@vela-science/canopus 0.4.0-rc.1

package/dist/src/product/custody.d.ts

@@ -0,0 +1,27 @@
+import { type CommandRunner } from "../util/command.js";
+export interface NativeCustodyPreflightResult {
+    schema: "canopus.native-custody-preflight.v1";
+    ok: true;
+    mode: "deterministic_no_model";
+    platform: string;
+    codex_version: string;
+    codex_sha256: string;
+    permission_profile_sha256: string;
+    verdict: {
+        curl_available: true;
+        source_auth_readable: false;
+        runtime_auth_readable: false;
+        sealed_input_readable: false;
+        unrelated_repo_readable: false;
+        canary_readable: false;
+        outside_workspace_writable: false;
+        command_network_reachable: false;
+        environment_contains_auth: false;
+        proc_environ_contains_auth: false;
+    };
+}
+export declare function runNativeCustodyPreflight(options: {
+    binary: string;
+    permissionProfile: string;
+    runner?: CommandRunner;
+}): Promise<NativeCustodyPreflightResult>;

package/dist/src/product/custody.js

@@ -0,0 +1,131 @@
+import { randomBytes } from "node:crypto";
+import { constants } from "node:fs";
+import { chmod, copyFile, mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { assertNativeRuntimeProfile } from "../engines/codex-tools-native.js";
+import { sha256Bytes } from "../util/canonical.js";
+import { isolatedEnvironment, runCommand } from "../util/command.js";
+import { MAX_EXECUTABLE_BYTES, readBoundedRegularFile, sha256RegularFile } from "../util/files.js";
+export async function runNativeCustodyPreflight(options) {
+    if (process.platform !== "darwin" && process.platform !== "linux") {
+        throw new Error(`native sandbox preflight does not support ${process.platform}`);
+    }
+    const runner = options.runner ?? runCommand;
+    const binary = await realpath(options.binary);
+    const profile = await realpath(options.permissionProfile);
+    const [binaryDigest, profileBytes] = await Promise.all([
+        sha256RegularFile(binary, MAX_EXECUTABLE_BYTES),
+        readBoundedRegularFile(profile, 8 * 1024 * 1024),
+    ]);
+    const runtime = await mkdtemp(path.join(os.homedir(), ".canopus-native-preflight-"));
+    try {
+        const codexHome = path.join(runtime, "codex-home");
+        const home = path.join(runtime, "home");
+        const workspace = path.join(runtime, "workspace");
+        const sourceHome = path.join(runtime, "source-auth");
+        const sealedInput = path.join(runtime, "sealed-input");
+        const unrelated = path.join(runtime, "unrelated-repository");
+        await Promise.all([
+            mkdir(codexHome, { mode: 0o700 }),
+            mkdir(home, { mode: 0o700 }),
+            mkdir(workspace, { mode: 0o700 }),
+            mkdir(sourceHome, { mode: 0o700 }),
+            mkdir(sealedInput, { mode: 0o700 }),
+            mkdir(unrelated, { mode: 0o700 }),
+        ]);
+        const authBytes = Buffer.from(JSON.stringify({
+            OPENAI_API_KEY: `preflight-${randomBytes(32).toString("hex")}`,
+        }) + "\n");
+        const sourceAuth = path.join(sourceHome, "auth.json");
+        const runtimeAuth = path.join(codexHome, "auth.json");
+        const inputFile = path.join(sealedInput, "packet.json");
+        const unrelatedFile = path.join(unrelated, "private.txt");
+        const canary = path.join(runtime, "host-secret");
+        await Promise.all([
+            writeFile(sourceAuth, authBytes, { flag: "wx", mode: 0o600 }),
+            writeFile(runtimeAuth, authBytes, { flag: "wx", mode: 0o600 }),
+            writeFile(inputFile, "sealed input\n", { flag: "wx", mode: 0o400 }),
+            writeFile(unrelatedFile, "unrelated repository\n", { flag: "wx", mode: 0o400 }),
+            writeFile(canary, `host-secret-${randomBytes(32).toString("hex")}\n`, {
+                flag: "wx",
+                mode: 0o400,
+            }),
+        ]);
+        await copyFile(profile, path.join(codexHome, "config.toml"));
+        await chmod(path.join(codexHome, "config.toml"), 0o600);
+        let runtimeBinary = binary;
+        if (process.platform === "linux") {
+            const runtimeDirectory = path.join(workspace, ".canopus-runtime");
+            await mkdir(runtimeDirectory, { mode: 0o700 });
+            runtimeBinary = path.join(runtimeDirectory, "codex");
+            await copyFile(binary, runtimeBinary, constants.COPYFILE_EXCL);
+            await chmod(runtimeBinary, 0o500);
+            if (await sha256RegularFile(runtimeBinary, MAX_EXECUTABLE_BYTES) !== binaryDigest) {
+                throw new Error("Codex binary changed while it was staged for the Linux sandbox");
+            }
+        }
+        const environment = {
+            ...isolatedEnvironment(home),
+            CODEX_HOME: codexHome,
+            CANOPUS_AUTH: "canopus-preflight-environment-canary",
+            NO_COLOR: "1",
+        };
+        await assertNativeRuntimeProfile({
+            binary: runtimeBinary,
+            runner,
+            environment,
+            cwd: workspace,
+            sourceAuth,
+            runtimeAuth,
+            inaccessibleInput: inputFile,
+            unrelatedFile,
+            canary,
+            outsideWrite: path.join(runtime, "outside-write"),
+            timeoutMs: 30_000,
+            includeSafeDiagnostics: true,
+        });
+        const version = await runner({
+            argv: [runtimeBinary, "--version"],
+            cwd: workspace,
+            env: environment,
+            timeoutMs: 30_000,
+            maxOutputBytes: 4096,
+        });
+        if (version.exitCode !== 0 || version.stderr.length !== 0) {
+            throw new Error("Codex version check failed after native sandbox preflight");
+        }
+        const codexVersion = version.stdout.toString("utf8").trim();
+        if (codexVersion === "" || codexVersion.length > 4096) {
+            throw new Error("Codex returned an invalid version after native sandbox preflight");
+        }
+        if (await sha256RegularFile(runtimeBinary, MAX_EXECUTABLE_BYTES) !== binaryDigest) {
+            throw new Error("Codex binary changed during native sandbox preflight");
+        }
+        return {
+            schema: "canopus.native-custody-preflight.v1",
+            ok: true,
+            mode: "deterministic_no_model",
+            platform: `${process.platform}-${process.arch}`,
+            codex_version: codexVersion,
+            codex_sha256: binaryDigest,
+            permission_profile_sha256: sha256Bytes(profileBytes),
+            verdict: {
+                curl_available: true,
+                source_auth_readable: false,
+                runtime_auth_readable: false,
+                sealed_input_readable: false,
+                unrelated_repo_readable: false,
+                canary_readable: false,
+                outside_workspace_writable: false,
+                command_network_reachable: false,
+                environment_contains_auth: false,
+                proc_environ_contains_auth: false,
+            },
+        };
+    }
+    finally {
+        await rm(runtime, { recursive: true, force: true });
+    }
+}

