@vela-science/canopus 0.4.5 → 0.5.0

package/BUILD_WEEK.md

@@ -9,116 +9,115 @@
 - **Repository:** <https://github.com/vela-science/vela-research-harness>
 - **Live evidence:** <https://app.vela.space/build-week>
 
-The OpenAI Build Week submission period began July 13, 2026 at 9:00 a.m.
-Pacific and ends July 21, 2026 at 5:00 p.m. Pacific. Canopus did not exist at
-the start of that period. Its first commit,
+The submission period began July 13, 2026 at 9:00 a.m. Pacific and ends July
+21 at 5:00 p.m. Pacific. Canopus did not exist at the start. Its first commit,
 `9d95924f27842ceb14a45bb0ecaf5a777c3b2736`, was created July 15 at 11:05
 p.m. Toronto time.
 
 ## Baseline and Build Week delta
 
-The pre-existing substrate is distinguished from the submitted work:
-
-| Repository or layer | Submission-period baseline | Build Week contribution |
+| Layer | Submission-period baseline | Build Week contribution |
 | --- | --- | --- |
-| Canopus | none | Entire bounded runner, custody boundary, verifier separation, npm package, retained runs, public projection, and advisory audit |
-| Vela protocol | `26386aef9126594c27888d511b76ad65a8d56870` | Released Vela 0.910.0 is consumed through existing public interfaces; Canopus changes no protocol, Receipt, policy, or authority primitive |
-| Erdős frontier | `a143c351f8488e0c621598307e248373d9dc3374` | Retains the exact bounded 1056 artifact, Receipt, Defer proposal, and replayable final commit used by the demo |
-| Vela Observatory | `37eca05ae3bc1e2f2832ed99c58ba9fdc4bd1787` | Adds a pinned public-run type, retained-run detail route, and stable anonymous `/build-week` evidence page |
-
-Canopus releases `0.1.0` through `0.4.3` and their dated commits were all made
-during the submission period. Version `0.4.4` advances the product and CI pin
-to Vela 0.910.0, adds the GPT-5.6 formal registration, preserves the exact
-GPT-5.4 registration from `v0.4.3`, and adds the sanitized public projection
-and claim-fidelity fallback. Version `0.4.5` changes documentation only to
-identify the retained worker and verifier chain precisely; all evidence roots
-and runtime behavior remain those of 0.4.4.
-
-## Exact evidence used by the submission
-
-### Retained bounded research result
-
-The successful research example is the existing Canopus Erdős 1056 run. Its
-worker used GPT-5.4; the separate Build Week advisory below is the GPT-5.6
-addition over its immutable evidence.
-
-- Run: `run_eb6bcd46-cffd-4ae8-b630-2681bd84da71`
-- Mission: `mission_erdos1056_k15_range_10428401_10428600_native1`
-- Target: `erdos:1056`
-- Activity: worker success; verifier pass; clean-clone replay matched
-- Bounded range: `10428401..10428600`; 15 primes tested
-- Maximum multiplicity: 12 at `p=10428581`, residue `5141590`
-- Artifact root: `sha256:79370d5243095f28e65c218f3d5dc4710802e4dbe462fcfff1a35a8697a6f225`
-- Verifier root: `sha256:6d3f61b9111fde87d57340404ad5b7561a4aa777ce54c8bf639d081c216cb165`
-- Receipt root: `sha256:263506aae0144fb2aa4784ff9c145c6c41886b2956191c6458214cedd0bfd4aa`
+| Canopus | none | Entire bounded runner, worker custody boundary, verifier separation, npm package, retained runs, public projection, and evidence workflow |
+| Vela protocol | `26386aef9126594c27888d511b76ad65a8d56870` | Released Vela 0.910.0 is consumed without changing its protocol, Receipt, policy, or authority interfaces |
+| Sidon frontier | `5f138a51a6c8723d5a85ff0ffc265728c2c33c6e` | A root-bound GPT-5.6 target, a new 7,194-point witness, frozen verification, Receipt, Defer proposal, and replayable final commit |
+| Vela Observatory | `37eca05ae3bc1e2f2832ed99c58ba9fdc4bd1787` | A pinned public-run type, retained-run detail route, and stable anonymous `/build-week` evidence page |
