Rullst v12 Stable Release Record

Note

Historical record (v12). The 12.x line reached end of life on 16 October 2026 with 12.3.0 as its last release. The current line is v13; move a v12 application with Preparing an application for v13.

12.1.2 maintenance release

The v12 maintenance line released 12.1.2 (tag v12.1.2, 28 September 2026 UTC, 27 September in Brasília) with Nexus stored-value escaping, HTML macro caller-binding hygiene, explicit OAuth authorization-code response types, a compatible Tauri family for generated Omni shells and additional Auth, HTTP lifecycle and SQLite messaging regressions. Compatible corrections are also prepared for v13 development; its package versions and admission remain separate.

This main copy does not hold the 12.1.2 publication receipt. See the 12.1.2 review and maintained release record for current stable status. The immutable 12.1.1 receipt follows below.

12.1.1 published maintenance release

All sixteen public packages were published as 12.1.1 on September 24, 2026 UTC (September 23 in Brasília). The protected release workflow completed successfully. Independent registry checks confirmed all versions were available, not yanked, and matched the reviewed SHA-256 checksums. The registry observation receipt records those checksums and timestamps; signed release attestations establish provenance.

This compatible patch preserves the 12.1.0 API and Rust 1.96.0 MSRV. It fixes application-key/configuration validation, HTTP response-body drain accounting and SQLite lease timestamps under write-lock contention, and includes reviewed dependency, generated-code and documentation maintenance. Applications using public scaffold keys must replace them with unique secure secrets and renew sessions; updating dependencies does not rotate deployed secrets or rewrite application files. See the migration guide.

The exact source passed all 28 required admission workflows. All 40 fuzz targets had eligible original campaign evidence under the reviewed equivalence policy; they were not all rerun for the final documentation change. Release packaging, crates-only consumers, installed CLI blueprints, reproducibility and four native CLI build/smoke jobs passed. Package/evidence digests and all four native artifact inventories matched the cryptographically verified tag/source/workflow/run-bound attestation. Packaged READMEs match the reviewed absolute-link documentation.

Targeted mutations identified additional regression-test work; they do not establish a full-framework mutation score or absence of defects. Additional tests follow on maintained v12 and development main, with a new patch version if another registry publication is needed. No real provider-account acceptance, physical-device acceptance or broad security certification is implied.

The maintenance and Daybreak review plan retains scope and acceptance boundaries. The published tag, crate archives, attestations and the original 12.1.0 receipts remain immutable.

12.1.0 published maintenance release

All sixteen public packages were published as 12.1.0 on September 20, 2026 UTC (September 19 in Brasília). The protected publication and GitHub release completed successfully; independent registry checks confirmed every version was available, not yanked, and matched the reviewed package SHA-256 checksum. The registry observation receipt retains the sixteen checksums and verification time; release attestations separately establish build provenance.

The release admitted all 28 required workflows for that source, including the declared fuzz inventory, and produced attested crate archives and native CLI assets for four targets. The verified Linux binaries reported rullst 12.1.0 through rullst --version, cargo-rullst --version and cargo rullst --version. The packaged README reflects the reviewed documentation and omits the staging SaaS URL. These receipts do not establish live acceptance for every external provider or physical-device compatibility.

The 12.1 migration guide covers application changes when upgrading. Post-publication documentation and informational mutation campaigns do not replace the immutable tag, crate archives or release attestations.

The record below preserves the completed 12.0.0 publication and its original evidence; its commit and checksums do not describe the 12.1 release.

12.0.0 published baseline

Rullst 12.0.0 was published on September 15, 2026. This page is the concise record of that release; it is no longer a development backlog or launch checklist.

Immutable release identity

The protected release workflow admitted the exact tag commit, reproduced the publication inputs, verified the artifacts, produced GitHub build-provenance attestations, published the packages in dependency order through short-lived Trusted Publishing credentials, and created the GitHub release. A release workflow pass is supply-chain evidence; it is not an independent security, provider, hardware, tax, accessibility, or store certification.

