@vela-science/canopus 0.6.5 → 0.8.0

package/dist/src/engines/codex-tool-free.js

@@ -1,213 +0,0 @@
-import { access, realpath } from "node:fs/promises";
-import path from "node:path";
-export const CODEX_TOOL_FEATURES = [
-    "apply_patch_freeform",
-    "apply_patch_streaming_events",
-    "apps",
-    "artifact",
-    "browser_use",
-    "browser_use_external",
-    "computer_use",
-    "enable_mcp_apps",
-    "goals",
-    "hooks",
-    "image_generation",
-    "in_app_browser",
-    "memories",
-    "multi_agent",
-    "plugin_sharing",
-    "remote_plugin",
-    "shell_snapshot",
-    "shell_tool",
-    "tool_suggest",
-    "unified_exec",
-    "workspace_dependencies",
-];
-function sbpl(value) {
-    return value.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
-}
-function metadataLiterals(paths) {
-    const values = new Set(["/"]);
-    for (const value of paths) {
-        for (let current = value; current !== "/"; current = path.dirname(current)) {
-            values.add(current);
-        }
-    }
-    return [...values]
-        .sort()
-        .map((value) => `(literal "${sbpl(value)}")`)
-        .join(" ");
-}
-async function optionalRealpath(candidate) {
-    try {
-        await access(candidate);
-        return await realpath(candidate);
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Wrap Codex itself in a host read boundary. Codex 0.139 always registers
- * view_image even when every feature-backed tool is disabled, so this outer
- * sandbox is the control that makes an arbitrary host image unreadable.
- */
-export async function sandboxedToolFreeCodexExecArgv(options) {
-    if (process.platform !== "darwin") {
-        throw new Error("Canopus v0 requires the macOS outer Codex sandbox");
-    }
-    const lexical = {
-        binary: path.resolve(options.binary),
-        cwd: path.resolve(options.cwd),
-        outputSchema: path.resolve(options.outputSchema),
-        finalParent: path.resolve(path.dirname(options.finalPath)),
-        authHome: path.resolve(options.authHome),
-        authFile: path.resolve(options.authHome, "auth.json"),
-        modelCatalog: path.resolve(options.authHome, "models_cache.json"),
-    };
-    const managedRequirements = [
-        "/etc/codex/requirements.toml",
-        "/private/etc/codex/requirements.toml",
-    ];
-    // These are public operating-system inputs used by the macOS resolver and
-    // network stack. Keep the outer boundary file-specific: Codex does not need
-    // the user's preferences, keychain, or arbitrary /etc contents.
-    const networkRuntimeFiles = [
-        "/Library/Preferences/com.apple.networkd.plist",
-        "/etc/hosts",
-        "/etc/protocols",
-        "/etc/resolv.conf",
-        "/etc/services",
-        "/private/etc/hosts",
-        "/private/etc/protocols",
-        "/private/etc/resolv.conf",
-        "/private/etc/services",
-        "/private/var/run/resolv.conf",
-        "/var/run/resolv.conf",
-    ];
-    const [binary, cwd, outputSchema, finalParent, authHome, authFile, modelCatalog] = await Promise.all([
-        realpath(lexical.binary),
-        realpath(lexical.cwd),
-        realpath(lexical.outputSchema),
-        realpath(lexical.finalParent),
-        realpath(lexical.authHome),
-        optionalRealpath(lexical.authFile),
-        optionalRealpath(lexical.modelCatalog),
-    ]);
-    if (authFile === undefined) {
-        throw new Error("Codex auth home has no readable auth.json");
-    }
-    const finalPath = path.join(finalParent, path.basename(options.finalPath));
-    const inner = toolFreeCodexExecArgv({
-        ...options,
-        binary,
-        cwd,
-        outputSchema,
-        finalPath,
-    });
-    const readableFiles = [
-        binary,
-        lexical.binary,
-        outputSchema,
-        lexical.outputSchema,
-        authFile,
-        authHome,
-        lexical.authFile,
-        lexical.authHome,
-        modelCatalog,
-        ...networkRuntimeFiles,
-        ...(modelCatalog === undefined ? [] : [lexical.modelCatalog]),
-    ]
-        .filter((item) => item !== undefined)
-        .filter((item, index, values) => values.indexOf(item) === index)
-        .map((item) => `(literal "${sbpl(item)}")`)
-        .join(" ");
-    const metadata = metadataLiterals([
-        binary,
-        cwd,
-        outputSchema,
-        finalPath,
-        authFile,
-        lexical.binary,
-        lexical.cwd,
-        lexical.outputSchema,
-        lexical.finalParent,
-        lexical.authFile,
-        ...managedRequirements,
-        ...networkRuntimeFiles,
-        ...(modelCatalog === undefined ? [] : [modelCatalog]),
-    ]);
-    const profile = [
-        "(version 1)",
-        "(deny default)",
-        '(import "dyld-support.sb")',
-        "(deny file-link file-clone)",
-        // Native Codex creates runtime threads after entering Seatbelt. macOS
-        // classifies that operation under process-fork; process-exec remains
-        // restricted to the checksum-pinned Codex binary below.
