diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index ad1cb30f75..5929a1af2f 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -1,18 +1,39 @@ # Compatibility Contract -## Server v1.6.562 source candidate - -Not yet published. Installation examples remain on verified Server561. -The candidate consumes published original Engine363 and Web203 / optional -bridge0.2.5 artifacts. External Service before-value previews and the retained -ServiceIndex cleanup authority use the original Engine; official MariaDB JDBC -3.5.11 remains on the 3.5 line. Web203 retains explicit restricted-Key discovery -and fixed public-code human guidance. Catalog0.20.17 / Compose0.14.40 and all -other component pins and existing VEX/vendor decisions are unchanged. -Assembled runtime, JDBC compatibility, roles, cross-ID, browser/layout and -designated weak-model acceptance remain pending. This is not full frontend PASS. -See [candidate coordinates](docs/releases/server-1.6.562.md). - + + +## Server v1.6.562 published + +Image: `ghcr.io/pasturestack/server:v1.6.562@sha256:0528940e29aabf142d852df14fb954be3cbf240db3be6b43822fbe48ea62af0d`. + +[Server v1.6.562](https://github.com/PastureStack/server/releases/tag/v1.6.562) +was published by the original +[publisher 41279691957](https://github.com/PastureStack/server/actions/runs/41279691957) +from `d6bec333a5852ced8f33733f614ee5a21aa7b38d`. Source/build, merged-runtime +security, startup/restart and protocol gates passed. All 35 public assets and +the OCI digest passed anonymous readback; native image provenance and SBOM +attestations passed. The [release note](docs/releases/server-1.6.562.md) records +the immutable image digest and original component identities. Documentation +commits do not replace this producer, rebuild the image or alter its assets. + +Original inputs are Engine 363 and Web 203 / optional bridge 0.2.5, retaining +Catalog 0.20.17 / Compose 0.14.40 and other qualified package pins. External +Service before-value previews, restricted-Key selection, safe permission +messages and pending-review/footer layout are corrected. Exact native +ServiceIndex cleanup ownership and current actor/role/Key/revision checks remain; +JDBC 3.5.11 retains the existing 3.5 line and database configuration. Human plan +confirmation, Full/legacy access and four default-off AI flags are unchanged. + +Ten registered Medium occurrences remain. Critical/High, available-fix, +untracked and secret gates passed; raw/effective scans and exact VEX/vendor +evidence remain separate. Browser runtime SBOM coverage is still incomplete. + +Sealed 8080 cutover, restart and smoke passed with three active Hosts/Agents, +preserved mounts/AppArmor, the explicit operator plan and retained rollback. +Core, External, Certificate, Audit and B3 business workflows remain pending, +including designated role/cross-ID/layout, JDBC compatibility and weak-model +acceptance. Health and component/source checks do not establish complete 243-group +acceptance. Older sections retain their original release-time scope and failures. diff --git a/README.md b/README.md index 4a868e8114..28ba6247f3 100644 --- a/README.md +++ b/README.md @@ -13,25 +13,22 @@ upstream history, authorship, licenses, and notices. ## Current release -[Server `v1.6.561`](https://github.com/PastureStack/server/releases/tag/v1.6.561) -packages Web Console `1.6.202` / optional bridge `0.2.4`, Engine `v0.183.361`, -Catalog `0.20.17` and Compose `0.14.40`. It includes bounded Certificate -name/description plans, native Container network-cleanup corrections, registered -typed audit targets and a corrected fixed audit-owner topology. Existing Full -and legacy permissions, operator settings, Catalog/Archive/session protections -and official package contracts remain. See the -[release note](docs/releases/server-1.6.561.md) and -[publication identities](COMPATIBILITY.md#server-v16561-publication). +[Server `v1.6.562`](https://github.com/PastureStack/server/releases/tag/v1.6.562) +packages Engine `v0.183.363`, Web Console `1.6.203` / optional bridge `0.2.5`, +Catalog `0.20.17` and Compose `0.14.40`. It corrects External Service preview +before values, restricted-Key discovery, human-readable permission failures +and pending-review/footer layout, while retaining exact ServiceIndex cleanup +ownership. MariaDB Connector/J is updated to official `3.5.11` on the same +3.5 line. Existing Full/legacy permissions, operator contracts and four +independent default-off AI opt-ins remain. See the +[release note](docs/releases/server-1.6.562.md) and +[publication record](COMPATIBILITY.md#server-v16562-publication). | Qualification | Current evidence | |---|---| -| Published image | Original publisher source/build, security, startup/restart and protocol gates passed. | -| Public bytes and provenance | All 35 assets and the OCI digest passed anonymous verification; native provenance and SBOM attestations passed. | -| Designated baseline | One actual Server561 restart passed, preserving config, mounts, AppArmor and rollback, with three active Hosts/Agents. | -| Business workflows | Complete scoped lifecycle remains unaccepted: real scale-down found a ServiceIndex cleanup authorization gap. New domain, Certificate, layout and weak-model workflows remain pending. The audit-query oracle's HTTP201 handling is being corrected separately from the successful query/completion. | - -This is not complete frontend coverage. Original failures are retained and -unchanged PASS evidence keeps its original scope. +| Publication | Original publisher gates passed; all 35 public assets and the OCI digest passed anonymous verification, with native provenance and SBOM attestations. | +| Designated baseline | Sealed 8080 cutover, restart and smoke passed with three active Hosts/Agents; mounts, AppArmor, the explicit operator plan and rollback were preserved. | +| Business acceptance | Core, External, Certificate, Audit and B3 workflows, including role/cross-ID/layout and JDBC compatibility, remain pending. Baseline health is not business or full 243-group acceptance. | Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host. @@ -64,7 +61,7 @@ instance count. Advanced forms and other resource workflows remain pending. The complete scoped lifecycle workflow remains unaccepted; review the [current limitation](docs/ai-collaboration.md#workload-retirement-limitation) before enabling these optional changes. -See the [release note](docs/releases/server-1.6.561.md) and +See the [release note](docs/releases/server-1.6.562.md) and [AI collaboration guide](docs/ai-collaboration.md) for activation, supported operations, audit records and rollback. @@ -78,7 +75,7 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \ -v pasturestack-cattle:/var/lib/cattle \ -v pasturestack-mysql:/var/lib/mysql \ -v pasturestack-mysqllog:/var/log/mysql \ - ghcr.io/pasturestack/server:v1.6.561 + ghcr.io/pasturestack/server:v1.6.562 ``` For HTTPS termination at a reverse proxy, set the exact public origin: @@ -86,7 +83,7 @@ For HTTPS termination at a reverse proxy, set the exact public origin: ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.561 + image: ghcr.io/pasturestack/server:v1.6.562 restart: unless-stopped ports: - "8080:8080" diff --git a/docs/performance/README.md b/docs/performance/README.md index b0b80b2082..f48d10a24b 100644 --- a/docs/performance/README.md +++ b/docs/performance/README.md @@ -8,7 +8,7 @@ The following example is appropriate as a starting point for a dedicated 16-vCPU host with about 32 GiB of RAM. It is not a universal performance profile; measure the real workload before increasing it further. -The example uses the published Server `v1.6.561` numeric tag. +The example uses the published Server `v1.6.562` numeric tag. The image and its release assets have passed public identity and checksum readback. See the [release note](../releases/server-1.6.561.md) and the [current release](../../README.md#current-release) for component versions and @@ -21,7 +21,7 @@ evidence is not a performance benchmark; measure the actual workload. ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.561 + image: ghcr.io/pasturestack/server:v1.6.562 restart: unless-stopped ports: - "8080:8080" diff --git a/docs/releases/server-1.6.562.md b/docs/releases/server-1.6.562.md index 0a9567ba1a..dcee24928a 100644 --- a/docs/releases/server-1.6.562.md +++ b/docs/releases/server-1.6.562.md @@ -1,15 +1,32 @@ -# Server v1.6.562 candidate +# Server v1.6.562 -Source candidate; not a published image. Published component bytes below are -qualified independently. Server image publication and designated runtime QA -remain pending; installation instructions remain on published Server561. +Published image: `ghcr.io/pasturestack/server:v1.6.562@sha256:0528940e29aabf142d852df14fb954be3cbf240db3be6b43822fbe48ea62af0d`. -Engine363 repairs native External Service before-value previews, retains the -exact ServiceIndex cleanup owner and updates official MariaDB Connector/J to -3.5.11 on the same 3.5 line. Web203 / optional bridge0.2.5 retain the closed -typed contract, explicit restricted-Key discovery and sanitized human guidance. -Current role/Key/revision checks, human confirmation and four independent -default-off AI opt-ins remain