@vela-science/canopus 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -2,6 +2,86 @@
 
 ## Unreleased
 
+## 0.8.0 - 2026-07-28
+
+- Release the nonmutating Run, explicit Submission, and framework-neutral
+  evaluation boundary from the Vela product monorepo.
+- Depend on the shared authority-free `@vela-science/protocol` package instead
+  of copying canonical JSON and validation primitives.
+- Drive exact Vela and Codex composition from one toolchain lock rather than
+  copied source, test, documentation, and workflow versions.
+- Preserve and reproduce the corrected Erdős Submission and scoped Verification
+  through the completed human Decision loop.
+
+- Advance Canopus `0.8.0-rc.8` after real campaign replay exposed a retained
+  predecessor-epoch compatibility defect. Current readers now validate and
+  replay immutable Run and Mission bytes through bounded in-memory projections;
+  the retained records and their exact roots remain unchanged.
+- Advance Canopus `0.8.0-rc.7` for the Vela `0.940.7` current Target Index
+  writer repair.
+- Keep retained Run and Submission source identities unchanged while requiring
+  registration through the exact repaired Vela release.
+
+- Advance Canopus `0.8.0-rc.6` for the Vela `0.940.6` retained-Artifact
+  repair. Current registration may reuse exact retained Artifact bytes and
+  canonical paths, while path substitution remains fail-closed.
+- Refuse a duplicate verifier-passing mission before output creation or model
+  execution. Historical schemas remain replayable but do not weaken the
+  current Mission v1 coverage gate.
+- Export immutable predecessor-root Run v2 records without rewriting their
+  bytes, and allow their authenticated Submission bundles to register only
+  against an exact source commit or its current descendant.
+- Add a rooted, source-only framework-neutral evaluation contract. Optional
+  engine experiments and metadata-only trace export remain outside the npm
+  payload and cannot change Vela Standing or authority.
+- Advance Canopus `0.8.0-rc.5` after real Erdős dogfood exposed stale
+  post-verifier wording at the Submission waist. New workers keep verifier
+  status out of the Claim, verifier-pending caveats are normalized after the
+  separate check, and export fails closed on stale verifier language or control
+  bytes. An explicit Claim-plus-scope-limit correction can author a new signed
+  producer Submission while preserving the immutable Run unchanged.
+- Consume Vela's current `produce` lane directly when selecting the first
+  canonical offer. Remove the retired `attack`-lane and `task.packet_ref`
+  compatibility path that blocked real `0.940.5` Frontiers before a model call.
+- Advance Canopus `0.8.0-rc.4` to the attested Vela `0.940.5` release. The
+  macOS and Linux archives and binaries are pinned by exact SHA-256;
+  the product contract is unchanged.
+- Begin Canopus `0.8.0-rc.1` as an exact candidate composition with attested
+  Vela `0.930.0-rc.12`. The older `0.7.0`/`0.915.1` composition remains
+  available only from immutable release history; it is no longer an active
+  operating path.
+- Advance the sole active Erdős 1056 k=15 profile to the next non-overlapping
+  range `10429201..10429400` before any model call. The closed profile root is
+  `sha256:2034d6b6a49ba1345518340ba74dfd75931035788924c53e629fb0260304ece1`;
+  its static Linux ARM64 and x86-64 verifier roots are
+  `sha256:6abe6125b5ed7cfeb256a1d86f3a66c6e7000a5542417d9dd04b2e5f9d3ffe81`
+  and
+  `sha256:ce73ca27d54a2ed31607a6d279d85ed36f28c2a830891b5d5d27b9cf50f0fcb4`.
+  The completed `10429001..10429200` run and pending Proposal remain
+  reproducible from immutable Git and Frontier history but are removed from
+  default discovery and the package payload.
+- Preserve the first candidate artifact for `10429001..10429200` as a
+  verifier-rejected bounded failure, then retain the exact successful repair
+  separately from the new active range. No prior numeric result is supplied
+  to the new worker.
+- Allow a verifier-passing review-only Run to export Submission v1 without an
+  optional `vela.execution-binding.v1`. The Submission still binds the exact
+  verifier capsule in its verification requirement and can only enter the
+  ordinary pending-review path; policy eligibility continues to require the
+  full execution binding and result contract.
+- Pin Vela rc.12 after the repository-authority landing regression proved that
+  repository authorization must not occupy Receipt v1's scientific
+  `acceptance.policyRef`, signed agent observations require canonical
+  whole-second timestamps, and repository-authority landing must materialize
+  derived views inside the same recoverable transaction without adding those
+  views to the signed scientific delta. The released macOS binary is
+  `sha256:2e6c4f5aadf0d3e6e7102d71f8fa0a46d31567cc847c25914706183248167471`.
+- Raise only the bounded Vela subprocess ceiling from two to ten minutes after
+  a real Erdős landing reached its frozen verifier and atomic authority
+  transaction but was killed during large-frontier materialization at exactly
+  120 seconds. Model, verifier, workspace, and mission budgets remain
+  independently bounded.
+
 ## 0.7.0 - 2026-07-25
 
