@vela-science/canopus 0.6.5 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## Unreleased
+
+## 0.7.0 - 2026-07-25
+
+- Retire long-lived proposal-withdrawal capabilities. Successful runs now
+  destroy the isolated producer key with the rest of the Vela home; `inspect`
+  reports only rooted run state, and the `withdraw` command and capability
+  store are removed. Historical activity records and Vela
+  `proposal.withdrawn` events remain readable, while pending proposals remain
+  canonical review records rather than reasons to retain a private key.
+- Narrow the npm package to the active Canopus product boundary. Historical
+  Build Week records, release ledgers, advisories, and retained Erdős evidence
+  remain immutable in Git and tagged source archives but no longer inflate the
+  installed runtime. Stable README links point to the exact `v0.6.5` archive,
+  while missions, profiles, verifier capsules, schemas, runtime custody
+  fixtures, and current product guidance continue to ship.
+
 ## 0.6.5 - 2026-07-25
 
 - Advance the sole runnable Erdős 1056 profile to the adjacent,

package/README.md

@@ -16,7 +16,7 @@
 
 <p align="center">
   <a href="https://app.vela.space/frontiers/sidon-sets/runs/run_f68e4cfc-e5c7-4c73-86cb-d79807c47ec4">Retained Sidon run</a> ·
-  <a href="BUILD_WEEK.md">Build Week record</a> ·
+  <a href="https://github.com/vela-science/vela-research-harness/blob/v0.6.5/BUILD_WEEK.md">Build Week archive</a> ·
   <a href="docs/MISSIONS.md">Missions</a> ·
   <a href="docs/RUN_RECORD.md">Run records</a> ·
   <a href="https://github.com/vela-science/vela">Vela</a>
@@ -57,8 +57,8 @@ Mission → GPT-5.6 → artifact → verifier → Receipt → Defer.
 **90 seconds — inspect the shipped product:**
 
 ```sh
-bunx @vela-science/canopus@0.6.5 --version
-bunx @vela-science/canopus@0.6.5 profile validate sidon-a24-at-least-7194-gpt56-v3
+bunx @vela-science/canopus@0.7.0 --version
+bunx @vela-science/canopus@0.7.0 profile validate sidon-a24-at-least-7194-gpt56-v3
 ```
 
 **Retained historical result — reproduce without rebuilding Canopus:**
@@ -82,23 +82,23 @@ frozen Sidon verifier. The second is an independent base-3 implementation that
 also rejects a bound collision injection. Neither command accepts the proposal.
 
 For new missions, use Vela `0.915.1`, the version composed with Canopus
-`0.6.5` and enforced by `canopus doctor`.
+`0.7.0` and enforced by `canopus doctor`.
 
 ## Quickstart
 
 Run the provenance-backed public package with Bun:
 
 ```sh
-bunx @vela-science/canopus@0.6.5 --version
+bunx @vela-science/canopus@0.7.0 --version
 ```
 
 Inspect a clean frontier, then run its first ranked producer offer:
 
 ```sh
-bunx @vela-science/canopus@0.6.5 doctor /path/to/frontier
-bunx @vela-science/canopus@0.6.5 run /path/to/frontier --first
-bunx @vela-science/canopus@0.6.5 inspect latest
-bunx @vela-science/canopus@0.6.5 replay /path/to/run.json
+bunx @vela-science/canopus@0.7.0 doctor /path/to/frontier
+bunx @vela-science/canopus@0.7.0 run /path/to/frontier --first
+bunx @vela-science/canopus@0.7.0 inspect latest
+bunx @vela-science/canopus@0.7.0 replay /path/to/run.json
 ```
 
 Export a completed Defer run without publishing or mutating anything:
@@ -117,7 +117,7 @@ standing after verification; historical run v0 records remain inspectable.
 Use `--no-land` for a diagnostic mission that cannot change the source frontier:
 
 ```sh
-bunx @vela-science/canopus@0.6.5 run /path/to/frontier --first --no-land
+bunx @vela-science/canopus@0.7.0 run /path/to/frontier --first --no-land
 ```
 
