#37 release(agent-relay): 0.3.1 reviewable customer release (GHCR digests, evidence, handoff)

Release lane, selfhost-night-20261103. Scope per Khaliq: a reviewable release for a company evaluating self-hosted Agent Relay on GCP, not a gate PASS. Nothing is fabricated: every open gate item is recorded as "not yet done; planned".

What changes

• charts/agent-relay 0.3.1 (main is on an unreleased 0.3.0 after the sessions-pipeline rename).
• values-gcp.yaml pins GHCR release images built from reviewed main commits:
  • selfhost-api sha256:535e6718… (relaycontrol 8e989a1, run 41684552871; amd64+arm64, SBOM, max provenance; package still private)
  • relay-dashboard sha256:bbeca872… (b213406, run 41697933750; amd64+arm64 verified anonymously, SBOM, max provenance, GitHub attestation)
  • relayauth c23c92d2… and relaycast-self-host a05732ad… unchanged
  • RelayHistory and Sessions services stay REQUIRED OVERRIDE (zero digest) until published: relayhistory-cloud #280 is held (a merge deploys prod), and the Sessions publish is Khaliq-only.
• values-gcp.yaml sets sessions-pipeline.alleyoop.auth.issuer to RelayAuth's issuer and asks for historyOrigin. The chart default https://96bulls.local rejected every RelayAuth-signed courier assertion; the GKE drill found this.
• self-hosted/customer-images.yaml: dashboard approved; the CloudNativePG wait-for-role image approved with upstream revision 4c2710a, run 40291448784, SBOM + SLSA provenance and a verified keyless cosign signature; selfhost-api at 8e989a1, blocked only on visibility; IMG-BLOCK-004 and IMG-REVIEW-001 closed.
• self-hosted/customer-release-evidence.json:
  • Apache-2.0 SPDX decisions for every first-party image (sessions-pipeline #172 merged; relayhistory-cloud #279, held, adds the LICENSE)
  • RelayHistory migration counts (47/47)
  • the GKE upgrade and isolated-restore drill records with artifact digests
  • honest not-run entries for operational readiness, version compatibility and Desktop
• Handoff:
  • docs/handoff/STATUS.md: what's proven, what's preview, what's planned
  • 0.3.1 release notes
  • sanitized GKE evidence summaries in docs/handoff/evidence/: e2e, upgrade/restore drills, durable-actors preview
  • the archive now ships the e2e harness, docs/operations, docs/support and the durable-actors doc
• e2e harness: --secret is now required (no proof default), and test users get addresses under the install's own base domain. Live proof runs must pass --secret agent-relay-gcp-proof.
• requirements.yaml: an agent-relay-0.3.1 row.

Gate

python3 scripts/release/validate-customer-release.py still FAILS by design. The remaining errors:

• RelayHistory and Sessions digests are unpublished
• selfhost-api visibility
• relaycast has no SBOM yet
• no branch/environment controls (dropped by Khaliq)
• the drills are partial against this manifest
• no supported-100 soak, compat matrix or Desktop release

The handoff archive is built in preview mode and labelled so. --consistency passes.

Not changed

release-agent-relay.yml has no environment requirement, and none is added.

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}