@vela-science/canopus 0.5.1 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.6.0 - 2026-07-20
+
+- Type completed-run evidence by stage as `worker_observations`,
+  `verifier_observations`, and `standing_caveats`, while preserving read
+  compatibility for immutable `canopus.run.v0` records.
+- Add `canopus publish-run`, which emits a sanitized public projection, root
+  manifest, exact pending-proposal commands, and read-only Observatory import
+  descriptor without landing, signing, pushing, deploying, or accepting.
+- Compose against Vela 0.912.0 and its proposal-scoped verifier attachment and
+  reproduction surfaces.
+
+## 0.5.2 - 2026-07-20
+
+- Compose against Vela 0.911.1 so same-actor retries of `vela work` return the
+  exact active session without appending a second lease event.
+- Preserve the 0.911.0 cold-use run and registration as immutable diagnostic
+  evidence; any focused retry remains separate and never rewrites that record.
+
 ## 0.5.1 - 2026-07-20
 
 - Preserve exact pending-result replay roots instead of recomputing a receipt

package/README.md

@@ -38,8 +38,8 @@ Mission → GPT-5.6 → artifact → verifier → Receipt → Defer.
 **90 seconds — inspect the shipped product:**
 
 ```sh
-bunx @vela-science/canopus@0.5.1 --version
-bunx @vela-science/canopus@0.5.1 profile validate sidon-a24-at-least-7194-gpt56-v3
+bunx @vela-science/canopus@0.6.0 --version
+bunx @vela-science/canopus@0.6.0 profile validate sidon-a24-at-least-7194-gpt56-v3
 ```
 
 **Full workflow — reproduce without rebuilding Canopus:**
@@ -56,22 +56,35 @@ vela reproduce .
 Run the provenance-backed public package with Bun:
 
 ```sh
-bunx @vela-science/canopus@0.5.1 --version
+bunx @vela-science/canopus@0.6.0 --version
 ```
 
 Inspect a clean frontier, then run its first ranked producer offer:
 
 ```sh
-bunx @vela-science/canopus@0.5.1 doctor /path/to/frontier
-bunx @vela-science/canopus@0.5.1 run /path/to/frontier --first
-bunx @vela-science/canopus@0.5.1 inspect latest
-bunx @vela-science/canopus@0.5.1 replay /path/to/run.json
+bunx @vela-science/canopus@0.6.0 doctor /path/to/frontier
+bunx @vela-science/canopus@0.6.0 run /path/to/frontier --first
+bunx @vela-science/canopus@0.6.0 inspect latest
+bunx @vela-science/canopus@0.6.0 replay /path/to/run.json
 ```
 
+Export a completed Defer run without publishing or mutating anything:
+
+```sh
+canopus publish-run /path/to/run.json --mission /path/to/mission.json \
+  --repository https://github.com/vela-science/<frontier> \
+  --output ./public-evidence
+```
+
+The new directory contains `public-run.json`, `root-manifest.json`, exact
+pending-state commands, and a read-only Observatory import descriptor. Run v1
+separates worker observations, verifier observations, and caveats that remain
+standing after verification; historical run v0 records remain inspectable.
+
 Use `--no-land` for a diagnostic mission that cannot change the source frontier:
 
 ```sh
-bunx @vela-science/canopus@0.5.1 run /path/to/frontier --first --no-land
+bunx @vela-science/canopus@0.6.0 run /path/to/frontier --first --no-land
 ```
 
 `doctor` binds the exact Vela, Codex, Git, frontier, packet, profile, and verifier
@@ -112,7 +125,7 @@ commits, run roots, audit evidence, and nonclaims live in
 
 ## Development
 
-Requires Bun 1.3.12, Vela 0.911.0, Codex CLI 0.144.6, and Docker. The built
+Requires Bun 1.3.12, Vela 0.912.0, Codex CLI 0.144.6, and Docker. The built
 package also runs under Node 22 or 24; unsupported odd-numbered Node releases
 are rejected rather than silently treated as supported.
 

