },
+  "files": [
+    "dist/src/activity",
+    "dist/src/artifact",
+    "dist/src/budget",
+    "dist/src/candidate",
+    "dist/src/capability",
+    "dist/src/contracts",
+    "dist/src/engines",
+    "dist/src/evidence",
+    "dist/src/mission",
+    "dist/src/product",
+    "dist/src/projection",
+    "dist/src/receipt",
+    "dist/src/repair",
+    "dist/src/util",
+    "dist/src/vela",
+    "dist/src/verifier",
+    "dist/src/workspace",
+    "dist/src/cli.js",
+    "dist/src/cli.d.ts",
+    "dist/src/index.js",
+    "dist/src/index.d.ts",
+    "dist/src/roles.js",
+    "dist/src/roles.d.ts",
+    "dist/src/run.js",
+    "dist/src/run.d.ts",
+    "schemas",
+    "capsules/erdos1056-k15/bin/linux-arm64/10428401-10428600/verifier",
+    "capsules/erdos1056-k15/bin/linux-x86_64/10428401-10428600/verifier",
+    "capsules/formal-erdos-505-test-dim-one/verifier",
+    "missions",
+    "profiles",
+    "runtime",
+    "scripts/run-hostile-native-custody-fixture.mjs",
+    "scripts/run-hostile-verifier-fixture.mjs",
+    "tests/fixtures/hostile-verifier",
+    "README.md",
+    "docs/MISSIONS.md",
+    "docs/RELEASES.md",
+    "docs/RUN_RECORD.md",
+    "CHANGELOG.md",
+    "SECURITY.md",
+    "LICENSE-APACHE",
+    "LICENSE-MIT"
+  ],
+  "scripts": {
+    "build": "node scripts/clean-dist.mjs && tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint": "tsc -p tsconfig.json --noEmit",
+    "test": "pnpm run build && node --test 'dist/tests/**/*.test.js' 'tests/**/*.test.mjs'",
+    "check": "pnpm run lint && pnpm run test",
+    "prepack": "pnpm run build",
+    "pack:check": "pnpm pack --dry-run",
+    "fixture:hostile-custody": "node scripts/run-hostile-native-custody-fixture.mjs",
+    "fixture:hostile-verifier": "node scripts/run-hostile-verifier-fixture.mjs"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.9.0"
+  }
+}

package/profiles/erdos1056-k15-10428401-10428600.json

@@ -0,0 +1,33 @@
+{
+  "schema": "canopus.profile.v2",
+  "name": "erdos1056-k15-10428401-10428600",
+  "target": "erdos:1056",
+  "target_packet_schema": "erdos-frontier.problem-work.v1",
+  "draft": "missions/erdos1056-k15-next/mission.draft.json",
+  "draft_sha256": "sha256:1c8f580b052f3d6b12c2d7694870eff1f196e27653422b6310a41ce14e4984d3",
+  "objective_sha256": "sha256:34b546c81a3522cf98fc2cd5b0f0308b723069e534dd533f6babed4634086be3",
+  "completion_condition_sha256": "sha256:4a4a06e2c867867a191af27900e96c23e677db2775783f1829c31e4867a7f270",
+  "allowed_artifacts_sha256": "sha256:70aff1cfbd41e2a8e9afccdfeaba4a95dd0356902a2592e1ebae031f9dcbb658",
+  "budgets_sha256": "sha256:26e3697f491461dd3073ebfb9960fcaf70e6412095fd4eeade7169fb79a4b070",
+  "replay_argv_sha256": "sha256:939ffff9ab670b28d3715e4bb26f42aa520de532e9a73328ac4be459f539a6b7",
+  "landing": {
+    "expected_routes": ["defer"],
+    "max_accepted_delta": 0
+  },
+  "platforms": {
+    "darwin-arm64": {
+      "worker_profile": "runtime/native-worker/config.toml",
+      "worker_profile_sha256": "sha256:12b58762819481ad101e7a172a296224b6050a8a07a7431272e521a4102908da",
+      "verifier_capsule": "capsules/erdos1056-k15/bin/linux-arm64/10428401-10428600/verifier",
+      "verifier_capsule_sha256": "sha256:a6fc0d2ad4dd8e665474d6efd530e8a574880b7191d246b1c245d8cf4db175aa",
+      "verifier_image": "ghcr.io/vela-science/canopus-verifier@sha256:a6f354862f2a3f7d72eb99244c65fa8583c98b74e17e3d5ce6e31ef48aa16536"
+    },
+    "linux-x86_64": {
+      "worker_profile": "runtime/native-worker/config-linux.toml",
+      "worker_profile_sha256": "sha256:fddecc4b7458b91f6d55ae16b666d297ae7bcd1a2f5deeb6650dcea60fc0242c",
+      "verifier_capsule": "capsules/erdos1056-k15/bin/linux-x86_64/10428401-10428600/verifier",
+      "verifier_capsule_sha256": "sha256:3cdcb487db4907b63230548a7c7fd94d4be6acf003ca532971f9cf1650f19546",
+      "verifier_image": "ghcr.io/vela-science/canopus-verifier@sha256:a6f354862f2a3f7d72eb99244c65fa8583c98b74e17e3d5ce6e31ef48aa16536"
+    }
+  }
+}

