@vela-science/canopus 0.7.0 → 0.8.0

package/dist/src/engines/codex-exec.js

@@ -1,136 +0,0 @@
-import path from "node:path";
-import { parseCandidateDraft, assertDraftArtifactsAllowed } from "../candidate/validate.js";
-import { roleInstruction } from "../roles.js";
-import { canonicalJson, contentDigest, sha256Bytes } from "../util/canonical.js";
-import { isolatedEnvironment, runCommand, } from "../util/command.js";
-import { MAX_EXECUTABLE_BYTES, readBoundedRegularFile, sha256RegularFile } from "../util/files.js";
-import { parseCodexEvents, summarizeCodexFailure } from "./codex-events.js";
-import { prepareIsolatedCodexHome, removeIsolatedCodexHome } from "./codex-home.js";
-import { CODEX_TOOL_FEATURES, sandboxedToolFreeCodexExecArgv, } from "./codex-tool-free.js";
-function prompt(mission, briefing) {
-    return [
-        "Execute one bounded Canopus research mission.",
-        roleInstruction(mission.role),
-        "This is a tool-free synthesis stage. You cannot inspect the host or run commands.",
-        "Use only the mission and the exact Vela work briefing supplied below.",
-        "Return artifact bytes inline as UTF-8 content. The trusted harness materializes and verifies them later.",
-        "Do not request tools, network access, external messages, Vela signing, human keys, or accepted-state writes.",
-        "Worker status reports producer completion, not verifier or scientific standing. Return status success when you produced all artifact bytes required by the output contract, while stating that separate verification remains pending.",
-        "Return null only when the bounded work produced no candidate, and failed only when you could not produce a contract-complete candidate or observed disqualifying evidence. Do not turn verifier failure into a success claim.",
-        "Return only the supplied engine-output JSON shape.",
-        "Mission:",
-        canonicalJson(mission),
-        "Vela work briefing:",
-        canonicalJson(briefing),
-    ].join("\n");
-}
-export class CodexExecEngine {
-    name = "codex-exec";
-    #options;
-    #runner;
-    constructor(options) {
-        this.#options = options;
-        this.#runner = options.runner ?? runCommand;
-    }
-    async #version(cwd, home, timeoutMs) {
-        const result = await this.#runner({
-            argv: [this.#options.binary, "--version"],
-            cwd,
-            env: isolatedEnvironment(home),
-            timeoutMs,
-            maxOutputBytes: 4096,
-        });
-        const version = result.stdout.toString("utf8").trim();
-        if (result.exitCode !== 0 || result.stderr.length !== 0 || version !== this.#options.expectedVersion) {
-            throw new Error(`expected Codex ${this.#options.expectedVersion}, observed ${JSON.stringify(version)}`);
-        }
-        return version;
-    }
-    async run(context) {
-        context.budget.beginAttempt();
-        const binaryDigest = await sha256RegularFile(this.#options.binary, MAX_EXECUTABLE_BYTES);
-        if (binaryDigest !== this.#options.expectedSha256) {
-            throw new Error(`Codex binary digest mismatch: expected ${this.#options.expectedSha256}, observed ${binaryDigest}`);
-        }
-        context.budget.beginProcess();
-        const finalPath = path.join(context.paths.work, ".canopus-final.json");
-        const version = await this.#version(context.paths.work, context.paths.home, context.budget.remainingTimeMs());
-        context.budget.beginProcess();
-        const runtimeCodexHome = await prepareIsolatedCodexHome(this.#options.authHome, context.paths.home);
-        try {
-            const environment = {
-                ...isolatedEnvironment(context.paths.home),
-                CODEX_HOME: runtimeCodexHome,
-                NO_COLOR: "1",
-            };
-            const argv = await sandboxedToolFreeCodexExecArgv({
-                binary: this.#options.binary,
-                model: this.#options.model,
-                outputSchema: this.#options.outputSchema,
-                finalPath,
-                cwd: context.paths.work,
-                authHome: runtimeCodexHome,
-            });
-            const started = performance.now();
-            const workerPrompt = prompt(context.mission, context.briefing);
-            context.budget.addPrompt(Buffer.byteLength(workerPrompt));
-            const result = await this.#runner({
-                argv,
-                cwd: context.paths.work,
-                env: environment,
-                timeoutMs: context.budget.remainingTimeMs(),
-                maxOutputBytes: context.budget.remainingOutputBytes(),
-                stdin: workerPrompt,
-            });
-            context.budget.addOutput(result.stdout.length + result.stderr.length);
-            if (result.exitCode !== 0) {
-                throw new Error(`codex exec exited ${result.exitCode}: ` +
-                    `${summarizeCodexFailure(result.stdout.toString("utf8"))}; ` +
-                    `stdout_sha256=${sha256Bytes(result.stdout)}; stderr_sha256=${sha256Bytes(result.stderr)}`);
-            }
-            const events = parseCodexEvents(result.stdout.toString("utf8"));
-            if (events.actionTypes.length !== 0) {
-                throw new Error(`tool-free Codex worker emitted actions: ${events.actionTypes.join(",")}`);
-            }
-            context.budget.addTokens(events.usage.input_tokens + events.usage.output_tokens);
-            const finalBytes = await readBoundedRegularFile(finalPath, 1_048_576);
-            context.budget.addOutput(finalBytes.length);
-            let raw;
-            try {
-                raw = JSON.parse(finalBytes.toString("utf8"));
-            }
-            catch (error) {
-                throw new Error(`Codex final response is not JSON: ${String(error)}`);
-            }
-            const draft = parseCandidateDraft(raw);
-            assertDraftArtifactsAllowed(draft, context.mission.allowed_paths);
-            return {
-                draft,
-                engine: {
-                    name: this.name,
-                    version,
-                    binary_sha256: binaryDigest,
-                    model: this.#options.model,
-                    configuration_sha256: contentDigest({
-                        binary_sha256: binaryDigest,
-                        codex_version: version,
-                        disabled_features: CODEX_TOOL_FEATURES,
-                        model: this.#options.model,
-                        output_schema_sha256: sha256Bytes(await readBoundedRegularFile(this.#options.outputSchema, 1_048_576)),
-                        outer_sandbox: "macos_seatbelt_bounded_reads",
-                        product_sandbox: "read-only",
-                    }),
-                },
-                usage: events.usage,
-                wallTimeMs: Math.max(0, Math.round(performance.now() - started)),
-                eventTypes: events.eventTypes,
-                actionTypes: events.actionTypes,
-                eventsDigest: sha256Bytes(result.stdout),
-                stderrDigest: sha256Bytes(result.stderr),
-            };
-        }
-        finally {
-            await removeIsolatedCodexHome(runtimeCodexHome);
-        }
-    }
-}

