# v0.8.0-beta.29 Release Notes

## Hermetic Observer Contract

This package-visible procedure and contract candidate advances the Consumer
Authority Beta acceptance record to `0.8.0-beta.29`. It changes no Persona
Harness authority, Fetch, Finish, artifact transport, workflow runtime,
registry channel, tag, release, or fixture behavior.

`0.8.0-beta.28` is terminal, non-reusable procedure evidence. Its selector
reported only `selectorStage=package-record` on the real Ubuntu runner, which
was insufficient to distinguish record encoding, ownership, policy-primary,
ancillary, or lstat causes without exposing runner details.

`0.8.0-beta.25` is likewise terminal, non-reusable procedure evidence. It
precedes the workflow-owned observer-tool selection boundary and establishes no
current package, authority, Finish, or final-observer acceptance claim.

The package-visible
[`consumer-authority-beta29-acceptance.json`](consumer-authority-beta29-acceptance.json)
binds reviewed V4 procedure record SHA-256
`5389c027b21f72f325a5d9e467ecd4d150f672e14da1d04f51774602a284c57d`.
No local absolute record path is a source of truth.

## Explicit Tool And Cleanliness Rules

Each CI, publish, and release package-contract job first uses the fixed
`/usr/bin/dpkg-query` path to require installed `gh` status `ii` and the current
supported architecture. It then parses the package record as a bounded Buffer:
valid UTF-8, LF-only with at most one final LF, and no NUL, CR, blank, duplicate,
nonabsolute, or noncanonical record. It requires exactly the policy primary
`/usr/bin/gh` as a no-follow regular non-symlink executable and only the
documented non-executable completion sibling
`/usr/share/bash-completion/completions/gh`. Unknown/unsafe ancillary entries
and multiple qualified executables block. The selected tool is copied into a
private runner directory and only that copy reaches source-built, fresh-tar,
supplied-bundle, and grammar-preflight paths. Its bounded direct `--version`
result must be compatible with `>=2.96.0 <3.0.0`. No shell, PATH lookup,
literal runner path, download/install, credential fallback, or artifact
invocation is permitted.

Each direct version assessment runs with an explicit token-free state
environment rooted in the validated runner temporary directory. `HOME`, `gh`,
XDG, temporary, Git, and npm state variables never inherit the package-contract
checkout, so a normal `gh --version` cannot create consumer-local `.local`,
`.config`, or `.cache` state before the clean package contract runs.

The workflow selector produces one fixed nonreflective stage for environment,
package-list, package-record, source-assessment, private-reservation,
private-copy, private-assessment, or output-handoff; an unexpected internal
failure is `selector-internal`. Package-record blocks additionally carry only
one of `record-encoding`, `record-path`, `primary-missing`, `primary-unsafe`,
`ancillary-missing-or-unsafe`, `ancillary-unknown`, `executable-ambiguous`,
`lstat-failed`, or `canonical`. The source child maps only those allowlisted
stage and shape codes to the authoritative bundle parent. No raw executable
path, package record, stderr, token, URL, or artifact input is rendered into
the package contract.

The V4 final-observer procedure retains host-state isolation: all fifteen
external host-state roots stay outside the consumer realpath under `env -i` and
explicit tool requirements.
At baseline, source-bound preparation, credential handoff, observer child, and
immediately before push, it compares NUL-safe untracked and ignored Git status
with the stage-specific normalized `git clean -ndx` projection. Only the
reviewed runtime/build residues may exist. `.local`, `.config`, `.cache`, a
tracked modification, an unexpected residue, or an alias/replacement remains a
fail-closed block. Linux may add only `UV_USE_IO_URING=0` to the existing fixed
authority-fetch child environment; any other extra key or value remains
blocked.

## Deterministic Boundary And Residual

The source-built and fresh packed-installed contracts use the same qualified
workflow-selected observer-gh lifecycle, V4 evaluator, no-token grammar
preflight, fixed child diagnostics, package root binding, and no-source-fallback checks. They preserve
the public Java/Spring readiness route, privacy constraints, modeled
trusted/unconsumed authority, one Finish consumption, and replay block without
accessing a live artifact.

After normal gates, the sole remaining action is one separately authorized V4
fixture commit and normal push. The already prepared same consumer must then
immediately acquire and verify current original bytes online before the leaf
certificate `notAfter`, fetch once, consume Finish once, and prove immediate
replay rejection. It must not reset, reinitialize, switch consumers, change
CWD/HEAD/source/profile, or replace its isolated home/store after fetch.