@vela-science/canopus 0.7.0 → 0.8.0

package/dist/src/product/submit.js

@@ -0,0 +1,264 @@
+import { constants } from "node:fs";
+import { access, mkdtemp, realpath, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { protocolDigest, sha256Bytes } from "../util/canonical.js";
+import { runCommand } from "../util/command.js";
+import { readBoundedRegularFile } from "../util/files.js";
+import { SUPPORTED_VELA_VERSION } from "./version.js";
+import { findExecutable } from "./runtime.js";
+import { verifySubmission, } from "./submission.js";
+async function command(runner, argv, cwd, maxOutputBytes = 8 * 1024 * 1024) {
+    const result = await runner({
+        argv,
+        cwd,
+        env: process.env,
+        timeoutMs: 120_000,
+        maxOutputBytes,
+    });
+    if (result.exitCode !== 0) {
+        let diagnostic = "no structured error";
+        try {
+            const parsed = JSON.parse(result.stdout.toString("utf8"));
+            if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+                const error = parsed.error;
+                if (typeof error === "object" && error !== null && !Array.isArray(error)) {
+                    const message = error.message;
+                    if (typeof message === "string" && message.length > 0) {
+                        diagnostic = [...message]
+                            .slice(0, 512)
+                            .join("")
+                            .replace(/\b(?:sk|sess|key)-[A-Za-z0-9_-]{8,}\b/gu, "[secret-redacted]");
+                    }
+                }
+            }
+        }
+        catch {
+            // Raw subprocess output is represented only by its digest below.
+        }
+        throw new Error(`${argv[0]} ${argv[1] ?? ""} exited ${result.exitCode}: ${diagnostic}; ` +
+            `stdout_sha256=${sha256Bytes(result.stdout)}; stderr_sha256=${sha256Bytes(result.stderr)}`);
+    }
+    return result.stdout.toString("utf8").trim();
+}
+function parseManifest(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error("Submission bundle manifest is not an object");
+    }
+    const object = value;
+    const exactKeys = (record, expected, label) => {
+        const observed = Object.keys(record).sort();
+        const wanted = [...expected].sort();
+        if (observed.length !== wanted.length || observed.some((key, index) => key !== wanted[index])) {
+            throw new Error(`${label} has unsupported or missing fields`);
+        }
+    };
+    const requiredString = (record, key, label) => {
+        const field = record[key];
+        if (typeof field !== "string" || field.length === 0 || field !== field.trim()) {
+            throw new Error(`${label}.${key} must be non-empty trimmed text`);
+        }
+        return field;
+    };
+    const requiredObject = (record, key, label) => {
+        const field = record[key];
+        if (typeof field !== "object" || field === null || Array.isArray(field)) {
+            throw new Error(`${label}.${key} must be an object`);
+        }
+        return field;
+    };
+    const safePath = (candidate, label) => {
+        if (path.isAbsolute(candidate) ||
+            candidate.includes("\\") ||
+            candidate.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
+            throw new Error(`${label} must be a safe relative POSIX path`);
+        }
+        return candidate;
+    };
+    exactKeys(object, [
+        "schema",
+        "run_id",
+        "run_root",
+        "source",
+        "producer",
+        "submission_id",
+        "submission_root",
+        "identity_binding_id",
+        "artifacts",
+    ], "Submission bundle manifest");
+    const source = requiredObject(object, "source", "manifest");
+    exactKeys(source, ["git_commit", "git_tree", "vela_version", "vela_sha256"], "manifest.source");
+    const rawArtifacts = object.artifacts;
+    if (!Array.isArray(rawArtifacts) || rawArtifacts.length === 0) {
+        throw new Error("Submission bundle contains no Artifacts");
+    }
+    const artifacts = rawArtifacts.map((entry, index) => {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+            throw new Error(`manifest.artifacts[${index}] must be an object`);
+        }
+        const artifact = entry;
+        exactKeys(artifact, ["source", "frontier_path", "digest", "bytes"], `manifest.artifacts[${index}]`);
+        const bytes = artifact.bytes;
+        if (!Number.isSafeInteger(bytes) || Number(bytes) <= 0) {
+            throw new Error(`manifest.artifacts[${index}].bytes must be a positive safe integer`);