package/dist/src/engines/codex-tool-free.d.ts

@@ -1,26 +0,0 @@
-export declare const CODEX_TOOL_FEATURES: readonly ["apply_patch_freeform", "apply_patch_streaming_events", "apps", "artifact", "browser_use", "browser_use_external", "computer_use", "enable_mcp_apps", "goals", "hooks", "image_generation", "in_app_browser", "memories", "multi_agent", "plugin_sharing", "remote_plugin", "shell_snapshot", "shell_tool", "tool_suggest", "unified_exec", "workspace_dependencies"];
-export interface ToolFreeCodexArgs {
-    binary: string;
-    model: string;
-    outputSchema: string;
-    finalPath: string;
-    cwd: string;
-    reasoningEffort?: string;
-}
-export interface SandboxedToolFreeCodexArgs extends ToolFreeCodexArgs {
-    authHome: string;
-}
-/**
- * Wrap Codex itself in a host read boundary. Codex 0.139 always registers
- * view_image even when every feature-backed tool is disabled, so this outer
- * sandbox is the control that makes an arbitrary host image unreadable.
- */
-export declare function sandboxedToolFreeCodexExecArgv(options: SandboxedToolFreeCodexArgs): Promise<string[]>;
-/**
- * Build the complete, pinned Codex lane used for untrusted synthesis.
- *
- * Read-only sandboxing alone still permits host reads. This lane registers no
- * shell, patch, browser, app, MCP, memory, or computer-use surface at all.
- * The only accepted product is the final response constrained by outputSchema.
- */
-export declare function toolFreeCodexExecArgv(options: ToolFreeCodexArgs): string[];

