@vela-science/canopus 0.4.6 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.5.0 - 2026-07-20
+
+- Compose against released Vela 0.911.0 and surface configured, available, and
+  leased producer work without treating a lease as an empty frontier.
+- Restore the packaged quantum-codes profile, mission draft, and verifier
+  capsule so all four published frontiers have reproducible product coverage.
+- Make Bun 1.3.12 the canonical development and public invocation path while
+  preserving the supported Node runtime for the installed package.
+- Keep historical Build Week registrations and evidence byte-identical; this
+  release adds composition and usability, not scientific authority.
+
 ## 0.4.6 - 2026-07-20
 
 - Register and complete the GPT-5.6 Sidon mission that produces a new

package/README.md

@@ -38,8 +38,8 @@ Mission → GPT-5.6 → artifact → verifier → Receipt → Defer.
 **90 seconds — inspect the shipped product:**
 
 ```sh
-npx -p @vela-science/canopus@0.4.6 canopus --version
-npx -p @vela-science/canopus@0.4.6 canopus profile validate sidon-a24-at-least-7194-gpt56-v3
+bunx @vela-science/canopus@0.5.0 --version
+bunx @vela-science/canopus@0.5.0 profile validate sidon-a24-at-least-7194-gpt56-v3
 ```
 
 **Full workflow — reproduce without rebuilding Canopus:**
@@ -53,26 +53,25 @@ vela reproduce .
 
 ## Quickstart
 
-Install the provenance-backed public package:
+Run the provenance-backed public package with Bun:
 
 ```sh
-npm install --global @vela-science/canopus@0.4.6
-canopus --version
+bunx @vela-science/canopus@0.5.0 --version
 ```
 
 Inspect a clean frontier, then run its first ranked producer offer:
 
 ```sh
-canopus doctor /path/to/frontier
-canopus run /path/to/frontier --first
-canopus inspect latest
-canopus replay /path/to/run.json
+bunx @vela-science/canopus@0.5.0 doctor /path/to/frontier
+bunx @vela-science/canopus@0.5.0 run /path/to/frontier --first
+bunx @vela-science/canopus@0.5.0 inspect latest
+bunx @vela-science/canopus@0.5.0 replay /path/to/run.json
 ```
 
 Use `--no-land` for a diagnostic mission that cannot change the source frontier:
 
 ```sh
-canopus run /path/to/frontier --first --no-land
+bunx @vela-science/canopus@0.5.0 run /path/to/frontier --first --no-land
 ```
 
 `doctor` binds the exact Vela, Codex, Git, frontier, packet, profile, and verifier
@@ -113,12 +112,14 @@ commits, run roots, audit evidence, and nonclaims live in
 
 ## Development
 
-Requires Node 22 or 24, pnpm 10, Vela 0.910.0, Codex CLI 0.144.6, and Docker.
+Requires Bun 1.3.12, Vela 0.911.0, Codex CLI 0.144.6, and Docker. The built
+package also runs under Node 22 or 24; unsupported odd-numbered Node releases
+are rejected rather than silently treated as supported.
 
 ```sh
-pnpm install --frozen-lockfile
-pnpm check
-pnpm pack --dry-run
+bun install --frozen-lockfile
+bun run check
+bun run pack:check
 ```
 