-        "(allow process-fork)",
-        "(allow process-info* (target same-sandbox))",
-        "(allow signal (target same-sandbox))",
-        `(allow file-read-metadata ${metadata})`,
-        `(allow process-exec (literal "${sbpl(binary)}"))`,
-        `(allow file-map-executable (literal "${sbpl(binary)}"))`,
-        '(allow sysctl-read (sysctl-name "hw.activecpu") (sysctl-name "hw.logicalcpu") (sysctl-name "hw.machine") (sysctl-name "hw.model") (sysctl-name "hw.ncpu") (sysctl-name "hw.pagesize") (sysctl-name "hw.pagesize_compat") (sysctl-name "kern.argmax") (sysctl-name "kern.hostname") (sysctl-name "kern.osproductversion") (sysctl-name "kern.osrelease") (sysctl-name "kern.ostype") (sysctl-name "kern.osversion") (sysctl-name "kern.usrstack64") (sysctl-name "kern.version") (sysctl-name-regex #"^net.routetable"))',
-        // This is the finite service set required by native Codex startup plus the
-        // DNS/TLS services in Codex's own macOS network policy. No wildcard Mach
-        // lookup or user application service is admitted.
-        '(allow mach-lookup (global-name "com.apple.SecurityServer") (global-name "com.apple.SystemConfiguration.DNSConfiguration") (global-name "com.apple.SystemConfiguration.configd") (global-name "com.apple.bsd.dirhelper") (global-name "com.apple.cfprefsd.agent") (local-name "com.apple.cfprefsd.agent") (global-name "com.apple.logd") (global-name "com.apple.networkd") (global-name "com.apple.ocspd") (global-name "com.apple.system.notification_center") (global-name "com.apple.system.opendirectoryd.libinfo") (global-name "com.apple.system.opendirectoryd.membership") (global-name "com.apple.trustd") (global-name "com.apple.trustd.agent"))',
-        '(allow ipc-posix-shm-read* (ipc-posix-name "apple.shm.notification_center") (ipc-posix-name-prefix "apple.cfprefs."))',
-        '(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))',
-        '(allow system-socket (socket-domain AF_UNIX))',
-        '(allow file-read* (subpath "/Library/Apple") (subpath "/System") (subpath "/usr/lib") (subpath "/usr/share") (subpath "/private/etc/ssl") (subpath "/private/var/db/timezone") (literal "/dev/null") (literal "/dev/urandom"))',
-        `(allow file-read* file-test-existence (subpath "${sbpl(cwd)}") (subpath "${sbpl(lexical.cwd)}") (subpath "${sbpl(authHome)}") (subpath "${sbpl(lexical.authHome)}") ${readableFiles})`,
-        `(allow file-write* (subpath "${sbpl(authHome)}") (subpath "${sbpl(lexical.authHome)}") (literal "${sbpl(finalPath)}") (literal "/dev/null"))`,
-        // Chromium's macOS network profile isolates the resolver socket from
-        // ordinary IP traffic. This keeps AF_UNIX open only for mDNSResponder,
-        // while permitting the model request over TCP/UDP.
-        '(allow network-outbound (control-name "com.apple.netsrc") (literal "/private/var/run/mDNSResponder") (remote tcp) (remote udp))',
-    ].join(" ");
-    return ["/usr/bin/sandbox-exec", "-p", profile, "--", ...inner];
-}
-/**
- * Build the complete, pinned Codex lane used for untrusted synthesis.
- *
- * Read-only sandboxing alone still permits host reads. This lane registers no
- * shell, patch, browser, app, MCP, memory, or computer-use surface at all.
- * The only accepted product is the final response constrained by outputSchema.
