From fd2005083f8274f028fcc72c1a5c4faaed20c722 Mon Sep 17 00:00:00 2001
From: Jeremi Joslin <jeremi@joslin.fr>
Date: Mon, 20 Jul 2026 09:44:49 +0700
Subject: [PATCH 1/2] chore(release): finalize Registry Stack v0.12.0 source

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
---
 .github/workflows/release.yml                 | 12 +++
 docs/site/src/data/contracts.yaml             | 16 +--
 docs/site/src/data/docsets.yaml               | 12 +--
 docs/site/src/data/generated/contracts.json   | 16 +--
 docs/site/src/data/generated/docsets.json     | 12 +--
 docs/site/src/data/generated/standards.json   | 98 +++++++++----------
 docs/site/src/data/standards.yaml             | 98 +++++++++----------
 .../notary/openapi/oasdiff-1.0-err-ignore.txt |  9 --
 .../notary/scripts/check-openapi-contract.sh  | 66 +------------
 release/manifests/registry-stack-beta-14.yaml |  2 +-
 release/scripts/test_registry_release.py      | 17 ++++
 11 files changed, 157 insertions(+), 201 deletions(-)
 delete mode 100644 products/notary/openapi/oasdiff-1.0-err-ignore.txt

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 15980a3c4..833440cdb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -383,6 +383,9 @@ jobs:
               --platform linux/amd64 \
               --file "${dockerfile}" \
               --tag "${image}" \
+              --label "org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}" \
+              --label "org.opencontainers.image.revision=${{ needs.verify.outputs.tag_target }}" \
+              --label "org.opencontainers.image.version=${{ needs.verify.outputs.version }}" \
               --metadata-file "${metadata}" \
               --cache-from "type=gha,scope=registry-stack-${name}" \
               --cache-to "type=gha,mode=max,scope=registry-stack-${name}" \
@@ -392,6 +395,15 @@ jobs:
             digest="$(jq -r '."containerimage.digest"' "${metadata}")"
             local digest_ref="${REGISTRY}/${IMAGE_NAMESPACE}/${name}@${digest}"
             printf '%s\n' "${digest_ref}" | tee "dist/images/${name}.digest"
+            docker buildx imagetools inspect "${digest_ref}" \
+              --format '{{json .Image.config}}' \
+              | jq -e \
+                --arg source "https://github.com/${GITHUB_REPOSITORY}" \
+                --arg revision "${{ needs.verify.outputs.tag_target }}" \
+                --arg version "${{ needs.verify.outputs.version }}" \
+                '.Labels["org.opencontainers.image.source"] == $source and
+                 .Labels["org.opencontainers.image.revision"] == $revision and
+                 .Labels["org.opencontainers.image.version"] == $version'
             syft "${digest_ref}" -o "spdx-json=dist/sbom/${name}.spdx.json"
             release/scripts/registry-release bind-spdx-subject \
               "dist/sbom/${name}.spdx.json" \
diff --git a/docs/site/src/data/contracts.yaml b/docs/site/src/data/contracts.yaml
index 7dffd0a73..89fb74600 100644
--- a/docs/site/src/data/contracts.yaml
+++ b/docs/site/src/data/contracts.yaml
@@ -5,7 +5,7 @@
   surface: Shared Rust crate APIs for auth helpers, OIDC verification, audit envelopes and sinks, HTTP security middleware, outbound HTTP policy, Ed25519 JWK and DID helpers, SD-JWT VC issuance, and testing fixtures.
   source_of_truth:
     label: Registry Platform crates
-    url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates
+    url: https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates
   consumer_note: Relay, Notary, and future registry services should consume these primitives instead of reimplementing security or operational behavior locally.
 - id: registry-platform.ops-posture-v1
   name: Registry Ops Posture v1
@@ -27,7 +27,7 @@
   surface: "Protected Registry Data API, metadata API, evidence offering discovery, aggregates, health and readiness, plus optional standards adapters (OGC API Features, OGC API Records, OGC API EDR, SP DCI)."
   source_of_truth:
     label: Registry Relay abstract OpenAPI contract
-    url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/openapi/registry-relay.openapi.json
+    url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/openapi/registry-relay.openapi.json
   consumer_note: Hand-authored from `docs/api.md` and the runtime route table. Uses templated paths and capability tags. For instance-specific shape of `{dataset_id}` and `{entity}`, fetch `GET /openapi.json` from a configured gateway. Runtime deployments gate that route by default unless `openapi_requires_auth` is disabled for demos or controlled tooling.
 - id: registry-notary.openapi
   name: Registry Notary OpenAPI
@@ -36,7 +36,7 @@
   surface: Claim discovery, claim evaluation, batch evaluation, federated delegated evaluation, rendering, JWKS, service metadata, and credential issuance.
   source_of_truth:
     label: Registry Notary OpenAPI generator
-    url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/openapi.rs
+    url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-server/src/openapi.rs
   consumer_note: Generate with `cargo run -p registry-notary -- openapi`. Both direct and OID4VCI credential routes require a fresh non-delegated stored evaluation with exact claim pins and normalized unique Relay execution records for every selected root's registry-backed dependency closure.