package/dist/src/product/doctor.d.ts

@@ -0,0 +1,61 @@
+import { type CommandRunner } from "../util/command.js";
+import { type ProductProfile } from "./profile.js";
+import { type RuntimeIdentity } from "./runtime.js";
+export interface ProductDoctorResult {
+    schema: "canopus.doctor.v1";
+    ok: boolean;
+    authority: "read_only_diagnostic";
+    frontier: {
+        path: string;
+        git_commit: string;
+        git_tree: string;
+        event_log_root: string;
+        snapshot_root: string;
+        clean: boolean;
+        strict_blockers: number;
+    };
+    offer: {
+        target: string;
+        rank: number;
+        profile: string;
+    };
+    runtimes: {
+        vela: RuntimeIdentity;
+        git: RuntimeIdentity;
+        codex: RuntimeIdentity | null;
+        docker: (RuntimeIdentity & {
+            daemon: "ready";
+            verifier_image: string;
+            verifier_image_id: string;
+        }) | null;
+    };
+    capsule: {
+        sha256: string;
+        source: "packaged";
+    };
+    worker: {
+        platform: string;
+        mission_runtime: "native" | "wsl2_required";
+        mission_ready: boolean;
+        custody_preflight: "passed" | "wsl2_required";
+        custody_mode: "deterministic_no_model" | "not_applicable";
+        permission_profile_sha256: string;
+    };
+    next_action: string;
+}
+export declare function selectProductOffer(offer: Record<string, unknown>, profile: ProductProfile, requestedTarget?: string): {
+    target: Record<string, unknown>;
+    targetId: string;
+    rank: number;
+};
+export declare function resolveProductProfile(offer: Record<string, unknown>, profileName?: string, requestedTarget?: string): Promise<ProductProfile>;
+export declare function doctorProduct(options: {
+    frontier: string;
+    profileName?: string;
+    requestedTarget?: string;
+    runner?: CommandRunner;
+    platform?: NodeJS.Platform;
+}): Promise<{
+    public: ProductDoctorResult;
+    profile: ProductProfile;
+}>;

