# v0.8.22 Release Notes

## Historical package authority

`0.8.22` was prepared with a root package, lockfile, private shared-skills
package, and `consumer-authority-v0822-acceptance.json` bound to the same
version. It is now immutable published history. The current source candidate
is `0.8.23`; this record cannot authorize a replacement publish.

## Authority verify digest normalization

The installed read-only `ph authority verify` command accepts either its
canonical `sha256:<64hex>` archive digest or an exact raw 64-character
SHA-256 hex value. Raw input is normalized before archive comparison, so both
forms bind the same tuple and retain the existing no-follow, enrollment,
source, crypto, and non-consuming boundaries.

Partial tuples, invalid sizes or characters, unsupported algorithms, duplicate
flags, symlink archives, and tuple mismatches still block before verifier,
store, fetch, Finish, or replay.

## Release boundary

The historical candidate required fresh Source and Package gates to bind its
canonical tar before protected integration, stable Release, and one npm
`latest` publication. Subsequent release candidates require their own current
version authority and independent evidence.