chore(release): 0.12.0

[eaitbrahim]

What this is

The version-bump PR for 0.12.0, following #482/#515/#518's precedent: one commit, every version and every == pin moves together, uv.lock moves with them. Per docs/RELEASING.md, merging this (not the workflow) is what sets the version — the release workflow then refuses to change it.

Minor, not a patch: 69 commits since v0.11.2 — 23 feat, 14 fix (non-merge subjects). New interfaces shipped (the web UI, declared parameter spaces, OrderSpec), so the minor is earned, not conservative.

What ships in 0.12.0

The headline items, enumerated from git log --oneline v0.11.2..HEAD:

• The web UI rewrite (docs(design): the web UI rewrite — zero-dependency, view-source, on-device #531–fix(web): worker update consent, keel.web strict, and the write boundary as a module #555): zero-dependency, view-source, on-device — static serving with checkable headers (feat(web): serve static assets, with the headers that make the UI's reach checkable #545), JSON reports sorted with Decimal (feat(web): the JSON API over the existing reports, with server-side sort #547), the four-module client shell (feat(web): the client shell — zero dependencies, no build step, served as authored #549), six views + SVG curve + stream that says when it stops (feat(web): the remaining six views, an SVG curve nobody has to see, and a stream that says when it stops (#537) #550), an installable PWA whose worker structurally cannot cache a balance (feat(web): installable, with a worker that structurally cannot cache a balance (#538) #551), the old renderer deleted (feat(web): delete the renderer — the server serves files and JSON, and nothing else (#540) #553), the curses TUI deleted with it (feat: delete the curses TUI and the console layer that only it could open (#541) #554), worker update consent and the write boundary as a module (fix(web): worker update consent, keel.web strict, and the write boundary as a module #555).
• The broker-port flip completed (Finish the broker-port migration: _build_broker still constructs CoinbaseClient directly #524, feat(broker-api): a product-catalogue read, the first of #524's two blockers #561–feat(executor): the increment read goes through the port, and stops fetching 900 products for one #563, feat(executor): every order is an OrderSpec, and the second Coinbase renderer is gone (#524) #569): the default venue resolves through the registry, every order is an OrderSpec, the second Coinbase renderer is gone, the product-catalogue read lands (feat(broker-api): a product-catalogue read, the first of #524's two blockers #561), the increment read goes through the port (feat(executor): the increment read goes through the port, and stops fetching 900 products for one #563), and the pre-port client's grandfather clause retires.
• Live stop management (Broker port has no bracket/OCO order kind — live trailing stops, BE-rolls and scale_out are blocked on it #502, feat(broker-api): a bracket is one order kind, because two legs race (#502 stage 1) #521, feat(db): record the stop a tranche was sized against (#520, #502 stage 2) #527): a per-cycle stop-management step (off by default), a bracket as one order kind because two legs race (feat(broker-api): a bracket is one order kind, because two legs race (#502 stage 1) #521), the stop a tranche was sized against is recorded because the current one ratchets away (feat(db): record the stop a tranche was sized against (#520, #502 stage 2) #527), stops manage under the owning row's policy per product, and a failed roll is loud and isolated (_roll_stop: a crash between cancel and replace leaves the position naked AND silent #519/fix(executor): write the crash ledger before cancelling, so a dead roll is loud (#519) #522 — the crash ledger is written before cancelling).
• Declared parameter spaces (Declare each rule's parameter space, so the trials budget is derived rather than remembered #528): each rule declares its parameter space; tuning reads the declaration, with explored-vs-declared honesty.
• Alpaca cash posture (Cash-account posture: encode and document no-margin / PDT-adjacent constraints #372): Alpaca refuses margin accounts — cash-only by posture; PDT safety is the cadence, not the posture.
• Installer fixes (installer: the release config.yaml is confirm-mode production, not "the paper profile" #556, installer: broken on Linux — the 3.14 floor refuses Pythons the wheels it installs support #557): the config shipped is confirm-mode production (not paper), the floor is the artifact's (not the dev tree's), the --force clobber warning, the DMG README floor tells the truth. Plus the installer/update line: curl|bash no-warning path (feat(installer): the curl|bash no-warning path, auditable line by line (#479) #511), Inno Setup installer with gated signing (D5 delta (#438): Inno Setup installer, gated signing + notarisation, protected signing environment #512, D5 — Package and sign macOS/Windows artifacts in the release workflow #438), per-release self-update (feat(update): D6 — packaged installs update per-release; refusals name the desktop path (#439) #510, D6 — Decide the update path for a packaged install #439).
• Pooled-review tooling (The 2026-09-30 n=100 pooled review is underpowered: n_eff is about 39, and it can only detect a 20-point edge #427): the 2026-09-30 pooled-review report driver, and the ledger-fees fix (fees are the exit leg — the measured-fee line cannot understate).
• Floor: Python 3.14 required (chore: raise the Python floor to 3.14, and record why it moved back up #546).

Docs/decisions also land (ADR 0002 SQLite #526, the commands/ survey #525, the fill-model hazard note #529, the Jesse learnings PRD #530) — release notes will group them per the label table in docs/RELEASING.md.

Files bumped

• pyproject.toml — version 0.11.2 → 0.12.0, plus the three sibling pins (keel-core, keel-broker-api, keel-broker-coinbase)
• packages/{keel-core,keel-broker-api,keel-broker-coinbase,keel-broker-alpaca,keel-broker-fake,keel-broker-robinhood,keel-broker-kraken}/pyproject.toml — each version, plus the 11 inter-package == pins
• uv.lock — regenerated with uv lock; diff is exactly 8 lines (one version per distribution), no unrelated churn; uv lock --check passes

Nothing else: keel/_build_info.py is stamped by the release workflow (not in a checkout, untouched), and a repo-wide grep for 0.11.2 finds only historical records (v0.11.0 incident history in test comments, the 0.11.2+88fb17bcab15 build-identity worked example) — no live pins or expectations were left behind.

Lock discipline

The trap from #422/#482, verified TDD-style: bumping only the root pyproject.toml first made tests/test_packaging.py fail exactly as designed —

FAILED tests/test_packaging.py::test_every_workspace_package_carries_the_same_version
FAILED tests/test_packaging.py::test_workspace_siblings_are_pinned_to_the_exact_version[keel-trader]
  keel-trader depends on 'keel-core==0.11.2'; it must be 'keel-core==0.12.0'

After completing the set (all 8 pyprojects, 14 pins, uv lock), the same suite is green. uv.lock rides in the same commit because the release workflow checks it is current before anything else (#424).

Gates

• uv run pytest tests/test_packaging.py -q — 22 passed
• uv run pytest -q — 4420 passed, 3 skipped
• uv run ruff check . — all checks passed
• uv run mypy — no issues in 350 source files

Do not merge unreviewed: the release workflow runs next, after merge, with this same version.