- */
-export function toolFreeCodexExecArgv(options) {
-    return [
-        options.binary,
-        "exec",
-        "--ephemeral",
-        "--skip-git-repo-check",
-        "--ignore-user-config",
-        "--ignore-rules",
-        "--strict-config",
-        "--sandbox",
-        "read-only",
-        "--model",
-        options.model,
-        "--output-schema",
-        options.outputSchema,
-        "--output-last-message",
-        options.finalPath,
-        "--json",
-        "--color",
-        "never",
-        "--cd",
-        options.cwd,
-        "--config",
-        "shell_environment_policy.inherit=none",
-        "--config",
-        "approval_policy=\"never\"",
-        "--config",
-        "web_search=\"disabled\"",
-        ...(options.reasoningEffort === undefined
-            ? []
-            : ["--config", `model_reasoning_effort=\"${options.reasoningEffort}\"`]),
-        ...CODEX_TOOL_FEATURES.flatMap((feature) => ["--disable", feature]),
-        "-",
-    ];
-}

package/dist/src/product/withdraw.d.ts

@@ -1,8 +0,0 @@
-import { type CommandRunner } from "../util/command.js";
-export declare function withdrawProduct(options: {
-    frontier: string;
-    runFile: string;
-    reason: string;
-    storeRoot?: string;
-    runner?: CommandRunner;
-}): Promise<Record<string, unknown>>;

package/dist/src/product/withdraw.js

@@ -1,255 +0,0 @@
-import os from "node:os";
-import path from "node:path";
-import { mkdir, mkdtemp, readdir, realpath, rm } from "node:fs/promises";
-import { consumeWithdrawalCapability, installWithdrawalCapabilitySecret, loadWithdrawalCapability, } from "../capability/withdrawal.js";
-import { parseRunRecord } from "../projection/run.js";
-import { canonicalJcs, contentDigest, protocolDigest, sha256Bytes, } from "../util/canonical.js";
-import { isolatedEnvironment, runCommand } from "../util/command.js";
-import { readBoundedRegularFile } from "../util/files.js";
-import { VelaClient } from "../vela/cli.js";
-async function gitText(runner, cwd, home, argv) {
-    const result = await runner({
-        argv: ["git", ...argv],
-        cwd,
-        env: isolatedEnvironment(home),
-        timeoutMs: 120_000,
-        maxOutputBytes: 8 * 1024 * 1024,
-    });
-    if (result.exitCode !== 0 || result.stderr.length !== 0) {
-        throw new Error(`git ${argv.join(" ")} failed: stdout=${sha256Bytes(result.stdout)} stderr=${sha256Bytes(result.stderr)}`);
-    }
-    return result.stdout.toString("utf8").trim();
-}
-function safeActor(actor) {
-    return [...actor].map((character) => /[A-Za-z0-9_-]/u.test(character) ? character : "-").join("");
-}
-async function scientificProjectionRoot(frontierRoot) {
-    const project = JSON.parse((await readBoundedRegularFile(path.join(frontierRoot, "frontier.json"), 128 * 1024 * 1024))
-        .toString("utf8"));
-    const fields = [
-        "actors",
-        "anchor_links",
-        "artifacts",
-        "condition_records",
-        "evidence_atoms",
-        "findings",
-        "frontier",
-        "frontier_id",
-        "released_diff_packs",
-        "sources",
-        "statement_attestations",
-        "verifier_attachments",
-    ];
-    return contentDigest(Object.fromEntries(fields.map((field) => [field, project[field] ?? null])));
-}
-function jsonObject(value, at) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw new Error(`${at} must be an object`);
-    }
-    return value;
-}
-function proposalStanding(value) {
-    if (value !== "pending_review" &&
-        value !== "accepted" &&
-        value !== "applied" &&
-        value !== "rejected" &&
-        value !== "revision_requested" &&
-        value !== "needs_revision" &&
-        value !== "withdrawn") {
-        throw new Error(`proposal has unrecognized standing ${JSON.stringify(value)}`);
-    }
-    return value;
-}
-async function frontierWithin(repo, frontier) {
-    const resolved = await realpath(path.resolve(repo, frontier));
-    if (resolved !== repo && !resolved.startsWith(`${repo}${path.sep}`)) {
-        throw new Error("capability frontier resolves outside the selected source repository");
-    }
-    return resolved;
-}
-async function terminalProposalEvent(frontierRoot, proposalId) {
-    const directory = path.join(frontierRoot, ".vela", "events");
-    const entries = await readdir(directory, { withFileTypes: true });
-    if (entries.length > 1_000_000)
