@vela-science/canopus 0.6.5 → 0.8.0

package/dist/src/contracts/validation.js

@@ -1,95 +1 @@
-import path from "node:path";
-export class ContractError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "ContractError";
-    }
-}
-export function objectAt(value, at) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw new ContractError(`${at} must be an object`);
-    }
-    return value;
-}
-export function exactKeys(value, required, optional, at) {
-    const allowed = new Set([...required, ...optional]);
-    for (const key of Object.keys(value)) {
-        if (!allowed.has(key)) {
-            throw new ContractError(`${at}.${key} is not allowed`);
-        }
-    }
-    for (const key of required) {
-        if (!(key in value)) {
-            throw new ContractError(`${at}.${key} is required`);
-        }
-    }
-}
-export function stringAt(value, at, options) {
-    if (typeof value !== "string") {
-        throw new ContractError(`${at} must be a string`);
-    }
-    const min = options.min ?? 0;
-    if (value.length < min || value.length > options.max) {
-        throw new ContractError(`${at} length must be ${min}..${options.max}`);
-    }
-    if (options.pattern !== undefined && !options.pattern.test(value)) {
-        throw new ContractError(`${at} has an invalid format`);
-    }
-    return value;
-}
-export function integerAt(value, at, min, max) {
-    if (!Number.isInteger(value) || typeof value !== "number") {
-        throw new ContractError(`${at} must be an integer`);
-    }
-    if (value < min || value > max) {
-        throw new ContractError(`${at} must be ${min}..${max}`);
-    }
-    return value;
-}
-export function enumAt(value, at, allowed) {
-    if (typeof value !== "string" || !allowed.includes(value)) {
-        throw new ContractError(`${at} must be one of ${allowed.join(", ")}`);
-    }
-    return value;
-}
-export function arrayAt(value, at, options, parse) {
-    if (!Array.isArray(value)) {
-        throw new ContractError(`${at} must be an array`);
-    }
-    const min = options.min ?? 0;
-    if (value.length < min || value.length > options.max) {
-        throw new ContractError(`${at} length must be ${min}..${options.max}`);
-    }
-    const parsed = value.map((item, index) => parse(item, `${at}[${index}]`));
-    if (options.unique === true) {
-        const seen = new Set(parsed.map((item) => JSON.stringify(item)));
-        if (seen.size !== parsed.length) {
-            throw new ContractError(`${at} must not contain duplicates`);
-        }
-    }
-    return parsed;
-}
-export const GIT_OBJECT_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
-export const SHA256_RE = /^sha256:[0-9a-f]{64}$/u;
-export const MISSION_ID_RE = /^mission_[a-z0-9][a-z0-9._-]{0,126}$/u;
-export const AGENT_RE = /^agent:[a-z0-9][a-z0-9._-]{0,62}$/u;
-export function relativePathAt(value, at) {
-    const parsed = stringAt(value, at, { min: 1, max: 1024 });
-    if (parsed.includes("\0") || path.isAbsolute(parsed) || parsed.includes("\\")) {
-        throw new ContractError(`${at} must be a portable relative path`);
-    }
-    const normalized = path.posix.normalize(parsed);
-    if (normalized === "." ||
-        normalized === ".." ||
-        normalized.startsWith("../") ||
-        normalized !== parsed) {
-        throw new ContractError(`${at} must be normalized and remain below its root`);
-    }
-    return parsed;
-}
-export function sha256At(value, at) {
-    return stringAt(value, at, { max: 71, pattern: SHA256_RE });
-}
-export function gitObjectAt(value, at) {
-    return stringAt(value, at, { max: 64, pattern: GIT_OBJECT_RE });
-}
+export { AGENT_RE, ContractError, GIT_OBJECT_RE, MISSION_ID_RE, SHA256_RE, arrayAt, enumAt, exactKeys, gitObjectAt, integerAt, objectAt, relativePathAt, sha256At, stringAt, } from "@vela-science/protocol";

