p-dev-harness 0.3.0 → 0.3.1

package/workspace-snapshot/files/docs/releases/release-process.md

@@ -0,0 +1,272 @@
+# Release process
+
+Operator guide for harness releases: GitHub source release plus public npm package `p-dev-harness`.
+
+**Related:** [`v0.3.1.md`](v0.3.1.md) (current release contract), [`v0.3.0.md`](v0.3.0.md) (historical), [`CHANGELOG.md`](../../CHANGELOG.md), [`docs/p-dev.md`](../p-dev.md)
+
+## Variables
+
+Use these placeholders throughout:
+
+| Variable | Example | Meaning |
+|----------|---------|---------|
+| `VERSION` | `0.3.1` | SemVer package/root version |
+| `TAG` | `v0.3.1` | Annotated git tag |
+| `RELEASE_SHA` | merge commit on `main` | Exact post-merge release commit |
+| `TARBALL` | `packages/p-dev/p-dev-harness-0.3.1.tgz` | Exact npm publish artifact |
+
+## Summary
+
+The release process has distinct phases:
+
+1. **Release-preparation PR** — versions, docs, tests, release contract (no tag/npm/release mutations)
+2. **Embedded workspace snapshot validation** — deterministic snapshot/manifest generation from clean `RELEASE_SHA` checkout
+3. **Exact tarball validation** — build and smoke-test `TARBALL` at `RELEASE_SHA`
+4. **npm publication** — publish the exact validated tarball
+5. **Annotated git tag** — primary `TAG` at `RELEASE_SHA`
+6. **GitHub release** — curated notes from `docs/releases/v<VERSION>.md`
+7. **Post-release finalization PR** — record immutable tag/npm evidence
+
+Do **not** push directly to `main`, force-push, overwrite tags, or republish npm versions.
+
+### Legacy template containment (v0.3.0 only)
+
+`weston-uribe/p-dev-harness-template` is a **frozen legacy compatibility artifact** for `p-dev-harness@0.3.0` template-based provisioning.
+
+For **0.3.1 and later**:
+
+- Do **not** advance, repurpose, or resync the template repository `main` branch for new package versions.
+- Do **not** move or recreate the existing template `v0.3.0` tag.
+- Snapshot transparency comes from the primary repository release commit plus the npm tarball `workspace-snapshot/manifest.json`.
+
+---
+
+## Phase 1 — Release-preparation PR
+
+Merge to `main`:
+
+- Version bumps (`VERSION` root, `p-dev-harness@VERSION`)
+- `CHANGELOG.md`, `docs/releases/v<VERSION>.md`, truth-audit docs
+- Package publication metadata and tests
+- Validation on the PR branch
+
+**Do not run during the release-prep PR:**
+
+- `git tag`, `git push` (tags)
+- `npm publish`
+- `gh release create`
+- Live remote setup mutations against production destinations
+
+---
+
+## Phase 2 — Embedded workspace snapshot validation
+
+After primary release-prep PR merges:
+
+1. Record `RELEASE_SHA` (merge commit on `main`)
+2. From a **clean checkout** at `RELEASE_SHA`, run:
+
+```bash
+git checkout "$RELEASE_SHA"
+npm ci
+npm run build
+npm run package:p-dev:prepare
+npm run package:p-dev:pack
+```
+
+Package preparation requires a clean working tree with `HEAD` equal to `RELEASE_SHA`. Do **not** use `P_DEV_SNAPSHOT_SOURCE_REF`.
+
+3. Inspect `packages/p-dev/workspace-snapshot/manifest.json`:
+   - `packageVersion` matches `packages/p-dev/package.json`
+   - `sourceCommit` equals `RELEASE_SHA`
+   - `snapshotSha256`, `snapshotContentId`, and `gitRootTreeSha1` are present
+4. Inspect the packed tarball:
+   - Contains `package/workspace-snapshot/manifest.json` and curated `package/workspace-snapshot/files/**`
+   - Excludes local secrets, operator state, generated caches, and unrelated generated package outputs
+5. Record tarball byte size and SHA-256 for release evidence
+
+**Do not** mutate `weston-uribe/p-dev-harness-template` for 0.3.1+ releases.
