chore(release): promote Registry Stack v0.12.0 beta-14

[jeremi]

Summary

Promote the complete frozen release/1.0 beta-14 integration tree to protected main as one signed-off commit, plus confirmed release-gate fixes. Commit 2068d650 is byte-for-byte identical to release/1.0 at 817ddec63d759653d88f2d934b55943f6a62c7b1.

This replaces #420 because the direct branch comparison exposed an older already-integrated unsigned squash commit to the DCO range check. No history was rewritten and no integrated product scope was dropped.

Confirmed promotion blockers

The exact main comparison correctly reports the intentional pre-1.0 removal of GET /oid4vci/credential-offer, POST /oid4vci/nonce, and three corresponding optional response fields. Commit a60c6745 restores the already-reviewed one-time exception with an exact five-change set; 641a5bfa aligns its literal quoting with the workflow-pinned oasdiff 1.23.0 output. It passes only against the pre-promotion baseline and fails once the baseline contains the new contract, so the finalization PR must delete it before tagging. No wildcard or general compatibility suppression is introduced.

Review of the fully green promotion head then found a real PostgreSQL OID4VCI boundary mismatch: the application generates canonical sha256:<64 lowercase hex> issuance commitments, while the encrypted state AAD and database schema accepted only bare 64-hex values. Commit 2dfc1cd3 makes the state-plane validation, SQL constraints, semantic schema identity, per-major catalog fingerprints, and fixtures agree on the canonical application format. It does not weaken commitment validation. Three duplicate Cargo wildcard comments are false positives because Cargo package specs support this glob and the exact all-features build, clippy, test, and coverage jobs passed.

Release

• Registry Stack v0.12.0
• beta registry-stack-beta-14
• manifest remains release-candidate until post-publication evidence supports closeout
• hosted/public and Solmara gates remain explicitly held as recorded in the manifest

Verification

• release/1.0 preparation PR chore(release): prepare Registry Stack v0.12.0 beta-14 #419 passed the complete CI suite
• CodeQL blocker PR fix(release): clear beta-14 CodeQL blockers #421 passed DCO, CodeQL, Scorecard, secret scan, release tooling, and 199 local release-script tests
• downloaded oasdiff 1.23.0 checksum verified; exact pre-promotion Notary OpenAPI contract check passes with the five-change exception
• the same check deliberately fails against 817ddec6, proving the exception self-expires after promotion
• PostgreSQL 16, 17, and 18 full Notary conformance passed, including typed state contracts, multi-instance recovery, minor upgrades, and logical backup/restore
• 24 non-database state-plane tests passed with 3 dedicated-database tests covered by the conformance runs
• 9 preauthorization state tests passed
• canonical issuance AAD and semantic schema fingerprint focused tests passed
• gate inventory: 70 gates, no inert nested workflows; 32 inventory tests passed
• cargo fmt --all -- --check
• git diff --check

Signed-off-by: Jeremi Joslin jeremi@joslin.fr

Final review also found two release-boundary blockers. Commit d99368b9 binds the temporary OpenAPI exception to the exact pre-promotion contract blob so it cannot affect later baselines, and reserves the new issuance transaction claims against configured subject-claim overwrite. The focused token collision test, future-baseline OpenAPI path, shell syntax, formatting, and diff checks pass locally; the full protected suite is rerunning on the exact head.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2068d650e8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2068d650e8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2068d650e8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

registry-stack/products/notary/scripts/check-openapi-contract.sh

Line 106 in 641a5bf

if observed != allowed:

Remove self-expiring OpenAPI allowlist before baseline advances

When this lands on main, the CI job in .github/workflows/ci.yml runs this script with OPENAPI_CONTRACT_BASE_REF set to the PR base or previous push. For any later PR/push whose base already contains these v1.0 route removals, the raw breaking diff is empty, so this unconditional observed != allowed check exits with all five allowlisted lines missing and blocks unrelated Rust/product changes until the exception file is edited. Gate the exception on the pre-promotion baseline or remove it in this commit.

---

registry-stack/.github/workflows/ci.yml

Line 209 in 641a5bf

run: cargo build --locked -p registry-config-report -p 'registry-platform-*' --all-targets --all-features

Expand platform package list instead of passing a cargo wildcard

In the new platform jobs this quoted package spec is passed to Cargo literally whenever a platform path changes. I checked Cargo package selection locally (cargo build --help documents -p, --package [<SPEC>], and cargo pkgid -p 'registry-platform-*' exits with “invalid character '*' in package name”), so the build/lint/test steps here and the coverage step with the same -p 'registry-platform-*' fail before running. Generate the platform package list explicitly or use a workspace/exclude selection that Cargo accepts.

