# v0.4.0-rc.4 Release Notes

## Version

`v0.4.0-rc.4`

## Dist Tag

`next`

`0.4.0-rc.4` is a next-channel prerelease refresh after published
`@next=0.4.0-rc.3` remained behind the current runtime hook guard and
write-deny boundary work. Do not move `latest`.

## Summary

This release candidate refreshes the npm package candidate so users can install
the currently verified package surface:

- runtime hook guard levers from
  `3b3754d fix(runtime): add PH hook guard levers`;
- strict bootstrap mode clarity from
  `d53083c fix(cli): clarify strict bootstrap mode`;
- release tag/publish split from
  `bd9d0a8 ci: decouple tag pushes from npm publish`;
- write-deny SDK boundary clarification from
  `a72ed31 docs(runtime): clarify write deny boundary`;
- runtime hook package-surface smoke docs from
  `9318a65 docs: record a72ed31 runtime hook smoke`.

It is scoped product/package-surface evidence, not eval/A-B evidence, PH
superiority proof, generated app quality certification, broad architecture
correctness, general reliability, or a closure guarantee.

## Runtime Hook Guard Surface

- `experimental.chat.system.transform` injects an idempotent PH system
  constitution. This is still prose and may be ignored; finish, archive, and
  closure gates remain authoritative.
- `enforce.systemConstitution` defaults on.
- `enforce.idleContinuation` defaults off. When explicitly enabled, idle
  continuation may send one bounded `session.promptAsync` nudge for the same
  closure blocker. It is not orchestration, a full loop, or a hard stop.
- `enforce.writeDeny` remains off and is documented as a no-op in this runtime:
  the current OpenCode SDK `permission.ask` payload does not expose proposed
  write content, so PH cannot block writes mid-flight by content.
- Authoritative enforcement remains closure-time: finish/archive/closure gates,
  convention blockers, and opt-in direct verification.

## Strict Bootstrap

`ph bootstrap backend --strict` writes and prints:

- `executeVerification=true`;
- `systemConstitution=true`;
- `writeDeny=false`;
- `idleContinuation=false`.

Strict mode does not claim generated app product-quality certification or a
closure guarantee.

## Release Automation

Release automation now separates tag verification from npm publishing:

- tag pushes verify the package and create GitHub release notes only;
- npm publish is explicit, either local `npm publish --tag <dist-tag>` or
  GitHub Actions `workflow_dispatch` with `publish=true`;
- release-candidate packages use dist-tag `next`;
- do not move `latest` unless stable release approval is explicit.

## Evidence

External current/local tarball package-surface re-smoke PASS:

- source: fresh current local tarball from
  `a72ed31d9f644d054a5614a293c75e4367b7157d`
  (`a72ed31 docs(runtime): clarify write deny boundary`), not registry;
- included commits: `3b3754d`, `bd9d0a8`, and `d53083c`;
- package version in tarball: `0.4.0-rc.3` before this release-prep bump;
- tarball shasum: `542d3234d8590f28e516d428afb93f336cd88a81`;
- sha256: `52c5beff1f3b01a229f61a0f64814d14ddd5c16008bc4f1ba666b040392d1dea`;
- archive:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/runtime-hooks-a72ed31-package-surface-20260630-guard`;
- system constitution injected exactly once after repeated transform calls;
- `enforce.systemConstitution=false` disabled injection;
- system constitution stated that system prompt prose may be ignored and
  finish/archive gates remain authoritative;
- write-deny boundary was observed: `Write-deny is a no-op in this runtime`;
- Java Controller write hook still emitted a non-blocking write-guard warning,
  not a hard deny/rewrite claim;
- idle continuation default-off emitted no prompt, opt-in emitted exactly one
  bounded nudge for repeated same blocker, and no-blocker state emitted none;
- `bootstrap backend --strict` exited 0 and wrote/printed the strict config
  listed above;
- `ph observe --json` still emitted `controller.repository-dependency`.

This is current/local tarball package-surface evidence. It is not registry
`@next` behavior until `0.4.0-rc.4` is published and registry gitHead is
verified.

## Post-Publish Registry Facts

Observed after publish:

- `persona-harness@0.4.0-rc.4` exists on npm;
- registry gitHead: `c3e4c2bc2178e6edc72581a8d34aedd406be922b`;
- registry shasum: `7cecf41e5baf6ebf383ea82fd352ab0d8a686b23`;
- dist-tags: `next=0.4.0-rc.4`, `latest=0.3.9-alpha.8`,
  `alpha=0.3.9-alpha.8`;
- local `HEAD`, `origin/main`, local tag `v0.4.0-rc.4`, and origin tag
  `v0.4.0-rc.4` point to
  `c3e4c2bc2178e6edc72581a8d34aedd406be922b`.

