[kikashy]

Prepare the independent v0.13.2 security release from published v0.13.1. This applies the reviewed #549 go-jose v4.1.5 → v4.1.6 patch and adds the RSA key compatibility release note for GHSA-mgcc-cww5-fp2q.

The target release/v0.13.2 is exactly v0.13.1 (59492cbbd3b9c5c0fe431b38e1687ed1e288f6e8). Using this separate branch avoids including the unrelated work already on main. The complete release diff is three files: go.mod, go.sum and docs/releases/v0.13.2.md. Module files match #549's reviewed bytes; x/sys stays v0.49.0. Component and web dependency locks and release workflows remain identical to v0.13.1. The v0.14.0 batch is unaffected.

Checks

Candidate: 1c699f3e7ac647b04a03f884feb3e1bf1076015e.

• PASS: exact locked npm installation, web production build and Go build.
• PASS: strict localization, all 11 catalogues at 6793/6793 with zero placeholder errors.
• PASS: Go module integrity and exact dependency resolution; component lock policy.
• PASS: focused OIDC checks and the preserved independent Bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 #549 authentication/parser probes run on this candidate. One local OIDC activation test requiring a Runtime binary was skipped, not counted as a pass. Actual Desk login accepts 2048-bit and 4096-bit keys; oversized, mixed, malformed and private-header inputs fail without issuing a session.
• PASS: three-file release scope, whitespace and public-text path checks.

This released baseline predates dev.json and scripts/dev/check.sh; those unrelated tools were not imported. Local checks above cover the change; the PR's required CI owns the complete regression and Linux/amd64, macOS/arm64 and macOS/amd64 archive checks. Initial offline Go graph resolution lacked metadata; that failure was preserved, and resolution succeeded using the exact locked modules. No live identity-provider sign-in was performed.

Remaining release gates

Current-head CI is complete: 14 checks passed and one expected development-build skip. All three native snapshot archives and assembly passed. The independent complete release-diff review passed with no findings; verbatim review and dispositions. Explicit merge approval, separate tag/publication approval, and final published artifact verification remain pending. The original #549 review is prior evidence, not approval for this release candidate. RSA keys above 4096 bits remain intentionally rejected; the limit is not raised or disabled.

Relates to #549 and the v0.13.2 milestone. No Agent release dependency.

[kikashy]

Independent release review — Desk v0.13.2 / PR #671

No findings. mergeable — head 1c699f3e7ac647b04a03f884feb3e1bf1076015e. Reviewed the complete release diff from published v0.13.1 (59492cbbd3b9c5c0fe431b38e1687ed1e288f6e8), containing only go.mod, go.sum, and docs/releases/v0.13.2.md. This is an independent same-vendor review under the standing exception, using the actual GPT-6.1 Sol/medium worker selection; it is not a different-vendor review.

The dependency files exactly match the prior PR #549 security review. The only effective dependency version change is go-jose 4.1.5 → 4.1.6; x/sys remains 0.49.0. The reviewed JWK source hash matches the prior evidence. The authentication protocol and session files also match. The older baseline's HTTP authentication file differs from that review only by the absence of a separate desks-list route registration; its verification, normalized failure and session-creation path is unchanged. No Desk override of the RSA limit was found.

The supplied candidate-specific authentication evidence reruns the original independent parser and actual Desk/OIDC session probes on this baseline. It covers normal 2048-bit and boundary 4096-bit acceptance, oversized and supported mixed JWKS refusal, missing/malformed modulus, malformed private prime and embedded private material. Refusals return normalized verification-failed with no issued session and no protected-route admission. Its probe and log hashes match the evidence index. One existing OIDC activation test was skipped locally because no Runtime binary was supplied; this is not claimed as a local pass. Exact-head CI supplies the full validation.

One independent guarded Go build passed in the detached review room. A narrow parser-only execution passed the 2048/4096/4097-bit witnesses, malformed private-prime prevalidation and embedded-private-header refusal. Prior semantic mutation evidence is reused because both the actual JWK guard and probe bytes match: omitting the public modulus guard compiled and caused the 4097-bit witness to fail with oversized JWK escaped modulus boundary: <nil>. The earlier rejected module-cache overlay is not counted as mutation evidence. No suites or mutation campaign were repeated.

The release notes correctly describe the default 4096-bit RSA JWK cap, failure of a supported key set containing an oversized supported key, provider key-rotation implications and the absence of a Desk override. Web package/lock files, component pins and release/CI workflows are unchanged from v0.13.1. The supplied Web build/i18n evidence matches its recorded hash. Exact-head CI records 14 successful checks and one expected development-build skip, including all three native archive jobs and assembly. The archive logs identify v0.0.0 snapshots at a synthetic merge whose tree equals the candidate tree 0034c3623b5b6e9bb8741da900392fd1c29e1508; these are not final v0.13.2 release assets.

No HIGH, MEDIUM or LOW findings remain. Tracked files and HEAD remained unchanged. No live identity provider, installed Desk, private user data, upstream state or publication was accessed. This bounded review reuses the prior dependency review and supplied exact-head CI; it does not claim a new performance benchmark, live-provider compatibility test or final artifact attestation verification.