package/dist/src/engines/codex-tools-native.js

@@ -70,7 +70,7 @@ function prompt(mission) {
         `The exact Vela work claim and roots were validated by the harness. The bound target packet is available at ${mission.target_packet.path}; inspect only the fields needed for this bounded computation.`,
         "If the packet has a repair_context object, read that object first. It is a root-bound intervention record and producer strategy, not a verifier or authority decision.",
         "Keep tool output narrow. Do not print or ingest the whole target packet.",
-        "Worker status reports producer completion, not verifier or scientific standing. Return status success when you produced all artifact bytes required by the output contract, even though you cannot run the separate verifier. State that verification remains pending; Canopus will freeze the bytes and run the verifier after you exit.",
+        "Worker status reports producer completion, not verifier or scientific standing. Return status success when you produced all artifact bytes required by the output contract, even though you cannot run the separate verifier. Keep the Claim limited to the bounded result and do not put verifier status in it. State in a caveat that verification remains pending; Canopus will freeze the bytes and run the verifier after you exit.",
         "Return null only when the bounded work produced no candidate. Return failed only when you could not produce a contract-complete candidate or observed disqualifying evidence. Never turn a bounded negative search into universal nonexistence, verifier failure into success, or Git publication into scientific acceptance.",
         "Return only the supplied engine-output JSON shape. Artifact bytes must be UTF-8 at mission.allowed_paths. Inline small artifacts. For a large declared artifact, content may be the empty string only when the complete bytes exist at that exact path inside the current workspace; Canopus will bound, scan, and freeze those bytes before workspace cleanup.",
         ...execution,
@@ -350,7 +350,7 @@ export class CodexToolsNativeEngine {
                 sourceAuth: path.join(this.#options.authHome, "auth.json"),
                 runtimeAuth: path.join(runtimeCodexHome, "auth.json"),
                 inaccessibleInput: path.join(context.paths.input, mission.target_packet.path),
-                unrelatedFile: path.join(context.paths.landing, ".git", "HEAD"),
+                unrelatedFile: path.join(context.paths.frontier, ".git", "HEAD"),
                 canary,
                 outsideWrite: path.join(context.paths.work, "outside-write"),
                 timeoutMs: context.budget.remainingTimeMs(),

package/dist/src/index.d.ts

@@ -1,34 +1,5 @@
-export * from "./contracts/candidate.js";
-export * from "./contracts/mission.js";
-export * from "./contracts/validation.js";
-export * from "./budget/enforce.js";
-export * from "./evidence/manifests.js";
-export * from "./artifact/freeze.js";
-export * from "./activity/events.js";
-export * from "./activity/store.js";
-export * from "./candidate/validate.js";
-export * from "./util/canonical.js";
-export * from "./projection/public-run.js";
-export * from "./projection/publication.js";
-export * from "./util/command.js";
-export * from "./util/files.js";
-export * from "./roles.js";
-export * from "./receipt/map.js";
-export * from "./repair/plan.js";
-export * from "./projection/run.js";
-export * from "./projection/diagnostic.js";
-export * from "./product/doctor.js";
-export * from "./product/profile.js";
-export * from "./product/profile-bundle.js";
-export * from "./product/replay.js";
-export * from "./product/run.js";
-export * from "./run.js";
-export * from "./engines/engine.js";
-export * from "./engines/fake.js";
-export * from "./engines/codex-events.js";
-export * from "./engines/codex-tool-free.js";
-export * from "./engines/codex-exec.js";
-export * from "./vela/cli.js";
-export * from "./vela/types.js";
-export * from "./workspace/prepare.js";
-export * from "./verifier/run.js";
+export { FAILURE_PROJECTION_SCHEMA, FAILURE_RECORD_SCHEMA, parseFailureRecord, projectFailure, } from "./projection/failure.js";
+export type { FailureProjection, FailureRecord } from "./projection/failure.js";
+export { parseCurrentRunRecord, projectCurrentRun, } from "./projection/current-run.js";
+export { exportSubmission, verifySubmission } from "./product/submission.js";
+export { submitBundle } from "./product/submit.js";

