v0.12.9

**Everything a `:v012` user receives moving from v0.12.4 → v0.12.9: 34 values.** Four candidates between them (v0.12.5–v0.12.8) were tagged, published, **witness-failed, and honestly abandoned** — their work ships here, witnessed. The receipt: [`releases/v0.12.9/witness.json`](https://github.com/Vexa-ai/vexa/blob/main/releases/v0.12.9/witness.json) — 14 values walked live on **lite + compose + helm**, 20 by-proxy with named evidence and stated limitations.

## Highlights

**Transcription & self-host**
- **Lite transcribes out of the box** — `make -C deploy/lite up LOCAL_STT=1`: bundled CPU whisper, no token, no GPU (#626)
- An empty env flag can never again silently disable transcription — fail-loud restored (#650, #651)
- Composer-mic dictation on lite (#628) · recording playback seeks (#633) · Jitsi joins the lineup (#632)

**Production reliability**
- Slim, paginated `/meetings` list — the cure for the 2026-07-15 production event-loop outage (#584)
- DB pool knobs wired (#635) · login-token flood capped (#638)
- Multi-replica safety: orphaned segment reclaim with safe degrade on Redis <6.2 (#636), single-flight sweeps (#637), ghost-consumer pruning (#660)
- Whole process tree reaped on bot exit — no orphaned Chromium on lite (#546)

**0.10 → 0.12 upgrade continuity**
- Pre-0.12 API tokens keep working — scopes backfilled automatically, no silent revocation (#578)
- Native-id `api.v1` routes restored: rename/delete by `(platform, native_id)`, `running_bots`, share/download aliases (#579)
- "Sealed api.v1" enforced **both directions** in CI; the audited `KNOWN_GAPS` ledger makes every exception visible (#591)

**Kubernetes/helm — bot spawn works stock for the first time in the 0.12 line**
The three-surface witness for this release found that no 0.12 helm install had ever spawned a bot successfully, and fixed the whole chain:
- Spawned pods inherit the runtime's scheduling constraints — tainted/dedicated pools work (#673)
- Bot pods boot the image's real entrypoint (docker masked the broken path; k8s crashed on it) (#675)
- `kubectl run --overrides` merge semantics respected — the spawn survives (#684)
- Terminal auth bootstrap (#676) and live-transcript SSE (#677) work stock; meeting-api gets `ADMIN_API_URL` + **fail-closed** auto-join (#656) and `MEETING_API_URL` (#634)

**Release honesty (governance)**
- Notes can't overstate a leg's scope — see the table below rendering its own truth (#657)
- The witness batch is bounded by the last release that *shipped*, not the last tag — abandoned candidates can't hide values (#658)
- merge-card waits for a verdict instead of red-carding in-flight checks (#655)

## Known issues (stated, filed)
- #674 — the meeting header's bot control can render stale state after session resets and surface raw errors (reproduced during this witness; prepared)
- #625 — CPU whisper (tiny/small) is the transcription-quality floor; GPU `large-v3-turbo` remains the recommended production path
- Rapid repeated bot joins from one IP can hit Google Meet's bot-detection throttle (operational note)

## Upgrading
From 0.10: token scopes are backfilled automatically at admin-api boot (#578); see the changelog migration section. From any 0.12.x: `IMAGE_TAG=v0.12.9` — compose stacks now pin the bot to the release tag automatically (#659).

## The guarantee — v0.12.9 ([this run](https://github.com/Vexa-ai/vexa/actions/runs/29528304777))

| # | Guarantee | Proof in this run |
|---|---|---|
| 1 | Every artifact users pull is the artifact we proved | ✅ manifests resolve; every leg pulls published bytes only |
| 2 | Every documented install path stands up and is exercised to its leg's scope (NOT full end-to-end — real audio→words is row 3) | compose installs + API/data-plane wiring, synthetic transcript; real bot in row 5 ✓ · FSM meeting-lifecycle FSM via mock bot, no real browser/STT ✓ · lite front doors + ≥2 concurrent real-bot spawn, no meeting/STT assertion ✓ · helm installs + healthy, bot/meeting/STT not exercised ✓ |
| 3 | Real audio → correct, speaker-attributed words | ⚠️ NOT machine-proven in this run — witness-pass only until the wav→words leg (#560) ships |
| 4 | A fresh machine with nothing on it succeeds | ⚠️ fresh-VM leg runs outside this workflow — attach its evidence to the notes or state unclaimed |
| 5 | Nothing that worked before broke | v010-compat ✅ · bot-spawn ✅ |
| 6 | Every image contains what its name promises | ✅ image-identity |
| 7 | A human witnessed the assembled value | ⛔ ENFORCED — witness-gate requires releases/v0.12.9/witness.json AND the release-promote Environment requires the owner's approval; promote cannot run without both |
| 8 | Every batch change individually proven before entry | ⛔ ENFORCED — value-gate blocks promote unless every batch PR is pr-value-green on its head or state: value-signed |
| 9 | The notes tell the truth about coverage | this table IS the mechanism — generated from run results, gaps stated above |
| 10 | Pointers moved honestly | promote runs only on all-green + promote:true; constitutional guards in the job |