 - id: registry-notary.oid4vci
   name: Registry Notary OID4VCI surface
@@ -45,7 +45,7 @@
   surface: OID4VCI issuer metadata, Type Metadata, offer start and authenticated callback, pre-authorized token redemption, and registry-backed credential issuance. The wallet-facing grant is issuer-initiated pre-authorized code. Primitives are sourced from the `registry-platform-oid4vci` crate.
   source_of_truth:
     label: Registry Notary OID4VCI routes
-    url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/api.rs
+    url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-server/src/api.rs
   consumer_note: >-
     Registry Notary advertises `dc+sd-jwt`, EdDSA `did:jwk` holder proof, and
     the configured EdDSA or ES256 issuer algorithm. Credential configurations
@@ -64,7 +64,7 @@
   surface: Static-peer delegated evaluation over `POST /federation/v1/evaluations`, compact JWS request and response JWTs, peer policy checks, pairwise subject handles, replay protection, and federation audit fields.
   source_of_truth:
     label: Registry Notary federation module
-    url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/federation
+    url: https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-server/src/federation
   consumer_note: This is delegated evaluation only. Open federation, trust-chain discovery, shared replay storage, audit checkpoint exchange, and federated credential issuance are outside the MVP.
 - id: registry-manifest.metadata-yaml
   name: Metadata Manifest
@@ -73,7 +73,7 @@
   surface: Portable `metadata.yaml` documents, compiled metadata model, public services, forms, policies, requirements, evidence type lists, evidence offering metadata, public federation metadata, and evaluation profile metadata.
   source_of_truth:
     label: Registry Manifest core
-    url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-core
+    url: https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-manifest-core
   consumer_note: Runtime source paths, scopes, table names, backend URLs, peer allowlists, replay storage, and federation secrets belong in runtime service config, not manifests.
 - id: registry-manifest.cpsv-ap-service-catalogue
   name: CPSV-AP Service Catalogue Render Contract
@@ -82,7 +82,7 @@
   surface: CPSV-AP JSON-LD service catalogue, CCCEV requirements, grouped evidence type lists, local form-definition links, DCAT data services, and form JSON Schemas.
   source_of_truth:
     label: Registry Manifest CPSV-AP fixture
-    url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap
+    url: https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/fixtures/cpsv-ap
   consumer_note: Each CCCEV evidence type list is one grouped option; multiple lists on a requirement are alternatives.
 - id: registry-manifest.static-publication
   name: Static Metadata Publication Bundle
@@ -91,5 +91,5 @@
   surface: Static index, catalog JSON, evidence offerings, policies, DCAT, CPSV-AP, BRegDCAT-AP, SHACL, OGC Records item collection, entity JSON Schemas, form JSON Schemas, and embedded SKOS-shaped codelist nodes.
   source_of_truth:
     label: Registry Manifest CLI
-    url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-cli
+    url: https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-manifest-cli
   consumer_note: The bundle can be hosted as static files without running Registry Relay.
diff --git a/docs/site/src/data/docsets.yaml b/docs/site/src/data/docsets.yaml
index afa447af4..3017a7cf2 100644
--- a/docs/site/src/data/docsets.yaml
+++ b/docs/site/src/data/docsets.yaml
@@ -31,22 +31,22 @@ docsets:
     products:
       registry-stack:
         version: v0.12.0
-        ref: 865921f0d8e874e3cefe548d000e8915c4abecbc
+        ref: 0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f
       registry-platform:
         version: v0.12.0
-        ref: 865921f0d8e874e3cefe548d000e8915c4abecbc
+        ref: 0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f
       registry-manifest:
         version: v0.12.0
-        ref: 865921f0d8e874e3cefe548d000e8915c4abecbc
+        ref: 0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f
       registry-notary:
         version: v0.12.0
-        ref: 865921f0d8e874e3cefe548d000e8915c4abecbc
+        ref: 0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f
       registry-relay:
         version: v0.12.0
-        ref: 865921f0d8e874e3cefe548d000e8915c4abecbc
+        ref: 0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f
       registry-registryctl:
         version: v0.12.0
-        ref: 865921f0d8e874e3cefe548d000e8915c4abecbc
+        ref: 0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f
       crosswalk:
         version: crosswalk-core-v0.2.0
         ref: 1d44ec735fdc8a7c719264b339574371e8330337
diff --git a/docs/site/src/data/generated/contracts.json b/docs/site/src/data/generated/contracts.json
index fcb866522..7b3786810 100644
--- a/docs/site/src/data/generated/contracts.json
+++ b/docs/site/src/data/generated/contracts.json
@@ -7,7 +7,7 @@
     "surface": "Shared Rust crate APIs for auth helpers, OIDC verification, audit envelopes and sinks, HTTP security middleware, outbound HTTP policy, Ed25519 JWK and DID helpers, SD-JWT VC issuance, and testing fixtures.",
     "source_of_truth": {
       "label": "Registry Platform crates",
-      "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates"
+      "url": "https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates"
     },
     "consumer_note": "Relay, Notary, and future registry services should consume these primitives instead of reimplementing security or operational behavior locally."
   },
@@ -31,7 +31,7 @@
     "surface": "Protected Registry Data API, metadata API, evidence offering discovery, aggregates, health and readiness, plus optional standards adapters (OGC API Features, OGC API Records, OGC API EDR, SP DCI).",
     "source_of_truth": {
       "label": "Registry Relay abstract OpenAPI contract",
-      "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/openapi/registry-relay.openapi.json"
+      "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/openapi/registry-relay.openapi.json"
     },
     "consumer_note": "Hand-authored from `docs/api.md` and the runtime route table. Uses templated paths and capability tags. For instance-specific shape of `{dataset_id}` and `{entity}`, fetch `GET /openapi.json` from a configured gateway. Runtime deployments gate that route by default unless `openapi_requires_auth` is disabled for demos or controlled tooling."