+
+---
+
+## Phase 3 — npm preflight
+
+Before publication:
+
+```bash
+npm config get registry
+npm whoami --registry=https://registry.npmjs.org/
+npm view p-dev-harness --registry=https://registry.npmjs.org/ --json
+npm view p-dev-harness@VERSION --registry=https://registry.npmjs.org/ --json
+```
+
+**Stop** if:
+
+- Not authenticated or not authorized to publish
+- `p-dev-harness@VERSION` already exists with **different bytes** than the intended `TARBALL`
+- Package name is owned by someone else
+
+If `p-dev-harness@VERSION` already exists with **identical bytes**, treat npm publication as complete and reconcile tag/release against the same `RELEASE_SHA`.
+
+Never print tokens, OTPs, or secrets.
+
+---
+
+## Phase 4 — Exact tarball and validation
+
+At `RELEASE_SHA` in a clean working tree:
+
+```bash
+git checkout "$RELEASE_SHA"
+npm ci
+npm run build
+npm test
+npm run test:webhook
+npm run package:p-dev:prepare
+npm run package:p-dev:pack
+npm run package:p-dev:inspect
+```
+
+Record tarball bytes, SHA-1, SHA-256, manifest, unpacked size, file count.
+
+Tarball launcher smoke (fresh `P_DEV_HOME`):
+
+```bash
+TARBALL="packages/p-dev/p-dev-harness-VERSION.tgz"
+WORKDIR=$(mktemp -d)
+export P_DEV_HOME="$WORKDIR/workspace"
+cd "$WORKDIR"
+npx --yes "file:/absolute/path/to/$TARBALL" --no-open
+# verify /settings/configure HTTP 200, stop, relaunch with same P_DEV_HOME
+```
+
+Dry-run publish:
+
+```bash
+npm publish "$TARBALL" --dry-run --access public --registry=https://registry.npmjs.org/
+```
+
+---
+
+## Phase 5 — npm publication
+
+Publish the **exact already-tested tarball** (do not rebuild between smoke and publish):
+
+```bash
+npm publish "$TARBALL" --access public --registry=https://registry.npmjs.org/
+```
+
+If npm requests OTP, enter it interactively. **Never** place OTP or token in files, commands reported in PRs, or logs.
+
+Verify:
+
+```bash
+npm view p-dev-harness@VERSION name version dist-tags.latest dist.shasum dist.integrity engines bin repository license
+```
+
+Registry smoke from fresh directory:
+
+```bash
+WORKDIR=$(mktemp -d)
+export P_DEV_HOME="$WORKDIR/workspace"
+cd "$WORKDIR"
+npx --yes p-dev-harness@VERSION --no-open
+```
+
+---
+
+## Phase 6 — Primary tag and GitHub release
+
+**After** npm publication verification:
+
+```bash
+git tag -a "$TAG" "$RELEASE_SHA" -m "$TAG"
+git rev-parse "$TAG^{}"   # must equal RELEASE_SHA
+git push origin "$TAG"
+```
+
+Verify remote tag resolves to `RELEASE_SHA`.
+
+Create GitHub release:
+
+```bash
+gh release create "$TAG" \
+  --title "$TAG — Immutable workspace provisioning" \
+  --notes-file "docs/releases/v$VERSION.md" \
+  --latest
+```
+
+- Do **not** use `--generate-notes` as primary body
+- Do **not** mark prerelease unless an actual blocker requires it
+- Do **not** overwrite an existing tag (`git tag -f`, `git push --force`)
+
+If npm succeeds but GitHub release fails: **do not republish**. Recover tag/release against the same `RELEASE_SHA`.
+
+---
+
+## Phase 7 — Post-release finalization PR
+
+Branch `docs/finalize-v<VERSION>-release`:
+
+- Update `docs/releases/v<VERSION>.md` with tagged/published status, URLs, SHAs, registry shasum/integrity, tarball metadata, live validation evidence, registry smoke result, timestamp
+- Do **not** change released package contents or version
+
+Merge after checks pass.