 - Retire long-lived proposal-withdrawal capabilities. Successful runs now

package/README.md

@@ -1,191 +1,113 @@
 <p align="center">
-  <img src="docs/assets/canopus-readme-hero.jpg" width="960" alt="Canopus carries one bounded target through an isolated Codex worker and separate verifier into a Receipt pending human review." />
+  <img src="docs/assets/canopus-readme-hero.jpg" width="960" alt="One bounded Canopus Run moves from a rooted target through an isolated worker and verifier to an optional Vela Submission." />
 </p>
 
 <p align="center"><strong>Bounded research for Codex.</strong></p>
 
 <p align="center">
-  Give Codex one finite mission. Verify the artifact independently. Keep humans in authority.
+  Run one exact mission. Reproduce the artifact. Submit only when you choose.
 </p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@vela-science/canopus"><img alt="npm" src="https://img.shields.io/npm/v/@vela-science/canopus?style=flat-square&color=C9A664&labelColor=081224" /></a>
-  <a href="https://github.com/vela-science/vela-research-harness/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/vela-science/vela-research-harness/ci.yml?branch=main&style=flat-square&label=build&labelColor=081224" /></a>
+  <a href="https://github.com/vela-science/vela/actions/workflows/product-ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/vela-science/vela/product-ci.yml?branch=main&style=flat-square&label=build&labelColor=081224" /></a>
   <a href="LICENSE-APACHE"><img alt="Apache-2.0 OR MIT" src="https://img.shields.io/badge/license-Apache--2.0%20OR%20MIT-4F8F8B?style=flat-square&labelColor=081224" /></a>
 </p>
 
