diff --git a/charts/agent-relay/Chart.lock b/charts/agent-relay/Chart.lock
index 2f4d06d..9e63468 100644
--- a/charts/agent-relay/Chart.lock
+++ b/charts/agent-relay/Chart.lock
@@ -1,7 +1,7 @@
 dependencies:
 - name: relaycast
   repository: file://../relaycast
-  version: 0.3.1
+  version: 0.3.2
 - name: relayauth
   repository: file://../relayauth
   version: 0.1.2
@@ -26,5 +26,5 @@ dependencies:
 - name: relayfile
   repository: file://../relayfile
   version: 0.2.0
-digest: sha256:43e0b3923627f7f49faa25042f7cb5b6cb58063dd20f8c99bbddd4e37c704bd0
-generated: "2026-11-03T10:18:40.215577-08:00"
+digest: sha256:3a1e8b73bbb5dd09e11168ffa0d7f7d5a0f4ccaf2eb2fe4a9602c2f733aa52c0
+generated: "2026-11-03T13:14:48.597974-08:00"
diff --git a/charts/agent-relay/Chart.yaml b/charts/agent-relay/Chart.yaml
index 0a867d9..858ca52 100644
--- a/charts/agent-relay/Chart.yaml
+++ b/charts/agent-relay/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: agent-relay
 description: Self-hosted Agent Relay messaging and sessions suite
 type: application
-version: 0.3.2
+version: 0.3.3
 appVersion: "0.1.0"
 kubeVersion: ">=1.28.0-0"
 annotations:
@@ -17,7 +17,7 @@ maintainers:
     url: https://github.com/AgentWorkforce
 dependencies:
   - name: relaycast
-    version: 0.3.1
+    version: 0.3.2
     repository: file://../relaycast
     condition: components.relaycast
   - name: relayauth
diff --git a/charts/agent-relay/values-gcp.yaml b/charts/agent-relay/values-gcp.yaml
index 0fb9270..24b06fc 100644
--- a/charts/agent-relay/values-gcp.yaml
+++ b/charts/agent-relay/values-gcp.yaml
@@ -37,9 +37,10 @@ gkeIngress:
 relaycast:
   fullnameOverride: relaycast
   image:
-    # Release image (public GHCR, relaycast bdf1b69; an SBOM-attested rebuild is pending relaycast #619). Mirror by digest and override repository.
+    # Release image (public GHCR, relaycast main bf713d86, engine 12.7.0, SBOM +
+    # provenance). Mirror it by digest to your registry and override repository.
     repository: ghcr.io/agentworkforce/relaycast-self-host
-    digest: sha256:a05732ad4f3614d057bb1460df40a30e3a9297c8930bfdda6d4e3d6dc9f41762
+    digest: sha256:81274dca7ab58673383dc7a9c777f422f29606c7422e81b5ea15724770f1455e
   # REQUIRED OVERRIDE: must use the same cast host as gkeIngress.hosts.cast.
   baseUrl: https://cast.placeholder.company
   # REQUIRED OVERRIDE: existing Secret name; see README for required keys.
diff --git a/charts/relaycast/Chart.yaml b/charts/relaycast/Chart.yaml
index dd995f8..fc46ba9 100644
--- a/charts/relaycast/Chart.yaml
+++ b/charts/relaycast/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: relaycast
 description: Portable Relaycast core for self-hosted Agent Relay deployments
 type: application
-version: 0.3.1
-appVersion: "12.2.1-selfhost.1"
+version: 0.3.2
+appVersion: "12.7.0"
 kubeVersion: ">=1.22.0-0"
 annotations:
   artifacthub.io/license: Apache-2.0
diff --git a/charts/relaycast/values.yaml b/charts/relaycast/values.yaml
index d973566..d4e5245 100644
--- a/charts/relaycast/values.yaml
+++ b/charts/relaycast/values.yaml
@@ -4,10 +4,11 @@ replicaCount: 1
 
 image:
   repository: ghcr.io/agentworkforce/relaycast-self-host
-  # relaycast-self-host:12.2.1-selfhost.1, built from relaycast main bdf1b69c
-  # (engine 12.2.1 + the internal admin API). Immutable multi-platform
-  # manifest (linux/amd64 and linux/arm64).
-  digest: sha256:a05732ad4f3614d057bb1460df40a30e3a9297c8930bfdda6d4e3d6dc9f41762
+  # relaycast-self-host:12.7.0, built from relaycast main bf713d86 by the
+  # reviewed publish-container workflow (engine 12.7.0). Immutable
+  # multi-platform manifest (linux/amd64 and linux/arm64) with an SPDX SBOM,
+  # max-mode provenance and a GitHub build-provenance attestation.
+  digest: sha256:81274dca7ab58673383dc7a9c777f422f29606c7422e81b5ea15724770f1455e
   pullPolicy: IfNotPresent
 
 imagePullSecrets: []
diff --git a/docs/handoff/RELEASE_NOTES.md b/docs/handoff/RELEASE_NOTES.md
index 327242a..d8f2a8e 100644
--- a/docs/handoff/RELEASE_NOTES.md
+++ b/docs/handoff/RELEASE_NOTES.md
@@ -37,6 +37,15 @@ Desktop setup. Relayflows, durable actors and Relayfile are optional preview
 components, off by default. Billing, provider integrations and hosted fleet
 are out of scope.
 
+## agent-relay 0.3.3 (2026-11-03)
+
+Pins the attested Relaycast image: `relaycast-self-host@sha256:81274dca…`
+(relaycast main `bf713d86`, engine 12.7.0; SPDX SBOM, max-mode provenance and a
+GitHub build-provenance attestation; public, amd64+arm64). The relaycast leaf
+chart is now 0.3.2 with the same default. This image has not run the GKE
+upgrade/restore drills; its kind smoke runs in this repository's CI. It also carries the untagged 0.3.2 GKE proof-overlay refresh (proof
+values only). Everything else is as in 0.3.1.