 `doctor` binds the exact Vela, Codex, Git, frontier, packet, profile, and verifier
@@ -130,7 +130,7 @@ unregistered targets. It never silently skips the first ranked offer.
 | --- | --- | --- |
 | Codex worker | Use tools inside one bounded workspace | Reach the network, host home, human keys, or verifier |
 | Verifier | Read frozen candidate bytes and declared inputs | Write, use the network, or make an authority decision |
-| Canopus | Preserve evidence, replay, land a Receipt, withdraw its own proposal | Sign, accept, reject, or call verifier success acceptance |
+| Canopus | Preserve evidence, replay, and land a Receipt | Sign, accept, reject, retain producer keys, or call verifier success acceptance |
 
 The worker uses macOS Seatbelt or Codex's Bubblewrap sandbox on Linux and WSL2.
 The verifier runs in a separate pinned container with network and writes denied.
@@ -144,17 +144,23 @@ canopus inspect [run.json | latest]
 canopus replay <run.json>
 ```
 
-Advanced profile and withdrawal commands are documented in
-[Missions](docs/MISSIONS.md). Installed profiles are closed,
+Advanced profile commands are documented in [Missions](docs/MISSIONS.md).
+Installed profiles are closed,
 content-addressed contracts that bind the target, packet, objective, artifact
 types, worker, verifier, replay command, budgets, and landing ceiling.
 
+Producer identities are ephemeral. After a successful landing and clean-clone
+reproduction, Canopus destroys the isolated Vela home instead of retaining a
+proposal-scoped private key. A proposal may remain pending until Vela policy or
+a human reviewer decides it; Canopus does not need a second control channel.
+
 ## Retained Build Week evidence
 
 Inspect the retained Mission → worker → artifact → verifier → Receipt → Defer
 chain on the [exact Sidon run](https://app.vela.space/frontiers/sidon-sets/runs/run_f68e4cfc-e5c7-4c73-86cb-d79807c47ec4).
 Exact commits, run roots, audit evidence, and nonclaims live in
-[`BUILD_WEEK.md`](BUILD_WEEK.md).
+the retained
+[`v0.6.5` Build Week archive](https://github.com/vela-science/vela-research-harness/blob/v0.6.5/BUILD_WEEK.md).
 
 ## Development
 
@@ -172,7 +178,7 @@ bun run pack:check
 
 - [Missions and profiles](docs/MISSIONS.md)
 - [Run records and publication](docs/RUN_RECORD.md)
-- [Release evidence](docs/RELEASES.md)
+- [Historical release evidence](https://github.com/vela-science/vela-research-harness/blob/v0.7.0/docs/RELEASES.md)
 - [Why the harness stays removable](docs/adr/0001-harness-boundary-and-name.md)
 
 ## License

package/SECURITY.md

@@ -5,8 +5,9 @@ Report vulnerabilities privately through GitHub Security Advisories for
 
 Canopus does not accept human signing keys. Do not place a human Vela key,
 provider credential, or unpublished scientific secret inside a run root.
-Successful runs scrub the isolated agent-key home, but operators remain
-responsible for deleting failed diagnostic runs and benchmark output.
+Successful runs scrub the isolated agent-key home and retain no producer
+private key or withdrawal capability. Operators remain responsible for
+deleting failed diagnostic runs and benchmark output.
 
 Agent-authored Git commits and tags must explicitly disable ambient signing
 (`commit.gpgSign=false`, `tag.gpgSign=false`) and verify that the resulting Git

package/dist/src/activity/events.d.ts

@@ -1,6 +1,9 @@
 export declare const ACTIVITY_SCHEMA: "canopus.activity.v0";
-export declare const ACTIVITY_TYPES: readonly ["run.started", "workspace.prepared", "roots.verified", "target.offered", "work.skipped", "work.claimed", "engine.started", "engine.completed", "artifact.frozen", "artifacts.published", "verifier.completed", "candidate.finalized", "receipt.mapped", "landing.observed", "landing.bound", "landing.completed", "withdrawal_capability.retained", "reproduction.completed", "projection.written", "run.completed", "run.failed"];
+export declare const WRITABLE_ACTIVITY_TYPES: readonly ["run.started", "workspace.prepared", "roots.verified", "target.offered", "work.skipped", "work.claimed", "engine.started", "engine.completed", "artifact.frozen", "artifacts.published", "verifier.completed", "candidate.finalized", "receipt.mapped", "landing.observed", "landing.bound", "landing.completed", "reproduction.completed", "projection.written", "run.completed", "run.failed"];