-        throw new Error("frontier event directory exceeds the supported audit bound");
-    const matches = [];
-    const decisionByKind = new Map([
-        ["review.accepted", "accepted"],
-        ["review.rejected", "rejected"],
-        ["review.revision_requested", "revision_requested"],
-        ["proposal.withdrawn", "withdrawn"],
-    ]);
-    for (const entry of entries) {
-        if (!entry.isFile() || !/^vev_[0-9a-f]{16}\.json$/u.test(entry.name))
-            continue;
-        const event = jsonObject(JSON.parse((await readBoundedRegularFile(path.join(directory, entry.name), 8 * 1024 * 1024)).toString("utf8")), `event ${entry.name}`);
-        const decision = typeof event.kind === "string" ? decisionByKind.get(event.kind) : undefined;
-        if (decision === undefined)
-            continue;
-        const target = jsonObject(event.target, `event ${entry.name}.target`);
-        if (target.type !== "proposal" || target.id !== proposalId)
-            continue;
-        const eventId = entry.name.slice(0, -".json".length);
-        if (event.id !== eventId || typeof event.signature !== "string" || event.signature.length === 0) {
-            throw new Error(`terminal proposal event ${entry.name} is not a signed canonical event file`);
-        }
-        const payload = jsonObject(event.payload, `event ${entry.name}.payload`);
-        if (payload.proposal_id !== proposalId) {
-            throw new Error(`terminal proposal event ${entry.name} payload targets another proposal`);
-        }
-        if (decision === "withdrawn") {
-            if (payload.schema !== "vela.proposal-withdrawal.v1") {
-                throw new Error(`withdrawal event ${entry.name} has the wrong payload schema`);
-            }
-        }
-        else if (payload.verdict !== decision) {
-            throw new Error(`review event ${entry.name} verdict disagrees with its kind`);
-        }
-        matches.push({ event_id: eventId, decision });
-    }
-    if (matches.length > 1)
-        throw new Error("proposal has conflicting terminal events");
-    return matches[0] ?? null;
-}
-function terminalDecisionMatchesStanding(decision, standing) {
-    return decision === "accepted"
-        ? standing === "accepted" || standing === "applied"
-        : decision === "revision_requested"
-            ? standing === "revision_requested" || standing === "needs_revision"
-            : decision === standing;
-}
-export async function withdrawProduct(options) {
-    if (options.reason.trim().length === 0)
-        throw new Error("withdrawal reason must not be empty");
-    const runner = options.runner ?? runCommand;
-    const source = await realpath(options.frontier);
-    const runFile = path.resolve(options.runFile);
-    const record = parseRunRecord(JSON.parse((await readBoundedRegularFile(runFile, 8 * 1024 * 1024)).toString("utf8")));
-    const capability = await loadWithdrawalCapability(record.landing.proposal_id, options.storeRoot);
-    if (capability.manifest.state !== "available" || !capability.secret_available) {
-        throw new Error("withdrawal capability is not available");
-    }
-    if (capability.manifest.receipt_root !== record.landing.receipt_root ||
-        canonicalJcs(capability.manifest.final_roots) !== canonicalJcs(record.final_roots)) {
-        throw new Error("withdrawal capability does not match the selected run");
-    }
-    const controlRoot = await mkdtemp(path.join(os.tmpdir(), "canopus-withdraw-"));
-    const controlHome = path.join(controlRoot, "home");
-    const clone = path.join(controlRoot, "candidate");
-    const replay = path.join(controlRoot, "replay");
-    await mkdir(path.join(controlHome, ".vela", "agents", safeActor(capability.manifest.actor)), {
-        recursive: true,
-        mode: 0o700,
-    });
-    try {
-        const sourceHead = await gitText(runner, source, controlHome, ["rev-parse", "--verify", "HEAD^{commit}"]);
-        const sourceStatus = await gitText(runner, source, controlHome, ["status", "--porcelain=v1", "--untracked-files=all"]);
-        if (sourceStatus !== "")
-            throw new Error("source frontier must be clean before withdrawal");
-        const client = new VelaClient({
-            binary: capability.manifest.vela.binary,
-            expectedVersion: capability.manifest.vela.version,
-            expectedSha256: capability.manifest.vela.sha256,
-            home: controlHome,