+
 ## agent-relay 0.3.1 (2026-11-03): reviewable release
 
 This is the first release of the umbrella chart, to be published from the
@@ -62,7 +71,7 @@ exists and you pin it.
 | Control-plane API | `ghcr.io/agentworkforce/selfhost-api@sha256:535e6718…` | relaycontrol `8e989a1` | SBOM + max provenance; **private package, not pullable by customers yet** (installation blocker) |
 | Dashboard | `ghcr.io/agentworkforce/relay-dashboard@sha256:bbeca872…` | relay-dashboard `b213406` | SBOM + max provenance + GitHub attestation; public |
 | RelayAuth | `ghcr.io/agentworkforce/relayauth@sha256:c23c92d2…` | relayauth `784582e` | SBOM + provenance; public |
-| Relaycast | `ghcr.io/agentworkforce/relaycast-self-host@sha256:a05732ad…` | relaycast `bdf1b69` | public; **no SBOM, min-mode provenance only** (attested rebuild pending) |
+| Relaycast | `ghcr.io/agentworkforce/relaycast-self-host@sha256:81274dca…` | relaycast `bf713d86` (engine 12.7.0) | SBOM + max provenance + GitHub attestation; public (0.3.2) |
 | Sessions wait-for-role | `ghcr.io/cloudnative-pg/postgresql@sha256:ed6923f9…` | upstream `4c2710a` | upstream revision label `4c2710a`, run 40291448784; SBOM + SLSA attestation manifests; keyless cosign signature verified with `--certificate-github-workflow-sha` |
 | Sessions services | `ghcr.io/agentworkforce/96bulls-services` | no release revision yet (last audited private image: `7d7229b`; the release is to be built from `main` at or after `51b38ff`) | **not published** (zero digest): the attested publish needs the owner's dispatch; REQUIRED OVERRIDE, installation blocker |
 | RelayHistory | `ghcr.io/agentworkforce/relayhistory` | relayhistory-cloud | **not published** (zero digest): the self-host runtime PR is held; REQUIRED OVERRIDE, installation blocker |
diff --git a/docs/handoff/STATUS.md b/docs/handoff/STATUS.md
index 7618762..a7b1de6 100644
--- a/docs/handoff/STATUS.md
+++ b/docs/handoff/STATUS.md
@@ -1,8 +1,9 @@
 # Release status: what is proven and what is preview
 
-Release: `agent-relay` chart 0.3.1, 2026-11-03 (to be published from the
-`agent-relay-0.3.1` tag as `oci://ghcr.io/agentworkforce/charts/agent-relay`,
-version 0.3.1).
+Release: `agent-relay` chart 0.3.3, 2026-11-03, published from the
+`agent-relay-0.3.3` tag as `oci://ghcr.io/agentworkforce/charts/agent-relay`
+version 0.3.3. 0.3.1 (the first published version) differs only in the
+Relaycast image and the GKE proof overlays (0.3.2 was never tagged).
 
 This release is for **review by a company evaluating a self-hosted Agent Relay
 on GCP**. It is a reviewable `portable-single` release that pins every
@@ -19,7 +20,7 @@ This archive is therefore labelled a development preview.
 | Area | Evidence (what was checked, including its limits) |
 |---|---|
 | Licensing | Apache-2.0 at `main` for relaycast, relayauth, relaycontrol (control-plane API), relay-dashboard and this chart repository. Sessions Pipeline is Apache-2.0 by owner decision; its LICENSE landed on `main` in sessions-pipeline #172 (merge `51b38ff`), after the image revision recorded in the manifest (`7d7229b`). RelayHistory is Apache-2.0 by owner decision; its LICENSE PR (relayhistory-cloud #279) is open and held, so no RelayHistory revision carries it yet. The third-party PostgreSQL image (CloudNativePG) is Apache-2.0 packaging. See `self-hosted/customer-release-evidence.json` (`licenses.firstParty`). |
-| Image supply chain | Mixed; per image in `self-hosted/customer-images.yaml`. The control-plane API (`selfhost-api`) and dashboard images were built by their release workflows from reviewed `main` commits with an SBOM and max-mode provenance (the dashboard also has a GitHub build-provenance attestation and is public; the `selfhost-api` package is still private). The RelayAuth image has an SBOM and provenance. The Relaycast image (`a05732ad…`) has **no SBOM and only buildx's default min-mode provenance**. The CloudNativePG PostgreSQL digest is verified against upstream revision `4c2710a` (run 40291448784, SBOM and SLSA attestation manifests, keyless cosign signature verified with `--certificate-github-workflow-sha`). The Sessions services and RelayHistory release images are **not published**; both stay REQUIRED OVERRIDE (zero digest) in `values-gcp.yaml`. |
+| Image supply chain | Mixed; per image in `self-hosted/customer-images.yaml`. The control-plane API (`selfhost-api`) and dashboard images were built by their release workflows from reviewed `main` commits with an SBOM and max-mode provenance (the dashboard also has a GitHub build-provenance attestation and is public; the `selfhost-api` package is still private). The RelayAuth image has an SBOM and provenance. Since 0.3.3 the Relaycast image (`81274dca…`, relaycast `bf713d86`, engine 12.7.0) also has an SBOM, max-mode provenance and a GitHub build-provenance attestation, and is public. The CloudNativePG PostgreSQL digest is verified against upstream revision `4c2710a` (run 40291448784, SBOM and SLSA attestation manifests, keyless cosign signature verified with `--certificate-github-workflow-sha`). The Sessions services and RelayHistory release images are **not published**; both stay REQUIRED OVERRIDE (zero digest) in `values-gcp.yaml`. |
 | End-to-end function on GKE | The live proof deployment (not the 0.3.1 customer profile: it ran the experimental RelayHistory proof image, and Relaycast on durable actors in the final run) passed all 15 end-to-end cases: single-org bootstrap, Relaycast messaging, session delivery and reads, workspace isolation on 28 routes, restart durability, RelayAuth verification, the Sessions Pipeline, session erasure, public-edge checks, the sessions API, admin env vars and audit, flows on an in-namespace worker, the dashboard and cleanup. See `docs/handoff/evidence/gke-e2e.md`. The harness is in `scripts/selfhost/`. |