+
+Canopus versions `0.1.0` through `0.4.6` were built during the submission
+period. Version `0.4.6` adds the successful GPT-5.6 Sidon profile and evidence,
+secure workspace-backed artifact retention, and the exact private Vela work
+session handoff required to carry a large scientific artifact through Defer.
+
+## Primary GPT-5.6 scientific result
+
+### What is new
+
+GPT-5.6 found an explicit Sidon subset of `{0,1}^24` with **7,194 points**.
+Every one of its `7,194 × 7,195 / 2 = 25,880,415` unordered componentwise
+integer pair sums is distinct. This advances the repository's mechanically
+verified but unaccepted 7,193-point seed by one point, establishing the bounded
+candidate lower bound `a(24) ≥ 7,194`. The accepted Vela state remains at its
+prior human-authorized lower bound; the new result is pending review.
+
+The discovery occurred in bounded run
+`run_230412bc-01f4-4805-9152-7fc8f8a5b8e0`. GPT-5.6 designed and executed an
+exact exchange search, removed zero-based baseline point 72, and added the
+24-bit points `970f25` and `246891`. It independently enumerated all
+25,880,415 sums. That run then failed closed because the 359 KB artifact
+remained in its transient worker workspace instead of crossing the artifact
+freeze boundary. It produced no Receipt and changed no frontier state.
+
+Canopus `0.4.6` repairs that product boundary without widening custody. A
+workspace-backed artifact is accepted only from its exact allowlisted path,
+must remain inside the sealed worker workspace, must be one regular singly
+linked file, must fit the mission byte budget, must be valid UTF-8, and is
+scanned for authentication material before being frozen. Symlinks, hardlinks,
+escapes, missing or empty files, invalid bytes, oversize files, and unrelated
+Git changes fail closed.
+
+### Completed primary run
+
+- Run: `run_f68e4cfc-e5c7-4c73-86cb-d79807c47ec4`
+- Mission: `mission_sidon_a24_at_least_7194_gpt56_v3`
+- Profile: `sidon-a24-at-least-7194-gpt56-v3`
+- Model: `gpt-5.6-sol`
+- Target packet root: `sha256:09977a08357cbe240c5a7f5c3ea8e5c7055d6b5d71bcfb5f947b49accee1a3a8`
+- Profile root: `sha256:3b529df4304b96890cdd7eed5f90fd862422b8b1e7b4da1cef0a478e6e7cdebe`
+- Worker: success
+- Artifact: 359,754 bytes at `sha256:878b05e01dbc4a785e5a671f977509f0bb338dfcb58ac53bf03d47bf6465f01e`
+- Frozen verifier: pass in a network-denied, read-only Linux capsule
+- Verifier root: `sha256:89130864b3ca4f354673416d4352616265b1e3dc25147a4ae91bbbf3874fbff8`
+- Receipt root: `sha256:91b9f0c72e2934d3f98a34de93b61a168c8a9ff560a18a63ff4a1ee6ae2f897c`
+- Evidence root: `sha256:072d5d45501fdf4fdae0481230e8b61536afbd4b02a097360bf9583a4c993a56`
+- Proposal: `vpr_491cc97cfdfe98ff`
 - Route: `defer`
 - Accepted-state delta: `0`
-- Final frontier commit: `807f0a8f770cfed05ac0dff00b952dc41052a720`
-- Public projection root: `sha256:056d7a3d9ba8d5fb682b6271e73616bff72cd9fa11f62f1ac93d76e89a699350`
+- Clean-clone replay: matched
+- Final frontier commit: `4289e05876f142e72af622672e190be26f6a6f1d`
+- Usage: 105,553 observed tokens, 88.131 seconds, 7 research processes, 1 attempt
+- Public projection root: `sha256:cf2c2ed8d54f68b8adca94f25f7ff2adcb39501fb2e68fa0b5640403dba5266e`
 
-The generated, sanitized projection is
-[`evidence/build-week/run_eb6bcd46-cffd-4ae8-b630-2681bd84da71.public.json`](evidence/build-week/run_eb6bcd46-cffd-4ae8-b630-2681bd84da71.public.json).
+The generated sanitized projection is
+[`evidence/build-week/run_f68e4cfc-e5c7-4c73-86cb-d79807c47ec4.public.json`](evidence/build-week/run_f68e4cfc-e5c7-4c73-86cb-d79807c47ec4.public.json).
 It contains no raw worker events, isolated home, authentication, private path,
 or unrestricted log.
 
