persona-harness 0.8.24 → 0.8.25

package/CHANGELOG.md

@@ -8,10 +8,24 @@ preparation alone does not establish stable support or channel state.
 
 ## Unreleased
 
+- Add a release-truth contract: stable GitHub Release generation rejects
+  source-candidate language, distinguishes the GitHub Release from the later
+  npm/provenance completion step, and keeps public maintainer command scopes
+  explicit.
 - Keep process-only evaluation cleanup in the normal CI lane while reserving
   the single-worker resource-sensitive lane for fixtures that own mutable
   package, Gradle, staged-consumer, workflow-loop, or producer runtime state.
 
+## [0.8.24] - 2026-08-22
+
+- Publish the exact packed-package Java/Spring Gradle/JUnit cooperative Finish
+  demo as the required `Verify repository` contract.
+- Keep runtime injection default-off; the legacy runtime-hook demos use only an
+  explicit test-local preview opt-in.
+- Record the protected integration, immutable tag, stable GitHub Release, npm
+  `latest` publication, canonical tar reconciliation, and provenance readback
+  as immutable 0.8.24 release facts.
+
 ## [0.8.4] - 2026-08-11
 
 - Add a finite, nonreflective `bindingReason` to blocked authority fetch results

package/README.md

@@ -53,7 +53,13 @@ production readiness, token savings, or broad security guarantees.
 **Start with:** [Quick Demo](docs/QUICK-DEMO.md) · [Measured Claims](docs/MEASURED-CLAIMS.md) · [Install guide](docs/START-HERE.md)
 
 > [!IMPORTANT]
-> **Alpha, gate-first, measured.** Live registry channels, tags, GitHub releases, and audit lifecycle facts are maintained in governed registry and audit records; source documentation records only its own preparation boundary. Runtime injection remains **default-off / opt-in**. See [`docs/current/p3-integrity-roadmap.md`](docs/current/p3-integrity-roadmap.md), [`docs/MEASURED-CLAIMS.md`](docs/MEASURED-CLAIMS.md), and [`injection-value-status.json`](docs/current/injection-value-status.json).
+> **Alpha, gate-first, measured.** Live registry channels, tags, GitHub releases,
+> and audit lifecycle facts are maintained by governed workflows and release
+> records; source release notes are inputs, not standalone proof. Runtime
+> injection remains **default-off / opt-in**. See
+> [`docs/current/p3-integrity-roadmap.md`](docs/current/p3-integrity-roadmap.md),
+> [`docs/MEASURED-CLAIMS.md`](docs/MEASURED-CLAIMS.md), and
+> [`injection-value-status.json`](docs/current/injection-value-status.json).
 
 ## Measured Behavior
 
@@ -151,6 +157,21 @@ address hostile same-user filesystem path replacement.
 
 Three-beat setup, gate, and goal-entry walkthrough: **[Quick Demo](docs/QUICK-DEMO.md)**. Repository maintainers and reviewers can run the separate exact-package Gradle/JUnit contract: **[Full cooperative verification demo](docs/QUICK-DEMO.md#full-cooperative-verification-demo)**.
 
+## Maintainer verification
+
+From a source checkout, the commands have deliberately different scopes:
+
+```bash
+npm test                    # packaged CLI smoke
+npm run test:unit           # full Vitest unit/integration suite
+npm run test:repository     # full repository contract: policy, docs, unit/integration, and clean-package checks
+node scripts/verify-cooperative-finish-demo.mjs # exact packed-package Java/Spring Gradle/JUnit demo
+```
+
+The required `Verify repository` workflow runs the full repository contract and
+the exact cooperative demo. These commands establish their named contracts; they
+do not certify generated application quality or external Finish authority.
+
 ## TDD Rail (opt-in)
 
 Enable both settings in `.persona/harness.jsonc`:

package/docs/current/README.md

@@ -47,9 +47,12 @@ history but do not become a current product or release claim.
 ## Release And Package Records
 
 The release row above leads to the compact operator entrypoint and durable
-package chronology. Historical Consumer Authority records live under `release/`;
-their past PASS, NO-GO, or staging result does not provide current Finish
-authority, promotion, or channel permission.
+package chronology. The current source release input and the latest published
+release record are intentionally separate: read the release operations table
+and package index for recorded facts, then re-read live registry and protected
+workflow state before a new release decision. Historical Consumer Authority
+records live under `release/`; their past PASS, NO-GO, or staging result does
+not provide current Finish authority, promotion, or channel permission.
 
 ## Deep Reference And History
 

package/docs/current/canonical-docs-index.md

@@ -18,7 +18,7 @@ Start with [Current Docs](README.md) unless you need a specific decision.
 | External environment procedure | `docs/current/external-environment-verification.md` | A bounded packaged-install check on a separate machine. |
 | External-attested Finish walkthrough | `docs/current/external-attested-finish-walkthrough.md` | Source-checkout-only enrolled/fetch/Finish/replay procedure and its limits. |
 | Consumer Authority V1 decision | `docs/current/consumer-authority-v1-decision.md` | The explicit cooperative assurance boundary. |
-| Release operations | `docs/current/release/README.md` | Current release checklist, runbooks, tag policy, and recorded state. |
+| Release operations | `docs/current/release/README.md` | Current release checklist, runbooks, tag policy, and the separation of source inputs from recorded published state. |
 | Version/package chronology | `docs/releases/package-index.md` | Durable version history and release-note links. |
 | Advanced repository surfaces | `docs/current/advanced-surface-index.md` | Source-checkout-only dormant, preview, and repository work. |
 | Full retained-file catalog | `docs/current/docs-inventory.md` | Exhaustive classification when the map above is insufficient. |

package/docs/current/release/README.md

@@ -18,14 +18,13 @@ find the record; it is not a ledger of every historical release decision.
 
 ## Recorded Release State
 
-At the recorded 2026-08-10 release state:
+At the recorded 2026-08-22 release state:
 
 | Channel or record | Value | Source |
 | --- | --- | --- |
-| npm `latest` | `0.8.2` | [`v0.8.2` release notes](v0.8.2-release-notes.md) |
-| npm `next` | `0.8.0-rc.1` | [`v0.8.0-rc.1` release notes](v0.8.0-rc.1-release-notes.md) |
-| npm `staging` | `0.8.0-beta.34` | [`v0.8.0-beta.34` release notes](v0.8.0-beta.34-release-notes.md) |
-| GitHub latest release | `v0.8.1` | [GitHub releases](https://github.com/jyt6640/persona-harness/releases) |
+| npm `latest` | `0.8.24` | [`v0.8.24` release notes](v0.8.24-release-notes.md) |
+| GitHub latest release | `v0.8.24` | [GitHub releases](https://github.com/jyt6640/persona-harness/releases) |
+| Historical prerelease channels | recorded separately | [Package/version index](../../releases/package-index.md) |
 
 These are recorded facts, not a standing authorization to publish, promote a
 channel, consume Finish authority, or create a release. Before a release