# v0.8.0 Release Notes

## Consumer Authority, Generally Available

This is the first stable release of the 0.8.0 line. It carries the same tree as
`0.8.0-rc.1` and changes no Persona Harness authority, Fetch, Finish, artifact
transport, workflow runtime, observer, or fixture behavior.

What it changes is the channel: `latest` moves from `0.7.0` to `0.8.0`.

## What the release rests on

[`p3-integrity-roadmap.md`](../p3-integrity-roadmap.md) gates Stable, GA, and an
npm `latest` move behind four requirements. All four are met:

| requirement | met by |
| --- | --- |
| Level 2 trusted external attestation boundary | demonstrated end to end on 2026-08-09 against a separate public consumer repository producing its own GitHub-signed attestations |
| exact tag / version / main ancestry | `publish.yml`'s `tag-source` policy, on every publish in this line |
| registry readback | the post-publish step of `publish.yml` |
| a separate actual RC release cycle | `0.8.0-rc.1` on the `next` channel |

The Consumer Authority Beta audit issued `GO — Consumer Authority Beta` with
three conditions. The condition gating promotion past `staging` — deciding the
external-attested finish lifetime — was resolved: a workspace takes exactly one
external-attested finish, and the diagnostic, `ph history`, `workflow finish`,
and the walkthrough now all say so.

## What this release does not claim

- **Not an application-quality claim.** Persona Harness gates evidence, not the
  quality of the code an agent writes.
- **Not a broad reliability, efficacy, or token-saving claim.** Runtime
  injection remains measured negative and default-off.
- **Cooperative assurance is darwin and linux only.** The source-read boundary
  needs a native artifact that is not built for Windows. Every public command
  behaves identically on Windows and `ph doctor` states the scope, but a
  cooperative PASS is unavailable there. External attestation is.
- **The P3 hold is not closed by this release.** One boundary it named is now
  evidenced; the remaining items are not.

## Known limits carried forward

- The excluded fork event was not exercised externally — it needs a push from an
  account outside the project.
- The audit covered one project shape, one operator, one day. What it did and
  did not cover is recorded on issue #116.