package/dist/src/engines/codex-tool-free.js

@@ -1,213 +0,0 @@
-import { access, realpath } from "node:fs/promises";
-import path from "node:path";
-export const CODEX_TOOL_FEATURES = [
-    "apply_patch_freeform",
-    "apply_patch_streaming_events",
-    "apps",
-    "artifact",
-    "browser_use",
-    "browser_use_external",
-    "computer_use",
-    "enable_mcp_apps",
-    "goals",
-    "hooks",
-    "image_generation",
-    "in_app_browser",
-    "memories",
-    "multi_agent",
-    "plugin_sharing",
-    "remote_plugin",
-    "shell_snapshot",
-    "shell_tool",
-    "tool_suggest",
-    "unified_exec",
-    "workspace_dependencies",
-];
-function sbpl(value) {
-    return value.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
-}
-function metadataLiterals(paths) {
-    const values = new Set(["/"]);
-    for (const value of paths) {
-        for (let current = value; current !== "/"; current = path.dirname(current)) {
-            values.add(current);
-        }
-    }
-    return [...values]
-        .sort()
-        .map((value) => `(literal "${sbpl(value)}")`)
-        .join(" ");
-}
-async function optionalRealpath(candidate) {
-    try {
-        await access(candidate);
-        return await realpath(candidate);
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Wrap Codex itself in a host read boundary. Codex 0.139 always registers
- * view_image even when every feature-backed tool is disabled, so this outer
- * sandbox is the control that makes an arbitrary host image unreadable.
- */
-export async function sandboxedToolFreeCodexExecArgv(options) {
-    if (process.platform !== "darwin") {
-        throw new Error("Canopus v0 requires the macOS outer Codex sandbox");
-    }
-    const lexical = {
-        binary: path.resolve(options.binary),
-        cwd: path.resolve(options.cwd),
-        outputSchema: path.resolve(options.outputSchema),
-        finalParent: path.resolve(path.dirname(options.finalPath)),
-        authHome: path.resolve(options.authHome),
-        authFile: path.resolve(options.authHome, "auth.json"),
-        modelCatalog: path.resolve(options.authHome, "models_cache.json"),
-    };
-    const managedRequirements = [
-        "/etc/codex/requirements.toml",
-        "/private/etc/codex/requirements.toml",
-    ];
-    // These are public operating-system inputs used by the macOS resolver and
-    // network stack. Keep the outer boundary file-specific: Codex does not need
-    // the user's preferences, keychain, or arbitrary /etc contents.
-    const networkRuntimeFiles = [
-        "/Library/Preferences/com.apple.networkd.plist",
-        "/etc/hosts",
-        "/etc/protocols",
-        "/etc/resolv.conf",
-        "/etc/services",
-        "/private/etc/hosts",
-        "/private/etc/protocols",
-        "/private/etc/resolv.conf",
-        "/private/etc/services",
-        "/private/var/run/resolv.conf",
-        "/var/run/resolv.conf",
-    ];
-    const [binary, cwd, outputSchema, finalParent, authHome, authFile, modelCatalog] = await Promise.all([
-        realpath(lexical.binary),
-        realpath(lexical.cwd),
-        realpath(lexical.outputSchema),
-        realpath(lexical.finalParent),
-        realpath(lexical.authHome),
-        optionalRealpath(lexical.authFile),
-        optionalRealpath(lexical.modelCatalog),
-    ]);
-    if (authFile === undefined) {
-        throw new Error("Codex auth home has no readable auth.json");
-    }
-    const finalPath = path.join(finalParent, path.basename(options.finalPath));
-    const inner = toolFreeCodexExecArgv({
-        ...options,
-        binary,
-        cwd,
-        outputSchema,
-        finalPath,
-    });
-    const readableFiles = [
-        binary,
-        lexical.binary,
-        outputSchema,
-        lexical.outputSchema,
-        authFile,
-        authHome,
-        lexical.authFile,
-        lexical.authHome,
-        modelCatalog,
-        ...networkRuntimeFiles,
-        ...(modelCatalog === undefined ? [] : [lexical.modelCatalog]),
-    ]
-        .filter((item) => item !== undefined)
-        .filter((item, index, values) => values.indexOf(item) === index)
-        .map((item) => `(literal "${sbpl(item)}")`)
-        .join(" ");
-    const metadata = metadataLiterals([
-        binary,
-        cwd,
-        outputSchema,
-        finalPath,
-        authFile,
-        lexical.binary,
-        lexical.cwd,
-        lexical.outputSchema,
-        lexical.finalParent,
-        lexical.authFile,
-        ...managedRequirements,
-        ...networkRuntimeFiles,
-        ...(modelCatalog === undefined ? [] : [modelCatalog]),
-    ]);
-    const profile = [