 ## Documentation

package/capsules/quantum-10-1-4/verifier.py

@@ -0,0 +1,152 @@
+#!/usr/bin/env python3
+"""Verify one explicit [[10,1,d>=4]] stabilizer witness."""
+
+from __future__ import annotations
+
+import itertools
+import json
+import pathlib
+import sys
+
+SCHEMA = "canopus.quantum-stabilizer-witness.v1"
+TARGET = "quantum:[[10,1,4]]"
+N = 10
+K = 1
+EXPECTED_KEYS = {"schema", "target", "n", "k", "generators"}
+
+
+def fail(message: str) -> "NoReturn":
+    print(f"quantum verifier: {message}", file=sys.stderr)
+    raise SystemExit(1)
+
+
+def pauli_vector(pauli: str) -> int:
+    if len(pauli) != N or any(symbol not in "IXYZ" for symbol in pauli):
+        fail("each generator must be a length-10 string over I, X, Y, Z")
+    vector = 0
+    for qubit, symbol in enumerate(pauli):
+        if symbol in "XY":
+            vector |= 1 << qubit
+        if symbol in "ZY":
+            vector |= 1 << (N + qubit)
+    return vector
+
+
+def symplectic(left: int, right: int) -> int:
+    mask = (1 << N) - 1
+    left_x, left_z = left & mask, left >> N
+    right_x, right_z = right & mask, right >> N
+    return ((left_x & right_z).bit_count() + (left_z & right_x).bit_count()) & 1
+
+
+def binary_rank(rows: list[int]) -> int:
+    basis: dict[int, int] = {}
+    for original in rows:
+        row = original
+        while row:
+            pivot = row.bit_length() - 1
+            if pivot in basis:
+                row ^= basis[pivot]
+            else:
+                basis[pivot] = row
+                break
+    return len(basis)
+
+
+def stabilizer_span(generators: list[int]) -> set[int]:
+    span = {0}
+    for generator in generators:
+        span.update(value ^ generator for value in tuple(span))
+    return span
+
+
+def error_vector(positions: tuple[int, ...], symbols: tuple[str, ...]) -> int:
+    vector = 0
+    for qubit, symbol in zip(positions, symbols, strict=True):
+        if symbol in "XY":
+            vector |= 1 << qubit
+        if symbol in "ZY":
+            vector |= 1 << (N + qubit)
+    return vector
+
+
+def main() -> None:
+    if len(sys.argv) != 2:
+        fail("usage: verifier.py WITNESS.json")
+    witness_path = pathlib.Path(sys.argv[1])
+    metadata = witness_path.lstat()
+    if not witness_path.is_file() or witness_path.is_symlink() or metadata.st_size > 65_536:
+        fail("witness must be one bounded regular file")
+    with witness_path.open("rb") as source:
+        raw = source.read(65_537)
+    if len(raw) > 65_536:
+        fail("witness exceeds 65536 bytes")
+    try:
+        witness = json.loads(raw)
+    except (UnicodeDecodeError, json.JSONDecodeError) as error:
+        fail(f"witness is not valid UTF-8 JSON: {error}")
+    if not isinstance(witness, dict) or set(witness) != EXPECTED_KEYS:
+        fail("witness fields must be exactly schema, target, n, k, generators")
+    if witness["schema"] != SCHEMA or witness["target"] != TARGET:
+        fail("witness schema or target is wrong")
+    if type(witness["n"]) is not int or type(witness["k"]) is not int:
+        fail("n and k must be integers")
+    if witness["n"] != N or witness["k"] != K:
+        fail("witness must declare n=10 and k=1")
+    declared = witness["generators"]
+    if not isinstance(declared, list) or len(declared) != N - K:
+        fail("witness must contain exactly nine generators")
+    if any(not isinstance(generator, str) for generator in declared):
+        fail("every generator must be a string")
+    if len(set(declared)) != len(declared):
+        fail("generators must be distinct")
+    generators = [pauli_vector(generator) for generator in declared]
+    if any(generator == 0 for generator in generators):
+        fail("identity is not a generator")
+    for left, right in itertools.combinations(generators, 2):
+        if symplectic(left, right) != 0:
+            fail("generators do not commute")
+    rank = binary_rank(generators)
+    if rank != N - K:
+        fail(f"generator rank is {rank}, expected nine")
+    span = stabilizer_span(generators)
+    if len(span) != 1 << (N - K):
+        fail("stabilizer span has the wrong cardinality")
+
+    tested = 0
+    degenerate = 0
+    for weight in range(1, 4):
+        for positions in itertools.combinations(range(N), weight):
+            for symbols in itertools.product("XYZ", repeat=weight):
+                tested += 1
+                error = error_vector(positions, symbols)
+                if all(symplectic(error, generator) == 0 for generator in generators):
+                    if error not in span:
+                        fail(
+                            "found an undetectable non-stabilizer Pauli below weight four: "
+                            f"positions={positions}, symbols={''.join(symbols)}"
+                        )
+                    degenerate += 1
+    if tested != 3_675:
+        fail(f"internal enumeration count is {tested}, expected 3675")
+    print(
+        json.dumps(
+            {
+                "schema": "canopus.quantum-stabilizer-verification.v1",
+                "target": TARGET,
+                "n": N,
+                "k": K,
+                "rank": rank,
+                "stabilizer_size": len(span),
+                "errors_weight_1_to_3_tested": tested,
+                "low_weight_stabilizers": degenerate,
+                "distance_at_least": 4,
+            },
+            sort_keys=True,
+            separators=(",", ":"),
+        )
+    )
+
+
+if __name__ == "__main__":
+    main()