package/dist/src/product/doctor.js

@@ -0,0 +1,278 @@
+import { mkdir, mkdtemp, realpath, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { objectAt, sha256At, stringAt } from "../contracts/validation.js";
+import { isolatedEnvironment, runCommand } from "../util/command.js";
+import { sha256Bytes } from "../util/canonical.js";
+import { listProductProfiles, loadProductProfile, packagedWorkerProfile, stageProfileCapsule, } from "./profile.js";
+import { runNativeCustodyPreflight } from "./custody.js";
+import { runtimeIdentity } from "./runtime.js";
+import { CANOPUS_VERSION } from "./version.js";
+async function jsonCommand(options) {
+    const result = await options.runner({
+        argv: options.argv,
+        cwd: options.cwd,
+        env: isolatedEnvironment(options.home),
+        timeoutMs: 120_000,
+        maxOutputBytes: 16 * 1024 * 1024,
+    });
+    if (result.exitCode !== 0) {
+        throw new Error(`${options.label} failed: stdout_sha256=${sha256Bytes(result.stdout)}; ` +
+            `stderr_sha256=${sha256Bytes(result.stderr)}`);
+    }
+    return objectAt(JSON.parse(result.stdout.toString("utf8")), options.label);
+}
+function nonnegative(value, at) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+        throw new Error(`${at} must be a nonnegative integer`);
+    }
+    return value;
+}
+export function selectProductOffer(offer, profile, requestedTarget) {
+    const targets = offer.targets;
+    if (!Array.isArray(targets) || targets.length === 0) {
+        throw new Error("vela next returned no producer target");
+    }
+    if (requestedTarget !== undefined && requestedTarget !== profile.target) {
+        throw new Error(`registered profile ${profile.name} targets ${profile.target}, not requested target ${requestedTarget}`);
+    }
+    const candidates = requestedTarget === undefined
+        ? [objectAt(targets[0], "vela next.targets[0]")]
+        : targets
+            .map((value, index) => objectAt(value, `vela next.targets[${index}]`))
+            .filter((value) => value.target_id === requestedTarget);
+    if (candidates.length !== 1) {
+        throw new Error(`requested target ${requestedTarget ?? profile.target} must appear exactly once in the ranked producer offers; ` +
+            `observed ${candidates.length}`);
+    }
+    const target = candidates[0];
+    const targetId = stringAt(target.target_id, "vela next target_id", { min: 1, max: 256 });
+    if (targetId !== profile.target) {
+        throw new Error(`first ranked target is ${targetId}, but registered profile ${profile.name} targets ` +
+            `${profile.target}; Canopus will not skip rank 1, so freeze a verifier profile for ${targetId} before running`);
+    }
+    return {
+        target,
+        targetId,
+        rank: nonnegative(target.rank, "vela next target rank"),
+    };
+}
+export async function resolveProductProfile(offer, profileName, requestedTarget) {
+    if (profileName !== undefined)
+        return loadProductProfile(profileName);
+    const targets = offer.targets;
+    if (!Array.isArray(targets) || targets.length === 0) {
+        throw new Error("vela next returned no producer target");
+    }
+    const selectedOffer = requestedTarget === undefined
+        ? objectAt(targets[0], "vela next.targets[0]")
+        : targets
+            .map((value, index) => objectAt(value, `vela next.targets[${index}]`))
+            .find((value) => value.target_id === requestedTarget);
+    if (selectedOffer === undefined) {
+        throw new Error(`requested target ${requestedTarget} is not a current producer offer`);
+    }
+    const target = stringAt(selectedOffer.target_id, "vela next target_id", { min: 1, max: 256 });
+    const matches = [];
+    for (const name of await listProductProfiles()) {
+        try {
+            const candidate = await loadProductProfile(name);
+            if (candidate.target === target)
+                matches.push(candidate);
+        }
+        catch (error) {
+            if (!(error instanceof Error) || !/replay-only/u.test(error.message))
+                throw error;
+        }
+    }
+    if (matches.length === 0) {
+        throw new Error(`no runnable profile is registered for producer target ${target}`);
+    }
+    if (matches.length !== 1) {
+        throw new Error(`multiple runnable profiles are registered for producer target ${target}: ` +
+            `${matches.map((profile) => profile.name).sort().join(", ")}; select one with --profile`);
+    }
+    return matches[0];
+}
+export async function doctorProduct(options) {
+    const runner = options.runner ?? runCommand;
+    const platform = options.platform ?? process.platform;