+
+---
+
+## V0.3.1 — exact commands (current example)
+
+```bash
+VERSION=0.3.1
+TAG=v0.3.1
+
+# After release-prep PR merge
+RELEASE_SHA=$(git rev-parse origin/main)
+git checkout main && git pull --ff-only origin main
+git checkout "$RELEASE_SHA"
+
+# Validate at release commit
+npm ci && npm run build && npm test && npm run test:webhook
+npm run package:p-dev:prepare && npm run package:p-dev:pack && npm run package:p-dev:inspect
+TARBALL="packages/p-dev/p-dev-harness-${VERSION}.tgz"
+
+# npm preflight + publish (interactive OTP if required)
+npm whoami --registry=https://registry.npmjs.org/
+npm view p-dev-harness@${VERSION} --registry=https://registry.npmjs.org/
+npm publish "$TARBALL" --access public --registry=https://registry.npmjs.org/
+
+# Tag and release
+git tag -a "$TAG" "$RELEASE_SHA" -m "$TAG"
+git push origin "$TAG"
+gh release create "$TAG" \
+  --title "$TAG — Immutable workspace provisioning" \
+  --notes-file "docs/releases/v${VERSION}.md" \
+  --latest
+```
+
+---
+
+## V0.3.0 — historical commands
+
+V0.3.0 used public-template provisioning. See [`v0.3.0.md`](v0.3.0.md) for the historical contract.
+
+---
+
+## Operator notes
+
+### Root repo vs npm package
+
+| Artifact | `private` | Published |
+|----------|-----------|-----------|
+| Root `agentic-product-development-harness` | `true` | GitHub source release only |
+| `packages/p-dev` (`p-dev-harness`) | no | Public npm |
+
+### What not to run during release-doc PRs
+
+- `git tag`, `git push` (tags)
+- `npm publish`
+- `gh release create`
+- Live `harness:run` against production issues
+- Linear writes
+- Secret inspection, printing, or rotation in reports

package/workspace-snapshot/files/docs/releases/v0.2.0.md

@@ -0,0 +1,193 @@
+# V0.2.0 — Release contract
+
+**Tag status:** Tagged — tag `v0.2.0` on `fe37e307930467d66840624c82bce9dc0b4af0f2`. GitHub release: https://github.com/weston-uribe/agentic-product-development-harness/releases/tag/v0.2.0
+
+**Release type:** GitHub **source release** (annotated tag + curated release notes). This is **not** an npm package publication. `package.json` remains `private: true`.
+
+## TL;DR
+
+V0.2.0 is the first source release of the working harness: Linear-triggered Cursor Cloud Agent runs, GitHub PR lifecycle automation, production sync, and the public-repo security baseline.
+
+It is intentionally narrow:
+
+- Cursor only
+- Linear only
+- GitHub / GitHub Actions only
+- Vercel only where preview/webhook support is configured
+
+It is not a provider-agnostic platform and not an npm package.
+
+## Who this is for
+
+V0.2.0 is for a solo operator or small product/engineering team that wants to run a controlled AI-assisted product-development loop from Linear to GitHub PRs.
+
+It assumes the operator is comfortable configuring GitHub Actions secrets, Vercel environment variables, Linear statuses, and target repo branch strategy.
+
+---
+
+## Summary
+
+V0.2.0 is a Cursor-first harness for orchestrating product work through **Linear + GitHub + GitHub Actions**. SDK runners handle planning through merge and production sync; Linear status changes trigger cloud harness runs via a Vercel webhook bridge and GitHub `repository_dispatch`.