package/dist/src/index.js

@@ -1,34 +1,4 @@
-export * from "./contracts/candidate.js";
-export * from "./contracts/mission.js";
-export * from "./contracts/validation.js";
-export * from "./budget/enforce.js";
-export * from "./evidence/manifests.js";
-export * from "./artifact/freeze.js";
-export * from "./activity/events.js";
-export * from "./activity/store.js";
-export * from "./candidate/validate.js";
-export * from "./util/canonical.js";
-export * from "./projection/public-run.js";
-export * from "./projection/publication.js";
-export * from "./util/command.js";
-export * from "./util/files.js";
-export * from "./roles.js";
-export * from "./receipt/map.js";
-export * from "./repair/plan.js";
-export * from "./projection/run.js";
-export * from "./projection/diagnostic.js";
-export * from "./product/doctor.js";
-export * from "./product/profile.js";
-export * from "./product/profile-bundle.js";
-export * from "./product/replay.js";
-export * from "./product/run.js";
-export * from "./run.js";
-export * from "./engines/engine.js";
-export * from "./engines/fake.js";
-export * from "./engines/codex-events.js";
-export * from "./engines/codex-tool-free.js";
-export * from "./engines/codex-exec.js";
-export * from "./vela/cli.js";
-export * from "./vela/types.js";
-export * from "./workspace/prepare.js";
-export * from "./verifier/run.js";
+export { FAILURE_PROJECTION_SCHEMA, FAILURE_RECORD_SCHEMA, parseFailureRecord, projectFailure, } from "./projection/failure.js";
+export { parseCurrentRunRecord, projectCurrentRun, } from "./projection/current-run.js";
+export { exportSubmission, verifySubmission } from "./product/submission.js";
+export { submitBundle } from "./product/submit.js";

package/dist/src/mission/prepare.d.ts

@@ -28,6 +28,15 @@ export interface PreparedMission {
     missionPath: string;
     manifestPath: string;
 }
+export declare function parseVelaVersionOutput(versionText: string): string;
 export declare function assertVerifierWorkingDirectory(sourceRepo: string, declaredCwd: string): Promise<void>;
-export declare function validateMissionBundle(mission: MissionV1, bundleRoot: string): Promise<void>;
+export declare function validateMissionBundle(mission: MissionV1, bundleRoot: string, expectedMissionRoot?: string): Promise<void>;
+export declare function selectedProducerTarget(offer: Record<string, unknown>, requested?: string): Record<string, unknown>;
+export declare function packetFromTarget(target: Record<string, unknown>, expected?: {
+    target: string;
+    schema: string;
+}): {
+    path: string;
+    sha256: string;
+};
 export declare function prepareMission(options: PrepareMissionOptions): Promise<PreparedMission>;

