@vela-science/canopus 0.6.3 → 0.6.4

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## Unreleased
+
+- Compose exactly with released Vela `0.915.1`. The maintenance release changes
+  no mission, Receipt, verifier, policy, proposal, or authority contract.
+  GitHub CI pins the released macOS, Linux, and Windows archives and binaries by
+  SHA-256, and the released-binary integration test retains Defer,
+  accepted-event delta zero, retained-artifact binding, and clean-clone replay.
+- Extend the bounded Vela 0.9 compact-root reader through `0.915.1`. Fresh
+  minimal frontiers intentionally omit `proof/latest.json`; Canopus continues
+  to bind the strict replay event and scientific-state roots instead of
+  inventing or requiring a derived proof packet.
+- Keep the non-normative cross-repository task-authority shadow test explicit:
+  it runs when its separately pinned ecosystem checkout is available and reports
+  a named skip in a standalone Canopus clone instead of copying private
+  experiment inputs or failing the product release suite.
+- Add a source-local, non-normative task-authority hostile experiment over the
+  released Canopus `0.6.3`, Vela `0.915.1`, and Codex `0.145.0` composition.
+  The current Mission v1 boundary detects three of eight frozen hostiles; an
+  additional operational packet detects all eight while retaining zero
+  scientific, authority, or standing effect. The experiment is intentionally
+  excluded from the npm package and promotes no Vela protocol object.
+
 ## 0.6.3 - 2026-07-24
 
 - Restore exact composition with released Vela `0.914.1` after Canopus

package/README.md

@@ -57,8 +57,8 @@ Mission → GPT-5.6 → artifact → verifier → Receipt → Defer.
 **90 seconds — inspect the shipped product:**
 
 ```sh
-bunx @vela-science/canopus@0.6.3 --version
-bunx @vela-science/canopus@0.6.3 profile validate sidon-a24-at-least-7194-gpt56-v3
+bunx @vela-science/canopus@0.6.4 --version
+bunx @vela-science/canopus@0.6.4 profile validate sidon-a24-at-least-7194-gpt56-v3
 ```
 
 **Full workflow — reproduce without rebuilding Canopus:**
@@ -85,16 +85,16 @@ also rejects a bound collision injection. Neither command accepts the proposal.
 Run the provenance-backed public package with Bun:
 
 ```sh
-bunx @vela-science/canopus@0.6.3 --version
+bunx @vela-science/canopus@0.6.4 --version
 ```
 
 Inspect a clean frontier, then run its first ranked producer offer:
 
 ```sh
-bunx @vela-science/canopus@0.6.3 doctor /path/to/frontier
-bunx @vela-science/canopus@0.6.3 run /path/to/frontier --first
-bunx @vela-science/canopus@0.6.3 inspect latest
-bunx @vela-science/canopus@0.6.3 replay /path/to/run.json
+bunx @vela-science/canopus@0.6.4 doctor /path/to/frontier
+bunx @vela-science/canopus@0.6.4 run /path/to/frontier --first
+bunx @vela-science/canopus@0.6.4 inspect latest
+bunx @vela-science/canopus@0.6.4 replay /path/to/run.json
 ```
 
 Export a completed Defer run without publishing or mutating anything:
@@ -113,7 +113,7 @@ standing after verification; historical run v0 records remain inspectable.
 Use `--no-land` for a diagnostic mission that cannot change the source frontier:
 
 ```sh
-bunx @vela-science/canopus@0.6.3 run /path/to/frontier --first --no-land
+bunx @vela-science/canopus@0.6.4 run /path/to/frontier --first --no-land
 ```
 
 `doctor` binds the exact Vela, Codex, Git, frontier, packet, profile, and verifier
@@ -154,7 +154,7 @@ Exact commits, run roots, audit evidence, and nonclaims live in
 
 ## Development
 
-Requires Bun 1.3.12, Vela 0.914.1, Codex CLI 0.145.0, and Docker. The built
+Requires Bun 1.3.12, Vela 0.915.1, Codex CLI 0.145.0, and Docker. The built
 package also runs under Node 22 or 24; unsupported odd-numbered Node releases
 are rejected rather than silently treated as supported.
 

package/THIRD_PARTY.md

@@ -5,7 +5,7 @@ are in `LICENSE-APACHE` and `LICENSE-MIT`.
 