unchanged. +Source commit: `d6bec333a5852ced8f33733f614ee5a21aa7b38d`. + +The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results. + +## Corrected workflows + +- External Service review now shows the actual current hostname/IP before + values through native dynamic fields, retaining safe display, owner and CAS + checks. The exact ServiceIndex cleanup fix for Service scale-down and + Service/Stack removal is retained without a generic cleanup grant. +- Key discovery explicitly distinguishes legacy `apiKey` from restricted or + expiring `apiKeyRestricted`, including same-name candidates. Existing current + actor/role, Key scope and policy revision checks still decide access. +- Human confirmation maps sanitized permission codes to clear account/Key + guidance and stale/session codes to re-query/preview guidance. Raw error + messages are not forwarded and hidden foreign targets are not disclosed. +- Pending-review and authorization notices remain in content flow so footer + controls stay actionable, including the reviewed narrow/RTL profiles. Original + CI includes the compiled theme rules and 96 parameter combinations; those + combinations are not 96 unique tests or a completed browser/locale matrix. +- Official MariaDB Connector/J `3.5.11` replaces `3.5.10` on the existing 3.5 + line. The four reported JDBC CVEs are absent from qualified original component + scans; the assembled image passed its own security gate. SQL, connection + configuration and privilege contracts remain; real JDBC business compatibility + acceptance is separate. ## Verified component inputs @@ -23,10 +40,38 @@ default-off AI opt-ins remain unchanged. - Optional bridge ZIP SHA256 `cafe59ca00122dfaf9534f65f2cbd96500e6c014f4819dd8c49fd3cd4fa23b93`. All 12 Engine and 13 Web public assets passed anonymous SHA256 readback against fresh metadata bytes. - Engine provenance is original GitHub artifact/source/tree evidence; no native Engine SLSA attestation is inferred. -Catalog0.20.17 / Compose0.14.40 and other qualified component/package pins, -base image, VEX statements and vendor entries are retained. This source change -does not rebuild components. The original Server publisher must pass its own -source, build, restart, merged-image/browser scan and native attestation gates. -Matching JDBC/External Service workflows, role/cross-ID/layout and designated -weak-model acceptance remain separate pending gates; component PASS is not -whole frontend or runtime acceptance. +Catalog `0.20.17`, Compose `0.14.40` and the other qualified component/package +pins, base image, VEX statements and vendor entries are retained. Component +publication reused original qualified bytes; Engine artifact/source provenance +remains separate from the Server image's native attestations. + +## Publication verification + +The original [publisher 41279691957](https://github.com/PastureStack/server/actions/runs/41279691957) +passed source/build, security, startup/restart and protocol gates. All 35 public +assets and the OCI digest above passed anonymous SHA256 verification; native +image provenance and SBOM attestations passed. Documentation changes do not +replace the source commit, rebuild the immutable image or rewrite release assets. + +The merged-rootfs, active nested payload and independent browser runtime scans +passed the existing exact VEX/vendor policy. Critical/High, available-fix, +untracked and secret counts were zero. Ten registered Medium occurrences remain; +passing the gate does not mean zero vulnerabilities. Raw/effective evidence is +retained, and browser runtime SBOM coverage remains incomplete. + +## Designated deployment and pending acceptance + +Sealed 8080 cutover, one actual restart and smoke passed for this exact digest +and producer, with three active Hosts and three active Agents. Host configuration, +mounts and AppArmor were preserved, the explicit operator plan was verified, +and the rollback container was retained. This designated baseline did not +change production or replace the original publisher. + +Core, External, Certificate, Audit and B3 business workflows remain pending. +Native ownership, role/Key/revision and cross-ID behavior, actual JDBC read/write +and transaction compatibility, browser/footer/locale layouts and designated +weak-model workflows require their own results on this image. Published source, +component CI and baseline health are not business completion or full 243-group +acceptance. Original failed and unaffected evidence keeps its original scope. +Human confirmation, Full/legacy behavior and the four independent default-off +AI properties remain unchanged.