+
+---
+
+## What ships
+
+| Area | What ships in V0.2.0 |
+|------|----------------------|
+| Agent provider | Cursor Cloud Agents only (`agentProvider.id: "cursor"`) |
+| Product system | Linear |
+| SCM / PR | GitHub |
+| Cloud runner | GitHub Actions |
+| Preview provider | Vercel (when enabled) or none |
+| SDK runners | planning, implementation, handoff, revision, merge, production sync |
+| Auto-runner | Linear webhook → Vercel → `repository_dispatch` → GHA → `--phase auto` |
+| Trigger statuses | Ready for Planning, Ready for Build, PR Open, Needs Revision, Ready to Merge |
+| Issue intake | ChatGPT prompt, Cursor skill, parser template, `validate-issue` CLI |
+| Provider seam | Internal `src/agents/` facade; Cursor adapter in `src/cursor/` |
+| GHA hardening | Pinned actions, env-var shell safety, output redaction, CI, CodeQL, Dependabot |
+| Security baseline | Public-repo threat model, token matrix, ruleset on `main`, Actions allowlist |
+| Solo automation | Trusted branch → PR → required checks → merge (0 required GitHub approvals) |
+| Target-repo integration posture | PRs → `dev`; manual `dev` → `main`; production sync updates Linear |
+
+---
+
+## What does not ship
+
+- Provider agnosticism
+- Claude Code, Codex, or local VS Code agent support
+- GitLab, Bitbucket, or generic PM-system support
+- npm package publication or npm stability guarantee
+- Generic auto-merge for any green public PR
+- OpenSSF Scorecard
+- Required GitHub human approval in solo-maintainer mode
+- Autonomous shipping without Linear/status gates
+- Production-grade portability
+- Automated eval runners (manual rubrics only)
+
+---
+
+## Supported stack / support matrix
+
+| Subsystem | V0.2.0 |
+|-----------|--------|
+| Agent provider | Cursor Cloud Agents |
+| Product system | Linear |
+| SCM / PR | GitHub |
+| Runner | GitHub Actions |
+| Preview | Vercel or none |
+| Model policy | Composer 2.5 (standard/basic) unless deliberately changed |
+
+Details: [`docs/provider-portability.md`](../provider-portability.md)
+
+---
+
+## Security model
+
+- **Secrets** live in GitHub Actions secrets, Vercel environment variables, or local untracked `.env` files — never committed.
+- **Public repo:** untrusted users cannot push to `main` or trigger secret-bearing automation without write access or a dispatch token.
+- **`main` protection:** ruleset requires PR, required status checks (`test`, `Analyze (javascript-typescript)`), no direct push, no force push.
+- **Actions allowlist:** only pinned first-party actions permitted.
+- **Output redaction:** harness stdout is redacted before logs, summaries, and artifacts.
+- **Accepted risks:** documented in [`docs/security.md`](../security.md) (dispatch token model, transitive `undici` advisory, public Actions logs).
+
+---
+
+## Solo repo automation policy
+
+While Weston is the sole maintainer:
+
+| Setting | Value |
+|---------|-------|
+| PR required to merge to `main` | Yes |
+| Required status checks | `test`, `Analyze (javascript-typescript)` |
+| Direct push to `main` | No |
+| Required GitHub approvals | **0** |
+| CODEOWNER review enforced | **No** (`.github/CODEOWNERS` exists for documentation/future enforcement) |
+
+**Linear/status gates remain required.** Automation runs only when the issue is on an allowlisted status; merge runs only after **Ready to Merge**. This is human-controlled product judgment via Linear — not bypassed by GitHub review settings.
+
+**Re-enable GitHub approvals and CODEOWNER review** when a second engineer joins or when accepting external contributions.