 | Upgrade and restore drills | An isolated GKE drill of agent-relay 0.1.1 ran a quiesced backup (writers stopped for 314 s) and a restore into a separate Cloud SQL instance, bucket, PVCs and namespace. All seven recorded verification gates passed (Cloud SQL, Relaycast and RelayAuth integrity, GCS integrity, isolated messaging, cross-workspace denial, no production references). No data was lost between the quiesce point and the capture. RTO was 387 s to pods Ready and 578 s to the gates passing; a cold restore adds about 189 s of instance creation (about 767 s, about 12.8 min). The pre-upgrade gate passed (OK), and an upgrade from 0.1.1 to the release candidate passed 17/17 checks (run before the Sessions chart rename that the final 0.3.1 also contains). Neither ran the full release image set: the restore ran the 0.1.1 drill images, and the upgrade ran previous or live-proof images for `selfhost-api`, RelayHistory and Sessions. See `docs/handoff/evidence/gke-upgrade-restore-drills.md`. |
 
diff --git a/docs/self-hosted-image-supply-chain.md b/docs/self-hosted-image-supply-chain.md
index b6eb9c6..ab84e4a 100644
--- a/docs/self-hosted-image-supply-chain.md
+++ b/docs/self-hosted-image-supply-chain.md
@@ -43,7 +43,7 @@ The audit checked:
 
 | Image | Active use | Source and revision | License | Platforms | Release and supply chain | Result |
 | --- | --- | --- | --- | --- | --- | --- |
-| `ghcr.io/agentworkforce/relaycast-self-host@sha256:a05732ad4f3614d057bb1460df40a30e3a9297c8930bfdda6d4e3d6dc9f41762` | Relaycast Deployment | [`AgentWorkforce/relaycast`](https://github.com/AgentWorkforce/relaycast) `bdf1b69ccaf1cd2bc7ce6c975c824907cc9eff49` | Apache-2.0 | Registry-verified `linux/amd64`, `linux/arm64` | [Workflow](https://github.com/AgentWorkforce/relaycast/blob/bdf1b69ccaf1cd2bc7ce6c975c824907cc9eff49/.github/workflows/publish-container.yml), [run](https://github.com/AgentWorkforce/relaycast/actions/runs/41161384835). **No SBOM**; only buildx's default min-mode, unsigned provenance. Public GHCR digest | **Hard blocker** (`IMG-BLOCK-005`) |
+| `ghcr.io/agentworkforce/relaycast-self-host@sha256:81274dca7ab58673383dc7a9c777f422f29606c7422e81b5ea15724770f1455e` | Relaycast Deployment | [`AgentWorkforce/relaycast`](https://github.com/AgentWorkforce/relaycast) `bf713d86b366b46f491e287ce6117c7c5ff1f27a` | Apache-2.0 | Registry-verified `linux/amd64`, `linux/arm64` (anonymous) | [Workflow](https://github.com/AgentWorkforce/relaycast/blob/bf713d86b366b46f491e287ce6117c7c5ff1f27a/.github/workflows/publish-container.yml), [run](https://github.com/AgentWorkforce/relaycast/actions/runs/41717074565). SPDX SBOM, max-mode provenance, GitHub build-provenance attestation. Public GHCR digest | Approved |
 | `ghcr.io/agentworkforce/relayauth@sha256:c23c92d25fdffef3b5838a1eef4c226925f859706365d9ccece229795b877288` | RelayAuth Deployment | [`AgentWorkforce/relayauth`](https://github.com/AgentWorkforce/relayauth) `784582ef983bb72b13b43512d9a4142ef5dfabb2` | Apache-2.0 | Registry-verified `linux/amd64`, `linux/arm64` | [Workflow](https://github.com/AgentWorkforce/relayauth/blob/784582ef983bb72b13b43512d9a4142ef5dfabb2/.github/workflows/container.yml), [run](https://github.com/AgentWorkforce/relayauth/actions/runs/41277442855); SBOM and provenance; anonymous pull verified | Approved |
 | `ghcr.io/agentworkforce/96bulls-services@sha256:6f22ea17dff336e1431664542759fd27958649388b90a0b2f0881883caa7c6b2` (evidence only; the profile renders a zero digest) | Four Sessions Deployments and migration Job | Private [`AgentWorkforce/sessions-pipeline`](https://github.com/AgentWorkforce/sessions-pipeline) `7d7229bb31c121ecb98cd4e35c248fc2cf5669ad` | Apache-2.0 by owner decision; the LICENSE landed on `main` in #172 (merge `51b38ff`), after this revision | Not registry-verified (anonymous inspection returns `unauthorized`) | Approval-gated [workflow](https://github.com/AgentWorkforce/sessions-pipeline/blob/7d7229bb31c121ecb98cd4e35c248fc2cf5669ad/.github/workflows/publish-image.yml), [run](https://github.com/AgentWorkforce/sessions-pipeline/actions/runs/41375745173); no SBOM, min-mode provenance. The attested release image is **not published** | **Hard blocker** (`IMG-BLOCK-001`, `IMG-BLOCK-005`) |
 | `ghcr.io/cloudnative-pg/postgresql@sha256:ed6923f9ba2399cf9070379a353c710c29ced8a294be73986a2c3dae7e599ce3` | Sessions migration `wait-for-role` init container | Public [`cloudnative-pg/postgres-containers`](https://github.com/cloudnative-pg/postgres-containers) `4c2710a78328becdadf708ca6d9cb3fb61f3f5ee` (the image's revision label and its SLSA provenance both name it) | Apache-2.0 packaging; PostgreSQL License | Registry-verified `linux/amd64`, `linux/arm64` | Upstream [`bake_targets.yml`](https://github.com/cloudnative-pg/postgres-containers/blob/4c2710a78328becdadf708ca6d9cb3fb61f3f5ee/.github/workflows/bake_targets.yml), [run 40291448784](https://github.com/cloudnative-pg/postgres-containers/actions/runs/40291448784); SPDX SBOM and SLSA v1 attestation manifests; keyless cosign signature verified with `--certificate-github-workflow-sha 4c2710a…` | Approved (third party) |
@@ -99,10 +99,10 @@ approved byte-for-byte third-party mirror.
   (relaycontrol `main` `8e989a1`, SBOM and max-mode provenance), but the GHCR
   package is still private, so customers have no pull path. Close by making
   the package public and verifying both platforms anonymously.
-- `IMG-BLOCK-005` — **Relaycast and Sessions services**: their release
-  workflows publish no SBOM and only buildx's default min-mode, unsigned
-  provenance. Close with a rebuild that publishes an SBOM and signed
-  provenance, and record the new digest.
