chore(release): promote Registry Stack v0.12.0 beta-14 by jeremi · Pull Request #420 · registrystack/registry-stack

jeremi · 2026-07-19T22:59:08Z

Summary

Promote the frozen Registry Stack beta-14 release scope from protected release/1.0 to protected main.

preserves the integrated scope prepared and verified in chore(release): prepare Registry Stack v0.12.0 beta-14 #419
includes only confirmed release-blocker fixes found by the release matrix
keeps hosted publication and Solmara repinning held
does not add draft PR Make the Relay, Notary, and programme decision boundary normative #418, unrelated Dependabot work, or new ticket scope

Verification

Preparation PR #419 passed the full exact-head matrix, including Rust workspace, Registryctl source tutorials, Docs, CodeQL, DCO, OpenSSF Scorecard, platform fuzz/coverage/portability, and Relay/Notary PostgreSQL 16/17/18 conformance.

After this squash merge, a source-ref finalization PR will pin the manifest and documentation inventory to the protected-main squash commit before v0.12.0 is tagged.

Signed-off-by: Jeremi Joslin jeremi@joslin.fr

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Preserve forward-compatible authorization metadata while keeping authorization decisions limited to modeled fields. Keep ClaimRef strict and align runtime parsing, generated schema, tests, and operator documentation. Corrects the Rust workspace regression introduced by #415.

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Prepare beta-14 from the frozen release/1.0 integration scope. Includes the confirmed release-blocker fixes for the local Notary listener and the pinned OpenAPI compatibility gate. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

+def atomic_json(path: Path, payload: dict[str, Any], mode: int) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    temporary = path.with_name(f".{path.name}.tmp")
+    descriptor = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, mode)


+            handle.write("\n")
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.chmod(temporary, mode)


+            "A live run remains unreviewed until its digest-bound report is "
+            "reviewed without raw secrets.",


+    finally:
+        try:
+            temporary.unlink()
+        except FileNotFoundError:


+    finally:
+        try:
+            temporary.unlink()
+        except FileNotFoundError:


+    finally:
+        try:
+            temporary.unlink()
+        except FileNotFoundError:


+import stat
+import subprocess
+import tempfile
+import unittest


Harden the beta-14 OIDC smoke runtime file boundary and resolve the exact CodeQL findings that blocked promotion. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

jeremi · 2026-07-19T23:25:04Z

Superseded by #422. The direct release/1.0 comparison cannot pass the repository DCO range check because it includes an older already-integrated unsigned squash commit. #422 promotes the exact same release/1.0 tree as one signed-off commit from main, without rewriting protected history or changing release scope.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 32640101b5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-19T23:45:19Z

+  release: beta-14
+  version: 0.12.0
+  source_repo: registrystack/registry-stack
+  source_ref: 865921f0d8e874e3cefe548d000e8915c4abecbc


Point source_ref at the release-tag lineage

When v0.12.0 is tagged on this promoted commit, the release workflow's Validate release source lineage step calls registry-release validate-source, which rejects non-draft manifests whose stack.source_ref is not an ancestor of the tag target. I checked 865921f0d8e874e3cefe548d000e8915c4abecbc against this commit and it is not in the ancestry, so the release job will fail before artifacts are built; use the tag target (or a main-reachable ancestor in the tag history) and regenerate any derived release/docs references.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-19T23:45:19Z

+          key: platform-all-features
+
+      - name: Build platform crates with all features
+        run: cargo build --locked -p registry-config-report -p 'registry-platform-*' --all-targets --all-features


Replace Cargo wildcard package specs

For any PR that touches platform paths, this new job is enabled, but Cargo does not accept * inside a -p/--package spec; I checked with cargo pkgid -p 'registry-platform-*' and Cargo reports invalid package ID specification because * is an invalid package-name character. The same package spec is reused by the clippy/test/llvm-cov steps, so platform CI will fail before running the intended checks unless the workflow expands the package list explicitly or uses a supported selection mechanism.

