Haft 9.0.2

A patch release for the project-profile onboarding defect in conventional monorepos. Its published predecessor is v9.0.1.

The defect

The file-metadata detector recognized apps/web/package.json as a software manifest but accepted production source only when the first path segment was app, cmd, internal, lib, pkg, or src. A normal path such as apps/web/src/main.tsx therefore supplied no production-source signal.

In a repository with product and design Markdown, that left an inconsistent onboarding state:

• haft profile inspect reported mixed, conflicting evidence with no complete suggested_scopes;
• haft_onboard(action="profile_prepare") could still materialize the partial document suggestion as an exact review;
• an explicit software scope was rejected because the detector had retained a partial candidate.

Applying that review would make software specifications inapplicable to the real product, while the normal recovery path was unavailable.

What changed

apps/<component>/src/** now carries a production-source signal. A conventional manifest and source tree therefore produces one supported software scope. Ordinary Markdown beside that implementation remains product material rather than a separate realization; an explicit document-system manifest can still establish its own scope.

Profile preparation now uses an explicit scope-identity posture:

• stable identity may produce an automatic review;
• a complete mixed or otherwise underdetermined observation produces needs_scope_review with no partial projected scopes and may accept explicit reviewed scopes;
• a truncated observation cannot use manual fallback;
• stable detection cannot be replaced through fallback.

An unchanged Haft-generated review from an older detector can be atomically refreshed. Manual, enriched, and foreign reviews keep the existing no-clobber protection.

Upgrade from v9.0.1

Install 9.0.2 and reconnect or restart the host so every MCP process loads the new binary. In an affected project, inspect the profile again:

:::bash
haft profile inspect --json --full-evidence

Then prepare the non-binding review again through haft_onboard(action="profile_prepare").

profile_prepare does not apply the profile, change specification lifecycle, or grant authority. This release adds no database migration.

This committed note describes the release contract; it does not record P13 or P14 evidence and is not release authority. Tag validation and public GitHub Release publication remain separate actions.