@vela-science/canopus 0.6.1 → 0.6.2

package/BUILD_WEEK.md

@@ -23,12 +23,34 @@ p.m. Toronto time.
 | Sidon frontier | `5f138a51a6c8723d5a85ff0ffc265728c2c33c6e` | A root-bound GPT-5.6 target, a new 7,194-point witness, frozen verification, Receipt, Defer proposal, and replayable final commit |
 | Vela Observatory | `37eca05ae3bc1e2f2832ed99c58ba9fdc4bd1787` | A pinned public-run type, retained-run detail route, and stable anonymous `/build-week` evidence page |
 
-Canopus versions `0.1.0` through `0.6.1` were built during the submission
+Canopus versions `0.1.0` through `0.6.2` were built during the submission
 period. Version `0.4.6` added the successful GPT-5.6 Sidon profile and secure
 workspace-backed artifact retention. Versions `0.5` and `0.6` then hardened
 retry-safe Vela composition, stage-typed run evidence, proposal-scoped replay,
 and a local-only sanitized publication bundle. None adds an acceptance path.
 
+## Dated Build Week ledger
+
+All dates below are Toronto time. Tags identify released product bytes; later
+documentation commits do not rewrite those release or evidence identities.
+
+| Date | Repository and immutable ref | Build Week addition |
+| --- | --- | --- |
+| July 15 | Canopus first commit `9d95924f27842ceb14a45bb0ecaf5a777c3b2736` | Introduced the bounded research harness; no Canopus repository existed at the competition baseline. |
+| July 16 | Canopus `v0.1.0` at `0c0e59bf025b93faca8e8078b098b5aee9c67078` | Bound exact missions, worker custody, artifact freezing, verifier separation, and released-Vela composition. |
+| July 16 | Canopus `v0.2.0` at `ab01e6b4eebebb64cd3403962e1104d4b2d43bbb` | Shipped the authority-free mission loop with retained success and failure evidence. |
+| July 17 | Canopus `v0.3.0` at `a25c97c4b92c6248d1f827ead6ab9522084728b8` | Added the installable `doctor`, `run`, `inspect`, `replay`, and `withdraw` product surface. |
+| July 19 | Canopus `v0.4.3` at `f461a0d184f2076c4b451e524e5e949abdee621e` | Published the provenance-backed npm path and repaired clean-install usability. |
+| July 20 | Sidon frontier result commit `4289e05876f142e72af622672e190be26f6a6f1d` | Retained the GPT-5.6-produced 7,194-point witness, verifier pass, Receipt, Defer proposal, and accepted delta zero. |
+| July 20 | Canopus `v0.4.6` at `ad72a7aca63aaa6c060f840020cca6871e4a9f11` | Added the successful GPT-5.6 Sidon profile and bounded workspace-backed artifact handoff. |
+| July 20 | Canopus `v0.5.0` at `25523ccb558f81db95c01b48b83616ed3ab05b35` | Added stage-typed run evidence and retry-safe Vela composition without adding an authority path. |
+| July 20 | Sidon independent-audit commit `825657d7e87618c0aa6fc9af7e3182e05f324750` | Added a separate base-3 verifier and a deterministic collision-injection rejection probe. |
+| July 21 | Canopus `v0.6.1` at `b98c846d61d4c554e43388107bcce77c51307db5` | Updated the released Vela and package identities; its packed judge path remained the generic canonical-witness check and is superseded by `v0.6.2`. |
+| July 21 | Canopus `v0.6.2` | Shipped the exact pending-artifact and independent-verifier judge path, dated evidence ledger, caveat reconciliation, and third-party notice in the provenance-backed package. |
+| July 21 | Vela `v0.912.0` at `bb6774b6a65ecc5615e17ddf574c3efd893e0e44` | Bound the final Build Week composition while leaving Receipt, policy, replay, and human-authority semantics intact. |
+| July 21 | Observatory `v0.340.6` at `7483ab20c0d2878f3d50a76ed1bca9969f7dd5f5` | Deployed the anonymous run detail and `/build-week` route with an exact evidence manifest. |
+| July 21 | Canopus documentation at `4cae162bc37538e9ff1add0ef42861804ff86a62` | Corrected the public commands to select and reproduce the pending witness rather than only retained canonical witnesses. |
+
 ## Primary GPT-5.6 scientific result
 
 ### What is new
@@ -83,6 +105,14 @@ The generated sanitized projection is
 It contains no raw worker events, isolated home, authentication, private path,
 or unrestricted log.
 
+The immutable `0.4.6` Receipt preserves the worker's pre-verifier handoff
+caveat that separate verification remained pending, alongside the rooted final
+verifier evidence. We do not rewrite that historical record. Canopus fixed
+post-verifier caveat finalization in commit
+`58aad1e5806e7f3c192214e65f8968e03e2cff87` and shipped it from `0.5.1`
+onward; the public projection derives standing caveats from the final run
+observations and therefore reports the recorded verifier pass.
+
 ## Secondary evidence
 
 The earlier retained Erdős 1056 run remains a useful bounded-research example:
@@ -100,23 +130,34 @@ The formal profile `formal-erdos-505-test-dim-one-gpt56` supplies the public
 fail-closed counterexample. Run
 `run_4c2ba5f5-04ac-44d5-adb6-8937eb2ea165` produced a candidate, but the
 frozen Lean verifier rejected an unsolved inverse goal and `sorryAx`. Canopus
-stopped before Receipt creation or frontier mutation.
+stopped before Receipt creation or frontier mutation. The rejected verifier
+result is bound at
+`sha256:04e31b07889f94a1d205231942bf30fa6c3b27864520b6a42de58604da53e544`.
 
