# v0.8.0-beta.1 Release Notes

## Source Preparation Boundary

This document records the immutable `0.8.0-beta.1` Consumer Authority Beta
source candidate. At candidate creation, it does not assert a published npm
package, Git tag, GitHub release, registry channel, staging provenance
artifact, promotion, Stable/GA state, `latest` movement, or Finish authority.
Those live facts belong only to governed registry and audit evidence after the
separate approved lifecycle.

## Included Source Controls

- The package version is strict prerelease SemVer `0.8.0-beta.1`.
- The manual publish workflow accepts only an existing exact `v0.8.0-beta.1`
  tag that resolves to the dispatched protected-main commit. It permits this
  prerelease only with `staging` and `staging-only`; `latest` is invalid and a
  later `next` movement requires separate `next-promotion-approved` approval.
- Publish readback independently binds the fixed npm package/version, selected
  channel, gitHead, SHA-1, SRI, and downloaded tarball SHA-256 without
  treating generic npm signature output as provenance. Its sanitized JSON is
  retained as a versioned Actions artifact with the upload artifact digest.
- The packaged `ph authority` surface has explicit user-scoped public GitHub
  enrollment and original-artifact fetch commands. A `GH_TOKEN` or
  `GITHUB_TOKEN` credential authenticates fixed public Actions reads only and
  never supplies identity or gets forwarded to artifact-storage redirects.
  The surface never accepts caller-local evidence as authority and never
  consumes Finish authority.

## Required Live Evidence

After protected integration, the separately authorized lifecycle must create
the exact tag and publish the immutable package to `staging`, then retain
sanitized Actions evidence for registry readback, fresh exact registry install,
the staged exact-artifact producer/verifier, and the separate cooperative and
external-attested consumer fixtures. The external-attested fixture must use
original signed project bytes and independent verification. Forged, copied,
wrong-identity, drifted, replayed, expired, zero/all-skipped, malformed,
unsafe, and offline inputs remain nonzero.

## Mutation Boundary

This source candidate does not publish, tag, release, move a dist-tag, dispatch
workflows, use registry credentials, or grant Finish/closure authority.