   },
@@ -43,7 +43,7 @@
     "surface": "Claim discovery, claim evaluation, batch evaluation, federated delegated evaluation, rendering, JWKS, service metadata, and credential issuance.",
     "source_of_truth": {
       "label": "Registry Notary OpenAPI generator",
-      "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/openapi.rs"
+      "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-server/src/openapi.rs"
     },
     "consumer_note": "Generate with `cargo run -p registry-notary -- openapi`. Both direct and OID4VCI credential routes require a fresh non-delegated stored evaluation with exact claim pins and normalized unique Relay execution records for every selected root's registry-backed dependency closure."
   },
@@ -55,7 +55,7 @@
     "surface": "OID4VCI issuer metadata, Type Metadata, offer start and authenticated callback, pre-authorized token redemption, and registry-backed credential issuance. The wallet-facing grant is issuer-initiated pre-authorized code. Primitives are sourced from the `registry-platform-oid4vci` crate.",
     "source_of_truth": {
       "label": "Registry Notary OID4VCI routes",
-      "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/api.rs"
+      "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-server/src/api.rs"
     },
     "consumer_note": "Registry Notary advertises `dc+sd-jwt`, EdDSA `did:jwk` holder proof, and the configured EdDSA or ES256 issuer algorithm. Credential configurations accept non-delegated registry-backed claims only, and issuance verifies the stored transaction plus exact dependency-closure Relay execution provenance before signing. Transaction code is required by default. An explicit no-PIN profile has a maximum 300-second bearer-offer window. There is no wallet-facing authorization-code grant, public nonce route, response next nonce, source-free issuance, ES256 holder proof, PAR, DPoP, wallet attestation, EUDI, or HAIP claim. External wallet and verifier evidence is candidate-only until recorded against a frozen artifact."
   },
@@ -67,7 +67,7 @@
     "surface": "Static-peer delegated evaluation over `POST /federation/v1/evaluations`, compact JWS request and response JWTs, peer policy checks, pairwise subject handles, replay protection, and federation audit fields.",
     "source_of_truth": {
       "label": "Registry Notary federation module",
-      "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/federation"
+      "url": "https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-server/src/federation"
     },
     "consumer_note": "This is delegated evaluation only. Open federation, trust-chain discovery, shared replay storage, audit checkpoint exchange, and federated credential issuance are outside the MVP."
   },
@@ -79,7 +79,7 @@
     "surface": "Portable `metadata.yaml` documents, compiled metadata model, public services, forms, policies, requirements, evidence type lists, evidence offering metadata, public federation metadata, and evaluation profile metadata.",
     "source_of_truth": {
       "label": "Registry Manifest core",
-      "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-core"
+      "url": "https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-manifest-core"
     },
     "consumer_note": "Runtime source paths, scopes, table names, backend URLs, peer allowlists, replay storage, and federation secrets belong in runtime service config, not manifests."
   },
@@ -91,7 +91,7 @@
     "surface": "CPSV-AP JSON-LD service catalogue, CCCEV requirements, grouped evidence type lists, local form-definition links, DCAT data services, and form JSON Schemas.",
     "source_of_truth": {
       "label": "Registry Manifest CPSV-AP fixture",
-      "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap"
+      "url": "https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/fixtures/cpsv-ap"
     },
     "consumer_note": "Each CCCEV evidence type list is one grouped option; multiple lists on a requirement are alternatives."
   },
@@ -103,7 +103,7 @@
     "surface": "Static index, catalog JSON, evidence offerings, policies, DCAT, CPSV-AP, BRegDCAT-AP, SHACL, OGC Records item collection, entity JSON Schemas, form JSON Schemas, and embedded SKOS-shaped codelist nodes.",
     "source_of_truth": {
       "label": "Registry Manifest CLI",
-      "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-cli"
+      "url": "https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-manifest-cli"
     },
     "consumer_note": "The bundle can be hosted as static files without running Registry Relay."