+- `IMG-BLOCK-005` — **Sessions services**: the recorded digest predates the
+  attested workflow (sessions-pipeline #172). Close with a rebuild that
+  publishes an SBOM and signed provenance, and record the new digest.
+  Relaycast was closed in 0.3.3 by the attested 12.7.0 digest.
 
 Until these are closed, the umbrella chart is not customer-image ready even if
 it renders or the proof cluster is healthy.
diff --git a/docs/self-hosted-requirements.md b/docs/self-hosted-requirements.md
index d564973..b689000 100644
--- a/docs/self-hosted-requirements.md
+++ b/docs/self-hosted-requirements.md
@@ -57,14 +57,15 @@ Services image (sessions-pipeline-worker, alleyoop and the privileged SQL Jobs):
 | 96bulls-0.5.2 | shipped | 96bulls 0.5.2<br>96bulls-worker 0.5.2<br>alleyoop 0.3.4<br>(deps: worker 0.5.2, alleyoop 0.3.4, hoopdb 0.9.0, locker 5.4.0, otel 0.178.0) | 96bulls-worker: `agentworkforce/96bulls-services@sha256:6f22ea17dff3…`<br>alleyoop: `agentworkforce/96bulls-services@sha256:6f22ea17dff3…` | `7d7229bb31c1` / `eff8b3be4656` | selfhosted + global-default-revoke (cnpg)<br>selfhosted + global-default-revoke (external)<br>cloudsql + global-default-revoke (external)<br>supabase + event-trigger (external) (held)<br>supabase + (unset) (external) (fails closed)<br>local + (unset) (any) (dev only) | License-annotation patch bump of 0.5.1; same services image and db combos. Superseded by 0.5.4. |
 | 96bulls-0.5.1 | shipped | 96bulls 0.5.1<br>96bulls-worker 0.5.1<br>alleyoop 0.3.3<br>(deps: worker 0.5.1, alleyoop 0.3.3, hoopdb 0.9.0, locker 5.4.0, otel 0.178.0) | 96bulls-worker: `agentworkforce/96bulls-services@sha256:6f22ea17dff3…`<br>alleyoop: `agentworkforce/96bulls-services@sha256:6f22ea17dff3…` | `7d7229bb31c1` / `eff8b3be4656` | selfhosted + global-default-revoke (cnpg)<br>selfhosted + global-default-revoke (external)<br>cloudsql + global-default-revoke (external)<br>supabase + event-trigger (external) (held)<br>supabase + (unset) (external) (fails closed)<br>local + (unset) (any) (dev only) | sessions-pipeline main 7d7229b (#124 session list RPC, #125 Supabase event-trigger boundary, #139 its manifest sync, #137 exact sessions function ACL). The AWS path pins the ECR digest of the same build. Superseded by 0.5.2. |
 | sessions-pipeline-next | **planned** | sessions-pipeline next | not built for the charts yet | `475d503216a2` / `5ed119133e36` |  | Follow-up re-pin to sessions-pipeline main after #127 (session briefs, generation 5ed11913...). Needs new GHCR/ECR digests, ci/sessions-pipeline-search-worker-role/services-commit and services-generation, and the session-brief entries below shipped. |
-| relaycast-0.3.1 | unreleased | relaycast 0.3.1 | relaycast: `ghcr.io/agentworkforce/relaycast-self-host@sha256:a05732ad4f36…` |  |  | README-only bump of 0.3.0 for the sessions-pipeline rename. |
+| relaycast-0.3.2 | unreleased | relaycast 0.3.2 | relaycast: `ghcr.io/agentworkforce/relaycast-self-host@sha256:81274dca7ab5…` |  |  | Default image moves to relaycast-self-host 12.7.0 (relaycast main bf713d86, engine 12.7.0), built by the reviewed publish-container workflow with an SPDX SBOM, max-mode provenance and a GitHub build-provenance attestation (run 41717074565); public, amd64+arm64. |
+| relaycast-0.3.1 | shipped | relaycast 0.3.1 | relaycast: `ghcr.io/agentworkforce/relaycast-self-host@sha256:a05732ad4f36…` |  |  | README-only bump of 0.3.0 for the sessions-pipeline rename. Superseded by 0.3.2. |
 | relaycast-0.3.0 | shipped | relaycast 0.3.0 | relaycast: `ghcr.io/agentworkforce/relaycast-self-host@sha256:a05732ad4f36…` |  |  | License-annotation bump of 0.2.0 (unreleased 0.2.1) plus runtime.backend=durable-actors (env contract v1): relaycast-actors-gateway and relaycast-actors-deployer images, digests supplied by the operator; the SQLite image above is unchanged and remains the default. Superseded by 0.3.1. |
 | relaycast-0.2.0 | shipped | relaycast 0.2.0 | relaycast: `ghcr.io/agentworkforce/relaycast-self-host@sha256:a05732ad4f36…` |  |  | engine 12.2.1 + the internal admin API (relaycast main bdf1b69c). Upgrade path from 0.1.0 is in charts/relaycast/README.md. Superseded by 0.3.0. |
 | relaycast-0.1.0 | shipped | relaycast 0.1.0 | relaycast: `ghcr.io/agentworkforce/relaycast-self-host@sha256:5c86c095a335…` |  |  | image 8.0.0; superseded by 0.2.0. ci/relaycast/smoke.sh upgrades from it. |
 | relayauth-0.1.2 | unreleased | relayauth 0.1.2 | relayauth: `ghcr.io/agentworkforce/relayauth@sha256:c23c92d25fdf…` |  |  | License-annotation patch bump of 0.1.1. |
 | relayauth-0.1.1 | shipped | relayauth 0.1.1 | relayauth: `ghcr.io/agentworkforce/relayauth@sha256:c23c92d25fdf…` |  |  | relayauth 784582ef (machine-bound History assertion contract, relayauth #113). Superseded by 0.1.2. |
 | relayauth-0.1.0 | shipped | relayauth 0.1.0 | relayauth: `ghcr.io/agentworkforce/relayauth@sha256:eb71daa28e30…` |  |  | superseded by 0.1.1. |
