Package Web203 and Engine363 for Server v1.6.562

COMPATIBILITY.md

@@ -1,5 +1,19 @@
 # Compatibility Contract
 
+## Server v1.6.562 source candidate
+
+Not yet published. Installation examples remain on verified Server561.
+The candidate consumes published original Engine363 and Web203 / optional
+bridge0.2.5 artifacts. External Service before-value previews and the retained
+ServiceIndex cleanup authority use the original Engine; official MariaDB JDBC
+3.5.11 remains on the 3.5 line. Web203 retains explicit restricted-Key discovery
+and fixed public-code human guidance. Catalog0.20.17 / Compose0.14.40 and all
+other component pins and existing VEX/vendor decisions are unchanged.
+Assembled runtime, JDBC compatibility, roles, cross-ID, browser/layout and
+designated weak-model acceptance remain pending. This is not full frontend PASS.
+See [candidate coordinates](docs/releases/server-1.6.562.md).
+
+
 <a id="server-v16561-publication"></a>
 
 ## Server v1.6.561 published

docs/releases/server-1.6.562.md

@@ -0,0 +1,32 @@
+# Server v1.6.562
+
+Source candidate; not a published image. Published component bytes below are
+qualified independently. Server image publication and designated runtime QA
+remain pending; installation instructions remain on published Server561.
+
+Engine363 repairs native External Service before-value previews, retains the
+exact ServiceIndex cleanup owner and updates official MariaDB Connector/J to
+3.5.11 on the same 3.5 line. Web203 / optional bridge0.2.5 retain the closed
+typed contract, explicit restricted-Key discovery and sanitized human guidance.
+Current role/Key/revision checks, human confirmation and four independent
+default-off AI opt-ins remain unchanged.
+
+## Qualified published component coordinates
+
+- Engine v0.183.363: producer `6b23ada41c0324d708739433b68f5ff00d2209c3`; tag source `0173d171053fd9d232d59ebe2adbf4c91f132ccf`; tested tree `4a0f382ec4371e0343060cc567103e5611fe5430`.
+- Original cattle.jar SHA256 `b2c1beca47f0654c22633012359eb8171202cb8192f7590ceddb02289875deda` (88234250 bytes); runtime SBOM `48896415699a4f4cb8d44d9429e63e8f32f35ece266f63f016dc5bb7f7405783`.
+- Original Security run 41276564016 attempt 1; CodeQL 41276563988 / 41276564757; 3858 tests in 414 suites, zero failure/error, 1 existing skip(s). Seven new preview cases and eight inherited cleanup cases are separate.
+- Operation contract: 431 inputs / 1396 tuples / 1397 projection rows; source fingerprint `5bd56f773b6d57827ee04cfb5fb51f3e9ff95969a152edbbbff40abf3bb338fc`; zero tuple/semantic delta and historical review chain retained.
+- Packaged official JDBC3.5.11 SHA256 `42604178b9e57ec08ee0035079961516f086e455d0141f0b22c6eff29fb2fff4`; four reported JDBC CVEs absent from qualified original scans. No new exception is added.
+- Web 1.6.203 / bridge 0.2.5: producer `d97a8990801a281b519573a48b0db7dd12c9a616`; tag source `ae409b8404e946512297f00a71bdb4c141a3d5eb`; tested tree `6fff4d815fa34edc0287626e2ab83990fbc3a061`.
+- Web archive SHA256 `81e2e81becb2a006f0a753d781d7ec0383a908081c10864f451e8372b246b59d`; lock SHA256 `a0dfad456f43949e8c7c707197a0d73c2bb54b1a2a6d0ce763db1e3be7038452`; independent browser runtime SBOM `a34c07e7c6289a72174ddf5be4e83d1ccc8db0ad5fea07264f0b623eb77f013e`.
+- Optional bridge ZIP SHA256 `cafe59ca00122dfaf9534f65f2cbd96500e6c014f4819dd8c49fd3cd4fa23b93`. All 12 Engine and 13 Web public assets passed anonymous SHA256 readback against fresh metadata bytes.
+- Engine provenance is original GitHub artifact/source/tree evidence; no native Engine SLSA attestation is inferred.
+
+Catalog0.20.17 / Compose0.14.40 and other qualified component/package pins,
+base image, VEX statements and vendor entries are retained. This source change
+does not rebuild components. The original Server publisher must pass its own
+source, build, restart, merged-image/browser scan and native attestation gates.
+Matching JDBC/External Service workflows, role/cross-ID/layout and designated
+weak-model acceptance remain separate pending gates; component PASS is not
+whole frontend or runtime acceptance.