package/dist/src/cli.js

@@ -3,7 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
-import { readdir, stat, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { parseMission } from "./contracts/mission.js";
 import { CodexExecEngine } from "./engines/codex-exec.js";
 import { CodexToolsNativeEngine } from "./engines/codex-tools-native.js";
@@ -12,6 +12,7 @@ import { parseDiagnosticRunRecord, projectDiagnosticRun } from "./projection/dia
 import { parseFailureRecord, projectFailure } from "./projection/failure.js";
 import { parseRunRecord, projectRun } from "./projection/run.js";
 import { projectPublicRun } from "./projection/public-run.js";
+import { buildPublicationBundle } from "./projection/publication.js";
 import { doctorProduct } from "./product/doctor.js";
 import { replayProduct } from "./product/replay.js";
 import { runProduct } from "./product/run.js";
@@ -35,6 +36,8 @@ Primary workflow:
   canopus inspect [run.json | latest]
   canopus public-run <run.json> --mission <mission.json> \
     --repository <public-url> --output <file>
+  canopus publish-run <run.json> --mission <mission.json> \
+    --repository <public-url> --output <new-directory>
   canopus replay <run.json>
   canopus withdraw [frontier] [--run <run.json|latest>] --reason <text>
 
@@ -104,6 +107,15 @@ Generates one canonical, sanitized canopus.public-run.v1 projection from a
 submission-ready completed run. Raw worker logs, homes, credentials, private
 paths, and unrestricted transcripts are never copied.`;
 }
+function publishRunUsage() {
+    return `Usage:
+  canopus publish-run <run.json> --mission <mission.json> \\
+    --repository <public-url> --output <new-directory>
+
+Creates a sanitized public projection, root manifest, proposal-scoped pending
+commands, and a read-only Vela Observatory import descriptor. It never lands,
+signs, accepts, pushes, or deploys.`;
+}
 function withdrawUsage() {
     return `Usage:
   canopus withdraw [frontier] [--run <run.json|latest>] --reason <text>
@@ -464,6 +476,44 @@ async function publicRunCommand(file, rest) {
         projection_root: contentDigest(projection),
     })}\n`);
 }
+async function publishRunCommand(file, rest) {
+    if (file === undefined)
+        throw new Error("publish-run requires one completed run file");
+    const values = options(rest, ["--mission", "--repository", "--output"]);
+    const record = parseRunRecord(await jsonFile(file));
+    const mission = parseMission(await jsonFile(required(values, "--mission")));
+    const bundle = buildPublicationBundle({
+        record,
+        mission,
+        repository: required(values, "--repository"),
+    });
+    const output = path.resolve(required(values, "--output"));
+    const parent = path.dirname(output);
+    await mkdir(parent, { recursive: true, mode: 0o755 });
+    const temporary = await mkdtemp(path.join(parent, `.${path.basename(output)}.tmp-`));
+    try {
+        await Promise.all([
+            writeFile(path.join(temporary, "public-run.json"), canonicalJson(bundle.projection), { flag: "wx", mode: 0o644 }),
+            writeFile(path.join(temporary, "pending-commands.json"), canonicalJson(bundle.pendingCommands), { flag: "wx", mode: 0o644 }),
+            writeFile(path.join(temporary, "web-import.json"), canonicalJson(bundle.webImport), { flag: "wx", mode: 0o644 }),
+            writeFile(path.join(temporary, "root-manifest.json"), canonicalJson(bundle.manifest), { flag: "wx", mode: 0o644 }),
+        ]);
+        await rename(temporary, output);
+    }
+    catch (error) {
+        await rm(temporary, { recursive: true, force: true });
+        throw error;
+    }
+    process.stdout.write(`${JSON.stringify({
+        ok: true,
+        command: "publish-run",
+        run_id: bundle.projection.run_id,
+        output,
+        projection_root: contentDigest(bundle.projection),
+        bundle_root: contentDigest(bundle.manifest),
+        authority_effect: "none",
+    })}\n`);
+}
 async function withdrawCommand(args) {
     const parsed = productOptions(args, ["--run", "--reason"], []);
     if (parsed.positional.length > 1)
@@ -506,8 +556,9 @@ async function main(argv) {
                 : command === "doctor" ? doctorUsage()
                     : command === "replay" ? replayUsage()
                         : command === "public-run" ? publicRunUsage()
-                            : command === "withdraw" ? withdrawUsage()
-                                : usage()}\n`);
+                            : command === "publish-run" ? publishRunUsage()
+                                : command === "withdraw" ? withdrawUsage()
+                                    : usage()}\n`);
         return;
     }
     if (command === "doctor") {
@@ -522,6 +573,10 @@ async function main(argv) {
         await publicRunCommand(file, rest);
         return;
     }
+    if (command === "publish-run") {
+        await publishRunCommand(file, rest);
+        return;
+    }
     if (command === "withdraw") {
         await withdrawCommand(argv.slice(1));
         return;