Published packages

All sixteen public packages use the same 12.0.0 version:

• macros: rullst-macros, rullst-orm-macros;
• foundations: rullst-orm, rullst-core, rullst-messaging;
• domain services: rullst-connect, rullst-iot, rullst-security, rullst-ai, rullst-capital, rullst-mail, rullst-auth;
• interfaces: rullst-nexus, rullst-studio;
• entry points: rullst, cargo-rullst.

The machine-readable publication order is .github/release-order.json.

What v12 stabilizes

Version 12 stabilizes the bounded public contracts described by the Single Source of Truth. Major delivered areas include the Axum/Tokio runtime and CLI scaffolding, relational ORM foundations, typed Turso support, bounded optional persistence adapters, authentication and security controls, provider-oriented AI, payments and mail, broker-neutral local messaging, Studio and Nexus, and bounded Omni packaging foundations.

“Stable” means the documented v12 APIs and stated boundaries are suitable for normal SemVer maintenance. It does not mean that every roadmap idea is complete or that every third-party service, deployment, mobile device, fiscal authority, or hardware platform has been homologated.

Use these active sources instead of old development percentages:

• Specification — normative architecture and capability boundaries;
• Capability status — compact implemented/partial/ roadmap view;
• Capability ledger — detailed evidence and limitations;
• Release audit — repository-owned verification record;
• Changelog — exact user-facing changes;
• Workflow guide — current automated, scheduled, and manual checks.

Verification summary

The stable candidate passed the required exact-SHA hosted gates and the tag-only publication pipeline. The maintained assurance system covers multi-platform tests, strict linting and formatting, package consumers, documentation, coverage floors, dependency and source policy, code scanning, generated applications, DAST, property tests, sanitizers, Miri, Kani, fuzzing, Omni compile matrices, and release artifact reproduction.

Every result is scoped to its workflow, target inventory, toolchain, commit, fixtures, and environment. For example, compilation of an unsigned mobile shell does not prove physical-device behavior or app-store acceptance, and protocol fixtures do not prove acceptance by a live provider. The release audit records those evidence boundaries.

Upgrading to v12

Existing applications should follow the v12 migration hub and the guide for their starting line:

• v5 to v12;
• v6 to v12;
• v11-era dependencies to v12.

cargo rullst upgrade --dry-run and cargo rullst upgrade from the v12 CLI provide an assisted, inspectable migration workflow; the v13 CLI accepts only v12 and v13 projects. They do not silently rewrite arbitrary application semantics; review the generated plan, back up application data, commit a clean baseline, run migrations in a safe environment, and execute the application’s own tests.

Maintenance after release

The 12.x line accepts compatible correctness, security, documentation, and dependency-maintenance releases. Breaking APIs and substantial new capabilities belong to v13. Security reports should follow SECURITY.md.

12.1.0 historical delivery checkpoints

The following pre-publication checkpoints preserve their original source and test boundaries. References below to a candidate, working source or pending release gates describe those earlier stages. The published maintenance record supersedes their release-readiness status. The maintenance candidate brought together:

• Studio asset/cache routing and Nexus/Portfolio mobile fixes, with migration notes for application-owned workaround routes and generated views;
• reviewed dependency and pinned Action updates, with synchronized fuzz locks;
• SaaS maintenance, including provider configuration, Stripe signature rotation, machine-client WAF defaults and honest operation boundaries across the v12 gateway inventory;
• bounded update notices, explicit advisory cargo rullst update check, the complete managed-package inventory and staged backup restoration;
• the API reference index, clearer HTMX/CSRF guidance and existing verification-efficiency improvements.