scripts/check-server-api-explorer-patch.sh

@@ -533,7 +533,7 @@ require_marker "$release_dockerfile" \
     SERVER_INCREMENTAL_RELEASE_BASE_MISSING
 for web_sbom_release_marker in \
     'COPY --chmod=0755 artifacts/verify-web-console-sbom.py /usr/local/bin/verify-web-console-sbom' \
-    'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.202-runtime.cdx.json' \
+    'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.203-runtime.cdx.json' \
     '"${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT}" "${WEB_CONSOLE_RUNTIME_SBOM_SHA256}" "${web_sbom}";' \
     '--lock-sha256 "${WEB_CONSOLE_LOCK_SHA256}" --archive "${web_archive}"' \
     '--webmcp-ceiling enabled;' \
@@ -571,7 +571,7 @@ python3 scripts/test-web-console-sbom.py
 python3 server/security/test_web_console_sbom_scan.py
 
 require_marker "$release_dockerfile" \
-    'ARG SERVER_RELEASE_TAG=v1.6.561' \
+    'ARG SERVER_RELEASE_TAG=v1.6.562' \
     SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
 require_marker "$release_dockerfile" \
     'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -629,22 +629,22 @@ require_marker "$publish_workflow" \
     'bash source/server/artifacts/verify-host-api-package.sh' \
     SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.202' \
+    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.203' \
     SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.202.tar.gz' \
+    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.203.tar.gz' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT_SHA256=333bca5f68e128423bf398cd2b8e72ccf05f96e02bcde7260b84a09b09601ac6' \
+    'ARG WEB_CONSOLE_ARTIFACT_SHA256=81e2e81becb2a006f0a753d781d7ec0383a908081c10864f451e8372b246b59d' \
     SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_COMMIT=3350a566b77c46ccf3686975bdcc8d9c14ee2985' \
+    'ARG WEB_CONSOLE_COMMIT=d97a8990801a281b519573a48b0db7dd12c9a616' \
     SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_LOCK_SHA256=81b8b3d579373456953ed27619de4b003cf13e122c94dce115254c3e3bba4dae' \
+    'ARG WEB_CONSOLE_LOCK_SHA256=a0dfad456f43949e8c7c707197a0d73c2bb54b1a2a6d0ce763db1e3be7038452' \
     SERVER_INCREMENTAL_WEB_CONSOLE_LOCK_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=54a17d3405535210d3f770a64b0708a6e3d8e908cbbe036fc737558eb0dfeaf8' \
+    'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=a34c07e7c6289a72174ddf5be4e83d1ccc8db0ad5fea07264f0b623eb77f013e' \
     SERVER_INCREMENTAL_WEB_CONSOLE_SBOM_HASH_MISSING
 require_marker "$release_dockerfile" \
     "grep -aF 'hostsPage.permissionDenied'" \
@@ -653,22 +653,22 @@ require_marker "$release_dockerfile" \
     '"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING
 require_marker "$build_script" \
-    'web_console_commit=${WEB_CONSOLE_COMMIT:-3350a566b77c46ccf3686975bdcc8d9c14ee2985}' \
+    'web_console_commit=${WEB_CONSOLE_COMMIT:-d97a8990801a281b519573a48b0db7dd12c9a616}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING
 require_marker "$build_script" \
-    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.202}' \
+    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.203}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.202.tar.gz}' \
+    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.203.tar.gz}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING
 require_marker "$build_script" \
-    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-333bca5f68e128423bf398cd2b8e72ccf05f96e02bcde7260b84a09b09601ac6}' \
+    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-81e2e81becb2a006f0a753d781d7ec0383a908081c10864f451e8372b246b59d}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING
 require_marker "$build_script" \
-    'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-81b8b3d579373456953ed27619de4b003cf13e122c94dce115254c3e3bba4dae}' \
+    'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-a0dfad456f43949e8c7c707197a0d73c2bb54b1a2a6d0ce763db1e3be7038452}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING
 require_marker "$build_script" \
-    'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-54a17d3405535210d3f770a64b0708a6e3d8e908cbbe036fc737558eb0dfeaf8}' \
+    'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-a34c07e7c6289a72174ddf5be4e83d1ccc8db0ad5fea07264f0b623eb77f013e}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING
 require_marker "$release_dockerfile" \
     'ARG CATALOG_SERVICE_VERSION=0.20.17' \
@@ -1139,21 +1139,21 @@ require_marker "$build_script" \
