Prepare RegistryStack v0.8.3 release

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

Cargo.lock

@@ -36,7 +36,7 @@ exclude = [
 resolver = "2"
 
 [workspace.package]
-version = "0.8.2"
+version = "0.8.3"
 edition = "2021"
 rust-version = "1.95"
 license = "Apache-2.0"
@@ -47,28 +47,28 @@ repository = "https://github.com/registrystack/registry-stack"
 unsafe_code = "forbid"
 
 [workspace.dependencies]
-registry-config-report = { path = "crates/registry-config-report", version = "0.8.2" }
-registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.8.2" }
-registry-notary-client = { path = "crates/registry-notary-client", version = "0.8.2" }
-registry-notary-core = { path = "crates/registry-notary-core", version = "0.8.2" }
-registry-notary-server = { path = "crates/registry-notary-server", version = "0.8.2", default-features = false }
-registry-notary-source-adapter-rhai = { path = "crates/registry-notary-source-adapter-rhai", version = "0.8.2" }
-registry-notary-source-adapter-sidecar = { path = "crates/registry-notary-source-adapter-sidecar", version = "0.8.2" }
-registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.8.2" }
-registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.8.2" }
-registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.8.2" }
-registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.8.2", features = ["redis"] }
-registry-platform-config = { path = "crates/registry-platform-config", version = "0.8.2" }
-registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.8.2" }
-registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.8.2" }
-registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.8.2" }
-registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.8.2" }
-registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.8.2" }
-registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.8.2" }
-registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.8.2" }
-registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.8.2", features = ["redis"] }
-registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.8.2" }
-registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.8.2" }
+registry-config-report = { path = "crates/registry-config-report", version = "0.8.3" }
+registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.8.3" }
+registry-notary-client = { path = "crates/registry-notary-client", version = "0.8.3" }
+registry-notary-core = { path = "crates/registry-notary-core", version = "0.8.3" }
+registry-notary-server = { path = "crates/registry-notary-server", version = "0.8.3", default-features = false }
+registry-notary-source-adapter-rhai = { path = "crates/registry-notary-source-adapter-rhai", version = "0.8.3" }
+registry-notary-source-adapter-sidecar = { path = "crates/registry-notary-source-adapter-sidecar", version = "0.8.3" }
+registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.8.3" }
+registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.8.3" }
+registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.8.3" }
+registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.8.3", features = ["redis"] }
+registry-platform-config = { path = "crates/registry-platform-config", version = "0.8.3" }
+registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.8.3" }
+registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.8.3" }
+registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.8.3" }
+registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.8.3" }
+registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.8.3" }
+registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.8.3" }
+registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.8.3" }
+registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.8.3", features = ["redis"] }
+registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.8.3" }
+registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.8.3" }
 
 crosswalk-core = { git = "https://github.com/PublicSchema/crosswalk", rev = "1d44ec735fdc8a7c719264b339574371e8330337", version = "0.2.0" }
 crosswalk-functions = { git = "https://github.com/PublicSchema/crosswalk", rev = "1d44ec735fdc8a7c719264b339574371e8330337", version = "0.2.0" }

Cargo.toml

@@ -44,14 +44,14 @@ include cosign signatures without SLSA provenance.
 
 For each signed release asset, download three files from the GitHub Release:
 
-- The asset, for example `registryctl-v0.8.2-linux-amd64`
-- The matching signature, for example `registryctl-v0.8.2-linux-amd64.sig`
-- The matching certificate, for example `registryctl-v0.8.2-linux-amd64.pem`
+- The asset, for example `registryctl-v0.8.3-linux-amd64`
+- The matching signature, for example `registryctl-v0.8.3-linux-amd64.sig`
+- The matching certificate, for example `registryctl-v0.8.3-linux-amd64.pem`
 
 Then verify the asset:
 
 ```bash
-asset=registryctl-v0.8.2-linux-amd64
+asset=registryctl-v0.8.3-linux-amd64
 
 cosign verify-blob \
   --certificate "${asset}.pem" \

SECURITY.md

@@ -5,7 +5,7 @@
 Install a pinned release without cloning this repo:
 