-<p align="center">
-  <a href="https://app.vela.space/frontiers/sidon-sets/runs/run_f68e4cfc-e5c7-4c73-86cb-d79807c47ec4">Retained Sidon run</a> ·
-  <a href="https://github.com/vela-science/vela-research-harness/blob/v0.6.5/BUILD_WEEK.md">Build Week archive</a> ·
-  <a href="docs/MISSIONS.md">Missions</a> ·
-  <a href="docs/RUN_RECORD.md">Run records</a> ·
-  <a href="https://github.com/vela-science/vela">Vela</a>
-</p>
-
-Canopus is a removable producer over released Vela and Git. It gives Codex one
-exact work offer, freezes the result, runs a separate verifier, and can land a
-Receipt through `vela land`.
-
-It cannot sign, accept a proposal, or make a scientific decision. Removing
-Canopus does not change accepted state or Vela replay.
-
-## Where Canopus fits
-
-The Vela product story has five steps:
-
-1. **Produce:** any suitable workbench may produce bounded work; Canopus is the
-   optional isolated producer for Codex.
-2. **Preserve:** the canonical frontier Git repository preserves the exact
-   source, artifacts, and history.
-3. **Check:** Vela replays the frontier and frozen verifiers fail closed.
-4. **Decide:** signed policy or one protected human decision determines
-   scientific standing.
-5. **Reuse:** the read-only Observatory and other replaceable readers help
-   people inspect, reproduce, and continue the work.
-
-Canopus owns **Produce** only. It reuses Git for preservation and Vela for
-checking, landing, replay, and authority; it does not become a second state
-store, verifier authority, or scientific workbench platform.
-
-## Inspect one retained example
-
-**20 seconds — inspect the real result:** open the anonymous
-[retained Sidon run](https://app.vela.space/frontiers/sidon-sets/runs/run_f68e4cfc-e5c7-4c73-86cb-d79807c47ec4)
-and follow
-Mission → GPT-5.6 → artifact → verifier → Receipt → Defer.
+Canopus is a removable research runner over Vela and Git. It gives Codex one
+rooted target, freezes the produced bytes, runs a separate verifier, and
+reproduces the result from a clean clone.
 
-**90 seconds — inspect the shipped product:**
+A Run is nonmutating. It does not create a Proposal, Verification Record,
+Decision, Event, or scientific Standing. A successful Run may be exported as an
+authenticated `vela.submission.v1`; only the separate `submit` command registers
+that Submission as pending review.
 
-```sh
-bunx @vela-science/canopus@0.7.0 --version
-bunx @vela-science/canopus@0.7.0 profile validate sidon-a24-at-least-7194-gpt56-v3
-```
-
-**Retained historical result — reproduce without rebuilding Canopus:**
+## The loop
 
