# v0.4.0-rc.2 Release Notes

## Version

`v0.4.0-rc.2`

## Dist Tag

`next`

`0.4.0-rc.2` is a next-channel prerelease vehicle for GUARD Phase 0-3. Do not
move `latest`.

## Summary

This release candidate packages the current GUARD Phase 0-3 commits after the
published `0.4.0-rc.1 @next` package:

- `c2819ac fix(cli): add opt-in direct verification gate`;
- `ffeafa9 fix(cli): support convention blocker levels`;
- `2f561a0 fix(runtime): warn on write-time convention violations`;
- `7fda771 refactor(cli): add convention registry`.

It is scoped product enforcement behavior, not eval/A-B evidence, PH
superiority proof, generated app quality certification, broad architecture
correctness, general reliability, or a closure guarantee.

## GUARD Phase 0-3

Phase 0: opt-in direct verification gate.

- `.persona/harness.jsonc` can set `enforce.executeVerification: true`.
- In the initial supported Java/Spring/Gradle slice, PH-run direct verification
  such as `gradlew test` / JUnit evidence is authoritative for PASS/FAIL.
- Agent-written report prose or fake passed evidence JSON is not authoritative
  under the opt-in gate.
- Disabled mode keeps the existing structured bearshell evidence flow.
- The opt-in gate may run commands and carries toolchain/time cost.

Phase 1: convention levels.

- Conventions can be `report`, `warn`, or `block`.
- `controller.repository-dependency` remains the scoped hard blocker path for
  ready Java/Spring service-layer projects.
- The blocker id is `architecture-controller-repository-direct-dependency`.
- Report/warn conventions do not hard-block, and other backend-shape WARNs are
  not broadly promoted to enforcement.

Phase 2: write-time guard.

- Runtime write-time convention feedback is warning-only because the current
  hook result type does not support hard deny/rewrite.
- Do not describe Phase 2 as hard enforcement.

Phase 3: convention registry.

- The registry centralizes convention id, default level, blocker id, step id,
  fix path, `blockAllowed`, and `highPrecision` metadata across observe, check,
  closure, continue, finish, archive, and write-warning surfaces.
- `b7b5c45 fix(cli): iterate registry convention blockers` moves architecture
  convention closure blockers through structured registry/config lookup instead
  of one hard-coded Controller rule path.
- `controller.repository-dependency` remains the first/default block-capable
  convention. `block` creates closure/archive/finish blockers; `warn` and
  `report` do not hard-block.
- Unsafe or low-precision rules must not become hard blockers.
- `a9bf926 fix(cli): support ast-grep conventions` adds BYO
  `.persona/conventions/*.yml` ast-grep convention preview support. Current
  registry size is 2 conventions, including 1 ast-grep convention:
  `controller.persistence-import`.
- If `sg` / `ast-grep` is absent, ast-grep checks skip with a warning instead
  of faking a pass.
- `1c304e4 fix(cli): emit ast-grep observe findings` resolves the previous BYO
  observe gap. External current-tarball package-surface re-smoke PASS:
  `ph observe --json` emits `controller.persistence-import` with
  `source=ast-grep`, `checkKind=ast-grep`, `filePath`, `line`, evidence message,
  and `fixPath`; workflow check/closure/continue align on
  `architecture-controller-persistence-import`, step
  `fix-controller-persistence-import`, and the Service/DTO fix path.
- This is fresh current tarball evidence for HEAD
  `1c304e412093dd0621d911ce379ef3f66ea7f224`, not registry `@next` evidence
  unless a later release publishes these commits. Smoke tarball:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/current-head-1c304e4-ast-grep-observe-resmoke-20260630-100023/pack/persona-harness-0.4.0-rc.2.tgz`;
  shasum `5f1047f47fb07fda7dce3d8b9cc58f7557a46dec`.
- BYO support is simple YAML metadata preview support, not a broad YAML
  ecosystem or broad architecture correctness claim.

## Evidence

QA and package-surface evidence were collected on current HEAD
`7fda771f74008f42082c3a85377262c8fc7ccf5f`.

- QA: focused 134 tests PASS; full `npm test` 70 files / 486 tests PASS;
  typecheck PASS; build PASS; product smoke PASS; built CLI smoke PASS.
- External Smoke package-surface: fresh current HEAD tarball, not registry.
  - tarball:
    `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/current-head-7fda771-guard-package-surface-smoke-20260630-001558/pack/persona-harness-0.4.0-rc.1.tgz`;
  - shasum: `b703953aab409f1cd7ac578c5af76b3d3e42cf90`;
  - sha256: `2155ac28c48367c85d2a4163ba56ecea5dd1842b1d0e0935313c665ab9d55b7c`;
  - archive:
    `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/current-head-7fda771-guard-package-surface-smoke-20260630-001558`.

This is not published `0.4.0-rc.2` registry evidence until this version is
published and verified.

## Eval Status

Eval remains stopped. `docs/current/injection-value-status.json` remains
`injection-effect-not-proven`.

Do not reinterpret old eval results, claim PH superiority, or use generated app
output as product-quality certification.

## Verification

Release-prep verification for this worktree:

```bash
npm test
npm run typecheck
npm run build
npm run check:docs
npm run smoke:product-mvp
npm pack --dry-run
git diff --check
```

Record the observed result in the release-prep report before publish.

## Publish Notes

- Preferred publish command after approval: `npm publish --tag next`.
- If npm requires OTP/2FA, stop after the first failure and hand off the exact
  command for the user to run.
- Do not move `latest`.
- Create and push `v0.4.0-rc.2` only after registry verification confirms
  `persona-harness@0.4.0-rc.2` exists with the release prep commit as gitHead.

## Post-Publish Verification

After publish, verify:

```bash
npm view persona-harness@0.4.0-rc.2 version gitHead dist.shasum --json
npm dist-tag ls persona-harness
```