 ## Reproduce without rebuilding Canopus
 
-The primary state transition needs released Vela and the public frontier:
+The pending primary artifact needs the provenance-checked prebuilt
+[Vela 0.912.0 release](https://github.com/vela-science/vela/releases/tag/v0.912.0)
+and the public frontier. The audit commit adds an independent implementation
+without changing the retained Receipt, proposal, or accepted state:
 
 ```bash
 git clone https://github.com/vela-science/sidon-frontier.git
 cd sidon-frontier
-git checkout 4289e05876f142e72af622672e190be26f6a6f1d
-vela reproduce .
+git checkout 825657d7e87618c0aa6fc9af7e3182e05f324750
+vela reproduce artifacts/sidon-a24-gpt56-7194.witness.json
+node verification/verify-sidon-a24-7194.mjs \
+  artifacts/sidon-a24-gpt56-7194.witness.json
 ```
 
+`vela reproduce .` remains the whole-frontier canonical-witness check, but it
+must not be presented as verification of this still-pending proposal. The
+artifact-specific command above is the exact pending-result path.
+
 Inspect the packaged product under Node 22 or 24:
 
 ```bash
-npm install --global @vela-science/canopus@0.6.1
+npm install --global @vela-science/canopus@0.6.2
 canopus --version
 canopus profile validate sidon-a24-at-least-7194-gpt56-v3
 ```
@@ -148,3 +189,10 @@ Session ID is kept in the submission checklist, not this repository.
 - The retained Erdős 1056 result covers one finite range and does not solve Erdős 1056.
 - The rejected formal candidate does not prove the one-dimensional theorem or Erdős 505.
 - Vela predates Build Week. The submission is Canopus and its Build Week additions, not the whole ecosystem.
+
+## Licensing and third-party boundary
+
+Canopus is dual-licensed Apache-2.0 OR MIT. Its runtime npm dependency set is
+empty. Bundled verifier capsules and separately supplied development or host
+tools are documented in [`THIRD_PARTY.md`](THIRD_PARTY.md); those tools do not
+receive scientific decision authority through Canopus.

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.6.2 - 2026-07-21
+
+- Ship the exact pending Sidon artifact reproduction command and independent
+  base-3 verifier command in the provenance-backed package instead of the
+  whole-frontier canonical-witness check previously published by `0.6.1`.
+- Package the dated Build Week ledger, immutable Receipt caveat reconciliation,
+  and third-party component notice used by the final judge path.
+- Add release-contract coverage for those public instructions and files. No
+  runtime, protocol, Receipt, policy, or authority behavior changes.
+
 ## 0.6.1 - 2026-07-21
 
 - Correct the public Build Week record and judge quickstart to name the

package/README.md

@@ -38,34 +38,44 @@ Mission → GPT-5.6 → artifact → verifier → Receipt → Defer.
 **90 seconds — inspect the shipped product:**
 
 ```sh
-bunx @vela-science/canopus@0.6.1 --version
-bunx @vela-science/canopus@0.6.1 profile validate sidon-a24-at-least-7194-gpt56-v3
+bunx @vela-science/canopus@0.6.2 --version
+bunx @vela-science/canopus@0.6.2 profile validate sidon-a24-at-least-7194-gpt56-v3
 ```
 
 **Full workflow — reproduce without rebuilding Canopus:**
 
+Install the provenance-checked prebuilt
+[Vela 0.912.0 release](https://github.com/vela-science/vela/releases/tag/v0.912.0)
+for your platform, then:
+
 ```sh
 git clone https://github.com/vela-science/sidon-frontier.git
 cd sidon-frontier
-git checkout 4289e05876f142e72af622672e190be26f6a6f1d
-vela reproduce .
+git checkout 825657d7e87618c0aa6fc9af7e3182e05f324750
+vela reproduce artifacts/sidon-a24-gpt56-7194.witness.json
+node verification/verify-sidon-a24-7194.mjs \
+  artifacts/sidon-a24-gpt56-7194.witness.json
 ```
 
+The first command selects the pending artifact explicitly and runs Vela's
+frozen Sidon verifier. The second is an independent base-3 implementation that
+also rejects a bound collision injection. Neither command accepts the proposal.
+
 ## Quickstart
 
 Run the provenance-backed public package with Bun:
 
 ```sh
-bunx @vela-science/canopus@0.6.1 --version
+bunx @vela-science/canopus@0.6.2 --version
 ```
 