-This Sidon artifact remains bound to the Vela version recorded when it landed.
-Install the provenance-checked prebuilt
-[Vela 0.912.0 release](https://github.com/vela-science/vela/releases/tag/v0.912.0)
-for this replay only, then:
-
-```sh
-git clone https://github.com/vela-science/sidon-frontier.git
-cd sidon-frontier
-git checkout 825657d7e87618c0aa6fc9af7e3182e05f324750
-vela reproduce artifacts/sidon-a24-gpt56-7194.witness.json
-node verification/verify-sidon-a24-7194.mjs \
-  artifacts/sidon-a24-gpt56-7194.witness.json
+```text
+doctor → run → show → replay → export → submit
 ```
 
-The first command selects the pending artifact explicitly and runs Vela's
-frozen Sidon verifier. The second is an independent base-3 implementation that
-also rejects a bound collision injection. Neither command accepts the proposal.
-
-For new missions, use Vela `0.915.1`, the version composed with Canopus
-`0.7.0` and enforced by `canopus doctor`.
-
-## Quickstart
-
-Run the provenance-backed public package with Bun:
-
 ```sh
-bunx @vela-science/canopus@0.7.0 --version
-```
-
-Inspect a clean frontier, then run its first ranked producer offer:
-
-```sh
-bunx @vela-science/canopus@0.7.0 doctor /path/to/frontier
-bunx @vela-science/canopus@0.7.0 run /path/to/frontier --first
-bunx @vela-science/canopus@0.7.0 inspect latest
-bunx @vela-science/canopus@0.7.0 replay /path/to/run.json
-```
-
-Export a completed Defer run without publishing or mutating anything:
-
-```sh
-canopus publish-run /path/to/run.json --mission /path/to/mission.json \
-  --repository https://github.com/vela-science/<frontier> \
-  --output ./public-evidence
+bun install --frozen-lockfile
+bun run build
+
+canopus doctor /path/to/frontier
+canopus run /path/to/frontier --first
+canopus show latest
+canopus replay /path/to/run.json
+canopus export /path/to/run.json --output /path/to/submission-bundle
+canopus submit /path/to/submission-bundle /path/to/frontier
 ```
 
-The new directory contains `public-run.json`, `root-manifest.json`, exact
-pending-state commands, and a read-only Observatory import descriptor. Run v1
-separates worker observations, verifier observations, and caveats that remain
-standing after verification; historical run v0 records remain inspectable.
+- `doctor` binds the exact frontier, target, Vela, Codex, profile, packet, and
+  verifier identities.
+- `run` executes in disposable workspaces and leaves the frontier unchanged.
+- `show` inspects current and historical run records.
+- `replay` reruns the frozen verifier without a model call.
+- `export` creates a signed portable Submission and retains no producer key.
+  If a retained Run from an older worker contract still says verification is
+  pending after its verifier passed, export fails closed until the producer
+  supplies one corrected bounded Claim and explicit scope limit.
+- `submit` explicitly registers that Submission through Vela. The expected
+  result is `pending_review` with accepted-event delta zero.
 
-Use `--no-land` for a diagnostic mission that cannot change the source frontier:
+`inspect`, `--no-land`, Receipt authoring, and automatic landing are not current
+interfaces.
 
-```sh
-bunx @vela-science/canopus@0.7.0 run /path/to/frontier --first --no-land
-```
+## Authority boundary
 
-`doctor` binds the exact Vela, Codex, Git, frontier, packet, profile, and verifier
-roots. `run` refuses dirty frontiers, drifted roots, missing capsules, and
-unregistered targets. It never silently skips the first ranked offer.
+| Component | Owns | Does not own |
+| --- | --- | --- |
+| Codex worker | One bounded attempt inside an isolated workspace | Host files, human keys, verifier, network tools |
+| Frozen verifier | A scoped mechanical result over exact bytes | Scientific acceptance |
+| Canopus | Run evidence, replay, Submission export | Verification Records, Decisions, Events, Standing |
+| Vela | Registration, review, decisions, replay, Standing | Model execution |
 
-## Custody and authority
+The worker uses macOS Seatbelt or Codex Bubblewrap on Linux/WSL2. The verifier
+runs separately with network and writes denied. Canopus never reads a human key
+or interprets verifier success as acceptance.
 
-| Surface | Can do | Cannot do |
-| --- | --- | --- |
-| Codex worker | Use tools inside one bounded workspace | Reach the network, host home, human keys, or verifier |
-| Verifier | Read frozen candidate bytes and declared inputs | Write, use the network, or make an authority decision |
-| Canopus | Preserve evidence, replay, and land a Receipt | Sign, accept, reject, retain producer keys, or call verifier success acceptance |
+## Exact product contract
 
-The worker uses macOS Seatbelt or Codex's Bubblewrap sandbox on Linux and WSL2.
-The verifier runs in a separate pinned container with network and writes denied.
+Current source is Canopus `0.8.0`. Its exact Vela, Codex, and platform
+composition is declared once in `toolchain.lock.json`; compatible public
+contracts are declared separately in `compatibility.json`. Historical releases
+remain available for exact replay; they are not current writers.
 
-## Everyday commands
+Mission v1 and profile v2 remain the advanced portable interfaces:
 