package/dist/src/index.d.ts

@@ -9,6 +9,7 @@ export * from "./activity/store.js";
 export * from "./candidate/validate.js";
 export * from "./util/canonical.js";
 export * from "./projection/public-run.js";
+export * from "./projection/publication.js";
 export * from "./util/command.js";
 export * from "./util/files.js";
 export * from "./roles.js";

package/dist/src/index.js

@@ -9,6 +9,7 @@ export * from "./activity/store.js";
 export * from "./candidate/validate.js";
 export * from "./util/canonical.js";
 export * from "./projection/public-run.js";
+export * from "./projection/publication.js";
 export * from "./util/command.js";
 export * from "./util/files.js";
 export * from "./roles.js";

package/dist/src/product/doctor.js

@@ -120,8 +120,8 @@ export async function doctorProduct(options) {
             runtimeIdentity({ name: "vela", cwd: frontier, home: runtime, runner }),
             runtimeIdentity({ name: "git", cwd: frontier, home: runtime, runner }),
         ]);
-        if (vela.version !== "vela 0.911.0") {
-            throw new Error(`Canopus ${CANOPUS_VERSION} requires vela 0.911.0, observed ${vela.version}`);
+        if (vela.version !== "vela 0.912.0") {
+            throw new Error(`Canopus ${CANOPUS_VERSION} requires vela 0.912.0, observed ${vela.version}`);
         }
         const [status, offer, gitStatus] = await Promise.all([
             jsonCommand({ runner, argv: [vela.binary, "status", ".", "--json"], cwd: frontier, home: runtime, label: "vela status" }),

package/dist/src/projection/publication.d.ts

@@ -0,0 +1,36 @@
+import type { Mission } from "../contracts/mission.js";
+import type { RunRecord } from "./run.js";
+import { projectPublicRun } from "./public-run.js";
+export interface PublicationBundle {
+    projection: ReturnType<typeof projectPublicRun>;
+    pendingCommands: {
+        schema: "canopus.pending-commands.v1";
+        authority: "none";
+        proposal_id: string;
+        commands: Array<{
+            purpose: string;
+            authority: string;
+            command: string;
+        }>;
+    };
+    webImport: {
+        schema: "vela-web.canopus-import.v1";
+        authority: "read_only";
+        run_id: string;
+        projection_path: "public-run.json";
+        projection_root: string;
+        route: "defer";
+        accepted_state_delta: 0;
+    };
+    manifest: {
+        schema: "canopus.publication-manifest.v1";
+        authority: "none";
+        run_id: string;
+        files: Record<string, string>;
+    };
+}
+export declare function buildPublicationBundle(options: {
+    record: RunRecord;
+    mission: Mission;
+    repository: string;
+}): PublicationBundle;