-### GPT-5.6 claim-fidelity advisory
-
-The fallback registration uses `gpt-5.6-sol` once, without tools, over the
-immutable run, artifact, and five final Vela roots. Deterministic replay binds
-the schema, roots, artifact, and numeric correspondences. Language and
-publication recommendations are explicitly labeled `model_assessment`.
-
-- Registration: `erdos1056-run-eb6b-claim-fidelity-gpt56`
-- Registration root: `sha256:371390871e1a371207e3de797e45989e84bbb766e07afdab5d47fdb3536f2c1b`
-- Output-schema root: `sha256:874c61b6fbd44a2bcb68cde8b5a9a89b74f6d00f3d9a9723cb67c682bd64e045`
-- Assessment root: `sha256:9205390df001a428b4b3e2fbb0a855e9f1061754b3f87771a85fc7328824ed1f`
-- Deterministic checks: source run, all five roots, artifact root, all six
-  numeric correspondences, and the verifier/acceptance distinction pass
-- Model assessment: no universal claim; no “solved” language; publishable only
-  with the bounded-result and non-acceptance caveats
-- Scientific state landed: `false`
-
-See the [registration](advisories/erdos1056-claim-fidelity/registration.json),
-[assessment](advisories/erdos1056-claim-fidelity/results/assessment.json), and
-[verification](advisories/erdos1056-claim-fidelity/results/verification.json).
-
-### Formal GPT-5.6 fail-closed case
-
-The active `formal-erdos-505-test-dim-one-gpt56` profile binds
-`gpt-5.6-sol`, profile root
-`sha256:e2330e477bdab48aede90512b4cf3f86cccda5fa014b4e64edfed23797f8e254`,
-the frozen Lean 4.27.0 capsule, one proof-term artifact, expected route Defer,
-and maximum accepted-state delta zero.
-
-The preregistered attempt `run_4c2ba5f5-04ac-44d5-adb6-8937eb2ea165`
-produced candidate root
-`sha256:ef81cbf548d8a08e3811f0aa070b6ce0d58b52792f0bb56b5584dd806da4cb30`.
-The frozen verifier rejected an unsolved one-dimensional inverse goal and
-reported `sorryAx`, with stdout root
-`sha256:04e31b07889f94a1d205231942bf30fa6c3b27864520b6a42de58604da53e544`.
-Canopus stopped before landing. There is no Receipt, proposal, policy route,
-accepted-state delta, Git commit, or frontier mutation for this attempt. The
-raw failure directory is intentionally not published.
+## Secondary evidence
+
+The earlier retained Erdős 1056 run remains a useful bounded-research example:
+
+- Run `run_eb6bcd46-cffd-4ae8-b630-2681bd84da71`
+- Artifact root `sha256:79370d5243095f28e65c218f3d5dc4710802e4dbe462fcfff1a35a8697a6f225`
+- Verifier pass, Receipt `sha256:263506aae0144fb2aa4784ff9c145c6c41886b2956191c6458214cedd0bfd4aa`, Defer, accepted delta zero, and matched replay
+
+The GPT-5.6 claim-fidelity advisory over that immutable run also remains
+published as a non-authoritative `model_assessment`. Its deterministic checks
+bind the source run, all five roots, artifact, numeric correspondences, and the
+verifier-versus-acceptance distinction. It was not landed as scientific state.
+
+The formal profile `formal-erdos-505-test-dim-one-gpt56` supplies the public
+fail-closed counterexample. Run
+`run_4c2ba5f5-04ac-44d5-adb6-8937eb2ea165` produced a candidate, but the
+frozen Lean verifier rejected an unsolved inverse goal and `sorryAx`. Canopus
+stopped before Receipt creation or frontier mutation.
 
 ## Reproduce without rebuilding Canopus
 
-The retained scientific-state transition needs only released Vela and the
-public frontier:
+The primary state transition needs released Vela and the public frontier:
 
 ```bash
-git clone https://github.com/vela-science/erdos-frontier.git
-cd erdos-frontier
-git checkout 807f0a8f770cfed05ac0dff00b952dc41052a720
+git clone https://github.com/vela-science/sidon-frontier.git
+cd sidon-frontier
+git checkout 4289e05876f142e72af622672e190be26f6a6f1d
 vela reproduce .
 ```
 
-To inspect the packaged product under Node 22 or 24 without rebuilding:
+Inspect the packaged product under Node 22 or 24:
 
 ```bash
-npm install --global @vela-science/canopus@0.4.5
+npm install --global @vela-science/canopus@0.4.6
 canopus --version
-canopus profile list
-canopus profile validate formal-erdos-505-test-dim-one-gpt56
+canopus profile validate sidon-a24-at-least-7194-gpt56-v3
 ```
 
 Supported tool-using worker platforms are macOS arm64 and Linux x86-64,
@@ -127,27 +126,24 @@ replay surface and directs tool-using work into WSL2.
 
 ## Codex collaboration and human decisions
 
-Codex implemented and tested the harness, custody profiles, verifier routing,
-release automation, Vela 0.910.0 compatibility, public projection, GPT-5.6
-advisory, and evidence surface. The main Build Week completion task also used
-Codex to audit the live GitHub organization, verify official submission rules,
-run the exact custody preflight, execute the preregistered formal attempt, and
-diagnose its fail-closed result.
+Codex implemented and tested Canopus, its custody profiles, verifier routing,
+release automation, Vela 0.910.0 compatibility, public projection, and
+evidence surface. In the primary task, Codex also registered the GPT-5.6 Sidon
+mission, diagnosed two fail-closed handoff defects, implemented bounded
+artifact retention, reran all gates, executed the completed mission, and
+published the resulting pending frontier state.
 
-The human chose the product boundary, Developer Tools track, mission and
-fallback criteria, public presentation, and the rule that no model or Canopus
-process receives a human key. The human remains the only party that can make a
-protected scientific decision or submit the final Devpost entry. The private
-`/feedback` Session ID is kept in the submission checklist, not this repository.
+The human chose the product boundary, Developer Tools track, mission target,
+public presentation, and the rule that no model or Canopus process receives a
+human key. The human remains the only party that can make a protected
+scientific decision or submit the final Devpost entry. The private `/feedback`
+Session ID is kept in the submission checklist, not this repository.
 
 ## Nonclaims
 
 - A verifier pass is not scientific acceptance.
-- The retained Erdős 1056 result covers one exact finite range; it does not
-  solve Erdős 1056.
-- The rejected formal candidate does not prove the one-dimensional theorem or
-  the general Erdős 505 statement.
-- The GPT-5.6 advisory is a non-authoritative model assessment and was not
-  landed as scientific state.
-- Vela predates Build Week. The submission is the Canopus product and its
-  Build Week additions, not the whole Vela ecosystem.
+- The 7,194-point construction does not establish maximality, classification, or a world record.
+- The accepted Vela state did not change; the proposal remains pending human review.
+- The retained Erdős 1056 result covers one finite range and does not solve Erdős 1056.
+- The rejected formal candidate does not prove the one-dimensional theorem or Erdős 505.
+- Vela predates Build Week. The submission is Canopus and its Build Week additions, not the whole ecosystem.

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 0.5.0 - 2026-07-20
+
+- Compose against released Vela 0.911.0 and surface configured, available, and
+  leased producer work without treating a lease as an empty frontier.
+- Restore the packaged quantum-codes profile, mission draft, and verifier
+  capsule so all four published frontiers have reproducible product coverage.
+- Make Bun 1.3.12 the canonical development and public invocation path while
+  preserving the supported Node runtime for the installed package.
+- Keep historical Build Week registrations and evidence byte-identical; this
+  release adds composition and usability, not scientific authority.
+
+## 0.4.6 - 2026-07-20
+
+- Register and complete the GPT-5.6 Sidon mission that produces a new
+  7,194-point construction in `{0,1}^24`, passes the frozen verifier, lands a
+  Receipt through Defer with accepted-state delta zero, and clean-clone replays
+  the same evidence.
+- Retain large declared artifacts from their exact allowlisted worker path
+  before workspace cleanup. Reject path escapes, symlinks, hardlinks, empty or
+  missing files, oversize files, invalid UTF-8, and authentication material.
+- Preserve the exact private Vela work-session capability needed by `vela land`
+  while the publication guard continues to reject every unrelated Git change.
+- Ship both Sidon verifier capsules in the npm package and cover the package
+  allowlist with a regression test.
+- Make the sanitized public projection target-neutral and distinguish a
+  worker-time verifier-pending handoff from the final recorded verifier pass.
+
 ## 0.4.5 - 2026-07-20
 