 ```sh
-canopus doctor [frontier]
-canopus run [frontier] [--first | --target <id>] [--profile <name>] [--no-land]
-canopus inspect [run.json | latest]
-canopus replay <run.json>
+canopus mission prepare ...
+canopus mission validate bundle/mission.json
+canopus profile list
+canopus profile show <name>
+canopus profile validate <name>
+canopus profile pack <name> --output <directory>
 ```
 
-Advanced profile commands are documented in [Missions](docs/MISSIONS.md).
-Installed profiles are closed,
-content-addressed contracts that bind the target, packet, objective, artifact
-types, worker, verifier, replay command, budgets, and landing ceiling.
-
-Producer identities are ephemeral. After a successful landing and clean-clone
-reproduction, Canopus destroys the isolated Vela home instead of retaining a
-proposal-scoped private key. A proposal may remain pending until Vela policy or
-a human reviewer decides it; Canopus does not need a second control channel.
-
-## Retained Build Week evidence
-
-Inspect the retained Mission → worker → artifact → verifier → Receipt → Defer
-chain on the [exact Sidon run](https://app.vela.space/frontiers/sidon-sets/runs/run_f68e4cfc-e5c7-4c73-86cb-d79807c47ec4).
-Exact commits, run roots, audit evidence, and nonclaims live in
-the retained
-[`v0.6.5` Build Week archive](https://github.com/vela-science/vela-research-harness/blob/v0.6.5/BUILD_WEEK.md).
-
 ## Development
 
-Requires Bun 1.3.12, Vela 0.915.1, Codex CLI 0.145.0, and Docker. The built
-package also runs under Node 22 or 24; unsupported odd-numbered Node releases
-are rejected rather than silently treated as supported.
-
 ```sh
 bun install --frozen-lockfile
 bun run check
 bun run pack:check
 ```
 
+The installed package has one runtime dependency:
+`@vela-science/protocol`, Vela's authority-free public TypeScript contract.
+
 ## Documentation
 
 - [Missions and profiles](docs/MISSIONS.md)
-- [Run records and publication](docs/RUN_RECORD.md)
-- [Historical release evidence](https://github.com/vela-science/vela-research-harness/blob/v0.7.0/docs/RELEASES.md)
-- [Why the harness stays removable](docs/adr/0001-harness-boundary-and-name.md)
+- [Run, export, and submit records](docs/RUN_RECORD.md)
+- [Evaluation gates](docs/EVALUATION.md)
+- [Nonmutating Runs and explicit Submission](docs/adr/0010-nonmutating-runs-and-explicit-submission.md)
+- [Why Canopus stays removable](docs/adr/0001-harness-boundary-and-name.md)
+- [Historical Build Week evidence](https://github.com/vela-science/vela-research-harness/blob/v0.6.5/BUILD_WEEK.md)
 
 ## License
 
-Apache-2.0 OR MIT, at your option. Canopus is a replaceable producer; Vela
-remains the protocol and authority boundary.
-
-The published CLI has no runtime npm dependencies. See
-[Third-party components](THIRD_PARTY.md) for the bundled verifier and external
-toolchain boundary.
+Apache-2.0 OR MIT, at your option. Vela remains the protocol and authority
+boundary.

package/compatibility.json

@@ -0,0 +1,25 @@
+{
+  "schema": "canopus.compatibility.v1",
+  "repository_epoch": "current",
+  "required_schemas": [
+    "vela.repository.v1",
+    "vela.status.v1",
+    "vela.offer.v1",
+    "vela.submission.v1",
+    "vela.verification-record.v1"
+  ],
+  "required_commands": [
+    "status",
+    "next",
+    "start",
+    "submit",
+    "verification import",
+    "check",
+    "reproduce"
+  ],
+  "forbidden_authority_capabilities": [
+    "review accept",
+    "review reject",
+    "repository authority"
+  ]
+}

package/dist/src/{receipt/map.d.ts → candidate/finalize.d.ts}

@@ -1,10 +1,10 @@
-import { type FrozenArtifactLocation } from "../artifact/freeze.js";
+import type { FrozenArtifactLocation } from "../artifact/freeze.js";
 import type { BudgetSnapshot } from "../budget/enforce.js";
 import { type Candidate } from "../contracts/candidate.js";
 import type { Mission } from "../contracts/mission.js";
 import type { EngineResult } from "../engines/engine.js";
 import type { VerifierOutcome } from "../verifier/run.js";
-import type { AuthoredReceiptInput } from "../vela/cli.js";
