# v0.7.0-rc.8 Release Notes

## Source Preparation Boundary

`v0.7.0-rc.8` records an immutable source-preparation candidate. It does not
assert a current npm package, registry channel, Git tag, GitHub release,
provenance artifact, or audit outcome. Live lifecycle facts are maintained in
governed registry and audit records after separately authorized actions.

## Included Controls

- The package version is prepared as `0.7.0-rc.8` for a future staging-only
  prerelease decision.
- `.github/workflows/release.yml` is manual-only. A GitHub release can be
  created only through an explicit `ga-approved` dispatch for an existing
  stable tag that passes the fixed protected-main policy. Tag pushes cannot
  create a GitHub release.
- `.github/workflows/production-integrity-audit.yml` is a no-input,
  protected-main, read-only audit route. After an authorized staged lifecycle,
  it runs fixed source and exact registry-installed package checks, evaluates
  the fixed provenance command, and uploads a sanitized digest-bound summary.
- The audit summary records command IDs, expected and actual exits, source
  revision, package version, registry/subject/artifact digests, and
  sanitization confirmation. It never includes raw tarballs, bundles, URLs,
  logs, paths, or secrets.

## Boundaries

- Staging remains a separately approved action; a later `next` move remains a
  separate decision.
- Local or caller-provided staged-package evidence remains
  `artifact-provenance-unavailable`.
- The fixed online provenance verifier remains read-only:
  `promotionAuthorized:false`,
  `promotionDecision:"release-approval-required"`, and
  `registryMutation:"not-performed"`.
- This candidate does not publish, tag, release, move a dist-tag, invoke the
  producer or audit workflow, or change Finish or closure authority.