 - Correct the judge quickstart so the retained Erdős 1056 evidence chain is

package/README.md

@@ -1,152 +1,135 @@
-# Canopus
+<p align="center">
+  <img src="docs/assets/canopus-readme-hero.jpg" width="960" alt="Canopus carries one bounded target through an isolated Codex worker and separate verifier into a Receipt pending human review." />
+</p>
 
-**Canopus: Bounded Research for Codex**
+<p align="center"><strong>Bounded research for Codex.</strong></p>
 
-Give Codex a mission. Verify the work. Keep humans in authority.
+<p align="center">
+  Give Codex one finite mission. Verify the artifact independently. Keep humans in authority.
+</p>
 
-## Build Week judge quickstart
+<p align="center">
+  <a href="https://www.npmjs.com/package/@vela-science/canopus"><img alt="npm" src="https://img.shields.io/npm/v/@vela-science/canopus?style=flat-square&color=C9A664&labelColor=081224" /></a>
+  <a href="https://github.com/vela-science/vela-research-harness/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/vela-science/vela-research-harness/ci.yml?branch=main&style=flat-square&label=build&labelColor=081224" /></a>
+  <a href="LICENSE-APACHE"><img alt="Apache-2.0 OR MIT" src="https://img.shields.io/badge/license-Apache--2.0%20OR%20MIT-4F8F8B?style=flat-square&labelColor=081224" /></a>
+</p>
 
-1. **20-second public demo:** open
-   [app.vela.space/build-week](https://app.vela.space/build-week) to inspect the
-   retained Mission → GPT-5.4 worker → artifact → independent verifier → Vela
-   Receipt → Defer chain, plus the separate GPT-5.6 formal fail-closed attempt
-   and advisory audit. No account or rebuild is required.
-2. **90-second package inspection:** install the provenance-backed release with
-   `npm install --global @vela-science/canopus@0.4.5`, then run `canopus
-   --version`, `canopus profile list`, and `canopus profile validate
-   formal-erdos-505-test-dim-one-gpt56`.
-3. **Full local workflow:** use the exact `doctor` and `run` commands below on
-   a clean supported frontier checkout. The public run page includes a separate
-   no-model `vela reproduce .` path for the retained evidence.
+<p align="center">
+  <a href="https://app.vela.space/build-week">Live evidence</a> ·
+  <a href="BUILD_WEEK.md">Build Week record</a> ·
+  <a href="docs/MISSIONS.md">Missions</a> ·
+  <a href="docs/RUN_RECORD.md">Run records</a> ·
+  <a href="https://github.com/vela-science/vela">Vela</a>
+</p>
 
-The Build Week delta, baseline commits, Codex collaboration, exact run roots,
-and nonclaims are recorded in [BUILD_WEEK.md](BUILD_WEEK.md).
+Canopus is a removable producer over released Vela and Git. It gives Codex one
+exact work offer, freezes the result, runs a separate verifier, and can land a
+Receipt through `vela land`.
 
-Canopus is a bounded research runner over released Vela and Git interfaces. It
-selects an exact Vela work offer, gives a finite mission to a tool-enabled Codex
-worker, freezes the output, runs an independent verifier container, and may land
-a Receipt v1 through `vela land`.
+It cannot sign, accept a proposal, or make a scientific decision. Removing
+Canopus does not change accepted state or Vela replay.
 
-Canopus cannot sign, accept a proposal, or make a scientific decision. A
-verifier-passing landing remains `Deferred` or `pending_review` unless an
-already-signed Vela policy says otherwise. Removing Canopus does not change Vela
-replay or accepted state.
+## Judge quickstart
 
-## Product workflow
+**20 seconds — inspect the real result:** open the anonymous
+[Build Week evidence page](https://app.vela.space/build-week) and follow
+Mission → GPT-5.6 → artifact → verifier → Receipt → Defer.
 