   }
diff --git a/docs/site/src/data/generated/docsets.json b/docs/site/src/data/generated/docsets.json
index 0e5f882f3..f4ff6ef15 100644
--- a/docs/site/src/data/generated/docsets.json
+++ b/docs/site/src/data/generated/docsets.json
@@ -40,27 +40,27 @@
       "products": {
         "registry-stack": {
           "version": "v0.12.0",
-          "ref": "865921f0d8e874e3cefe548d000e8915c4abecbc"
+          "ref": "0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f"
         },
         "registry-platform": {
           "version": "v0.12.0",
-          "ref": "865921f0d8e874e3cefe548d000e8915c4abecbc"
+          "ref": "0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f"
         },
         "registry-manifest": {
           "version": "v0.12.0",
-          "ref": "865921f0d8e874e3cefe548d000e8915c4abecbc"
+          "ref": "0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f"
         },
         "registry-notary": {
           "version": "v0.12.0",
-          "ref": "865921f0d8e874e3cefe548d000e8915c4abecbc"
+          "ref": "0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f"
         },
         "registry-relay": {
           "version": "v0.12.0",
-          "ref": "865921f0d8e874e3cefe548d000e8915c4abecbc"
+          "ref": "0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f"
         },
         "registry-registryctl": {
           "version": "v0.12.0",
-          "ref": "865921f0d8e874e3cefe548d000e8915c4abecbc"
+          "ref": "0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f"
         },
         "crosswalk": {
           "version": "crosswalk-core-v0.2.0",
diff --git a/docs/site/src/data/generated/standards.json b/docs/site/src/data/generated/standards.json
index de51252fc..f841061ce 100644
--- a/docs/site/src/data/generated/standards.json
+++ b/docs/site/src/data/generated/standards.json
@@ -20,15 +20,15 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Manifest README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/README.md"
       },
       {
         "label": "Registry Relay DCAT catalog tests",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/catalog_entity.rs"
       }
     ],
     "last_checked": "2026-06-13",
@@ -54,15 +54,15 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Manifest README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/README.md"
       },
       {
         "label": "Registry Relay BRegDCAT-AP route tests",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/catalog_entity.rs"
       }
     ],
     "last_checked": "2026-06-13",
@@ -88,7 +88,7 @@
     "evidence_docs": [
       {
         "label": "Registry Manifest CPSV-AP fixture",
-        "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap"
+        "url": "https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/fixtures/cpsv-ap"
       }
     ],
     "last_checked": "2026-05-25",
@@ -114,15 +114,15 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Manifest README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/README.md"
       },
       {
         "label": "Registry Relay OGC records API tests",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/ogc_records_api.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/ogc_records_api.rs"
       }
     ],
     "last_checked": "2026-07-19",
@@ -147,11 +147,11 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Relay OGC Features API tests",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/ogc_api.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/ogc_api.rs"
       }
     ],
     "last_checked": "2026-07-19",
@@ -176,7 +176,7 @@
     "evidence_docs": [
       {
         "label": "Registry Relay OGC EDR API tests",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/ogc_edr_api.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/ogc_edr_api.rs"
       }
     ],
     "last_checked": "2026-07-19",
@@ -202,19 +202,19 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Notary README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/notary/README.md"
       },
       {
         "label": "Registry Relay generated OpenAPI document (pinned)",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/openapi/registry-relay.openapi.json"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/openapi/registry-relay.openapi.json"
       },
       {
         "label": "Registry Notary generated OpenAPI document (pinned)",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/openapi/registry-notary.openapi.json"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/notary/openapi/registry-notary.openapi.json"
       }
     ],
     "last_checked": "2026-07-19",
@@ -240,15 +240,15 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Manifest README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/README.md"
       },
       {
         "label": "Registry Relay SHACL document structure tests",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/catalog_entity.rs"
       }
     ],
     "last_checked": "2026-06-13",
@@ -274,11 +274,11 @@
     "evidence_docs": [
       {
         "label": "Registry Manifest codelist renderer",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-core/src/lib.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-manifest-core/src/lib.rs"
       },
       {
         "label": "Registry Manifest codelist tests",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-core/tests/metadata_core.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-manifest-core/tests/metadata_core.rs"
       }
     ],
     "last_checked": "2026-06-20",
@@ -304,15 +304,15 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Manifest README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/README.md"
       },
       {
         "label": "Registry Manifest form schema fixture (Draft 2020-12)",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json"
       }
     ],
     "last_checked": "2026-06-13",
@@ -341,15 +341,15 @@
     "evidence_docs": [
       {
         "label": "Registry Relay JSON-LD renderers",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/src/metadata/shacl.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/src/metadata/shacl.rs"
       },
       {
         "label": "Registry Notary CCCEV renderer",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/runtime.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-server/src/runtime.rs"
       },
       {
         "label": "Registry Manifest CPSV-AP JSON-LD fixture",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld"
       }
     ],
     "last_checked": "2026-06-13",
@@ -376,15 +376,15 @@
     "evidence_docs": [
       {
         "label": "Registry Notary SD-JWT VC conformance profile",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/docs/sd-jwt-vc-conformance-profile.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/notary/docs/sd-jwt-vc-conformance-profile.md"
       },
       {
         "label": "Registry Notary format constants",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-core/src/model.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-core/src/model.rs"
       },
       {
         "label": "Registry Platform SD-JWT crate",
-        "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-sdjwt"
+        "url": "https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-platform-sdjwt"
       }
     ],
     "last_checked": "2026-06-13",
@@ -409,7 +409,7 @@
     "evidence_docs": [
       {
         "label": "Registry Notary README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/notary/README.md"
       }
     ],
     "last_checked": "2026-05-23",
@@ -438,15 +438,15 @@
     "evidence_docs": [
       {
         "label": "Registry Manifest grouped evidence fixture",
-        "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap"
+        "url": "https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/fixtures/cpsv-ap"
       },
       {
         "label": "Registry Notary CCCEV renderer",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/runtime.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-server/src/runtime.rs"
       },
       {
         "label": "Registry Notary media type constants",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-core/src/model.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-core/src/model.rs"
       }
     ],
     "last_checked": "2026-05-25",
