Skip to content

Vexa 0.12.1 — first pipeline-clean release

Latest
Latest

Choose a tag to compare

View all tags
@DmitriyG228 DmitriyG228 released this 12 Jul 23:37
v0.12.1
a363ab9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Vexa v0.12.1 — the first pipeline-clean release. Same product surface as 0.12.0; this
release exists to prove the ship bar itself: every image built, published, and validated by the
release machinery (0.12.0's images were hand-pushed around a broken matrix). It also lands the
governance system and two security dependency waves.

What's in it

  • Governance system on main (#505) — two constitutions + three protocols
    (PREPARE / TAKE / MAINTAIN) as one delivery law, with the AGENTS.md front door. 9 docs → 4.
  • Security dependency waves — #517 (pytest out of runtime deps → dev groups, GHSA-6w46-j5rx-g56g)
    and #521 (esbuild ≥0.25, postcss ≥8.5.10, vite 8.1.4 — Dependabot 137/141/143/169/178/179).
  • Release machinery (#494) — the release-images lane (build → publish → prove → promote).
  • Maiden-run bug paydown — the first real ship-bar run fixed four latent defects the
    hand-pushed 0.12.0 hid: Docker Hub CI creds, the nonexistent clients/dashboard matrix entry
    (#549, executes the dashboard-deprecation ruling at the artifact level), the lite STT-gate 503
    in the smoke (#550), and the POST /bots → 502 startup race in the concurrent-bots smoke
    (readiness gate added).
  • Release machinery split (#551/#554) — build+publish is now separate from validate+promote,
    so a validation-harness fix re-runs the verdict in minutes without rebuilding unchanged images.

Validated on (coverage statement)

Proven on what we name — all legs pull the published :v0.12.1 images, never a local build:

  • Lite (self-host compose) — front doors green + concurrent-bots smoke on a fresh
    us-sea VM     (2 bots, isolated profiles, 45s stable) AND CI validate-lite. release/vm-validated
    posted on the release commit.
  • Compose (full stack) — validate-compose, validate-mock-fsm, real bot spawn
    (validate-bot-spawn).
  • 0.10 API backward-compat — validate-v010-compat (passes + recorded V010-BREAK: xfails only).
  • Kubernetes / Helm — validate-helm-k3s (ephemeral single node, gateway /health + all pods Running).
  • Image identity — every published image proven to contain what its name promises.

Honestly unclaimed: arm64 (amd64-only this release; tracked follow-up), and the hosted STT path
under load (the internal fallback token is capacity-saturated — an ops item, not a release defect).

Pointers

:v012 now moves to v0.12.1 on all images. :latest unchanged. vexaai/vexa-bot:{dev,latest}
untouched (0.10 line).

Assets 3
Loading