kjgbot · Nov 4, 2026 · Nov 3, 2026
diff --git a/charts/agent-relay/Chart.lock b/charts/agent-relay/Chart.lock
@@ -1,7 +1,7 @@
 dependencies:
 - name: relaycast
   repository: file://../relaycast
-  version: 0.3.1
+  version: 0.3.2
 - name: relayauth
   repository: file://../relayauth
   version: 0.1.2
@@ -26,5 +26,5 @@ dependencies:
 - name: relayfile
   repository: file://../relayfile
   version: 0.2.0
-digest: sha256:43e0b3923627f7f49faa25042f7cb5b6cb58063dd20f8c99bbddd4e37c704bd0
-generated: "2026-11-03T10:18:40.215577-08:00"
+digest: sha256:3a1e8b73bbb5dd09e11168ffa0d7f7d5a0f4ccaf2eb2fe4a9602c2f733aa52c0
+generated: "2026-11-03T13:14:48.597974-08:00"
diff --git a/charts/agent-relay/Chart.yaml b/charts/agent-relay/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: agent-relay
 description: Self-hosted Agent Relay messaging and sessions suite
 type: application
-version: 0.3.2
+version: 0.3.3
 appVersion: "0.1.0"
 kubeVersion: ">=1.28.0-0"
 annotations:
@@ -17,7 +17,7 @@ maintainers:
     url: https://github.com/AgentWorkforce
 dependencies:
   - name: relaycast
-    version: 0.3.1
+    version: 0.3.2
     repository: file://../relaycast
     condition: components.relaycast
   - name: relayauth

diff --git a/charts/agent-relay/values-gcp.yaml b/charts/agent-relay/values-gcp.yaml
@@ -37,9 +37,10 @@ gkeIngress:
 relaycast:
   fullnameOverride: relaycast
   image:
-    # Release image (public GHCR, relaycast bdf1b69; an SBOM-attested rebuild is pending relaycast #619). Mirror by digest and override repository.
+    # Release image (public GHCR, relaycast main bf713d86, engine 12.7.0, SBOM +
+    # provenance). Mirror it by digest to your registry and override repository.
     repository: ghcr.io/agentworkforce/relaycast-self-host
-    digest: sha256:a05732ad4f3614d057bb1460df40a30e3a9297c8930bfdda6d4e3d6dc9f41762
+    digest: sha256:81274dca7ab58673383dc7a9c777f422f29606c7422e81b5ea15724770f1455e
   # REQUIRED OVERRIDE: must use the same cast host as gkeIngress.hosts.cast.
   baseUrl: https://cast.placeholder.company
   # REQUIRED OVERRIDE: existing Secret name; see README for required keys.

diff --git a/charts/relaycast/Chart.yaml b/charts/relaycast/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: relaycast
 description: Portable Relaycast core for self-hosted Agent Relay deployments
 type: application
-version: 0.3.1
-appVersion: "12.2.1-selfhost.1"
+version: 0.3.2
+appVersion: "12.7.0"
 kubeVersion: ">=1.22.0-0"
 annotations:
   artifacthub.io/license: Apache-2.0

diff --git a/charts/relaycast/values.yaml b/charts/relaycast/values.yaml
@@ -4,10 +4,11 @@ replicaCount: 1
 
 image:
   repository: ghcr.io/agentworkforce/relaycast-self-host
-  # relaycast-self-host:12.2.1-selfhost.1, built from relaycast main bdf1b69c
-  # (engine 12.2.1 + the internal admin API). Immutable multi-platform
-  # manifest (linux/amd64 and linux/arm64).
-  digest: sha256:a05732ad4f3614d057bb1460df40a30e3a9297c8930bfdda6d4e3d6dc9f41762
+  # relaycast-self-host:12.7.0, built from relaycast main bf713d86 by the
+  # reviewed publish-container workflow (engine 12.7.0). Immutable
+  # multi-platform manifest (linux/amd64 and linux/arm64) with an SPDX SBOM,
+  # max-mode provenance and a GitHub build-provenance attestation.
+  digest: sha256:81274dca7ab58673383dc7a9c777f422f29606c7422e81b5ea15724770f1455e
   pullPolicy: IfNotPresent
 
 imagePullSecrets: []

diff --git a/docs/handoff/RELEASE_NOTES.md b/docs/handoff/RELEASE_NOTES.md
@@ -37,6 +37,15 @@ Desktop setup. Relayflows, durable actors and Relayfile are optional preview
 components, off by default. Billing, provider integrations and hosted fleet
 are out of scope.
 