@@ -474,23 +474,23 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Manifest README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/README.md"
       },
       {
         "label": "Registry Relay catalog tests (ODRL offer assertions)",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/catalog_entity.rs"
       },
       {
         "label": "Registry Platform PDP ODRL enforcement profile constants",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-pdp/src/lib.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-platform-pdp/src/lib.rs"
       },
       {
         "label": "Registry Relay governed evidence PDP path",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/src/api/governed.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/src/api/governed.rs"
       }
     ],
     "last_checked": "2026-07-09",
@@ -515,11 +515,11 @@
     "evidence_docs": [
       {
         "label": "Registry Relay client integration guide",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/docs/client-integration.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/docs/client-integration.md"
       },
       {
         "label": "Registry Relay aggregates tests (schema-validated SDMX-JSON output)",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/aggregates_entity.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/aggregates_entity.rs"
       }
     ],
     "last_checked": "2026-07-19",
@@ -544,7 +544,7 @@
     "evidence_docs": [
       {
         "label": "Registry Notary claim model",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-core/src/model.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-core/src/model.rs"
       }
     ],
     "last_checked": "2026-05-23",
@@ -598,7 +598,7 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md"
       }
     ],
     "last_checked": "2026-05-23",
@@ -650,7 +650,7 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Stack OpenCRVS project-authoring fixture",
@@ -684,11 +684,11 @@
     "evidence_docs": [
       {
         "label": "Registry Notary OID4VCI routes",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/api.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-server/src/api.rs"
       },
       {
         "label": "Registry Platform OID4VCI crate",
-        "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-oid4vci"
+        "url": "https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-platform-oid4vci"
       },
       {
         "label": "Registry Notary wallet facade specification",
@@ -719,11 +719,11 @@
     "evidence_docs": [
       {
         "label": "Registry Notary did:jwk handling",
-        "url": "https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/api.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-server/src/api.rs"
       },
       {
         "label": "Registry Platform crypto crate",
-        "url": "https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-crypto"
+        "url": "https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-platform-crypto"
       }
     ],
     "last_checked": "2026-06-13",
diff --git a/docs/site/src/data/standards.yaml b/docs/site/src/data/standards.yaml
index fd1627e0e..6a80e639a 100644
--- a/docs/site/src/data/standards.yaml
+++ b/docs/site/src/data/standards.yaml
@@ -15,11 +15,11 @@
     - access service metadata
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md
     - label: Registry Manifest README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/README.md
     - label: Registry Relay DCAT catalog tests
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/catalog_entity.rs
   last_checked: 2026-06-13
   notes: Relay and Manifest emit DCAT-shaped metadata; the emitted catalog structure is asserted by Relay's catalog tests. Profile conformance claims still require profile-specific validation evidence (no DCAT validator output is pinned).
 - id: bregdcat-ap
@@ -38,11 +38,11 @@
     - embedded SHACL entity shapes
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md
     - label: Registry Manifest README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/README.md
     - label: Registry Relay BRegDCAT-AP route tests
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/catalog_entity.rs
   last_checked: 2026-06-13
   notes: Manifest and Relay emit BRegDCAT-shaped registry and data-service metadata; the `/metadata/dcat/bregdcat-ap` route output is asserted by Relay's catalog tests. CPSV-AP is now the service-discovery layer; BRegDCAT-AP remains the registry and data-service discovery layer. Later BRegDCAT-AP releases require a separate renderer review.
 - id: cpsv-ap
@@ -61,7 +61,7 @@
     - competent authority and requirement links
   evidence_docs:
     - label: Registry Manifest CPSV-AP fixture
-      url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap
+      url: https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/fixtures/cpsv-ap
   last_checked: 2026-05-25
   notes: Registry Manifest emits CPSV-AP service catalogues. Registry Relay does not expose a current CPSV-AP runtime route.
 - id: ogc-api-records
@@ -80,11 +80,11 @@
     - OGC records item bodies
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md
     - label: Registry Manifest README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/README.md
     - label: Registry Relay OGC records API tests
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/ogc_records_api.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/ogc_records_api.rs
   last_checked: 2026-07-19
   notes: The link-free Records metadata artifacts are stable for 1.0. The live Relay adapter behind ogcapi-records is a separate experimental, feature-frozen surface outside the 1.0 compatibility promise. Manifest renders and publishes static OGC Records item collections.
 - id: ogc-api-features
@@ -102,9 +102,9 @@
     - dataset-scoped feature items
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md
     - label: Registry Relay OGC Features API tests
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/ogc_api.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/ogc_api.rs
   last_checked: 2026-07-19
   notes: Relay exposes OGC API Features routes behind the ogcapi-features feature. The adapter is experimental, feature-frozen, and outside the 1.0 compatibility promise. The claim is scoped to the profiled route output tested in Registry Relay, not full OGC conformance.
 - id: ogc-api-edr
@@ -122,7 +122,7 @@
     - EDR collection discovery
   evidence_docs:
     - label: Registry Relay OGC EDR API tests
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/ogc_edr_api.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/ogc_edr_api.rs
   last_checked: 2026-07-19
   notes: Relay exposes OGC API EDR area routes behind the ogcapi-edr feature for configured spatial aggregates. The adapter is experimental, feature-frozen, and outside the 1.0 compatibility promise. The claim is scoped to the tested adapter surface, not full OGC conformance.
 - id: openapi
@@ -141,13 +141,13 @@
     - native OpenAPI publication
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md
     - label: Registry Notary README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/notary/README.md
     - label: Registry Relay generated OpenAPI document (pinned)
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/openapi/registry-relay.openapi.json
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/openapi/registry-relay.openapi.json
     - label: Registry Notary generated OpenAPI document (pinned)
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/openapi/registry-notary.openapi.json
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/notary/openapi/registry-notary.openapi.json
   last_checked: 2026-07-19
   notes: Relay and Notary generate OpenAPI; the pinned generated documents are cited directly. These docs publish the same pinned artifacts as native API reference pages.
 - id: shacl
@@ -166,11 +166,11 @@
     - entity node shapes
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md
     - label: Registry Manifest README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/README.md
     - label: Registry Relay SHACL document structure tests
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/catalog_entity.rs
   last_checked: 2026-06-13
   notes: Relay emits SHACL/JSON-LD documents whose structure is asserted by its catalog tests, and Manifest renders SHACL. No SHACL validator run against the emitted shapes is pinned.
