# v0.8.0-beta.17 Release Notes ## Source Preparation Boundary This document records the immutable `0.8.0-beta.17` Consumer Authority Beta source-preparation candidate. It makes no npm package, Git tag, dist-tag movement, GitHub release, original signed consumer artifact, promotion, Stable/GA, or Finish authority claim. `0.8.0-beta.16` is immutable staging-only evidence. Its final observer accepted an exit-zero GitHub API download without proving it wrote the expected ZIP bytes, so it stopped before ZIP validation. It is not reusable for beta.17 transport, authority, consumption, replay, or crypto evidence. ## Included Binding Contract The packaged [`consumer-authority-beta17-acceptance.json`](consumer-authority-beta17-acceptance.json) record defines the source and fresh installed package contract. It preserves the enrolled caller workflow as `.github/workflows/research-attestation.yml` on `refs/heads/main` and binds the signer separately to the Persona reusable workflow certificate SAN. The caller identity is never substituted for the reusable signer identity. The same record owns two versioned observer plans. The external `gh attestation verify` command plan renders exactly one `--repo` selector from the caller enrollment and one `--signer-workflow` plus `--signer-digest` from the reusable producer. The transport plan derives only the fixed GitHub API artifact endpoint from enrolled caller identity and exact artifact metadata. It reserves private no-follow output, streams an exact byte count and SHA-256, accepts at most one validated redirect with Authorization stripped, rejects empty/HTML/truncated/ oversize/unsafe ZIP output, and hands only a validated original ZIP and bundle to the command plan. Caller workflow/ref/source/run facts stay separate from reusable signer identity; no caller URL, headers, or output path is accepted. Before a fixture is authorized, the observer runs both installed no-token preflights: `preflight-consumer-authority-external-attestation.mjs --json` and `preflight-consumer-authority-external-artifact-transport.mjs --json`. They exercise only parser grammar and fixed topology/metadata sentinels; neither contacts an artifact, invokes crypto, fetches authority, consumes Finish, or retains credential, URL, headers, response bytes, or raw output. The source projection excludes only bootstrap-local `.persona/.ph-init-manifest.json` and workflow runtime state. The init manifest contains a per-consumer canonical real path and is product ownership metadata, not caller project source. The project profile, Gradle descriptors, Git source identity, reports, and evidence remain bound. A mismatched caller, reusable SHA/SAN, repository, source, run, digest, archive, stale record, or replay remains blocked without retaining authority. Before a future fixture, the package must still prove this public Java/Spring consumer readiness route: ```text ph bootstrap backend --strict --no-developer-mcp ph bearshell ./gradlew test ph bearshell ./gradlew compileJava ph bearshell ./gradlew clean ph evidence read README.md ph evidence read .persona/project-profile.jsonc ph evidence read src/main/java//.java | ph plan --report-filled implementation --stdin | ph plan --report-filled review --stdin ph workflow finish implement ``` An uninitialized `ph workflow finish implement` is a nonzero `workflow-state-uninitialized` block. After the public bootstrap route, the default Finish must be blocked only by `trusted-authority-required`; it must not retain lifecycle readiness blockers. Source-built and fresh packed-installed deterministic models prove a verified fetch remains unconsumed until one explicit Finish consumes it, followed by an immediate replay block. The model is not a signed artifact, online crypto result, or authority claim. The package proof invokes plain `npm` only from its already bound detached checkout; `npm --prefix ... pack` is forbidden. Its prepack runner derives the package root from its own script location rather than a nested npm command. The portable `package-content-identity.1` projects sorted safe package-relative regular members, allowed mode, size, and per-member SHA-256. It is the cross-environment package comparison. A raw tarball SHA-256 is valid only for the one canonical supplied tarball or the registry blob read back after publication; independent normal `npm pack` byte equality is not claimed. The publisher pins Node `20.19.0` and npm `10.8.2`, isolates npm/Git state, normalizes the one canonical tarball, and publishes that exact file. Registry readback must bind both its raw bytes/integrity and portable identity to those frozen facts. Retained beta.16/beta.17 tar aggregates are diagnostic-only: their normalized headers do not explain the observed content/mode deltas and they are not package acceptance evidence. One authoritative-bundle command requires an explicit canonical candidate branch ref, accepts a `HEAD` alias only when it names that same candidate SHA, materializes fresh target and base checkouts, rejects a stale launcher before pack, verifies resolved manifest and lock paths, and runs the built source CLI plus fresh installed consumer package exercise against the exact canonical target tarball SHA-256 and content identity. The package exercise uses the same consumer-contract executable but deliberately omits only the real Java/Gradle fixture when the packaging host does not provision Java and Gradle. The full source-built and fresh-installed Java/Spring/Gradle contract remains a separate required run on a provisioned Java/Gradle host; the package exercise does not claim that real Gradle verification occurred. ## Required Live Evidence After protected integration, a separately authorized lifecycle may create the matching `v0.8.0-beta.17` tag and publish once to `staging`. Before one natural current-version fixture push, an independent observer must prepare an isolated exact registry installation, enrollment/status/explain, observer credential preflight, the no-token attestation and transport command-plan preflights, and the authority-only public readiness route. Only after the natural fixture produces a current-version original artifact may the observer acquire it through the fixed transport plan, compare exact byte count/SHA-256 and safe ZIP members, verify online inside the certificate window, run real installed authority fetch, consume Finish once, and verify immediate replay rejection. The pre-fixture gate downloads no artifact and grants no authority.