+        }
+        return {
+            source: safePath(requiredString(artifact, "source", `manifest.artifacts[${index}]`), `manifest.artifacts[${index}].source`),
+            frontier_path: safePath(requiredString(artifact, "frontier_path", `manifest.artifacts[${index}]`), `manifest.artifacts[${index}].frontier_path`),
+            digest: requiredString(artifact, "digest", `manifest.artifacts[${index}]`),
+            bytes: Number(bytes),
+        };
+    });
+    const manifest = {
+        schema: requiredString(object, "schema", "manifest"),
+        run_id: requiredString(object, "run_id", "manifest"),
+        run_root: requiredString(object, "run_root", "manifest"),
+        source: {
+            git_commit: requiredString(source, "git_commit", "manifest.source"),
+            git_tree: requiredString(source, "git_tree", "manifest.source"),
+            vela_version: requiredString(source, "vela_version", "manifest.source"),
+            vela_sha256: requiredString(source, "vela_sha256", "manifest.source"),
+        },
+        producer: requiredString(object, "producer", "manifest"),
+        submission_id: requiredString(object, "submission_id", "manifest"),
+        submission_root: requiredString(object, "submission_root", "manifest"),
+        identity_binding_id: requiredString(object, "identity_binding_id", "manifest"),
+        artifacts,
+    };
+    if (manifest.schema !== "canopus.submission-bundle.v1") {
+        throw new Error("Submission bundle schema must be canopus.submission-bundle.v1");
+    }
+    if (new Set(manifest.artifacts.map((artifact) => artifact.source)).size !== manifest.artifacts.length ||
+        new Set(manifest.artifacts.map((artifact) => artifact.frontier_path)).size !== manifest.artifacts.length) {
+        throw new Error("Submission bundle contains duplicate Artifact paths");
+    }
+    return manifest;
+}
+export async function submitBundle(options) {
+    const runner = options.runner ?? runCommand;
+    const bundle = await realpath(options.bundle);
+    const frontier = await realpath(options.frontier);
+    const manifest = parseManifest(JSON.parse((await readBoundedRegularFile(path.join(bundle, "manifest.json"), 8 * 1024 * 1024)).toString("utf8")));
+    const submission = JSON.parse((await readBoundedRegularFile(path.join(bundle, "submission.json"), 8 * 1024 * 1024)).toString("utf8"));
+    verifySubmission(submission);
+    if (submission.submission_id !== manifest.submission_id) {
+        throw new Error("Submission bundle identity mismatch");
+    }
+    if (submission.provenance.producer !== manifest.producer ||
+        submission.authentication.identity_binding.binding_id !== manifest.identity_binding_id) {
+        throw new Error("Submission bundle producer binding mismatch");
+    }
+    if (protocolDigest(submission) !== manifest.submission_root) {
+        throw new Error("Submission bundle root mismatch");
+    }
+    const declaredArtifacts = submission.artifacts
+        .map((artifact) => `${artifact.path}\0${artifact.digest}`)
+        .sort();
+    const bundledArtifacts = manifest.artifacts
+        .map((artifact) => `${artifact.frontier_path}\0${artifact.digest}`)
+        .sort();
+    if (declaredArtifacts.length !== bundledArtifacts.length ||
+        declaredArtifacts.some((entry, index) => entry !== bundledArtifacts[index])) {
+        throw new Error("Submission and bundle Artifact bindings disagree");
+    }
+    const status = await command(runner, ["git", "status", "--porcelain=v1", "--untracked-files=all"], frontier);
+    if (status !== "")
+        throw new Error("source frontier must be clean before submit");
+    const before = await command(runner, ["git", "rev-parse", "--verify", "HEAD^{commit}"], frontier);
+    const sourceTree = await command(runner, ["git", "rev-parse", "--verify", `${manifest.source.git_commit}^{tree}`], frontier);
+    const sourceOrigin = await command(runner, ["git", "remote", "get-url", "origin"], frontier);
+    if (sourceTree !== manifest.source.git_tree) {
+        throw new Error("retained Run source commit no longer matches its exact Git tree");
+    }
+    if (before !== manifest.source.git_commit) {
+        const ancestry = await runner({
+            argv: ["git", "merge-base", "--is-ancestor", manifest.source.git_commit, before],
+            cwd: frontier,
+            env: process.env,
+            timeoutMs: 120_000,
+            maxOutputBytes: 64 * 1024,
+        });
+        if (ancestry.exitCode !== 0) {