The explicit checker has bounded private Unix caching and offline reuse. The Windows owner/DACL implementation cross-compiles with strict Clippy. Its three native cache contracts and the complete Windows CLI standard shard passed at 990ddf1cf790cd422c1770a87b3fa19d13ab9ecb in run 35259362060. That evidence covers private cache roundtrips/expiry/replacement and rejection of unsafe ACLs, locks, links and paths; the final candidate still requires all release gates on its exact source commit. Its source/age report grants no installation authority. Tauri materializes the Android Gradle configuration before the standalone Gradle check, and its tutorial is registered in the documentation inventory gate.

The 2026-09-16 Linux check passed 318 CLI unit/process tests (including upgrade recovery and Omni tool boundaries), both documentation-inventory tests, CLI all-target/all-feature strict Clippy, formatting, Action pin validation and the mdBook build. These targeted local results are not a full workspace, Windows/macOS or native Android sign-off; the candidate’s hosted checks remain required. Native Android evidence must include the actual signed APK and its certificate, not just process fixtures or a successful Rust compile.

The native Android check passed at 95225f5e: a disposable key signed the generated release APK, and apksigner verification plus a DER certificate digest comparison passed. The certificate parser accepts both signer-label formats emitted by the supported toolchain and rejects substituted certificates or extra signers. This covers the generated CI shell, not physical devices or store acceptance.

The full Rust CI matrix passed at 95225f5e, including all test shards on Linux, Windows and macOS, strict workspace Clippy/format, database/provider matrices and public feature boundaries. Subsequent checkout, billing, ORM and upgrade changes require a new exact-commit run; this checkpoint does not certify those later changes or replace the other publication gates.

The follow-up matrix at e1d8fe4d finished with 35 successful and seven failed jobs. The failures came from unconditional enum codecs in isolated ORM builds and an unexpanded billing persistence placeholder in the CLI template fixture. 98977d0b and c5ae541d correct those causes with local regression evidence. Later customer and inbox additions still need a full candidate run; this failed checkpoint is not release admission.

The sixteen public manifests and their internal minimum requirements now use the unpublished 12.1.0 candidate. The workspace and ten fuzz lockfiles are synchronized without changing external dependency versions. The metadata preflight validates all sixteen packages and their topological order. This version preparation creates neither a release tag nor a registry publication.

Additional local gateway review passes 157 Capital tests with Actix and strict all-target Clippy. Lemon Squeezy now validates subscription lifecycle/state, store/mode/identities and expiry; InfinitePay’s unreviewed live callback fails explicitly. The initial generated-billing containment is superseded by the customer-bound Stripe integration: durable intents, session recovery, atomic event completion and revision-fenced reconciliation. Polar has a typed current product checkout and external-customer webhook binding. The expanded SQLite/Turso materialized contracts cover lost responses, replay, rollback and ownership. All ten scaffold contracts and CLI all-feature/all-target Clippy pass. Existing SaaS controllers require an application-owned migration.

Native artifact preparation at 6db7a2a6 passed actual release builds and version/inventory smoke checks on Windows x64 and both macOS architectures in run 35276572044. Linux built but its staging script failed because the runner’s default Python lacked tomllib; b97b02ef selects Python explicitly. All four native artifact builds and version/inventory smoke checks then passed at 020d9a72 in run 35278808660, alongside Ubuntu/Windows standard CLI tests and workspace strict Clippy/format. The full candidate run at 64979b0e exposed macOS cache-writer contention; explicit lock release and a duplicate-handle regression address it. The next macOS attempt found a nonportable FIFO test fixture, corrected with POSIX mkfifo. Native macOS standard CLI tests and workspace strict Clippy/format passed at 011d9437 in run 35279884257. These are bounded checkpoints, not an exact final candidate acceptance.

Working-source update verify authenticates a private local manifest through a certificate-bound GitHub CLI policy, then hashes both native binaries without executing or installing them. Local policy, tampering, size, path, timeout and CLI composition tests pass, together with strict all-target CLI Clippy. The same certificate policy accepted the already-published v12.0.0 release-context artifact and rejected changed bytes and a mismatched source tag. That checks the existing verifier protocol, not unpublished 12.1.0 assets or installation.

