@vela-science/canopus 0.4.4 → 0.4.5

package/BUILD_WEEK.md

@@ -30,7 +30,9 @@ Canopus releases `0.1.0` through `0.4.3` and their dated commits were all made
 during the submission period. Version `0.4.4` advances the product and CI pin
 to Vela 0.910.0, adds the GPT-5.6 formal registration, preserves the exact
 GPT-5.4 registration from `v0.4.3`, and adds the sanitized public projection
-and claim-fidelity fallback.
+and claim-fidelity fallback. Version `0.4.5` changes documentation only to
+identify the retained worker and verifier chain precisely; all evidence roots
+and runtime behavior remain those of 0.4.4.
 
 ## Exact evidence used by the submission
 
@@ -113,7 +115,7 @@ vela reproduce .
 To inspect the packaged product under Node 22 or 24 without rebuilding:
 
 ```bash
-npm install --global @vela-science/canopus@0.4.4
+npm install --global @vela-science/canopus@0.4.5
 canopus --version
 canopus profile list
 canopus profile validate formal-erdos-505-test-dim-one-gpt56

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.4.5 - 2026-07-20
+
+- Correct the judge quickstart so the retained Erdős 1056 evidence chain is
+  identified as GPT-5.4 with an independent verifier, while the GPT-5.6 formal
+  attempt and claim-fidelity advisory remain clearly separate Build Week
+  additions. Runtime behavior, evidence roots, and Vela interfaces are
+  unchanged from 0.4.4.
+
 ## 0.4.4 - 2026-07-20
 
 - Advance the product, CI assets, runtime inspection, and released-interface

package/README.md

@@ -8,10 +8,11 @@ Give Codex a mission. Verify the work. Keep humans in authority.
 
 1. **20-second public demo:** open
    [app.vela.space/build-week](https://app.vela.space/build-week) to inspect the
-   retained Mission → GPT-5.6 → artifact → Lean → Receipt → Defer chain. No
-   account or rebuild is required.
+   retained Mission → GPT-5.4 worker → artifact → independent verifier → Vela
+   Receipt → Defer chain, plus the separate GPT-5.6 formal fail-closed attempt
+   and advisory audit. No account or rebuild is required.
 2. **90-second package inspection:** install the provenance-backed release with
-   `npm install --global @vela-science/canopus@0.4.4`, then run `canopus
+   `npm install --global @vela-science/canopus@0.4.5`, then run `canopus
    --version`, `canopus profile list`, and `canopus profile validate
    formal-erdos-505-test-dim-one-gpt56`.
 3. **Full local workflow:** use the exact `doctor` and `run` commands below on
@@ -33,7 +34,7 @@ replay or accepted state.
 
 ## Product workflow
 
-Canopus 0.4.4 targets checksum-pinned Vela 0.910.0. Install the released CLI:
+Canopus 0.4.5 targets checksum-pinned Vela 0.910.0. Install the released CLI:
 
 ```bash
 npm install --global @vela-science/canopus

package/docs/RELEASES.md

@@ -1,5 +1,13 @@
 # Release evidence
 
+## Canopus v0.4.5
+
+Version `0.4.5` is a documentation-only truthfulness correction over 0.4.4.
+It identifies the retained Erdős 1056 worker as GPT-5.4 and its verifier as an
+independent verifier, while keeping the separate GPT-5.6 formal failure and
+claim-fidelity advisory explicit. Runtime behavior, mission registrations,
+evidence roots, Vela compatibility, and authority boundaries are unchanged.
+
 ## Canopus v0.4.4
 
 Version `0.4.4` advances the product and hosted integration from Vela 0.901.0
@@ -16,10 +24,35 @@ run and all five final Vela roots, validates every reported numeric against the
 frozen artifact, and labels language judgments `model_assessment`. It is not
 landed as scientific state.
 
-Release publication remains the existing tag-triggered GitHub Actions OIDC
-workflow. The final tag, workflow runs, package root, npm integrity, and
-byte-equivalence audit are appended here after hosted gates complete; no
-reusable npm token is introduced.
+The hosted release closed the product and provenance gates:
+
+- Source/tag: `26dc0518cbeb3377d285dc4aa90bd3bc70a6e013` / `v0.4.4`
+- Cross-platform CI:
+  [run 29768275757](https://github.com/vela-science/vela-research-harness/actions/runs/29768275757)
+- CodeQL:
+  [run 29768274600](https://github.com/vela-science/vela-research-harness/actions/runs/29768274600)
+- OIDC publish and build attestation:
+  [run 29769118124](https://github.com/vela-science/vela-research-harness/actions/runs/29769118124)
+- Package SHA-256:
+  `593a3a5caa64cee5ebb2fe91a5e8518d780172462671607398f2ef6f45e79fa7`
+- npm integrity:
+  `sha512-6H4ZmnQ4nAOhRLbrkUM15AAgn4uoB+xJsLm7t7kSLbU+J3Fq4kA50HBrhEjwiRTlntCOy3/SPyvYy4WpeYJLwA==`
+- npm shasum: `36ad1a8647320ad314e081b6daa6b261e286988b`
+- npm reports the SLSA provenance v1 predicate, and `npm audit signatures`
+  verifies the registry signatures and one attestation.
+- A clean registry install under Node `v24.18.0` returned `canopus 0.4.4`,
+  listed both packaged profiles, and validated the exact GPT-5.6 formal
+  profile root.
+- The [GitHub release](https://github.com/vela-science/vela-research-harness/releases/tag/v0.4.4)
+  tarball is byte-identical to the npm tarball and its published
+  `SHA256SUMS`.
+
+The OIDC workflow's immediate npm-attestation endpoint check encountered a
+transient registry `404` after publication, so its final GitHub-release step
+did not run. Once the same endpoint and `npm audit signatures` both returned
+the expected provenance, the matching GitHub release was created from the
+exact attested npm tarball. No tag moved and no reusable npm token was
+introduced.
 
 ## Canopus v0.4.3
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vela-science/canopus",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "A bounded, replaceable research harness over released Vela interfaces",
   "type": "module",
   "private": false,