+
+---
+
+## Setup prerequisites
+
+1. Node.js 22+, npm
+2. Linear team with harness workflow statuses configured
+3. GitHub repo with Actions secrets: `LINEAR_API_KEY`, `CURSOR_API_KEY`, `HARNESS_GITHUB_TOKEN`
+4. Vercel project for webhook bridge (production env vars only — see security doc)
+5. `harness.config.json` with target repos and Linear mappings
+6. Optional: integration branch/`main` branch setup and production sync dispatch
+
+Operator guides:
+
+- [`docs/getting-started.md`](../getting-started.md)
+- [`docs/linear-watcher-setup.md`](../linear-watcher-setup.md)
+- [`docs/target-repo-branch-setup.md`](../target-repo-branch-setup.md)
+- [`docs/production-sync-automation.md`](../production-sync-automation.md)
+- [`docs/security.md`](../security.md)
+
+---
+
+## Validation checklist
+
+Run before tagging (also run locally on the release-doc PR):
+
+```bash
+npm ci
+npm run build
+npm test
+npm run test:webhook
+```
+
+Optional operator checks:
+
+- `npm run harness:doctor`
+- `npm run harness:validate-issue -- --file <draft> --intended-phase planning`
+- `npm run harness:run -- --issue WES-XX --dry-run`
+
+---
+
+## Known limitations
+
+See [CHANGELOG.md](../../CHANGELOG.md) Known limitations section for the full list. Key points:
+
+- **Cursor-only** — no Claude Code, Codex, or local VS Code agent support
+- **Linear + GitHub only** — not a generic PM or SCM platform
+- **Manual evals** — automated eval contract is deferred; scorecards are human-readable rubrics
+- **Operator setup required** — not a plug-and-play product; expect to configure secrets, statuses, and branch strategy
+
+---
+
+## Upgrade notes from v0.1
+
+| v0.1 | V0.2.0 |
+|------|--------|
+| Manual Cursor loop + docs/templates | SDK runners for full lifecycle |
+| No auto-run | Event-driven auto-runner from Linear |
+| Implicit Cursor usage | Explicit `agentProvider.id: "cursor"` config |
+| Single-branch merge assumption | Integration branch (`dev`) + production sync |
+| Manual security guidance | Implemented ruleset, allowlist, redaction |
+| `version: 0.1.0` | `version: 0.2.0` (source marker only) |
+
+Historical v0.1 artifacts (ADRs, milestone docs, example run 001) remain valid as history.
+
+---
+
+## Release readiness checklist
+
+- [ ] Release-doc PR merged to `main`
+- [ ] Required checks green on merge commit (`test`, `Analyze (javascript-typescript)`)
+- [ ] `docs/releases/v0.2.0.md` and `CHANGELOG.md` reflect final scope
+- [ ] Local validation: `npm ci`, `npm run build`, `npm test`, `npm run test:webhook`
+- [ ] Tag preflight: `v0.2.0` tag does not already exist
+- [ ] Annotated tag `v0.2.0` created and pushed
+- [ ] GitHub release created with curated notes (not `--generate-notes`)
+- [ ] Follow-up PR updates tag status in this doc to **Tagged**
+
+---
+
+## Tag / release
+
+Do **not** create the tag in the release-doc PR. Follow [`release-process.md`](release-process.md) after merge.

package/workspace-snapshot/files/docs/releases/v0.3.0.md

@@ -0,0 +1,188 @@
+# V0.3.0 — Release contract
+
+**Tag status:** Tagged — annotated tag `v0.3.0` on `f55f21825802a246a9db130ae5e128ad8165384d`. GitHub release: https://github.com/weston-uribe/agentic-product-development-harness/releases/tag/v0.3.0
+
+**npm status:** Published — `p-dev-harness@0.3.0` on https://www.npmjs.com/package/p-dev-harness
+
+**Release type:** GitHub **source release** (annotated tag + curated release notes) plus public npm CLI package **`p-dev-harness@0.3.0`**.
+
+**npm naming note:** Registry rejected bare `p-dev` as too similar to existing [`pdev`](https://www.npmjs.com/package/pdev). The published package name is `p-dev-harness`.
+
+## TL;DR
+
+V0.3.0 is the guided-onboarding and distribution release. Product managers can start with `npx --yes p-dev-harness@0.3.0` without cloning the source repository. The seven-step Configure GUI automates service credentials, Linear workspace setup, Vercel webhook bridge, target repos, cloud secrets, and guarded workflow install PR finalization.
+
+## Who this is for
+
+- Product managers and solo operators who want guided harness onboarding
+- Contributors who develop the harness from the source repository
+- Teams already on Linear + GitHub + GitHub Actions + Vercel + Cursor
+
+## Primary install command
+
+```bash
+npx --yes p-dev-harness@0.3.0
+```
+
+Requires Node.js 22+. macOS is the validated packaged platform; use `--no-open` elsewhere.