 ```sh
-curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/v0.8.2/crates/registryctl/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/v0.8.3/crates/registryctl/install.sh | sh
 ```
 
 Then create and start your first secured spreadsheet API:
@@ -44,16 +44,16 @@ source-adapter contract and defaults the sidecar URL to
 `http://host.docker.internal:4360`. It does not start a FHIR server or the
 FHIR sidecar for you.
 
-The installer defaults to `v0.8.2`. To install a different pinned release, set
+The installer defaults to `v0.8.3`. To install a different pinned release, set
 `REGISTRYCTL_VERSION`:
 
 ```sh
-REGISTRYCTL_VERSION=vX.Y.Z curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/v0.8.2/crates/registryctl/install.sh | sh
+REGISTRYCTL_VERSION=vX.Y.Z curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/v0.8.3/crates/registryctl/install.sh | sh
 ```
 
-Prebuilt binaries are published for the `v0.8.2` stack release on Linux x86_64,
+Prebuilt binaries are published for the `v0.8.3` stack release on Linux x86_64,
 Linux arm64, and macOS arm64. On other platforms, install from source with
-`cargo install --git https://github.com/registrystack/registry-stack --tag v0.8.2 registryctl --locked`.
+`cargo install --git https://github.com/registrystack/registry-stack --tag v0.8.3 registryctl --locked`.
 
 ## Update checks
 

crates/registryctl/README.md

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 repo="registrystack/registry-stack"
-default_version="v0.8.2"
+default_version="v0.8.3"
 version="${REGISTRYCTL_VERSION:-$default_version}"
 install_dir="${REGISTRYCTL_INSTALL_DIR:-$HOME/.local/bin}"
 
@@ -11,7 +11,7 @@ usage() {
 Install registryctl.
 
 Environment:
-  REGISTRYCTL_VERSION      Pinned release tag to install. Defaults to v0.8.2.
+  REGISTRYCTL_VERSION      Pinned release tag to install. Defaults to v0.8.3.
   REGISTRYCTL_INSTALL_DIR  Install directory. Defaults to ~/.local/bin.
 EOF
 }

crates/registryctl/install.sh

@@ -5,14 +5,23 @@ status: current
 owner: registry-docs
 source_repos:
   - registry-docs
-last_reviewed: "2026-06-22"
+last_reviewed: "2026-06-26"
 doc_type: reference
 locale: en
 standards_referenced: []
 ---
 
 This page records notable changes to the documentation site and the product versions it documents. Per-product release notes live in each product repository; the entries below link to the relevant product pages on this site rather than duplicating release notes.
 
+## 2026-06-26
+
+Documentation updates prepared for the v0.8.3 security and release-trust patch:
+
+- Advanced the active monorepo docs and source citations to RegistryStack `v0.8.3`.
+- Added the `v0.8.3` archived docset pinned to the beta-9 manifest candidate source ref.
+- Updated registryctl install examples to the `v0.8.3` release tag.
+- Kept `v0.8.2` as the fix-forward archive without tag-bound SLSA provenance.
+
 ## 2026-06-25
 
 Documentation updates prepared for the v0.8.2 fix-forward release:

docs/site/src/content/docs/changelog.mdx

@@ -156,7 +156,7 @@ The registry-lab evidence packet notes that functional identifiers baked into cr
 log correlation, and spec URLs (`decentralized-demo-correlation-001`,
 `decentralized-demo-static-publication`) are intentionally stable and do not require
 change when the directory is renamed.
-Docstrings and comments are residual and could be updated to say "[Registry Lab](https://github.com/registrystack/registry-stack/tree/v0.8.2/lab) demo"
+Docstrings and comments are residual and could be updated to say "[Registry Lab](https://github.com/registrystack/registry-stack/tree/v0.8.3/lab) demo"
 without affecting machine contracts.
 `projects.yaml` `rename_status`: "Local checkout renamed to `registry-lab`;
 some scripts and fixtures may still reference the old `decentralized-evidence-demo` name."