+            throw new Error("current frontier is not a descendant of the retained Run source commit");
+        }
+    }
+    const vela = await findExecutable(options.velaBinary ?? process.env.VELA_BIN ?? "vela");
+    const observedVela = sha256Bytes(await readBoundedRegularFile(vela, 512 * 1024 * 1024));
+    const version = await command(runner, [vela, "--version"], frontier, 64 * 1024);
+    if (version !== `vela ${SUPPORTED_VELA_VERSION}`) {
+        throw new Error(`Canopus requires registration through vela ${SUPPORTED_VELA_VERSION}, observed ${version}; ` +
+            `the retained Run source binary remains recorded separately as ${manifest.source.vela_version} ` +
+            `(${manifest.source.vela_sha256})`);
+    }
+    const temporary = await mkdtemp(path.join(os.tmpdir(), "canopus-submit-"));
+    const clone = path.join(temporary, "frontier");
+    try {
+        await command(runner, ["git", "clone", "--no-hardlinks", "--", frontier, clone], temporary);
+        const cloneHead = await command(runner, ["git", "rev-parse", "--verify", "HEAD^{commit}"], clone);
+        if (cloneHead !== before)
+            throw new Error("disposable submit clone does not match source HEAD");
+        await command(runner, ["git", "remote", "set-url", "origin", sourceOrigin], clone);
+        for (const artifact of manifest.artifacts) {
+            const source = path.join(bundle, artifact.source);
+            await access(source, constants.R_OK);
+            const bytes = await readBoundedRegularFile(source, artifact.bytes + 1);
+            if (bytes.length !== artifact.bytes || sha256Bytes(bytes) !== artifact.digest) {
+                throw new Error(`bundle Artifact ${artifact.digest} is missing or corrupt`);
+            }
+        }
+        const resultText = await command(runner, [
+            vela,
+            "submit",
+            path.join(bundle, "submission.json"),
+            "--frontier",
+            clone,
+            "--as",
+            manifest.producer,
+            "--json",
+        ], clone);
+        const result = JSON.parse(resultText);
+        if (result.ok !== true ||
+            result.schema !== "vela.submit-result.v1" ||
+            result.submission_id !== manifest.submission_id ||
+            result.submission_root !== manifest.submission_root ||
+            result.route !== "pending_review" ||
+            result.accepted_event_delta !== 0) {
+            throw new Error("Vela returned an invalid or authority-changing submit result");
+        }
+        const after = await command(runner, ["git", "rev-parse", "--verify", "HEAD^{commit}"], clone);
+        if (after === before)
+            throw new Error("Vela submit produced no registration commit");
+        const sourceStill = await command(runner, ["git", "rev-parse", "--verify", "HEAD^{commit}"], frontier);
+        const sourceStatus = await command(runner, ["git", "status", "--porcelain=v1", "--untracked-files=all"], frontier);
+        if (sourceStill !== before || sourceStatus !== "") {
+            throw new Error("source frontier changed before the verified registration was ready");
+        }
+        await command(runner, ["git", "fetch", "--no-tags", "--", clone, after], frontier);
+        await command(runner, ["git", "merge", "--ff-only", "FETCH_HEAD"], frontier);
+        const installed = await command(runner, ["git", "rev-parse", "--verify", "HEAD^{commit}"], frontier);
+        if (installed !== after)
+            throw new Error("source frontier did not fast-forward to the registration");
+        const finalStatus = await command(runner, ["git", "status", "--porcelain=v1", "--untracked-files=all"], frontier);
+        if (finalStatus !== "")
+            throw new Error("source frontier is dirty after submit");
+        return {
+            schema: "canopus.submit-result.v1",
+            ok: true,
+            submission_id: manifest.submission_id,
+            submission_root: manifest.submission_root,
+            registration_record_id: String(result.registration_record_id),
+            registration_record_root: String(result.registration_record_root),
+            proposal_id: String(result.proposal_id),
+            claim_id: String(result.claim_id),
+            route: "pending_review",
+            accepted_event_delta: 0,
+            source_commit_before: before,
+            source_commit_after: after,
+            registration_binary_version: version,
+            registration_binary_sha256: observedVela,
+        };
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true });
+    }
+}