+
+Full guide: [`docs/p-dev.md`](../p-dev.md)
+
+## Architecture / workspace model
+
+| Boundary | Role |
+|----------|------|
+| `p-dev-harness` npm package | Packaged operator shell and Configure GUI launcher |
+| Operator workspace (`~/.p-dev`, `P_DEV_HOME`, `--workspace`) | Durable local secrets and config |
+| Public template (`weston-uribe/p-dev-harness-template`) | Provisioning source for private harness workspace |
+| Private `OWNER/p-dev-harness` | Managed harness workspace for cloud automation |
+| Target repos | Product codebases the harness operates on |
+
+## What ships
+
+| Area | V0.3.0 |
+|------|--------|
+| Product install | `p-dev-harness@0.3.0` on public npm |
+| Configure GUI | Seven-step guided setup with confirmation gates |
+| Packaged provisioning | Private harness workspace from public template |
+| Linear setup | Automated workspace/status configuration |
+| Vercel bridge | Env vars, webhook, redeploy polling, signed verification |
+| Cloud secrets | Harness repo GitHub Actions secret writes |
+| Target workflow | Install PR create/reuse, checks, guarded merge, production verify |
+| Canonical skills | Six skills under `.agents/skills/` |
+| Source release | Annotated tag + GitHub release on this repository |
+
+## Setup flow
+
+1. Connect services (optional packaged harness workspace provisioning)
+2. Set up Linear workspace
+3. Set up Vercel webhook bridge
+4. Choose target repo(s)
+5. Check local readiness
+6. Connect cloud secrets
+7. Install target repo workflow (guarded auto-finalization for system-owned setup PRs)
+
+Remote mutations require explicit confirmation. Ordinary product PRs remain governed by Linear status gates.
+
+## Canonical skills
+
+Implemented under `.agents/skills/`:
+
+- `issue-intake`
+- `code-health-audit`
+- `architecture-evolution-audit`
+- `security-audit`
+- `planner`
+- `implementation`
+
+Deferred: `performance-cost-audit`, skill registry/package manager, manifests, provider adapters, runner-skill prompt integration. Planner and implementation SKILL.md files do not replace `src/prompts/*.md` runner implementation.
+
+## Changes from v0.2.0
+
+| v0.2.0 | v0.3.0 |
+|--------|--------|
+| Source clone only | `p-dev-harness` npm package for product onboarding |
+| Manual/scattered setup docs | Seven-step guided Configure GUI |
+| No canonical skills | Six canonical skills documented and implemented |
+| No public template provisioning | Private harness workspace from public template |
+| Manual workflow install guidance | Guarded Step 7 auto-finalization for setup PRs |
+| Source release only | Source release + public npm package |
+
+## Security model
+
+- Secrets in local workspace, GitHub Actions secrets, and Vercel env vars — never in the published package
+- Confirmation-gated remote writes with fingerprint validation
+- Output redaction before logs and artifacts
+- Published tarball excludes credentials and operator state
+
+Details: [`docs/security.md`](../security.md)
+
+## Validation evidence
+
+- Codespaces source-based Configure GUI validation
+- Controlled separate-account packaged onboarding through Setup complete
+- Package pack/inspect tests and tarball smoke (Configure route HTTP 200)
+- Registry-installed smoke: `npx --yes p-dev-harness@0.3.0 --no-open` → `/settings/configure` HTTP 200
+- Expanded setup, GUI, and provisioning test suite
+
+**Not validated:** full real issue lifecycle from an isolated npm-installed workspace.
