persona-harness 0.8.21 → 0.8.22

package/docs/current/release/history.md

@@ -9,13 +9,15 @@ version/package chronology, use
 [`docs/releases/README.md`](../../releases/README.md) and
 [`docs/releases/package-index.md`](../../releases/package-index.md).
 
-## Current 0.8.21 Package Authority
+## Current 0.8.22 Package Authority
 
-The current unpublished package authority is 0.8.21. Its root package,
-lockfile, private shared-skills package, and v0821 acceptance record must agree
-exactly. The published 0.8.20 release is immutable historical evidence only
+The current unpublished package authority is 0.8.22. Its root package,
+lockfile, private shared-skills package, and v0822 acceptance record must agree
+exactly. The published 0.8.21 release is immutable historical evidence only
 and must not be retagged, rerun, or published.
-The package-visible read-only `ph authority verify` surface never fetches,
+The package-visible read-only `ph authority verify` surface accepts canonical
+`sha256:<64hex>` or an exact raw SHA-256 hex digest, normalizing either form
+before the same no-follow archive boundary. It never fetches,
 persists, consumes, finishes, or replays authority. Its `.2` result exposes a
 finite `sourceReason` only alongside `source-mismatch`; unavailable Sigstore
 trust remains a fixed blocked result rather than a trust claim.

package/docs/current/release/project-finish-attestation-verifier.md

@@ -92,7 +92,7 @@ caller that already holds one original archive:
 ```text
 ph authority verify [owner/repository] --archive <original-archive> \
   --artifact-id <id> --run-id <run-id> --source-head <commit> \
-  --artifact-digest sha256:<digest> --json
+  --artifact-digest <sha256:<digest>|64hex> --json
 ```
 
 The command requires all four tuple fields, the current enrolled source and
@@ -102,6 +102,10 @@ and checks its digest before invoking the existing verifier. It never reads a
 GitHub credential, fetches an artifact, writes the authority store, consumes
 authority, runs Finish, or performs replay.
 
+The digest is canonicalized to lowercase `sha256:<64hex>`. Callers may supply
+that canonical form or an exact raw 64-character SHA-256 hex digest; every
+other form remains blocked before archive verification.
+
 Its public result is `consumer-authority-verify.2` with fixed fields for
 eligibility, consumption state, bounded reason, schema, source-fallback state,
 and terminal state. Only `source-mismatch` includes a finite nonreflective

package/docs/current/release/v0.8.21-release-notes.md

@@ -1,12 +1,11 @@
 # v0.8.21 Release Notes
 
-## Current package authority
+## Historical package authority
 
-`0.8.21` is the current unpublished package authority. The root package,
+`0.8.21` was published as an immutable stable release. Its root package,
 lockfile, private shared-skills package, and
-`consumer-authority-v0821-acceptance.json` bind the same version. Published
-`0.8.20` is immutable historical evidence and cannot authorize this candidate
-or a replacement publish.
+`consumer-authority-v0821-acceptance.json` remain historical release evidence;
+they cannot authorize a later candidate or a second publish.
 
 ## Portable repair source identity
 
@@ -22,9 +21,8 @@ The exclusion is intentionally narrow. A reviewed
 all other tracked or untracked source stay in the signed identity and continue
 to drift or fail closed as before.
 
-## Release boundary
+## Historical boundary
 
-Fresh Source and Package gates must bind the exact `0.8.21` candidate and its
-canonical tar before protected integration, stable Release, and one npm
-`latest` publication. A released successor package is the lawful fixture-pin
-trigger for #338; fixture and V4 observations remain separately governed.
+The release completed through protected integration, a stable GitHub Release,
+and one npm `latest` publication. Fixture and V4 observations remain separate
+evidence paths and do not alter this immutable release history.

package/docs/current/release/v0.8.22-release-notes.md

@@ -0,0 +1,28 @@
+# v0.8.22 Release Notes
+
+## Current package authority
+
+`0.8.22` is the current unpublished package authority. The root package,
+lockfile, private shared-skills package, and
+`consumer-authority-v0822-acceptance.json` bind the same version. Published
+`0.8.21` is immutable historical evidence and cannot authorize this candidate
+or a replacement publish.
+
+## Authority verify digest normalization
+
+The installed read-only `ph authority verify` command accepts either its
+canonical `sha256:<64hex>` archive digest or an exact raw 64-character
+SHA-256 hex value. Raw input is normalized before archive comparison, so both
+forms bind the same tuple and retain the existing no-follow, enrollment,
+source, crypto, and non-consuming boundaries.
+
+Partial tuples, invalid sizes or characters, unsupported algorithms, duplicate
+flags, symlink archives, and tuple mismatches still block before verifier,
+store, fetch, Finish, or replay.
+
+## Release boundary
+
+Fresh Source and Package gates must bind the exact `0.8.22` candidate and its
+canonical tar before protected integration, stable Release, and one npm
+`latest` publication. A released successor package is the lawful fixture-pin
+trigger for #307; fixture and V4 observations remain separately governed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "persona-harness",
-  "version": "0.8.21",
+  "version": "0.8.22",
   "private": false,
   "type": "module",
   "packageManager": "npm@10.8.2",
@@ -248,6 +248,8 @@
     "scripts/consumer-authority-v0820-acceptance-schema.mjs",
     "scripts/consumer-authority-v0821-acceptance-schema.d.mts",
     "scripts/consumer-authority-v0821-acceptance-schema.mjs",
+    "scripts/consumer-authority-v0822-acceptance-schema.d.mts",
+    "scripts/consumer-authority-v0822-acceptance-schema.mjs",
     "scripts/consumer-authority-v081-acceptance-schema.d.mts",
     "scripts/consumer-authority-v081-acceptance-schema.mjs",
     "scripts/consumer-authority-rc1-acceptance-schema.mjs",