-        "(version 1)",
-        "(deny default)",
-        '(import "dyld-support.sb")',
-        "(deny file-link file-clone)",
-        // Native Codex creates runtime threads after entering Seatbelt. macOS
-        // classifies that operation under process-fork; process-exec remains
-        // restricted to the checksum-pinned Codex binary below.
-        "(allow process-fork)",
-        "(allow process-info* (target same-sandbox))",
-        "(allow signal (target same-sandbox))",
-        `(allow file-read-metadata ${metadata})`,
-        `(allow process-exec (literal "${sbpl(binary)}"))`,
-        `(allow file-map-executable (literal "${sbpl(binary)}"))`,
-        '(allow sysctl-read (sysctl-name "hw.activecpu") (sysctl-name "hw.logicalcpu") (sysctl-name "hw.machine") (sysctl-name "hw.model") (sysctl-name "hw.ncpu") (sysctl-name "hw.pagesize") (sysctl-name "hw.pagesize_compat") (sysctl-name "kern.argmax") (sysctl-name "kern.hostname") (sysctl-name "kern.osproductversion") (sysctl-name "kern.osrelease") (sysctl-name "kern.ostype") (sysctl-name "kern.osversion") (sysctl-name "kern.usrstack64") (sysctl-name "kern.version") (sysctl-name-regex #"^net.routetable"))',
-        // This is the finite service set required by native Codex startup plus the
-        // DNS/TLS services in Codex's own macOS network policy. No wildcard Mach
-        // lookup or user application service is admitted.
-        '(allow mach-lookup (global-name "com.apple.SecurityServer") (global-name "com.apple.SystemConfiguration.DNSConfiguration") (global-name "com.apple.SystemConfiguration.configd") (global-name "com.apple.bsd.dirhelper") (global-name "com.apple.cfprefsd.agent") (local-name "com.apple.cfprefsd.agent") (global-name "com.apple.logd") (global-name "com.apple.networkd") (global-name "com.apple.ocspd") (global-name "com.apple.system.notification_center") (global-name "com.apple.system.opendirectoryd.libinfo") (global-name "com.apple.system.opendirectoryd.membership") (global-name "com.apple.trustd") (global-name "com.apple.trustd.agent"))',
-        '(allow ipc-posix-shm-read* (ipc-posix-name "apple.shm.notification_center") (ipc-posix-name-prefix "apple.cfprefs."))',
-        '(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))',
-        '(allow system-socket (socket-domain AF_UNIX))',
-        '(allow file-read* (subpath "/Library/Apple") (subpath "/System") (subpath "/usr/lib") (subpath "/usr/share") (subpath "/private/etc/ssl") (subpath "/private/var/db/timezone") (literal "/dev/null") (literal "/dev/urandom"))',
-        `(allow file-read* file-test-existence (subpath "${sbpl(cwd)}") (subpath "${sbpl(lexical.cwd)}") (subpath "${sbpl(authHome)}") (subpath "${sbpl(lexical.authHome)}") ${readableFiles})`,
-        `(allow file-write* (subpath "${sbpl(authHome)}") (subpath "${sbpl(lexical.authHome)}") (literal "${sbpl(finalPath)}") (literal "/dev/null"))`,
-        // Chromium's macOS network profile isolates the resolver socket from
-        // ordinary IP traffic. This keeps AF_UNIX open only for mDNSResponder,
-        // while permitting the model request over TCP/UDP.
-        '(allow network-outbound (control-name "com.apple.netsrc") (literal "/private/var/run/mDNSResponder") (remote tcp) (remote udp))',
-    ].join(" ");
-    return ["/usr/bin/sandbox-exec", "-p", profile, "--", ...inner];
-}
-/**
- * Build the complete, pinned Codex lane used for untrusted synthesis.
- *
- * Read-only sandboxing alone still permits host reads. This lane registers no
- * shell, patch, browser, app, MCP, memory, or computer-use surface at all.
- * The only accepted product is the final response constrained by outputSchema.
- */
-export function toolFreeCodexExecArgv(options) {
-    return [
-        options.binary,
-        "exec",
-        "--ephemeral",
-        "--skip-git-repo-check",
-        "--ignore-user-config",
-        "--ignore-rules",
-        "--strict-config",
-        "--sandbox",
-        "read-only",
-        "--model",
-        options.model,
-        "--output-schema",
-        options.outputSchema,
-        "--output-last-message",
-        options.finalPath,
-        "--json",
-        "--color",
-        "never",
-        "--cd",
-        options.cwd,
-        "--config",
-        "shell_environment_policy.inherit=none",
-        "--config",
-        "approval_policy=\"never\"",
-        "--config",
-        "web_search=\"disabled\"",
-        ...(options.reasoningEffort === undefined
-            ? []
-            : ["--config", `model_reasoning_effort=\"${options.reasoningEffort}\"`]),
-        ...CODEX_TOOL_FEATURES.flatMap((feature) => ["--disable", feature]),
-        "-",
-    ];
-}