+
+## Support matrix
+
+| Subsystem | V0.3.0 |
+|-----------|--------|
+| Product install | `p-dev-harness@0.3.0` (npm) |
+| Packaged platform | macOS validated; `--no-open` elsewhere |
+| Node.js | 22+ |
+| Agent provider | Cursor Cloud Agents |
+| Product system | Linear |
+| SCM / PR | GitHub |
+| Runner | GitHub Actions |
+| Preview / bridge | Vercel |
+
+## Known limitations
+
+- Cursor-only agent provider
+- Linear / GitHub / GitHub Actions / Vercel stack
+- macOS validated for packaged browser auto-launch
+- No full isolated npm issue lifecycle validated
+- No automatic private harness workspace upgrade/sync
+- Public template compatibility dependency
+- Not production SaaS or provider-agnostic
+- Manual eval rubrics where automation is not implemented
+
+## Upgrade notes from v0.2.0
+
+- Product managers: use `npx --yes p-dev-harness@0.3.0` instead of cloning for onboarding
+- Contributors: continue cloning source repository
+- Existing source-based workspaces: unchanged; operator workspace remains under `~/.p-dev` by default
+- Template main updated for authoritative provenance after npm package rename
+
+## Template dependency / provenance
+
+| Artifact | SHA / value | Notes |
+|----------|-------------|-------|
+| Template repo | `weston-uribe/p-dev-harness-template` | Public GitHub template |
+| Template **main** (authoritative) | `9cdf5534638194036b55d84a3d959f092c47c201` | PR [#17](https://github.com/weston-uribe/p-dev-harness-template/pull/17) — aligned to primary `f55f218`, `p-dev-harness` naming |
+| Template tag `v0.3.0` (immutable) | `8dac15dfeef798909f9216028708c66aebd55dd6` | PR [#16](https://github.com/weston-uribe/p-dev-harness-template/pull/16) — initial sync from primary `156eab6`; **not moved** |
+| `templateContentId` on template main | `agentic-product-development-harness-f55f21825802a246a9db130ae5e128ad8165384d-curated-v1` | Matches authoritative primary release commit |
+
+GitHub template provisioning uses repository **default branch** (`main`), so corrected template `main` is authoritative for new private workspaces. The immutable template tag `v0.3.0` remains a historical snapshot from the pre-rename sync.
+
+## Immutable release evidence
+
+| Field | Value |
+|-------|-------|
+| **RELEASE_SHA** | `f55f21825802a246a9db130ae5e128ad8165384d` |
+| Primary annotated tag object | `e6cdc5f69c1f394e0403bc90a14b317e2b6b134b` |
+| Primary tag peeled commit | `f55f21825802a246a9db130ae5e128ad8165384d` |
+| GitHub release | https://github.com/weston-uribe/agentic-product-development-harness/releases/tag/v0.3.0 |
+| Release-prep PR | https://github.com/weston-uribe/agentic-product-development-harness/pull/56 |
+| npm rename PR | https://github.com/weston-uribe/agentic-product-development-harness/pull/57 |
+| npm package | `p-dev-harness@0.3.0` |
+| npm dist-tag `latest` | `0.3.0` |
+| npm dist.shasum | `fbc2c9e3d29ad4181776008b1880e5845e3aec53` |
+| npm dist.integrity | `sha512-0p2ggAnyVOv4QVEpFFPp54e2eaPfFNfyLhVdyYLySfTVym/iOcB6nJR0v3UcRTM9uQc05F2bayG9i7JltnuUmA==` |
+| Local tarball | `packages/p-dev/p-dev-harness-0.3.0.tgz` |
+| Local tarball bytes | 1,630,506 |
+| Local tarball SHA-1 | `fbc2c9e3d29ad4181776008b1880e5845e3aec53` |
+| Local tarball SHA-256 | `d7b99605f40f1837ef9a7bd64dd1f712d18259c6dafc9124527337b29a60c916` |
+| Registry smoke | `npx --yes p-dev-harness@0.3.0 --no-open` → HTTP 200 on `/settings/configure` |
+| Release timestamp (UTC) | 2026-07-13 |
+
+## Release readiness checklist
+
+- [x] Release-prep PR merged to `main`
+- [x] npm package-name correction PR merged
+- [x] Required checks green on merge commits
+- [x] Template sync PR merged; immutable template tag `v0.3.0` at `8dac15d`
+- [x] Template provenance correction merged to template `main`
+- [x] `p-dev-harness@0.3.0` published from exact tarball
+- [x] Registry smoke: `npx --yes p-dev-harness@0.3.0 --no-open`
+- [x] Annotated primary tag `v0.3.0` pushed at `RELEASE_SHA`
+- [x] GitHub release created
+- [x] Finalization PR records immutable tag/npm/template evidence
+
+## Tag / npm / GitHub release procedure
+
+Historical operator steps: [`release-process.md`](release-process.md)