Everything a :v012 user receives moving from v0.12.4 → v0.12.9: 34 values. Four candidates between them (v0.12.5–v0.12.8) were tagged, published, witness-failed, and honestly abandoned — their work ships here, witnessed. The receipt: releases/v0.12.9/witness.json — 14 values walked live on lite + compose + helm, 20 by-proxy with named evidence and stated limitations.
Highlights
Transcription & self-host
- Lite transcribes out of the box —
make -C deploy/lite up LOCAL_STT=1: bundled CPU whisper, no token, no GPU (#626) - An empty env flag can never again silently disable transcription — fail-loud restored (#650, #651)
- Composer-mic dictation on lite (#628) · recording playback seeks (#633) · Jitsi joins the lineup (#632)
Production reliability
- Slim, paginated
/meetingslist — the cure for the 2026-07-15 production event-loop outage (#584) - DB pool knobs wired (#635) · login-token flood capped (#638)
- Multi-replica safety: orphaned segment reclaim with safe degrade on Redis <6.2 (#636), single-flight sweeps (#637), ghost-consumer pruning (#660)
- Whole process tree reaped on bot exit — no orphaned Chromium on lite (#546)
0.10 → 0.12 upgrade continuity
- Pre-0.12 API tokens keep working — scopes backfilled automatically, no silent revocation (#578)
- Native-id
api.v1routes restored: rename/delete by(platform, native_id),running_bots, share/download aliases (#579) - "Sealed api.v1" enforced both directions in CI; the audited
KNOWN_GAPSledger makes every exception visible (#591)
Kubernetes/helm — bot spawn works stock for the first time in the 0.12 line
The three-surface witness for this release found that no 0.12 helm install had ever spawned a bot successfully, and fixed the whole chain:
- Spawned pods inherit the runtime's scheduling constraints — tainted/dedicated pools work (#673)
- Bot pods boot the image's real entrypoint (docker masked the broken path; k8s crashed on it) (#675)
kubectl run --overridesmerge semantics respected — the spawn survives (#684)- Terminal auth bootstrap (#676) and live-transcript SSE (#677) work stock; meeting-api gets
ADMIN_API_URL+ fail-closed auto-join (#656) andMEETING_API_URL(#634)
Release honesty (governance)
- Notes can't overstate a leg's scope — see the table below rendering its own truth (#657)
- The witness batch is bounded by the last release that shipped, not the last tag — abandoned candidates can't hide values (#658)
- merge-card waits for a verdict instead of red-carding in-flight checks (#655)
Known issues (stated, filed)
- #674 — the meeting header's bot control can render stale state after session resets and surface raw errors (reproduced during this witness; prepared)
- #625 — CPU whisper (tiny/small) is the transcription-quality floor; GPU
large-v3-turboremains the recommended production path - Rapid repeated bot joins from one IP can hit Google Meet's bot-detection throttle (operational note)
Upgrading
From 0.10: token scopes are backfilled automatically at admin-api boot (#578); see the changelog migration section. From any 0.12.x: IMAGE_TAG=v0.12.9 — compose stacks now pin the bot to the release tag automatically (#659).
The guarantee — v0.12.9 (this run)
| # | Guarantee | Proof in this run |
|---|---|---|
| 1 | Every artifact users pull is the artifact we proved | ✅ manifests resolve; every leg pulls published bytes only |
| 2 | Every documented install path stands up and is exercised to its leg's scope (NOT full end-to-end — real audio→words is row 3) | compose installs + API/data-plane wiring, synthetic transcript; real bot in row 5 ✓ · FSM meeting-lifecycle FSM via mock bot, no real browser/STT ✓ · lite front doors + ≥2 concurrent real-bot spawn, no meeting/STT assertion ✓ · helm installs + healthy, bot/meeting/STT not exercised ✓ |
| 3 | Real audio → correct, speaker-attributed words | ⚠️ NOT machine-proven in this run — witness-pass only until the wav→words leg (#560) ships |
| 4 | A fresh machine with nothing on it succeeds | ⚠️ fresh-VM leg runs outside this workflow — attach its evidence to the notes or state unclaimed |
| 5 | Nothing that worked before broke | v010-compat ✅ · bot-spawn ✅ |
| 6 | Every image contains what its name promises | ✅ image-identity |
| 7 | A human witnessed the assembled value | ⛔ ENFORCED — witness-gate requires releases/v0.12.9/witness.json AND the release-promote Environment requires the owner's approval; promote cannot run without both |
| 8 | Every batch change individually proven before entry | ⛔ ENFORCED — value-gate blocks promote unless every batch PR is pr-value-green on its head or state: value-signed |
| 9 | The notes tell the truth about coverage | this table IS the mechanism — generated from run results, gaps stated above |
| 10 | Pointers moved honestly | promote runs only on all-green + promote:true; constitutional guards in the job |