package/dist/src/projection/publication.js

@@ -0,0 +1,47 @@
+import { contentDigest } from "../util/canonical.js";
+import { projectPublicRun } from "./public-run.js";
+export function buildPublicationBundle(options) {
+    const projection = projectPublicRun(options);
+    const pendingCommands = {
+        schema: "canopus.pending-commands.v1",
+        authority: "none",
+        proposal_id: projection.policy.proposal_id,
+        commands: [
+            {
+                purpose: "reproduce_pending_artifact",
+                authority: "read_only",
+                command: `vela reproduce . --proposal ${projection.policy.proposal_id} --json`,
+            },
+            {
+                purpose: "inspect_review_material",
+                authority: "read_only",
+                command: `vela review show . ${projection.policy.proposal_id} --json`,
+            },
+            {
+                purpose: "retain_independent_verifier_evidence",
+                authority: "evidence_only",
+                command: `vela verify attach . <attachment.json> --proposal ${projection.policy.proposal_id} --as verifier:<actor> --json`,
+            },
+        ],
+    };
+    const webImport = {
+        schema: "vela-web.canopus-import.v1",
+        authority: "read_only",
+        run_id: projection.run_id,
+        projection_path: "public-run.json",
+        projection_root: contentDigest(projection),
+        route: "defer",
+        accepted_state_delta: 0,
+    };
+    const manifest = {
+        schema: "canopus.publication-manifest.v1",
+        authority: "none",
+        run_id: projection.run_id,
+        files: {
+            "pending-commands.json": contentDigest(pendingCommands),
+            "public-run.json": contentDigest(projection),
+            "web-import.json": contentDigest(webImport),
+        },
+    };
+    return { projection, pendingCommands, webImport, manifest };
+}

package/dist/src/projection/run.d.ts

@@ -1,8 +1,9 @@
 import type { MissionRoots } from "../contracts/mission.js";
-export declare const RUN_RECORD_SCHEMA: "canopus.run.v0";
+export declare const RUN_RECORD_SCHEMA: "canopus.run.v1";
+export declare const LEGACY_RUN_RECORD_SCHEMA: "canopus.run.v0";
 export declare const RUN_PROJECTION_SCHEMA: "canopus.run-projection.v0";
 export interface RunRecord {
-    schema: typeof RUN_RECORD_SCHEMA;
+    schema: typeof RUN_RECORD_SCHEMA | typeof LEGACY_RUN_RECORD_SCHEMA;
     run_id: string;
     status: "completed";
     authority: "non_authoritative";
@@ -25,6 +26,11 @@ export interface RunRecord {
         }>;
         caveats: string[];
     };
+    observations?: {
+        worker_observations: string[];
+        verifier_observations: string[];
+        standing_caveats: string[];
+    };
     verifier: {
         status: "passed" | "failed" | "error";
         sandbox: "macos_sandbox" | "container_network_denied";

package/dist/src/projection/run.js

@@ -1,5 +1,6 @@
 import { arrayAt, enumAt, exactKeys, gitObjectAt, integerAt, objectAt, relativePathAt, sha256At, stringAt, } from "../contracts/validation.js";
-export const RUN_RECORD_SCHEMA = "canopus.run.v0";
+export const RUN_RECORD_SCHEMA = "canopus.run.v1";
+export const LEGACY_RUN_RECORD_SCHEMA = "canopus.run.v0";
 export const RUN_PROJECTION_SCHEMA = "canopus.run-projection.v0";
 function literal(value, expected, at) {
     if (value !== expected)
@@ -24,10 +25,12 @@ function nullableCount(value, at) {
 }
 export function parseRunRecord(value) {
     const record = objectAt(value, "run");
+    const schema = enumAt(record.schema, "run.schema", [RUN_RECORD_SCHEMA, LEGACY_RUN_RECORD_SCHEMA]);
     exactKeys(record, [
         "schema", "run_id", "status", "authority", "external_gate_credit", "mission",
         "candidate", "verifier", "landing", "final_roots", "reproduction", "budget",
-    ], [], "run");
+        ...(schema === RUN_RECORD_SCHEMA ? ["observations"] : []),
+    ], schema === LEGACY_RUN_RECORD_SCHEMA ? ["observations"] : [], "run");
     const mission = objectAt(record.mission, "run.mission");
     exactKeys(mission, ["id", "target", "digest", "starting_roots"], [], "run.mission");
     const candidate = objectAt(record.candidate, "run.candidate");
@@ -48,8 +51,18 @@ export function parseRunRecord(value) {
         "research_elapsed_ms", "research_processes", "research_output_bytes", "prompt_bytes",
         "artifact_bytes", "attempts", "observed_tokens",
     ], [], "run.budget");
+    const observations = record.observations === undefined ? undefined : (() => {
+        const stages = objectAt(record.observations, "run.observations");
+        exactKeys(stages, ["worker_observations", "verifier_observations", "standing_caveats"], [], "run.observations");
+        const strings = (value, at) => arrayAt(value, at, { max: 16 }, (item, itemAt) => stringAt(item, itemAt, { min: 1, max: 4096 }));
+        return {
+            worker_observations: strings(stages.worker_observations, "run.observations.worker_observations"),
+            verifier_observations: strings(stages.verifier_observations, "run.observations.verifier_observations"),
+            standing_caveats: strings(stages.standing_caveats, "run.observations.standing_caveats"),
+        };
+    })();
     return {
-        schema: literal(record.schema, RUN_RECORD_SCHEMA, "run.schema"),
+        schema,
         run_id: stringAt(record.run_id, "run.run_id", { min: 5, max: 128 }),
         status: literal(record.status, "completed", "run.status"),
         authority: literal(record.authority, "non_authoritative", "run.authority"),
@@ -76,6 +89,7 @@ export function parseRunRecord(value) {
             }),
             caveats: arrayAt(candidate.caveats, "run.candidate.caveats", { max: 10 }, (item, at) => stringAt(item, at, { min: 1, max: 4096 })),
         },
+        ...(observations === undefined ? {} : { observations }),
         verifier: {
             status: enumAt(verifier.status, "run.verifier.status", ["passed", "failed", "error"]),
             sandbox: enumAt(verifier.sandbox, "run.verifier.sandbox", ["macos_sandbox", "container_network_denied"]),