-            runner,
-        });
-        const strictBaseline = capability.manifest.strict_baseline;
-        const sourceInspection = await client.inspect(source, capability.manifest.frontier, strictBaseline);
-        const frontierRoot = await frontierWithin(source, capability.manifest.frontier);
-        const proposalPath = path.join(frontierRoot, ".vela", "proposals", `${record.landing.proposal_id}.json`);
-        const proposal = jsonObject(JSON.parse((await readBoundedRegularFile(proposalPath, 8 * 1024 * 1024)).toString("utf8")), "proposal");
-        if (proposal.id !== record.landing.proposal_id)
-            throw new Error("proposal file id disagrees with the run");
-        const standing = proposalStanding(proposal.status);
-        const terminalEvent = await terminalProposalEvent(frontierRoot, record.landing.proposal_id);
-        const stableHead = await gitText(runner, source, controlHome, ["rev-parse", "--verify", "HEAD^{commit}"]);
-        const stableStatus = await gitText(runner, source, controlHome, ["status", "--porcelain=v1", "--untracked-files=all"]);
-        if (stableHead !== sourceHead || stableStatus !== "") {
-            throw new Error("source frontier changed during proposal verification");
-        }
-        if (standing !== "pending_review") {
-            if (terminalEvent === null || !terminalDecisionMatchesStanding(terminalEvent.decision, standing)) {
-                throw new Error("terminal proposal standing is not backed by exactly one matching signed event");
-            }
-            await consumeWithdrawalCapability(record.landing.proposal_id, terminalEvent.decision === "withdrawn" ? "withdrawn" : "human_decision_observed", options.storeRoot);
-            return {
-                ok: true,
-                command: "withdraw",
-                proposal_id: record.landing.proposal_id,
-                terminal_event_id: terminalEvent.event_id,
-                state: terminalEvent.decision === "withdrawn" ? "already_withdrawn" : "human_decision_observed",
-                frontier_mutated: false,
-                capability_consumed: true,
-            };
-        }
-        if (terminalEvent !== null)
-            throw new Error("pending proposal already has a terminal event");
-        if (protocolDigest(proposal) !== capability.manifest.proposal_root) {
-            throw new Error("pending proposal bytes drifted from the retained withdrawal capability");
-        }
-        await gitText(runner, controlRoot, controlHome, ["clone", "--quiet", "--no-local", source, clone]);
-        const before = await client.inspect(clone, capability.manifest.frontier, strictBaseline);
-        if (canonicalJcs(before.roots) !== canonicalJcs(sourceInspection.roots)) {
-            throw new Error("disposable withdrawal clone does not match the selected source head");
-        }
-        await installWithdrawalCapabilitySecret(record.landing.proposal_id, path.join(controlHome, ".vela", "agents", safeActor(capability.manifest.actor), "private.key"), options.storeRoot);
-        const scientificRootBefore = await scientificProjectionRoot(path.resolve(clone, capability.manifest.frontier));
-        const withdrawal = await client.withdraw(clone, capability.manifest.frontier, record.landing.proposal_id, capability.manifest.actor, options.reason);
-        const after = await client.inspect(clone, capability.manifest.frontier, strictBaseline);
-        const scientificRootAfter = await scientificProjectionRoot(path.resolve(clone, capability.manifest.frontier));
-        if (after.roots.git_commit === before.roots.git_commit || after.roots.vela_event_log === before.roots.vela_event_log) {
-            throw new Error("withdrawal did not append and publish one event");
-        }
-        if (withdrawal.publication_commit !== after.roots.git_commit ||
-            withdrawal.state_root_before !== before.roots.vela_event_log ||
-            withdrawal.state_root_after !== after.roots.vela_event_log) {
-            throw new Error("withdrawal response does not bind the verified Git and event-log roots");
-        }
-        if (scientificRootAfter !== scientificRootBefore) {
-            throw new Error("withdrawal changed the accepted scientific projection");
-        }
-        const withdrawnFrontier = await frontierWithin(await realpath(clone), capability.manifest.frontier);
