Vexa-ai/vexa v0.12.1

Vexa 0.12.1 — first pipeline-clean release

on GitHub

Vexa v0.12.1 — the first pipeline-clean release. Same product surface as 0.12.0; this
release exists to prove the ship bar itself: every image built, published, and validated by the
release machinery (0.12.0's images were hand-pushed around a broken matrix). It also lands the
governance system and two security dependency waves.

What's in it

• Governance system on main (#505) — two constitutions + three protocols
  (PREPARE / TAKE / MAINTAIN) as one delivery law, with the AGENTS.md front door. 9 docs → 4.
• Security dependency waves — #517 (pytest out of runtime deps → dev groups, GHSA-6w46-j5rx-g56g)
  and #521 (esbuild ≥0.25, postcss ≥8.5.10, vite 8.1.4 — Dependabot 137/141/143/169/178/179).
• Release machinery (#494) — the release-images lane (build → publish → prove → promote).
• Maiden-run bug paydown — the first real ship-bar run fixed four latent defects the
  hand-pushed 0.12.0 hid: Docker Hub CI creds, the nonexistent clients/dashboard matrix entry
  (#549, executes the dashboard-deprecation ruling at the artifact level), the lite STT-gate 503
  in the smoke (#550), and the POST /bots → 502 startup race in the concurrent-bots smoke
  (readiness gate added).
• Release machinery split (#551/#554) — build+publish is now separate from validate+promote,
  so a validation-harness fix re-runs the verdict in minutes without rebuilding unchanged images.

Validated on (coverage statement)

Proven on what we name — all legs pull the published :v0.12.1 images, never a local build:

• Lite (self-host compose) — front doors green + concurrent-bots smoke on a fresh
  us-sea VM (2 bots, isolated profiles, 45s stable) AND CI validate-lite. release/vm-validated
  posted on the release commit.
• Compose (full stack) — validate-compose, validate-mock-fsm, real bot spawn
  (validate-bot-spawn).
• 0.10 API backward-compat — validate-v010-compat (passes + recorded V010-BREAK: xfails only).
• Kubernetes / Helm — validate-helm-k3s (ephemeral single node, gateway /health + all pods Running).
• Image identity — every published image proven to contain what its name promises.

Honestly unclaimed: arm64 (amd64-only this release; tracked follow-up), and the hosted STT path
under load (the internal fallback token is capacity-saturated — an ops item, not a release defect).

Pointers

:v012 now moves to v0.12.1 on all images. :latest unchanged. vexaai/vexa-bot:{dev,latest}
untouched (0.10 line).