 - id: skos
@@ -189,9 +189,9 @@
     - BRegDCAT/DCAT dataset codelist references
   evidence_docs:
     - label: Registry Manifest codelist renderer
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-core/src/lib.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-manifest-core/src/lib.rs
     - label: Registry Manifest codelist tests
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-manifest-core/tests/metadata_core.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-manifest-core/tests/metadata_core.rs
   last_checked: 2026-06-20
   notes: Registry Manifest emits flat SKOS-shaped `skos:ConceptScheme` and `skos:Concept` nodes for manifest codelists inside SHACL and BRegDCAT/DCAT-shaped outputs. It does not yet publish a standalone SKOS artifact or claim full SKOS conformance.
 - id: json-schema
@@ -210,11 +210,11 @@
     - static discovery bundle
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md
     - label: Registry Manifest README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/README.md
     - label: Registry Manifest form schema fixture (Draft 2020-12)
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json
   last_checked: 2026-06-13
   notes: Manifest renders entity JSON Schemas (the pinned fixture declares Draft 2020-12) and Relay exposes entity schema endpoints.
 - id: json-ld
@@ -236,11 +236,11 @@
     - CCCEV render output
   evidence_docs:
     - label: Registry Relay JSON-LD renderers
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/src/metadata/shacl.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/src/metadata/shacl.rs
     - label: Registry Notary CCCEV renderer
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/runtime.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-server/src/runtime.rs
     - label: Registry Manifest CPSV-AP JSON-LD fixture
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld
   last_checked: 2026-06-13
   notes: The projects emit JSON-LD artifacts and contexts; a pinned JSON-LD fixture is cited as a concrete emitted artifact. No broad RDF dataset conformance claim is made here.
 - id: sd-jwt-vc
@@ -260,11 +260,11 @@
     - shared SD-JWT VC issuance and holder-proof helpers
   evidence_docs:
     - label: Registry Notary SD-JWT VC conformance profile
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/docs/sd-jwt-vc-conformance-profile.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/notary/docs/sd-jwt-vc-conformance-profile.md
     - label: Registry Notary format constants
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-core/src/model.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-core/src/model.rs
     - label: Registry Platform SD-JWT crate
-      url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-sdjwt
+      url: https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-platform-sdjwt
   last_checked: 2026-06-13
   notes: >-
     Registry Platform owns reusable SD-JWT VC issuance and holder-proof helpers.
@@ -289,7 +289,7 @@
     - SD-JWT VC credential issuance
   evidence_docs:
     - label: Registry Notary README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/notary/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/notary/README.md
   last_checked: 2026-05-23
   notes: Registry Notary issues SD-JWT VC. Relay no longer emits or hosts VC artifacts.
 - id: cccev
@@ -311,11 +311,11 @@
     - evidence node JSON-LD
   evidence_docs:
     - label: Registry Manifest grouped evidence fixture
-      url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/fixtures/cpsv-ap
+      url: https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/fixtures/cpsv-ap
     - label: Registry Notary CCCEV renderer
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/runtime.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-server/src/runtime.rs
     - label: Registry Notary media type constants
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-core/src/model.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-core/src/model.rs
   last_checked: 2026-05-25
   notes: Manifest emits CCCEV requirement and evidence type list metadata. Notary renders CCCEV-shaped claim results. Profile conformance is not claimed.
 - id: odrl
@@ -336,15 +336,15 @@
     - governed evidence PDP constraint terms
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md
     - label: Registry Manifest README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/products/manifest/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/products/manifest/README.md
     - label: Registry Relay catalog tests (ODRL offer assertions)
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/catalog_entity.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/catalog_entity.rs
     - label: Registry Platform PDP ODRL enforcement profile constants
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-pdp/src/lib.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-platform-pdp/src/lib.rs
     - label: Registry Relay governed evidence PDP path
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/src/api/governed.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/src/api/governed.rs
   last_checked: 2026-07-09
   notes: Relay catalog JSON-LD can include dataset-scoped ODRL Offers, and Manifest renders ODRL policy metadata. That publication surface is descriptive and is not itself an access grant. The shared governed Evidence Gateway profile vocabulary includes `odrl:purpose` and `odrl:spatial`, but Relay's governed runtime path currently enforces `odrl:purpose` only; `odrl:spatial` and other unsupported ODRL terms are denied fail-closed rather than treated as enforced.
 - id: sdmx
@@ -362,9 +362,9 @@
     - content negotiation delivery
   evidence_docs:
     - label: Registry Relay client integration guide
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/docs/client-integration.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/docs/client-integration.md
     - label: Registry Relay aggregates tests (schema-validated SDMX-JSON output)
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/tests/aggregates_entity.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/tests/aggregates_entity.rs
   last_checked: 2026-07-19
   notes: >-
     Relay serves configured aggregates as SDMX-JSON 2.1 data messages via
@@ -391,7 +391,7 @@
     - provenance-shaped claim fields
   evidence_docs:
     - label: Registry Notary claim model
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-core/src/model.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-core/src/model.rs
   last_checked: 2026-05-23
   notes: The code uses provenance concepts, but current evidence does not show a PROV-O vocabulary emission surface. Keep this as design influence until PROV-O terms are emitted or mapped.
 - id: fhir-r4
@@ -429,7 +429,7 @@
     - capability boundary
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md
   last_checked: 2026-05-23
   notes: Relay explores a protected consultation gateway model rather than the current single uniform CRUD platform.
