Skip to content

v0.8.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Aug 09:58
v0.8.1
280fbf1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.8.1 Release Notes

Two finish fixes for platforms with no native project-read artifact

A patch on the latest line. It changes nothing for darwin or linux, and it
does not move any gate. What it fixes is workflow finish on a platform the
release builds no native project-read artifact for — Windows today — where
ph doctor promises:

finish reports blockers but cannot reach a cooperative PASS

Neither half of that promise held. Both do now.

What was wrong

Both defects were found by installing the published 0.8.0 on Windows and
running it, not by the test suite. All 2,190 tests passed throughout.

The finish reported a verification that never ran

0.8.0 printed these two lines together:

- Cooperative verification blocked: source-read-runtime-unavailable.

... Cooperative verification ran without the snapshot boundary ...

The platform fallback added in #214 deliberately passes no boundary down, and
prepareCooperativeFinishContext re-reserved the very boundary that branch had
skipped. So the finish was blocked before evaluating anything, while the notice
described a completed unsnapshotted run.

A gate that reports a verification it did not perform errs in the one direction
that matters. Fixed in #236 (#235).

The finish could not report a single blocker

Same cause, and it left Windows with no usable cooperative path at all —
workflow finish implement accepts only --assurance cooperative, so there was
no alternative on that command.

Fixed in #240. Where 0.8.0 printed one runtime error, 0.8.1 prints the
project's real blockers with their next actions:

Required fixes:
- Closure blocker: verification-unknown
  Run test/build/runtime verification through `npx ph bearshell`. …
- Closure blocker: implementation-report-missing
- Closure blocker: review-report-missing
- Closure blocker: evidence-missing

What this release does not relax

Nothing. The second fix opens a context on a platform with no artifact, and that
alone would have reached runCooperativeGradleVerification — a non-boundary
path that returns passed — producing a cooperative PASS on the one platform
whose doctor output states it cannot reach one, with nothing running the build
under a boundary.

So the two halves of the promise are two separate gates, and the second refuses
passed explicitly with cooperative-pass-unavailable-on-this-platform.

Both key on whether the release builds an artifact for the platform, never on
whether a boundary happens to be absent. A platform that does build one and
fails to reserve it keeps failing closed, because that is a load or tamper
signal rather than a platform fact.

Cooperative assurance remains darwin and linux only, exactly as in 0.8.0.
#217 is closed as a recorded decision rather than as pending work — a win32
artifact is feasible without any undocumented Windows API, and is still a
reimplementation of a 2,164-line security-critical component with no measured
demand behind it.

Also in this release

  • The Windows CI smoke had never exercised the cooperative path, because the
    default assurance is external and it passed no --assurance. It now
    asserts both halves of the promise on the real runner.
  • Windows platform smoke is a required check on main; it previously ran on
    every PR without being able to block a merge.
  • A test fixture copied 37 MB of accumulated evidence into a simulated package
    root on every call — content that cannot exist in a real package, since
    npm pack ships none of it. It was also the cause of an intermittent suite
    failure, and its cost grew with every run the repository made (#237).

Verification

  • Full suite 2196/2196 across 296 files.
  • Windows behaviour verified on the CI runner, not inferred.
  • 0.8.0 remains the accepted general-availability record for its own tree;
    consumer-authority-v081-acceptance.json supersedes it only for what this
    patch changes.

Upgrading

npm install persona-harness@0.8.1

No configuration, evidence, or workflow-state migration. A workspace that had
consumed a finish attestation on 0.8.0 stays consumed — that record is
terminal per workspace and this release does not touch it.

Automation Metadata

  • Source release notes: docs/current/release/v0.8.1-release-notes.md
  • Package version: 0.8.1
  • Tag: v0.8.1
  • Intended npm dist-tag: latest
  • Acceptance results index: docs/current/acceptance-results/README.md

Claim Boundaries

This GitHub release body is generated from the repository release notes. It does
not add token-saving, provider-token-saving, product-efficacy,
navigation-benefit, app-quality, full-TDD/test-sufficiency, CodeGraph/LSP
default/effectiveness, broad reliability, closure guarantee, Codex support,
code-nav replacement, or automatic downgrade/removal claims.

It also does not select a current workflow lifecycle state or prove #111
producer success, signature verification, registry publication, tag movement,
GitHub release creation, or release completion.

Assets 2
Loading