 Inspect a clean frontier, then run its first ranked producer offer:
 
 ```sh
-bunx @vela-science/canopus@0.6.1 doctor /path/to/frontier
-bunx @vela-science/canopus@0.6.1 run /path/to/frontier --first
-bunx @vela-science/canopus@0.6.1 inspect latest
-bunx @vela-science/canopus@0.6.1 replay /path/to/run.json
+bunx @vela-science/canopus@0.6.2 doctor /path/to/frontier
+bunx @vela-science/canopus@0.6.2 run /path/to/frontier --first
+bunx @vela-science/canopus@0.6.2 inspect latest
+bunx @vela-science/canopus@0.6.2 replay /path/to/run.json
 ```
 
 Export a completed Defer run without publishing or mutating anything:
@@ -84,7 +94,7 @@ standing after verification; historical run v0 records remain inspectable.
 Use `--no-land` for a diagnostic mission that cannot change the source frontier:
 
 ```sh
-bunx @vela-science/canopus@0.6.1 run /path/to/frontier --first --no-land
+bunx @vela-science/canopus@0.6.2 run /path/to/frontier --first --no-land
 ```
 
 `doctor` binds the exact Vela, Codex, Git, frontier, packet, profile, and verifier
@@ -146,3 +156,7 @@ bun run pack:check
 
 Apache-2.0 OR MIT, at your option. Canopus is a replaceable producer; Vela
 remains the protocol and authority boundary.
+
+The published CLI has no runtime npm dependencies. See
+[Third-party components](THIRD_PARTY.md) for the bundled verifier and external
+toolchain boundary.

package/THIRD_PARTY.md

@@ -0,0 +1,41 @@
+# Third-party components
+
+Canopus is licensed under Apache-2.0 OR MIT. The corresponding license texts
+are in `LICENSE-APACHE` and `LICENSE-MIT`.
+
+## Shipped npm package
+
+`@vela-science/canopus@0.6.2` has no runtime npm dependencies. Its packaged
+JavaScript uses only Node.js built-ins. The package also contains frozen
+mission data and verifier capsules produced for the bounded profiles described
+in `docs/MISSIONS.md`; their source and executable identities are bound by the
+profile and release evidence.
+
+The native Vela verifier capsules are distributed under Vela's Apache-2.0 OR
+MIT licensing. The Python and shell verifier capsules use only their host
+language or declared container toolchain and do not add a vendored application
+dependency.
+
+## Development-only dependencies
+
+These packages are used to type-check and build Canopus but are not runtime npm
+dependencies of the published CLI:
+
+| Component | Role | Upstream license |
+| --- | --- | --- |
+| `typescript` | TypeScript compiler | Apache-2.0 |
+| `@types/node` | Node.js type declarations | MIT |
+
+Exact resolved versions and integrity hashes are recorded in `bun.lock`.
+
+## Separately supplied host tools
+
+The full tool-using workflow composes separately installed Vela, Codex CLI,
+Git, Docker, and operating-system sandbox facilities. They are not bundled as
+npm runtime dependencies and remain governed by their respective upstream
+licenses and terms. Canopus records or checks their exact identities where the
+mission contract requires it.
+
+Third-party presence does not imply authority. The Codex worker, verifier,
+Canopus process, and host tools cannot sign or perform a protected Vela
+scientific acceptance decision.

package/docs/RELEASES.md

@@ -1,5 +1,26 @@
 # Release evidence
 
+## Canopus v0.6.2
+
+Version `0.6.2` is the final Build Week distribution correction. It packages
+the exact artifact-specific Vela replay and independent base-3 verifier paths
+for the pending 7,194-point Sidon witness, together with the dated evidence
+ledger, immutable Receipt caveat reconciliation, and third-party notice that
+were added after `0.6.1`. It changes no runtime, protocol, Receipt, policy, or
+authority behavior.
+
+- Source/tag: `v0.6.2`
+- Public package: <https://www.npmjs.com/package/@vela-science/canopus/v/0.6.2>
+- Matching release: <https://github.com/vela-science/vela-research-harness/releases/tag/v0.6.2>
+- Publication path: the repository release workflow validates the package on
+  macOS, packs it on Ubuntu, binds a GitHub build attestation to the exact tag
+  and workflow, publishes through npm trusted publishing, and audits the npm
+  signature plus SLSA provenance v1 before creating the GitHub release.
+- Judge-path contract: the packed `README.md` and `BUILD_WEEK.md` select
+  `artifacts/sidon-a24-gpt56-7194.witness.json` explicitly at frontier audit
+  commit `825657d7e87618c0aa6fc9af7e3182e05f324750`; neither command performs a
+  scientific acceptance decision.
+
 ## Canopus v0.4.6
 
 Version `0.4.6` is the primary Build Week science release. It registers the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vela-science/canopus",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "A bounded, replaceable research harness over released Vela interfaces",
   "type": "module",
   "private": false,
@@ -70,6 +70,7 @@
     "tests/fixtures/hostile-verifier",
     "README.md",
     "BUILD_WEEK.md",
+    "THIRD_PARTY.md",
     "docs/MISSIONS.md",
     "docs/RELEASES.md",
     "docs/RUN_RECORD.md",