persona-harness 0.8.23 → 0.8.25

package/CHANGELOG.md

@@ -8,10 +8,24 @@ preparation alone does not establish stable support or channel state.
 
 ## Unreleased
 
+- Add a release-truth contract: stable GitHub Release generation rejects
+  source-candidate language, distinguishes the GitHub Release from the later
+  npm/provenance completion step, and keeps public maintainer command scopes
+  explicit.
 - Keep process-only evaluation cleanup in the normal CI lane while reserving
   the single-worker resource-sensitive lane for fixtures that own mutable
   package, Gradle, staged-consumer, workflow-loop, or producer runtime state.
 
+## [0.8.24] - 2026-08-22
+
+- Publish the exact packed-package Java/Spring Gradle/JUnit cooperative Finish
+  demo as the required `Verify repository` contract.
+- Keep runtime injection default-off; the legacy runtime-hook demos use only an
+  explicit test-local preview opt-in.
+- Record the protected integration, immutable tag, stable GitHub Release, npm
+  `latest` publication, canonical tar reconciliation, and provenance readback
+  as immutable 0.8.24 release facts.
+
 ## [0.8.4] - 2026-08-11
 
 - Add a finite, nonreflective `bindingReason` to blocked authority fetch results

package/README.md

@@ -53,7 +53,13 @@ production readiness, token savings, or broad security guarantees.
 **Start with:** [Quick Demo](docs/QUICK-DEMO.md) · [Measured Claims](docs/MEASURED-CLAIMS.md) · [Install guide](docs/START-HERE.md)
 
 > [!IMPORTANT]
-> **Alpha, gate-first, measured.** Live registry channels, tags, GitHub releases, and audit lifecycle facts are maintained in governed registry and audit records; source documentation records only its own preparation boundary. Runtime injection remains **default-off / opt-in**. See [`docs/current/p3-integrity-roadmap.md`](docs/current/p3-integrity-roadmap.md), [`docs/MEASURED-CLAIMS.md`](docs/MEASURED-CLAIMS.md), and [`injection-value-status.json`](docs/current/injection-value-status.json).
+> **Alpha, gate-first, measured.** Live registry channels, tags, GitHub releases,
+> and audit lifecycle facts are maintained by governed workflows and release
+> records; source release notes are inputs, not standalone proof. Runtime
+> injection remains **default-off / opt-in**. See
+> [`docs/current/p3-integrity-roadmap.md`](docs/current/p3-integrity-roadmap.md),
+> [`docs/MEASURED-CLAIMS.md`](docs/MEASURED-CLAIMS.md), and
+> [`injection-value-status.json`](docs/current/injection-value-status.json).
 
 ## Measured Behavior
 
@@ -149,7 +155,22 @@ address hostile same-user filesystem path replacement.
 > [!IMPORTANT]
 > `workflow finish` cannot reach a trusted PASS from a purely local checkout. Clearing every content gate still leaves `trusted-authority-required`, because only a verified external attestation from an enrolled repository grants finish authority. Enrol one with `npx ph authority`, and run `npx ph doctor` to see the current `Finish authority` and `Consumer authority` state before you rely on the gate.
 
-Three-beat setup, gate, and goal-entry walkthrough: **[Quick Demo](docs/QUICK-DEMO.md)**.
+Three-beat setup, gate, and goal-entry walkthrough: **[Quick Demo](docs/QUICK-DEMO.md)**. Repository maintainers and reviewers can run the separate exact-package Gradle/JUnit contract: **[Full cooperative verification demo](docs/QUICK-DEMO.md#full-cooperative-verification-demo)**.
+
+## Maintainer verification
+
+From a source checkout, the commands have deliberately different scopes:
+
+```bash
+npm test                    # packaged CLI smoke
+npm run test:unit           # full Vitest unit/integration suite
+npm run test:repository     # full repository contract: policy, docs, unit/integration, and clean-package checks
+node scripts/verify-cooperative-finish-demo.mjs # exact packed-package Java/Spring Gradle/JUnit demo
+```
+
+The required `Verify repository` workflow runs the full repository contract and
+the exact cooperative demo. These commands establish their named contracts; they
+do not certify generated application quality or external Finish authority.
 