package/dist/src/mission/prepare.js

@@ -9,6 +9,12 @@ import { canonicalJson, contentDigest, sha256Bytes } from "../util/canonical.js"
 import { isolatedEnvironment, runCommand } from "../util/command.js";
 import { MAX_EXECUTABLE_BYTES, readBoundedRegularFile, sha256RegularFile } from "../util/files.js";
 import { VelaClient } from "../vela/cli.js";
+export function parseVelaVersionOutput(versionText) {
+    const match = /^vela (0\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?)$/u.exec(versionText);
+    if (match?.[1] === undefined)
+        throw new Error("Vela returned an invalid version");
+    return match[1];
+}
 export async function assertVerifierWorkingDirectory(sourceRepo, declaredCwd) {
     const root = await realpath(sourceRepo);
     const relative = relativePathAt(declaredCwd, "mission.verifier.cwd");
@@ -25,7 +31,7 @@ export async function assertVerifierWorkingDirectory(sourceRepo, declaredCwd) {
         throw new Error(`mission verifier cwd is not a real directory below the sealed source checkout: ${relative}`);
     }
 }
-export async function validateMissionBundle(mission, bundleRoot) {
+export async function validateMissionBundle(mission, bundleRoot, expectedMissionRoot = contentDigest(mission)) {
     const root = await realpath(bundleRoot);
     const capsule = await sourceFile(root, mission.verifier.capsule_path, "verifier capsule");
     await access(capsule, constants.X_OK);
@@ -59,7 +65,7 @@ export async function validateMissionBundle(mission, bundleRoot) {
     const manifest = objectAt(manifestValue, "mission bundle manifest");
     if (manifest.schema !== "canopus.mission-bundle.v1" ||
         manifest.authority !== "non_authoritative" ||
-        manifest.mission_sha256 !== contentDigest(mission)) {
+        manifest.mission_sha256 !== expectedMissionRoot) {
         throw new Error("mission bundle manifest does not bind the mission");
     }
 }
@@ -111,45 +117,43 @@ function boundedObjective(value) {
     }
     return objective;
 }
-function selectedAttack(offer, requested) {
+export function selectedProducerTarget(offer, requested) {
     if (!Array.isArray(offer.targets))
         throw new Error("vela next omitted targets");
-    const attacks = [];
+    const producers = [];
     for (const [index, raw] of offer.targets.entries()) {
         const target = objectAt(raw, `vela next.targets[${index}]`);
-        if (target.lane === "attack")
-            attacks.push(target);
+        if (target.lane === "produce")
+            producers.push(target);
     }
-    if (attacks.length === 0) {
-        throw new Error("vela next returned no non-review attack target in the first 128 offers");
+    if (producers.length === 0) {
+        throw new Error("vela next returned no producer target in the first 128 offers");
     }
     if (requested === undefined)
-        return attacks[0];
-    const matches = attacks.filter((target) => (target.target_id ?? target.id) === requested);
+        return producers[0];
+    const matches = producers.filter((target) => (target.target_id ?? target.id) === requested);
     if (matches.length !== 1) {
-        throw new Error(`explicit mission target ${requested} must appear exactly once among the first 128 attack offers; ` +
+        throw new Error(`explicit mission target ${requested} must appear exactly once among the first 128 producer offers; ` +
             `observed ${matches.length}`);
     }
     return matches[0];
 }
-function packetFromTarget(target, expected) {
-    const packet = target.packet === undefined
-        ? objectAt(objectAt(target.task, "vela next attack.task").packet_ref, "vela next attack.task.packet_ref")
-        : objectAt(target.packet, "vela next attack.packet");
+export function packetFromTarget(target, expected) {
+    const packet = objectAt(target.packet, "vela next producer packet");
     const targetId = target.target_id ?? target.id;