package/dist/src/projection/diagnostic.d.ts

@@ -1,12 +0,0 @@
-import type { DiagnosticRunRecord } from "../run.js";
-export declare function parseDiagnosticRunRecord(value: unknown): DiagnosticRunRecord;
-export declare function projectDiagnosticRun(record: DiagnosticRunRecord): {
-    schema: "canopus.diagnostic-projection.v1";
-    authority: "read_only_projection";
-    run_id: string;
-    target: string;
-    candidate_digest: string;
-    verifier_status: "passed" | "failed" | "error";
-    landed: false;
-    clean_clone_reproduced: true;
-};

package/dist/src/projection/diagnostic.js

@@ -1,61 +0,0 @@
-import { arrayAt, enumAt, exactKeys, objectAt, relativePathAt, sha256At, stringAt, } from "../contracts/validation.js";
-function literal(value, expected, at) {
-    if (value !== expected)
-        throw new Error(`${at} must be ${String(expected)}`);
-    return expected;
-}
-export function parseDiagnosticRunRecord(value) {
-    const record = objectAt(value, "diagnostic run");
-    exactKeys(record, [
-        "schema", "run_id", "status", "mode", "authority", "external_gate_credit",
-        "mission", "candidate", "verifier", "landing", "reproduction", "budget",
-    ], [], "diagnostic run");
-    const mission = objectAt(record.mission, "diagnostic run.mission");
-    exactKeys(mission, ["id", "target", "digest", "starting_roots"], [], "diagnostic run.mission");
-    const candidate = objectAt(record.candidate, "diagnostic run.candidate");
-    exactKeys(candidate, ["digest", "status", "claim", "artifacts", "caveats"], [], "diagnostic run.candidate");
-    const verifier = objectAt(record.verifier, "diagnostic run.verifier");
-    exactKeys(verifier, ["status", "sandbox", "record"], [], "diagnostic run.verifier");
-    const reproduction = objectAt(record.reproduction, "diagnostic run.reproduction");
-    exactKeys(reproduction, ["matched", "roots", "verifier_status", "stdout_digest", "stderr_digest"], [], "diagnostic run.reproduction");
-    objectAt(mission.starting_roots, "diagnostic run.mission.starting_roots");
-    objectAt(reproduction.roots, "diagnostic run.reproduction.roots");
-    objectAt(record.budget, "diagnostic run.budget");
-    literal(record.schema, "canopus.diagnostic-run.v1", "diagnostic run.schema");
-    literal(record.status, "completed", "diagnostic run.status");
-    literal(record.mode, "no_land", "diagnostic run.mode");
-    literal(record.authority, "non_authoritative", "diagnostic run.authority");
-    literal(record.external_gate_credit, false, "diagnostic run.external_gate_credit");
-    literal(record.landing, null, "diagnostic run.landing");
-    stringAt(record.run_id, "diagnostic run.run_id", { min: 5, max: 128 });
-    stringAt(mission.id, "diagnostic run.mission.id", { min: 1, max: 134 });
-    stringAt(mission.target, "diagnostic run.mission.target", { min: 1, max: 256 });
-    sha256At(mission.digest, "diagnostic run.mission.digest");
-    sha256At(candidate.digest, "diagnostic run.candidate.digest");
-    enumAt(candidate.status, "diagnostic run.candidate.status", ["success", "null", "failed"]);
-    stringAt(candidate.claim, "diagnostic run.candidate.claim", { min: 1, max: 8192 });
-    arrayAt(candidate.artifacts, "diagnostic run.candidate.artifacts", { max: 10 }, (item, at) => {
-        const artifact = objectAt(item, at);
-        exactKeys(artifact, ["path", "kind", "digest", "bytes"], [], at);
-        relativePathAt(artifact.path, `${at}.path`);
-        stringAt(artifact.kind, `${at}.kind`, { min: 1, max: 128 });
-        sha256At(artifact.digest, `${at}.digest`);
-        return true;
-    });
-    arrayAt(candidate.caveats, "diagnostic run.candidate.caveats", { max: 10 }, (item, at) => stringAt(item, at, { min: 1, max: 4096 }));
-    enumAt(verifier.status, "diagnostic run.verifier.status", ["passed", "failed", "error"]);
-    literal(reproduction.matched, true, "diagnostic run.reproduction.matched");
-    return value;
-}
-export function projectDiagnosticRun(record) {
-    return {
-        schema: "canopus.diagnostic-projection.v1",
-        authority: "read_only_projection",
-        run_id: record.run_id,
-        target: record.mission.target,
-        candidate_digest: record.candidate.digest,
-        verifier_status: record.verifier.status,
-        landed: false,
-        clean_clone_reproduced: true,
-    };
-}

