{
  "schemaVersion": "consumer-authority-beta8-acceptance.1",
  "package": {
    "version": "0.8.0-beta.8",
    "channel": "staging",
    "scope": "staging-only"
  },
  "beta7HistoricalArtifact": {
    "version": "0.8.0-beta.7",
    "certificateNotAfter": "2026-07-28T21:46:50Z",
    "independentDecisionAt": "2026-07-28T21:52:38Z",
    "outcome": "certificate-window-expired-no-trusted-positive",
    "reusableForBeta8": false
  },
  "nativeProjectRead": {
    "manifest": "native/project-read/manifest.json",
    "source": "native/project-read/ph_native_project_read.c",
    "platforms": ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64"],
    "node": "^20.17.0 || >=22.9.0",
    "unavailable": "source-read-runtime-unavailable"
  },
  "ciRuntime": {
    "proof": "clean-checkout-forced-dist-build-private-runtime-stage",
    "sourceFallback": "forbidden",
    "physicalResourceLane": {
      "files": [
        "tests/cooperative-finish-real-gradle.test.ts",
        "tests/project-finish-attestation-producer-oidc-bridge.test.ts",
        "tests/staged-package-verification-runner.test.ts",
        "tests/persona-harness-staged-package-verification-installed.test.ts",
        "tests/persona-harness-workflow-loop.test.ts"
      ],
      "maxWorkers": 1,
      "normalMaxWorkers": 4
    },
    "parallelProcessCleanup": {
      "files": ["tests/eval-runner.test.ts"],
      "proof": "unique-temporary-process-groups"
    }
  },
  "producerWorkspace": {
    "proof": "source-built-and-packed-installed-github-script-outer-runner-nested-caller-native-audit",
    "blocked": "bounded-block-no-external-descriptor-open-read-write-or-artifact",
    "manifest": [
      {
        "id": "runner-root-capture",
        "root": "runner",
        "capability": "outer-runner-directory-fd",
        "relativePath": ".",
        "operation": "canonical-no-follow-identity-bind"
      },
      {
        "id": "nested-caller-capture",
        "root": "caller",
        "capability": "outer-runner-directory-fd",
        "relativePath": ".project-finish-caller",
        "operation": "openat-nofollow-direct-child-identity-bind"
      },
      {
        "id": "caller-input-read",
        "root": "caller",
        "capability": "nested-caller-directory-fd",
        "relativePath": "<profile-gradle-git-source-junit-evidence>",
        "operation": "descriptor-relative-no-follow-bounded-read-tree-and-fixed-command"
      },
      {
        "id": "failure-output",
        "root": "runner",
        "capability": "outer-runner-output-reservation",
        "relativePath": ".project-finish-attestation-failure/failure-diagnostic.json",
        "operation": "canonical-contained-nofollow-private-write"
      },
      {
        "id": "unsigned-artifact-output",
        "root": "runner",
        "capability": "outer-runner-output-reservation",
        "relativePath": ".project-finish-attestation-artifacts/<receipt-predicate-bundle>",
        "operation": "reserved-nofollow-private-write-and-handoff"
      },
      {
        "id": "caller-cleanup",
        "root": "caller",
        "capability": "held-native-descriptors",
        "relativePath": "<caller-root-and-parent-fds>",
        "operation": "close-only-no-caller-path-reopen"
      }
    ]
  },
  "cooperative": {
    "commands": [
      "ph bootstrap backend --strict --no-developer-mcp",
      "ph bearshell ./gradlew test",
      "ph bearshell ./gradlew compileJava",
      "ph bearshell ./gradlew clean",
      "ph evidence read README.md",
      "ph evidence read .persona/project-profile.jsonc",
      "ph evidence read src/main/java/example/cooperative/GreetingService.java",
      "ph plan --report-filled implementation --stdin",
      "ph plan --report-filled review --stdin"
    ],
    "defaultFinish": "trusted-authority-required",
    "explicitFinish": "cooperative-pass",
    "laterClosure": "trusted-authority-required",
    "evidence": {
      "recordSchema": "workflow-read-evidence.1",
      "sourceReads": [
        "README.md",
        ".persona/project-profile.jsonc",
        "src/main/java/example/cooperative/GreetingService.java"
      ],
      "sourceReadManifest": [
        {
          "id": "project-root",
          "surface": "producer-and-source-match",
          "boundary": "native-directory-fd-root-capability"