package/dist/src/run.js

@@ -576,6 +576,14 @@ export async function runCanopus(options) {
                 artifacts: candidate.artifacts,
                 caveats: candidate.caveats,
             },
+            observations: {
+                worker_observations: candidate.observations,
+                verifier_observations: [
+                    `Frozen verifier passed in ${verifier.sandbox}.`,
+                    `Verifier stdout ${verifier.record.stdout_digest}; stderr ${verifier.record.stderr_digest}.`,
+                ],
+                standing_caveats: candidate.caveats,
+            },
             verifier: {
                 status: verifier.status,
                 sandbox: verifier.sandbox,

package/dist/src/vela/cli.js

@@ -432,7 +432,7 @@ export class VelaClient {
         if (replay.source_hash !== undefined) {
             assertEqual(normalizeSha256(replay.source_hash, "vela check.replay.source_hash"), checkCurrent, "Vela source snapshot");
         }
-        const proof = version === "0.900.0" || version === "0.900.1" || version === "0.900.2" || version === "0.901.0" || version === "0.910.0" || version === "0.911.0"
+        const proof = version === "0.900.0" || version === "0.900.1" || version === "0.900.2" || version === "0.901.0" || version === "0.910.0" || version === "0.911.0" || version === "0.911.1" || version === "0.912.0"
             ? {
                 ok: true,
                 command: "status_root_projection",

package/docs/RUN_RECORD.md

@@ -9,8 +9,8 @@ A completed run writes these local records beneath its run root:
 - `worker-final.json`: the exact final worker response;
 - `worker-stderr.bin`: the bounded raw worker stderr stream;
 - `engine-result.json`: the parsed worker outcome and usage;
-- `run.json`: the compact run record, exact roots, landing result, costs, and
-  clean-clone reproduction result;
+- `run.json`: the compact run record, exact roots, landing result, costs,
+  clean-clone reproduction result, and stage-typed observations;
 - `evidence-manifest.json`: content roots for the worker, run, candidate,
   artifacts, verifier result, Receipt when present, and final frontier roots;
 - `projection.json`: a read-only view for another consumer;
@@ -30,25 +30,36 @@ so in its schema and can be rebuilt with `canopus inspect run.json`. Deleting
 the run-record files must not change Vela replay, a policy route, or accepted
 state.
 