     if (expected !== undefined && targetId !== expected.target) {
-        throw new Error(`selected attack target ${String(targetId)} does not match profile target ${expected.target}`);
+        throw new Error(`selected producer target ${String(targetId)} does not match profile target ${expected.target}`);
     }
-    const schema = stringAt(packet.schema, "vela next attack.packet.schema", { min: 1, max: 128 });
+    const schema = stringAt(packet.schema, "vela next producer packet.schema", { min: 1, max: 128 });
     if (expected !== undefined && schema !== expected.schema) {
         throw new Error(`selected packet schema ${schema} does not match profile schema ${expected.schema}`);
     }
     if (expected === undefined && schema !== "erdos-frontier.problem-work.v1") {
-        throw new Error("selected attack target has no registered exact problem packet schema");
+        throw new Error("selected producer target has no registered exact problem packet schema");
     }
     return {
-        path: relativePathAt(packet.path, "vela next attack.packet.path"),
-        sha256: sha256At(packet.sha256, "vela next attack.packet.sha256"),
+        path: relativePathAt(packet.path, "vela next producer packet.path"),
+        sha256: sha256At(packet.sha256, "vela next producer packet.sha256"),
     };
 }
 async function imageId(runner, dockerBinary, image, cwd, home) {
@@ -190,10 +194,7 @@ export async function prepareMission(options) {
         const velaBinary = await realpath(options.velaBinary);
         const velaSha256 = await sha256RegularFile(velaBinary, MAX_EXECUTABLE_BYTES);
         const versionText = await commandText(runner, [velaBinary, "--version"], sourceRepo, runtimeHome);
-        const versionMatch = /^vela (0\.[0-9]+\.[0-9]+)$/u.exec(versionText);
-        if (versionMatch?.[1] === undefined)
-            throw new Error("Vela returned an invalid version");
-        const velaVersion = versionMatch[1];
+        const velaVersion = parseVelaVersionOutput(versionText);
         const vela = new VelaClient({
             binary: velaBinary,
             expectedVersion: velaVersion,
@@ -201,14 +202,13 @@ export async function prepareMission(options) {
             home: path.join(runtimeHome, "vela"),
             runner,
         });
-        const strictBaseline = await vela.observeStrictBaseline(sourceRepo, frontier);
-        const inspection = await vela.inspect(sourceRepo, frontier, strictBaseline);
-        const offer = await vela.offer(sourceRepo, frontier, inspection.roots, strictBaseline, 128);
+        const inspection = await vela.inspect(sourceRepo, frontier);
+        const offer = await vela.offer(sourceRepo, frontier, inspection.roots, 128);
         const requestedTarget = raw.target === undefined || raw.target === "auto"
             ? undefined
             : stringAt(raw.target, "mission.target", { min: 1, max: 256 });
-        const target = selectedAttack(offer.value, requestedTarget);
-        const targetId = stringAt(target.target_id ?? target.id, "vela next attack.target_id", { min: 1, max: 256 });
+        const target = selectedProducerTarget(offer.value, requestedTarget);
+        const targetId = stringAt(target.target_id ?? target.id, "vela next producer target_id", { min: 1, max: 256 });
         const packet = packetFromTarget(target, options.targetPacket);
         const packetSource = await sourceFile(sourceRepo, packet.path, "target packet");
         const packetBytes = await readBoundedRegularFile(packetSource, 64 * 1024 * 1024);
@@ -249,7 +249,6 @@ export async function prepareMission(options) {
             objective: boundedObjective(raw.objective),
             roots: inspection.roots,
             target_packet: packet,
-            strict_baseline: strictBaseline,
             worker: {
                 ...workerDraft,
                 kind: "codex_tools_native",

