[codex] Prepare registry-stack v0.8.4 beta-10

CONTRIBUTING.md

@@ -127,7 +127,7 @@ Release and lab source checks:
 
 ```bash
 python3 -m unittest release/scripts/test_registry_release.py
-release/scripts/registry-release validate release/manifests/registry-stack-beta-9.yaml
+release/scripts/registry-release validate release/manifests/registry-stack-beta-10.yaml
 release/scripts/registry-release audit release/manifests/import-map-2026-06-24.yaml
 REGISTRY_LAB_RELEASE_SOURCE_MODE=monorepo lab/scripts/check-release-source-model.sh
 python3 -m unittest lab/scripts/test_check_release_source_model.py

Cargo.toml

@@ -36,7 +36,7 @@ exclude = [
 resolver = "2"
 
 [workspace.package]
-version = "0.8.3"
+version = "0.8.4"
 edition = "2021"
 rust-version = "1.95"
 license = "Apache-2.0"
@@ -47,28 +47,28 @@ repository = "https://github.com/registrystack/registry-stack"
 unsafe_code = "forbid"
 
 [workspace.dependencies]
-registry-config-report = { path = "crates/registry-config-report", version = "0.8.3" }
-registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.8.3" }
-registry-notary-client = { path = "crates/registry-notary-client", version = "0.8.3" }
-registry-notary-core = { path = "crates/registry-notary-core", version = "0.8.3" }
-registry-notary-server = { path = "crates/registry-notary-server", version = "0.8.3", default-features = false }
-registry-notary-source-adapter-rhai = { path = "crates/registry-notary-source-adapter-rhai", version = "0.8.3" }
-registry-notary-source-adapter-sidecar = { path = "crates/registry-notary-source-adapter-sidecar", version = "0.8.3" }
-registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.8.3" }
-registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.8.3" }
-registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.8.3" }
-registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.8.3", features = ["redis"] }
-registry-platform-config = { path = "crates/registry-platform-config", version = "0.8.3" }
-registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.8.3" }
-registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.8.3" }
-registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.8.3" }
-registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.8.3" }
-registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.8.3" }
-registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.8.3" }
-registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.8.3" }
-registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.8.3", features = ["redis"] }
-registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.8.3" }
-registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.8.3" }
+registry-config-report = { path = "crates/registry-config-report", version = "0.8.4" }
+registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.8.4" }
+registry-notary-client = { path = "crates/registry-notary-client", version = "0.8.4" }
+registry-notary-core = { path = "crates/registry-notary-core", version = "0.8.4" }
+registry-notary-server = { path = "crates/registry-notary-server", version = "0.8.4", default-features = false }
+registry-notary-source-adapter-rhai = { path = "crates/registry-notary-source-adapter-rhai", version = "0.8.4" }
+registry-notary-source-adapter-sidecar = { path = "crates/registry-notary-source-adapter-sidecar", version = "0.8.4" }
+registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.8.4" }
+registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.8.4" }
+registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.8.4" }
+registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.8.4", features = ["redis"] }
+registry-platform-config = { path = "crates/registry-platform-config", version = "0.8.4" }
+registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.8.4" }
+registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.8.4" }
+registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.8.4" }
+registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.8.4" }
+registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.8.4" }
+registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.8.4" }
+registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.8.4" }
+registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.8.4", features = ["redis"] }
+registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.8.4" }
+registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.8.4" }
 
 crosswalk-core = { git = "https://github.com/PublicSchema/crosswalk", rev = "1d44ec735fdc8a7c719264b339574371e8330337", version = "0.2.0" }
 crosswalk-functions = { git = "https://github.com/PublicSchema/crosswalk", rev = "1d44ec735fdc8a7c719264b339574371e8330337", version = "0.2.0" }

SECURITY.md

@@ -44,14 +44,14 @@ include cosign signatures without SLSA provenance.
 
 For each signed release asset, download three files from the GitHub Release:
 
-- The asset, for example `registryctl-v0.8.3-linux-amd64`
-- The matching signature, for example `registryctl-v0.8.3-linux-amd64.sig`
-- The matching certificate, for example `registryctl-v0.8.3-linux-amd64.pem`
+- The asset, for example `registryctl-v0.8.4-linux-amd64`
+- The matching signature, for example `registryctl-v0.8.4-linux-amd64.sig`
+- The matching certificate, for example `registryctl-v0.8.4-linux-amd64.pem`
 
 Then verify the asset:
 
 ```bash
-asset=registryctl-v0.8.3-linux-amd64
+asset=registryctl-v0.8.4-linux-amd64
 
 cosign verify-blob \
   --certificate "${asset}.pem" \
@@ -69,7 +69,7 @@ For releases with SLSA provenance, download the provenance asset and verify the
 artifact against the release tag:
 
 ```bash
-tag=v0.8.3
+tag=v0.8.4
 asset=registryctl-${tag}-linux-amd64
 provenance=registry-stack-${tag}-release-provenance.intoto.jsonl
 

crates/registry-relay/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+## 0.8.4 - 2026-07-04
+
 ### Added
 
 - `registry-relay --version` and `registry-relay -V` output so the Relay binary

crates/registry-relay/demo/decentralized/config/evidence/civil-registry-notary.yaml

@@ -14,7 +14,7 @@ auth:
       scopes:
         - civil_registry:evidence_verification
   bearer_tokens:
-    - id: civil_evidence_client
+    - id: civil_evidence_client_bearer
       fingerprint:
         provider: env
         name: CIVIL_EVIDENCE_CLIENT_BEARER_HASH

crates/registry-relay/demo/decentralized/config/evidence/shared-eligibility-registry-notary.yaml

@@ -16,7 +16,7 @@ auth:
         - social_protection_registry:evidence_verification
         - health_registry:evidence_verification
   bearer_tokens:
-    - id: shared_evidence_client
+    - id: shared_evidence_client_bearer
       fingerprint:
         provider: env
         name: SHARED_EVIDENCE_CLIENT_BEARER_HASH

crates/registry-relay/demo/decentralized/config/evidence/social-protection-registry-notary.yaml

@@ -14,7 +14,7 @@ auth:
       scopes:
         - social_protection_registry:evidence_verification
   bearer_tokens:
-    - id: social_protection_evidence_client
+    - id: social_protection_evidence_client_bearer
       fingerprint:
         provider: env
         name: SOCIAL_EVIDENCE_CLIENT_BEARER_HASH

crates/registry-relay/openapi/registry-relay.openapi.json

@@ -2257,7 +2257,7 @@
     },
     "summary": "Read-only data gateway exposing entity records, catalog metadata, and SHACL/DCAT-AP shapes for governed datasets.",
     "title": "Registry Relay API",
-    "version": "0.8.3"
+    "version": "0.8.4"
   },
   "openapi": "3.1.0",
   "paths": {

crates/registryctl/CHANGELOG.md

@@ -6,6 +6,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased]
 
+## [0.8.4] - 2026-07-04
+
 ### Added
 
 - `registryctl init notary <dir> --source-kind fhir-sidecar` - scaffold a standalone Notary