package/dist/src/product/version.d.ts

@@ -1,3 +1,3 @@
 export declare const CANOPUS_VERSION: string;
-export declare const SUPPORTED_VELA_VERSION = "0.915.1";
-export declare const SUPPORTED_CODEX_VERSION = "0.145.0";
+export declare const SUPPORTED_VELA_VERSION: string;
+export declare const SUPPORTED_CODEX_VERSION: string;

package/dist/src/product/version.js

@@ -1,8 +1,31 @@
-import { readFileSync } from "node:fs";
-const packageJson = JSON.parse(readFileSync(new URL("../../../package.json", import.meta.url), "utf8"));
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+const packageUrl = [
+    new URL("../../package.json", import.meta.url),
+    new URL("../../../package.json", import.meta.url),
+].find((candidate) => existsSync(fileURLToPath(candidate)));
+if (packageUrl === undefined)
+    throw new Error("Canopus package.json is missing");
+const packageJson = JSON.parse(readFileSync(packageUrl, "utf8"));
+const toolchainUrl = [
+    new URL("../../toolchain.lock.json", import.meta.url),
+    new URL("../../../toolchain.lock.json", import.meta.url),
+].find((candidate) => existsSync(fileURLToPath(candidate)));
+if (toolchainUrl === undefined)
+    throw new Error("Canopus toolchain.lock.json is missing");
+const toolchain = JSON.parse(readFileSync(toolchainUrl, "utf8"));
 if (typeof packageJson.version !== "string" || packageJson.version.length === 0) {
     throw new Error("Canopus package version is missing");
 }
 export const CANOPUS_VERSION = packageJson.version;
-export const SUPPORTED_VELA_VERSION = "0.915.1";
-export const SUPPORTED_CODEX_VERSION = "0.145.0";
+if (toolchain.schema !== "canopus.toolchain-lock.v1") {
+    throw new Error("Canopus toolchain lock schema is unsupported");
+}
+if (typeof toolchain.vela?.version !== "string" || toolchain.vela.version.length === 0) {
+    throw new Error("Canopus Vela toolchain version is missing");
+}
+if (typeof toolchain.codex?.version !== "string" || toolchain.codex.version.length === 0) {
+    throw new Error("Canopus Codex toolchain version is missing");
+}
+export const SUPPORTED_VELA_VERSION = toolchain.vela.version;
+export const SUPPORTED_CODEX_VERSION = toolchain.codex.version;

package/dist/src/projection/current-run.d.ts

@@ -0,0 +1,12 @@
+import type { CurrentRunRecord } from "../run.js";
+export declare function parseCurrentRunRecord(value: unknown): CurrentRunRecord;
+export declare function projectCurrentRun(record: CurrentRunRecord): {
+    schema: "canopus.run-projection.v2";
+    authority: "read_only_projection";
+    run_id: string;
+    target: string;
+    candidate_digest: string;
+    verifier_status: "passed" | "failed" | "error";
+    submitted: false;
+    clean_clone_reproduced: true;
+};