-For a public evidence surface, generate the strict sanitized projection only
-after the successful run has reached Defer with zero accepted-state delta and
-matched clean-clone replay:
+Completed runs now use `canopus.run.v1`. Its `observations` object separates
+three claims that must not be collapsed:
+
+- `worker_observations`: what the model reported or attempted;
+- `verifier_observations`: what the frozen mechanical verifier established;
+- `standing_caveats`: limitations that remain true after verification.
+
+Immutable `canopus.run.v0` records remain readable and replayable. Canopus does
+not rewrite them to manufacture the new evidence categories.
+
+For a public evidence surface, generate the publication bundle only after the
+successful run has reached Defer with zero accepted-state delta and matched
+clean-clone replay:
 
 ```bash
-canopus public-run /local/run/run.json \
+canopus publish-run /local/run/run.json \
   --mission /local/run/mission/mission.json \
   --repository https://github.com/vela-science/formal-conjectures-frontier \
-  --output canopus.public-run.v1.json
+  --output ./public-evidence
 ```
 
-`canopus.public-run.v1` contains only mission and model identity, a bounded
-activity summary, claim and caveats, artifact/verifier/Receipt roots, route,
-accepted delta, usage, source/final commits, and clean-clone reproduction
-commands. Those public commands target the mission's exact allowed artifact
-paths; they do not substitute frontier-wide accepted-state replay for
-verification of a pending artifact. It cannot export a failed or admitted run.
-Never publish the raw run
-directory, isolated homes, authentication, private paths, or unrestricted logs.
+The new directory contains the `canopus.public-run.v1` projection, an exact
+root manifest, read-only Observatory import data, and commands to reproduce or
+inspect the pending proposal and retain additional verifier evidence. The
+commands do not accept, publish, push, deploy, or cross a human authority
+boundary. The public projection contains only mission and model identity, a
+bounded activity summary, claim and caveats, artifact/verifier/Receipt roots,
+route, accepted delta, usage, source/final commits, and reproduction commands.
+It cannot export a failed or admitted run. Never publish the raw run directory,
+isolated homes, authentication, private paths, or unrestricted logs.
 
 The run root also contains isolated checkouts and content-addressed artifacts.
 The landing clone uses a disposable attached branch so Vela can publish exact

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vela-science/canopus",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "A bounded, replaceable research harness over released Vela interfaces",
   "type": "module",
   "private": false,