package/packages/shared-skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@persona-harness/shared-skills",
-  "version": "0.8.21",
+  "version": "0.8.22",
   "type": "module",
   "private": true,
   "description": "Persona-owned portable skill procedures and optional overlays",

package/scripts/consumer-authority-v0822-acceptance-schema.d.mts

@@ -0,0 +1,40 @@
+export const V0822_ACCEPTANCE_SCHEMA_VERSION: "consumer-authority-v0822-acceptance.1"
+
+export class V0822AcceptanceManifestError extends Error {
+  readonly code: "v0822-acceptance-schema"
+}
+
+export type V0822AcceptanceManifest = Readonly<Record<string, unknown>> & Readonly<{
+  readonly authority: Readonly<{
+    readonly readOnlyVerify: Readonly<{
+      readonly archiveInput: Readonly<{
+        readonly ancestorDirectoryChurn: string
+        readonly arbitrarySymlinkAncestorOrLeaf: string
+        readonly darwinSystemTemporaryAlias: string
+        readonly directParentIntegrity: string
+        readonly nonDarwin: string
+      }>
+      readonly artifactDigestInput: string
+      readonly command: string
+      readonly noCredentialFetchStoreConsumeFinishReplay: boolean
+      readonly schemaVersion: string
+    }>
+  }>
+  readonly package: Readonly<{
+    readonly channel: string
+    readonly scope: string
+    readonly version: string
+  }>
+  readonly initialization: Readonly<{
+    readonly packageTemplateIdentity: string
+    readonly repairStaging: string
+  }>
+  readonly projectFinishSourceIdentity: Readonly<{
+    readonly adoptedInstructionPolicy: string
+    readonly repairInferenceObservations: string
+  }>
+}>
+
+export function canonicalV0822AcceptanceManifest(): V0822AcceptanceManifest
+export function readV0822AcceptanceManifest(packageRoot: string): V0822AcceptanceManifest
+export function parseV0822AcceptanceManifest(value: unknown, packageVersion: string): V0822AcceptanceManifest