+export declare const HISTORICAL_ACTIVITY_TYPES: readonly ["withdrawal_capability.retained"];
+export declare const ACTIVITY_TYPES: readonly ["run.started", "workspace.prepared", "roots.verified", "target.offered", "work.skipped", "work.claimed", "engine.started", "engine.completed", "artifact.frozen", "artifacts.published", "verifier.completed", "candidate.finalized", "receipt.mapped", "landing.observed", "landing.bound", "landing.completed", "reproduction.completed", "projection.written", "run.completed", "run.failed", "withdrawal_capability.retained"];
 export type ActivityType = (typeof ACTIVITY_TYPES)[number];
+export type WritableActivityType = (typeof WRITABLE_ACTIVITY_TYPES)[number];
 export interface ActivityEventBody {
     schema: typeof ACTIVITY_SCHEMA;
     run_id: string;

package/dist/src/activity/events.js

@@ -1,5 +1,5 @@
 export const ACTIVITY_SCHEMA = "canopus.activity.v0";
-export const ACTIVITY_TYPES = [
+export const WRITABLE_ACTIVITY_TYPES = [
     "run.started",
     "workspace.prepared",
     "roots.verified",
@@ -16,9 +16,15 @@ export const ACTIVITY_TYPES = [
     "landing.observed",
     "landing.bound",
     "landing.completed",
-    "withdrawal_capability.retained",
     "reproduction.completed",
     "projection.written",
     "run.completed",
     "run.failed",
 ];
+export const HISTORICAL_ACTIVITY_TYPES = [
+    "withdrawal_capability.retained",
+];
+export const ACTIVITY_TYPES = [
+    ...WRITABLE_ACTIVITY_TYPES,
+    ...HISTORICAL_ACTIVITY_TYPES,
+];

package/dist/src/activity/store.d.ts

@@ -1,4 +1,4 @@
-import { type ActivityEvent, type ActivityType } from "./events.js";
+import { type ActivityEvent, type WritableActivityType } from "./events.js";
 export declare function readActivity(file: string): Promise<ActivityEvent[]>;
 export declare class ActivityStore {
     #private;
@@ -6,5 +6,5 @@ export declare class ActivityStore {
     static open(file: string, runId: string): Promise<ActivityStore>;
     get tip(): string | null;
     get events(): readonly ActivityEvent[];
-    append(type: ActivityType, payload: Record<string, unknown>): Promise<ActivityEvent>;
+    append(type: WritableActivityType, payload: Record<string, unknown>): Promise<ActivityEvent>;
 }

package/dist/src/activity/store.js

@@ -3,7 +3,7 @@ import { mkdir, open } from "node:fs/promises";
 import path from "node:path";
 import { canonicalJson, contentDigest } from "../util/canonical.js";
 import { readBoundedRegularFile } from "../util/files.js";
-import { ACTIVITY_SCHEMA, ACTIVITY_TYPES, } from "./events.js";
+import { ACTIVITY_SCHEMA, ACTIVITY_TYPES, WRITABLE_ACTIVITY_TYPES, } from "./events.js";
 const MAX_ACTIVITY_BYTES = 64 * 1024 * 1024;
 const MAX_EVENT_BYTES = 1024 * 1024;
 function parseEvent(value, line) {
@@ -129,8 +129,9 @@ export class ActivityStore {
         });
         this.#queue = this.#queue.then(async () => {
             try {
-                if (!ACTIVITY_TYPES.includes(type))
-                    throw new Error(`unknown activity type ${type}`);
+                if (!WRITABLE_ACTIVITY_TYPES.includes(type)) {
+                    throw new Error(`retired or unknown activity type ${type}`);
+                }
                 const body = {
                     schema: ACTIVITY_SCHEMA,
                     run_id: this.#runId,

package/dist/src/cli.js

@@ -16,7 +16,6 @@ import { buildPublicationBundle } from "./projection/publication.js";
 import { doctorProduct } from "./product/doctor.js";
 import { replayProduct } from "./product/replay.js";
 import { runProduct } from "./product/run.js";
-import { withdrawProduct } from "./product/withdraw.js";
 import { CANOPUS_VERSION } from "./product/version.js";
 import { listProductProfiles, packProductProfile, validateProductProfile, } from "./product/profile-bundle.js";
 import { loadProductProfile } from "./product/profile.js";
@@ -24,7 +23,6 @@ import { runCanopus } from "./run.js";
 import { readBoundedRegularFile } from "./util/files.js";