package/dist/src/projection/public-run.d.ts

@@ -1,59 +0,0 @@
-import type { Mission } from "../contracts/mission.js";
-import type { RunRecord } from "./run.js";
-export declare const PUBLIC_RUN_SCHEMA: "canopus.public-run.v1";
-export interface PublicRunProjection {
-    schema: typeof PUBLIC_RUN_SCHEMA;
-    authority: "read_only_projection";
-    run_id: string;
-    mission: {
-        id: string;
-        target: string;
-        digest: string;
-        registration_kind: "profile" | "mission_bundle";
-        registration_name: string;
-        registration_root: string;
-        target_packet_root: string;
-        model: string;
-    };
-    activity: {
-        worker: "success";
-        verifier: "pass";
-        clean_clone_replay: "matched";
-    };
-    claim: string;
-    caveats: string[];
-    artifact_roots: string[];
-    verifier_root: string;
-    receipt_root: string;
-    policy: {
-        route: "defer";
-        proposal_id: string;
-        accepted_state_delta: 0;
-    };
-    usage: {
-        research_elapsed_ms: number;
-        research_processes: number;
-        observed_tokens: number;
-        attempts: number;
-    };
-    source: {
-        repository: string;
-        commit: string;
-        event_log_root: string;
-        snapshot_root: string;
-    };
-    final: {
-        commit: string;
-        event_log_root: string;
-        snapshot_root: string;
-    };
-    reproduction: {
-        commands: string[];
-    };
-    nonclaims: string[];
-}
-export declare function projectPublicRun(options: {
-    record: RunRecord;
-    mission: Mission;
-    repository: string;
-}): PublicRunProjection;