Remaining publication gates: the coordinator must publish the review record and dispositions, obtain the required explicit authorization before tag push, and verify the final v0.13.2 artifacts and attestations before announcement. The unchanged tag workflow automatically publishes after compatibility and archive jobs; mergeability does not authorize that publication.

Coordinator dispositions

Finding	Disposition
None	No changes required; exact candidate remains 1c699f3.

All 14 checks passed with one expected development-build skip. The local OIDC activation test requiring a Runtime binary was skipped; it is not a local pass. The PR CI and all three native snapshot archive jobs passed. Explicit maintainer approval is still required for merging #671 and separately for tag/publication; final release artifacts must be verified after that workflow.

[github-actions]

🎉 Thank you for your contribution to Judgment Pack!

If you’d like another task, choose a path that interests you:

• Go runtime
• Judgment desk
• Gateway and provenance
• Python and evaluator experiments
• Specification and documentation

[kikashy]

The maintainer approved tagging and publishing v0.13.2 from merged commit ef378c406f8b96e2c0c8854bc5e4dff40ac841e2. The signed annotated tag is now pushed: tag object 60b298973779b0b33c311705f6abfc5e078425fe, targeting that exact commit and the reviewed tree 0034c3623b5b6e9bb8741da900392fd1c29e1508. Local signature verification passed against the configured release signer. GitHub reports unknown_key for the SSH signature; no GitHub-verified signature claim is made.

Final release workflow is running. It will run compatibility checks, build and smoke-test the three native archives, then publish automatically. Published asset identities, checksums, source manifests and bundled component provenance still require final verification. The milestone remains open; this is a publication-start record, not a completed-release claim.

[kikashy]

Desk v0.13.2 published-asset verification

Verified at 2026-10-25T02:26:32.955699Z. The immutable release https://github.com/Judgment-Pack/judgment-pack-desk/releases/tag/v0.13.2 (release ID 423031037) is published with the expected eight assets.

Tag object 60b298973779b0b33c311705f6abfc5e078425fe peels to ef378c406f8b96e2c0c8854bc5e4dff40ac841e2, matching the expected commit. The commit API reports tree 0034c3623b5b6e9bb8741da900392fd1c29e1508, matching the reviewed tree. Release workflow run 40140071032 completed with success on that commit.

All eight downloaded asset sizes and SHA-256 digests match GitHub’s release API metadata. checksums.txt contains exactly seven entries, covering every other asset, and each digest matches. The legacy Linux manifest equals the Linux platform manifest. All three platform manifests name v0.13.2, the expected Desk commit, and the identical runtime, runner, and gateway lock. Each archive passed the existing safe unpack and manifest/file verification helper with its explicit platform; each contains 465 verified files. The existing component provenance helper passed checksum, GitHub attestation, and bundled-byte checks on all three platforms. Upstream component archive hashes, checksum file hashes, pinned source revisions, and copied-file hashes are recorded in final-verification.json.

The final release workflow’s three native archive jobs, assembly job, and publish job all succeeded. Each native job checked out v0.13.2 at the expected commit and completed the release archive verification script. That script verifies the archive and component provenance, checks the bundled executable versions, and runs the local gateway check before reporting success.

GitHub’s tag API reports signature verification as unknown_key. Local trusted SSH signature verification is recorded in STATE.md; this record does not claim GitHub verified the signature. Foreign-platform archives were only unpacked and verified locally; native execution evidence comes from the final workflow logs.

Asset IDs, byte sizes, and SHA-256 digests:

Asset	GitHub asset ID	Bytes	SHA-256
checksums.txt	673529599	725	0032b4f0ea9b4eaae8eb96e54e3c4aaec3df7bee2b9527a217beca41a7e2211c
judgment-pack-desk_0.13.2_darwin_amd64.tar.gz	673529601	70738432	46b333f80548fdf5f2a898a2af6c9517c288e5ba639387ac01246b8db29095e5
judgment-pack-desk_0.13.2_darwin_arm64.tar.gz	673529603	67198414	a7e4ba19802aca467ed882954220949481230e75191e14e6e6c338e5fdfbb666
judgment-pack-desk_0.13.2_linux_amd64.tar.gz	673529602	70221031	10b6f3423c75a6e14c22823aa3a04130d7819becaf13fcc37a3b454dd574e86d
release-manifest.json	673529594	59169	11f90d497934149915a4c78d87076081d30be42703ae95e45939586d065022a8
release-manifest_darwin_amd64.json	673529620	59150	ed7cb67f0b7f1482c509a642466072f00418366cb6559651d98f8a211d9dd692
release-manifest_darwin_arm64.json	673529622	59156	ca0df194ac6a417c1456636f27e309f202eddca772b99ee5eb5b0e82286b64d7
release-manifest_linux_amd64.json	673529646	59169	11f90d497934149915a4c78d87076081d30be42703ae95e45939586d065022a8

Evidence files and SHA-256 digests are indexed in final-verification.json. Native job log IDs: Linux amd64 121011498718, macOS amd64 121011498853, macOS arm64 121011498693; assembly 121012601283; publish 121012682237.

Disposition: published artifact verification passed with no findings. The v0.13.2 milestone has no remaining open issues and is ready to close. The signature and native execution limitations above remain explicit.