{
  "schemaVersion": "consumer-authority-beta10-acceptance.1",
  "package": {
    "channel": "staging",
    "scope": "staging-only",
    "version": "0.8.0-beta.10"
  },
  "packageBoundary": {
    "bundle": {
      "requiredRefs": ["HEAD", "refs/remotes/origin/main"],
      "verification": "git-bundle-verify-and-exact-ref-binding",
      "baseComparison": "independent-no-local-base-checkout-under-the-same-npm-policy"
    },
    "cleanCheckout": {
      "requiredBindings": [
        "checkout-cwd",
        "git-toplevel",
        "npm-prefix",
        "HEAD-package-json-bytes",
        "HEAD-package-lock-bytes"
      ],
      "sourceFallback": "forbidden"
    },
    "npm": {
      "global": false,
      "ignoreScriptsBeforePack": false,
      "install": "npm-ci-ignore-scripts",
      "workspaces": false
    },
    "pack": {
      "metadata": "name-version-filename-must-match-frozen-package-and-lock",
      "postcondition": "fresh-installed-cli-version-must-match-tarball-version"
    }
  },
  "beta9HistoricalArtifact": {
    "archiveZipSha256": "sha256:df0e18d68a6b0161b95680b2aa06042818c32708e65c5040e2628798bd28438c",
    "artifactId": 8712218259,
    "certificateSanIdentity": "reusable-producer-workflow",
    "cryptoOutcome": "independently-verified-before-expiry",
    "outcome": "verified-original-artifact-discovery-unavailable",
    "reusableForBeta10": false,
    "runId": 30421869946,
    "version": "0.8.0-beta.9"
  },
  "cooperative": {
    "commands": [
      "ph bootstrap backend --strict --no-developer-mcp",
      "ph bearshell ./gradlew test",
      "ph bearshell ./gradlew compileJava",
      "ph bearshell ./gradlew clean",
      "ph evidence read README.md",
      "ph evidence read .persona/project-profile.jsonc",
      "ph evidence read src/main/java/example/cooperative/GreetingService.java",
      "ph plan --report-filled implementation --stdin",
      "ph plan --report-filled review --stdin"
    ],
    "defaultFinish": "trusted-authority-required",
    "explicitFinish": "cooperative-pass",
    "laterClosure": "trusted-authority-required"
  },
  "authority": {
    "discoveryBinding": {
      "fixedWorkflowIdentifier": "enrolled-caller-workflow-filename",
      "failureMode": "missing-malformed-or-mismatched-evidence-is-not-retained",
      "required": [
        "caller-workflow-filename",
        "reusable-workflow-sha-and-certificate-SAN",
        "repository-id",
        "source-head",
        "workflow-run-id",
        "artifact-id-and-sha256"
      ],
      "storeSchema": "consumer-authority-original-artifact.2"
    },
    "fixturePlan": {
      "artifact": "project-finish-attestation",
      "consumer": "public-java-spring-gradle",
      "postmergeAction": "normal-push-to-main",
      "registryInstall": "npm install persona-harness@0.8.0-beta.10 --registry https://registry.npmjs.org"
    },
    "hostedFixture": {
      "callerWorkflowPath": ".github/workflows/research-attestation.yml",
      "certificateSanIdentity": "reusable-producer-workflow",
      "event": "push",
      "ref": "refs/heads/main",
      "repository": "jyt6640/persona-harness-attestation-claim-fixture",
      "reusableWorkflowPath": ".github/workflows/persona-harness-project-finish.yml",
      "revision": "postmerge-persona-harness-beta10-main-sha"
    },
    "verification": {
      "predicate": "project-finish-attestation.1",
      "route": "fixed-product-owned-online",
      "unavailable": "bounded-non-authoritative"
    }
  },
  "prearmedExternalHandoff": {
    "prepare": {
      "allowedBeforeFixture": ["enroll", "status", "explain"],
      "consumer": "isolated-exact-registry-install",
      "prohibitedBeforeArtifact": [
        "artifact-download",
        "online-crypto-validation",
        "finish-consumption",
        "replay-observation"
      ]
    },
    "trigger": {
      "onlyAfter": "natural-current-version-original-artifact",
      "steps": [
        "download-original-bytes-for-independent-online-verification",
        "verify-online-before-leaf-certificate-notAfter",
        "authority-fetch-discovers-and-binds-original-artifact",
        "finish-consume-once",
        "finish-replay-blocked"
      ]
    },
    "nonAuthority": [
      "prearm-does-not-self-validate",
      "prearm-does-not-grant-authority",
      "prearm-does-not-reuse-beta9-artifact"
    ]
  },
  "hostedResidual": {
    "id": "beta10-prearmed-external-live-original-artifact-verification",
    "requiredEvidence": "one natural current-version public fixture artifact, independent online verification inside its live certificate window, real installed authority fetch, one explicit Finish consumption, and immediate replay rejection",
    "whyLocalCannotClose": "GitHub Actions must mint the original current-version signed artifact and independent online Sigstore verification must observe its live certificate evidence."
  },
  "mutationBoundary": {
    "performed": false,
    "prohibited": [
      "npm-publish",
      "tag-or-dist-tag-mutation",
      "release-creation",
      "artifact-download-or-live-verification",
      "Finish-consumption",
      "fixture-push-or-workflow-dispatch"
    ]
  }
}