package/dist/src/projection/public-run.js

@@ -1,106 +0,0 @@
-import { contentDigest } from "../util/canonical.js";
-export const PUBLIC_RUN_SCHEMA = "canopus.public-run.v1";
-function publicRepository(value) {
-    if (!/^https:\/\/github\.com\/vela-science\/[a-z0-9-]+(?:\.git)?$/u.test(value)) {
-        throw new Error("public run repository must be a public vela-science GitHub URL");
-    }
-    const url = value.endsWith(".git") ? value.slice(0, -4) : value;
-    const directory = new URL(url).pathname.split("/").at(-1);
-    if (directory === undefined || directory === "")
-        throw new Error("public run repository is invalid");
-    return { url, directory };
-}
-function publicCaveat(value) {
-    if (/verif(?:y|ication|ier).*(?:pending|has not run)|pending.*verif(?:y|ication|ier)/iu.test(value)) {
-        return "The worker handed off without verifier authority; Canopus subsequently recorded the separate verifier pass shown in this projection.";
-    }
-    return value;
-}
-function shellArgument(value) {
-    return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
-export function projectPublicRun(options) {
-    const { record, mission } = options;
-    if (mission.schema !== "canopus.mission.v1") {
-        throw new Error("public run export requires a closed Mission v1 bundle");
-    }
-    if (contentDigest(mission) !== record.mission.digest) {
-        throw new Error("public run mission bytes do not match the completed run");
-    }
-    if (mission.id !== record.mission.id || mission.target !== record.mission.target) {
-        throw new Error("public run mission identity does not match the completed run");
-    }
-    if (record.candidate.status !== "success" || record.candidate.artifacts.length < 1) {
-        throw new Error("public run export requires at least one successful bounded artifact");
-    }
-    if (record.verifier.status !== "passed" || record.reproduction.verifier_status !== "passed") {
-        throw new Error("public run export requires verifier pass in both landing and replay");
-    }
-    if (!record.reproduction.matched) {
-        throw new Error("public run export requires matched clean-clone replay");
-    }
-    if (record.landing.route !== "defer" || record.landing.accepted_event_delta !== 0) {
-        throw new Error("public run export requires Defer with zero accepted-state delta");
-    }
-    const repository = publicRepository(options.repository);
-    return {
-        schema: PUBLIC_RUN_SCHEMA,
-        authority: "read_only_projection",
-        run_id: record.run_id,
-        mission: {
-            id: mission.id,
-            target: mission.target,
-            digest: record.mission.digest,
-            registration_kind: mission.profile === undefined ? "mission_bundle" : "profile",
-            registration_name: mission.profile?.name ?? mission.id,
-            registration_root: mission.profile?.root ?? record.mission.digest,
-            target_packet_root: mission.target_packet.sha256,
-            model: mission.worker.model,
-        },
-        activity: {
-            worker: "success",
-            verifier: "pass",
-            clean_clone_replay: "matched",
-        },
-        claim: record.candidate.claim,
-        caveats: [...new Set(record.candidate.caveats.map(publicCaveat))],
-        artifact_roots: record.candidate.artifacts.map((artifact) => artifact.digest).sort(),
-        verifier_root: contentDigest(record.verifier),
-        receipt_root: record.landing.receipt_root,
-        policy: {
-            route: "defer",
-            proposal_id: record.landing.proposal_id,
-            accepted_state_delta: 0,
-        },
-        usage: {
-            research_elapsed_ms: record.budget.research_elapsed_ms,
-            research_processes: record.budget.research_processes,
-            observed_tokens: record.budget.observed_tokens,
-            attempts: record.budget.attempts,
-        },
-        source: {
-            repository: repository.url,
-            commit: record.mission.starting_roots.git_commit,
-            event_log_root: record.mission.starting_roots.vela_event_log,
-            snapshot_root: record.mission.starting_roots.vela_snapshot,
-        },
-        final: {
-            commit: record.final_roots.git_commit,
-            event_log_root: record.final_roots.vela_event_log,
-            snapshot_root: record.final_roots.vela_snapshot,
-        },
-        reproduction: {
-            commands: [
-                `git clone ${repository.url}.git`,
-                `cd ${repository.directory}`,
-                `git checkout ${record.final_roots.git_commit}`,
-                ...mission.allowed_paths.map((artifact) => `vela reproduce ${shellArgument(artifact)}`),
-            ],
-        },
-        nonclaims: [
-            "Verifier success is not scientific acceptance.",
-            "The bounded result does not establish maximality or settle the broader scientific problem.",
-            "Canopus did not sign or perform a human decision.",
-        ],
-    };
-}

package/dist/src/projection/publication.d.ts

@@ -1,36 +0,0 @@
-import type { Mission } from "../contracts/mission.js";
-import type { RunRecord } from "./run.js";
-import { projectPublicRun } from "./public-run.js";
-export interface PublicationBundle {
-    projection: ReturnType<typeof projectPublicRun>;
-    pendingCommands: {
-        schema: "canopus.pending-commands.v1";
-        authority: "none";
-        proposal_id: string;
-        commands: Array<{
-            purpose: string;
-            authority: string;
-            command: string;
-        }>;
-    };
-    webImport: {
-        schema: "vela-web.canopus-import.v1";
-        authority: "read_only";
-        run_id: string;
-        projection_path: "public-run.json";
-        projection_root: string;
-        route: "defer";
-        accepted_state_delta: 0;
-    };
-    manifest: {
-        schema: "canopus.publication-manifest.v1";
-        authority: "none";
-        run_id: string;
-        files: Record<string, string>;
-    };
-}
-export declare function buildPublicationBundle(options: {
-    record: RunRecord;
-    mission: Mission;
-    repository: string;
-}): PublicationBundle;