RegistryStack v0.13.0

Registry Stack v0.13.0

Registry Stack v0.13.0 is the beta-17 release. It is a breaking pre-1.0
release that tightens the Relay and Notary evidence boundary, replaces the
deployment-waiver metadata contract, and completes a set of Registryctl
authoring and release-evidence corrections.

Breaking changes

• Registry Relay removes the inert six-field provenance.consent member from
  registry.relay.consultation-result.v1 and its closed batch-terminal replay
  representation. The PostgreSQL terminal constraint now accepts only the
  reduced exact shape. Operators must drain retained terminal replays and
  re-bootstrap the pre-release consultation state plane before upgrading.
  Old and v0.13.0 Relay binaries must not share one consultation state plane.
• Registry Notary's closed Relay-result decoder accepts only that reduced
  result contract. Registry-backed credential issuance still requires exact
  compiler-pinned Relay evidence. Consent verification, policy enforcement,
  legal-basis handling, evidence commitments, scopes, authorization, and trust
  headers are unchanged.
• Relay, Notary, and registry-platform-ops replace deployment-waiver
  reason with a required validated reference and optional validated
  summary. Strict configuration parsing rejects the retired field. Default
  posture continues to omit waiver metadata, and hard startup and readiness
  gates remain non-waivable.
• The hidden registryctl init spreadsheet-api compatibility alias is
  removed. Use registryctl init relay for the local spreadsheet tutorial or
  registryctl init --from for Registry Stack project authoring.

Authoring and evidence changes

• Maintained project-authoring fixtures keep Relay source adaptation, Notary
  evidence policy, and consumer decisions separate. The DHIS2 Tracker starter
  distinguishes positive, negative, unknown, no-match, ambiguity, and source
  failure outcomes. Snapshot and custom-system examples now model reusable
  evidence or explicitly source-owned decisions.
• Registryctl smoke reports identify and validate the closed
  registryctl.smoke.v1 schema.
• Release conformance evidence is bound to immutable candidates, normalized
  artifact coordinates, and promoted only through the closed evidence
  contracts. These controls do not claim that an external OpenID, OpenCRVS,
  DHIS2, or pilot run passed for beta-17.

Security and release maintenance

• Relay rejects non-exclusive Android trust roots so a configured Android
  attestation root cannot also remain trusted through the general federation
  root set.
• Registryctl isolates attribute-release scopes and tightens governed live
  evidence validation.
• Privileged release workflows use hardened permissions and immutable action
  inputs. Release gate inventory and sharded CI now preserve required-check
  coverage while reducing pull-request latency.
• The Nightly Security workflow now runs only the maintained Notary fuzz
  target. A CI contract test compares that workflow inventory with the fuzz
  manifest so retired or newly added targets cannot silently drift.
• Dependency and Scorecard maintenance keeps Rust advisory blockers visible
  and removes the vulnerable editor dependency paths that can be updated
  without changing the incompatible editor graph.

Product scope and held gates

Registry Manifest has no user-visible change. Crosswalk remains pinned at
1d44ec735fdc8a7c719264b339574371e8330337.

The release workflow publishes Registry Notary, its CEL worker, Registry
Relay, its Rhai worker, Registry Manifest CLI, Registryctl, the Registryctl
image lock, Registry Docs, checksums, Software Bill of Materials files,
vulnerability reports, signatures, provenance, and the release capsule.

Solmara Lab repinning, hosted publication, the owner-run OpenSPP holdout, the
complete upgrade and rollback exercise, external OpenCRVS and DHIS2 runs,
external OpenID conformance, wallet or verifier interoperability, and the
independent deployment pilot remain separate held gates. This source release
does not claim those results.