[jbb-kryo]

Prepares v0.1.0-rc.2.

v0.1.0-rc.1 was tagged on 2026-11-09 at 3568b9b and never released. Three faults in the release workflow kept its run from the signing jobs. They are fixed by #91 and #92. A release tag cannot be moved, and a tag's run uses the workflow files of its own commit, so no re-run of rc.1 can release it. rc.2 is the same tree with those fixes.

What changes

• Version. Cargo.toml, the workspace crates in Cargo.lock, the Helm chart's version, appVersion and image tag, the five images in deploy/k8s/enclosure.yaml, and the air-gap bundle README's example. cargo metadata --locked --offline passes, so the lockfile needs nothing else.
• docs/releases/v0.1.0-rc.2.md. rc.1's notes, with a section on why there is a second candidate. The closing section now says how this candidate is cut.
• CHANGELOG.md. The unreleased entries become 0.1.0-rc.2's, under a short preface. 0.1.0-rc.1 is recorded as tagged and never released. A new, empty Unreleased section sits on top.
• README.md. Says no release is published yet, and points at the rc.2 notes. Line counts are unchanged.
• The waiver. clients/shells/audit-waivers.txt records the owner's decision for 0.1.0-rc.2, for the same reason as rc.1: no shell has a buildable project yet. GA_READINESS row B names both pre-releases. The waiver file is covered by the gate, so it lands here, before the gate runs.
• Claims and numbers. The preface moves every changelog line after it by 10, so the changelog anchors in claims.toml move with it. Each one was checked to point at the same text. The rc.2 notes are cited beside rc.1's. CLAIMS.md is re-rendered and NUMBERS.md regenerated.

Left as it is

• Historical records still name rc.1, which is correct: GA_READINESS §4a's rehearsal, the completion plan, docs/ops/UPGRADING.md, and the test fixtures.
• The launch and design material (docs/launch/, docs/design/site/) still says rc.1, including the two .pptx decks. Those directories are outside the gate and can follow separately.

Still needed before the tag

1. The gate. Run the gate at the merge commit, record it, and merge the records-only change.
2. The tag. Run tag-release.sh, push the tag, and a second maintainer approves each signing job.

Checks

• claims.sh --check --strict, numbers.sh --check and gate-record.sh --check: pass
• tag-release.sh --check: ready except the gate record, which does not cover this commit yet, and the uncommitted tree
• cargo metadata --locked --offline: passes with the bumped lockfile
• tools/ci/tests/*.test.sh: 35 of 36 pass on a Windows checkout. mg-install.test.sh fails five symlink and file-mode cases there, the same as on main. CI runs it on Linux.

[phillips1707]

Approving. This is the rc.2 preparation, and it does what the description says.

Checked

• Commit 117896a has a verified signature and sits on d60346d (#92), the tip of main. Since v0.1.0-rc.1 (3568b9b), the only changes are #91, #92 and this commit, so "rc.2 is rc.1 with the workflow fixes" holds.
• Version. Cargo.toml, all 70 workspace entries in Cargo.lock, the chart's version, appVersion and image tag, the five images in enclosure.yaml and the air-gap README all move from 0.1.0-rc.1 to 0.1.0-rc.2. Every 0.1.0-rc.1 left in the tree is an example, a test fixture, a historical record or the waiver for rc.1 itself.
• Waiver. audit-waivers.txt has a 0.1.0-rc.2 line matching Cargo.toml's version, so the shell-audit gate can pass and write the verdict #92 reads. shell-audit-waiver.test.sh and shell-audit.test.sh pass locally.
• Claims anchors. I checked all 61 changed anchors mechanically. Each CHANGELOG.md line moved by +10 holds the same text it did on main, and each new v0.1.0-rc.2.md anchor holds the same text as its rc.1 counterpart.
• Release notes. The rc.2 notes are rc.1's, with "Why a second candidate" added and the pre-tag owner checklist replaced by "How this candidate is cut".
• Local checks. numbers.sh --check and gate-record.sh --check pass locally. I couldn't run claims.sh (it needs bash 4) or cargo metadata on this machine; "scripts, provenance, secrets, manifests" passes in CI.

Not blocking

• build and test, reproducible build and release gate, dry run are still running as I approve.
• As the description says, docs/launch/ and the two decks still say rc.1.
• Next: the gate at the merge commit, the records-only PR, then tag-release.sh for v0.1.0-rc.2.