        },
        {
          "id": "harness-config-and-profile",
          "surface": ".persona/harness.jsonc-and-project-profile.jsonc",
          "boundary": "native-openat-regular-file"
        },
        {
          "id": "gradle-descriptors",
          "surface": "build.gradle-or-build.gradle.kts-and-settings.gradle-or-settings.gradle.kts",
          "boundary": "native-openat-exactly-one"
        },
        {
          "id": "source-tree-and-git",
          "surface": "tracked-and-included-untracked-source-plus-fixed-git",
          "boundary": "native-openat-tree-and-captured-cwd"
        },
        {
          "id": "evidence-read-input-and-output",
          "surface": "public-ph-evidence-read",
          "boundary": "captured-project-read-and-canonical-evidence-write"
        }
      ],
      "sourceReadStages": [
        {
          "id": "project-root-capture",
          "capability": "runner-directory-fd",
          "relativePath": "<direct-child-project>",
          "operation": "openat-nofollow-and-identity-bind"
        },
        {
          "id": "intermediate-segment-traversal",
          "capability": "project-root-fd",
          "relativePath": "<each-relative-parent-segment>",
          "operation": "fstatat-openat-nofollow-fstatat"
        },
        {
          "id": "regular-leaf-read",
          "capability": "held-parent-fd",
          "relativePath": "<selected-regular-leaf>",
          "operation": "openat-nofollow-bounded-read-post-identity"
        },
        {
          "id": "harness-config-profile",
          "capability": "project-root-fd",
          "relativePath": ".persona/harness.jsonc|.persona/project-profile.jsonc",
          "operation": "bounded-regular-read"
        },
        {
          "id": "gradle-descriptors",
          "capability": "project-root-fd",
          "relativePath": "build.gradle|build.gradle.kts|settings.gradle|settings.gradle.kts",
          "operation": "exactly-one-bounded-regular-read"
        },
        {
          "id": "gradle-wrapper-execution",
          "capability": "project-root-fd",
          "relativePath": "gradlew",
          "operation": "nofollow-wrapper-check-and-fixed-exec"
        },
        {
          "id": "source-identity-tree",
          "capability": "project-root-fd",
          "relativePath": "<tracked-staged-unstaged-included-untracked>",
          "operation": "bounded-descriptor-relative-tree"
        },
        {
          "id": "git-identity",
          "capability": "project-root-fd",
          "relativePath": ".git",
          "operation": "fixed-catalog-fchdir-exec"
        },
        {
          "id": "junit-baseline",
          "capability": "project-root-fd",
          "relativePath": "build/test-results/test|target/surefire-reports",
          "operation": "descriptor-relative-generated-manifest"
        },
        {
          "id": "junit-fresh-read",
          "capability": "project-root-fd",
          "relativePath": "build/test-results/test|target/surefire-reports",
          "operation": "descriptor-relative-generated-tree"
        },
        {
          "id": "public-evidence-source-read",
          "capability": "project-root-fd",
          "relativePath": "<validated-public-relative-path>",
          "operation": "manifest-bound-regular-read"
        },
        {
          "id": "public-evidence-record-write",
          "capability": "bootstrap-write-boundary",
          "relativePath": ".persona/evidence/phase0/<digest>.json",
          "operation": "canonical-contained-atomic-write"
        },
        {
          "id": "producer-post-verification-recheck",
          "capability": "project-root-fd",
          "relativePath": "<same-captured-project>",
          "operation": "repeat-input-source-git-and-junit-bindings"
        },
        {
          "id": "boundary-cleanup",
          "capability": "held-native-descriptors",
          "relativePath": "<all-held-fds>",
          "operation": "close-only-no-path-reopen"
        }
      ],
      "unsafeResult": "bounded-block-no-external-descriptor-bytes-record-or-artifact"
    }
  },
  "authority": {
    "commands": [
      "ph authority enroll github <owner/repository> --workflow <caller-workflow>",
      "ph authority status --json",
