Cycle for Zcode 1.0.12

Cycle for Zcode 1.0.12

Governed delivery for ZCode: an architect plans, an executor implements inside an
isolated worktree, two independent reviewers judge the frozen candidate, and an
arbiter decides - with every gate result and verdict written to a hash-chained,
signature-checkpointed ledger.

1.0.12 closes what the 1.0.11 live campaign left open.

Fixed

• A request that named credential material was routed to quick. The
  router kept its own short word list and missed a request that asked for an
  sk_live_ literal, so the independent security review of full never ran. It
  now consults the secret-scan gate's own credential table, matches plurals, and
  covers passwords, private and signing keys and access, bearer and refresh
  tokens.
• /cycle:doctor described workflows it had no information about. The
  doctor result now lists the project's recent workflows with nextOperations,
  found by trying each operation on a copy of the state machine, and the command
  reports those fields verbatim. A cancelled workflow can no longer be called
  resumable.
• /cycle:goal did not say how to drive a goal. cycle_goal publishes every
  operation's fields, bound to the Rust type by a test; the command documents
  each call and the lifecycle; goal status lists the arbitration receipt
  digests approve_completion accepts.
• /cycle:setup remove reported pin drift for the profiles it had just
  deleted.

The published-release gate now also refuses a release marked stable without a
valid live-certification receipt. See the
changelog.

Artifacts

Built and sealed by release-candidate run 35908223733 from 64a23f4; the
certification battery passed 20/20 on Windows 11 x64 and Ubuntu 22.04, and clean
installs passed on Windows 11, Ubuntu 22.04 and Ubuntu 24.04. Tag v1.0.12 is
signed by 29CB2E3FA61B8A2FFE97BF87CC4D1A39CE15684F and points at the commit that
imports these exact daemons.

Not yet claimed

Until 1.0.12 has been carried through the thirteen-scenario live campaign against
this exact archive, it is a sealed and reproducible candidate rather than a
certified release, and it is marked as a pre-release for that reason. 1.0.11
remains the certified stable release.