package/dist/src/projection/current-run.js

@@ -0,0 +1,94 @@
+import { arrayAt, enumAt, exactKeys, gitObjectAt, integerAt, objectAt, relativePathAt, sha256At, stringAt, } from "../contracts/validation.js";
+function literal(value, expected, at) {
+    if (value !== expected)
+        throw new Error(`${at} must be ${String(expected)}`);
+    return expected;
+}
+function rootsAt(value, at) {
+    const roots = objectAt(value, at);
+    exactKeys(roots, ["git_commit", "git_tree", "vela_repository"], [], at);
+    return {
+        git_commit: gitObjectAt(roots.git_commit, `${at}.git_commit`),
+        git_tree: gitObjectAt(roots.git_tree, `${at}.git_tree`),
+        vela_repository: sha256At(roots.vela_repository, `${at}.vela_repository`),
+    };
+}
+export function parseCurrentRunRecord(value) {
+    const record = objectAt(value, "run");
+    exactKeys(record, [
+        "schema", "run_id", "status", "effect", "authority", "external_gate_credit",
+        "mission", "candidate", "verifier", "submission", "reproduction", "budget",
+    ], [], "run");
+    const mission = objectAt(record.mission, "run.mission");
+    exactKeys(mission, ["id", "target", "digest", "starting_roots"], [], "run.mission");
+    const candidate = objectAt(record.candidate, "run.candidate");
+    exactKeys(candidate, ["digest", "status", "claim", "artifacts", "caveats"], [], "run.candidate");
+    const verifier = objectAt(record.verifier, "run.verifier");
+    exactKeys(verifier, ["status", "sandbox", "record"], [], "run.verifier");
+    const verifierRecord = objectAt(verifier.record, "run.verifier.record");
+    exactKeys(verifierRecord, ["argv", "executable_digest", "exit_code", "stdout_digest", "stderr_digest", "duration_ms"], [], "run.verifier.record");
+    const reproduction = objectAt(record.reproduction, "run.reproduction");
+    exactKeys(reproduction, ["matched", "roots", "verifier_status", "stdout_digest", "stderr_digest"], [], "run.reproduction");
+    const budget = objectAt(record.budget, "run.budget");
+    exactKeys(budget, [
+        "research_elapsed_ms", "research_processes", "research_output_bytes",
+        "prompt_bytes", "artifact_bytes", "attempts", "observed_tokens",
+    ], [], "run.budget");
+    rootsAt(mission.starting_roots, "run.mission.starting_roots");
+    rootsAt(reproduction.roots, "run.reproduction.roots");
+    literal(record.schema, "canopus.run.v2", "run.schema");
+    literal(record.status, "completed", "run.status");
+    literal(record.effect, "none", "run.effect");
+    literal(record.authority, "non_authoritative", "run.authority");
+    literal(record.external_gate_credit, false, "run.external_gate_credit");
+    literal(record.submission, null, "run.submission");
+    stringAt(record.run_id, "run.run_id", { min: 5, max: 128 });
+    stringAt(mission.id, "run.mission.id", { min: 1, max: 134 });
+    stringAt(mission.target, "run.mission.target", { min: 1, max: 256 });
+    sha256At(mission.digest, "run.mission.digest");
+    sha256At(candidate.digest, "run.candidate.digest");
+    enumAt(candidate.status, "run.candidate.status", ["success", "null", "failed"]);
+    stringAt(candidate.claim, "run.candidate.claim", { min: 1, max: 8192 });
+    arrayAt(candidate.artifacts, "run.candidate.artifacts", { min: 1, max: 10 }, (item, at) => {
+        const artifact = objectAt(item, at);
+        exactKeys(artifact, ["path", "kind", "digest", "bytes"], [], at);
+        relativePathAt(artifact.path, `${at}.path`);
+        stringAt(artifact.kind, `${at}.kind`, { min: 1, max: 128 });
+        sha256At(artifact.digest, `${at}.digest`);
+        integerAt(artifact.bytes, `${at}.bytes`, 0, 1_073_741_824);
+        return true;
+    });
+    arrayAt(candidate.caveats, "run.candidate.caveats", { min: 1, max: 10 }, (item, at) => stringAt(item, at, { min: 1, max: 4096 }));
+    literal(verifier.status, "passed", "run.verifier.status");
+    enumAt(verifier.sandbox, "run.verifier.sandbox", ["macos_sandbox", "container_network_denied"]);
+    arrayAt(verifierRecord.argv, "run.verifier.record.argv", { min: 1, max: 64 }, (item, at) => stringAt(item, at, { max: 4096 }));
+    sha256At(verifierRecord.executable_digest, "run.verifier.record.executable_digest");
+    integerAt(verifierRecord.exit_code, "run.verifier.record.exit_code", -1, 255);
+    sha256At(verifierRecord.stdout_digest, "run.verifier.record.stdout_digest");
+    sha256At(verifierRecord.stderr_digest, "run.verifier.record.stderr_digest");
+    integerAt(verifierRecord.duration_ms, "run.verifier.record.duration_ms", 0, 3_600_000);
+    literal(reproduction.matched, true, "run.reproduction.matched");
+    enumAt(reproduction.verifier_status, "run.reproduction.verifier_status", ["passed", "failed", "error"]);
+    sha256At(reproduction.stdout_digest, "run.reproduction.stdout_digest");
+    sha256At(reproduction.stderr_digest, "run.reproduction.stderr_digest");
+    integerAt(budget.research_elapsed_ms, "run.budget.research_elapsed_ms", 0, 3_600_000);
+    integerAt(budget.research_processes, "run.budget.research_processes", 0, 64);
+    integerAt(budget.research_output_bytes, "run.budget.research_output_bytes", 0, 67_108_864);
+    integerAt(budget.prompt_bytes, "run.budget.prompt_bytes", 0, 8_388_608);
+    integerAt(budget.artifact_bytes, "run.budget.artifact_bytes", 0, 1_073_741_824);
+    integerAt(budget.attempts, "run.budget.attempts", 0, 8);
+    integerAt(budget.observed_tokens, "run.budget.observed_tokens", 0, 1_000_000);
+    return value;
+}
+export function projectCurrentRun(record) {
+    return {
+        schema: "canopus.run-projection.v2",
+        authority: "read_only_projection",
+        run_id: record.run_id,
+        target: record.mission.target,
+        candidate_digest: record.candidate.digest,
+        verifier_status: record.verifier.status,
+        submitted: false,
+        clean_clone_reproduced: true,
+    };
+}