 import { canonicalJson, contentDigest } from "./util/canonical.js";
 import { VelaClient } from "./vela/cli.js";
-import { withdrawalCapabilityStatus } from "./capability/withdrawal.js";
 function usage() {
     return `Canopus — bounded Vela research harness
 
@@ -39,7 +37,6 @@ Primary workflow:
   canopus publish-run <run.json> --mission <mission.json> \
     --repository <public-url> --output <new-directory>
   canopus replay <run.json>
-  canopus withdraw [frontier] [--run <run.json|latest>] --reason <text>
 
 Mission v1 prepare/validate remains available under advanced help.
 
@@ -116,14 +113,6 @@ Creates a sanitized public projection, root manifest, proposal-scoped pending
 commands, and a read-only Vela Observatory import descriptor. It never lands,
 signs, accepts, pushes, or deploys.`;
 }
-function withdrawUsage() {
-    return `Usage:
-  canopus withdraw [frontier] [--run <run.json|latest>] --reason <text>
-
-Uses only the retained proposal-scoped producer capability. The operation runs
-in a disposable exact-head clone, verifies strict and clean-clone replay, then
-fast-forwards the clean source. It never mounts a worker or human key.`;
-}
 function isHelp(value) {
     return value === "--help" || value === "-h" || value === "help";
 }
@@ -445,10 +434,7 @@ async function inspectCommand(value, rest) {
         : schema === "canopus.failure.v0"
             ? projectFailure(parseFailureRecord(raw))
             : projectRun(parseRunRecord(raw));
-    const withdrawal = "proposal_id" in projection
-        ? await withdrawalCapabilityStatus(projection.proposal_id)
-        : { state: "not_applicable", available: false };
-    process.stdout.write(`${JSON.stringify({ ok: true, command: "inspect", run_file: file, projection, withdrawal })}\n`);
+    process.stdout.write(`${JSON.stringify({ ok: true, command: "inspect", run_file: file, projection })}\n`);
 }
 async function replayCommand(file, rest) {
     if (file === undefined || rest.length !== 0)
@@ -514,22 +500,6 @@ async function publishRunCommand(file, rest) {
         authority_effect: "none",
     })}\n`);
 }
-async function withdrawCommand(args) {
-    const parsed = productOptions(args, ["--run", "--reason"], []);
-    if (parsed.positional.length > 1)
-        throw new Error("withdraw accepts at most one frontier");
-    const reason = parsed.values.get("--reason");
-    if (reason === undefined || reason.trim().length === 0)
-        throw new Error("withdraw requires --reason");
-    const runValue = parsed.values.get("--run") ?? "latest";
-    const runFile = runValue === "latest" ? await latestRunFile() : path.resolve(runValue);
-    const result = await withdrawProduct({
-        frontier: path.resolve(parsed.positional[0] ?? "."),
-        runFile,
-        reason,
-    });
-    process.stdout.write(`${JSON.stringify(result)}\n`);
-}
 async function main(argv) {
     const [command, file, ...rest] = argv;
     if (command === undefined || isHelp(command)) {
@@ -557,8 +527,7 @@ async function main(argv) {
                     : command === "replay" ? replayUsage()
                         : command === "public-run" ? publicRunUsage()
                             : command === "publish-run" ? publishRunUsage()
-                                : command === "withdraw" ? withdrawUsage()
-                                    : usage()}\n`);
+                                : usage()}\n`);
         return;
     }
     if (command === "doctor") {
@@ -577,10 +546,6 @@ async function main(argv) {
         await publishRunCommand(file, rest);
         return;
     }
-    if (command === "withdraw") {
-        await withdrawCommand(argv.slice(1));
-        return;
-    }
     if (command === "validate") {
         if (file === undefined)
             throw new Error("validate requires a mission file");

package/dist/src/product/run.js

@@ -11,7 +11,6 @@ import { readBoundedRegularFile } from "../util/files.js";
 import { VelaClient } from "../vela/cli.js";
 import { doctorProduct } from "./doctor.js";
 import { loadProfileDraft, loadProfileResultContract, packagedWorkerProfile, stageProfileCapsule, } from "./profile.js";