package/dist/src/product/coverage.d.ts

@@ -0,0 +1,17 @@
+export interface CoveredMission {
+    mission_id: string;
+    coverage_key?: string;
+    run_id: string;
+    run_file: string;
+}
+export declare function findCoveredMission(options: {
+    missionId: string;
+    coverageKey?: string | null;
+    frontier: string;
+    runsRoot?: string;
+}): Promise<CoveredMission | null>;
+export declare function assertMissionNotCovered(options: {
+    draft: unknown;
+    frontier: string;
+    runsRoot?: string;
+}): Promise<void>;

package/dist/src/product/coverage.js

@@ -0,0 +1,137 @@
+import { lstat, readdir } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { objectAt, stringAt } from "../contracts/validation.js";
+import { parseRetainedRunRecord } from "../projection/retained-run.js";
+import { contentDigest } from "../util/canonical.js";
+import { readBoundedRegularFile } from "../util/files.js";
+const MAX_RUN_DIRECTORIES = 4096;
+function consistentMatch(value, expression) {
+    const matches = [...value.matchAll(expression)];
+    if (matches.length === 0)
+        return null;
+    const expected = matches[0].slice(1);
+    return matches.every((match) => match.slice(1).length === expected.length &&
+        match.slice(1).every((entry, index) => entry === expected[index]))
+        ? matches[0]
+        : null;
+}
+function erdosCoverageKey(value, context) {
+    const target = typeof value.target === "string" ? value.target : "";
+    const objective = typeof value.objective === "string" ? value.objective : "";
+    const targetMatch = target.match(/^erdos:(\d+)$/u);
+    if (targetMatch === null)
+        return null;
+    const problemMatch = consistentMatch(objective, /Erdős\s+(\d+)/gu);
+    const kMatch = consistentMatch(objective, /\bk=(\d+)\b/gu);
+    const rangeMatch = consistentMatch(objective, /\binclusive range\s+(\d+)\.\.(\d+)\b/gu);
+    if (problemMatch === null || kMatch === null || rangeMatch === null) {
+        throw new Error(`${context} does not expose one exact Erdős problem, k, and inclusive range`);
+    }
+    if (problemMatch[1] !== targetMatch[1]) {
+        throw new Error(`${context} target and objective disagree on the Erdős problem`);
+    }
+    const start = BigInt(rangeMatch[1]);
+    const end = BigInt(rangeMatch[2]);
+    if (start > end)
+        throw new Error(`${context} inclusive range is reversed`);
+    return `erdos:${targetMatch[1]}:k=${kMatch[1]}:${start}..${end}`;
+}
+async function retainedMissionForRun(runFile, expected) {
+    const missionFile = path.join(path.dirname(runFile), "..", "mission", "mission.json");
+    const mission = objectAt(JSON.parse((await readBoundedRegularFile(missionFile, 8 * 1024 * 1024)).toString("utf8")), `retained Mission ${missionFile}`);
+    if (contentDigest(mission) !== expected.digest) {
+        throw new Error(`retained Run ${runFile} and Mission ${missionFile} roots disagree`);
+    }
+    if (stringAt(mission.id, `retained Mission ${missionFile}.id`, { min: 1, max: 134 }) !==
+        expected.id ||
+        stringAt(mission.target, `retained Mission ${missionFile}.target`, { min: 1, max: 256 }) !==
+            expected.target) {
+        throw new Error(`retained Run ${runFile} and Mission ${missionFile} identities disagree`);
+    }
+    return mission;