This confirms the rc4 package is published under `next`. It does not move
`latest` and does not add eval/A-B proof, PH superiority, generated app
certification, broad architecture correctness, general reliability, or a closure
guarantee.

## Current-Tarball R1 Relay Preview Smoke

External package-surface/no-model relay preview smoke PASS:

- source: fresh local/current tarball from
  `12562195719745ed371320d04590c68037ab0b05`
  (`1256219 fix(cli): consume canonical relay test guidance`), not registry
  `@next`;
- registry `persona-harness@next` remains `0.4.0-rc.4` at gitHead
  `c3e4c2bc2178e6edc72581a8d34aedd406be922b`, so it does not include the R1
  relay preview commits until a later publish verifies a new gitHead;
- included commits: `3c0d675`, `2b452af`, `d46f698`, and `1256219`;
- package/version: `persona-harness@0.4.0-rc.4`;
- tarball:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/r1-relay-preview-1256219-package-surface-20260630-131649/persona-harness-0.4.0-rc.4.tgz`;
- npm shasum: `97ca79d47158b7e560f47c6255e01b382d63ba1d`;
- sha256: `70df6c1abedc08c50ad61ba9bca5523eb0f751140cd30734146485df371f590d`;
- archive:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/r1-relay-preview-1256219-package-surface-20260630-131649`;
- default/off fixture kept `multiAgent.enabled=false`, surfaced relay blocker
  `multi-agent-disabled`, and generated no three-role agent map or
  `.opencode/agent` dependency;
- preview fixture `bootstrap backend --multi-agent-preview` preserved existing
  `.opencode/opencode.json` plugin and custom agent fields, then added top-level
  `agent` entries for exactly `test-writer`, `jaeki`, and `roach` with
  `mode: subagent`;
- `test-writer` prompt references `.persona/rules/backend/spring-test.md`
  section `PH Multi-Agent Relay` and
  `packages/shared-skills/skills/programming/references/java/testing.md` section
  `Persona Harness relay contract`;
- `workflow relay status/next --json` exposes
  `enabled`, `action`, `currentTicket`, `closureBlocker`, `roleOrder`,
  `scopedInputs`, `nextRole`, `requiredArtifact`, `gateCommand`,
  `roleArtifacts`, and `blockers`;
- role progression is `test-writer` -> `jaeki` -> `roach` -> closure next via
  role artifact files;
- boundary regression: no model/OpenCode/eval run, no native subtask dispatch,
  no report auto-fill/archive, no finish gate weakening; finish remains blocked
  in template/pending-ticket state.

This is current/local tarball package-surface evidence only. It is not registry
`@next` behavior unless a later publish verifies registry gitHead. It does not
prove native subtask dispatch, OMO parity, token savings, autonomous completion,
model/OpenCode behavior, eval value, generated app quality, general reliability,
or closure guarantees.

## Current-Tarball R2 Relay Coordinator Smoke

External package-surface/no-model relay coordinator state smoke PASS:

- source: fresh local/current tarball from
  `4788135b01447f7cbfde3198abfcd45640893ce6`
  (`4788135 feat(cli): expand relay coordinator state`), not registry `@next`
  and not origin-only;
- registry `persona-harness@next` remains `0.4.0-rc.4` at gitHead
  `c3e4c2bc2178e6edc72581a8d34aedd406be922b`, so it does not include the R2
  relay coordinator commit until a later publish verifies a new gitHead;
- package/version: `persona-harness@0.4.0-rc.4`;
- tarball:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/r2-relay-coordinator-4788135-package-surface-20260630-133442/persona-harness-0.4.0-rc.4.tgz`;
- npm shasum: `826097d9ba5445a20d68b091f218af4e7fd208f6`;
- sha256: `c4be3eebda709de186ac269b35f6727ec85c825a5f26740e059a7d28520723f9`;
- archive:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/r2-relay-coordinator-4788135-package-surface-20260630-133442`;
- default/off fixture kept `multiAgent.enabled=false`, surfaced relay blocker
  `multi-agent-disabled`, reported `currentRole=null`,
  `requiredOutputArtifact=null`, and `roleCompletionState.overall=disabled`, and
  generated no relay agent entries or `.opencode/agent` dependency;
- preview fixture `bootstrap backend --multi-agent-preview` preserved
  `.opencode/opencode.json` plugin and custom agent fields, then exposed
  `test-writer`, `jaeki`, and `roach` with `mode: subagent`;
- `workflow relay status/next --json` includes `currentRole`,
  `roleCompletionState`, `scopedInputFiles`, `promptBlock`, and
  `requiredOutputArtifact`, plus the R1 fields;
- role progression remains read-only and artifact-gated:
  `test-writer` -> `jaeki` -> `roach` -> closure next, with role blockers and
  required artifacts;
- canonical Java guidance references are preserved in `promptBlock`/`promptLines`;
- finish still exits 1 in template report/evidence/pending-ticket state; there is
  no auto-fill, auto-archive, or finish gate weakening.