Working-source update project prepare now produces private before/candidate source copies and a bounded migration report without editing the original or executing builds/tests. Local process fixtures pass for dirty/untracked/deleted files, ignored/absent lockfiles, virtual workspaces, migration findings, downgrade rejection and unsafe inputs. Standard CLI tests and workspace strict Clippy/format passed at 88ddabad on Windows and macOS.

The earlier full matrix at 64979b0e finished with 42 successful jobs, including package-archive consumers and the isolated installed CLI, and only the subsequently corrected macOS cache contention failure. The full candidate matrix at 88ddabad subsequently passed, including all native builds, package-archive consumers and the isolated installed CLI, in run 35282705151. It does not cover subsequent updater changes.

Working-source update project verify adds exact command preview, source/plan revalidation, an exclusive lock and explicit trusted-code consent. Real locked checks and tests run in another private copy; 14 local preparation/verification process tests pass, alongside 300 CLI library tests, nine legacy upgrade fixtures and strict all-target CLI Clippy. Tests include stale inputs, missing consent, contention, timeout, application-test failure and unexpected source writes. Reports grant no application authority. Native Linux/macOS verification passed at 1c4ddd12; Windows passed after path normalization at 1c4b3e60.

The native update diagnostic at 1c4ddd12 passed on Ubuntu but exposed a Windows lexical mismatch between Cargo paths and private-storage verbatim prefixes before project execution. Filesystem-resolved membership comparisons address that defect; Windows confirmation passed in run 35284872349. The working source also deduplicates those manifest identities. Explicit review now revalidates successful command logs and file inventories and returns the full dependency diff plus its review digest. All 16 local preparation, verification and review process tests pass with strict CLI Clippy and mdBook; these were focused review checks before application/recovery was added.

At 9fb49b63, explicit digest-approved application/recovery stages all reviewed manifest/root-lockfile replacements before original writes, binds access policy, persists an intent and refuses divergent edits. Local acceptance passed 306 CLI library tests, 22 project-flow process tests and nine legacy upgrade tests, strict all-target CLI Clippy and mdBook. Linux/macOS updater checks passed in run 35287712905; Windows found an SDDL buffer-capacity versus string-length defect before original writes; e547746e stops at the bounded terminator. Subsequent Windows tests exposed Git’s handling of verbatim absolute paths in review diffs; 8b58cd12 uses relative paths from the canonical private cache root. At that checkpoint, the complete native updater diagnostic passed on Linux, Windows and macOS together with workspace strict Clippy/format in run 35289409340. Additional local tests kill a child after the first production replacement and recover the persisted before/after states; a Linux file-size limit terminates real CLI staging with originals unchanged. These tests do not prove power-loss behavior or replace the remaining native/final-candidate acceptance. The working source additionally stages bounded authenticated CLI downloads; it rechecks fresh registry eligibility, authenticates the manifest before fetching binaries and verifies exact bytes without executing or installing them. 86b6178f adds a total body deadline, including a real slow-response regression. At f2aa8055, installation review authenticates a fresh eligible candidate and previews a new/empty private root without creating it or executing binaries. Local acceptance passed 319 CLI library, 7 discovery, 23 project-flow, 3 artifact/installation and 9 legacy-upgrade tests, strict all-target CLI Clippy and mdBook. These later changes still require native candidate acceptance.

The latest examples report is pinned to 1af10ed4 and adds application retry quota/session resumption and Chromium CSP handoff findings. The SaaS generator now emits an exact Stripe form-action origin. A local Chromium regression reproduces the strict-default block, accepts the intended POST/303 handoff and blocks lookalike hosts, another provider, HTTP, another port and an unreviewed second redirect. Destinations are intercepted; this does not exercise payment, deployed SaaS or live provider sessions. The 319 CLI library tests, strict CLI Clippy, format, workflow lint and documentation build pass locally.

