# v0.8.0-beta.19 Release Notes

## Source Correction Boundary

This document records the `0.8.0-beta.19` Consumer Authority Beta source
candidate. It makes no npm publication, tag, dist-tag movement, GitHub release,
original signed consumer artifact, promotion, Finish authority, or issue closure
claim.

`0.8.0-beta.18` is immutable staging evidence and is not reused. Its registry
package matched the canonical version, selected tag, SHA-1, SRI, raw SHA-256,
and portable package-content identity, but the workflow blocked only because it
required an npm version-metadata `gitHead` field that was not exposed.

## Workflow-Bound Registry Reconciliation

The beta19 release contract preserves the protected-main/tag preflight and the
Node `20.19.0`/npm `10.8.2` canonical packer followed by the isolated Node
`24.18.0`/npm `11.16.0` publisher. It binds the source commit before package
facts exist, then publishes only the exact canonical tarball.

After a hosted registry PUT, the postpublish checker requires all of the
following:

1. the expected version and selected dist-tag;
2. registry SHA-1 and SRI matching the downloaded registry tarball;
3. downloaded raw tarball SHA-256 and `package-content-identity.1` matching
   the frozen canonical package facts; and
4. the workflow source head reported as
   `workflow-verified-canonical-tar`, rather than a claimed registry `gitHead`.

Unsupported or hostile metadata `gitHead` values are ignored and never rendered.
If reconciliation blocks, the workflow retains a bounded sanitized readback in
a fixed runner-temp path and uploads it with `if: always()` before ending the
job nonzero. It never exposes raw registry responses, credentials, signed URLs,
or package paths.

The current package retains
`preflight-consumer-authority-observer.mjs`,
`preflight-consumer-authority-external-attestation.mjs`, and
`preflight-consumer-authority-external-artifact-transport.mjs` as no-token,
no-artifact preparation only. Their bounded parser and credential-isolation
checks do not substitute for registry reconciliation, online crypto, authority,
Finish consumption, or replay evidence.

## Required Live Evidence

After protected integration, the sole package-publish residual is one npm
Trusted Publishing registry PUT for beta19 followed by the bounded readback
above. Only after that distinct immutable package observation is independently
accepted may later consumer authority and fixture evidence use beta19.