 - id: universal-dpi-safeguards
@@ -472,7 +472,7 @@
     - authored Relay source integration
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-relay/README.md
     - label: Registry Stack OpenCRVS project-authoring fixture
       url: https://github.com/registrystack/registry-stack/tree/2dfcf2ddf22e2c0fa4bf5fd84eb06b8736057605/crates/registryctl/tests/fixtures/project-authoring/opencrvs
   last_checked: 2026-07-19
@@ -497,9 +497,9 @@
     - registry-backed holder-wallet issuance
   evidence_docs:
     - label: Registry Notary OID4VCI routes
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/api.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-server/src/api.rs
     - label: Registry Platform OID4VCI crate
-      url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-oid4vci
+      url: https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-platform-oid4vci
     - label: Registry Notary wallet facade specification
       url: https://github.com/registrystack/registry-stack/blob/37ce044567f05f8b3088b54f5bd4dbf389fd2ddb/products/notary/specs/openid4vci-wallet-facade-spec.md
   last_checked: 2026-07-19
@@ -533,8 +533,8 @@
     - shared DID validation and Ed25519 JWK helpers
   evidence_docs:
     - label: Registry Notary did:jwk handling
-      url: https://github.com/registrystack/registry-stack/blob/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-notary-server/src/api.rs
+      url: https://github.com/registrystack/registry-stack/blob/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-notary-server/src/api.rs
     - label: Registry Platform crypto crate
-      url: https://github.com/registrystack/registry-stack/tree/865921f0d8e874e3cefe548d000e8915c4abecbc/crates/registry-platform-crypto
+      url: https://github.com/registrystack/registry-stack/tree/0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f/crates/registry-platform-crypto
   last_checked: 2026-06-13
   notes: Notary parses did:jwk values for credential subjects, and Platform owns shared DID and Ed25519 JWK helpers. Relay no longer hosts a did:web document. No DID resolver, DID URL dereferencing, or DID Core conformance class is implemented, so the claim stays at emits. The site does not claim conformance to the wider DID method registry beyond did:jwk.
diff --git a/products/notary/openapi/oasdiff-1.0-err-ignore.txt b/products/notary/openapi/oasdiff-1.0-err-ignore.txt
deleted file mode 100644
index 639cc1fcf..000000000
--- a/products/notary/openapi/oasdiff-1.0-err-ignore.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-# One-time accepted Registry Stack 1.0 break. The wallet facade now exposes
-# registry-backed, issuer-initiated pre-authorized issuance only. The contract
-# check also requires every line below to remain present in the raw diff, so this
-# file must be removed after the comparison baseline includes the new contract.
-GET /oid4vci/credential-offer api path removed without deprecation
-POST /oid4vci/nonce api path removed without deprecation
-GET /.well-known/openid-credential-issuer removed the optional property `nonce_endpoint` from the response with the `200` status
-POST /oid4vci/credential removed the optional property `c_nonce` from the response with the `200` status
-POST /oid4vci/credential removed the optional property `c_nonce_expires_in` from the response with the `200` status
diff --git a/products/notary/scripts/check-openapi-contract.sh b/products/notary/scripts/check-openapi-contract.sh
index 4e2f5e453..832b8a6b4 100755
--- a/products/notary/scripts/check-openapi-contract.sh
+++ b/products/notary/scripts/check-openapi-contract.sh
@@ -9,12 +9,6 @@ BASE_REF="${1:-${OPENAPI_CONTRACT_BASE_REF:-}}"
 WORK_DIR="target/openapi-contract"
 GENERATED="$WORK_DIR/generated.openapi.json"
 BASELINE="$WORK_DIR/base.openapi.json"
-RAW_BREAKING_DIFF="$WORK_DIR/breaking.singleline.txt"
-BREAKING_IGNORE="openapi/oasdiff-1.0-err-ignore.txt"
-# Exact git blob for the Notary 1.0 contract on main before beta-14 promotion.
-# The release-only exception below must never apply after that contract baseline
-# advances, even when BASE_REF also contains unrelated commits.
-NOTARY_1_0_BASELINE_BLOB="083a894a853c1791f2ba87f5ecee259e687eab70"
 
 mkdir -p "$WORK_DIR"
 
@@ -66,62 +60,4 @@ if ! git cat-file -e "$BASE_REF:$SPEC_PATH_FROM_ROOT" 2>/dev/null; then
 fi
 
 git show "$BASE_REF:$SPEC_PATH_FROM_ROOT" > "$BASELINE"
-
-BASELINE_BLOB="$(git rev-parse "$BASE_REF:$SPEC_PATH_FROM_ROOT")"
-if [[ "$BASELINE_BLOB" != "$NOTARY_1_0_BASELINE_BLOB" ]]; then
-    oasdiff breaking --fail-on ERR "$BASELINE" "$GENERATED"
-    exit 0
-fi
-
-# Keep the one-time 1.0 exception exact and self-expiring. An added allowlist
-# line fails this check, and an accepted line that disappears from the raw diff
-# also fails so the exception cannot silently survive a baseline advance.