+## agent-relay 0.3.3 (2026-11-03)
+
+Pins the attested Relaycast image: `relaycast-self-host@sha256:81274dca…`
+(relaycast main `bf713d86`, engine 12.7.0; SPDX SBOM, max-mode provenance and a
+GitHub build-provenance attestation; public, amd64+arm64). The relaycast leaf
+chart is now 0.3.2 with the same default. This image has not run the GKE
+upgrade/restore drills; its kind smoke runs in this repository's CI. It also carries the untagged 0.3.2 GKE proof-overlay refresh (proof
+values only). Everything else is as in 0.3.1.
+
 ## agent-relay 0.3.1 (2026-11-03): reviewable release
 
 This is the first release of the umbrella chart, to be published from the
@@ -62,7 +71,7 @@ exists and you pin it.
 | Control-plane API | `ghcr.io/agentworkforce/selfhost-api@sha256:535e6718…` | relaycontrol `8e989a1` | SBOM + max provenance; **private package, not pullable by customers yet** (installation blocker) |
 | Dashboard | `ghcr.io/agentworkforce/relay-dashboard@sha256:bbeca872…` | relay-dashboard `b213406` | SBOM + max provenance + GitHub attestation; public |
 | RelayAuth | `ghcr.io/agentworkforce/relayauth@sha256:c23c92d2…` | relayauth `784582e` | SBOM + provenance; public |
-| Relaycast | `ghcr.io/agentworkforce/relaycast-self-host@sha256:a05732ad…` | relaycast `bdf1b69` | public; **no SBOM, min-mode provenance only** (attested rebuild pending) |
+| Relaycast | `ghcr.io/agentworkforce/relaycast-self-host@sha256:81274dca…` | relaycast `bf713d86` (engine 12.7.0) | SBOM + max provenance + GitHub attestation; public (0.3.2) |
 | Sessions wait-for-role | `ghcr.io/cloudnative-pg/postgresql@sha256:ed6923f9…` | upstream `4c2710a` | upstream revision label `4c2710a`, run 40291448784; SBOM + SLSA attestation manifests; keyless cosign signature verified with `--certificate-github-workflow-sha` |
 | Sessions services | `ghcr.io/agentworkforce/96bulls-services` | no release revision yet (last audited private image: `7d7229b`; the release is to be built from `main` at or after `51b38ff`) | **not published** (zero digest): the attested publish needs the owner's dispatch; REQUIRED OVERRIDE, installation blocker |
 | RelayHistory | `ghcr.io/agentworkforce/relayhistory` | relayhistory-cloud | **not published** (zero digest): the self-host runtime PR is held; REQUIRED OVERRIDE, installation blocker |

diff --git a/docs/handoff/STATUS.md b/docs/handoff/STATUS.md
@@ -1,8 +1,9 @@
 # Release status: what is proven and what is preview
 
-Release: `agent-relay` chart 0.3.1, 2026-11-03 (to be published from the
-`agent-relay-0.3.1` tag as `oci://ghcr.io/agentworkforce/charts/agent-relay`,
-version 0.3.1).
+Release: `agent-relay` chart 0.3.3, 2026-11-03, published from the
+`agent-relay-0.3.3` tag as `oci://ghcr.io/agentworkforce/charts/agent-relay`
+version 0.3.3. 0.3.1 (the first published version) differs only in the
+Relaycast image and the GKE proof overlays (0.3.2 was never tagged).
 