 ## TDD Rail (opt-in)
 

package/docs/QUICK-DEMO.md

@@ -71,6 +71,28 @@ npx ph workflow closure next --json
 `workflow closure next --json` is diagnostic state, not a `finish --json`
 result. `workflow finish` has no `--json` option.
 
+## Full Cooperative Verification Demo
+
+Repository maintainers and reviewers can exercise the longer exact-package
+contract from a Persona Harness checkout:
+
+```bash
+npm ci
+node scripts/verify-cooperative-finish-demo.mjs
+```
+
+It requires Node 20.19+, JDK 21, and Gradle 9.4.0. The required repository
+verification job runs this exact command. It creates a disposable Java/Spring
+Gradle fixture, packs and installs the current package tarball, demonstrates
+the initial `workflow-state-uninitialized` block, then records real
+Gradle/JUnit evidence and reaches `Finish status: PASS` with
+`--assurance cooperative`.
+
+This is a maintainer/reviewer test contract, not an end-user startup command.
+It keeps runtime injection default-off, does not call an external authority,
+and does not grant trusted external authority. Add `-- --keep` only when the
+temporary fixture needs manual inspection.
+
 ## Boundaries
 
 This walkthrough demonstrates only the observed setup, blocked-finish, and

package/docs/current/README.md

@@ -47,9 +47,12 @@ history but do not become a current product or release claim.
 ## Release And Package Records
 
 The release row above leads to the compact operator entrypoint and durable
-package chronology. Historical Consumer Authority records live under `release/`;
-their past PASS, NO-GO, or staging result does not provide current Finish
-authority, promotion, or channel permission.
+package chronology. The current source release input and the latest published
+release record are intentionally separate: read the release operations table
+and package index for recorded facts, then re-read live registry and protected
+workflow state before a new release decision. Historical Consumer Authority
+records live under `release/`; their past PASS, NO-GO, or staging result does
+not provide current Finish authority, promotion, or channel permission.
 
 ## Deep Reference And History
 

package/docs/current/canonical-docs-index.md

@@ -18,7 +18,7 @@ Start with [Current Docs](README.md) unless you need a specific decision.
 | External environment procedure | `docs/current/external-environment-verification.md` | A bounded packaged-install check on a separate machine. |
 | External-attested Finish walkthrough | `docs/current/external-attested-finish-walkthrough.md` | Source-checkout-only enrolled/fetch/Finish/replay procedure and its limits. |
 | Consumer Authority V1 decision | `docs/current/consumer-authority-v1-decision.md` | The explicit cooperative assurance boundary. |
-| Release operations | `docs/current/release/README.md` | Current release checklist, runbooks, tag policy, and recorded state. |
+| Release operations | `docs/current/release/README.md` | Current release checklist, runbooks, tag policy, and the separation of source inputs from recorded published state. |
 | Version/package chronology | `docs/releases/package-index.md` | Durable version history and release-note links. |
 | Advanced repository surfaces | `docs/current/advanced-surface-index.md` | Source-checkout-only dormant, preview, and repository work. |
 | Full retained-file catalog | `docs/current/docs-inventory.md` | Exhaustive classification when the map above is insufficient. |

package/docs/current/java-backend-mvp-install-guide.md

@@ -122,9 +122,18 @@ npm run demo:java-mvp
 
 `npm run demo:init`은 package artifact가 실제 설치 환경에서 `persona-harness init`으로 clean project를 안전하게 초기화하는지 확인한다.
 
-`npm run demo:bootstrap`은 init 이후 README target에서 bootstrap injection과 runtime evidence 생성이 되는지 확인한다.
+`npm run demo:bootstrap`은 init 이후 README target에서 bootstrap injection과 runtime evidence 생성이 되는지 확인한다. 설치된 named `PersonaHarnessPlugin` export를 사용하고 임시 프로젝트 안에서만 `ph bootstrap backend --runtime-injection-preview --no-developer-mcp`를 명시적으로 적용한다. 이 opt-in은 기본 `runtimeInjection` 설정을 바꾸지 않는다.
 