package/profiles/formal-erdos-505-test-dim-one.json

@@ -0,0 +1,35 @@
+{
+  "schema": "canopus.profile.v2",
+  "name": "formal-erdos-505-test-dim-one",
+  "target": "formal:erdos-505-test-dim-one",
+  "target_packet_schema": "formal-conjectures.lean-proof-work.v1",
+  "draft": "missions/formal-erdos-505-test-dim-one/mission.draft.json",
+  "draft_sha256": "sha256:93c19a6856ebad4781710e88d042bc69092b33645f5b0139298b649d877af074",
+  "objective_sha256": "sha256:d9b480cf26a5d4481a00eb6da15b6805fe49dd00154e9906943fbd1dcb3667fb",
+  "completion_condition_sha256": "sha256:75a9c7ce1f44f24e594b068beea5d4b26544331546435592a90b32c4363672fb",
+  "allowed_artifacts_sha256": "sha256:6c95468a5b24366edf539b156bbf3651cff55c1b1aad2a752522d316e88882db",
+  "budgets_sha256": "sha256:ac698d491f864a95be0e708029f538d532333920105ea5c28b56b45b6f639245",
+  "replay_argv_sha256": "sha256:120e2870a3570cbcebca835bb30c3f4b016d9cbbaece13b269ce449b2dcdfd1e",
+  "landing": {
+    "expected_routes": ["defer"],
+    "max_accepted_delta": 0
+  },
+  "platforms": {
+    "darwin-arm64": {
+      "worker_profile": "runtime/native-worker/config.toml",
+      "worker_profile_sha256": "sha256:12b58762819481ad101e7a172a296224b6050a8a07a7431272e521a4102908da",
+      "verifier_capsule": "capsules/formal-erdos-505-test-dim-one/verifier",
+      "verifier_capsule_sha256": "sha256:c1ef5a0914e9d537d2acba2b74a27f139d37414629c7676937515e99438b58dd",
+      "verifier_image": "ghcr.io/vela-science/canopus-formal-verifier@sha256:a9df828f9480d79e10a9707847fdf99a6a27287cf4281256d79f17be7f3d9f39",
+      "verifier_platform": "linux/amd64"
+    },
+    "linux-x86_64": {
+      "worker_profile": "runtime/native-worker/config-linux.toml",
+      "worker_profile_sha256": "sha256:fddecc4b7458b91f6d55ae16b666d297ae7bcd1a2f5deeb6650dcea60fc0242c",
+      "verifier_capsule": "capsules/formal-erdos-505-test-dim-one/verifier",
+      "verifier_capsule_sha256": "sha256:c1ef5a0914e9d537d2acba2b74a27f139d37414629c7676937515e99438b58dd",
+      "verifier_image": "ghcr.io/vela-science/canopus-formal-verifier@sha256:a9df828f9480d79e10a9707847fdf99a6a27287cf4281256d79f17be7f3d9f39",
+      "verifier_platform": "linux/amd64"
+    }
+  }
+}