package/scripts/consumer-authority-v0822-acceptance-schema.mjs

@@ -0,0 +1,83 @@
+import { readFileSync } from "node:fs"
+import { join } from "node:path"
+import { isDeepStrictEqual } from "node:util"
+
+import { canonicalV0821AcceptanceManifest } from "./consumer-authority-v0821-acceptance-schema.mjs"
+import { parseCanonicalPackagePublisherPlan } from "./canonical-package-publisher.mjs"
+import { parseExternalArtifactTransportPlan } from "./consumer-authority-external-artifact-transport-plan.mjs"
+import { parseExternalAttestationCommandPlan } from "./consumer-authority-external-attestation-command-plan.mjs"
+import { parseObserverGhToolContract } from "./consumer-authority-observer-gh-tool.mjs"
+
+export const V0822_ACCEPTANCE_SCHEMA_VERSION = "consumer-authority-v0822-acceptance.1"
+
+const V0822_PACKAGE_VERSION = "0.8.22"
+const ACCEPTANCE_PATH = join("docs", "current", "release", "consumer-authority-v0822-acceptance.json")
+const EXPECTED_MANIFEST = buildExpectedManifest()
+
+export class V0822AcceptanceManifestError extends Error {
+  constructor(code) {
+    super(code)
+    this.code = code
+  }
+}
+
+export function canonicalV0822AcceptanceManifest() {
+  return structuredClone(EXPECTED_MANIFEST)
+}
+
+export function readV0822AcceptanceManifest(packageRoot) {
+  let packageVersion
+  let value
+  try {
+    packageVersion = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8")).version
+    value = JSON.parse(readFileSync(join(packageRoot, ACCEPTANCE_PATH), "utf8"))
+  } catch {
+    fail()
+  }
+  return parseV0822AcceptanceManifest(value, packageVersion)
+}
+
+export function parseV0822AcceptanceManifest(value, packageVersion) {
+  if (packageVersion !== V0822_PACKAGE_VERSION || !isDeepStrictEqual(value, EXPECTED_MANIFEST)) fail()
+  parseCanonicalPackagePublisherPlan(value.canonicalPackagePublisherPlan)
+  parseExternalAttestationCommandPlan(value.externalAttestationCommandPlan)
+  parseExternalArtifactTransportPlan(value.externalArtifactTransportPlan)
+  parseObserverGhToolContract(value.observerGhTool)
+  return value
+}
+
+function buildExpectedManifest() {
+  const manifest = canonicalV0821AcceptanceManifest()
+  manifest.schemaVersion = V0822_ACCEPTANCE_SCHEMA_VERSION
+  manifest.package.channel = "unpublished"
+  manifest.package.scope = "source-candidate"
+  manifest.package.version = V0822_PACKAGE_VERSION
+  delete manifest.v0820HistoricalRelease
+  manifest.v0821HistoricalRelease = {
+    outcome: "published-0.8.21-release-is-immutable-and-not-reusable-for-this-unpublished-v0822-source-candidate-or-any-later-package",
+    reusableForV0822: false,
+    version: "0.8.21",
+  }
+  manifest.initialization = {
+    packageTemplateIdentity: "canonical-package-template-digest-remains-separate-from-effective-bootstrap-overlay-file-digests",
+    repairStaging: "manifest-less-recognized-portable-static-baseline-records-the-caller-realpath-before-staging-ownership-verification",
+  }
+  manifest.projectFinishSourceIdentity = {
+    adoptedInstructionPolicy: "remains-source-bound",
+    repairInferenceObservations: "excludes-only-.persona/instructions/inferred.json-and-.persona/instructions/conflicts.json",
+  }
+  manifest.authority.readOnlyVerify.archiveInput = {
+    ...manifest.authority.readOnlyVerify.archiveInput,
+    ancestorDirectoryChurn: "same-no-follow-directory-location-and-mode-required-while-unrelated-entry-metadata-may-change",
+    directParentIntegrity: "full-no-follow-identity-remains-required-before-read",
+  }
+  manifest.authority.readOnlyVerify.artifactDigestInput = "canonical-sha256-prefix-or-exact-64-hex-normalized-before-archive-verification"
+  manifest.authority.fixturePlan.registryInstall = "requires-authorized-release-before-registry-install-persona-harness@0.8.22"
+  manifest.authority.hostedFixture.revision = "v0822-source-candidate-head-before-authorized-release"
+  manifest.hostedResidual.id = "v0822-current-package-acceptance-and-authorized-current-artifact-observation"
+  return manifest
+}
+
+function fail() {
+  throw new V0822AcceptanceManifestError("v0822-acceptance-schema")
+}

package/scripts/preflight-consumer-authority-external-artifact-transport.mjs

@@ -2,7 +2,7 @@ import { realpathSync } from "node:fs"
 import { dirname } from "node:path"
 import { fileURLToPath, pathToFileURL } from "node:url"
 
-import { readV0821AcceptanceManifest } from "./consumer-authority-v0821-acceptance-schema.mjs"
+import { readV0822AcceptanceManifest } from "./consumer-authority-v0822-acceptance-schema.mjs"
 import { runExternalArtifactTransportPreflight } from "./consumer-authority-external-artifact-transport-plan.mjs"
 
 const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)))
@@ -14,7 +14,7 @@ async function main() {
     process.exitCode = 1
     return
   }
-  readV0821AcceptanceManifest(packageRoot)
+  readV0822AcceptanceManifest(packageRoot)
   const result = await runExternalArtifactTransportPreflight()
   process.stdout.write(`${JSON.stringify(result)}\n`)
   process.exitCode = result.state === "ready" ? 0 : 1

package/scripts/preflight-consumer-authority-external-attestation.mjs

@@ -2,7 +2,7 @@ import { realpathSync } from "node:fs"
 import { dirname } from "node:path"
 import { fileURLToPath, pathToFileURL } from "node:url"
 
-import { readV0821AcceptanceManifest } from "./consumer-authority-v0821-acceptance-schema.mjs"
+import { readV0822AcceptanceManifest } from "./consumer-authority-v0822-acceptance-schema.mjs"
 import { runExternalAttestationGrammarPreflight } from "./consumer-authority-external-attestation-command-plan.mjs"
 
 const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)))
@@ -15,7 +15,7 @@ function main() {
     process.exitCode = 1
     return
   }
-  const manifest = readV0821AcceptanceManifest(packageRoot)
+  const manifest = readV0822AcceptanceManifest(packageRoot)
   const result = runExternalAttestationGrammarPreflight(
     manifest.externalAttestationCommandPlan,
     grammarOnlyTopology(manifest),