-`npm run demo:java-mvp`는 package artifact가 실제 설치 환경에서도 Java Controller plugin hook, injection, model input transform, evidence 생성 경로를 재현하는지 확인한다.
+`npm run demo:java-mvp`는 package artifact가 실제 설치 환경에서도 Java Controller plugin hook, injection, model input transform, evidence 생성 경로를 재현하는지 확인한다. 마찬가지로 disposable fixture에서만 preview opt-in을 사용한다.
+
+저장소 maintainer/reviewer가 실제 Gradle/JUnit과 workflow Finish 경계를 검증하려면 Node 20.19+, JDK 21, Gradle 9.4.0 환경에서 다음을 실행한다.
+
+```bash
+npm ci
+node scripts/verify-cooperative-finish-demo.mjs
+```
+
+이 명령은 exact packed package를 disposable Java/Spring fixture에 설치하고, 먼저 `workflow-state-uninitialized` BLOCK을 확인한 다음 실제 Gradle/JUnit evidence와 `--assurance cooperative`의 `Finish status: PASS`를 확인한다. required repository CI도 같은 명령을 실행한다. 이는 trusted external authority나 production quality를 증명하지 않는다.
 
 검증하는 것:
 
@@ -212,7 +221,7 @@ Plugin hook이 발동하면 연결한 Java/Spring 프로젝트의 configured evi
 
 ## Non-Goals
 
-이 install guide와 `npm run demo:java-mvp`는 다음을 보증하지 않는다.
+이 install guide와 `npm run demo:java-mvp` 및 `node scripts/verify-cooperative-finish-demo.mjs`는 다음을 보증하지 않는다.
 
 - 생성된 Spring application의 품질
 - 테스트 충분성

package/docs/current/persona-harness-detailed-usage.md

@@ -302,9 +302,18 @@ npm run demo:java-mvp
 
 `npm run demo:init`은 package artifact를 임시 clean project에 설치하고 `persona-harness init`을 실행해 `.persona/rules`, `.persona/harness.jsonc`, `.opencode/opencode.json`이 안전하게 만들어지는지 확인한다. 이때 `.persona/evidence`가 생기면 실패한다.
 
-`npm run demo:bootstrap`은 init 이후 `README.md` target으로 설치된 plugin hook을 직접 호출해 `project-bootstrap` injection과 runtime evidence 생성을 확인한다.
+`npm run demo:bootstrap`은 init 이후 `README.md` target으로 설치된 named `PersonaHarnessPlugin` hook을 직접 호출해 `project-bootstrap` injection과 runtime evidence 생성을 확인한다. disposable fixture에서만 `ph bootstrap backend --runtime-injection-preview --no-developer-mcp`를 명시적으로 적용하며, 기본 `runtimeInjection`은 그대로 off다.
 
-`npm run demo:java-mvp`는 package artifact가 실제 설치 환경에서도 plugin hook, injection, model input transform, evidence 생성 경로를 재현하는지 확인한다. 내부적으로 빌드, `npm pack`, 임시 프로젝트 설치, `persona-harness init`, 설치된 `dist/index.js` OpenCode plugin hook 실행, Java Controller injection, model input transform, `.persona/evidence/phase0` evidence 생성을 검증한다.
+`npm run demo:java-mvp`는 package artifact가 실제 설치 환경에서도 plugin hook, injection, model input transform, evidence 생성 경로를 재현하는지 확인한다. 내부적으로 빌드, `npm pack`, 임시 프로젝트 설치, `persona-harness init`, 설치된 `dist/index.js` OpenCode plugin hook 실행, Java Controller injection, model input transform, `.persona/evidence/phase0` evidence 생성을 검증한다. 이 preview opt-in도 disposable fixture 안에 한정된다.
+
+실제 Gradle/JUnit과 workflow Finish의 BLOCK-to-PASS 경계는 repository maintainer/reviewer용 별도 명령이다. Node 20.19+, JDK 21, Gradle 9.4.0 환경에서 실행한다.
+
+```bash
+npm ci
+node scripts/verify-cooperative-finish-demo.mjs
+```
+
+이 명령은 exact packed package를 Java/Spring fixture에 설치하고 `workflow-state-uninitialized` BLOCK을 먼저 확인한 뒤, 실제 Gradle/JUnit evidence와 `--assurance cooperative`의 local `Finish status: PASS`를 검증한다. required repository CI도 같은 명령을 실행하며 trusted external authority나 생성된 application quality는 주장하지 않는다.
 