-| agent-relay-0.3.2 | unreleased | agent-relay 0.3.2<br>relayhistory 0.1.1<br>relay-cloud-api 0.2.1<br>relay-dashboard 0.1.0<br>(deps: relaycast 0.3.1, relayauth 0.1.2, sessions-pipeline 0.6.0, relayhistory 0.1.1, relay-cloud-api 0.2.1, relay-dashboard 0.1.0, relayflows 0.2.4, durable-actors 0.14.6, relayfile 0.2.0) | relayhistory: `ghcr.io/agentworkforce/relayhistory@sha256:<required>`<br>relay-cloud-api: `ghcr.io/agentworkforce/selfhost-api@sha256:<required>`<br>relay-dashboard: `ghcr.io/agentworkforce/relay-dashboard@sha256:<required>` |  |  | GKE proof refresh on top of 0.3.1 (tag agent-relay-0.3.1). Proof overlays only: values-gcp-proof-durable-actors.yaml pins relaycast-actors-gateway sha256:faf66ec45d2c755ab5cdc6ee32bca6dc48446dff444118cab18fa1f765124ffa and relaycast-actors-deployer sha256:a81e91ed52bfb7cbb0a8c2773752df3b5d78afdc443608998b3203a30e314cee (relaycast main 3624cc12); values-gcp-proof-relayfile.yaml pins relayfile-actors sha256:7fb2110701a004f9f7ed2b025d25156fbe993208598bfbd0498a48b30df48299 and relayfile-actors-workspace sha256:c5851a1b1f7624390a1a00ebdee69e8e521dc3f23f345c582d62e09dba9a6e83 (relayfile main 39f84fcf); values-gcp-proof-live.yaml pins the experimental unsupported RelayHistory sha256:f36ae1671bdcd88a2b8b2df62c8edecb1381237d9f968747b39298959ad33563 (relayhistory-cloud 3cb76752). Proof CPU requests sized for the e2-medium pool, and the README documents the write-hold upgrade with the Relayflows smoke Job. The customer profile (values-gcp.yaml) and templates are unchanged from 0.3.1. |
+| agent-relay-0.3.3 | unreleased | agent-relay 0.3.3<br>relayhistory 0.1.1<br>relay-cloud-api 0.2.1<br>relay-dashboard 0.1.0<br>(deps: relaycast 0.3.2, relayauth 0.1.2, sessions-pipeline 0.6.0, relayhistory 0.1.1, relay-cloud-api 0.2.1, relay-dashboard 0.1.0, relayflows 0.2.4, durable-actors 0.14.6, relayfile 0.2.0) | relayhistory: `ghcr.io/agentworkforce/relayhistory@sha256:<required>`<br>relay-cloud-api: `ghcr.io/agentworkforce/selfhost-api@sha256:<required>`<br>relay-dashboard: `ghcr.io/agentworkforce/relay-dashboard@sha256:<required>` |  |  | 0.3.3 (tag agent-relay-0.3.3) moves relaycast to chart 0.3.2 and pins relaycast-self-host sha256:81274dca7ab58673383dc7a9c777f422f29606c7422e81b5ea15724770f1455e (relaycast main bf713d86, engine 12.7.0; SBOM + max-mode provenance + GitHub attestation; public) in values-gcp.yaml, and includes the never-tagged 0.3.2 proof refresh: GKE proof refresh on top of 0.3.1 (tag agent-relay-0.3.1). Proof overlays only: values-gcp-proof-durable-actors.yaml pins relaycast-actors-gateway sha256:faf66ec45d2c755ab5cdc6ee32bca6dc48446dff444118cab18fa1f765124ffa and relaycast-actors-deployer sha256:a81e91ed52bfb7cbb0a8c2773752df3b5d78afdc443608998b3203a30e314cee (relaycast main 3624cc12); values-gcp-proof-relayfile.yaml pins relayfile-actors sha256:7fb2110701a004f9f7ed2b025d25156fbe993208598bfbd0498a48b30df48299 and relayfile-actors-workspace sha256:c5851a1b1f7624390a1a00ebdee69e8e521dc3f23f345c582d62e09dba9a6e83 (relayfile main 39f84fcf); values-gcp-proof-live.yaml pins the experimental unsupported RelayHistory sha256:f36ae1671bdcd88a2b8b2df62c8edecb1381237d9f968747b39298959ad33563 (relayhistory-cloud 3cb76752). Proof CPU requests sized for the e2-medium pool, and the README documents the write-hold upgrade with the Relayflows smoke Job. The customer profile (values-gcp.yaml) and templates are unchanged from 0.3.1. |
 | agent-relay-0.3.1 | shipped | agent-relay 0.3.1<br>relayhistory 0.1.1<br>relay-cloud-api 0.2.1<br>relay-dashboard 0.1.0<br>(deps: relaycast 0.3.1, relayauth 0.1.2, sessions-pipeline 0.6.0, relayhistory 0.1.1, relay-cloud-api 0.2.1, relay-dashboard 0.1.0, relayflows 0.2.4, durable-actors 0.14.6, relayfile 0.2.0) | relayhistory: `ghcr.io/agentworkforce/relayhistory@sha256:<required>`<br>relay-cloud-api: `ghcr.io/agentworkforce/selfhost-api@sha256:<required>`<br>relay-dashboard: `ghcr.io/agentworkforce/relay-dashboard@sha256:<required>` |  |  | 0.3.1 is published from the tag agent-relay-0.3.1 as the first reviewable, preview-labelled customer release; it includes the never-released 0.2.0, 0.2.1 and 0.3.0 changes described below. values-gcp.yaml pins these GHCR digests (supply chain per image): selfhost-api sha256:535e6718fa239ce87dead3d22e7c53324bed44bfcef94018918e8804d24af478 (relaycontrol main 8e989a1; SBOM + max-mode provenance; package still private), relay-dashboard sha256:bbeca872c7e204a02a17050db6ac6309c6d36a07bcd00e1da3a739923f990282 (main b213406; SBOM + max-mode provenance + GitHub attestation, public; self-host build that only uses the same-origin /cloud/api prefix), relayauth sha256:c23c92d2... (784582e; SBOM + provenance), relaycast-self-host sha256:a05732ad... (bdf1b69; NO SBOM and only buildx min-mode provenance; attested rebuild pending relaycast #619). RelayHistory and the Sessions services release images are not published and stay REQUIRED OVERRIDE (zero digest). values-gcp.yaml also sets alleyoop.auth.issuer and historyOrigin (the chart default rejected RelayAuth assertions; the umbrella now refuses an alleyoop historyOrigin that differs from relayhistory.relayauth.historyOrigin). Status: docs/handoff/STATUS.md. 0.3.0 renamed the Sessions subchart values key from 96bulls: to