@vela-science/canopus 0.4.2 → 0.4.3

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.4.3 - 2026-07-19
+
+- Add the stable `canopus --version` and `canopus -V` probes required for exact
+  runtime discovery and clean-install diagnosis.
+- Write release checksums with portable basenames so `shasum -a 256 -c
+  SHA256SUMS` works in the directory where users download the assets.
+- Preserve `v0.4.2` and its valid npm/GitHub provenance as a released artifact;
+  `0.4.3` is the corrected default install target.
+
 ## 0.4.2 - 2026-07-19
 
 - Preserve the failed `v0.4.1` tag and its verified GitHub build attestation as

package/dist/src/cli.js

@@ -15,6 +15,7 @@ import { doctorProduct } from "./product/doctor.js";
 import { replayProduct } from "./product/replay.js";
 import { runProduct } from "./product/run.js";
 import { withdrawProduct } from "./product/withdraw.js";
+import { CANOPUS_VERSION } from "./product/version.js";
 import { listProductProfiles, packProductProfile, validateProductProfile, } from "./product/profile-bundle.js";
 import { loadProductProfile } from "./product/profile.js";
 import { runCanopus } from "./run.js";
@@ -25,6 +26,7 @@ function usage() {
     return `Canopus — bounded Vela research harness
 
 Primary workflow:
+  canopus --version
   canopus doctor [frontier]
   canopus run [frontier] [--first | --target <id>] [--profile <name>] \\
     [--output <dir>] [--no-land]
@@ -446,6 +448,12 @@ async function main(argv) {
         process.stdout.write(`${usage()}\n`);
         return;
     }
+    if (command === "--version" || command === "-V") {
+        if (file !== undefined)
+            throw new Error("--version accepts no arguments");
+        process.stdout.write(`canopus ${CANOPUS_VERSION}\n`);
+        return;
+    }
     if (command === "mission") {
         await missionCommand(argv.slice(1));
         return;

package/docs/RELEASES.md

@@ -1,8 +1,8 @@
 # Release evidence
 
-## Canopus v0.4.2
+## Canopus v0.4.3
 
-The source package advertises `0.4.0`. The public npm namespace was bootstrapped
+The source package advertises `0.4.3`. The public npm namespace was bootstrapped
 once with `0.4.0-rc.1` under the `next` tag so the package could bind its exact
 GitHub Actions trusted publisher. That bootstrap used interactive human 2FA,
 has no provenance attestation, and earns no release credit. Package publishing
@@ -13,10 +13,13 @@ corrected `v0.4.1` workflow passed both validation jobs and verified its GitHub
 build attestation, but npm interpreted `release/*.tgz` as a GitHub repository
 shorthand and stopped before OIDC publication; no npm package or GitHub release
 was created. Both tags are retained as failure evidence and are not moved. The
-corrected exact `v0.4.2` tag/version pair is
-published only by `.github/workflows/release.yml` in environment `npm`; the
-workflow must produce and verify both npm SLSA provenance and a GitHub build
-attestation before creating the matching GitHub release.
+corrected exact `v0.4.2` tag/version pair became the first stable package
+published only by `.github/workflows/release.yml` in environment `npm`. An
+independent clean-install smoke then found that its checksum manifest retained
+the build-directory prefix and that the CLI lacked a direct version probe.
+`v0.4.3` fixes both public-release UX defects. Its workflow must produce and
+verify both npm SLSA provenance and a GitHub build attestation before creating
+the matching GitHub release.
 
 The first registered quantum mission stopped safely before verification or
 landing because provider-reported usage exceeded its frozen 100,000-token

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vela-science/canopus",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "A bounded, replaceable research harness over released Vela interfaces",
   "type": "module",
   "private": false,