+    const frontier = await realpath(options.frontier);
+    const runtime = await mkdtemp(path.join(os.tmpdir(), "canopus-doctor-"));
+    try {
+        const [vela, git] = await Promise.all([
+            runtimeIdentity({ name: "vela", cwd: frontier, home: runtime, runner }),
+            runtimeIdentity({ name: "git", cwd: frontier, home: runtime, runner }),
+        ]);
+        if (vela.version !== "vela 0.901.0") {
+            throw new Error(`Canopus ${CANOPUS_VERSION} requires vela 0.901.0, observed ${vela.version}`);
+        }
+        const [status, offer, gitStatus] = await Promise.all([
+            jsonCommand({ runner, argv: [vela.binary, "status", ".", "--json"], cwd: frontier, home: runtime, label: "vela status" }),
+            jsonCommand({ runner, argv: [vela.binary, "next", ".", "--limit", "128", "--json"], cwd: frontier, home: runtime, label: "vela next" }),
+            runner({ argv: [git.binary, "status", "--porcelain=v1", "--untracked-files=all"], cwd: frontier, env: isolatedEnvironment(runtime), timeoutMs: 30_000, maxOutputBytes: 8 * 1024 * 1024 }),
+        ]);
+        if (gitStatus.exitCode !== 0 || gitStatus.stderr.length !== 0)
+            throw new Error("git status failed");
+        const clean = gitStatus.stdout.length === 0;
+        if (!clean)
+            throw new Error("frontier checkout must be clean before Canopus runs");
+        if (status.schema !== "vela.status.v1" || offer.schema !== "vela.offer.v1") {
+            throw new Error("frontier did not return the Vela 0.9 compact contracts");
+        }
+        const profile = await resolveProductProfile(offer, options.profileName, options.requestedTarget);
+        const selected = selectProductOffer(offer, profile, options.requestedTarget);
+        const roots = objectAt(status.roots, "vela status.roots");
+        const gitState = objectAt(status.git, "vela status.git");
+        const integrity = objectAt(status.integrity, "vela status.integrity");
+        const staging = path.join(runtime, "capsule-build");
+        await mkdir(staging, { mode: 0o700 });
+        const capsule = await stageProfileCapsule({ profile, stagingRoot: staging });
+        if (platform === "win32") {
+            return {
+                profile,
+                public: {
+                    schema: "canopus.doctor.v1",
+                    ok: true,
+                    authority: "read_only_diagnostic",
+                    frontier: {
+                        path: frontier,
+                        git_commit: stringAt(gitState.commit, "vela status.git.commit", { min: 40, max: 64 }),
+                        git_tree: stringAt(gitState.tree, "vela status.git.tree", { min: 40, max: 64 }),
+                        event_log_root: sha256At(roots.event_log, "vela status.roots.event_log"),
+                        snapshot_root: sha256At(roots.snapshot, "vela status.roots.snapshot"),
+                        clean,
+                        strict_blockers: nonnegative(integrity.blocker_count, "vela status.integrity.blocker_count"),
+                    },
+                    offer: {
+                        target: selected.targetId,
+                        rank: selected.rank,
+                        profile: profile.name,
+                    },
+                    runtimes: { vela, git, codex: null, docker: null },
+                    capsule: { sha256: profile.capsule_sha256, source: capsule.source },
+                    worker: {
+                        platform: `${platform}-${process.arch}`,
+                        mission_runtime: "wsl2_required",
+                        mission_ready: false,
+                        custody_preflight: "wsl2_required",
+                        custody_mode: "not_applicable",
+                        permission_profile_sha256: profile.permission_profile_sha256,
+                    },
+                    next_action: "Open WSL2, enter this frontier through its Linux path, and rerun canopus doctor there; native Windows supports inspect and replay only.",
+                },
+            };
+        }
+        if (platform !== "darwin" && platform !== "linux") {
+            throw new Error(`Canopus doctor does not support ${platform}`);
+        }
+        const [codex, docker] = await Promise.all([
+            runtimeIdentity({ name: "codex", cwd: frontier, home: runtime, runner }),
+            runtimeIdentity({ name: "docker", cwd: frontier, home: runtime, runner }),
+        ]);
+        if (codex.version !== "codex-cli 0.144.6") {
+            throw new Error(`registered worker requires codex-cli 0.144.6, observed ${codex.version}`);
+        }
+        const daemon = await runner({
