v0.12.10

**Everything a `:v012` user receives moving from v0.12.9 → v0.12.10: 11 values, one walked live.** The receipt: [`releases/v0.12.10/witness.json`](https://github.com/Vexa-ai/vexa/blob/main/releases/v0.12.10/witness.json) — the silence-hallucination fix walked live on a **fresh, autonomously pre-validated `lite` deployment** (bot admitted to a real Meet, speech transcribed, near-silence produced no phantom phrases), the other 10 values by-proxy with named test/gate evidence.

## Highlights

**Transcription (the live-walk value)**
- **Meet transcripts stop hallucinating during silence** (#619, closes #617) — near-silent audio windows are gated before they ever reach Whisper, and the ja/tr phantom-phrase classes are filtered, so quiet stretches no longer inject "thanks-for-watching"-style ghost lines into the record. Walked live this release.
- **Hallucination lists become empirical** (#623, closes #622) — one script harvests phrase lists across every Whisper language, superseding hand-curation. (The harvester ships here; the empirical harvest *run* is tracked in #710.)

**Reliability / operator-facing**
- **Webhooks survive storage outages** (#614, closes #520) — the retry queue is now a crash-safe Redis reliable-queue: a `meeting.completed` that fails delivery during an outage is delivered after recovery instead of silently vanishing (the 2026-04-21 incident class, closed).
- **Supply-chain honesty** (#615) — every release now generates a per-release SPDX SBOM (npm + pip + the baked pyannote model weights no dependency scanner sees), plus an offline bake-VERIFY leg and the baked-model licence notice. v0.12.10 is the first release shipping its own SBOM.

**Contributor-facing**
- **Local gates stop lying** (#703, closes #702) — `gate:db-budget` scans the committed tree only; a gitignored `.venv` can no longer red every dev machine's pre-push while CI stays blind to it.
- **The merge-train tax is dead** (#701) — per-PR changelog fragments + `merge=union` + the fan-out rule: the exact mechanism this release's own changelog was assembled with, five manual conflict cycles per batch gone.

**Governance / record**
- **The two loops become law** (#692, closes #688) — debug-loop vs release-loop discipline, flake quarantine, and the human-placement rule (D-L4): the witness walks a *delivered, running* deployment, never a setup recipe.
- **Value definition leads every prepared issue** (#700) and **the v0.12.9 witness receipt is on record** (#687) — the spec shape sharpened, the record honest.
- **Release mechanics hardened at their point of introduction** (#707, #708) — three-stamp version alignment (`package.json` · Chart `appVersion` · docs-reflects) with the runbook checklist corrected.

## Known issues (stated, filed)
- **#710** — the empirical hallucination harvest has not been *run* yet (the harvester shipped in #623; the operator sweep is filed and prepared). Until it lands, non-silence phantoms outside the curated lists (e.g. a "Thank you for watching!" over noisy non-speech audio) can still leak — the near-silence gate does not cover non-silent noise.
- **#625** — CPU whisper (tiny/small) is the transcription-quality floor; GPU `large-v3-turbo` remains the recommended production path.
- Rapid repeated bot joins from one IP can hit Google Meet's bot-detection throttle (operational note).

## Upgrading
From any 0.12.x: pull `:v012` (now v0.12.10) or pin `IMAGE_TAG=v0.12.10`. No schema or API changes in this batch. From 0.10: token scopes are backfilled automatically at admin-api boot — see the [changelog migration section](https://docs.vexa.ai/changelog).

## The guarantee — v0.12.10 ([this run](https://github.com/Vexa-ai/vexa/actions/runs/29606089006))

| # | Guarantee | Proof in this run |
|---|---|---|
| 1 | Every artifact users pull is the artifact we proved | ✅ manifests resolve; every leg pulls published `:v0.12.10` bytes only |
| 2 | Every documented install path stands up to its leg's scope | compose ✅ · mock-FSM meeting-lifecycle ✅ · lite front doors + real-bot spawn ✅ · helm-k3s installs healthy ✅ |
| 3 | Real audio → correct, speaker-attributed words | witness-proven — walked live on the lite deployment (#619); machine-proof lands with the wav→words leg (#560) |
| 4 | A fresh machine with nothing on it succeeds | ✅ the witness ran on a fresh throwaway VM, autonomously pre-validated before handover (D-L4) |
| 5 | Nothing that worked before broke | v010-compat ✅ · bot-spawn ✅ |
| 6 | Every image contains what its name promises | ✅ image-identity |
| 7 | A human witnessed the assembled value | ⛔ ENFORCED — witness-gate required `releases/v0.12.10/witness.json` AND the `release-promote` Environment required the owner's approval; both cleared |
| 8 | Every batch change individually proven before entry | ⛔ ENFORCED — value-gate: every batch PR `pr-value`-green or `state: value-signed` |
| 9 | The notes tell the truth about coverage | this table IS the mechanism — generated from run results, gaps stated above |
| 10 | Pointers moved honestly | promote ran only on all-green + `promote:true` + owner approval; `:v012` → `sha256:43fd4371…` |

## Credits
- **@fredpalas** — reported #613 (audio drop during silence; the ja/tr phantom phrases), the ground truth behind the silence-hallucination fix (#619) walked live in this release.