RegistryStack v0.12.2

Registry Stack v0.12.2

Registry Stack v0.12.2 is the beta-16 fix-forward release after the v0.12.1
publication attempt stopped at the image advisory gate. The v0.12.1 tag remains
an immutable historical marker and did not produce a completed GitHub Release.
Beta-16 preserves the beta-14 product scope, adds no new product features, and
contains only release-build correctness, dependency-security maintenance,
release-gate reliability, and Notary runtime transport correctness fixes.

Fix-forward changes

• Registryctl and Relay now build in separate release invocations, and release
  verification rejects a Relay binary containing Registryctl-only authoring
  features.
• Shared binary and image wrappers use canonical container paths, pinned
  Buildx, BuildKit, and Dockerfile inputs, normalized filesystem metadata, and
  registry-pushed BuildKit provenance. Independent builds must match binary
  hashes and ordered runtime root filesystem layers.
• Candidate evidence starts only after the refreshed versioned preparation
  commit merges to protected main. Before tagging, the finalized target must
  reproduce the reviewed candidate's binary hashes and ordered runtime root
  filesystem layers.
• Relay's XLSX and phone-metadata XML dependency paths now resolve only to
  quick-xml 0.41 through Calamine 0.36 and phonenumber 0.3.10, removing the
  temporary RUSTSEC-2026-0194 and RUSTSEC-2026-0195 exceptions.
• ryu-js is pinned exactly to 1.0.3 after refreshed source, unsafe-path, and
  alternatives review. Registry Stack uses only Buffer::format_finite; the
  fixed format_to_fixed defect was not reachable.
• Registry Notary router tests use in-process transport except where a real
  peer address or external server is part of the contract. This prevents
  loopback socket exhaustion in the release gate without changing production
  request handling.
• Registry Notary's single-use eSignet authorization-code exchange now uses a
  short-lived DNS-pinned client so pooled connections cannot cross validated
  endpoint lifecycles. Redirects and proxies remain denied, timeouts remain
  bounded, and the non-idempotent token exchange is never transparently
  retried.

Product scope

There are no new product features relative to v0.12.1. Registry Notary's
wallet-facade, status-verification, bounded-batch, and generated-configuration
schema changes; Registry Relay's stable-surface roster, refresh-health, and
Debian 13 changes; and Registryctl's output and project-publication changes are
the unchanged beta-14 scope. Use the v0.12.0 notes for the full migration
detail, but install and deploy the completed v0.12.2 artifacts.

These maintenance changes do not change public routes or authentication and
authorization contracts. Disclosure, credential issuance, audit, nonce, and
approval behavior is unchanged.

Registry Manifest has no user-visible change in this train. Crosswalk remains
pinned at 1d44ec735fdc8a7c719264b339574371e8330337.

Release evidence and held gates

The release workflow retains the eight-artifact public inventory: Registry
Notary, the Notary CEL worker, Registry Relay, the Relay Rhai worker, Registry
Manifest CLI, Registryctl, the Registryctl image lock, and Registry Docs. It
publishes exactly two runtime images, checksums, Software Bill of Materials
files, vulnerability reports, a release capsule, signatures, and provenance.

The reviewed Debian findings are time-bounded accepted risk, not a claim that
the base operating system has no known vulnerabilities. A fixable finding, a
changed runtime root filesystem, an expired review, or a finding outside the
reviewed set fails the advisory gate.

Solmara Lab repinning, the complete upgrade and rollback exercise, OpenCRVS and
DHIS2 external runs, OpenID conformance, external wallet or verifier
interoperability, hosted publication, and the independent pilot remain held.
This source note does not claim any of those results.