+            argv: [docker.binary, "info", "--format={{.ServerVersion}}"],
+            cwd: frontier,
+            env: isolatedEnvironment(runtime),
+            timeoutMs: 30_000,
+            maxOutputBytes: 64 * 1024,
+        });
+        if (daemon.exitCode !== 0 || daemon.stdout.toString("utf8").trim() === "") {
+            throw new Error("Docker daemon is not ready");
+        }
+        const [image, repoDigests] = await Promise.all([
+            runner({
+                argv: [docker.binary, "image", "inspect", "--format={{.Id}}", profile.verifier_image],
+                cwd: frontier,
+                env: isolatedEnvironment(runtime),
+                timeoutMs: 30_000,
+                maxOutputBytes: 64 * 1024,
+            }),
+            runner({
+                argv: [docker.binary, "image", "inspect", "--format={{json .RepoDigests}}", profile.verifier_image],
+                cwd: frontier,
+                env: isolatedEnvironment(runtime),
+                timeoutMs: 30_000,
+                maxOutputBytes: 64 * 1024,
+            }),
+        ]);
+        if (image.exitCode !== 0 || repoDigests.exitCode !== 0) {
+            throw new Error("registered verifier image is unavailable; run " +
+                `docker pull --platform ${profile.verifier_platform} ${profile.verifier_image}`);
+        }
+        if (image.stderr.length !== 0 || repoDigests.stderr.length !== 0) {
+            throw new Error("registered verifier image inspection produced unexpected stderr");
+        }
+        const imageId = sha256At(image.stdout.toString("utf8").trim(), "Docker image ID");
+        const observedDigests = JSON.parse(repoDigests.stdout.toString("utf8"));
+        if (!Array.isArray(observedDigests) || !observedDigests.includes(profile.verifier_image)) {
+            throw new Error("registered verifier image repository digest drifted");
+        }
+        const permissionProfile = await packagedWorkerProfile(profile);
+        const custody = await runNativeCustodyPreflight({
+            binary: codex.binary,
+            permissionProfile,
+            runner,
+        });
+        if (custody.codex_version !== codex.version || custody.codex_sha256 !== codex.sha256) {
+            throw new Error("native custody preflight and discovered Codex identity disagree");
+        }
+        if (custody.permission_profile_sha256 !== profile.permission_profile_sha256) {
+            throw new Error("native custody preflight and registered worker profile disagree");
+        }
+        return {
+            profile,
+            public: {
+                schema: "canopus.doctor.v1",
+                ok: true,
+                authority: "read_only_diagnostic",
+                frontier: {
+                    path: frontier,
+                    git_commit: stringAt(gitState.commit, "vela status.git.commit", { min: 40, max: 64 }),
+                    git_tree: stringAt(gitState.tree, "vela status.git.tree", { min: 40, max: 64 }),
+                    event_log_root: sha256At(roots.event_log, "vela status.roots.event_log"),
+                    snapshot_root: sha256At(roots.snapshot, "vela status.roots.snapshot"),
+                    clean,
+                    strict_blockers: nonnegative(integrity.blocker_count, "vela status.integrity.blocker_count"),
+                },
+                offer: {
+                    target: selected.targetId,
+                    rank: selected.rank,
+                    profile: profile.name,
+                },
+                runtimes: {
+                    vela,
+                    codex,
+                    git,
+                    docker: {
+                        ...docker,
+                        daemon: "ready",
+                        verifier_image: profile.verifier_image,
+                        verifier_image_id: imageId,
+                    },
+                },
+                capsule: {
+                    sha256: profile.capsule_sha256,
+                    source: capsule.source,
+                },
+                worker: {
+                    platform: custody.platform,
+                    mission_runtime: "native",
+                    mission_ready: true,
+                    custody_preflight: "passed",
+                    custody_mode: custody.mode,
+                    permission_profile_sha256: custody.permission_profile_sha256,
+                },
+                next_action: options.requestedTarget === undefined
+                    ? `canopus run ${frontier} --first`
+                    : `canopus run ${frontier} --target ${selected.targetId}`,
+            },
+        };
+    }
+    finally {
+        await rm(runtime, { recursive: true, force: true });
+    }
+}

