persona-harness 0.8.24 → 0.8.26

package/CHANGELOG.md

@@ -8,10 +8,33 @@ preparation alone does not establish stable support or channel state.
 
 ## Unreleased
 
+- Replace static live-release snapshots in package-visible current documents
+  with npm and GitHub lookup links, so a newly published package cannot become
+  stale at the instant its governed publish completes.
+- Add a release-truth contract: stable GitHub Release generation rejects
+  source-candidate language, distinguishes the GitHub Release from the later
+  npm/provenance completion step, and keeps public maintainer command scopes
+  explicit.
 - Keep process-only evaluation cleanup in the normal CI lane while reserving
   the single-worker resource-sensitive lane for fixtures that own mutable
   package, Gradle, staged-consumer, workflow-loop, or producer runtime state.
 
+## [0.8.25] - 2026-08-22
+
+- Publish the release-truth contract through protected integration, immutable
+  tag, stable GitHub Release, npm `latest`, canonical tar reconciliation, and
+  provenance readback.
+
+## [0.8.24] - 2026-08-22
+
+- Publish the exact packed-package Java/Spring Gradle/JUnit cooperative Finish
+  demo as the required `Verify repository` contract.
+- Keep runtime injection default-off; the legacy runtime-hook demos use only an
+  explicit test-local preview opt-in.
+- Record the protected integration, immutable tag, stable GitHub Release, npm
+  `latest` publication, canonical tar reconciliation, and provenance readback
+  as immutable 0.8.24 release facts.
+
 ## [0.8.4] - 2026-08-11
 
 - Add a finite, nonreflective `bindingReason` to blocked authority fetch results

package/README.md

@@ -53,7 +53,13 @@ production readiness, token savings, or broad security guarantees.
 **Start with:** [Quick Demo](docs/QUICK-DEMO.md) · [Measured Claims](docs/MEASURED-CLAIMS.md) · [Install guide](docs/START-HERE.md)
 
 > [!IMPORTANT]
-> **Alpha, gate-first, measured.** Live registry channels, tags, GitHub releases, and audit lifecycle facts are maintained in governed registry and audit records; source documentation records only its own preparation boundary. Runtime injection remains **default-off / opt-in**. See [`docs/current/p3-integrity-roadmap.md`](docs/current/p3-integrity-roadmap.md), [`docs/MEASURED-CLAIMS.md`](docs/MEASURED-CLAIMS.md), and [`injection-value-status.json`](docs/current/injection-value-status.json).
+> **Alpha, gate-first, measured.** Live registry channels, tags, GitHub releases,
+> and audit lifecycle facts are maintained by governed workflows and release
+> records; source release notes are inputs, not standalone proof. Runtime
+> injection remains **default-off / opt-in**. See
+> [`docs/current/p3-integrity-roadmap.md`](docs/current/p3-integrity-roadmap.md),
+> [`docs/MEASURED-CLAIMS.md`](docs/MEASURED-CLAIMS.md), and
+> [`injection-value-status.json`](docs/current/injection-value-status.json).
 
 ## Measured Behavior
 
@@ -151,6 +157,21 @@ address hostile same-user filesystem path replacement.
 
 Three-beat setup, gate, and goal-entry walkthrough: **[Quick Demo](docs/QUICK-DEMO.md)**. Repository maintainers and reviewers can run the separate exact-package Gradle/JUnit contract: **[Full cooperative verification demo](docs/QUICK-DEMO.md#full-cooperative-verification-demo)**.
 
