# v0.8.0-beta.15 Release Notes

## Source Preparation Boundary

This document records the immutable `0.8.0-beta.15` Consumer Authority Beta
source-preparation candidate. It makes no npm package, Git tag, dist-tag
movement, GitHub release, original signed consumer artifact, promotion,
Stable/GA, or Finish authority claim.

`0.8.0-beta.14` is historical staging-only evidence. Its current original
artifact bytes, DSSE/Sigstore/TUF/Rekor bindings, caller/reusable/source/run
bindings, and installed authenticated fetch all passed. The final disposable
consumer then lacked initialized workflow state, so public Finish exited as an
advisory no-op and did not consume. That observation is not reusable for
beta.15 authority, consumption, or replay evidence.

## Included Binding Contract

The packaged
[`consumer-authority-beta15-acceptance.json`](consumer-authority-beta15-acceptance.json)
record defines the source and fresh installed package contract. It preserves
the enrolled caller workflow as
`.github/workflows/research-attestation.yml` on `refs/heads/main` and binds
the signer separately to the Persona reusable workflow certificate SAN. The
caller identity is never substituted for the reusable signer identity.

The source projection excludes only bootstrap-local
`.persona/.ph-init-manifest.json` and workflow runtime state. The init manifest
contains a per-consumer canonical real path and is product ownership metadata,
not caller project source. The project profile, Gradle descriptors, Git source
identity, reports, and evidence remain bound. A mismatched caller, reusable
SHA/SAN, repository, source, run, digest, archive, stale record, or replay
remains blocked without retaining authority.

Before a future fixture, the package must still prove this public Java/Spring
consumer readiness route:

```text
ph bootstrap backend --strict --no-developer-mcp
ph bearshell ./gradlew test
ph bearshell ./gradlew compileJava
ph bearshell ./gradlew clean
ph evidence read README.md
ph evidence read .persona/project-profile.jsonc
ph evidence read src/main/java/<package>/<role>.java
<substantive implementation report> | ph plan --report-filled implementation --stdin
<substantive review report> | ph plan --report-filled review --stdin
ph workflow finish implement
```

An uninitialized `ph workflow finish implement` is a nonzero
`workflow-state-uninitialized` block. After the public bootstrap route, the
default Finish must be blocked only by `trusted-authority-required`; it must
not retain lifecycle readiness blockers. Source-built and fresh packed-installed
deterministic models prove a verified fetch remains unconsumed until one
explicit Finish consumes it, followed by an immediate replay block. The model
is not a signed artifact, online crypto result, or authority claim.

The package proof invokes plain `npm` only from its already bound detached
checkout; `npm --prefix ... pack` is forbidden. Its prepack runner derives the
package root from its own script location rather than a nested npm command.
One authoritative-bundle command requires an explicit canonical candidate
branch ref, accepts a `HEAD` alias only when it names that same candidate SHA,
materializes fresh target and base checkouts, rejects a stale launcher before
pack, verifies resolved manifest and lock paths, and runs the built source CLI
plus fresh installed consumer package exercise against the exact target tarball
SHA-256. The package exercise uses the same
consumer-contract executable but deliberately omits only the real Java/Gradle
fixture when the packaging host does not provision Java and Gradle. The full
source-built and fresh-installed Java/Spring/Gradle contract remains a separate
required run on a provisioned Java/Gradle host; the package exercise does not
claim that real Gradle verification occurred.

## Required Live Evidence

After protected integration, a separately authorized lifecycle may create the
matching `v0.8.0-beta.15` tag and publish once to `staging`. Before one natural
current-version fixture push, an independent observer must prepare an isolated
exact registry installation, enrollment/status/explain, observer credential
preflight, and the authority-only public readiness route.

Only after the natural fixture produces a current-version original artifact may
the observer verify original bytes online inside the certificate window, run
real installed authority fetch, consume Finish once, and verify immediate
replay rejection. The pre-fixture gate downloads no artifact and grants no
authority.