package/dist/src/product/profile-bundle.d.ts

@@ -0,0 +1,21 @@
+import { listProductProfiles, type ProductPlatform } from "./profile.js";
+export interface ProfileValidation {
+    schema: "canopus.profile-validation.v1";
+    name: string;
+    profile_sha256: string;
+    draft_sha256: string;
+    result_contract_sha256: string | null;
+    platforms: Record<ProductPlatform, {
+        worker_profile_sha256: string;
+        verifier_capsule_sha256: string;
+        verifier_image: string;
+        verifier_platform: string;
+    }>;
+}
+export declare function validateProductProfile(name: string): Promise<ProfileValidation>;
+export declare function packProductProfile(name: string, outputRoot: string): Promise<{
+    manifest: string;
+    root: string;
+    files: number;
+}>;
+export { listProductProfiles };

package/dist/src/product/profile-bundle.js

@@ -0,0 +1,78 @@
+import { constants } from "node:fs";
+import { copyFile, mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { canonicalJson, sha256Bytes } from "../util/canonical.js";
+import { readBoundedRegularFile } from "../util/files.js";
+import { SUPPORTED_PRODUCT_PLATFORMS, listProductProfiles, loadProductProfile, loadProfileDraft, loadProfileResultContract, packagedProfileResource, } from "./profile.js";
+async function exactResource(relative, expected, label) {
+    const file = await packagedProfileResource(relative, label);
+    const bytes = await readBoundedRegularFile(file, 268_435_456);
+    const observed = sha256Bytes(bytes);
+    if (observed !== expected)
+        throw new Error(`${label} root drifted: expected ${expected}, observed ${observed}`);
+    return { path: relative, sha256: observed, size: bytes.length };
+}
+export async function validateProductProfile(name) {
+    const profiles = await Promise.all(SUPPORTED_PRODUCT_PLATFORMS.map((platform) => loadProductProfile(name, { platform })));
+    const canonical = profiles[0];
+    if (canonical === undefined)
+        throw new Error("profile has no supported platform capsules");
+    await loadProfileDraft(canonical);
+    await loadProfileResultContract(canonical);
+    const profileFile = await packagedProfileResource(`profiles/${name}.json`, "profile");
+    const profileBytes = await readBoundedRegularFile(profileFile, 1024 * 1024);
+    const platforms = Object.fromEntries(await Promise.all(profiles.map(async (profile) => {
+        await exactResource(profile.permission_profile, profile.permission_profile_sha256, `${profile.platform} worker profile`);
+        await exactResource(profile.capsule_binary, profile.capsule_sha256, `${profile.platform} verifier capsule`);
+        return [profile.platform, {
+                worker_profile_sha256: profile.permission_profile_sha256,
+                verifier_capsule_sha256: profile.capsule_sha256,
+                verifier_image: profile.verifier_image,
+                verifier_platform: profile.verifier_platform,
+            }];
+    })));
+    return {
+        schema: "canopus.profile-validation.v1",
+        name,
+        profile_sha256: sha256Bytes(profileBytes),
+        draft_sha256: canonical.draft_sha256,
+        result_contract_sha256: canonical.result_contract_sha256 ?? null,
+        platforms,
+    };
+}
+export async function packProductProfile(name, outputRoot) {
+    const validation = await validateProductProfile(name);
+    const profile = await loadProductProfile(name, { platform: SUPPORTED_PRODUCT_PLATFORMS[0] });
+    const resources = new Map();
+    const add = async (relative, expected, label) => {
+        resources.set(relative, await exactResource(relative, expected, label));
+    };
+    await add(`profiles/${name}.json`, validation.profile_sha256, "profile");
+    await add(profile.draft, profile.draft_sha256, "profile draft");
+    if (profile.result_contract !== undefined && profile.result_contract_sha256 !== undefined) {
+        await add(profile.result_contract, profile.result_contract_sha256, "profile result contract");
+    }
+    for (const platform of SUPPORTED_PRODUCT_PLATFORMS) {
+        const capsule = profile.platforms[platform];
+        await add(capsule.worker_profile, capsule.worker_profile_sha256, `${platform} worker profile`);
+        await add(capsule.verifier_capsule, capsule.verifier_capsule_sha256, `${platform} verifier capsule`);
+    }
+    await mkdir(outputRoot, { recursive: false, mode: 0o755 });
+    for (const resource of [...resources.values()].sort((left, right) => left.path.localeCompare(right.path))) {
+        const source = await packagedProfileResource(resource.path, "profile pack resource");
+        const destination = path.join(outputRoot, resource.path);
+        await mkdir(path.dirname(destination), { recursive: true, mode: 0o755 });
+        await copyFile(source, destination, constants.COPYFILE_EXCL);
+    }
+    const manifestValue = {
+        schema: "canopus.profile-pack.v1",
+        profile: name,
+        profile_sha256: validation.profile_sha256,
+        files: [...resources.values()].sort((left, right) => left.path.localeCompare(right.path)),
+    };
+    const manifestBytes = canonicalJson(manifestValue);
+    const manifest = path.join(outputRoot, "profile-pack.json");
+    await writeFile(manifest, manifestBytes, { encoding: "utf8", flag: "wx", mode: 0o644 });
+    return { manifest, root: sha256Bytes(manifestBytes), files: resources.size };
+}
+export { listProductProfiles };

