# v0.4.0-rc.3 Release Notes

## Version

`v0.4.0-rc.3`

## Dist Tag

`next`

`0.4.0-rc.3` is a next-channel prerelease refresh for the GUARD Phase 0-3
package surface. Do not move `latest`.

## Summary

This release candidate refreshes the published `@next` package so users can
install the currently verified GUARD behavior:

- strict backend bootstrap from `c499169 fix(cli): add strict backend bootstrap`;
- registry blocker iteration from `b7b5c45 fix(cli): iterate registry convention blockers`;
- BYO `.persona/conventions/*.yml` ast-grep preview from
  `a9bf926 fix(cli): support ast-grep conventions`;
- BYO ast-grep observe alignment from
  `1c304e4 fix(cli): emit ast-grep observe findings`;
- runtime hook guard levers from
  `3b3754d fix(runtime): add PH hook guard levers`;
- strict bootstrap mode clarification from
  `d53083c fix(cli): clarify strict bootstrap mode`;
- tag/publish split docs/workflow fix from
  `bd9d0a8 ci: decouple tag pushes from npm publish`.

It is scoped product enforcement behavior, not eval/A-B evidence, PH
superiority proof, generated app quality certification, broad architecture
correctness, general reliability, or a closure guarantee.

## GUARD Refresh

- Phase 0 remains opt-in: `.persona/harness.jsonc`
  `enforce.executeVerification: true` makes PH-run direct verification
  authoritative in the supported Java/Spring/Gradle slice. It may run commands
  and carries toolchain/time cost.
- Phase 1 supports convention levels `report`, `warn`, and `block`.
  `controller.repository-dependency` remains the scoped hard blocker path for
  ready Java/Spring service-layer projects.
- Phase 2 remains warning-only at write time because the current hook surface
  does not support hard write-content deny/rewrite. Closure-time enforcement is
  authoritative.
- Phase 3 centralizes convention id, default level, blocker id, step id, fix
  path, `blockAllowed`, and `highPrecision` metadata across observe, check,
  closure, continue, finish, archive, and write-warning surfaces.

## BYO Ast-Grep Preview

- BYO `.persona/conventions/*.yml` ast-grep convention preview is implemented
  for simple YAML metadata, not a broad YAML ecosystem.
- The included ast-grep convention is `controller.persistence-import`.
- Registry size is 2 conventions, including 1 ast-grep convention.
- `block` can hard block only for high-precision, block-allowed conventions
  with a fix path. `warn` and `report` are non-hard-blocking.
- If `sg` / `ast-grep` is absent, ast-grep checks skip with a warning instead
  of crashing or faking a pass.
- `ph observe --json` now emits `controller.persistence-import` with
  `source=ast-grep`, `checkKind=ast-grep`, `filePath`, `line`, evidence message,
  and `fixPath`.
- Workflow check/closure/continue align on
  `architecture-controller-persistence-import`, step
  `fix-controller-persistence-import`, and the Service/DTO fix path.
- Finish/archive block for level `block`; compliant fixtures have no BYO
  blocker and finish 0.

## Evidence

External targeted current-tarball package-surface re-smoke PASS:

- HEAD: `1c304e412093dd0621d911ce379ef3f66ea7f224`;
- package version: `0.4.0-rc.2` before this release-prep bump;
- tarball:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/current-head-1c304e4-ast-grep-observe-resmoke-20260630-100023/pack/persona-harness-0.4.0-rc.2.tgz`;
- shasum: `5f1047f47fb07fda7dce3d8b9cc58f7557a46dec`;
- sha256: `e25571678cd53db525f2af8796f0270c707127bb5355feb0b32640eced0dc566`;
- archive:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/current-head-1c304e4-ast-grep-observe-resmoke-20260630-100023`.

This is current-tarball package-surface evidence. It is not registry `@next`
evidence until `0.4.0-rc.3` is published and verified.

External runtime hook guard package-surface re-smoke PASS:

- source: fresh current local tarball from clean HEAD
  `a72ed31d9f644d054a5614a293c75e4367b7157d`
  (`a72ed31 docs(runtime): clarify write deny boundary`), not registry;
- included commits: `3b3754d`, `d53083c`, and `bd9d0a8`;
- package version in tarball: `0.4.0-rc.3`;
- tarball shasum: `542d3234d8590f28e516d428afb93f336cd88a81`;
- sha256: `52c5beff1f3b01a229f61a0f64814d14ddd5c16008bc4f1ba666b040392d1dea`;
- archive:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/runtime-hooks-a72ed31-package-surface-20260630-guard`;
- system constitution imported from installed package root export and injected
  `[Persona Harness System Constitution]` exactly once after repeated transform
  calls;
- system constitution injected exactly once and can be disabled with
  `enforce.systemConstitution=false`;
- system constitution is still prose and may be ignored; finish/archive/closure
  gates remain authoritative;
- updated write-deny boundary observed: `Write-deny is a no-op in this runtime`.
  OpenCode `permission.ask` lacks proposed write content, PH cannot block writes
  mid-flight by content, and enforcement is closure-time, not write-time;
- write guard remains non-blocking warning; no hard deny/rewrite is claimed;
- idle continuation is default-off; when opted in, it emits one bounded
  `session.promptAsync` nudge for repeated same blocker, while no-blocker state
  emits none. It is not orchestration, a full loop, or a hard stop;
- `bootstrap backend --strict` writes/prints strict config:
  `executeVerification=true`, `systemConstitution=true`, `writeDeny=false`, and
  `idleContinuation=false`, with no product-quality or closure guarantee wording;
- cheap regression: `ph observe --json` still emitted
  `controller.repository-dependency`.

This is current/local tarball package-surface evidence. It is not registry
`@next` behavior unless publish verification confirms the registry gitHead.

## Eval Status

Eval remains stopped. `docs/current/injection-value-status.json` remains
`injection-effect-not-proven`.

Do not reinterpret old eval results, claim PH superiority, or use generated app
output as product-quality certification.

## Verification

Release-prep verification for this worktree:

```bash
npm test
npm run typecheck
npm run build
npm run check:docs
npm run smoke:product-mvp
npm pack --dry-run
git diff --check
```

Record the observed result in the release-prep report before publish.

## Publish Notes

- Preferred publish command after approval: `npm publish --tag next`.
- If npm requires OTP/2FA, stop after the first failure and hand off the exact
  command for the user to run.
- Do not move `latest`.
- Create and push `v0.4.0-rc.3` only after registry verification confirms
  `persona-harness@0.4.0-rc.3` exists with the release prep commit as gitHead.

## Post-Publish Verification

After publish, verify:

```bash
npm view persona-harness@0.4.0-rc.3 version gitHead dist.shasum --json
npm dist-tag ls persona-harness
```