This is current/local tarball package-surface evidence only. It is not registry
`@next` behavior unless a later publish verifies registry gitHead. It does not
prove native subtask dispatch, OMO parity, token savings, autonomous completion,
model/OpenCode behavior, eval value, generated app quality, general reliability,
or closure guarantees.

## Current-Tarball R3b Relay Artifact Gate Smoke

External package-surface/no-model deterministic relay artifact gate smoke PASS:

- source: fresh local/current tarball from
  `7d9329449063888092f9a9a1a0141f94728c5e0e`
  (`7d93294 fix(cli): tighten relay role artifact gates`), not registry `@next`
  and not origin-only;
- package/version: `persona-harness@0.4.0-rc.4`;
- tarball:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/r3b-relay-artifact-gates-7d93294-package-surface-20260630-162610/persona-harness-0.4.0-rc.4.tgz`;
- npm shasum: `642a9d95fdff0892e089f3d449a193854e9e236c`;
- sha256: `5a39ecca7bfc05aa9f624cd87b8fd958bb36830401f1d7514acbb012fd399a4d`;
- archive:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/r3b-relay-artifact-gates-7d93294-package-surface-20260630-162610`;
- disabled/default state kept relay `enabled=false`, blocker
  `multi-agent-disabled`, and no unintended relay agent behavior;
- missing artifact state reports `role-test-artifact-missing`,
  `readiness=missing`, and reason `Role artifact is missing.`;
- incomplete/template-like artifacts block with `role-test-artifact-incomplete`,
  `role-implementation-artifact-incomplete`, and
  `role-review-artifact-incomplete`;
- boundary-violating artifacts block deterministically, including a test-writer
  artifact claiming product implementation, jaeki review-only prose, or roach
  implementation-only prose;
- valid artifacts progress read-only and artifact-gated:
  `test-writer` -> `jaeki` -> `roach` ->
  `npx ph workflow closure next --json`;
- complete state has `currentRole=null`, `nextRole=null`,
  `roleCompletionState.overall=complete`, `incompleteRoles=[]`, and
  `requiredOutputArtifact=null`;
- JSON includes `roleArtifacts[].readiness`, `roleArtifacts[].reason`, and
  `roleCompletionState.incompleteRoles`, plus the R2/R1 relay fields;
- canonical Java guidance references remain in the `test-writer` handoff/agent
  prompt;
- workflow archive and finish remain blocked in incomplete
  verification/report/evidence/pending-ticket state; there is no report
  auto-fill, ticket auto-archive, or finish/archive gate weakening.

This is current/local tarball package-surface evidence only. It is not registry
`@next` behavior unless a later publish verifies registry gitHead. It does not
prove native subtask dispatch, OMO parity, token savings, autonomous completion,
model/OpenCode behavior, eval value, generated app quality, general reliability,
or closure guarantees.

## Current-Tarball R4 Relay Validate Smoke

External package-surface/no-model relay validate smoke PASS:

- source: fresh local/current tarball from
  `ebc57dd2ae72c947255f472145291d424f5d2337`
  (`ebc57dd feat(cli): add relay artifact validator`), not registry `@next` and
  not origin-only;
- package/version: `persona-harness@0.4.0-rc.4`;
- tarball:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/r4-relay-validate-ebc57dd-package-surface-20260630-163930/persona-harness-0.4.0-rc.4.tgz`;
- npm shasum: `c02cfd8a666db066dac57b7a3d6cc2b5059ba230`;
- sha256: `8bd2d4f21ab28fe03992675b8349934cc13efe4ab8abddcb880fb4f1d1e3cf89`;
- archive:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/r4-relay-validate-ebc57dd-package-surface-20260630-163930`;
- `npx ph workflow relay validate --json` returns `action: validate` in
  disabled, missing, incomplete, and valid fixture states;
- disabled/default state reports `enabled=false` and blocker
  `multi-agent-disabled`;
- missing artifact state reports `role-test-artifact-missing`,
  `readiness=missing`, and reason `Role artifact is missing.`;
- missing-artifact validation is no-write: the roles directory remains absent
  before and after validate, and the work ticket file list is unchanged;
- incomplete/template `test-writer.md` reports `role-test-artifact-incomplete`,
  `readiness=incomplete`, and
  `roleCompletionState.incompleteRoles=[test-writer]`;
- incomplete validation is no-write: the artifact sha256 is unchanged before and
  after validate;
- valid artifacts report no role blockers, gate command
  `npx ph workflow closure next --json`, complete `roleCompletionState`, empty
  `incompleteRoles`, and `requiredOutputArtifact=null`;
- valid validation is no-write: all role artifact sha256 hashes are unchanged
  before and after validate;
- JSON includes readiness, reason, and incomplete role fields plus the prior relay
  fields;
- workflow archive and finish remain blocked in incomplete
  verification/report/evidence/pending-ticket state; there is no report
  auto-fill, ticket auto-archive, or finish/archive gate weakening.