-Canopus 0.4.5 targets checksum-pinned Vela 0.910.0. Install the released CLI:
+**90 seconds — inspect the shipped product:**
 
-```bash
-npm install --global @vela-science/canopus
+```sh
+bunx @vela-science/canopus@0.5.0 --version
+bunx @vela-science/canopus@0.5.0 profile validate sidon-a24-at-least-7194-gpt56-v3
 ```
 
-Its ordinary path is:
+**Full workflow — reproduce without rebuilding Canopus:**
 
-```bash
-canopus doctor /path/to/frontier
-canopus run /path/to/frontier --first
-canopus inspect latest
-canopus replay /path/to/run.json
-canopus withdraw /path/to/frontier --run latest --reason "superseded"
+```sh
+git clone https://github.com/vela-science/sidon-frontier.git
+cd sidon-frontier
+git checkout 4289e05876f142e72af622672e190be26f6a6f1d
+vela reproduce .
 ```
 
-`doctor` discovers and binds Vela, Codex, Git, Docker, the clean frontier roots,
-the first Vela producer offer, and a registered verifier profile. It also runs
-the same generated-canary native custody preflight required by `run`; native
-Windows reports the WSL2 handoff instead of claiming mission readiness. `run`
-uses the first offer unless an exact registered target is requested. It refuses
-dirty frontiers, drifted binaries or roots, missing verifier images,
-cloud-synced output paths, and unregistered targets.
-`inspect latest` selects the newest completed or safely stopped run. Failed-run
-projections state whether landing was never attempted or whether retained
-landing-recovery evidence must be inspected; they never infer an unchanged
-frontier from process failure alone. Withdrawal's `latest` selector remains
-limited to completed, proposal-bearing runs.
-
-The native Codex worker runs under a bundled default-deny profile with only the
-target workspace and required compiler files exposed. macOS uses Seatbelt;
-Linux and WSL2 use Codex's Bubblewrap sandbox. Native Windows supports the
-read-only product surface and directs tool-using runs to WSL2 before creating
-run output or probing credentials. Open WSL2, enter the frontier through its
-Linux path, and rerun the same `canopus run` command there. Authentication,
-human keys, unrelated repositories, browser/search/MCP/app surfaces,
-delegation, and command network access remain outside the worker boundary. The
-verifier runs separately with network and writes denied.
-
-A successful landing creates unsigned local Git commits and fast-forwards the
-source checkout only after verifier success and clean-clone reproduction. It
-does not push a remote. Use `--no-land` for a diagnostic run that leaves the
-source frontier unchanged.
-
-Profiles are Defer-only by default. A profile can request the policy lane only
-when it includes a closed positive result contract and binds the full target
-packet, profile, verifier capsule, and result-contract roots into the Receipt.
-Canopus does not decide whether that work is admitted: released Vela evaluates
-the exact signed policy, and any route, root, result class, or accepted-state
-delta outside the frozen profile stops the run.
-
-After a pending landing reproduces, Canopus retains only the exact
-Receipt-bound producer seed needed to withdraw that one proposal. The
-capability never enters worker, verifier, or run evidence. Withdrawal is
-explicit, runs in a disposable exact-head clone, proves the accepted scientific
-projection unchanged, fast-forwards the clean source, and then deletes the
-secret. A later human decision also consumes the now-useless secret.
-
-The installed product contains only the current active producer profiles:
-
-- `erdos1056-k15-10428401-10428600`
-- `formal-erdos-505-test-dim-one-gpt56`
-
-The Erdős capsule is a content-addressed static Linux binary for arm64 and
-x86-64. The formal capsule is a small reviewed shell edge over an immutable
-Linux-amd64 Lean image; Apple-silicon hosts bind Docker's exact amd64 emulation
-instead of relying on implicit platform selection.
-Completed and stopped profile registrations remain in Git and release evidence,
-not in default discovery or the installed package. The shared source and pinned
-build provenance remain available for reproducible rebuilding, but an installed
-product run does not require a cross-compiler.
-
-## Advanced and historical interfaces
-
-Mission v1 remains the portable interface for preparing and validating a frozen
-bundle:
-
-```bash
-canopus mission prepare path/to/draft.json \
-  --source /clean/frontier --output /new/bundle --vela /path/to/vela \
-  --codex /path/to/codex --verifier-image sha256:<image-root>
-canopus mission validate /new/bundle/mission.json
+## Quickstart
+
+Run the provenance-backed public package with Bun:
+
+```sh
+bunx @vela-science/canopus@0.5.0 --version
+```
+
+Inspect a clean frontier, then run its first ranked producer offer:
+
+```sh
+bunx @vela-science/canopus@0.5.0 doctor /path/to/frontier
+bunx @vela-science/canopus@0.5.0 run /path/to/frontier --first
+bunx @vela-science/canopus@0.5.0 inspect latest
+bunx @vela-science/canopus@0.5.0 replay /path/to/run.json
 ```
 
-Closed profile v2 contracts have a separate advanced lifecycle:
+Use `--no-land` for a diagnostic mission that cannot change the source frontier:
 
-```bash
-canopus profile list
-canopus profile show erdos1056-k15-10428401-10428600
-canopus profile validate erdos1056-k15-10428401-10428600
-canopus profile pack erdos1056-k15-10428401-10428600 --output /new/profile-pack
-canopus profile validate formal-erdos-505-test-dim-one-gpt56
+```sh
+bunx @vela-science/canopus@0.5.0 run /path/to/frontier --first --no-land
 ```
 
