[kjgbot]

Follow-up to #37/#38 (release lane). relaycast #619 and #618 are merged, so the Relaycast customer image is rebuilt from relaycast main bf713d86 by the reviewed publish-container workflow (run https://github.com/AgentWorkforce/relaycast/actions/runs/41717074565):

ghcr.io/agentworkforce/relaycast-self-host:12.7.0 = sha256:81274dca7ab58673383dc7a9c777f422f29606c7422e81b5ea15724770f1455e

• public; linux/amd64 + linux/arm64 checked anonymously from the registry
• SPDX SBOM, max-mode SLSA provenance, and a GitHub build-provenance attestation

Changes:

• charts/relaycast 0.3.2 (appVersion 12.7.0) defaults to this digest, so the relaycast kind smoke in CI exercises it
• charts/agent-relay 0.3.3 (rebased on the untagged 0.3.2 proof refresh, chore(agent-relay): move the GKE proof onto merged relaycast, relayfile and relayhistory builds #39) depends on relaycast 0.3.2 (Chart.lock regenerated), and values-gcp.yaml pins the digest
• customer-images.yaml: relaycast approved; IMG-BLOCK-005 now names only Sessions services
• evidence: chartVersion 0.3.3 and a recomputed manifest hash
• requirements.yaml: relaycast-0.3.1 is marked shipped; relaycast-0.3.2 and agent-relay-0.3.3 are current (the never-tagged agent-relay 0.3.2 row is folded into 0.3.3)
• RELEASE_NOTES / STATUS / supply-chain doc updated

Not done: the new engine (12.2.1 to 12.7.0) has not run the GKE upgrade/restore drills; that is stated in the release notes. After merge, the release lane tags agent-relay-0.3.3 (a new tag; existing tags never move).

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6eddbf05-83de-409e-bac0-68431060c493

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the two remaining documentation findings are non-blocking.

Findings

1.  Credential instructions contradict the default ▶
2.  Release status contradicts itself ▶

Fix with agent prompt

### Issue 1
charts/relaycast/values.yaml:7-11
The new default runs engine 12.7.0, but the `credentials` comments still say the default is older than 12.3.x and require an `image.digest` override for `ar_` credentials. The GCP example repeats that warning. Update both comments so operators do not replace the newly attested image unnecessarily.

### Issue 2
docs/handoff/STATUS.md:3-6
`STATUS.md` now describes 0.3.2 and its attested Relaycast image, but its remaining-work list still says Relaycast has no SBOM and awaits a rebuild. It also says `agent-relay-0.3.1` does not exist, while this PR records that version as shipped. Update those bullets alongside the release header so customers have one consistent list of remaining work.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Updates agent-relay to 0.3.3 and its relaycast dependency to 0.3.2.

• Relaycast charts now install the pinned 12.7.0 image.
• The release inventory approves the Relaycast image.

No new findings were accepted.

_{Reviews (2) · Last reviewed commit: "release(agent-relay): 0.3.3 pins the att..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 12 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>