release: Hermes workload gateway, Rust 1.99 and approval broker

[ak5]

Release

Included changes

• Release source SHA: f1d11bbd59a7c80be0c731a565f8077993a5f841.
• Exclusive workload gateway for ordinary Hermes/curl/gh/SDK proxy clients: mandatory TLS interception, exact-host per-request grants, fixed network-bound identity, public-only pinned DNS and verified upstream TLS, secretless forwarding and typed header/Basic mediation, bounded streaming, metadata receipts and fixed errors/logs.
• Exact synthetic Hermes provider policy, CA/client requirements, feature verification and Infra handoff, including the pinned-source Codex quota/Nous grant correction (fix: match Hermes provider grants to pinned source #70). Signed proxy and independent Hermes tool admission remain compatible. No live Infra changes or convergence-guard removal.
• Rust 1.99.0 throughout local/CI/package/Docker pins; patched Rustls 0.23.45 and available Alpine CA/curl fixture pins.
• Previously integrated dev changes since the last main release: durable approval broker core (feat: establish durable approval broker core #53), bounded structured stream scanning (Bound structured stream scanning #52), h2 advisory fix (fix(deps): update h2 for RUSTSEC-2026-0258 #54), and reviewed dependency/build updates (Bump library/rust from 14bc9c5 to 0e2bcae #44, Bump distroless/cc-debian12 from fccdbb0 to adcd20c #45, chore(deps): bump futures-util from 0.3.33 to 0.3.34 #47–chore(deps): bump async-trait from 0.1.91 to 0.1.92 #51).
• Known limitations: exclusive network isolation and client trust are Infra obligations; WebSockets, HTTP/3 and compression fail closed; DNS pins last for the process lifetime; streaming cannot retract partial side effects or recognize arbitrary secret transformations. The implementation review is not an independent security audit.

Release checks

• The base branch is main and the head branch is dev.
• The exact source tree matches the all-green reviewed PR fix: match Hermes provider grants to pinned source #70 on top of feat: exclusive workload TLS gateway for Hermes and Rust 1.99 #68; release PR runs fresh checks on this dev head.
• Documentation and security-impact notes are current; source review is recorded in feat: exclusive workload TLS gateway for Hermes and Rust 1.99 #68 and docs/security-review-workload-gateway.md.
• The release will use a merge commit, not squash or rebase.
• After merging, git merge-base --is-ancestor f1d11bbd59a7c80be0c731a565f8077993a5f841 origin/main succeeds. Released merge commit: d17a86506502aa517642cf2dfa265703798ba461; its tree matches the reviewed dev source.

Risk and rollback

• Risk: TLS interception and network-bound identity require exclusive isolation and installed client trust. The inherited approval broker/storage changes and scan bounds are included because release preserves the full dev ancestry.
• Rollback: Infra must preserve the installed Compose layout, image pins and configuration revision and restore them while preserving egress isolation. Full platform convergence remains guarded until Infra validates real requests, bypass denial, config CD, tool admission, encrypted backups and obtains operator cutover authorization.
• Publication: successful trusted main CI publishes immutable sha-<main-commit> GHCR images with provenance/SBOM. The actual registry digest will be recorded after publication.

[ak5]

Release review of dev source 3d3a4d83619c228a2799efe0928a7d7df740b076: verified dev -> main path and exact tree equivalence with all-green implementation PR #68. Reviewed the complete main-to-dev file scope and listed inherited approval-broker, structured-scan and dependency changes in the release body rather than presenting this as gateway-only.

The new identity/credential/TLS boundary review is recorded in #68 and docs/security-review-workload-gateway.md. The final local mise run check, schema CLI validation, documentation parity and pinned Hermes compatibility pass. No unresolved source-review findings remain; this is an implementing-agent review, not an independent audit. Fresh release CI must also pass before merging.

Merge method must be a merge commit, with the source SHA verified as an ancestor afterward. Publication must wait for trusted main CI. No live deployment or operator cutover is part of this release; Infra retains the convergence guard and rollback pins until its completion checks pass.

[ak5]

Refreshed release review: source f1d11bb is tree-identical to all-green reviewed correction #70, built on implementation #68. Reviewed exact Codex quota grant and narrowed Nous OAuth paths against pinned Hermes source. Release body/source SHA updated. Fresh release checks on this head must pass before the merge commit; earlier checks/review do not substitute. No live Infra changes.

[ak5]

Release publication completed successfully after trusted main CI:

• Main merge commit: d17a86506502aa517642cf2dfa265703798ba461.
• Reviewed source: f1d11bbd59a7c80be0c731a565f8077993a5f841; verified ancestor of main, with matching trees.
• Gateway immutable reference: ghcr.io/ak5/charon:sha-d17a86506502aa517642cf2dfa265703798ba461@sha256:f6568769ac4f713478941a233b5cb715bbeb57d6688b75a30a31f53a9a2d801c.
• Separate Hermes integration reference: ghcr.io/ak5/charon-hermes:sha-d17a86506502aa517642cf2dfa265703798ba461@sha256:662d8962fb842cf87d4a061f0f517aaa10d696fdd8c3ae3c8c81658cdbbe8371.
• Registry inspection confirms both OCI index digests, linux/amd64 manifests and attestation manifests. Digests are read from GHCR, not inferred from Git SHAs.
• All final local gates, Linux PR/release/main CI and publication pass, including unmodified curl/gh mediation and pinned Hermes compatibility.
• The actual digest-pinned gateway container validates the complete synthetic example (valid workload gateway v1) with --network none, read-only filesystem and dropped capabilities.

Schema/example: examples/hermes-gateway.toml. Contract and client CA/proxy/feature-test/rollback handoff: contracts/workload-gateway.md and docs/hermes-gateway.md. Required verification is the real TLS gateway fixture suite and deployment behavior proof; /readyz is not feature evidence.

No apps host deployment or convergence occurred. Infra retains its guard until isolation, real client trust and origin-side hydration, direct-egress/IPv6/QUIC/alternate-route denial, config CD, admission and encrypted backups are proven, then requests operator cutover authorization.