chore(release): prepare v0.36.0 beta-48

[jeremi]

Prepare Registry Stack v0.36.0 / beta-48. This commit carries:

• versioned manifests;
• workspace and excluded lockfiles;
• native client metadata;
• generated contracts;
• reviewed release notes and changelogs;
• the canonical documentation archive lock;
• renewed image advisory baselines.

v0.36.0 is the first breaking beta of the 1.0 push. It carries 19 BREAKING entries: BReg 9, Casework 7, Evidence 1, Scheduling 2. The notes give the migration step for each. Main points:

• BReg activation ledger. BReg records every activation in a database ledger and ships unsigned, environment-neutral packages named by their digest (feat(breg): record activations in a ledger and ship environment-neutral unsigned packages #1701, feat(casework,scheduling): activate packages through a database ledger with plan and apply #1718). Package signing is removed, so a deployment must pass through v0.35.0 first.
• Evidence. The evidencectl result envelope (feat(evidence)!: give evidencectl the shared ctl report and exit contract #1663).
• Casework and Scheduling. The shared JSONL audit writer (refactor(audit)!: replace chained journals with shared JSONL streams #1560).
• BReg usage errors. A bregctl usage error no longer repeats a rejected argument value (fix(breg): keep rejected argument values out of bregctl usage errors #1736, closing bregctl usage errors repeat a rejected argument value, including --operator-reference #1699).
• Images. Since feat(release): publish schedulingctl and ship each operator tool in its image #1730, the BReg, Casework and Scheduling images carry their operator tool at /usr/local/bin/<name>ctl, and the manifest adds schedulingctl.

Security review notes (advisory baselines, deployment defaults, release provenance):

• Unchanged images. The runtime bases and every image's OCI process configuration are unchanged. renew-advisory-baselines would have refused either change, and it refused nothing.

• What the renewal moved. The subcommand moved, for all six images:

  • the application layers;
  • the executable digests;
  • the reference image digests;
  • the source revision;
  • the review dates;
  • the live pins in release/scripts/test_check_advisory_baselines.py.

  A second dry run reports no changes, the strict check passes for every image, and test_check_advisory_baselines passes.

• The 18 exceptions are re-reviewed and kept. They cover CVE-2026-5435 and CVE-2026-19499 on libc6, and CVE-2026-85091 on zlib1g.

  • Loader, libc, libm and libpthread digests are unchanged, as are libc6 2.41-12+deb13u4 and zlib1g 1:1.3.dfsg+really1.3.1-1+b1.
  • There are no new findings: each image has 22, and the 3 High ones are covered by those exceptions.
  • expires_at stays 2026-10-06.

• The operator tools are reviewed too. They are new in these images this release, so the rehearsal records an exposure report for each (exposure/<name>.<name>ctl.json).

  • None of bregctl, caseworkctl or schedulingctl imports or contains the resolver-printing, strfmon, libz or gzip-write symbols the rationales name. I checked both the exposure reports and the exported bytes.
  • bregctl's one review_required entry is the same Wasmtime ittapi dlsym probe as breg: it reaches the tool through registry-breg, registry-platform-script, wasmtime and ittapi.
  • caseworkctl and schedulingctl have none.
  • I did not add the tools to the assertions' files. The whole_image_fingerprint_equals assertion already binds every ordered rootfs DiffID, including the application layer that holds the tool.
  • Each BReg, Casework and Scheduling rationale now has one sentence covering its tool. Otherwise only the version, run, source and review date moved.

• Other review_required entries are unchanged: SQLite's nonconstant extension dlsym in evidence and relay, where load_extension is denied. Casework, discovery and scheduling have none.

• Documentation date. The documentation set is dated 2026-09-29, the intended publication date.

• Review fixes. The upgrade steps name --runtime-config FILE on every BReg, Casework and Scheduling plan, apply, verify and status call. The Evidence migration, in the notes and the docs changelog, keeps the documented --project on source import, source diff, source update and target new. Because the changelog is archived, the v0.36.0 archive-lock entry was regenerated from the fixed tree. The upgrade order, in the notes and in upgrade-and-retire.mdx, now includes a Scheduling backup and activation step, and every BReg and Casework command in the runbook carries its required --runtime-config (and --package). A read-only review of the runbook against the code then completed it: the BReg rebuild names bregctl test and --test-receipt, Casework adds identity.databaseId, repins its BReg sources, and repoints package.root, the earlier casework and evidence processes are stopped before the new ones start, evidence check takes --runtime-config, and "Roll back" covers returning BReg, Casework, and Scheduling to the previous release, and the Scheduling changelog names the schedulingctl sibling of audit.path instead of a literal file name. A further round names BUILD/package as the package bregctl package --output BUILD writes, repoints BReg package.expectedDigest when set, has a BReg rollback restore into a fresh database and adopt its instance claim with the v0.35.0 bregctl instance-claim adopt before starting the previous breg, and adds "Retire Scheduling" to "Retire a deployment".

Validation:

• Local:
  • registry-release validate on beta-48;
  • registry-release prepare (ready);
  • test_registry_release;
  • the monorepo release source model check and its tests;
  • test_check_advisory_baselines;
  • cargo fmt --check;
  • cargo check --locked --workspace --all-targets.
• Rehearsals:
  • The advisory-evidence rehearsal (run 36494611865) passed.
  • The strict rehearsal on the final head (run 36512885121) is running.
  • The upgrade rehearsal runs on this pull request.

Known follow-ups, not blockers:

• rehearse-upgrade.py does not cover Scheduling or the Casework BReg-source repin (test(release): rehearse the Scheduling upgrade and the Casework BReg-source repin #1740).

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-29T02:34:47.887989Z	301902a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b1f0f04a62

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6f0f332b72

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f418ec67f1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 457b7aff33

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 71672a99e7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 40caf7754e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".