This is current/local tarball package-surface evidence only. It is not registry
`@next` behavior unless a later publish verifies registry gitHead. It does not
prove native subtask dispatch, OMO parity, token savings, autonomous completion,
model/OpenCode behavior, eval value, generated app quality, general reliability,
or closure guarantees.

## Current-Tarball R5 Relay Validate Text Smoke

External package-surface/no-model relay validate text smoke PASS:

- source: fresh local/current tarball from
  `24f85001605b7c121f11a2933a3ebfd0453434a7`
  (`24f8500 feat(cli): add relay validate text mode`), not registry `@next` and
  not origin-only;
- package/version: `persona-harness@0.4.0-rc.4`;
- tarball:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/r5-relay-validate-text-24f8500-package-surface-20260630-165522/persona-harness-0.4.0-rc.4.tgz`;
- npm shasum: `022dd98f49e8d018800309213af6ea062be1af23`;
- sha256: `40b3ff2d0f2715754a4f58191d8a8a3083b55053bc4ecd22bc2c0509a9175496`;
- archive:
  `/Users/yongtae/Desktop/persona-harness-artifacts/archive/2026-06-24-desktop-persona-runs/r5-relay-validate-text-24f8500-package-surface-20260630-165522`;
- `ph workflow relay validate` human text works in missing, incomplete, and
  complete role-artifact states;
- missing text includes current ticket, current/next role, readiness, first
  blocker `role-test-artifact-missing`, required artifact, gate command,
  authoring hints, and read-only/no native dispatch/no artifact writes/PH closure
  gate boundary;
- incomplete text prints `role-test-artifact-incomplete` and reason;
- complete text prints all role artifacts complete, first blocker none, required
  artifact none, and gate command `npx ph workflow closure next --json`;
- `validate --json` remains compatible with `action: validate`, blockers,
  readiness, reason, `incompleteRoles`, and closure-next gate command for
  complete artifacts;
- no-write evidence remained intact: missing human validate did not create roles
  files, and incomplete/complete artifact hashes were unchanged;
- workflow archive and finish still block when closure blockers remain; there is
  no report auto-fill, ticket auto-archive, or finish/archive gate weakening.

This is current/local tarball package-surface evidence only. It is not registry
`@next` behavior unless a later publish verifies registry gitHead. It does not
prove native subtask dispatch, OMO parity, token savings, autonomous completion,
model/OpenCode behavior, eval value, generated app quality, PH superiority, broad
reliability, or closure guarantees.

## Eval Status

Eval remains stopped. `docs/current/injection-value-status.json` remains
`injection-effect-not-proven`.

Do not reinterpret old eval results, claim PH superiority, or use generated app
output as product-quality certification.

## Verification

Release-prep verification for this worktree:

```bash
npm test
npm run typecheck
npm run build
npm run check:docs
npm run smoke:product-mvp
npm pack --dry-run
git diff --check
```

Record the observed result in the release-prep report before publish.

Observed release-prep verification:

- `npm test`: PASS, 72 files / 503 tests.
- `npm run typecheck`: PASS.
- `npm run build`: PASS.
- `npm run check:docs`: PASS.
- `npm run smoke:product-mvp`: PASS.
- `git diff --check`: PASS.
- `npm pack --dry-run --json`: PASS.
  - filename: `persona-harness-0.4.0-rc.4.tgz`;
  - total files: `422`.
- `npm publish --dry-run --access public --tag next`: PASS.

## Publish Notes

- Preferred publish command after approval: `npm publish --tag next`.
- If npm requires OTP/2FA, stop after the first failure and hand off the exact
  command for the user to run.
- Do not move `latest`.
- Publish first, verify registry facts, then create and push `v0.4.0-rc.4`.

## Post-Publish Verification

After publish, verify:

```bash
npm view persona-harness@0.4.0-rc.4 version gitHead dist.shasum --json
npm dist-tag ls persona-harness
```