-        const withdrawnProposal = jsonObject(JSON.parse((await readBoundedRegularFile(path.join(withdrawnFrontier, ".vela", "proposals", `${record.landing.proposal_id}.json`), 8 * 1024 * 1024)).toString("utf8")), "withdrawn proposal");
-        const withdrawnEvent = await terminalProposalEvent(withdrawnFrontier, record.landing.proposal_id);
-        if (withdrawnProposal.status !== "withdrawn" ||
-            withdrawnEvent?.decision !== "withdrawn" ||
-            withdrawnEvent.event_id !== withdrawal.withdrawal_event_id) {
-            throw new Error("withdrawal output is not backed by the exact materialized terminal event");
-        }
-        await gitText(runner, controlRoot, controlHome, ["clone", "--quiet", "--no-local", clone, replay]);
-        const reproduced = await client.inspect(replay, capability.manifest.frontier, strictBaseline);
-        if (canonicalJcs(reproduced.roots) !== canonicalJcs(after.roots)) {
-            throw new Error("clean-clone withdrawal replay drifted");
-        }
-        const unchangedHead = await gitText(runner, source, controlHome, ["rev-parse", "--verify", "HEAD^{commit}"]);
-        const unchangedStatus = await gitText(runner, source, controlHome, ["status", "--porcelain=v1", "--untracked-files=all"]);
-        if (unchangedHead !== sourceHead || unchangedStatus !== "") {
-            throw new Error("source frontier changed during withdrawal");
-        }
-        await gitText(runner, source, controlHome, ["fetch", "--quiet", "--no-tags", clone, "HEAD"]);
-        await gitText(runner, source, controlHome, ["merge", "--ff-only", "--no-edit", "FETCH_HEAD"]);
-        const installed = await client.inspect(source, capability.manifest.frontier, strictBaseline);
-        if (canonicalJcs(installed.roots) !== canonicalJcs(after.roots)) {
-            throw new Error("fast-forwarded source does not match the verified withdrawal clone");
-        }
-        const installedStatus = await gitText(runner, source, controlHome, ["status", "--porcelain=v1", "--untracked-files=all"]);
-        if (installedStatus !== "")
-            throw new Error("fast-forwarded source is not clean");
-        await consumeWithdrawalCapability(record.landing.proposal_id, "withdrawn", options.storeRoot);
-        return {
-            ok: true,
-            command: "withdraw",
-            proposal_id: record.landing.proposal_id,
-            withdrawal_event_id: withdrawal.withdrawal_event_id,
-            roots: after.roots,
-            scientific_state_root_before: scientificRootBefore,
-            scientific_state_root_after: scientificRootAfter,
-            accepted_state_changed: false,
-            clean_clone_reproduced: true,
-            capability_consumed: true,
-        };
-    }
-    finally {
-        await rm(controlRoot, { recursive: true, force: true });
-    }
-}

package/dist/src/projection/diagnostic.d.ts

@@ -1,12 +0,0 @@
-import type { DiagnosticRunRecord } from "../run.js";
-export declare function parseDiagnosticRunRecord(value: unknown): DiagnosticRunRecord;
-export declare function projectDiagnosticRun(record: DiagnosticRunRecord): {
-    schema: "canopus.diagnostic-projection.v1";
-    authority: "read_only_projection";
-    run_id: string;
-    target: string;
-    candidate_digest: string;
-    verifier_status: "passed" | "failed" | "error";
-    landed: false;
-    clean_clone_reproduced: true;
-};

package/dist/src/projection/diagnostic.js

@@ -1,61 +0,0 @@
-import { arrayAt, enumAt, exactKeys, objectAt, relativePathAt, sha256At, stringAt, } from "../contracts/validation.js";
-function literal(value, expected, at) {
-    if (value !== expected)
-        throw new Error(`${at} must be ${String(expected)}`);
-    return expected;
-}
-export function parseDiagnosticRunRecord(value) {
-    const record = objectAt(value, "diagnostic run");
-    exactKeys(record, [
-        "schema", "run_id", "status", "mode", "authority", "external_gate_credit",
-        "mission", "candidate", "verifier", "landing", "reproduction", "budget",
-    ], [], "diagnostic run");
-    const mission = objectAt(record.mission, "diagnostic run.mission");
-    exactKeys(mission, ["id", "target", "digest", "starting_roots"], [], "diagnostic run.mission");
-    const candidate = objectAt(record.candidate, "diagnostic run.candidate");
-    exactKeys(candidate, ["digest", "status", "claim", "artifacts", "caveats"], [], "diagnostic run.candidate");