-import { retainWithdrawalCapability } from "../capability/withdrawal.js";
 function packageFile(relative) {
     return fileURLToPath(new URL(`../../../${relative}`, import.meta.url));
 }
@@ -220,12 +219,6 @@ export async function runProduct(options) {
             bundleRoot,
             dockerBinary: dockerRuntime.binary,
             verifierRunner: runner,
-            retainWithdrawalCapability: async (context) => {
-                await retainWithdrawalCapability({
-                    ...context,
-                    velaBinary: diagnosis.public.runtimes.vela.binary,
-                });
-            },
         };
         const run = options.noLand === true
             ? await runCanopus({ ...commonRun, noLand: true })

package/dist/src/run.d.ts

@@ -25,13 +25,6 @@ export interface CanopusRunOptions {
     bundleRoot?: string;
     dockerBinary?: string;
     verifierRunner?: CommandRunner;
-    retainWithdrawalCapability?: (context: {
-        velaHome: string;
-        landingRepo: string;
-        mission: Mission;
-        landing: LandResult;
-        finalRoots: MissionRoots;
-    }) => Promise<void>;
     noLand?: false;
 }
 export interface CanopusNoLandOptions extends Omit<CanopusRunOptions, "noLand"> {

package/dist/src/run.js

@@ -542,20 +542,6 @@ export async function runCanopus(options) {
             roots: reproductionInspection.roots,
             verifier_status: reproductionVerifier.status,
         });
-        if (options.retainWithdrawalCapability !== undefined) {
-            phase = "withdrawal_capability";
-            await options.retainWithdrawalCapability({
-                velaHome: paths.velaHome,
-                landingRepo: paths.landing,
-                mission: options.mission,
-                landing,
-                finalRoots: final.roots,
-            });
-            await activity.append("withdrawal_capability.retained", {
-                proposal_id: landing.proposalId,
-                authority: "producer_withdrawal_only",
-            });
-        }
         await rm(paths.velaHome, { recursive: true, force: true });
         const record = {
             schema: RUN_RECORD_SCHEMA,
@@ -630,7 +616,6 @@ export async function runCanopus(options) {
         if (phase.startsWith("landing_") ||
             phase === "receipt_binding" ||
             phase === "clean_clone_reproduction" ||
-            phase === "withdrawal_capability" ||
             phase === "record_finalization") {
             let observedRoots = null;
             let inspectionError = null;

package/dist/src/vela/cli.d.ts

@@ -44,14 +44,6 @@ export interface VelaLandCommandObservation {
     stdout_digest: string;
     stderr_digest: string;
 }
-export interface VelaWithdrawalResult {
-    proposal_id: string;
-    withdrawal_event_id: string;
-    withdrawn_at: string;
-    state_root_before: string;
-    state_root_after: string;
-    publication_commit: string;
-}
 export declare function strictBaselineFromCheck(check: Record<string, unknown>): StrictBaseline;
 export declare function validateLandResult(mission: Mission, raw: Record<string, unknown>): LandResult;
 export declare class VelaClient {
@@ -64,7 +56,6 @@ export declare class VelaClient {
     next(mission: Mission, repoRoot: string): Promise<VelaCommandResponse>;
     offer(repoRoot: string, frontier: string, roots: MissionRoots, strictBaseline?: StrictBaseline, limit?: number): Promise<VelaCommandResponse>;
     work(mission: Mission, repoRoot: string, target: string, expected: MissionRoots): Promise<VelaCommandResponse>;
-    withdraw(repoRoot: string, frontier: string, proposalId: string, actor: string, reason: string): Promise<VelaWithdrawalResult>;
     landAuthoredCommand(mission: Mission, repoRoot: string, input: AuthoredReceiptInput, _expected: MissionRoots): Promise<VelaLandCommandObservation>;
     parseLandCommand(observation: VelaLandCommandObservation): Record<string, unknown>;
     validateLandResult(mission: Mission, raw: Record<string, unknown>): LandResult;

package/dist/src/vela/cli.js

@@ -509,54 +509,6 @@ export class VelaClient {
         }
         return { ok: true, value };