---

registry-stack/crates/registry-notary-core/src/tokens.rs

Line 177 in 641a5bf

"issuance_transaction_id".to_string(),

Reserve new transaction claims before subject insertion

When subject_access.subject_binding.token_claim is configured to a valid name such as issuance_transaction_id or issuance_transaction_commitment, insert_subject_claims runs after these new fields are written and the reserved-claim list still does not include them, so the civil ID overwrites the transaction binding in the pre-authorized code/access token. The token or credential endpoint then sees either an ID that no longer matches the code jti or a commitment that no longer matches the reserved transaction, causing otherwise-valid issuance for that configuration to be rejected; add the new claim names to the reserved list or reject them during config validation.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

registry-stack/products/notary/scripts/check-openapi-contract.sh

Line 106 in 641a5bf

if observed != allowed:

Remove self-expiring OpenAPI allowlist before baseline advances

When this lands on main, the CI job in .github/workflows/ci.yml runs this script with OPENAPI_CONTRACT_BASE_REF set to the PR base or previous push. For any later PR/push whose base already contains these v1.0 route removals, the raw breaking diff is empty, so this unconditional observed != allowed check exits with all five allowlisted lines missing and blocks unrelated Rust/product changes until the exception file is edited. Gate the exception on the pre-promotion baseline or remove it in this commit.

---

registry-stack/.github/workflows/ci.yml

Line 209 in 641a5bf

run: cargo build --locked -p registry-config-report -p 'registry-platform-*' --all-targets --all-features

Expand platform package list instead of passing a cargo wildcard

In the new platform jobs this quoted package spec is passed to Cargo literally whenever a platform path changes. I checked Cargo package selection locally (cargo build --help documents -p, --package [<SPEC>], and cargo pkgid -p 'registry-platform-*' exits with “invalid character '*' in package name”), so the build/lint/test steps here and the coverage step with the same -p 'registry-platform-*' fail before running. Generate the platform package list explicitly or use a workspace/exclude selection that Cargo accepts.

---

registry-stack/crates/registry-notary-core/src/tokens.rs

Line 177 in 641a5bf

"issuance_transaction_id".to_string(),

Reserve new transaction claims before subject insertion

When subject_access.subject_binding.token_claim is configured to a valid name such as issuance_transaction_id or issuance_transaction_commitment, insert_subject_claims runs after these new fields are written and the reserved-claim list still does not include them, so the civil ID overwrites the transaction binding in the pre-authorized code/access token. The token or credential endpoint then sees either an ID that no longer matches the code jti or a commitment that no longer matches the reserved transaction, causing otherwise-valid issuance for that configuration to be rejected; add the new claim names to the reserved list or reject them during config validation.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

registry-stack/products/notary/scripts/check-openapi-contract.sh

Line 106 in 641a5bf

if observed != allowed:

Remove self-expiring OpenAPI allowlist before baseline advances

When this lands on main, the CI job in .github/workflows/ci.yml runs this script with OPENAPI_CONTRACT_BASE_REF set to the PR base or previous push. For any later PR/push whose base already contains these v1.0 route removals, the raw breaking diff is empty, so this unconditional observed != allowed check exits with all five allowlisted lines missing and blocks unrelated Rust/product changes until the exception file is edited. Gate the exception on the pre-promotion baseline or remove it in this commit.

---

registry-stack/.github/workflows/ci.yml

Line 209 in 641a5bf

run: cargo build --locked -p registry-config-report -p 'registry-platform-*' --all-targets --all-features

Expand platform package list instead of passing a cargo wildcard

In the new platform jobs this quoted package spec is passed to Cargo literally whenever a platform path changes. I checked Cargo package selection locally (cargo build --help documents -p, --package [<SPEC>], and cargo pkgid -p 'registry-platform-*' exits with “invalid character '*' in package name”), so the build/lint/test steps here and the coverage step with the same -p 'registry-platform-*' fail before running. Generate the platform package list explicitly or use a workspace/exclude selection that Cargo accepts.

