persona-harness 0.8.21 → 0.8.23

package/docs/current/release/history.md

@@ -9,13 +9,21 @@ version/package chronology, use
 [`docs/releases/README.md`](../../releases/README.md) and
 [`docs/releases/package-index.md`](../../releases/package-index.md).
 
-## Current 0.8.21 Package Authority
+## Current 0.8.23 Package Authority
 
-The current unpublished package authority is 0.8.21. Its root package,
-lockfile, private shared-skills package, and v0821 acceptance record must agree
-exactly. The published 0.8.20 release is immutable historical evidence only
+The current unpublished package authority is 0.8.23. Its root package,
+lockfile, private shared-skills package, and v0823 acceptance record must agree
+exactly. The published 0.8.22 release is immutable historical evidence only
 and must not be retagged, rerun, or published.
-The package-visible read-only `ph authority verify` surface never fetches,
+
+The package tarball contains exactly one root README candidate, `README.md`,
+so npm presents the current English first screen and 30-second demo
+deterministically. Korean, Japanese, and Simplified Chinese source documents
+remain under `docs/current/` and are linked from the English README through
+their GitHub source URLs.
+The package-visible read-only `ph authority verify` surface accepts canonical
+`sha256:<64hex>` or an exact raw SHA-256 hex digest, normalizing either form
+before the same no-follow archive boundary. It never fetches,
 persists, consumes, finishes, or replays authority. Its `.2` result exposes a
 finite `sourceReason` only alongside `source-mismatch`; unavailable Sigstore
 trust remains a fixed blocked result rather than a trust claim.

package/docs/current/release/project-finish-attestation-verifier.md

@@ -92,7 +92,7 @@ caller that already holds one original archive:
 ```text
 ph authority verify [owner/repository] --archive <original-archive> \
   --artifact-id <id> --run-id <run-id> --source-head <commit> \
-  --artifact-digest sha256:<digest> --json
+  --artifact-digest <sha256:<digest>|64hex> --json
 ```
 
 The command requires all four tuple fields, the current enrolled source and
@@ -102,6 +102,10 @@ and checks its digest before invoking the existing verifier. It never reads a
 GitHub credential, fetches an artifact, writes the authority store, consumes
 authority, runs Finish, or performs replay.
 
+The digest is canonicalized to lowercase `sha256:<64hex>`. Callers may supply
+that canonical form or an exact raw 64-character SHA-256 hex digest; every
+other form remains blocked before archive verification.
+
 Its public result is `consumer-authority-verify.2` with fixed fields for
 eligibility, consumption state, bounded reason, schema, source-fallback state,
 and terminal state. Only `source-mismatch` includes a finite nonreflective

package/docs/current/release/v0.8.21-release-notes.md

@@ -1,12 +1,11 @@
 # v0.8.21 Release Notes
 
-## Current package authority
+## Historical package authority
 
-`0.8.21` is the current unpublished package authority. The root package,
+`0.8.21` was published as an immutable stable release. Its root package,
 lockfile, private shared-skills package, and
-`consumer-authority-v0821-acceptance.json` bind the same version. Published
-`0.8.20` is immutable historical evidence and cannot authorize this candidate
-or a replacement publish.
+`consumer-authority-v0821-acceptance.json` remain historical release evidence;
+they cannot authorize a later candidate or a second publish.
 
 ## Portable repair source identity
 
@@ -22,9 +21,8 @@ The exclusion is intentionally narrow. A reviewed
 all other tracked or untracked source stay in the signed identity and continue
 to drift or fail closed as before.
 