package/dist/src/product/doctor.js

@@ -28,10 +28,26 @@ function nonnegative(value, at) {
     }
     return value;
 }
+function noAvailableProducerTarget(offer) {
+    const leased = Array.isArray(offer.leased_targets) ? offer.leased_targets : [];
+    if (leased.length > 0) {
+        const summaries = leased.map((value, index) => {
+            const lease = objectAt(value, `vela next.leased_targets[${index}]`);
+            const target = stringAt(lease.target_id, "leased target id", { min: 1, max: 256 });
+            const actor = stringAt(lease.actor, "leased target actor", { min: 1, max: 256 });
+            const expires = lease.expires_at === undefined
+                ? "unknown expiry"
+                : stringAt(lease.expires_at, "leased target expiry", { min: 1, max: 64 });
+            return `${target} by ${actor} until ${expires}`;
+        });
+        return new Error(`no producer target is currently available; configured work is leased: ${summaries.join(", ")}`);
+    }
+    return new Error("vela next returned no producer target");
+}
 export function selectProductOffer(offer, profile, requestedTarget) {
     const targets = offer.targets;
     if (!Array.isArray(targets) || targets.length === 0) {
-        throw new Error("vela next returned no producer target");
+        throw noAvailableProducerTarget(offer);
     }
     if (requestedTarget !== undefined && requestedTarget !== profile.target) {
         throw new Error(`registered profile ${profile.name} targets ${profile.target}, not requested target ${requestedTarget}`);
@@ -62,7 +78,7 @@ export async function resolveProductProfile(offer, profileName, requestedTarget)
         return loadProductProfile(profileName);
     const targets = offer.targets;
     if (!Array.isArray(targets) || targets.length === 0) {
-        throw new Error("vela next returned no producer target");
+        throw noAvailableProducerTarget(offer);
     }
     const selectedOffer = requestedTarget === undefined
         ? objectAt(targets[0], "vela next.targets[0]")
@@ -104,8 +120,8 @@ export async function doctorProduct(options) {
             runtimeIdentity({ name: "vela", cwd: frontier, home: runtime, runner }),
             runtimeIdentity({ name: "git", cwd: frontier, home: runtime, runner }),
         ]);
-        if (vela.version !== "vela 0.910.0") {
-            throw new Error(`Canopus ${CANOPUS_VERSION} requires vela 0.910.0, observed ${vela.version}`);
+        if (vela.version !== "vela 0.911.0") {
+            throw new Error(`Canopus ${CANOPUS_VERSION} requires vela 0.911.0, observed ${vela.version}`);
         }
         const [status, offer, gitStatus] = await Promise.all([
             jsonCommand({ runner, argv: [vela.binary, "status", ".", "--json"], cwd: frontier, home: runtime, label: "vela status" }),

package/dist/src/vela/cli.js

@@ -432,7 +432,7 @@ export class VelaClient {
         if (replay.source_hash !== undefined) {
             assertEqual(normalizeSha256(replay.source_hash, "vela check.replay.source_hash"), checkCurrent, "Vela source snapshot");
         }
-        const proof = version === "0.900.0" || version === "0.900.1" || version === "0.900.2" || version === "0.901.0" || version === "0.910.0"
+        const proof = version === "0.900.0" || version === "0.900.1" || version === "0.900.2" || version === "0.901.0" || version === "0.910.0" || version === "0.911.0"
             ? {
                 ok: true,
                 command: "status_root_projection",