+## Maintainer verification
+
+From a source checkout, the commands have deliberately different scopes:
+
+```bash
+npm test                    # packaged CLI smoke
+npm run test:unit           # full Vitest unit/integration suite
+npm run test:repository     # full repository contract: policy, docs, unit/integration, and clean-package checks
+node scripts/verify-cooperative-finish-demo.mjs # exact packed-package Java/Spring Gradle/JUnit demo
+```
+
+The required `Verify repository` workflow runs the full repository contract and
+the exact cooperative demo. These commands establish their named contracts; they
+do not certify generated application quality or external Finish authority.
+
 ## TDD Rail (opt-in)
 
 Enable both settings in `.persona/harness.jsonc`:

package/docs/current/README.md

@@ -47,9 +47,12 @@ history but do not become a current product or release claim.
 ## Release And Package Records
 
 The release row above leads to the compact operator entrypoint and durable
-package chronology. Historical Consumer Authority records live under `release/`;
-their past PASS, NO-GO, or staging result does not provide current Finish
-authority, promotion, or channel permission.
+package chronology. The current source release input and the latest published
+release record are intentionally separate: read the release operations table
+and package index for recorded facts, then re-read live registry and protected
+workflow state before a new release decision. Historical Consumer Authority
+records live under `release/`; their past PASS, NO-GO, or staging result does
+not provide current Finish authority, promotion, or channel permission.
 
 ## Deep Reference And History
 

package/docs/current/canonical-docs-index.md

@@ -18,7 +18,7 @@ Start with [Current Docs](README.md) unless you need a specific decision.
 | External environment procedure | `docs/current/external-environment-verification.md` | A bounded packaged-install check on a separate machine. |
 | External-attested Finish walkthrough | `docs/current/external-attested-finish-walkthrough.md` | Source-checkout-only enrolled/fetch/Finish/replay procedure and its limits. |
 | Consumer Authority V1 decision | `docs/current/consumer-authority-v1-decision.md` | The explicit cooperative assurance boundary. |
-| Release operations | `docs/current/release/README.md` | Current release checklist, runbooks, tag policy, and recorded state. |
+| Release operations | `docs/current/release/README.md` | Current release checklist, runbooks, tag policy, and the separation of source inputs from recorded published state. |
 | Version/package chronology | `docs/releases/package-index.md` | Durable version history and release-note links. |
 | Advanced repository surfaces | `docs/current/advanced-surface-index.md` | Source-checkout-only dormant, preview, and repository work. |
 | Full retained-file catalog | `docs/current/docs-inventory.md` | Exhaustive classification when the map above is insufficient. |

package/docs/current/release/README.md

@@ -16,20 +16,20 @@ find the record; it is not a ledger of every historical release decision.
 - [Release operations history](history.md) retains old readiness decisions,
   beta evidence, and the full release-note index without making them current.
 
-## Recorded Release State
+## Live Release State
 
-At the recorded 2026-08-10 release state:
+The package version in this checkout is a source input. npm dist-tags and
+GitHub Releases can change only later in the governed lifecycle, so
+package-visible current docs do not freeze a live channel snapshot.
 
-| Channel or record | Value | Source |
-| --- | --- | --- |
-| npm `latest` | `0.8.2` | [`v0.8.2` release notes](v0.8.2-release-notes.md) |
-| npm `next` | `0.8.0-rc.1` | [`v0.8.0-rc.1` release notes](v0.8.0-rc.1-release-notes.md) |
-| npm `staging` | `0.8.0-beta.34` | [`v0.8.0-beta.34` release notes](v0.8.0-beta.34-release-notes.md) |
-| GitHub latest release | `v0.8.1` | [GitHub releases](https://github.com/jyt6640/persona-harness/releases) |
+- Read [live npm versions and dist-tags](https://www.npmjs.com/package/persona-harness?activeTab=versions).
+- Read [live GitHub Releases](https://github.com/jyt6640/persona-harness/releases).
+- Read immutable historical version facts in the
+  [package/version index](../../releases/package-index.md).
 
-These are recorded facts, not a standing authorization to publish, promote a
-channel, consume Finish authority, or create a release. Before a release
-decision, read the live registry and the protected workflow state again.
+Those sources are not a standing authorization to publish, promote a channel,
+consume Finish authority, or create a release. Before a release decision, read
+the live registry and the protected workflow state again.
 
 ## Current Workflow Lifecycle Boundary