-## Release boundary
+## Historical boundary
 
-Fresh Source and Package gates must bind the exact `0.8.21` candidate and its
-canonical tar before protected integration, stable Release, and one npm
-`latest` publication. A released successor package is the lawful fixture-pin
-trigger for #338; fixture and V4 observations remain separately governed.
+The release completed through protected integration, a stable GitHub Release,
+and one npm `latest` publication. Fixture and V4 observations remain separate
+evidence paths and do not alter this immutable release history.

package/docs/current/release/v0.8.22-release-notes.md

@@ -0,0 +1,27 @@
+# v0.8.22 Release Notes
+
+## Historical package authority
+
+`0.8.22` was prepared with a root package, lockfile, private shared-skills
+package, and `consumer-authority-v0822-acceptance.json` bound to the same
+version. It is now immutable published history. The current source candidate
+is `0.8.23`; this record cannot authorize a replacement publish.
+
+## Authority verify digest normalization
+
+The installed read-only `ph authority verify` command accepts either its
+canonical `sha256:<64hex>` archive digest or an exact raw 64-character
+SHA-256 hex value. Raw input is normalized before archive comparison, so both
+forms bind the same tuple and retain the existing no-follow, enrollment,
+source, crypto, and non-consuming boundaries.
+
+Partial tuples, invalid sizes or characters, unsupported algorithms, duplicate
+flags, symlink archives, and tuple mismatches still block before verifier,
+store, fetch, Finish, or replay.
+
+## Release boundary
+
+The historical candidate required fresh Source and Package gates to bind its
+canonical tar before protected integration, stable Release, and one npm
+`latest` publication. Subsequent release candidates require their own current
+version authority and independent evidence.

package/docs/current/release/v0.8.23-release-notes.md

@@ -0,0 +1,25 @@
+# v0.8.23 Release Notes
+
+## Current package authority
+
+`0.8.23` is the current unpublished package authority. The root package,
+lockfile, private shared-skills package, and
+`consumer-authority-v0823-acceptance.json` bind the same version. Published
+`0.8.22` is immutable historical evidence and cannot authorize this candidate
+or a replacement publish.
+
+## Deterministic npm landing README
+
+The package tarball contains exactly one root README candidate, `README.md`,
+so npm's package landing page uses the current English first screen and
+30-second demo. Korean, Japanese, and Simplified Chinese source documents
+remain in `docs/current/`; the English README links to their GitHub source
+paths. This changes presentation selection only and makes no claim about
+translation quality.
+
+## Release boundary
+
+Fresh Source and Package gates must bind the exact `0.8.23` candidate and its
+canonical tar before protected integration, stable Release, and one npm
+`latest` publication. Registry readback must report `readmeFilename` as
+`README.md` and retain the candidate's canonical tar identity.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "persona-harness",
-  "version": "0.8.21",
+  "version": "0.8.23",
   "private": false,
   "type": "module",
   "packageManager": "npm@10.8.2",
@@ -21,9 +21,6 @@
     "dist",
     "LICENSE",
     "README.md",
-    "README.ko.md",
-    "README.ja.md",
-    "README.zh-cn.md",
     "CHANGELOG.md",
     "img",
     ".persona/harness.jsonc",
@@ -248,6 +245,10 @@
     "scripts/consumer-authority-v0820-acceptance-schema.mjs",
     "scripts/consumer-authority-v0821-acceptance-schema.d.mts",
     "scripts/consumer-authority-v0821-acceptance-schema.mjs",
+    "scripts/consumer-authority-v0822-acceptance-schema.d.mts",
+    "scripts/consumer-authority-v0822-acceptance-schema.mjs",
+    "scripts/consumer-authority-v0823-acceptance-schema.d.mts",
+    "scripts/consumer-authority-v0823-acceptance-schema.mjs",
     "scripts/consumer-authority-v081-acceptance-schema.d.mts",
     "scripts/consumer-authority-v081-acceptance-schema.mjs",
     "scripts/consumer-authority-rc1-acceptance-schema.mjs",

package/packages/shared-skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@persona-harness/shared-skills",
-  "version": "0.8.21",
+  "version": "0.8.23",
   "type": "module",
   "private": true,
   "description": "Persona-owned portable skill procedures and optional overlays",