 ## Shipped npm package
 
-`@vela-science/canopus@0.6.3` has no runtime npm dependencies. Its packaged
+`@vela-science/canopus@0.6.4` has no runtime npm dependencies. Its packaged
 JavaScript uses only Node.js built-ins. The package also contains frozen
 mission data and verifier capsules produced for the bounded profiles described
 in `docs/MISSIONS.md`; their source and executable identities are bound by the

package/dist/src/product/version.d.ts

@@ -1,3 +1,3 @@
 export declare const CANOPUS_VERSION: string;
-export declare const SUPPORTED_VELA_VERSION = "0.914.1";
+export declare const SUPPORTED_VELA_VERSION = "0.915.1";
 export declare const SUPPORTED_CODEX_VERSION = "0.145.0";

package/dist/src/product/version.js

@@ -4,5 +4,5 @@ if (typeof packageJson.version !== "string" || packageJson.version.length === 0)
     throw new Error("Canopus package version is missing");
 }
 export const CANOPUS_VERSION = packageJson.version;
-export const SUPPORTED_VELA_VERSION = "0.914.1";
+export const SUPPORTED_VELA_VERSION = "0.915.1";
 export const SUPPORTED_CODEX_VERSION = "0.145.0";

package/dist/src/vela/cli.js

@@ -43,7 +43,7 @@ function usesCompactStatusProjection(version) {
     if (match === null)
         return false;
     const minor = Number(match[1]);
-    return Number.isSafeInteger(minor) && minor >= 900 && minor <= 914;
+    return Number.isSafeInteger(minor) && minor >= 900 && minor <= 915;
 }
 function safeFailureMessage(value) {
     if (typeof value !== "string" || value.length === 0)

package/docs/RELEASES.md

@@ -1,5 +1,33 @@
 # Release evidence
 
+## Canopus v0.6.4
+
+Version `0.6.4` restores exact composition with released Vela `0.915.1`.
+The change advances only the tested Vela binary boundary and its platform
+archive and executable digests. It changes no mission, Receipt, verifier,
+policy, proposal, or authority contract. Historical missions remain bound to
+their own recorded Vela versions and SHA-256 digests.
+
+Vela `0.915.1` preserves the 0.9 minimal-init contract: a fresh frontier has no
+`proof/latest.json`. Canopus therefore reads the event and scientific-state
+roots from the strict replay projection, cross-checks every available replay
+root, and does not create or require a derived proof packet.
+
+The release gate requires the exact Vela `0.915.1` binary to pass initialization,
+work, authored Defer landing, accepted-event delta zero, retained-artifact
+binding, and clean-clone replay. CI pins these release bytes:
+
+| Platform | Archive SHA-256 | Vela executable SHA-256 |
+| --- | --- | --- |
+| macOS arm64 | `e9f34d25e10313b2bcd38683b198743ef51242e5074b33d8f223a3d04873a642` | `826861ac137e4607bdaa363702d2779f2639b8fffb088a70f8be7d0be6540fed` |
+| Linux x86-64 | `6d78bf5f47b51baf3610cd40a33524ea36e3f5f231bf2616ef306dacb4a4edf3` | `b9acf197e26a75decf37219ba681f78878dffe1c11d4e1351bba18246c77d8aa` |
+| Windows x86-64 | `dae503dc0a83679e0f244ab12ea3fffd105bae1e0217d4d01c5b8a24adf508bd` | `a2dba32fe9354355a3cd0b3665a9da706dcd6bf15bdbb0c87c1cec25756d1ba4` |
+
+The source-local task-authority live-shadow experiment still binds separate
+private-parent evidence. A standalone Canopus clone now reports that fixture
+as unavailable rather than copying it or making a non-normative experiment a
+false product failure.
+
 ## Canopus v0.6.3
 
 Version `0.6.3` is a narrow composition repair for released Vela `0.914.1`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vela-science/canopus",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "description": "A bounded, replaceable research harness over released Vela interfaces",
   "type": "module",
   "private": false,
@@ -88,6 +88,8 @@
     "check": "bun run lint && bun run test",
     "prepack": "bun run build",
     "pack:check": "bun pm pack --dry-run",
+    "experiment:task-authority": "bun experiments/task-authority/run.mjs",
+    "experiment:task-authority-shadow": "bun experiments/task-authority/run-live-shadow.mjs",
     "fixture:hostile-custody": "node scripts/run-hostile-native-custody-fixture.mjs",
     "fixture:hostile-verifier": "node scripts/run-hostile-verifier-fixture.mjs"
   },