     '--file server/Dockerfile.web-compose-release' \
     SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
 require_marker "$build_script" \
-    'image=${IMAGE:-pasturestack-validation/server:v1.6.561}' \
+    'image=${IMAGE:-pasturestack-validation/server:v1.6.562}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.561}' \
+    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.562}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
 require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
     SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING
 for release_engine_marker in \
-    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.361' \
+    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.363' \
     'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar' \
-    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=9346cdc844c56e76779e95b015246c4aba3c224ee8b7e3bdb6ba31989a615136' \
-    'ARG ORCHESTRATION_ENGINE_COMMIT=592bd47ca9417f24d5acea07b567b9385852f381' \
+    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=b2c1beca47f0654c22633012359eb8171202cb8192f7590ceddb02289875deda' \
+    'ARG ORCHESTRATION_ENGINE_COMMIT=6b23ada41c0324d708739433b68f5ff00d2209c3' \
     'COPY --from=release_artifacts /out/orchestration-engine.jar /tmp/orchestration-engine.jar' \
-    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.361' \
+    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.363' \
     'sh /usr/share/cattle/verify-engine-archive.sh "${archive}" "${ORCHESTRATION_ENGINE_VERSION}" "${ORCHESTRATION_ENGINE_ARTIFACT_SHA256}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar' \
@@ -1172,10 +1172,10 @@ for release_engine_marker in \
         SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING
 done
 for release_engine_build_marker in \
-    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.361}' \
+    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.363}' \
     'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}' \
-    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-9346cdc844c56e76779e95b015246c4aba3c224ee8b7e3bdb6ba31989a615136}' \
-    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-592bd47ca9417f24d5acea07b567b9385852f381}' \
+    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-b2c1beca47f0654c22633012359eb8171202cb8192f7590ceddb02289875deda}' \
+    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-6b23ada41c0324d708739433b68f5ff00d2209c3}' \
     'CATTLE_CATTLE_VERSION="${orchestration_engine_release_tag}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     '< "${server_dir}/artifacts/verify-engine-archive.sh"'; do
@@ -1694,10 +1694,10 @@ fi
 if grep -Fxq '## Current source candidate' README.md; then
     for candidate_readme_marker in \
         '<a id="current-release"></a>' \
-        'Server `v1.6.561` is a prepared source candidate, not a published image.' \
+        'Server `v1.6.562` is a prepared source candidate, not a published image.' \
         'run them only after its official release' \
         'This candidate is not yet available' \
-        'ghcr.io/pasturestack/server:v1.6.561'; do
+        'ghcr.io/pasturestack/server:v1.6.562'; do
         require_marker README.md "$candidate_readme_marker" \
             SERVER_CURRENT_CANDIDATE_README_MISSING
     done
@@ -2303,7 +2303,7 @@ done
 jq -e '
   ["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves
   |   .["@context"] == "https://openvex.dev/ns/v0.2.0"
-  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.561"
+  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.562"
   and (.statements | length) == 56
   and ([.statements[].vulnerability.name] | length == (unique | length))
   and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2341,7 +2341,7 @@ jq -r '
   | @tsv
 ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
 bash "$vendor_pending_validator" "$runtime_vendor_pending" \
-    "$vendor_pending_fixture" v1.6.561 >/dev/null
+    "$vendor_pending_fixture" v1.6.562 >/dev/null
 bash scripts/test-vendor-pending-findings.sh >/dev/null
 rm -f "$vendor_pending_fixture"
 trap - EXIT
@@ -2430,4 +2430,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.561 base=v1.6.460 engine=0.183.361 web_console=1.6.202 catalog_service=0.20.17 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.562 base=v1.6.460 engine=0.183.363 web_console=1.6.203 catalog_service=0.20.17 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'