+}
+async function regularFileIfPresent(candidate) {
+    try {
+        const metadata = await lstat(candidate);
+        return metadata.isFile() && !metadata.isSymbolicLink() ? candidate : null;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+async function currentRunFiles(root) {
+    let entries;
+    try {
+        entries = await readdir(root, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    if (entries.length > MAX_RUN_DIRECTORIES) {
+        throw new Error(`retained Run coverage index exceeds ${MAX_RUN_DIRECTORIES} entries; ` +
+            "archive obsolete generated output before running another mission");
+    }
+    const files = [];
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+        if (!entry.isDirectory() || entry.isSymbolicLink())
+            continue;
+        const runRoot = path.join(root, entry.name);
+        const candidates = [
+            path.join(runRoot, "run.json"),
+            path.join(runRoot, "run", "run.json"),
+        ];
+        for (const candidate of candidates) {
+            const runFile = await regularFileIfPresent(candidate);
+            if (runFile !== null)
+                files.push(runFile);
+        }
+    }
+    return files;
+}
+export async function findCoveredMission(options) {
+    const root = options.runsRoot ??
+        path.join(os.homedir(), ".canopus", "runs", path.basename(path.resolve(options.frontier)));
+    for (const runFile of await currentRunFiles(root)) {
+        const value = JSON.parse((await readBoundedRegularFile(runFile, 8 * 1024 * 1024)).toString("utf8"));
+        const object = objectAt(value, `retained Run ${runFile}`);
+        if (object.schema !== "canopus.run.v2")
+            continue;
+        const run = parseRetainedRunRecord(value).record;
+        const mission = await retainedMissionForRun(runFile, run.mission);
+        const coverageKey = erdosCoverageKey(mission, `retained Run ${runFile} Mission`);
+        if (run.mission.id === options.missionId ||
+            (options.coverageKey !== null &&
+                options.coverageKey !== undefined &&
+                coverageKey === options.coverageKey)) {
+            return {
+                mission_id: run.mission.id,
+                ...(coverageKey === null ? {} : { coverage_key: coverageKey }),
+                run_id: run.run_id,
+                run_file: runFile,
+            };
+        }
+    }
+    return null;
+}
+export async function assertMissionNotCovered(options) {
+    const draft = objectAt(options.draft, "profile draft");
+    const missionId = stringAt(draft.id, "profile draft.id", { min: 1, max: 134 });
+    const coverageKey = erdosCoverageKey(draft, "profile draft");
+    const covered = await findCoveredMission({
+        missionId,
+        coverageKey,
+        frontier: options.frontier,
+        ...(options.runsRoot === undefined ? {} : { runsRoot: options.runsRoot }),
+    });
+    if (covered !== null) {
+        throw new Error(`mission ${covered.mission_id} is already covered by verifier-passing Run ` +
+            `${covered.run_id} at ${covered.run_file}` +
+            `${covered.coverage_key === undefined ? "" : ` (${covered.coverage_key})`}; ` +
+            "freeze the first uncovered bounded range instead of repeating it");
+    }
+}