package/runtime/native-worker/config-linux.toml

@@ -0,0 +1,20 @@
+default_permissions = "canopus-worker"
+approval_policy = "never"
+allow_login_shell = false
+
+[permissions.canopus-worker.filesystem]
+":minimal" = "read"
+"/home" = "deny"
+"/root" = "deny"
+"/tmp" = "deny"
+
+[permissions.canopus-worker.filesystem.":workspace_roots"]
+"." = "write"
+".canopus-runtime" = "read"
+
+[permissions.canopus-worker.network]
+enabled = false
+
+[shell_environment_policy]
+inherit = "none"
+set = { PATH = "/usr/local/bin:/usr/bin:/bin", TMPDIR = "." }

package/runtime/native-worker/config.toml

@@ -0,0 +1,17 @@
+default_permissions = "canopus-worker"
+approval_policy = "never"
+allow_login_shell = false
+
+[permissions.canopus-worker.filesystem]
+":minimal" = "read"
+"/Applications/Xcode.app/Contents/Developer" = "read"
+
+[permissions.canopus-worker.filesystem.":workspace_roots"]
+"." = "write"
+
+[permissions.canopus-worker.network]
+enabled = false
+
+[shell_environment_policy]
+inherit = "none"
+set = { PATH = "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin", SDKROOT = "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk", TMPDIR = "." }

package/schemas/candidate.v0.json

@@ -0,0 +1,125 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://vela.science/schemas/canopus/candidate.v0.json",
+  "title": "Canopus frozen candidate v0",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "mission_id",
+    "status",
+    "claim",
+    "artifacts",
+    "observations",
+    "tests",
+    "costs",
+    "caveats",
+    "engine"
+  ],
+  "properties": {
+    "schema": { "const": "canopus.candidate.v0" },
+    "mission_id": {
+      "type": "string",
+      "pattern": "^mission_[a-z0-9][a-z0-9._-]{0,126}$"
+    },
+    "status": { "enum": ["success", "null", "failed"] },
+    "claim": { "type": "string", "minLength": 1, "maxLength": 8192 },
+    "artifacts": {
+      "type": "array",
+      "maxItems": 10,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "kind", "digest", "bytes"],
+        "properties": {
+          "path": { "$ref": "#/$defs/relativePath" },
+          "kind": { "type": "string", "minLength": 1, "maxLength": 128 },
+          "digest": { "$ref": "#/$defs/sha256" },
+          "bytes": { "type": "integer", "minimum": 0, "maximum": 1073741824 }
+        }
+      }
+    },
+    "observations": {
+      "type": "array",
+      "maxItems": 16,
+      "items": { "type": "string", "minLength": 1, "maxLength": 4096 }
+    },
+    "tests": {
+      "type": "array",
+      "maxItems": 2,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["argv", "executable_digest", "exit_code", "stdout_digest", "stderr_digest", "duration_ms"],
+        "properties": {
+          "argv": {
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 64,
+            "items": { "type": "string", "maxLength": 4096 }
+          },
+          "executable_digest": { "$ref": "#/$defs/sha256" },
+          "exit_code": { "type": "integer", "minimum": -1, "maximum": 255 },
+          "stdout_digest": { "$ref": "#/$defs/sha256" },
+          "stderr_digest": { "$ref": "#/$defs/sha256" },
+          "duration_ms": { "type": "integer", "minimum": 0, "maximum": 3600000 }
+        }
+      }
+    },
+    "costs": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["wall_time_ms", "attempt", "input_tokens", "output_tokens"],
+      "properties": {
+        "wall_time_ms": { "type": "integer", "minimum": 0, "maximum": 3600000 },
+        "attempt": { "type": "integer", "minimum": 1, "maximum": 8 },
+        "input_tokens": { "type": "integer", "minimum": 0, "maximum": 1000000 },
+        "output_tokens": { "type": "integer", "minimum": 0, "maximum": 1000000 }
+      }
+    },
+    "caveats": {
+      "type": "array",
+      "maxItems": 10,
+      "items": { "type": "string", "minLength": 1, "maxLength": 4096 }
+    },
+    "engine": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "version", "binary_sha256", "model", "configuration_sha256"],
+      "properties": {
+        "name": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "version": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "binary_sha256": {
+          "anyOf": [{ "$ref": "#/$defs/sha256" }, { "type": "null" }]
+        },
+        "model": {
+          "anyOf": [
+            { "type": "string", "minLength": 1, "maxLength": 256 },
+            { "type": "null" }
+          ]
+        },
+        "configuration_sha256": { "$ref": "#/$defs/sha256" }
+      }
+    },
+    "repair": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["parent_candidate", "reason"],
+      "properties": {
+        "parent_candidate": { "$ref": "#/$defs/sha256" },
+        "reason": { "type": "string", "minLength": 1, "maxLength": 4096 }
+      }
+    }
+  },
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^sha256:[0-9a-f]{64}$"
+    },
+    "relativePath": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 1024
+    }
+  }
+}