-oasdiff breaking --format singleline "$BASELINE" "$GENERATED" > "$RAW_BREAKING_DIFF"
-python3 - "$BREAKING_IGNORE" "$RAW_BREAKING_DIFF" <<'PY'
-import sys
-from pathlib import Path
-
-expected = {
-    "GET /oid4vci/credential-offer api path removed without deprecation",
-    "POST /oid4vci/nonce api path removed without deprecation",
-    "GET /.well-known/openid-credential-issuer removed the optional property `nonce_endpoint` from the response with the `200` status",
-    "POST /oid4vci/credential removed the optional property `c_nonce` from the response with the `200` status",
-    "POST /oid4vci/credential removed the optional property `c_nonce_expires_in` from the response with the `200` status",
-}
-
-ignore_path = Path(sys.argv[1])
-raw_path = Path(sys.argv[2])
-allowed = {
-    line.strip()
-    for line in ignore_path.read_text(encoding="utf-8").splitlines()
-    if line.strip() and not line.lstrip().startswith("#")
-}
-if allowed != expected:
-    missing = sorted(expected - allowed)
-    extra = sorted(allowed - expected)
-    raise SystemExit(
-        f"Notary OpenAPI 1.0 allowlist is not exact; missing={missing}, extra={extra}"
-    )
-
-observed = set()
-for raw_line in raw_path.read_text(encoding="utf-8").splitlines():
-    marker = "in API "
-    if marker not in raw_line:
-        continue
-    change = raw_line.split(marker, 1)[1]
-    if " [" in change:
-        change = change.rsplit(" [", 1)[0]
-    observed.add(change.strip().removesuffix(".").rstrip())
-
-if observed != allowed:
-    missing = sorted(allowed - observed)
-    extra = sorted(observed - allowed)
-    raise SystemExit(
-        f"Notary OpenAPI 1.0 raw diff is not exactly allowlisted; "
-        f"missing={missing}, extra={extra}"
-    )
-PY
-
-oasdiff breaking --fail-on ERR --err-ignore "$BREAKING_IGNORE" \
-    --warn-ignore "$BREAKING_IGNORE" \
-    "$BASELINE" "$GENERATED"
+oasdiff breaking --fail-on ERR "$BASELINE" "$GENERATED"
diff --git a/release/manifests/registry-stack-beta-14.yaml b/release/manifests/registry-stack-beta-14.yaml
index d463c7a88..e852aeffc 100644
--- a/release/manifests/registry-stack-beta-14.yaml
+++ b/release/manifests/registry-stack-beta-14.yaml
@@ -2,7 +2,7 @@ stack:
   release: beta-14
   version: 0.12.0
   source_repo: registrystack/registry-stack
-  source_ref: 865921f0d8e874e3cefe548d000e8915c4abecbc
+  source_ref: 0a20f7a81d8ca2fccb70d8f4c088ff5acaf5f66f
   source_tag: v0.12.0
   status: release-candidate
 
diff --git a/release/scripts/test_registry_release.py b/release/scripts/test_registry_release.py
index ac653497d..b25c3ccfa 100755
--- a/release/scripts/test_registry_release.py
+++ b/release/scripts/test_registry_release.py
@@ -96,6 +96,23 @@ def test_release_image_packaging_uses_release_dockerfiles(self) -> None:
             text = (ROOT / dockerfile).read_text(encoding="utf-8")
             self.assertIn("dist/image-bin", text)
 
+    def test_release_images_publish_and_verify_source_labels(self) -> None:
+        workflow = (ROOT / ".github/workflows/release.yml").read_text(encoding="utf-8")
+
+        for label in [
+            '--label "org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}"',
+            '--label "org.opencontainers.image.revision=${{ needs.verify.outputs.tag_target }}"',
+            '--label "org.opencontainers.image.version=${{ needs.verify.outputs.version }}"',
+        ]:
+            self.assertEqual(workflow.count(label), 1)
+        self.assertIn('docker buildx imagetools inspect "${digest_ref}"', workflow)
+        for label_name in [
+            "org.opencontainers.image.source",
+            "org.opencontainers.image.revision",
+            "org.opencontainers.image.version",
+        ]:
+            self.assertGreaterEqual(workflow.count(label_name), 2)
+
     def test_release_cargo_cache_is_scoped_to_builder_image(self) -> None:
         workflow = (ROOT / ".github/workflows/release.yml").read_text(encoding="utf-8")
         binaries_job = workflow[

From 2140986baf48e98941c835adba3b04b814613cd9 Mon Sep 17 00:00:00 2001
From: Jeremi Joslin <jeremi@joslin.fr>
Date: Mon, 20 Jul 2026 09:51:18 +0700
Subject: [PATCH 2/2] fix(release): inspect OCI image config

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
---
 .github/workflows/release.yml            | 2 +-
 release/scripts/test_registry_release.py | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 833440cdb..5629beec7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -396,7 +396,7 @@ jobs:
             local digest_ref="${REGISTRY}/${IMAGE_NAMESPACE}/${name}@${digest}"
             printf '%s\n' "${digest_ref}" | tee "dist/images/${name}.digest"
             docker buildx imagetools inspect "${digest_ref}" \
-              --format '{{json .Image.config}}' \
+              --format '{{json .Image.Config}}' \
               | jq -e \
                 --arg source "https://github.com/${GITHUB_REPOSITORY}" \
                 --arg revision "${{ needs.verify.outputs.tag_target }}" \
diff --git a/release/scripts/test_registry_release.py b/release/scripts/test_registry_release.py
index b25c3ccfa..d50f8c123 100755
--- a/release/scripts/test_registry_release.py
+++ b/release/scripts/test_registry_release.py
@@ -106,6 +106,7 @@ def test_release_images_publish_and_verify_source_labels(self) -> None:
         ]:
             self.assertEqual(workflow.count(label), 1)
         self.assertIn('docker buildx imagetools inspect "${digest_ref}"', workflow)
+        self.assertIn("--format '{{json .Image.Config}}'", workflow)
         for label_name in [
             "org.opencontainers.image.source",
             "org.opencontainers.image.revision",