The full Rust matrix passed at 21ce347b, including all three native hosts, generated applications, strict workspace Clippy/format, MSRV, four native CLI builds, sixteen package checks and archive-only consumers. The managed installation native check passed at ef0a8577 on Linux, Windows and macOS with workspace strict Clippy/format. It covers initial installation, updates, exact predecessor recovery, private receipts/locks, late replacement failures, an executing older binary and actual process termination. It does not claim power-loss safety or published 12.1.0 artifact acceptance.

Working source also composes the checked commands through update guided, with separate default-no approvals and elapsed time per stage. Additional local regressions resume every injected recovery failure, reject oversized local files before hashing and preserve installed entries under an OS file-size limit. A real terminal exercises refused preparation/execution, failed project tests and approved manifest application followed by recovery. The new guided flow and additional faults must pass the final candidate’s native matrix.

The Stripe/Polar candidate passed the full 48-job Rust matrix at 4b5aca21, including native CLI and package-consumer checks. Its source at 8c3c8391 also passed SemVer, coverage and CodeQL. Links and scope are retained in the SaaS evidence record. The subsequent Paddle customer/transaction and subscription work passed fresh SemVer, coverage and CodeQL checks; the full candidate Rust matrix remains in progress. See 12.1 migration for final API adoption.

Stripe adapter acceptance now covers test-mode hosted Checkout, paid-invoice amount/currency/customer checks, provider-relayed signed events, current-state reads and cancellation at 0f15d70a; see the redacted SaaS evidence record above. Fresh CLI-generated SQLite billing at 370a4170 also passed controller and signed-webhook persistence, process restart, duplicate delivery and altered signature rejection against real Stripe test events. Its isolated database contained the matching active and canceled subscriptions and event receipts.

Release preparation now includes an exact dated 12.1.0 changelog section, successful release-note rendering, matching versions and topological internal dependencies for all sixteen packages, and a crates.io ownership check. None of the sixteen 12.1.0 versions was indexed during this check. Workflow validation now extracts notes for the current package version instead of only checking 12.0.0; these checks do not create a tag or authorize registry publication.

The next dependency candidate consolidates Dependabot PRs #207–#212 for 12.1, including their five Action updates and the four grouped Rust updates. The tinyvec resolver pin also requires refreshing four ORM-dependent fuzz locks. Earlier CI results remain evidence for their original commits; the combined candidate requires fresh CI and exact-main release admission before publication.

Release blockers still open: latest-candidate CI, remaining provider-account acceptance and all exact-main release admission checks. Generated Stripe billing requires the account, recurring price, webhook and migration setup documented in generated BILLING.md. The existing SaaS staging’s 12.0 one-time payment handoff remains separate from the candidate’s isolated acceptance; deployed ingress, authentication and database migration have not been exercised here. The acceptance plan defines the bounded updater delivery. Future v13 migration rules remain v13 work.

Do not regenerate an existing application over local changes. Updating the CLI or framework dependencies neither rewrites application-owned blueprint files nor redeploys the Azure demonstrations. New capability development should focus on v13 after this compatible minor is validated and released; v12 then receives necessary maintenance by exception.

The maintenance candidate also adds default Rullst-branded Omni icons applied after native initialization, application-owned Android release signing and upgrade recovery fixes for macOS root aliases and Windows strict linting. See Android signing. These changes are unreleased; native CI and cross-platform recovery acceptance remain required.

Preserved development history

The former v12 program contained 2,410 lines of planning notes, intermediate percentages, and a detailed audit of 190 historical roadmap claims. It remains available in the immutable v12.0.0 source snapshot and Git history. The compact classification dataset used by documentation CI is .github/historical-roadmap-ledger-v12.tsv.

Those historical labels describe what an earlier roadmap claimed and how the v12 audit classified it. They are not a substitute for the current specification, capability ledger, or executable evidence.