---

registry-stack/crates/registry-notary-core/src/tokens.rs

Line 177 in 641a5bf

"issuance_transaction_id".to_string(),

Reserve new transaction claims before subject insertion

When subject_access.subject_binding.token_claim is configured to a valid name such as issuance_transaction_id or issuance_transaction_commitment, insert_subject_claims runs after these new fields are written and the reserved-claim list still does not include them, so the civil ID overwrites the transaction binding in the pre-authorized code/access token. The token or credential endpoint then sees either an ID that no longer matches the code jti or a commitment that no longer matches the reserved transaction, causing otherwise-valid issuance for that configuration to be rejected; add the new claim names to the reserved list or reject them during config validation.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 641a5bfa8e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 641a5bfa8e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 641a5bfa8e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

registry-stack/products/notary/scripts/check-openapi-contract.sh

Line 106 in 641a5bf

if observed != allowed:

Remove self-expiring OpenAPI allowlist before baseline advances

When this lands on main, the CI job in .github/workflows/ci.yml runs this script with OPENAPI_CONTRACT_BASE_REF set to the PR base or previous push. For any later PR/push whose base already contains these v1.0 route removals, the raw breaking diff is empty, so this unconditional observed != allowed check exits with all five allowlisted lines missing and blocks unrelated Rust/product changes until the exception file is edited. Gate the exception on the pre-promotion baseline or remove it in this commit.

---

registry-stack/.github/workflows/ci.yml

Line 209 in 641a5bf

run: cargo build --locked -p registry-config-report -p 'registry-platform-*' --all-targets --all-features

Expand platform package list instead of passing a cargo wildcard

In the new platform jobs this quoted package spec is passed to Cargo literally whenever a platform path changes. I checked Cargo package selection locally (cargo build --help documents -p, --package [<SPEC>], and cargo pkgid -p 'registry-platform-*' exits with “invalid character '*' in package name”), so the build/lint/test steps here and the coverage step with the same -p 'registry-platform-*' fail before running. Generate the platform package list explicitly or use a workspace/exclude selection that Cargo accepts.

---

registry-stack/crates/registry-notary-core/src/tokens.rs

Line 177 in 641a5bf

"issuance_transaction_id".to_string(),

Reserve new transaction claims before subject insertion

When subject_access.subject_binding.token_claim is configured to a valid name such as issuance_transaction_id or issuance_transaction_commitment, insert_subject_claims runs after these new fields are written and the reserved-claim list still does not include them, so the civil ID overwrites the transaction binding in the pre-authorized code/access token. The token or credential endpoint then sees either an ID that no longer matches the code jti or a commitment that no longer matches the reserved transaction, causing otherwise-valid issuance for that configuration to be rejected; add the new claim names to the reserved list or reject them during config validation.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

registry-stack/products/notary/scripts/check-openapi-contract.sh

Line 106 in 641a5bf

if observed != allowed:

Remove self-expiring OpenAPI allowlist before baseline advances

When this lands on main, the CI job in .github/workflows/ci.yml runs this script with OPENAPI_CONTRACT_BASE_REF set to the PR base or previous push. For any later PR/push whose base already contains these v1.0 route removals, the raw breaking diff is empty, so this unconditional observed != allowed check exits with all five allowlisted lines missing and blocks unrelated Rust/product changes until the exception file is edited. Gate the exception on the pre-promotion baseline or remove it in this commit.

---

registry-stack/.github/workflows/ci.yml

Line 209 in 641a5bf

run: cargo build --locked -p registry-config-report -p 'registry-platform-*' --all-targets --all-features

Expand platform package list instead of passing a cargo wildcard

In the new platform jobs this quoted package spec is passed to Cargo literally whenever a platform path changes. I checked Cargo package selection locally (cargo build --help documents -p, --package [<SPEC>], and cargo pkgid -p 'registry-platform-*' exits with “invalid character '*' in package name”), so the build/lint/test steps here and the coverage step with the same -p 'registry-platform-*' fail before running. Generate the platform package list explicitly or use a workspace/exclude selection that Cargo accepts.

---

registry-stack/crates/registry-notary-core/src/tokens.rs

Line 177 in 641a5bf

"issuance_transaction_id".to_string(),

Reserve new transaction claims before subject insertion

When subject_access.subject_binding.token_claim is configured to a valid name such as issuance_transaction_id or issuance_transaction_commitment, insert_subject_claims runs after these new fields are written and the reserved-claim list still does not include them, so the civil ID overwrites the transaction binding in the pre-authorized code/access token. The token or credential endpoint then sees either an ID that no longer matches the code jti or a commitment that no longer matches the reserved transaction, causing otherwise-valid issuance for that configuration to be rejected; add the new claim names to the reserved list or reject them during config validation.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".