     }
-    async withdraw(repoRoot, frontier, proposalId, actor, reason) {
-        if (!/^vpr_[0-9a-f]{16}$/u.test(proposalId)) {
-            throw new VelaClientError("malformed_output", "withdrawal requires a full proposal id");
-        }
-        if (!actor.startsWith("agent:") || reason.trim().length === 0) {
-            throw new VelaClientError("malformed_output", "withdrawal requires an agent actor and reason");
-        }
-        const value = await this.#json(["review", "withdraw", frontierPath(frontier), proposalId, "--as", actor, "--reason", reason, "--json"], repoRoot, "vela review withdraw");
-        if (value.ok !== true || value.command !== "review.withdraw") {
-            throw new VelaClientError("malformed_output", "vela review withdraw returned an invalid envelope");
-        }
-        if (value.proposal_id !== proposalId || value.idempotent !== false || value.key_read !== true) {
-            throw new VelaClientError("malformed_output", "vela review withdraw did not bind one new key-backed withdrawal");
-        }
-        const eventId = stringAt(value.withdrawal_event_id, "vela review withdraw.withdrawal_event_id", {
-            max: 20,
-            pattern: /^vev_[0-9a-f]{16}$/u,
-        });
-        const withdrawnAt = stringAt(value.withdrawn_at, "vela review withdraw.withdrawn_at", {
-            min: 20,
-            max: 64,
-        });
-        if (!Number.isFinite(Date.parse(withdrawnAt))) {
-            throw new VelaClientError("malformed_output", "vela review withdraw returned an invalid timestamp");
-        }
-        const stateRootBefore = normalizeSha256(value.state_root_before, "vela review withdraw.state_root_before");
-        const stateRootAfter = normalizeSha256(value.state_root_after, "vela review withdraw.state_root_after");
-        if (stateRootBefore === stateRootAfter) {
-            throw new VelaClientError("malformed_output", "new withdrawal did not change the event-log root");
-        }
-        const publication = fieldObject(value, "publication", "vela review withdraw");
-        const publicationState = stringAt(publication.state, "vela review withdraw.publication.state", {
-            min: 1,
-            max: 32,
-        });
-        if (publicationState !== "committed_local" && publicationState !== "pushed") {
-            throw new VelaClientError("command_failed", `withdrawal publication is ${publicationState}, not committed`);
-        }
-        const publicationCommit = stringAt(publication.commit, "vela review withdraw.publication.commit", { max: 64, pattern: GIT_OBJECT_RE });
-        return {
-            proposal_id: proposalId,
-            withdrawal_event_id: eventId,
-            withdrawn_at: withdrawnAt,
-            state_root_before: stateRootBefore,
-            state_root_after: stateRootAfter,
-            publication_commit: publicationCommit,
-        };
-    }
     async landAuthoredCommand(mission, repoRoot, input, _expected) {
         if ((input.predictedObservable === undefined) === (input.notApplicable === undefined)) {
             throw new VelaClientError("malformed_output", "authored receipt requires exactly one prediction mode");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vela-science/canopus",
-  "version": "0.6.5",
+  "version": "0.7.0",
   "description": "A bounded, replaceable research harness over released Vela interfaces",
   "type": "module",
   "private": false,
@@ -31,7 +31,6 @@
     "dist/src/artifact",
     "dist/src/budget",
     "dist/src/candidate",
-    "dist/src/capability",
     "dist/src/contracts",
     "dist/src/engines",
     "dist/src/evidence",
@@ -62,18 +61,12 @@
     "missions",
     "profiles",
     "runtime",
-    "advisories",
-    "evidence/build-week",
-    "evidence/erdos",
-    "scripts/run-claim-fidelity-advisory.mjs",
     "scripts/run-hostile-native-custody-fixture.mjs",
     "scripts/run-hostile-verifier-fixture.mjs",
     "tests/fixtures/hostile-verifier",
     "README.md",
-    "BUILD_WEEK.md",
     "THIRD_PARTY.md",
     "docs/MISSIONS.md",
-    "docs/RELEASES.md",
     "docs/RUN_RECORD.md",
     "CHANGELOG.md",
     "SECURITY.md",