package/scripts/consumer-authority-v0822-acceptance-schema.d.mts

@@ -0,0 +1,40 @@
+export const V0822_ACCEPTANCE_SCHEMA_VERSION: "consumer-authority-v0822-acceptance.1"
+
+export class V0822AcceptanceManifestError extends Error {
+  readonly code: "v0822-acceptance-schema"
+}
+
+export type V0822AcceptanceManifest = Readonly<Record<string, unknown>> & Readonly<{
+  readonly authority: Readonly<{
+    readonly readOnlyVerify: Readonly<{
+      readonly archiveInput: Readonly<{
+        readonly ancestorDirectoryChurn: string
+        readonly arbitrarySymlinkAncestorOrLeaf: string
+        readonly darwinSystemTemporaryAlias: string
+        readonly directParentIntegrity: string
+        readonly nonDarwin: string
+      }>
+      readonly artifactDigestInput: string
+      readonly command: string
+      readonly noCredentialFetchStoreConsumeFinishReplay: boolean
+      readonly schemaVersion: string
+    }>
+  }>
+  readonly package: Readonly<{
+    readonly channel: string
+    readonly scope: string
+    readonly version: string
+  }>
+  readonly initialization: Readonly<{
+    readonly packageTemplateIdentity: string
+    readonly repairStaging: string
+  }>
+  readonly projectFinishSourceIdentity: Readonly<{
+    readonly adoptedInstructionPolicy: string
+    readonly repairInferenceObservations: string
+  }>
+}>
+
+export function canonicalV0822AcceptanceManifest(): V0822AcceptanceManifest
+export function readV0822AcceptanceManifest(packageRoot: string): V0822AcceptanceManifest
+export function parseV0822AcceptanceManifest(value: unknown, packageVersion: string): V0822AcceptanceManifest

package/scripts/consumer-authority-v0822-acceptance-schema.mjs

@@ -0,0 +1,83 @@
+import { readFileSync } from "node:fs"
+import { join } from "node:path"
+import { isDeepStrictEqual } from "node:util"
+
+import { canonicalV0821AcceptanceManifest } from "./consumer-authority-v0821-acceptance-schema.mjs"
+import { parseCanonicalPackagePublisherPlan } from "./canonical-package-publisher.mjs"
+import { parseExternalArtifactTransportPlan } from "./consumer-authority-external-artifact-transport-plan.mjs"
+import { parseExternalAttestationCommandPlan } from "./consumer-authority-external-attestation-command-plan.mjs"
+import { parseObserverGhToolContract } from "./consumer-authority-observer-gh-tool.mjs"
+
+export const V0822_ACCEPTANCE_SCHEMA_VERSION = "consumer-authority-v0822-acceptance.1"
+
+const V0822_PACKAGE_VERSION = "0.8.22"
+const ACCEPTANCE_PATH = join("docs", "current", "release", "consumer-authority-v0822-acceptance.json")
+const EXPECTED_MANIFEST = buildExpectedManifest()
+
+export class V0822AcceptanceManifestError extends Error {
+  constructor(code) {
+    super(code)
+    this.code = code
+  }
+}
+
+export function canonicalV0822AcceptanceManifest() {
+  return structuredClone(EXPECTED_MANIFEST)
+}
+
+export function readV0822AcceptanceManifest(packageRoot) {
+  let packageVersion
+  let value
+  try {
+    packageVersion = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8")).version
+    value = JSON.parse(readFileSync(join(packageRoot, ACCEPTANCE_PATH), "utf8"))
+  } catch {
+    fail()
+  }
+  return parseV0822AcceptanceManifest(value, packageVersion)
+}
+
+export function parseV0822AcceptanceManifest(value, packageVersion) {
+  if (packageVersion !== V0822_PACKAGE_VERSION || !isDeepStrictEqual(value, EXPECTED_MANIFEST)) fail()
+  parseCanonicalPackagePublisherPlan(value.canonicalPackagePublisherPlan)
+  parseExternalAttestationCommandPlan(value.externalAttestationCommandPlan)
+  parseExternalArtifactTransportPlan(value.externalArtifactTransportPlan)
+  parseObserverGhToolContract(value.observerGhTool)
+  return value
+}
+
+function buildExpectedManifest() {
+  const manifest = canonicalV0821AcceptanceManifest()
+  manifest.schemaVersion = V0822_ACCEPTANCE_SCHEMA_VERSION
+  manifest.package.channel = "unpublished"
+  manifest.package.scope = "source-candidate"
+  manifest.package.version = V0822_PACKAGE_VERSION
+  delete manifest.v0820HistoricalRelease
+  manifest.v0821HistoricalRelease = {
+    outcome: "published-0.8.21-release-is-immutable-and-not-reusable-for-this-unpublished-v0822-source-candidate-or-any-later-package",
+    reusableForV0822: false,
+    version: "0.8.21",
+  }
+  manifest.initialization = {
+    packageTemplateIdentity: "canonical-package-template-digest-remains-separate-from-effective-bootstrap-overlay-file-digests",
+    repairStaging: "manifest-less-recognized-portable-static-baseline-records-the-caller-realpath-before-staging-ownership-verification",
+  }
+  manifest.projectFinishSourceIdentity = {
+    adoptedInstructionPolicy: "remains-source-bound",
+    repairInferenceObservations: "excludes-only-.persona/instructions/inferred.json-and-.persona/instructions/conflicts.json",
+  }
+  manifest.authority.readOnlyVerify.archiveInput = {
+    ...manifest.authority.readOnlyVerify.archiveInput,
+    ancestorDirectoryChurn: "same-no-follow-directory-location-and-mode-required-while-unrelated-entry-metadata-may-change",
+    directParentIntegrity: "full-no-follow-identity-remains-required-before-read",
+  }
+  manifest.authority.readOnlyVerify.artifactDigestInput = "canonical-sha256-prefix-or-exact-64-hex-normalized-before-archive-verification"
+  manifest.authority.fixturePlan.registryInstall = "requires-authorized-release-before-registry-install-persona-harness@0.8.22"
+  manifest.authority.hostedFixture.revision = "v0822-source-candidate-head-before-authorized-release"
+  manifest.hostedResidual.id = "v0822-current-package-acceptance-and-authorized-current-artifact-observation"
+  return manifest
+}
+
+function fail() {
+  throw new V0822AcceptanceManifestError("v0822-acceptance-schema")
+}