package/docs/RELEASES.md

@@ -1,5 +1,45 @@
 # Release evidence
 
+## Canopus v0.4.6
+
+Version `0.4.6` is the primary Build Week science release. It registers the
+bounded `gpt-5.6-sol` Sidon mission, securely retains the worker's declared
+large artifact before workspace teardown, packages the frozen Sidon verifier
+capsules, and publishes the sanitized public projection of the successful
+7,194-point construction.
+
+The exact run completed the full product chain: worker success, frozen
+verifier pass, Vela route `defer`, accepted-state delta zero, and matching
+clean-clone replay. The pending proposal is evidence, not scientific
+acceptance.
+
+- Source/tag: `ad72a7aca63aaa6c060f840020cca6871e4a9f11` / `v0.4.6`
+- Cross-platform CI and installed-package smoke:
+  [run 29783128714](https://github.com/vela-science/vela-research-harness/actions/runs/29783128714)
+- CodeQL:
+  [run 29783117151](https://github.com/vela-science/vela-research-harness/actions/runs/29783117151)
+- OIDC publish and GitHub build attestation:
+  [run 29783128737](https://github.com/vela-science/vela-research-harness/actions/runs/29783128737)
+- Package SHA-256: `d1c30b0c35b56cb7d874e3646a5d3ddc2abe2f61e38da0c6d2c7163d6de09300`
+- npm shasum: `ca9e9f5a8c064c749523f2e47a4936030367eed3`
+- npm integrity:
+  `sha512-Y3vL/29YEYnKt6iniPvSi5C85UHEOWZ+vtlXiqZSyyyNo5emXkC5gt8fJ4chzEMi7iTYzaRPOv0hsNuPnbUhVQ==`
+- A fresh `npm audit signatures --include-attestations` verifies the registry
+  signatures and the SLSA provenance v1 attestation.
+- A clean registry execution under Node `v24.14.0` returned `canopus 0.4.6`
+  and validated the exact packaged Sidon v3 profile root.
+- Public package and matching release:
+  [npm](https://www.npmjs.com/package/@vela-science/canopus/v/0.4.6),
+  [GitHub](https://github.com/vela-science/vela-research-harness/releases/tag/v0.4.6)
+
+The OIDC workflow published successfully, but its immediate registry
+attestation audit encountered a transient npm attestations-endpoint `404`, so
+the final GitHub-release step did not run. Once the same registry tarball
+passed both `gh attestation verify` against the exact release workflow/tag and
+the npm signature audit, the matching GitHub release was created from those
+bytes. The tag did not move and no reusable npm token was introduced. The
+workflow now retries the full audit while the registry endpoint propagates.
+
 ## Canopus v0.4.5
 
 Version `0.4.5` is a documentation-only truthfulness correction over 0.4.4.

package/missions/quantum-10-1-4-retry/mission.draft.json

@@ -0,0 +1,40 @@
+{
+  "id": "mission_quantum_10_1_4_stabilizer_v2",
+  "target": "quantum:[[10,1,4]]",
+  "frontier": ".",
+  "actor": "agent:canopus-local",
+  "role": "producer",
+  "claim_type": "computational",
+  "replayability": "exact",
+  "objective": "Produce exactly one explicit stabilizer witness at artifacts/quantum-10-1-4.witness.json. The JSON fields must be exactly schema, target, n, k, and generators. Set schema to canopus.quantum-stabilizer-witness.v1, target to quantum:[[10,1,4]], n to 10, k to 1, and generators to exactly nine distinct length-10 strings over I, X, Y, Z. The generators must be non-identity, pairwise commuting, GF(2)-independent, and define no undetectable non-stabilizer Pauli of weight one, two, or three. A null or failed result is valid if no candidate is found. Work only from the supplied frontier and do not assume access to any earlier run artifact. Do not claim classification, optimality, or universal nonexistence.",
+  "completion_condition": "The frozen verifier independently checks generator validity, pairwise symplectic commutation, rank nine, stabilizer-span membership, and all 3,675 Pauli errors of weight one through three in a separate network-denied and write-denied container.",
+  "allowed_paths": [
+    "artifacts/quantum-10-1-4.witness.json"
+  ],
+  "budgets": {
+    "max_research_wall_time_ms": 1800000,
+    "max_research_processes": 16,
+    "max_research_output_bytes": 16777216,
+    "max_prompt_bytes": 2097152,
+    "max_artifact_bytes": 65536,
+    "max_attempts": 1,
+    "max_observed_tokens": 400000
+  },
+  "worker": {
+    "model": "gpt-5.4"
+  },
+  "verifier": {
+    "argv": [
+      "capsule/verifier",
+      "{artifact:artifacts/quantum-10-1-4.witness.json}"
+    ],
+    "cwd": "targets",
+    "timeout_ms": 30000,
+    "max_output_bytes": 65536,
+    "capsule_path": "capsule/verifier"
+  },
+  "scientific_chain": {
+    "predicted_observable": "The frozen verifier reports rank nine, stabilizer size 512, exactly 3,675 checked Pauli errors, and distance_at_least=4 for the supplied generator set.",
+    "performed_test": "capsule/verifier artifacts/quantum-10-1-4.witness.json"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vela-science/canopus",
-  "version": "0.4.6",
+  "version": "0.5.0",
   "description": "A bounded, replaceable research harness over released Vela interfaces",
   "type": "module",
   "private": false,
@@ -16,6 +16,7 @@
   "engines": {
     "node": ">=22 <23 || >=24 <25"
   },
+  "packageManager": "bun@1.3.12",
   "bin": {
     "canopus": "dist/src/cli.js"
   },
@@ -55,6 +56,7 @@
     "capsules/erdos1056-k15/bin/linux-arm64/10428401-10428600/verifier",
     "capsules/erdos1056-k15/bin/linux-x86_64/10428401-10428600/verifier",
     "capsules/formal-erdos-505-test-dim-one/verifier",
+    "capsules/quantum-10-1-4/verifier.py",
     "capsules/sidon-a24/bin/linux-arm64/verifier",
     "capsules/sidon-a24/bin/linux-x86_64/verifier",
     "missions",
@@ -76,18 +78,19 @@
     "LICENSE-APACHE",
     "LICENSE-MIT"
   ],
-  "devDependencies": {
-    "@types/node": "^24.0.0",
-    "typescript": "^5.9.0"
-  },
   "scripts": {
     "build": "node scripts/clean-dist.mjs && tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "lint": "tsc -p tsconfig.json --noEmit",
-    "test": "pnpm run build && node --test 'dist/tests/**/*.test.js' 'tests/**/*.test.mjs'",
-    "check": "pnpm run lint && pnpm run test",
-    "pack:check": "pnpm pack --dry-run",
+    "test": "bun run build && node --test 'dist/tests/**/*.test.js' 'tests/**/*.test.mjs'",
+    "check": "bun run lint && bun run test",
+    "prepack": "bun run build",
+    "pack:check": "bun pm pack --dry-run",
     "fixture:hostile-custody": "node scripts/run-hostile-native-custody-fixture.mjs",
     "fixture:hostile-verifier": "node scripts/run-hostile-verifier-fixture.mjs"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.9.0"
   }
-}
+}