package/dist/src/projection/failure.d.ts

@@ -1,10 +1,20 @@
-export declare const FAILURE_RECORD_SCHEMA: "canopus.failure.v0";
-export declare const FAILURE_PROJECTION_SCHEMA: "canopus.failure-projection.v0";
+export declare const FAILURE_RECORD_SCHEMA: "canopus.failure.v1";
+export declare const HISTORICAL_FAILURE_RECORD_SCHEMA: "canopus.failure.v0";
+export declare const FAILURE_PROJECTION_SCHEMA: "canopus.failure-projection.v1";
 export interface FailureRecord {
     schema: typeof FAILURE_RECORD_SCHEMA;
     run_id: string;
     error: string;
     phase: string;
+    effect: "none";
+    activity_tip: string;
+    authority: "non_authoritative";
+}
+export interface HistoricalFailureRecord {
+    schema: typeof HISTORICAL_FAILURE_RECORD_SCHEMA;
+    run_id: string;
+    error: string;
+    phase: string;
     landing_observed: boolean;
     landing_recovery: string | null;
     activity_tip: string;
@@ -17,10 +27,10 @@ export interface FailureProjection {
     status: "failed";
     phase: string;
     error: string;
-    landing_status: "not_attempted" | "observed_requires_recovery";
-    landing_recovery: string | null;
+    effect: "none" | "historical_landing_observed";
+    recovery: string | null;
     activity_tip: string;
-    deletion_test: "Vela state does not depend on this projection; inspect retained recovery evidence for any observed landing effect.";
+    deletion_test: "Vela state does not depend on this projection; show retained recovery evidence for any historical landing effect.";
 }
-export declare function parseFailureRecord(value: unknown): FailureRecord;
-export declare function projectFailure(record: FailureRecord): FailureProjection;
+export declare function parseFailureRecord(value: unknown): FailureRecord | HistoricalFailureRecord;
+export declare function projectFailure(record: FailureRecord | HistoricalFailureRecord): FailureProjection;