package/schemas/run.v1.json

@@ -0,0 +1,220 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://vela.science/schemas/canopus/run.v1.json",
+  "title": "Canopus completed run v1",
+  "description": "A non-authoritative completed-run record with worker observations, mechanical verifier observations, and caveats that remain standing after verification.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "run_id",
+    "status",
+    "authority",
+    "external_gate_credit",
+    "mission",
+    "candidate",
+    "observations",
+    "verifier",
+    "landing",
+    "final_roots",
+    "reproduction",
+    "budget"
+  ],
+  "properties": {
+    "schema": { "const": "canopus.run.v1" },
+    "run_id": { "type": "string", "minLength": 5, "maxLength": 128 },
+    "status": { "const": "completed" },
+    "authority": { "const": "non_authoritative" },
+    "external_gate_credit": { "const": false },
+    "mission": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "target", "digest", "starting_roots"],
+      "properties": {
+        "id": { "type": "string", "minLength": 1, "maxLength": 134 },
+        "target": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "digest": { "$ref": "#/$defs/sha256" },
+        "starting_roots": { "$ref": "#/$defs/roots" }
+      }
+    },
+    "candidate": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["digest", "status", "claim", "artifacts", "caveats"],
+      "properties": {
+        "digest": { "$ref": "#/$defs/sha256" },
+        "status": { "enum": ["success", "null", "failed"] },
+        "claim": { "type": "string", "minLength": 1, "maxLength": 8192 },
+        "artifacts": {
+          "type": "array",
+          "maxItems": 10,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["path", "kind", "digest", "bytes"],
+            "properties": {
+              "path": { "$ref": "#/$defs/relativePath" },
+              "kind": { "type": "string", "minLength": 1, "maxLength": 128 },
+              "digest": { "$ref": "#/$defs/sha256" },
+              "bytes": { "type": "integer", "minimum": 0, "maximum": 1073741824 }
+            }
+          }
+        },
+        "caveats": { "$ref": "#/$defs/caveats" }
+      }
+    },
+    "observations": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["worker_observations", "verifier_observations", "standing_caveats"],
+      "properties": {
+        "worker_observations": { "$ref": "#/$defs/observations" },
+        "verifier_observations": { "$ref": "#/$defs/observations" },
+        "standing_caveats": { "$ref": "#/$defs/observations" }
+      }
+    },
+    "verifier": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["status", "sandbox", "record"],
+      "properties": {
+        "status": { "enum": ["passed", "failed", "error"] },
+        "sandbox": { "enum": ["macos_sandbox", "container_network_denied"] },
+        "record": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "argv",
+            "executable_digest",
+            "exit_code",
+            "stdout_digest",
+            "stderr_digest",
+            "duration_ms"
+          ],
+          "properties": {
+            "argv": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 64,
+              "items": { "type": "string", "maxLength": 4096 }
+            },
+            "executable_digest": { "$ref": "#/$defs/sha256" },
+            "exit_code": { "type": "integer", "minimum": -1, "maximum": 255 },
+            "stdout_digest": { "$ref": "#/$defs/sha256" },
+            "stderr_digest": { "$ref": "#/$defs/sha256" },
+            "duration_ms": { "type": "integer", "minimum": 0, "maximum": 3600000 }
+          }
+        }
+      }
+    },
+    "landing": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "operation_id",
+        "receipt_root",
+        "proposal_id",
+        "route",
+        "original_route",
+        "accepted_event_delta",
+        "publication_state"
+      ],
+      "properties": {
+        "operation_id": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "receipt_root": { "$ref": "#/$defs/sha256" },
+        "proposal_id": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "route": { "enum": ["permit", "defer", "exact_retry"] },
+        "original_route": {
+          "oneOf": [
+            { "enum": ["permit", "defer"] },
+            { "type": "null" }
+          ]
+        },
+        "accepted_event_delta": {
+          "oneOf": [
+            { "type": "integer", "minimum": 0 },
+            { "type": "null" }
+          ]
+        },
+        "publication_state": { "type": "string", "minLength": 1, "maxLength": 4096 }
+      }
+    },
+    "final_roots": { "$ref": "#/$defs/roots" },
+    "reproduction": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["matched", "roots", "verifier_status", "stdout_digest", "stderr_digest"],
+      "properties": {
+        "matched": { "const": true },
+        "roots": { "$ref": "#/$defs/roots" },
+        "verifier_status": { "enum": ["passed", "failed", "error"] },
+        "stdout_digest": { "$ref": "#/$defs/sha256" },
+        "stderr_digest": { "$ref": "#/$defs/sha256" }
+      }
+    },
+    "budget": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "research_elapsed_ms",
+        "research_processes",
+        "research_output_bytes",
+        "prompt_bytes",
+        "artifact_bytes",
+        "attempts",
+        "observed_tokens"
+      ],
+      "properties": {
+        "research_elapsed_ms": { "$ref": "#/$defs/nonnegativeInteger" },
+        "research_processes": { "$ref": "#/$defs/nonnegativeInteger" },
+        "research_output_bytes": { "$ref": "#/$defs/nonnegativeInteger" },
+        "prompt_bytes": { "$ref": "#/$defs/nonnegativeInteger" },
+        "artifact_bytes": { "$ref": "#/$defs/nonnegativeInteger" },
+        "attempts": { "$ref": "#/$defs/nonnegativeInteger" },
+        "observed_tokens": { "$ref": "#/$defs/nonnegativeInteger" }
+      }
+    }
+  },
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^sha256:[0-9a-f]{64}$"
+    },
+    "gitObject": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{40,64}$"
+    },
+    "relativePath": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 4096,
+      "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$)).+$"
+    },
+    "roots": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["git_commit", "git_tree", "vela_event_log", "vela_snapshot"],
+      "properties": {
+        "git_commit": { "$ref": "#/$defs/gitObject" },
+        "git_tree": { "$ref": "#/$defs/gitObject" },
+        "vela_event_log": { "$ref": "#/$defs/sha256" },
+        "vela_snapshot": { "$ref": "#/$defs/sha256" }
+      }
+    },
+    "observations": {
+      "type": "array",
+      "maxItems": 16,
+      "items": { "type": "string", "minLength": 1, "maxLength": 4096 }
+    },
+    "caveats": {
+      "type": "array",
+      "maxItems": 10,
+      "items": { "type": "string", "minLength": 1, "maxLength": 4096 }
+    },
+    "nonnegativeInteger": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 9007199254740991
+    }
+  }
+}