package/profiles/quantum-10-1-4-stabilizer-retry.json

@@ -0,0 +1,35 @@
+{
+  "schema": "canopus.profile.v2",
+  "name": "quantum-10-1-4-stabilizer-retry",
+  "target": "quantum:[[10,1,4]]",
+  "target_packet_schema": "quantum-codes.stabilizer-work.v1",
+  "draft": "missions/quantum-10-1-4-retry/mission.draft.json",
+  "draft_sha256": "sha256:e19f77440210492229e77014766abda013ab08ae5d8780a1ba7ae88f299c6c9d",
+  "objective_sha256": "sha256:bb432a7dedff4ed91facabc519f9d822988fe5a071342e6b1b7da15ab922e81e",
+  "completion_condition_sha256": "sha256:3f8efa58f9262d0e7a5cf3c7357a52b41331c8de4996c8d46d4bc187893a2372",
+  "allowed_artifacts_sha256": "sha256:17c9b63d133d87c3f8947805a414772597b99babcebdf95645c80a8357b67e35",
+  "budgets_sha256": "sha256:af61ff3790f8a96491fecca0693b6498f89b87ae7f67cebdbe85bef1670c48a0",
+  "replay_argv_sha256": "sha256:db20f2bd15f3bad1de911942247efbc190199d9d3683462a41723302b7ffacce",
+  "landing": {
+    "expected_routes": [
+      "defer"
+    ],
+    "max_accepted_delta": 0
+  },
+  "platforms": {
+    "darwin-arm64": {
+      "worker_profile": "runtime/native-worker/config.toml",
+      "worker_profile_sha256": "sha256:12b58762819481ad101e7a172a296224b6050a8a07a7431272e521a4102908da",
+      "verifier_capsule": "capsules/quantum-10-1-4/verifier.py",
+      "verifier_capsule_sha256": "sha256:7070364ac9017b597b7765efd772f68f543008b64217df4b0d43e72719527160",
+      "verifier_image": "ghcr.io/vela-science/canopus-verifier@sha256:a6f354862f2a3f7d72eb99244c65fa8583c98b74e17e3d5ce6e31ef48aa16536"
+    },
+    "linux-x86_64": {
+      "worker_profile": "runtime/native-worker/config-linux.toml",
+      "worker_profile_sha256": "sha256:fddecc4b7458b91f6d55ae16b666d297ae7bcd1a2f5deeb6650dcea60fc0242c",
+      "verifier_capsule": "capsules/quantum-10-1-4/verifier.py",
+      "verifier_capsule_sha256": "sha256:7070364ac9017b597b7765efd772f68f543008b64217df4b0d43e72719527160",
+      "verifier_image": "ghcr.io/vela-science/canopus-verifier@sha256:a6f354862f2a3f7d72eb99244c65fa8583c98b74e17e3d5ce6e31ef48aa16536"
+    }
+  }
+}