Useful? React with 👍 / 👎.

jeremi added 30 commits July 18, 2026 21:18

feat(notary): add generated config schema (#415)

e065c11

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(registryctl): default reports to human output

22996a1

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

docs(registryctl): document human report defaults

53095b9

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

feat(notary): enforce bounded batch evaluation

3d9c090

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

docs(notary): define bounded batch contract

d70b276

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(relay): migrate maintained images to Debian 13

364dbf7

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(notary): use Debian 13 distroless runtime

b39177f

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(release): enforce Debian 13 image bases

1254107

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

ci(release): build with pinned Debian 13 image

b44f0c9

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(relay): enforce Debian 13 scan policy

40409b8

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(notary): enforce Debian 13 scan policy

85f338a

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

ci(release): enforce builder and image scan policy

f3552bd

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(relay): align the 1.0 support roster

d4bbf85

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

docs(relay): publish the 1.0 support roster

0f2ce9b

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(relay): preserve stable core record routes

bfc1b88

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

docs(relay): expose unstable OpenAPI selectors

6bc29d3

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

ci(release): use canonical Relay feature set

273391a

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

test(relay): parse release features precisely

e1f920e

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

feat(release): guard stable lifecycle contracts

9fa2631

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(relay): scope OpenAPI stability to support roster

eaf2727

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

docs: finalize 1.0 lifecycle policy

fb6195f

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

ci: compare stable contracts to base revision

56abf30

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

test(release): require roster path coverage

182c62d

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(ci): validate Relay roster compatibility

f157dfc

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(release): require forward upgrade evidence

16b79b1

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

test(release): pin candidate release identifiers

b12dac8

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(release): protect stable roster selectors

e89ca8f

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(notary): preserve batch request compatibility

57b41d8

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

feat(notary): bind OID4VCI issuance to registry transactions

08c5cce

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

jeremi added 24 commits July 19, 2026 18:56

test(release): constrain OID4VCI conformance claims

e2507ab

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

refactor(notary): group OID4VCI materialization inputs

6e6530f

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(notary): remove retired OID4VCI client surfaces

83d2c50

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

test(notary): gate ES256 fixture with CEL support

e3f0449

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

test(notary): report safe batch conformance failures

eaa657f

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

release: add external integration evidence packet

5bd8bbf

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(release): harden integration evidence validation

a218fab

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(release): isolate verified candidate execution

93abd4d

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

test(release): add Relay OIDC candidate smoke

9052cdc

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(release): harden Relay OIDC smoke redirects

ecc21b9

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

docs(release): wrap Relay OIDC smoke commands

bba683d

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

chore(repo): single-source example profiles

7a2b8d7

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

feat(editors): add source installer

5d0d307

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

chore(monorepo): finish pre-convergence cleanup

55ff0bb

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(docs): prevent lazy evidence fetches

c84b1b9

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

docs(security): specify replay protection contracts

da27888

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

docs: specify operations posture contract

99aad41

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

docs(manifest): defer narrative keys to reference

6da9f12

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

chore(ci): remove inert nested workflows

8a1fcb1

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

chore(registryctl): use workspace YAML parser

6067918

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(ci): ignore generated secret-scan caches

563f570

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

feat(relay): expose last-good refresh health

1b6c012

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

fix(registryctl): stage project initialization

865921f

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

chore(release): prepare Registry Stack v0.12.0 beta-14

3264010

Prepare beta-14 from the frozen release/1.0 integration scope. Includes the confirmed release-blocker fixes for the local Notary listener and the pinned OpenAPI compatibility gate. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

github-advanced-security AI found potential problems Jul 19, 2026

View reviewed changes

fix(release): clear beta-14 CodeQL blockers

817ddec

Harden the beta-14 OIDC smoke runtime file boundary and resolve the exact CodeQL findings that blocked promotion. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

jeremi mentioned this pull request Jul 19, 2026

chore(release): promote Registry Stack v0.12.0 beta-14 #422

Merged

jeremi closed this Jul 19, 2026

chatgpt-codex-connector Bot reviewed Jul 19, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(release): promote Registry Stack v0.12.0 beta-14#420

chore(release): promote Registry Stack v0.12.0 beta-14#420
jeremi wants to merge 65 commits into
mainfrom
release/1.0

jeremi commented Jul 19, 2026

Uh oh!

Uh oh!

Uh oh!

jeremi commented Jul 19, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 19, 2026

Uh oh!

chatgpt-codex-connector Bot Jul 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		"A live run remains unreviewed until its digest-bound report is "
		"reviewed without raw secrets.",

Uh oh!

Conversation

jeremi commented Jul 19, 2026

Summary

Verification

Uh oh!

Uh oh!

Uh oh!

jeremi commented Jul 19, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 19, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants