@vela-science/canopus 0.5.0 → 0.5.2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.5.2 - 2026-07-20
+
+- Compose against Vela 0.911.1 so same-actor retries of `vela work` return the
+  exact active session without appending a second lease event.
+- Preserve the 0.911.0 cold-use run as immutable diagnostic evidence; the
+  retry defect it exposed is not rewritten away.
+
+## 0.5.1 - 2026-07-20
+
+- Preserve exact pending-result replay roots instead of recomputing a receipt
+  projection with incomplete post-run state.
+- Keep the published `0.5.0` package and failed post-publication workflow as
+  audit evidence; `0.5.1` is the corrected default install target.
+
 ## 0.5.0 - 2026-07-20
 
 - Compose against released Vela 0.911.0 and surface configured, available, and

package/README.md

@@ -38,8 +38,8 @@ Mission → GPT-5.6 → artifact → verifier → Receipt → Defer.
 **90 seconds — inspect the shipped product:**
 
 ```sh
-bunx @vela-science/canopus@0.5.0 --version
-bunx @vela-science/canopus@0.5.0 profile validate sidon-a24-at-least-7194-gpt56-v3
+bunx @vela-science/canopus@0.5.2 --version
+bunx @vela-science/canopus@0.5.2 profile validate sidon-a24-at-least-7194-gpt56-v3
 ```
 
 **Full workflow — reproduce without rebuilding Canopus:**
@@ -56,22 +56,22 @@ vela reproduce .
 Run the provenance-backed public package with Bun:
 
 ```sh
-bunx @vela-science/canopus@0.5.0 --version
+bunx @vela-science/canopus@0.5.2 --version
 ```
 
 Inspect a clean frontier, then run its first ranked producer offer:
 
 ```sh
-bunx @vela-science/canopus@0.5.0 doctor /path/to/frontier
-bunx @vela-science/canopus@0.5.0 run /path/to/frontier --first
-bunx @vela-science/canopus@0.5.0 inspect latest
-bunx @vela-science/canopus@0.5.0 replay /path/to/run.json
+bunx @vela-science/canopus@0.5.2 doctor /path/to/frontier
+bunx @vela-science/canopus@0.5.2 run /path/to/frontier --first
+bunx @vela-science/canopus@0.5.2 inspect latest
+bunx @vela-science/canopus@0.5.2 replay /path/to/run.json
 ```
 
 Use `--no-land` for a diagnostic mission that cannot change the source frontier:
 
 ```sh
-bunx @vela-science/canopus@0.5.0 run /path/to/frontier --first --no-land
+bunx @vela-science/canopus@0.5.2 run /path/to/frontier --first --no-land
 ```
 
 `doctor` binds the exact Vela, Codex, Git, frontier, packet, profile, and verifier
@@ -112,7 +112,7 @@ commits, run roots, audit evidence, and nonclaims live in
 
 ## Development
 
-Requires Bun 1.3.12, Vela 0.911.0, Codex CLI 0.144.6, and Docker. The built
+Requires Bun 1.3.12, Vela 0.911.1, Codex CLI 0.144.6, and Docker. The built
 package also runs under Node 22 or 24; unsupported odd-numbered Node releases
 are rejected rather than silently treated as supported.
 

package/dist/src/product/doctor.js

@@ -120,8 +120,8 @@ export async function doctorProduct(options) {
             runtimeIdentity({ name: "vela", cwd: frontier, home: runtime, runner }),
             runtimeIdentity({ name: "git", cwd: frontier, home: runtime, runner }),
         ]);
-        if (vela.version !== "vela 0.911.0") {
-            throw new Error(`Canopus ${CANOPUS_VERSION} requires vela 0.911.0, observed ${vela.version}`);
+        if (vela.version !== "vela 0.911.1") {
+            throw new Error(`Canopus ${CANOPUS_VERSION} requires vela 0.911.1, observed ${vela.version}`);
         }
         const [status, offer, gitStatus] = await Promise.all([
             jsonCommand({ runner, argv: [vela.binary, "status", ".", "--json"], cwd: frontier, home: runtime, label: "vela status" }),

package/dist/src/projection/public-run.js

@@ -16,6 +16,9 @@ function publicCaveat(value) {
     }
     return value;
 }
+function shellArgument(value) {
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
 export function projectPublicRun(options) {
     const { record, mission } = options;
     if (mission.schema !== "canopus.mission.v1") {
@@ -91,7 +94,7 @@ export function projectPublicRun(options) {
                 `git clone ${repository.url}.git`,
                 `cd ${repository.directory}`,
                 `git checkout ${record.final_roots.git_commit}`,
-                "vela reproduce .",
+                ...mission.allowed_paths.map((artifact) => `vela reproduce ${shellArgument(artifact)}`),
             ],
         },
         nonclaims: [

package/dist/src/receipt/map.js

@@ -6,6 +6,12 @@ import { parseCandidate } from "../contracts/candidate.js";
 function unique(values) {
     return [...new Set(values)];
 }
+function finalizeWorkerCaveat(value) {
+    if (/verif(?:y|ication|ier).*(?:pending|has not run)|pending.*verif(?:y|ication|ier)/iu.test(value)) {
+        return "The worker handed off without verifier authority; Canopus subsequently recorded the separate verifier outcome.";
+    }
+    return value;
+}
 export function finalizeCandidate(options) {
     const draftPaths = options.engine.draft.artifacts.map((artifact) => `${artifact.path}:${artifact.kind}`).sort();
     const supporting = new Map((options.supportingArtifacts ?? []).map((entry) => [entry.path, entry.kind]));
@@ -34,7 +40,7 @@ export function finalizeCandidate(options) {
         ? `The engine proposed a candidate, but the declared verifier did not pass: ${options.engine.draft.claim}`
         : exactPositiveClaim ?? options.engine.draft.claim;
     const caveats = unique([
-        ...options.engine.draft.caveats,
+        ...options.engine.draft.caveats.map(finalizeWorkerCaveat),
         `Declared verifier outcome: ${options.verifier.status}.`,
         "Canopus produced this record; it is not a human acceptance decision.",
     ]);

package/dist/src/vela/cli.js

@@ -432,7 +432,7 @@ export class VelaClient {
         if (replay.source_hash !== undefined) {
             assertEqual(normalizeSha256(replay.source_hash, "vela check.replay.source_hash"), checkCurrent, "Vela source snapshot");
         }
-        const proof = version === "0.900.0" || version === "0.900.1" || version === "0.900.2" || version === "0.901.0" || version === "0.910.0" || version === "0.911.0"
+        const proof = version === "0.900.0" || version === "0.900.1" || version === "0.900.2" || version === "0.901.0" || version === "0.910.0" || version === "0.911.0" || version === "0.911.1"
             ? {
                 ok: true,
                 command: "status_root_projection",

package/docs/RUN_RECORD.md

@@ -44,7 +44,10 @@ canopus public-run /local/run/run.json \
 `canopus.public-run.v1` contains only mission and model identity, a bounded
 activity summary, claim and caveats, artifact/verifier/Receipt roots, route,
 accepted delta, usage, source/final commits, and clean-clone reproduction
-commands. It cannot export a failed or admitted run. Never publish the raw run
+commands. Those public commands target the mission's exact allowed artifact
+paths; they do not substitute frontier-wide accepted-state replay for
+verification of a pending artifact. It cannot export a failed or admitted run.
+Never publish the raw run
 directory, isolated homes, authentication, private paths, or unrestricted logs.
 
 The run root also contains isolated checkouts and content-addressed artifacts.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vela-science/canopus",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "A bounded, replaceable research harness over released Vela interfaces",
   "type": "module",
   "private": false,