+export declare function finalizeWorkerCaveat(value: string): string;
 export declare function finalizeCandidate(options: {
     mission: Mission;
     engine: EngineResult;
@@ -16,10 +16,3 @@ export declare function finalizeCandidate(options: {
         kind: string;
     }>;
 }): Candidate;
-export declare function mapCandidateToReceipt(mission: Mission, candidate: Candidate, verifier: VerifierOutcome, work?: string): AuthoredReceiptInput;
-export declare function installFrozenArtifacts(options: {
-    landingRepo: string;
-    frontier: string;
-    frozen: readonly FrozenArtifactLocation[];
-    maxBytes: number;
-}): Promise<string[]>;

package/dist/src/candidate/finalize.js

@@ -0,0 +1,71 @@
+import { parseCandidate } from "../contracts/candidate.js";
+function unique(values) {
+    return [...new Set(values)];
+}
+export function finalizeWorkerCaveat(value) {
+    if (/verif(?:y|ication|ier).*(?:pending|has not run|not (?:been )?(?:performed|executed|run))|pending.*verif(?:y|ication|ier)/iu.test(value)) {
+        return "The worker handed off without verifier authority; Canopus subsequently recorded the separate verifier outcome.";
+    }
+    return value;
+}
+export function finalizeCandidate(options) {
+    const draftPaths = options.engine.draft.artifacts
+        .map((artifact) => `${artifact.path}:${artifact.kind}`)
+        .sort();
+    const supporting = new Map((options.supportingArtifacts ?? []).map((entry) => [entry.path, entry.kind]));
+    const frozenPaths = options.frozen
+        .filter((entry) => !supporting.has(entry.artifact.path))
+        .map((entry) => `${entry.artifact.path}:${entry.artifact.kind}`)
+        .sort();
+    if (JSON.stringify(draftPaths) !== JSON.stringify(frozenPaths)) {
+        throw new Error("frozen artifacts do not exactly match the engine declaration");
+    }
+    for (const [path, kind] of supporting) {
+        const entry = options.frozen.find((candidate) => candidate.artifact.path === path);
+        if (entry === undefined || entry.artifact.kind !== kind) {
+            throw new Error(`supporting artifact ${path} is absent or misclassified`);
+        }
+    }
+    const verifierFailed = options.engine.draft.status === "success" && options.verifier.status !== "passed";
+    const status = verifierFailed ? "failed" : options.engine.draft.status;
+    const exactPositiveClaim = options.mission.schema === "canopus.mission.v1" &&
+        options.mission.result_contract !== undefined &&
+        options.engine.draft.status === "success" &&
+        options.verifier.status === "passed"
+        ? options.mission.result_contract.claim_exact
+        : undefined;
+    const claim = verifierFailed
+        ? `The engine proposed a candidate, but the declared verifier did not pass: ${options.engine.draft.claim}`
+        : exactPositiveClaim ?? options.engine.draft.claim;
+    const caveats = unique([
+        ...options.engine.draft.caveats.map(finalizeWorkerCaveat),
+        `Declared verifier outcome: ${options.verifier.status}.`,
+        "Canopus produced this record; it is not a Verification Record or Decision.",
+    ]);
+    const base = {
+        schema: "canopus.candidate.v0",
+        mission_id: options.mission.id,
+        status,
+        claim,
+        artifacts: options.frozen.map((entry) => entry.artifact),
+        observations: options.engine.draft.observations,
+        tests: [options.verifier.record],
+        costs: {
+            wall_time_ms: options.budget.research_elapsed_ms,
+            attempt: options.budget.attempts,
+            input_tokens: options.engine.usage.input_tokens,
+            output_tokens: options.engine.usage.output_tokens,
+        },
+        caveats,
+        engine: options.engine.engine,
+    };
+    return parseCandidate(options.mission.parent_candidate === undefined
+        ? base
+        : {
+            ...base,
+            repair: {
+                parent_candidate: options.mission.parent_candidate,
+                reason: options.mission.repair_reason ?? "Bounded repair of the named candidate.",
+            },
+        });
+}