package/scripts/consumer-authority-v0823-acceptance-schema.d.mts

@@ -0,0 +1,40 @@
+export const V0823_ACCEPTANCE_SCHEMA_VERSION: "consumer-authority-v0823-acceptance.1"
+
+export class V0823AcceptanceManifestError extends Error {
+  readonly code: "v0823-acceptance-schema"
+}
+
+export type V0823AcceptanceManifest = Readonly<Record<string, unknown>> & Readonly<{
+  readonly authority: Readonly<{
+    readonly readOnlyVerify: Readonly<{
+      readonly archiveInput: Readonly<{
+        readonly ancestorDirectoryChurn: string
+        readonly arbitrarySymlinkAncestorOrLeaf: string
+        readonly darwinSystemTemporaryAlias: string
+        readonly directParentIntegrity: string
+        readonly nonDarwin: string
+      }>
+      readonly artifactDigestInput: string
+      readonly command: string
+      readonly noCredentialFetchStoreConsumeFinishReplay: boolean
+      readonly schemaVersion: string
+    }>
+  }>
+  readonly package: Readonly<{
+    readonly channel: string
+    readonly scope: string
+    readonly version: string
+  }>
+  readonly initialization: Readonly<{
+    readonly packageTemplateIdentity: string
+    readonly repairStaging: string
+  }>
+  readonly projectFinishSourceIdentity: Readonly<{
+    readonly adoptedInstructionPolicy: string
+    readonly repairInferenceObservations: string
+  }>
+}>
+
+export function canonicalV0823AcceptanceManifest(): V0823AcceptanceManifest
+export function readV0823AcceptanceManifest(packageRoot: string): V0823AcceptanceManifest
+export function parseV0823AcceptanceManifest(value: unknown, packageVersion: string): V0823AcceptanceManifest