-Mission v0 and the stopped cold-use registrations remain available in Git for
-exact historical reproduction. Benchmark commands, compiled benchmark modules,
-registrations, and benchmark documentation are intentionally absent from the
-installed npm package.
+`doctor` binds the exact Vela, Codex, Git, frontier, packet, profile, and verifier
+roots. `run` refuses dirty frontiers, drifted roots, missing capsules, and
+unregistered targets. It never silently skips the first ranked offer.
+
+## Custody and authority
+
+| Surface | Can do | Cannot do |
+| --- | --- | --- |
+| Codex worker | Use tools inside one bounded workspace | Reach the network, host home, human keys, or verifier |
+| Verifier | Read frozen candidate bytes and declared inputs | Write, use the network, or make an authority decision |
+| Canopus | Preserve evidence, replay, land a Receipt, withdraw its own proposal | Sign, accept, reject, or call verifier success acceptance |
+
+The worker uses macOS Seatbelt or Codex's Bubblewrap sandbox on Linux and WSL2.
+The verifier runs in a separate pinned container with network and writes denied.
+
+## Everyday commands
+
+```sh
+canopus doctor [frontier]
+canopus run [frontier] [--first | --target <id>] [--profile <name>] [--no-land]
+canopus inspect [run.json | latest]
+canopus replay <run.json>
+```
+
+Advanced profile and withdrawal commands are documented in
+[Missions](docs/MISSIONS.md). Installed profiles are closed,
+content-addressed contracts that bind the target, packet, objective, artifact
+types, worker, verifier, replay command, budgets, and landing ceiling.
+
+## OpenAI Build Week
+
+Inspect the retained Mission → worker → artifact → verifier → Receipt → Defer
+chain on the [live evidence surface](https://app.vela.space/build-week). Exact
+commits, run roots, audit evidence, and nonclaims live in
+[`BUILD_WEEK.md`](BUILD_WEEK.md).
 
 ## Development
 
-Requires Node 22 or 24, pnpm 10, Vela 0.910.0, Codex CLI 0.144.6, and Docker.
-Linux and WSL2 also require Bubblewrap. On Ubuntu 24.04, follow OpenAI's
-[targeted AppArmor setup](https://developers.openai.com/codex/concepts/sandboxing#prerequisites)
-for `bwrap-userns-restrict`; Canopus never disables the global unprivileged
-user-namespace restriction or falls back to an unsandboxed worker.
+Requires Bun 1.3.12, Vela 0.911.0, Codex CLI 0.144.6, and Docker. The built
+package also runs under Node 22 or 24; unsupported odd-numbered Node releases
+are rejected rather than silently treated as supported.
 
-```bash
-pnpm install
-pnpm check
-pnpm pack --dry-run
+```sh
+bun install --frozen-lockfile
+bun run check
+bun run pack:check
 ```
 
-See [run records](docs/RUN_RECORD.md) for evidence and publication semantics,
-[mission roles](docs/MISSIONS.md) for the bounded jobs, [ADR 0001](docs/adr/0001-harness-boundary-and-name.md)
-for the deletion test, and [release evidence](docs/RELEASES.md) for exact roots.
+## Documentation
+
+- [Missions and profiles](docs/MISSIONS.md)
+- [Run records and publication](docs/RUN_RECORD.md)
+- [Release evidence](docs/RELEASES.md)
+- [Why the harness stays removable](docs/adr/0001-harness-boundary-and-name.md)
+
+## License
+
+Apache-2.0 OR MIT, at your option. Canopus is a replaceable producer; Vela
+remains the protocol and authority boundary.