      "ph authority fetch github --json",
      "ph authority explain --json",
      "ph workflow finish implement"
    ],
    "hostedFixture": {
      "repository": "jyt6640/persona-harness-attestation-claim-fixture",
      "callerWorkflowPath": ".github/workflows/persona-harness.yml",
      "reusableWorkflowPath": ".github/workflows/persona-harness-project-finish.yml",
      "event": "push",
      "ref": "refs/heads/main",
      "revision": "postmerge-persona-harness-main-sha"
    },
    "fixturePlan": {
      "artifact": "project-finish-attestation",
      "consumer": "public-java-spring-gradle",
      "postmergeAction": "normal-push-to-main",
      "registryInstall": "npm install persona-harness@0.8.0-beta.8 --registry https://registry.npmjs.org"
    },
    "verification": {
      "predicate": "project-finish-attestation.1",
      "route": "fixed-product-owned-online",
      "unavailable": "bounded-non-authoritative"
    }
  },
  "prearmedExternalHandoff": {
    "prepare": {
      "consumer": "isolated-exact-registry-install",
      "allowedBeforeFixture": ["enroll", "status", "explain"],
      "prohibitedBeforeArtifact": [
        "artifact-download",
        "online-crypto-validation",
        "finish-consumption",
        "replay-observation"
      ]
    },
    "trigger": {
      "onlyAfter": "natural-current-version-original-artifact",
      "steps": [
        "download-original-bytes-once",
        "verify-online-before-leaf-certificate-notAfter",
        "finish-consume-once",
        "finish-replay-blocked"
      ],
      "expiration": {
        "source": "leaf-certificate-notAfter",
        "code": "certificate-window-expired",
        "outcome": "blocked-no-fetch-finish-or-replay"
      }
    },
    "nonAuthority": [
      "prearm-does-not-self-validate",
      "prearm-does-not-grant-authority",
      "prearm-does-not-reuse-beta7-artifact"
    ]
  },
  "negativeCases": [
    { "id": "gradle-test-or-compile-failure", "proof": "cooperative-source-and-packed" },
    { "id": "junit-malformed-stale-or-unsafe", "proof": "cooperative-source-and-packed" },
    { "id": "report-malformed-repeated-control-or-oversized", "proof": "report-ingress-source-and-packed" },
    { "id": "workflow-or-ralph-loop-missing-malformed-or-unsafe", "proof": "bootstrap-containment-source-and-packed" },
    { "id": "source-read-root-parent-leaf-alias-or-replacement", "proof": "native-source-read-source-and-packed" },
    { "id": "source-read-runtime-missing-invalid-or-unsupported", "proof": "native-source-read-source-and-packed" },
    { "id": "producer-outer-runner-nested-caller-root-parent-leaf-alias-or-replacement", "proof": "producer-workspace-topology-source-and-packed" },
    { "id": "default-finish-authority-negative", "proof": "cooperative-source-and-packed" },
    { "id": "artifact-identity-or-version-mismatch", "proof": "project-consumption-source" },
    { "id": "external-trust-unavailable", "proof": "doctor-source-and-packed" },
    { "id": "explicit-consumption-replay", "proof": "project-consumption-source" }
  ],
  "deterministicProofs": [
    { "id": "cooperative-source-and-packed", "surface": "source-built-and-packed-installed" },
    { "id": "report-ingress-source-and-packed", "surface": "source-built-and-packed-installed" },
    { "id": "bootstrap-containment-source-and-packed", "surface": "source-built-and-packed-installed" },
    { "id": "native-source-read-source-and-packed", "surface": "source-built-and-packed-installed-with-native-descriptor-open-audit" },
    { "id": "producer-workspace-topology-source-and-packed", "surface": "source-built-and-packed-installed-github-script-outer-runner-nested-caller-native-audit" },
    { "id": "project-consumption-source", "surface": "source-built-worker-seam" },
    { "id": "doctor-source-and-packed", "surface": "source-built-and-packed-installed" }
  ],
  "hostedResidual": {
    "id": "beta8-prearmed-external-live-original-artifact-verification",
    "evidence": [
      "staging-only-publish-and-registry-readback",
      "registry-installed-cooperative-finish",
      "current-version-original-signed-project-artifact",
      "one-fresh-download-and-independent-online-custom-predicate-verification-within-leaf-certificate-window",
      "explicit-consumption-and-replay-block"
    ]
  }
}