package/scripts/consumer-authority-v0823-acceptance-schema.mjs

@@ -0,0 +1,83 @@
+import { readFileSync } from "node:fs"
+import { join } from "node:path"
+import { isDeepStrictEqual } from "node:util"
+
+import { canonicalV0822AcceptanceManifest } from "./consumer-authority-v0822-acceptance-schema.mjs"
+import { parseCanonicalPackagePublisherPlan } from "./canonical-package-publisher.mjs"
+import { parseExternalArtifactTransportPlan } from "./consumer-authority-external-artifact-transport-plan.mjs"
+import { parseExternalAttestationCommandPlan } from "./consumer-authority-external-attestation-command-plan.mjs"
+import { parseObserverGhToolContract } from "./consumer-authority-observer-gh-tool.mjs"
+
+export const V0823_ACCEPTANCE_SCHEMA_VERSION = "consumer-authority-v0823-acceptance.1"
+
+const V0823_PACKAGE_VERSION = "0.8.23"
+const ACCEPTANCE_PATH = join("docs", "current", "release", "consumer-authority-v0823-acceptance.json")
+const EXPECTED_MANIFEST = buildExpectedManifest()
+
+export class V0823AcceptanceManifestError extends Error {
+  constructor(code) {
+    super(code)
+    this.code = code
+  }
+}
+
+export function canonicalV0823AcceptanceManifest() {
+  return structuredClone(EXPECTED_MANIFEST)
+}
+
+export function readV0823AcceptanceManifest(packageRoot) {
+  let packageVersion
+  let value
+  try {
+    packageVersion = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8")).version
+    value = JSON.parse(readFileSync(join(packageRoot, ACCEPTANCE_PATH), "utf8"))
+  } catch {
+    fail()
+  }
+  return parseV0823AcceptanceManifest(value, packageVersion)
+}
+
+export function parseV0823AcceptanceManifest(value, packageVersion) {
+  if (packageVersion !== V0823_PACKAGE_VERSION || !isDeepStrictEqual(value, EXPECTED_MANIFEST)) fail()
+  parseCanonicalPackagePublisherPlan(value.canonicalPackagePublisherPlan)
+  parseExternalAttestationCommandPlan(value.externalAttestationCommandPlan)
+  parseExternalArtifactTransportPlan(value.externalArtifactTransportPlan)
+  parseObserverGhToolContract(value.observerGhTool)
+  return value
+}
+
+function buildExpectedManifest() {
+  const manifest = canonicalV0822AcceptanceManifest()
+  manifest.schemaVersion = V0823_ACCEPTANCE_SCHEMA_VERSION
+  manifest.package.channel = "unpublished"
+  manifest.package.scope = "source-candidate"
+  manifest.package.version = V0823_PACKAGE_VERSION
+  delete manifest.v0821HistoricalRelease
+  manifest.v0822HistoricalRelease = {
+    outcome: "published-0.8.22-release-is-immutable-and-not-reusable-for-this-unpublished-v0823-source-candidate-or-any-later-package",
+    reusableForV0823: false,
+    version: "0.8.22",
+  }
+  manifest.initialization = {
+    packageTemplateIdentity: "canonical-package-template-digest-remains-separate-from-effective-bootstrap-overlay-file-digests",
+    repairStaging: "manifest-less-recognized-portable-static-baseline-records-the-caller-realpath-before-staging-ownership-verification",
+  }
+  manifest.projectFinishSourceIdentity = {
+    adoptedInstructionPolicy: "remains-source-bound",
+    repairInferenceObservations: "excludes-only-.persona/instructions/inferred.json-and-.persona/instructions/conflicts.json",
+  }
+  manifest.authority.readOnlyVerify.archiveInput = {
+    ...manifest.authority.readOnlyVerify.archiveInput,
+    ancestorDirectoryChurn: "same-no-follow-directory-location-and-mode-required-while-unrelated-entry-metadata-may-change",
+    directParentIntegrity: "full-no-follow-identity-remains-required-before-read",
+  }
+  manifest.authority.readOnlyVerify.artifactDigestInput = "canonical-sha256-prefix-or-exact-64-hex-normalized-before-archive-verification"
+  manifest.authority.fixturePlan.registryInstall = "requires-authorized-release-before-registry-install-persona-harness@0.8.23"
+  manifest.authority.hostedFixture.revision = "v0823-source-candidate-head-before-authorized-release"
+  manifest.hostedResidual.id = "v0823-current-package-acceptance-and-authorized-current-artifact-observation"
+  return manifest
+}
+
+function fail() {
+  throw new V0823AcceptanceManifestError("v0823-acceptance-schema")
+}

package/scripts/preflight-consumer-authority-external-artifact-transport.mjs

@@ -2,7 +2,7 @@ import { realpathSync } from "node:fs"
 import { dirname } from "node:path"
 import { fileURLToPath, pathToFileURL } from "node:url"
 