 ### B. Clean Java/Spring Project Local Install
 
@@ -559,6 +568,7 @@ npm run build
 npm run demo:init
 npm run demo:bootstrap
 npm run demo:java-mvp
+node scripts/verify-cooperative-finish-demo.mjs
 npm test
 npm run typecheck
 npm run build
@@ -588,7 +598,15 @@ npm run demo:bootstrap
 npm run demo:java-mvp
 ```
 
-이 명령들은 현재 저장소를 빌드한 뒤 `npm pack`으로 tarball을 만들고, 임시 프로젝트에 `persona-harness` 패키지를 설치한다. `demo:init`은 `persona-harness init` 표면을 검증하고, `demo:bootstrap`은 README bootstrap hook surface를 검증하며, `demo:java-mvp`는 Java Controller target에 대한 Phase 0 hook을 직접 호출한다.
+이 명령들은 현재 저장소를 빌드한 뒤 `npm pack`으로 tarball을 만들고, 임시 프로젝트에 `persona-harness` 패키지를 설치한다. `demo:init`은 `persona-harness init` 표면을 검증하고, `demo:bootstrap`은 disposable preview opt-in으로 README bootstrap hook surface를 검증하며, `demo:java-mvp`는 같은 disposable preview opt-in으로 Java Controller target에 대한 Phase 0 hook을 직접 호출한다.
+
+Node 20.19+, JDK 21, Gradle 9.4.0이 있는 repository maintainer/reviewer는 다음 full contract도 실행할 수 있다.
+
+```bash
+node scripts/verify-cooperative-finish-demo.mjs
+```
+
+이 명령은 initial `workflow-state-uninitialized` BLOCK, exact packed package, 실제 Gradle/JUnit evidence, `--assurance cooperative` local PASS를 검증한다. trusted external authority나 application quality를 증명하지 않으며 required repository CI가 동일 명령을 실행한다.
 
 검증하는 것:
 

package/docs/current/release/README.md

@@ -18,14 +18,13 @@ find the record; it is not a ledger of every historical release decision.
 
 ## Recorded Release State
 
-At the recorded 2026-08-10 release state:
+At the recorded 2026-08-22 release state:
 
 | Channel or record | Value | Source |
 | --- | --- | --- |
-| npm `latest` | `0.8.2` | [`v0.8.2` release notes](v0.8.2-release-notes.md) |
-| npm `next` | `0.8.0-rc.1` | [`v0.8.0-rc.1` release notes](v0.8.0-rc.1-release-notes.md) |
-| npm `staging` | `0.8.0-beta.34` | [`v0.8.0-beta.34` release notes](v0.8.0-beta.34-release-notes.md) |
-| GitHub latest release | `v0.8.1` | [GitHub releases](https://github.com/jyt6640/persona-harness/releases) |
+| npm `latest` | `0.8.24` | [`v0.8.24` release notes](v0.8.24-release-notes.md) |
+| GitHub latest release | `v0.8.24` | [GitHub releases](https://github.com/jyt6640/persona-harness/releases) |
+| Historical prerelease channels | recorded separately | [Package/version index](../../releases/package-index.md) |
 
 These are recorded facts, not a standing authorization to publish, promote a
 channel, consume Finish authority, or create a release. Before a release