 This release is for **review by a company evaluating a self-hosted Agent Relay
 on GCP**. It is a reviewable `portable-single` release that pins every
@@ -19,7 +20,7 @@ This archive is therefore labelled a development preview.
 | Area | Evidence (what was checked, including its limits) |
 |---|---|
 | Licensing | Apache-2.0 at `main` for relaycast, relayauth, relaycontrol (control-plane API), relay-dashboard and this chart repository. Sessions Pipeline is Apache-2.0 by owner decision; its LICENSE landed on `main` in sessions-pipeline #172 (merge `51b38ff`), after the image revision recorded in the manifest (`7d7229b`). RelayHistory is Apache-2.0 by owner decision; its LICENSE PR (relayhistory-cloud #279) is open and held, so no RelayHistory revision carries it yet. The third-party PostgreSQL image (CloudNativePG) is Apache-2.0 packaging. See `self-hosted/customer-release-evidence.json` (`licenses.firstParty`). |
-| Image supply chain | Mixed; per image in `self-hosted/customer-images.yaml`. The control-plane API (`selfhost-api`) and dashboard images were built by their release workflows from reviewed `main` commits with an SBOM and max-mode provenance (the dashboard also has a GitHub build-provenance attestation and is public; the `selfhost-api` package is still private). The RelayAuth image has an SBOM and provenance. The Relaycast image (`a05732ad…`) has **no SBOM and only buildx's default min-mode provenance**. The CloudNativePG PostgreSQL digest is verified against upstream revision `4c2710a` (run 40291448784, SBOM and SLSA attestation manifests, keyless cosign signature verified with `--certificate-github-workflow-sha`). The Sessions services and RelayHistory release images are **not published**; both stay REQUIRED OVERRIDE (zero digest) in `values-gcp.yaml`. |
+| Image supply chain | Mixed; per image in `self-hosted/customer-images.yaml`. The control-plane API (`selfhost-api`) and dashboard images were built by their release workflows from reviewed `main` commits with an SBOM and max-mode provenance (the dashboard also has a GitHub build-provenance attestation and is public; the `selfhost-api` package is still private). The RelayAuth image has an SBOM and provenance. Since 0.3.3 the Relaycast image (`81274dca…`, relaycast `bf713d86`, engine 12.7.0) also has an SBOM, max-mode provenance and a GitHub build-provenance attestation, and is public. The CloudNativePG PostgreSQL digest is verified against upstream revision `4c2710a` (run 40291448784, SBOM and SLSA attestation manifests, keyless cosign signature verified with `--certificate-github-workflow-sha`). The Sessions services and RelayHistory release images are **not published**; both stay REQUIRED OVERRIDE (zero digest) in `values-gcp.yaml`. |
 | End-to-end function on GKE | The live proof deployment (not the 0.3.1 customer profile: it ran the experimental RelayHistory proof image, and Relaycast on durable actors in the final run) passed all 15 end-to-end cases: single-org bootstrap, Relaycast messaging, session delivery and reads, workspace isolation on 28 routes, restart durability, RelayAuth verification, the Sessions Pipeline, session erasure, public-edge checks, the sessions API, admin env vars and audit, flows on an in-namespace worker, the dashboard and cleanup. See `docs/handoff/evidence/gke-e2e.md`. The harness is in `scripts/selfhost/`. |
 | Upgrade and restore drills | An isolated GKE drill of agent-relay 0.1.1 ran a quiesced backup (writers stopped for 314 s) and a restore into a separate Cloud SQL instance, bucket, PVCs and namespace. All seven recorded verification gates passed (Cloud SQL, Relaycast and RelayAuth integrity, GCS integrity, isolated messaging, cross-workspace denial, no production references). No data was lost between the quiesce point and the capture. RTO was 387 s to pods Ready and 578 s to the gates passing; a cold restore adds about 189 s of instance creation (about 767 s, about 12.8 min). The pre-upgrade gate passed (OK), and an upgrade from 0.1.1 to the release candidate passed 17/17 checks (run before the Sessions chart rename that the final 0.3.1 also contains). Neither ran the full release image set: the restore ran the 0.1.1 drill images, and the upgrade ran previous or live-proof images for `selfhost-api`, RelayHistory and Sessions. See `docs/handoff/evidence/gke-upgrade-restore-drills.md`. |
 

diff --git a/docs/self-hosted-image-supply-chain.md b/docs/self-hosted-image-supply-chain.md
@@ -43,7 +43,7 @@ The audit checked:
 