-    const verifier = objectAt(record.verifier, "diagnostic run.verifier");
-    exactKeys(verifier, ["status", "sandbox", "record"], [], "diagnostic run.verifier");
-    const reproduction = objectAt(record.reproduction, "diagnostic run.reproduction");
-    exactKeys(reproduction, ["matched", "roots", "verifier_status", "stdout_digest", "stderr_digest"], [], "diagnostic run.reproduction");
-    objectAt(mission.starting_roots, "diagnostic run.mission.starting_roots");
-    objectAt(reproduction.roots, "diagnostic run.reproduction.roots");
-    objectAt(record.budget, "diagnostic run.budget");
-    literal(record.schema, "canopus.diagnostic-run.v1", "diagnostic run.schema");
-    literal(record.status, "completed", "diagnostic run.status");
-    literal(record.mode, "no_land", "diagnostic run.mode");
-    literal(record.authority, "non_authoritative", "diagnostic run.authority");
-    literal(record.external_gate_credit, false, "diagnostic run.external_gate_credit");
-    literal(record.landing, null, "diagnostic run.landing");
-    stringAt(record.run_id, "diagnostic run.run_id", { min: 5, max: 128 });
-    stringAt(mission.id, "diagnostic run.mission.id", { min: 1, max: 134 });
-    stringAt(mission.target, "diagnostic run.mission.target", { min: 1, max: 256 });
-    sha256At(mission.digest, "diagnostic run.mission.digest");
-    sha256At(candidate.digest, "diagnostic run.candidate.digest");
-    enumAt(candidate.status, "diagnostic run.candidate.status", ["success", "null", "failed"]);
-    stringAt(candidate.claim, "diagnostic run.candidate.claim", { min: 1, max: 8192 });
-    arrayAt(candidate.artifacts, "diagnostic run.candidate.artifacts", { max: 10 }, (item, at) => {
-        const artifact = objectAt(item, at);
-        exactKeys(artifact, ["path", "kind", "digest", "bytes"], [], at);
-        relativePathAt(artifact.path, `${at}.path`);
-        stringAt(artifact.kind, `${at}.kind`, { min: 1, max: 128 });
-        sha256At(artifact.digest, `${at}.digest`);
-        return true;
-    });
-    arrayAt(candidate.caveats, "diagnostic run.candidate.caveats", { max: 10 }, (item, at) => stringAt(item, at, { min: 1, max: 4096 }));
-    enumAt(verifier.status, "diagnostic run.verifier.status", ["passed", "failed", "error"]);
-    literal(reproduction.matched, true, "diagnostic run.reproduction.matched");
-    return value;
-}
-export function projectDiagnosticRun(record) {
-    return {
-        schema: "canopus.diagnostic-projection.v1",
-        authority: "read_only_projection",
-        run_id: record.run_id,
-        target: record.mission.target,
-        candidate_digest: record.candidate.digest,
-        verifier_status: record.verifier.status,
-        landed: false,
-        clean_clone_reproduced: true,
-    };
-}

package/dist/src/projection/public-run.d.ts

@@ -1,59 +0,0 @@
-import type { Mission } from "../contracts/mission.js";
-import type { RunRecord } from "./run.js";
-export declare const PUBLIC_RUN_SCHEMA: "canopus.public-run.v1";
-export interface PublicRunProjection {
-    schema: typeof PUBLIC_RUN_SCHEMA;
-    authority: "read_only_projection";
-    run_id: string;
-    mission: {
-        id: string;
-        target: string;
-        digest: string;
-        registration_kind: "profile" | "mission_bundle";
-        registration_name: string;
-        registration_root: string;
-        target_packet_root: string;
-        model: string;
-    };
-    activity: {
-        worker: "success";
-        verifier: "pass";
-        clean_clone_replay: "matched";
-    };
-    claim: string;
-    caveats: string[];
-    artifact_roots: string[];
-    verifier_root: string;
-    receipt_root: string;
-    policy: {
-        route: "defer";
-        proposal_id: string;
-        accepted_state_delta: 0;
-    };
-    usage: {
-        research_elapsed_ms: number;
-        research_processes: number;
-        observed_tokens: number;
-        attempts: number;
-    };
-    source: {
-        repository: string;
-        commit: string;
-        event_log_root: string;
-        snapshot_root: string;
-    };
-    final: {
-        commit: string;
-        event_log_root: string;
-        snapshot_root: string;
-    };
-    reproduction: {
-        commands: string[];
-    };
-    nonclaims: string[];
-}
-export declare function projectPublicRun(options: {
-    record: RunRecord;
-    mission: Mission;
-    repository: string;
-}): PublicRunProjection;