-import { readV0821AcceptanceManifest } from "./consumer-authority-v0821-acceptance-schema.mjs"
+import { readV0823AcceptanceManifest } from "./consumer-authority-v0823-acceptance-schema.mjs"
 import { runExternalArtifactTransportPreflight } from "./consumer-authority-external-artifact-transport-plan.mjs"
 
 const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)))
@@ -14,7 +14,7 @@ async function main() {
     process.exitCode = 1
     return
   }
-  readV0821AcceptanceManifest(packageRoot)
+  readV0823AcceptanceManifest(packageRoot)
   const result = await runExternalArtifactTransportPreflight()
   process.stdout.write(`${JSON.stringify(result)}\n`)
   process.exitCode = result.state === "ready" ? 0 : 1

package/scripts/preflight-consumer-authority-external-attestation.mjs

@@ -2,7 +2,7 @@ import { realpathSync } from "node:fs"
 import { dirname } from "node:path"
 import { fileURLToPath, pathToFileURL } from "node:url"
 
-import { readV0821AcceptanceManifest } from "./consumer-authority-v0821-acceptance-schema.mjs"
+import { readV0823AcceptanceManifest } from "./consumer-authority-v0823-acceptance-schema.mjs"
 import { runExternalAttestationGrammarPreflight } from "./consumer-authority-external-attestation-command-plan.mjs"
 
 const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)))
@@ -15,7 +15,7 @@ function main() {
     process.exitCode = 1
     return
   }
-  const manifest = readV0821AcceptanceManifest(packageRoot)
+  const manifest = readV0823AcceptanceManifest(packageRoot)
   const result = runExternalAttestationGrammarPreflight(
     manifest.externalAttestationCommandPlan,
     grammarOnlyTopology(manifest),