sessions-pipeline: (move your overrides; resource names under the umbrella are unchanged). relay-cloud-api 0.2.0 renders the relaycontrol contract (encryption.keyId required; internal token, dashboardUrl, flows, telemetry off by default). The GKE ingress denies /internal on the api host and gives the api backend a BackendConfig timeout (default 3600s) for the flows queue SSE stream. Supersedes the never-released 0.1.0. GKE proof packaging. Live proof pins (values-gcp-proof-live.yaml): dashboard sha256:23361e08b899f272ed5debcbd4e7d6c6555591029357d6fba6c54236063bca62 (relay-dashboard 53d484b); experimental unsupported RelayHistory sha256:72a057c27edbec53412a2b3a665913810b5d9a95d8b6b818946f1892590147bf (relayhistory-cloud 74a6e526, erasure fix). The CI render fixture and customer-images.yaml keep dashboard sha256:9bfc0c6b873411c7a0da60d746883bdef6aafd86a9b733c719500a603890b6fe and RelayHistory sha256:8fbda9bd89dd33994b6b3331fb403c38a25f04e6742050bd717e99661f3544ba. selfhost-api remains fail-closed until published and supplied by digest. The dashboard's same-origin /cloud/api is served by selfhost-api natively (it owns /cloud/api and /login; no ingress rewrite). No HA claim. 0.2.0 adds optional components.durableActors (vendored durable-actors 0.14.6) and components.relayfile, both off by default. relayhistory 0.1.1 adds migrations.drainForWriteHold (two-step write-hold upgrade; the migrate Job waits until no History pod exists, README). relay-cloud-api 0.2.1: telemetry.level defaults to errors (scrubbed error metadata and health only; it takes effect once the install is registered with installId, install key and endpoint, so a default render stays off and a partial registration fails), telemetry.egressTo defaults to empty (restricted egress with https telemetry must list the ingest addresses), the standalone Ingress denies /internal when secretKeys.internalToken is set, and Helm 3.10+ is required. 0.2.1 moved to 96bulls 0.5.5 (interim RelayAuth bearer stays off by default) and supersedes the never-released 0.2.0. |
 | relayfile-0.2.0 | unreleased | relayfile 0.2.0 | relayfile: `ghcr.io/agentworkforce/relayfile:0.1.0` |  |  | License-annotation bump of 0.1.1 (unreleased 0.1.2) plus runtime.backend=durable-actors (gateway, session broker: ghcr.io/agentworkforce/relayfile-actors by digest; deploy Job and dev sidecar: relayfile-actors-workspace by digest). Go server image by tag (Chart.appVersion), not digest; default render unchanged. |
 | durable-actors-0.14.6 | unreleased | durable-actors 0.14.6 |  |  |  | Vendored TerseAI/durable-actors release chart v0.14.6 (tag commit 5f0a2d62, asset sha256 a489cd15...bee) with the local patches listed in charts/durable-actors/UPSTREAM.md (root global, invoke-only key, host idle timeout, pool-manager name length, zero-valued bounds, lowercase ingress host, schema patterns, README links). Never published by this repo; images pinned by upstream digest (charts/durable-actors/UPSTREAM.md). |
diff --git a/self-hosted/customer-images.yaml b/self-hosted/customer-images.yaml
index c5d3ec4..9541ca9 100644
--- a/self-hosted/customer-images.yaml
+++ b/self-hosted/customer-images.yaml
@@ -10,7 +10,7 @@ metadata:
   auditedAt: "2026-11-03"
   chart:
     name: agent-relay
-    version: 0.3.1
+    version: 0.3.3
     values:
       - charts/agent-relay/values-gcp.yaml
 
@@ -60,37 +60,43 @@ images:
       - Deployment/relaycast:relaycast
     current:
       repository: ghcr.io/agentworkforce/relaycast-self-host
-      digest: sha256:a05732ad4f3614d057bb1460df40a30e3a9297c8930bfdda6d4e3d6dc9f41762
+      digest: sha256:81274dca7ab58673383dc7a9c777f422f29606c7422e81b5ea15724770f1455e
       chartStatus: shipped
     source:
       repository: https://github.com/AgentWorkforce/relaycast
-      revision: bdf1b69ccaf1cd2bc7ce6c975c824907cc9eff49
+      revision: bf713d86b366b46f491e287ce6117c7c5ff1f27a
       path: Dockerfile
       reproducibleReference: true
+      note: relaycast main after #618 and #619; engine 12.7.0 (docker/package.json pin).
     license:
       status: approved
       spdx: Apache-2.0
-      evidence: LICENSE at the source revision
+      evidence: https://github.com/AgentWorkforce/relaycast/blob/bf713d86b366b46f491e287ce6117c7c5ff1f27a/LICENSE
     platforms:
       expected: [linux/amd64, linux/arm64]
       verifiedFromRegistry: [linux/amd64, linux/arm64]
       status: verified
+      verificationAccess: anonymous
     release:
-      workflow: https://github.com/AgentWorkforce/relaycast/blob/bdf1b69ccaf1cd2bc7ce6c975c824907cc9eff49/.github/workflows/publish-container.yml
-      run: https://github.com/AgentWorkforce/relaycast/actions/runs/41161384835
+      workflow: https://github.com/AgentWorkforce/relaycast/blob/bf713d86b366b46f491e287ce6117c7c5ff1f27a/.github/workflows/publish-container.yml
+      run: https://github.com/AgentWorkforce/relaycast/actions/runs/41717074565
       trigger: workflow_dispatch
       buildsCommittedRevision: true
-      publishesSbom: false
-      # buildx default (mode=min, unsigned) attestation only; not verifiable.