package/dist/src/product/doctor.d.ts

@@ -9,8 +9,7 @@ export interface ProductDoctorResult {
         path: string;
         git_commit: string;
         git_tree: string;
-        event_log_root: string;
-        scientific_state_root: string;
+        repository_root: string;
         clean: boolean;
         strict_blockers: number;
     };

package/dist/src/product/doctor.js

@@ -16,7 +16,7 @@ async function jsonCommand(options) {
         timeoutMs: 120_000,
         maxOutputBytes: 16 * 1024 * 1024,
     });
-    if (result.exitCode !== 0) {
+    if (!(options.acceptedExitCodes ?? [0]).includes(result.exitCode)) {
         throw new Error(`${options.label} failed: stdout_sha256=${sha256Bytes(result.stdout)}; ` +
             `stderr_sha256=${sha256Bytes(result.stderr)}`);
     }
@@ -124,7 +124,16 @@ export async function doctorProduct(options) {
             throw new Error(`Canopus ${CANOPUS_VERSION} requires vela ${SUPPORTED_VELA_VERSION}, observed ${vela.version}`);
         }
         const [status, offer, gitStatus] = await Promise.all([
-            jsonCommand({ runner, argv: [vela.binary, "status", ".", "--json"], cwd: frontier, home: runtime, label: "vela status" }),
+            jsonCommand({
+                runner,
+                argv: [vela.binary, "status", ".", "--json"],
+                cwd: frontier,
+                home: runtime,
+                label: "vela status",
+                // Vela deliberately returns domain failure when strict debt exists,
+                // while still emitting the complete read-only compact projection.
+                acceptedExitCodes: [0, 1],
+            }),
             jsonCommand({ runner, argv: [vela.binary, "next", ".", "--limit", "128", "--json"], cwd: frontier, home: runtime, label: "vela next" }),
             runner({ argv: [git.binary, "status", "--porcelain=v1", "--untracked-files=all"], cwd: frontier, env: isolatedEnvironment(runtime), timeoutMs: 30_000, maxOutputBytes: 8 * 1024 * 1024 }),
         ]);
@@ -133,14 +142,28 @@ export async function doctorProduct(options) {
         const clean = gitStatus.stdout.length === 0;
         if (!clean)
             throw new Error("frontier checkout must be clean before Canopus runs");
-        if (status.schema !== "vela.status.v1" || offer.schema !== "vela.offer.v1") {
-            throw new Error("frontier did not return the Vela 0.9 compact contracts");
+        if (status.schema !== "vela.status.v1" ||
+            status.ok !== true ||
+            status.command !== "status" ||
+            offer.schema !== "vela.offer.v1" ||
+            offer.ok !== true ||
+            offer.command !== "next") {
+            throw new Error("frontier did not return the current Vela compact contracts");
         }
         const profile = await resolveProductProfile(offer, options.profileName, options.requestedTarget);
         const selected = selectProductOffer(offer, profile, options.requestedTarget);
         const roots = objectAt(status.roots, "vela status.roots");
         const gitState = objectAt(status.git, "vela status.git");
         const integrity = objectAt(status.integrity, "vela status.integrity");
+        const repositoryRoot = sha256At(roots.repository, "vela status.roots.repository");
+        if (integrity.replay !== "verified" ||
+            integrity.strict !== "pass" ||
+            nonnegative(integrity.blocker_count, "vela status.integrity.blocker_count") !== 0) {
+            throw new Error("frontier must replay and pass strict verification before Canopus can run");
+        }
+        if (sha256At(offer.repository_root, "vela next.repository_root") !== repositoryRoot) {
+            throw new Error("vela status and next disagree on the current repository root");
+        }
         const staging = path.join(runtime, "capsule-build");
         await mkdir(staging, { mode: 0o700 });
         const capsule = await stageProfileCapsule({ profile, stagingRoot: staging });
@@ -155,8 +178,7 @@ export async function doctorProduct(options) {
                         path: frontier,
                         git_commit: stringAt(gitState.commit, "vela status.git.commit", { min: 40, max: 64 }),
                         git_tree: stringAt(gitState.tree, "vela status.git.tree", { min: 40, max: 64 }),
-                        event_log_root: sha256At(roots.event_log, "vela status.roots.event_log"),
-                        scientific_state_root: sha256At(roots.scientific_state_root, "vela status.roots.scientific_state_root"),
+                        repository_root: repositoryRoot,
                         clean,
                         strict_blockers: nonnegative(integrity.blocker_count, "vela status.integrity.blocker_count"),
                     },
@@ -250,8 +272,7 @@ export async function doctorProduct(options) {
                     path: frontier,
                     git_commit: stringAt(gitState.commit, "vela status.git.commit", { min: 40, max: 64 }),
                     git_tree: stringAt(gitState.tree, "vela status.git.tree", { min: 40, max: 64 }),
-                    event_log_root: sha256At(roots.event_log, "vela status.roots.event_log"),
-                    scientific_state_root: sha256At(roots.scientific_state_root, "vela status.roots.scientific_state_root"),
+                    repository_root: repositoryRoot,
                     clean,
                     strict_blockers: nonnegative(integrity.blocker_count, "vela status.integrity.blocker_count"),
                 },

package/dist/src/product/profile.js

@@ -1,4 +1,4 @@
-import { constants } from "node:fs";
+import { constants, existsSync } from "node:fs";
 import { access, chmod, copyFile, mkdir, realpath } from "node:fs/promises";
 import path from "node:path";
 import process from "node:process";
@@ -11,7 +11,13 @@ export const PROFILE_V1_SCHEMA = "canopus.profile.v1";
 export const PROFILE_SCHEMA = "canopus.profile.v2";
 export const SUPPORTED_PRODUCT_PLATFORMS = ["darwin-arm64", "linux-x86_64"];
 export function productPackageRoot() {
-    return fileURLToPath(new URL("../../../", import.meta.url));
+    const root = [
+        fileURLToPath(new URL("../../", import.meta.url)),
+        fileURLToPath(new URL("../../../", import.meta.url)),
+    ].find((candidate) => existsSync(path.join(candidate, "package.json")));
+    if (root === undefined)
+        throw new Error("Canopus package root is missing");
+    return root;
 }
 export function currentProductPlatform() {
     if (process.platform === "darwin" && process.arch === "arm64")