@vela-science/canopus 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.5.1 - 2026-07-20
+
+- Preserve exact pending-result replay roots instead of recomputing a receipt
+  projection with incomplete post-run state.
+- Keep the published `0.5.0` package and failed post-publication workflow as
+  audit evidence; `0.5.1` is the corrected default install target.
+
 ## 0.5.0 - 2026-07-20
 
 - Compose against released Vela 0.911.0 and surface configured, available, and

package/README.md

@@ -38,8 +38,8 @@ Mission → GPT-5.6 → artifact → verifier → Receipt → Defer.
 **90 seconds — inspect the shipped product:**
 
 ```sh
-bunx @vela-science/canopus@0.5.0 --version
-bunx @vela-science/canopus@0.5.0 profile validate sidon-a24-at-least-7194-gpt56-v3
+bunx @vela-science/canopus@0.5.1 --version
+bunx @vela-science/canopus@0.5.1 profile validate sidon-a24-at-least-7194-gpt56-v3
 ```
 
 **Full workflow — reproduce without rebuilding Canopus:**
@@ -56,22 +56,22 @@ vela reproduce .
 Run the provenance-backed public package with Bun:
 
 ```sh
-bunx @vela-science/canopus@0.5.0 --version
+bunx @vela-science/canopus@0.5.1 --version
 ```
 
 Inspect a clean frontier, then run its first ranked producer offer:
 
 ```sh
-bunx @vela-science/canopus@0.5.0 doctor /path/to/frontier
-bunx @vela-science/canopus@0.5.0 run /path/to/frontier --first
-bunx @vela-science/canopus@0.5.0 inspect latest
-bunx @vela-science/canopus@0.5.0 replay /path/to/run.json
+bunx @vela-science/canopus@0.5.1 doctor /path/to/frontier
+bunx @vela-science/canopus@0.5.1 run /path/to/frontier --first
+bunx @vela-science/canopus@0.5.1 inspect latest
+bunx @vela-science/canopus@0.5.1 replay /path/to/run.json
 ```
 
 Use `--no-land` for a diagnostic mission that cannot change the source frontier:
 
 ```sh
-bunx @vela-science/canopus@0.5.0 run /path/to/frontier --first --no-land
+bunx @vela-science/canopus@0.5.1 run /path/to/frontier --first --no-land
 ```
 
 `doctor` binds the exact Vela, Codex, Git, frontier, packet, profile, and verifier

package/dist/src/projection/public-run.js

@@ -16,6 +16,9 @@ function publicCaveat(value) {
     }
     return value;
 }
+function shellArgument(value) {
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
 export function projectPublicRun(options) {
     const { record, mission } = options;
     if (mission.schema !== "canopus.mission.v1") {
@@ -91,7 +94,7 @@ export function projectPublicRun(options) {
                 `git clone ${repository.url}.git`,
                 `cd ${repository.directory}`,
                 `git checkout ${record.final_roots.git_commit}`,
-                "vela reproduce .",
+                ...mission.allowed_paths.map((artifact) => `vela reproduce ${shellArgument(artifact)}`),
             ],
         },
         nonclaims: [

package/dist/src/receipt/map.js

@@ -6,6 +6,12 @@ import { parseCandidate } from "../contracts/candidate.js";
 function unique(values) {
     return [...new Set(values)];
 }
+function finalizeWorkerCaveat(value) {
+    if (/verif(?:y|ication|ier).*(?:pending|has not run)|pending.*verif(?:y|ication|ier)/iu.test(value)) {
+        return "The worker handed off without verifier authority; Canopus subsequently recorded the separate verifier outcome.";
+    }
+    return value;
+}
 export function finalizeCandidate(options) {
     const draftPaths = options.engine.draft.artifacts.map((artifact) => `${artifact.path}:${artifact.kind}`).sort();
     const supporting = new Map((options.supportingArtifacts ?? []).map((entry) => [entry.path, entry.kind]));
@@ -34,7 +40,7 @@ export function finalizeCandidate(options) {
         ? `The engine proposed a candidate, but the declared verifier did not pass: ${options.engine.draft.claim}`
         : exactPositiveClaim ?? options.engine.draft.claim;
     const caveats = unique([
-        ...options.engine.draft.caveats,
+        ...options.engine.draft.caveats.map(finalizeWorkerCaveat),
         `Declared verifier outcome: ${options.verifier.status}.`,
         "Canopus produced this record; it is not a human acceptance decision.",
     ]);

package/docs/RUN_RECORD.md

@@ -44,7 +44,10 @@ canopus public-run /local/run/run.json \
 `canopus.public-run.v1` contains only mission and model identity, a bounded
 activity summary, claim and caveats, artifact/verifier/Receipt roots, route,
 accepted delta, usage, source/final commits, and clean-clone reproduction
-commands. It cannot export a failed or admitted run. Never publish the raw run
+commands. Those public commands target the mission's exact allowed artifact
+paths; they do not substitute frontier-wide accepted-state replay for
+verification of a pending artifact. It cannot export a failed or admitted run.
+Never publish the raw run
 directory, isolated homes, authentication, private paths, or unrestricted logs.
 
 The run root also contains isolated checkouts and content-addressed artifacts.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vela-science/canopus",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "A bounded, replaceable research harness over released Vela interfaces",
   "type": "module",
   "private": false,