-      publishesProvenance: false
-      provenanceMode: buildx-default
+      publishedTags: ["12.7.0"]
+      publishesSbom: true
+      publishesProvenance: true
+      provenanceMode: max-plus-github-attestation
     customerAcquisition:
       status: available-public
       procedure: Mirror the public GHCR digest into the customer registry by digest and record the destination digest.
     approval:
-      status: blocked
-      blockingReasons: [IMG-BLOCK-005]
-
+      status: approved
+      basis: >-
+        Public digest from the reviewed publish-container workflow at the
+        recorded main revision, with an SPDX SBOM, max-mode provenance, a
+        GitHub build-provenance attestation, and amd64+arm64 verified
+        anonymously from the registry.
+      blockingReasons: []
   - id: relayauth
     active: true
     firstParty: true
@@ -454,10 +460,12 @@ blockers:
       - both platforms are verified anonymously from the registry
   - id: IMG-BLOCK-005
     severity: hard
-    images: [relaycast, sessions-services]
+    images: [sessions-services]
     summary: >-
-      The release workflows publish no SBOM and only buildx's default
-      (mode=min, unsigned) provenance, which is not verifiable provenance.
+      The recorded Sessions services digest was built before the workflow
+      gained an SBOM and signed provenance (sessions-pipeline #172, merged);
+      a new digest from the attested workflow is not published yet.
+      Relaycast was closed by relaycast #619 and the 12.7.0 digest.
     closeWhen:
       - the release workflow publishes an SBOM and signed provenance for the recorded revision
       - a new digest built that way is recorded here
diff --git a/self-hosted/customer-release-evidence.json b/self-hosted/customer-release-evidence.json
index ed6f4cc..faa9660 100644
--- a/self-hosted/customer-release-evidence.json
+++ b/self-hosted/customer-release-evidence.json
@@ -22,7 +22,7 @@
       },
       {
         "decision": "approved",
-        "evidence": "https://github.com/AgentWorkforce/relaycast/blob/main/LICENSE (Apache-2.0; root LICENSE at the image source revision recorded in self-hosted/customer-images.yaml)",
+        "evidence": "https://github.com/AgentWorkforce/relaycast/blob/bf713d86b366b46f491e287ce6117c7c5ff1f27a/LICENSE (Apache-2.0, at the image source revision)",
         "id": "relaycast",
         "spdx": "Apache-2.0"
       },
@@ -61,7 +61,7 @@
   "operationalReadiness": {
     "loadTest": {
       "artifactSha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
-      "chartVersion": "0.3.1",
+      "chartVersion": "0.3.3",
       "evidence": "Not yet done; planned. The supported-100 ramp, 24-hour steady run, burst, drain and fault phases in docs/operations/capacity-and-load-test.md have not run. No capacity or SLO claim is made.",
       "imageManifestSha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
       "result": "not-run",
@@ -116,14 +116,14 @@
       "requiredStatusChecks": [],
       "requiresPullRequest": false
     },
-    "chartVersion": "0.3.1",
+    "chartVersion": "0.3.3",
     "environmentControls": {
       "name": "customer-release",
       "preventsSelfReview": false,
       "protected": false,
       "requiredApprovals": 0
     },
-    "imageManifestSha256": "sha256:8ad64140e4f3e0b698624b9e165c52288ce56b8e5127f2a4cf35868e9a925347",
+    "imageManifestSha256": "sha256:1b4f31225b0617732b2fe997f684bb4a65fbc9bc2393a362c1ef7883db6870d0",
     "valuesFile": "charts/agent-relay/values-gcp.yaml"
   },
   "releaseDecision": "blocked",
@@ -153,7 +153,7 @@
         "desktopVersion": "unreleased-custom-origin",
         "evidence": "Not yet done; planned. The server N/N-1 x Desktop current/previous matrix has not run; testedPlatforms lists the planned customer platform only.",
         "result": "not-run",
-        "serverVersion": "0.3.1",
+        "serverVersion": "0.3.3",
         "testedPlatforms": [
           "linux/amd64"
         ]
@@ -163,7 +163,7 @@
         "desktopVersion": "none",
         "evidence": "Not yet done; planned. The server N/N-1 x Desktop current/previous matrix has not run; testedPlatforms lists the planned customer platform only.",
         "result": "not-run",
-        "serverVersion": "0.3.1",
+        "serverVersion": "0.3.3",
         "testedPlatforms": [
           "linux/amd64"
         ]
@@ -173,7 +173,7 @@
         "desktopVersion": "unreleased-custom-origin",
         "evidence": "Not yet done; planned. The server N/N-1 x Desktop current/previous matrix has not run; testedPlatforms lists the planned customer platform only.",
         "result": "not-run",
-        "serverVersion": "0.1.1",
+        "serverVersion": "0.3.1",
         "testedPlatforms": [
           "linux/amd64"
         ]
@@ -183,13 +183,13 @@
         "desktopVersion": "none",
         "evidence": "Not yet done; planned. The server N/N-1 x Desktop current/previous matrix has not run; testedPlatforms lists the planned customer platform only.",
         "result": "not-run",
-        "serverVersion": "0.1.1",
+        "serverVersion": "0.3.1",
         "testedPlatforms": [
           "linux/amd64"
         ]
       }
     },
-    "serverCurrentVersion": "0.3.1",
-    "serverPreviousVersion": "0.1.1"
+    "serverCurrentVersion": "0.3.3",
+    "serverPreviousVersion": "0.3.1"
   }
 }
diff --git a/self-hosted/requirements.yaml b/self-hosted/requirements.yaml
index 7fd235f..b34df16 100644
--- a/self-hosted/requirements.yaml
+++ b/self-hosted/requirements.yaml
@@ -291,14 +291,21 @@ compatibility:
       images_note: not built for the charts yet
       notes: 'Follow-up re-pin to sessions-pipeline main after #127 (session briefs, generation 5ed11913...). Needs new GHCR/ECR digests, ci/sessions-pipeline-search-worker-role/services-commit and services-generation, and the session-brief entries below shipped.'
       db_combos: []
-    - id: relaycast-0.3.1
+    - id: relaycast-0.3.2
       status: unreleased
       current: true
+      charts: { relaycast: 0.3.2 }
+      app_versions: { relaycast: 12.7.0 }
+      images:
+        relaycast: { repository: ghcr.io/agentworkforce/relaycast-self-host, digest: sha256:81274dca7ab58673383dc7a9c777f422f29606c7422e81b5ea15724770f1455e }
+      notes: 'Default image moves to relaycast-self-host 12.7.0 (relaycast main bf713d86, engine 12.7.0), built by the reviewed publish-container workflow with an SPDX SBOM, max-mode provenance and a GitHub build-provenance attestation (run 41717074565); public, amd64+arm64.'