package/dist/src/product/profile.d.ts

@@ -0,0 +1,67 @@
+import { type LandingSpec, type PositiveResultContractV1 } from "../contracts/mission.js";
+export declare const PROFILE_V1_SCHEMA: "canopus.profile.v1";
+export declare const PROFILE_SCHEMA: "canopus.profile.v2";
+export declare const SUPPORTED_PRODUCT_PLATFORMS: readonly ["darwin-arm64", "linux-x86_64"];
+export type ProductPlatform = (typeof SUPPORTED_PRODUCT_PLATFORMS)[number];
+export type VerifierPlatform = "linux/amd64" | "linux/arm64";
+export interface PlatformCapsule {
+    worker_profile: string;
+    worker_profile_sha256: string;
+    verifier_capsule: string;
+    verifier_capsule_sha256: string;
+    verifier_image: string;
+    verifier_platform: VerifierPlatform;
+}
+export interface ProductProfile {
+    schema: typeof PROFILE_SCHEMA;
+    name: string;
+    target: string;
+    target_packet_schema: string;
+    draft: string;
+    draft_sha256: string;
+    objective_sha256: string;
+    completion_condition_sha256: string;
+    allowed_artifacts_sha256: string;
+    budgets_sha256: string;
+    replay_argv_sha256: string;
+    landing: LandingSpec;
+    profile_sha256: string;
+    result_contract?: string;
+    result_contract_sha256?: string;
+    platforms: Record<ProductPlatform, PlatformCapsule>;
+    platform: ProductPlatform;
+    capsule_binary: string;
+    capsule_sha256: string;
+    permission_profile: string;
+    permission_profile_sha256: string;
+    verifier_image: string;
+    verifier_platform: VerifierPlatform;
+}
+export interface LegacyProductProfile {
+    schema: typeof PROFILE_V1_SCHEMA;
+    name: string;
+    target: string;
+}
+export declare function productPackageRoot(): string;
+export declare function currentProductPlatform(): ProductPlatform;
+export declare function verifierImageAt(value: unknown, at?: string): string;
+export declare function listProductProfiles(): Promise<string[]>;
+export declare function loadProductProfile(name: string, options?: {
+    allowLegacy?: false;
+    platform?: ProductPlatform;
+}): Promise<ProductProfile>;
+export declare function loadProductProfile(name: string, options: {
+    allowLegacy: true;
+    platform?: ProductPlatform;
+}): Promise<ProductProfile | LegacyProductProfile>;
+export declare function loadProfileResultContract(profile: ProductProfile): Promise<PositiveResultContractV1 | undefined>;
+export declare function packagedProfileResource(relative: string, label: string): Promise<string>;
+export declare function loadProfileDraft(profile: ProductProfile): Promise<unknown>;
+export declare function stageProfileCapsule(options: {
+    profile: ProductProfile;
+    stagingRoot: string;
+}): Promise<{
+    capsule: string;
+    source: "packaged";
+}>;
+export declare function packagedWorkerProfile(profile: ProductProfile): Promise<string>;