# v0.8.0-beta.14 Release Notes

## Source Preparation Boundary

This document records the immutable `0.8.0-beta.14` Consumer Authority Beta
source-preparation candidate. It makes no npm package, Git tag, dist-tag
movement, GitHub release, original signed consumer artifact, promotion,
Stable/GA, or Finish authority claim.

`0.8.0-beta.13` is historical staging-only evidence. Its current original
artifact bytes, DSSE/Sigstore/TUF/Rekor bindings, caller/source/run bindings,
and online certificate-window verification passed. Installed product fetch did
not retain authority because the consumer source projection included the
bootstrap-local `.persona/.ph-init-manifest.json` real-path metadata. That
observation is not reusable for beta.14 authority, consumption, or replay
evidence.

## Included Binding Contract

The packaged
[`consumer-authority-beta14-acceptance.json`](consumer-authority-beta14-acceptance.json)
record defines the source and fresh installed package contract. It preserves
the enrolled caller workflow as
`.github/workflows/research-attestation.yml` on `refs/heads/main` and binds
the signer separately to the Persona reusable workflow certificate SAN. The
caller identity is never substituted for the reusable signer identity.

The source projection excludes only bootstrap-local
`.persona/.ph-init-manifest.json` and workflow runtime state. The init manifest
contains a per-consumer canonical real path and is product ownership metadata,
not caller project source. The project profile, Gradle descriptors, Git source
identity, reports, and evidence remain bound. A mismatched caller, reusable
SHA/SAN, repository, source, run, digest, archive, stale record, or replay
remains blocked without retaining authority.

Before a future fixture, the package must still prove this public Java/Spring
consumer readiness route:

```text
ph bootstrap backend --strict --no-developer-mcp
ph bearshell ./gradlew test
ph bearshell ./gradlew compileJava
ph bearshell ./gradlew clean
ph evidence read README.md
ph evidence read .persona/project-profile.jsonc
ph evidence read src/main/java/<package>/<role>.java
<substantive implementation report> | ph plan --report-filled implementation --stdin
<substantive review report> | ph plan --report-filled review --stdin
ph workflow finish implement
```

The final default Finish must be blocked only by
`trusted-authority-required`; it must not retain lifecycle readiness blockers.
Source-built and fresh packed-installed deterministic models prove a verified
fetch remains unconsumed until one explicit Finish consumes it, followed by an
immediate replay block. The model is not a signed artifact, online crypto
result, or authority claim.

## Required Live Evidence

After protected integration, a separately authorized lifecycle may create the
matching `v0.8.0-beta.14` tag and publish once to `staging`. Before one natural
current-version fixture push, an independent observer must prepare an isolated
exact registry installation, enrollment/status/explain, observer credential
preflight, and the authority-only public readiness route.

Only after the natural fixture produces a current-version original artifact may
the observer verify original bytes online inside the certificate window, run
real installed authority fetch, consume Finish once, and verify immediate
replay rejection. The pre-fixture gate downloads no artifact and grants no
authority.