package/dist/src/projection/failure.js

@@ -1,6 +1,7 @@
 import { exactKeys, objectAt, relativePathAt, sha256At, stringAt, } from "../contracts/validation.js";
-export const FAILURE_RECORD_SCHEMA = "canopus.failure.v0";
-export const FAILURE_PROJECTION_SCHEMA = "canopus.failure-projection.v0";
+export const FAILURE_RECORD_SCHEMA = "canopus.failure.v1";
+export const HISTORICAL_FAILURE_RECORD_SCHEMA = "canopus.failure.v0";
+export const FAILURE_PROJECTION_SCHEMA = "canopus.failure-projection.v1";
 function literal(value, expected, at) {
     if (value !== expected)
         throw new Error(`${at} must be ${String(expected)}`);
@@ -13,13 +14,44 @@ function booleanAt(value, at) {
 }
 export function parseFailureRecord(value) {
     const record = objectAt(value, "failure");
+    if (record.schema === HISTORICAL_FAILURE_RECORD_SCHEMA) {
+        exactKeys(record, [
+            "schema",
+            "run_id",
+            "error",
+            "phase",
+            "landing_observed",
+            "landing_recovery",
+            "activity_tip",
+            "authority",
+        ], [], "failure");
+        return {
+            schema: HISTORICAL_FAILURE_RECORD_SCHEMA,
+            run_id: stringAt(record.run_id, "failure.run_id", {
+                min: 5,
+                max: 128,
+                pattern: /^run_[A-Za-z0-9._-]+$/u,
+            }),
+            error: stringAt(record.error, "failure.error", { min: 1, max: 16_384 }),
+            phase: stringAt(record.phase, "failure.phase", {
+                min: 1,
+                max: 128,
+                pattern: /^[a-z][a-z0-9_]*$/u,
+            }),
+            landing_observed: booleanAt(record.landing_observed, "failure.landing_observed"),
+            landing_recovery: record.landing_recovery === null
+                ? null
+                : relativePathAt(record.landing_recovery, "failure.landing_recovery"),
+            activity_tip: sha256At(record.activity_tip, "failure.activity_tip"),
+            authority: literal(record.authority, "non_authoritative", "failure.authority"),
+        };
+    }
     exactKeys(record, [
         "schema",
         "run_id",
         "error",
         "phase",
-        "landing_observed",
-        "landing_recovery",
+        "effect",
         "activity_tip",
         "authority",
     ], [], "failure");
@@ -36,18 +68,17 @@ export function parseFailureRecord(value) {
             max: 128,
             pattern: /^[a-z][a-z0-9_]*$/u,
         }),
-        landing_observed: booleanAt(record.landing_observed, "failure.landing_observed"),
-        landing_recovery: record.landing_recovery === null
-            ? null
-            : relativePathAt(record.landing_recovery, "failure.landing_recovery"),
+        effect: literal(record.effect, "none", "failure.effect"),
         activity_tip: sha256At(record.activity_tip, "failure.activity_tip"),
         authority: literal(record.authority, "non_authoritative", "failure.authority"),
     };
 }
 export function projectFailure(record) {
-    if (record.landing_observed !== (record.landing_recovery !== null)) {
+    if (record.schema === HISTORICAL_FAILURE_RECORD_SCHEMA &&
+        record.landing_observed !== (record.landing_recovery !== null)) {
         throw new Error("failure landing observation and recovery evidence disagree");
     }
+    const historicalObserved = record.schema === HISTORICAL_FAILURE_RECORD_SCHEMA && record.landing_observed;
     return {
         schema: FAILURE_PROJECTION_SCHEMA,
         authority: "read_only_projection",
@@ -55,9 +86,9 @@ export function projectFailure(record) {
         status: "failed",
         phase: record.phase,
         error: record.error,
-        landing_status: record.landing_observed ? "observed_requires_recovery" : "not_attempted",
-        landing_recovery: record.landing_recovery,
+        effect: historicalObserved ? "historical_landing_observed" : "none",
+        recovery: record.schema === HISTORICAL_FAILURE_RECORD_SCHEMA ? record.landing_recovery : null,
         activity_tip: record.activity_tip,
-        deletion_test: "Vela state does not depend on this projection; inspect retained recovery evidence for any observed landing effect.",
+        deletion_test: "Vela state does not depend on this projection; show retained recovery evidence for any historical landing effect.",
     };
 }