package/README.ja.md

@@ -1,163 +0,0 @@
-<!-- <CENTERED SECTION FOR GITHUB DISPLAY> -->
-
-<div align="center">
-
-<img src="img/Persona-Harness-Logo.png" alt="Persona Harness ロゴ" width="180">
-
-# Persona Harness
-
-**Java/Spring バックエンドを作る AI コーディングエージェントのための完了ゲート。**
-
-[![npm version](https://img.shields.io/npm/v/persona-harness?color=369eff&labelColor=black&style=flat-square)](https://www.npmjs.com/package/persona-harness)
-[![npm downloads](https://img.shields.io/npm/dt/persona-harness?color=ff6b35&labelColor=black&style=flat-square)](https://www.npmjs.com/package/persona-harness)
-[![node](https://img.shields.io/badge/node-%5E20.17.0%20%7C%7C%20%3E%3D22.9.0-c4f042?labelColor=black&style=flat-square)](https://nodejs.org)
-[![License](https://img.shields.io/badge/license-Apache--2.0-white?labelColor=black&style=flat-square)](./LICENSE)
-
-[English](README.md) | [한국어](README.ko.md) | [日本語](README.ja.md) | [简体中文](README.zh-cn.md)
-
-**[Start Here](docs/START-HERE.md) · [Quick Demo](docs/QUICK-DEMO.md) · [Measured Claims](docs/MEASURED-CLAIMS.md)**
-
-</div>
-
-<!-- </CENTERED SECTION FOR GITHUB DISPLAY> -->
-
-> AI エージェントは「完了しました！」と言いたがります — Persona Harness はそれを証明させます。必要な report、PH が生成した evidence、実際のテスト結果がディスク上に存在するまで完了主張をブロックするローカル CLI 完了ゲートです。
-
-> [!IMPORTANT]
-> **Alpha, gate-first, 測定ベース。** ライブの registry チャネル、タグ、GitHub リリース、audit lifecycle の事実は governed registry と audit record に保持されます。source documentation は自身の preparation boundary だけを記録します。runtime injection は **default-off / opt-in** です。[`docs/current/p3-integrity-roadmap.md`](docs/current/p3-integrity-roadmap.md)、[`docs/MEASURED-CLAIMS.md`](docs/MEASURED-CLAIMS.md)、[`injection-value-status.json`](docs/current/injection-value-status.json) を参照してください。
-
-## 測定された動作 (Measured Behavior)
-
-多くのエージェントハーネスプロジェクトと異なり、PH は実際に測定したものを — ネガティブな結果も含めて — 公開します。
-
-- **偽造された TDD evidence** を `workflow finish` の前に仕込む → `finish` が **exit 1**、偽造ファイルは無視。
-- **Green-only 完了**（TDD rail on）→ ブロック **5/5**（off では許可 5/5）。
-- **runtime injection**、10 ペアの OpenCode run → 成功率は同じ（両方 10/10）だが PH ON は全 10 ペアでコスト増 → **default-off** を維持。
-
-限定されたローカル fixture での completion-integrity 測定です — トークン節約・アプリ品質・プロダクト効能の主張では*ありません*。完全な境界と根拠: **[docs/MEASURED-CLAIMS.md](docs/MEASURED-CLAIMS.md)**。
-
-## これは何か
-
-AI エージェントが行う Java/Spring バックエンド作業のための workflow + evidence CLI（`ph`）と、任意の OpenCode プラグインです。行うこと:
-
-- プロジェクトのアイデアや README を実装 ticket に分割
-- エージェントを反復可能なバックエンド workflow に乗せ続ける
-- 制限されたコマンド実行で検証
-- 何を読み、実行し、完了したかをローカル evidence として記録
-- **必要な report/evidence がなければ完了をブロック**
-
-コード品質保証、トークン節約プロダクト、broad linter、生成アプリが production-ready である証明では**ありません**。完了ゲートより広いすべての主張は、先に測定によって獲得しなければなりません — [MEASURED-CLAIMS](docs/MEASURED-CLAIMS.md) を参照。
-
-## インストール
-
-Node.js ^20.17.0 || >=22.9.0（Node 21 は未対応）、Java 21+ / Gradle、そしてプロバイダーが設定済みの OpenCode CLI が必要です。
-
-```bash
-# OpenCode
-curl -fsSL https://opencode.ai/install | bash   # または: npm install -g opencode-ai
-opencode auth login
-
-# Persona Harness
-npm install -D persona-harness
-npx ph --help && npx ph doctor
-```
-
-## クイックスタート
-
-クリーンなプロジェクトディレクトリでは、次の経路を使ってください（Persona Harness repo 自体は不可）。
-
-```bash
-mkdir -p /tmp/ph-demo && cd /tmp/ph-demo && npm init -y
-npm install -D persona-harness
-
-npx ph init                 # 最小限の統合ファイルのみ
-npx ph bootstrap backend    # AGENTS.md, profile, plan, report テンプレート
-npx ph workflow check
-```
-
-既存の Java/Spring/Gradle プロジェクトでは、まず推論された draft を確認してから
-明示的に受け入れます。
-
-```bash
-npx ph attach
-npx ph attach --yes
-
-# 認識済みの弱い Persona Harness インストールにのみ使用し、ready なものには使用しない:
-npx ph attach --repair --yes
-```
-
-`attach` は、認識できない、または壊れた既存 Persona Harness ファイルを上書きせず
-拒否し、すでに ready なインストールに対する repair も拒否します。attach が成功すると
-PH-run verification を有効にしますが、`runtimeInjection`、`systemConstitution`、
-`idleContinuation`、Ralph loop は off のままです。
-
-その後、OpenCode でエージェントにあなたの `README.md` を実装するよう依頼します。エージェントは自分で rail を回し、`npx ph workflow finish implement` で終えるはずです。
-
-> [!NOTE]
-> `workflow finish` が失敗した場合、エージェントは完了を主張する前に報告された blocker を修正しなければなりません。**その失敗はバグではなく、プロダクトが機能している証拠です。**
-
-サンプル Todo API とアイデア優先フローを含む完全なガイド: **[Quick Demo](docs/QUICK-DEMO.md)**。
-
-## TDD Rail (opt-in)
-
-`.persona/harness.jsonc` で両方の設定を有効にします:
-
-```json
-{ "enforce": { "executeVerification": true, "tdd": true } }
-```
-
-すると `ph workflow test` は **PH が直接実行した Gradle/JUnit の失敗からのみ** red evidence を記録します — エージェントが報告した evidence は決して受け付けません。その後 `workflow check` / `archive` / `finish` が同じ ticket/test id の green evidence を記録します。red-first 完了ゲートであり、テスト scaffolding・十分性の証明・coverage/mutation・アプリ品質の認証は行いません。
-
-## コマンド
-
-```bash
-npx ph attach [--yes]                                  # 既存 Java/Spring/Gradle プロジェクト
-npx ph workflow check | implement | finish implement | archive <ticket-id>
-npx ph workflow split README.md && npx ph workflow next   # マルチ ticket
-npx ph bearshell --shell 'gradle test'                    # 制限された実行
-npx ph evidence summary | metrics --json | ab-report --json | pminus-report --json
-npx ph review backend-shape
-```
-
-全リストは `npx ph --help`。workflow 台帳は `.persona/workflow/`（`work/`, `history/`, `requirements/`）にあります。
-
-## オプション統合 (opt-in preview)
-
-```bash
-npx ph bootstrap backend --codegraph-preview          # CodeGraph
-npx ph bootstrap backend --lsp-preview                # Java LSP
-npx ph bootstrap backend --runtime-injection-preview  # parked model-facing guidance
-npx ph bootstrap backend --no-developer-mcp           # 既定の developer MCP を無効化
-```
-
-preview wrapper は外部ツールがない場合、成功を偽装せず **unavailable** 状態を報告します。runtime injection は parked（negative 測定）であり、推奨パスではありません。
-
-## プラットフォームとホストのサポート
-
-| サーフェス | 状態 | 根拠の範囲 |
-| --- | --- | --- |
-| macOS / Linux + OpenCode | 検証済み | 現在の Persona Harness のホストアダプターとプロダクトの根拠は、macOS/Linux 上の OpenCode に限定されます。 |
-| Windows | 未検証 | Windows のサポートを主張しません。ロック identity の device/inode 動作と stale-lock/concurrency に関する結論は、測定も検証もされていません。 |
-| Codex adapter | 計画中 | 現在の Codex adapter または Codex プロダクトの根拠はありません。計画中の adapter にすぎません。 |
-
-## 境界と安全
-
-Evidence は一つの質問にのみ答えます — *「エージェントは期待された rail を見て従ったか？」* — それ以上ではありません。PH はアプリ品質認証、トークン節約、Clean Code 保証、broad AST/linter 強制、full TDD フレームワーク、closure 保証、OpenCode なしの完全な workflow を**約束しません**。正規のリストは [MEASURED-CLAIMS](docs/MEASURED-CLAIMS.md) にあります。
-
-> [!WARNING]
-> `ph bearshell` は**サンドボックスではありません**。実行時間と出力サイズを制限しますが、コマンドはあなたのマシン上であなたの権限で実行されます。[SECURITY](SECURITY.md) を参照。
-
-## ドキュメント
-
-- **新規ユーザー** → [Start Here](docs/START-HERE.md) · [Quick Demo](docs/QUICK-DEMO.md) · [Measured Claims](docs/MEASURED-CLAIMS.md)
-- **インストール & バックエンド形状** → [MVP インストールガイド](docs/current/java-backend-mvp-install-guide.md)
-- **コントリビューター** → [CONTRIBUTING](CONTRIBUTING.md) · [ROADMAP](ROADMAP.md) · [CODE_OF_CONDUCT](CODE_OF_CONDUCT.md)
-- **リリース & 測定** → [リリース運用](docs/current/release/README.md) · [バージョン別リリース文書](docs/releases/README.md) · [パッケージインデックス](docs/releases/package-index.md) · [Changelog](CHANGELOG.md)
-
-## コントリビュート
-
-コントリビュートを歓迎します — ネガティブな測定結果も含めて。PH は証拠が裏付けるものだけを主張し、主張を広げる PR はその測定を伴わなければなりません。[CONTRIBUTING.md](CONTRIBUTING.md) から読んでください。
-
-## ライセンス
-
-Apache-2.0。[LICENSE](LICENSE) を参照してください。