 | Image | Active use | Source and revision | License | Platforms | Release and supply chain | Result |
 | --- | --- | --- | --- | --- | --- | --- |
-| `ghcr.io/agentworkforce/relaycast-self-host@sha256:a05732ad4f3614d057bb1460df40a30e3a9297c8930bfdda6d4e3d6dc9f41762` | Relaycast Deployment | [`AgentWorkforce/relaycast`](https://github.com/AgentWorkforce/relaycast) `bdf1b69ccaf1cd2bc7ce6c975c824907cc9eff49` | Apache-2.0 | Registry-verified `linux/amd64`, `linux/arm64` | [Workflow](https://github.com/AgentWorkforce/relaycast/blob/bdf1b69ccaf1cd2bc7ce6c975c824907cc9eff49/.github/workflows/publish-container.yml), [run](https://github.com/AgentWorkforce/relaycast/actions/runs/41161384835). **No SBOM**; only buildx's default min-mode, unsigned provenance. Public GHCR digest | **Hard blocker** (`IMG-BLOCK-005`) |
+| `ghcr.io/agentworkforce/relaycast-self-host@sha256:81274dca7ab58673383dc7a9c777f422f29606c7422e81b5ea15724770f1455e` | Relaycast Deployment | [`AgentWorkforce/relaycast`](https://github.com/AgentWorkforce/relaycast) `bf713d86b366b46f491e287ce6117c7c5ff1f27a` | Apache-2.0 | Registry-verified `linux/amd64`, `linux/arm64` (anonymous) | [Workflow](https://github.com/AgentWorkforce/relaycast/blob/bf713d86b366b46f491e287ce6117c7c5ff1f27a/.github/workflows/publish-container.yml), [run](https://github.com/AgentWorkforce/relaycast/actions/runs/41717074565). SPDX SBOM, max-mode provenance, GitHub build-provenance attestation. Public GHCR digest | Approved |
 | `ghcr.io/agentworkforce/relayauth@sha256:c23c92d25fdffef3b5838a1eef4c226925f859706365d9ccece229795b877288` | RelayAuth Deployment | [`AgentWorkforce/relayauth`](https://github.com/AgentWorkforce/relayauth) `784582ef983bb72b13b43512d9a4142ef5dfabb2` | Apache-2.0 | Registry-verified `linux/amd64`, `linux/arm64` | [Workflow](https://github.com/AgentWorkforce/relayauth/blob/784582ef983bb72b13b43512d9a4142ef5dfabb2/.github/workflows/container.yml), [run](https://github.com/AgentWorkforce/relayauth/actions/runs/41277442855); SBOM and provenance; anonymous pull verified | Approved |
 | `ghcr.io/agentworkforce/96bulls-services@sha256:6f22ea17dff336e1431664542759fd27958649388b90a0b2f0881883caa7c6b2` (evidence only; the profile renders a zero digest) | Four Sessions Deployments and migration Job | Private [`AgentWorkforce/sessions-pipeline`](https://github.com/AgentWorkforce/sessions-pipeline) `7d7229bb31c121ecb98cd4e35c248fc2cf5669ad` | Apache-2.0 by owner decision; the LICENSE landed on `main` in #172 (merge `51b38ff`), after this revision | Not registry-verified (anonymous inspection returns `unauthorized`) | Approval-gated [workflow](https://github.com/AgentWorkforce/sessions-pipeline/blob/7d7229bb31c121ecb98cd4e35c248fc2cf5669ad/.github/workflows/publish-image.yml), [run](https://github.com/AgentWorkforce/sessions-pipeline/actions/runs/41375745173); no SBOM, min-mode provenance. The attested release image is **not published** | **Hard blocker** (`IMG-BLOCK-001`, `IMG-BLOCK-005`) |
 | `ghcr.io/cloudnative-pg/postgresql@sha256:ed6923f9ba2399cf9070379a353c710c29ced8a294be73986a2c3dae7e599ce3` | Sessions migration `wait-for-role` init container | Public [`cloudnative-pg/postgres-containers`](https://github.com/cloudnative-pg/postgres-containers) `4c2710a78328becdadf708ca6d9cb3fb61f3f5ee` (the image's revision label and its SLSA provenance both name it) | Apache-2.0 packaging; PostgreSQL License | Registry-verified `linux/amd64`, `linux/arm64` | Upstream [`bake_targets.yml`](https://github.com/cloudnative-pg/postgres-containers/blob/4c2710a78328becdadf708ca6d9cb3fb61f3f5ee/.github/workflows/bake_targets.yml), [run 40291448784](https://github.com/cloudnative-pg/postgres-containers/actions/runs/40291448784); SPDX SBOM and SLSA v1 attestation manifests; keyless cosign signature verified with `--certificate-github-workflow-sha 4c2710a…` | Approved (third party) |
@@ -99,10 +99,10 @@ approved byte-for-byte third-party mirror.
   (relaycontrol `main` `8e989a1`, SBOM and max-mode provenance), but the GHCR
   package is still private, so customers have no pull path. Close by making
   the package public and verifying both platforms anonymously.
-- `IMG-BLOCK-005` — **Relaycast and Sessions services**: their release
-  workflows publish no SBOM and only buildx's default min-mode, unsigned
-  provenance. Close with a rebuild that publishes an SBOM and signed
-  provenance, and record the new digest.
+- `IMG-BLOCK-005` — **Sessions services**: the recorded digest predates the
+  attested workflow (sessions-pipeline #172). Close with a rebuild that
+  publishes an SBOM and signed provenance, and record the new digest.
+  Relaycast was closed in 0.3.3 by the attested 12.7.0 digest.
 
 Until these are closed, the umbrella chart is not customer-image ready even if
 it renders or the proof cluster is healthy.