package/schemas/engine-manifest.v0.json

@@ -0,0 +1,45 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://vela.science/schemas/canopus/engine-manifest.v0.json",
+  "title": "Canopus engine manifest v0",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "engine",
+    "usage",
+    "wall_time_ms",
+    "event_types",
+    "action_types",
+    "events_sha256",
+    "stderr_sha256"
+  ],
+  "properties": {
+    "schema": { "const": "canopus.engine-manifest.v0" },
+    "engine": { "$ref": "candidate.v0.json#/properties/engine" },
+    "usage": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["input_tokens", "cached_input_tokens", "output_tokens", "reasoning_output_tokens"],
+      "properties": {
+        "input_tokens": { "type": "integer", "minimum": 0 },
+        "cached_input_tokens": { "type": "integer", "minimum": 0 },
+        "output_tokens": { "type": "integer", "minimum": 0 },
+        "reasoning_output_tokens": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "wall_time_ms": { "type": "integer", "minimum": 0, "maximum": 3600000 },
+    "event_types": {
+      "type": "array",
+      "maxItems": 64,
+      "items": { "type": "string", "minLength": 1, "maxLength": 128 }
+    },
+    "action_types": {
+      "type": "array",
+      "maxItems": 16,
+      "items": { "type": "string", "minLength": 1, "maxLength": 128 }
+    },
+    "events_sha256": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
+    "stderr_sha256": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
+  }
+}

package/schemas/engine-output.v0.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://vela.science/schemas/canopus/engine-output.v0.json",
+  "title": "Canopus engine output v0",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "status", "claim", "artifacts", "observations", "caveats"],
+  "properties": {
+    "schema": { "type": "string", "const": "canopus.engine-output.v0" },
+    "status": {
+      "description": "Producer completion only: success means contract-complete candidate bytes are present and does not imply verifier passage or scientific acceptance.",
+      "enum": ["success", "null", "failed"]
+    },
+    "claim": { "type": "string", "minLength": 1, "maxLength": 8192 },
+    "artifacts": {
+      "type": "array",
+      "maxItems": 8,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "kind", "encoding", "content"],
+        "properties": {
+          "path": { "type": "string", "minLength": 1, "maxLength": 1024 },
+          "kind": { "type": "string", "minLength": 1, "maxLength": 128 },
+          "encoding": { "type": "string", "const": "utf8" },
+          "content": { "type": "string", "maxLength": 1048576 }
+        }
+      }
+    },
+    "observations": {
+      "type": "array",
+      "maxItems": 16,
+      "items": { "type": "string", "minLength": 1, "maxLength": 4096 }
+    },
+    "caveats": {
+      "type": "array",
+      "maxItems": 8,
+      "items": { "type": "string", "minLength": 1, "maxLength": 4096 }
+    }
+  }
+}