+    - id: relaycast-0.3.1
+      status: shipped
       charts: { relaycast: 0.3.1 }
       app_versions: { relaycast: 12.2.1-selfhost.1 }
       images:
         relaycast: { repository: ghcr.io/agentworkforce/relaycast-self-host, digest: sha256:a05732ad4f3614d057bb1460df40a30e3a9297c8930bfdda6d4e3d6dc9f41762 }
-      notes: 'README-only bump of 0.3.0 for the sessions-pipeline rename.'
+      notes: 'README-only bump of 0.3.0 for the sessions-pipeline rename. Superseded by 0.3.2.'
     - id: relaycast-0.3.0
       status: shipped
       charts: { relaycast: 0.3.0 }
@@ -343,18 +350,18 @@ compatibility:
       images:
         relayauth: { repository: ghcr.io/agentworkforce/relayauth, digest: sha256:eb71daa28e30eb7305f666d0bccc5a4002e53e8a574e3c4c32163d907a1b71df }
       notes: superseded by 0.1.1.
-    - id: agent-relay-0.3.2
+    - id: agent-relay-0.3.3
       status: unreleased
       current: true
-      charts: { agent-relay: 0.3.2, relayhistory: 0.1.1, relay-cloud-api: 0.2.1, relay-dashboard: 0.1.0 }
+      charts: { agent-relay: 0.3.3, relayhistory: 0.1.1, relay-cloud-api: 0.2.1, relay-dashboard: 0.1.0 }
       app_versions: { agent-relay: 0.1.0, relayhistory: 0.1.0, relay-cloud-api: 0.1.0, relay-dashboard: 0.1.0 }
       depends:
-        agent-relay: { relaycast: 0.3.1, relayauth: 0.1.2, sessions-pipeline: 0.6.0, relayhistory: 0.1.1, relay-cloud-api: 0.2.1, relay-dashboard: 0.1.0, relayflows: 0.2.4, durable-actors: 0.14.6, relayfile: 0.2.0 }
+        agent-relay: { relaycast: 0.3.2, relayauth: 0.1.2, sessions-pipeline: 0.6.0, relayhistory: 0.1.1, relay-cloud-api: 0.2.1, relay-dashboard: 0.1.0, relayflows: 0.2.4, durable-actors: 0.14.6, relayfile: 0.2.0 }
       images:
         relayhistory: { repository: ghcr.io/agentworkforce/relayhistory, digest_required: true }
         relay-cloud-api: { repository: ghcr.io/agentworkforce/selfhost-api, digest_required: true }
         relay-dashboard: { repository: ghcr.io/agentworkforce/relay-dashboard, digest_required: true }
-      notes: 'GKE proof refresh on top of 0.3.1 (tag agent-relay-0.3.1). Proof overlays only: values-gcp-proof-durable-actors.yaml pins relaycast-actors-gateway sha256:faf66ec45d2c755ab5cdc6ee32bca6dc48446dff444118cab18fa1f765124ffa and relaycast-actors-deployer sha256:a81e91ed52bfb7cbb0a8c2773752df3b5d78afdc443608998b3203a30e314cee (relaycast main 3624cc12); values-gcp-proof-relayfile.yaml pins relayfile-actors sha256:7fb2110701a004f9f7ed2b025d25156fbe993208598bfbd0498a48b30df48299 and relayfile-actors-workspace sha256:c5851a1b1f7624390a1a00ebdee69e8e521dc3f23f345c582d62e09dba9a6e83 (relayfile main 39f84fcf); values-gcp-proof-live.yaml pins the experimental unsupported RelayHistory sha256:f36ae1671bdcd88a2b8b2df62c8edecb1381237d9f968747b39298959ad33563 (relayhistory-cloud 3cb76752). Proof CPU requests sized for the e2-medium pool, and the README documents the write-hold upgrade with the Relayflows smoke Job. The customer profile (values-gcp.yaml) and templates are unchanged from 0.3.1.'
+      notes: '0.3.3 (tag agent-relay-0.3.3) moves relaycast to chart 0.3.2 and pins relaycast-self-host sha256:81274dca7ab58673383dc7a9c777f422f29606c7422e81b5ea15724770f1455e (relaycast main bf713d86, engine 12.7.0; SBOM + max-mode provenance + GitHub attestation; public) in values-gcp.yaml, and includes the never-tagged 0.3.2 proof refresh: GKE proof refresh on top of 0.3.1 (tag agent-relay-0.3.1). Proof overlays only: values-gcp-proof-durable-actors.yaml pins relaycast-actors-gateway sha256:faf66ec45d2c755ab5cdc6ee32bca6dc48446dff444118cab18fa1f765124ffa and relaycast-actors-deployer sha256:a81e91ed52bfb7cbb0a8c2773752df3b5d78afdc443608998b3203a30e314cee (relaycast main 3624cc12); values-gcp-proof-relayfile.yaml pins relayfile-actors sha256:7fb2110701a004f9f7ed2b025d25156fbe993208598bfbd0498a48b30df48299 and relayfile-actors-workspace sha256:c5851a1b1f7624390a1a00ebdee69e8e521dc3f23f345c582d62e09dba9a6e83 (relayfile main 39f84fcf); values-gcp-proof-live.yaml pins the experimental unsupported RelayHistory sha256:f36ae1671bdcd88a2b8b2df62c8edecb1381237d9f968747b39298959ad33563 (relayhistory-cloud 3cb76752). Proof CPU requests sized for the e2-medium pool, and the README documents the write-hold upgrade with the Relayflows smoke Job. The customer profile (values-gcp.yaml) and templates are unchanged from 0.3.1.'
     - id: agent-relay-0.3.1
       status: shipped
       charts: { agent-relay: 0.3.1, relayhistory: 0.1.1, relay-cloud-api: 0.2.1, relay-dashboard: 0.1.0 }