package/dist/src/projection/retained-mission.d.ts

@@ -0,0 +1,6 @@
+import { type MissionV1 } from "../contracts/mission.js";
+export declare function parseRetainedMission(value: unknown): {
+    mission: MissionV1;
+    exactRoot: string;
+    exactRoots: string;
+};

package/dist/src/projection/retained-mission.js

@@ -0,0 +1,41 @@
+import { parseMission } from "../contracts/mission.js";
+import { arrayAt, enumAt, exactKeys, integerAt, objectAt, sha256At, stringAt, } from "../contracts/validation.js";
+import { canonicalJcs, canonicalJson, sha256Bytes } from "../util/canonical.js";
+import { normalizeRetainedRunRoots } from "./retained-run.js";
+export function parseRetainedMission(value) {
+    const raw = objectAt(value, "retained Mission");
+    const roots = objectAt(raw.roots, "retained Mission.roots");
+    if (raw.strict_baseline !== undefined) {
+        const baseline = objectAt(raw.strict_baseline, "retained Mission.strict_baseline");
+        exactKeys(baseline, ["status", "blocker_count", "blockers_root", "rule_counts"], [], "retained Mission.strict_baseline");
+        enumAt(baseline.status, "retained Mission.strict_baseline.status", ["pass", "fail"]);
+        integerAt(baseline.blocker_count, "retained Mission.strict_baseline.blocker_count", 0, 1_000_000);
+        sha256At(baseline.blockers_root, "retained Mission.strict_baseline.blockers_root");
+        arrayAt(baseline.rule_counts, "retained Mission.strict_baseline.rule_counts", { min: 0, max: 256 }, (item, at) => {
+            const count = objectAt(item, at);
+            exactKeys(count, ["count", "rule"], [], at);
+            integerAt(count.count, `${at}.count`, 0, 1_000_000);
+            stringAt(count.rule, `${at}.rule`, {
+                min: 1,
+                max: 128,
+                pattern: /^[a-z][a-z0-9_]*$/u,
+            });
+            return true;
+        });
+    }
+    const parseable = { ...raw };
+    delete parseable.strict_baseline;
+    const normalized = {
+        ...parseable,
+        roots: normalizeRetainedRunRoots(roots, "retained Mission.roots"),
+    };
+    const mission = parseMission(normalized);
+    if (mission.schema !== "canopus.mission.v1") {
+        throw new Error("current reader requires canopus.mission.v1");
+    }
+    return {
+        mission,
+        exactRoot: sha256Bytes(canonicalJson(raw)),
+        exactRoots: canonicalJcs(roots),
+    };
+}

package/dist/src/projection/retained-run.d.ts

@@ -0,0 +1,7 @@
+import { parseCurrentRunRecord } from "./current-run.js";
+export declare function normalizeRetainedRunRoots(value: unknown, at: string): Record<string, string>;
+export declare function parseRetainedRunRecord(value: unknown): {
+    record: ReturnType<typeof parseCurrentRunRecord>;
+    exactRoot: string;
+    exactStartingRoots: string;
+};