chen21019 · Nov 1, 2026 · Nov 1, 2026 · Nov 1, 2026 · Nov 1, 2026
@@ -1,18 +1,39 @@
 # Compatibility Contract
 
-## Server v1.6.562 source candidate
-
-Not yet published. Installation examples remain on verified Server561.
-The candidate consumes published original Engine363 and Web203 / optional
-bridge0.2.5 artifacts. External Service before-value previews and the retained
-ServiceIndex cleanup authority use the original Engine; official MariaDB JDBC
-3.5.11 remains on the 3.5 line. Web203 retains explicit restricted-Key discovery
-and fixed public-code human guidance. Catalog0.20.17 / Compose0.14.40 and all
-other component pins and existing VEX/vendor decisions are unchanged.
-Assembled runtime, JDBC compatibility, roles, cross-ID, browser/layout and
-designated weak-model acceptance remain pending. This is not full frontend PASS.
-See [candidate coordinates](docs/releases/server-1.6.562.md).
-
+<a id="server-v16562-publication"></a>
+
+## Server v1.6.562 published
+
+Image: `ghcr.io/pasturestack/server:v1.6.562@sha256:0528940e29aabf142d852df14fb954be3cbf240db3be6b43822fbe48ea62af0d`.
+
+[Server v1.6.562](https://github.com/PastureStack/server/releases/tag/v1.6.562)
+was published by the original
+[publisher 41279691957](https://github.com/PastureStack/server/actions/runs/41279691957)
+from `d6bec333a5852ced8f33733f614ee5a21aa7b38d`. Source/build, merged-runtime
+security, startup/restart and protocol gates passed. All 35 public assets and
+the OCI digest passed anonymous readback; native image provenance and SBOM
+attestations passed. The [release note](docs/releases/server-1.6.562.md) records
+the immutable image digest and original component identities. Documentation
+commits do not replace this producer, rebuild the image or alter its assets.
+
+Original inputs are Engine 363 and Web 203 / optional bridge 0.2.5, retaining
+Catalog 0.20.17 / Compose 0.14.40 and other qualified package pins. External
+Service before-value previews, restricted-Key selection, safe permission
+messages and pending-review/footer layout are corrected. Exact native
+ServiceIndex cleanup ownership and current actor/role/Key/revision checks remain;
+JDBC 3.5.11 retains the existing 3.5 line and database configuration. Human plan
+confirmation, Full/legacy access and four default-off AI flags are unchanged.
+
+Ten registered Medium occurrences remain. Critical/High, available-fix,
+untracked and secret gates passed; raw/effective scans and exact VEX/vendor
+evidence remain separate. Browser runtime SBOM coverage is still incomplete.
+
+Sealed 8080 cutover, restart and smoke passed with three active Hosts/Agents,
+preserved mounts/AppArmor, the explicit operator plan and retained rollback.
+Core, External, Certificate, Audit and B3 business workflows remain pending,
+including designated role/cross-ID/layout, JDBC compatibility and weak-model
+acceptance. Health and component/source checks do not establish complete 243-group
+acceptance. Older sections retain their original release-time scope and failures.
 
 <a id="server-v16561-publication"></a>
 

@@ -13,25 +13,22 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-[Server `v1.6.561`](https://github.com/PastureStack/server/releases/tag/v1.6.561)
-packages Web Console `1.6.202` / optional bridge `0.2.4`, Engine `v0.183.361`,
-Catalog `0.20.17` and Compose `0.14.40`. It includes bounded Certificate
-name/description plans, native Container network-cleanup corrections, registered
-typed audit targets and a corrected fixed audit-owner topology. Existing Full
-and legacy permissions, operator settings, Catalog/Archive/session protections
-and official package contracts remain. See the
-[release note](docs/releases/server-1.6.561.md) and
-[publication identities](COMPATIBILITY.md#server-v16561-publication).
+[Server `v1.6.562`](https://github.com/PastureStack/server/releases/tag/v1.6.562)
+packages Engine `v0.183.363`, Web Console `1.6.203` / optional bridge `0.2.5`,
+Catalog `0.20.17` and Compose `0.14.40`. It corrects External Service preview
+before values, restricted-Key discovery, human-readable permission failures
+and pending-review/footer layout, while retaining exact ServiceIndex cleanup
+ownership. MariaDB Connector/J is updated to official `3.5.11` on the same
+3.5 line. Existing Full/legacy permissions, operator contracts and four
+independent default-off AI opt-ins remain. See the
+[release note](docs/releases/server-1.6.562.md) and
+[publication record](COMPATIBILITY.md#server-v16562-publication).
 
 | Qualification | Current evidence |
 |---|---|
-| Published image | Original publisher source/build, security, startup/restart and protocol gates passed. |
-| Public bytes and provenance | All 35 assets and the OCI digest passed anonymous verification; native provenance and SBOM attestations passed. |
-| Designated baseline | One actual Server561 restart passed, preserving config, mounts, AppArmor and rollback, with three active Hosts/Agents. |
-| Business workflows | Complete scoped lifecycle remains unaccepted: real scale-down found a ServiceIndex cleanup authorization gap. New domain, Certificate, layout and weak-model workflows remain pending. The audit-query oracle's HTTP201 handling is being corrected separately from the successful query/completion. |
-
-This is not complete frontend coverage. Original failures are retained and
-unchanged PASS evidence keeps its original scope.
+| Publication | Original publisher gates passed; all 35 public assets and the OCI digest passed anonymous verification, with native provenance and SBOM attestations. |
+| Designated baseline | Sealed 8080 cutover, restart and smoke passed with three active Hosts/Agents; mounts, AppArmor, the explicit operator plan and rollback were preserved. |
+| Business acceptance | Core, External, Certificate, Audit and B3 workflows, including role/cross-ID/layout and JDBC compatibility, remain pending. Baseline health is not business or full 243-group acceptance. |
 
 Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
@@ -64,7 +61,7 @@ instance count. Advanced forms and other resource workflows remain pending.
 The complete scoped lifecycle workflow remains unaccepted; review
 the [current limitation](docs/ai-collaboration.md#workload-retirement-limitation)
 before enabling these optional changes.
-See the [release note](docs/releases/server-1.6.561.md) and
+See the [release note](docs/releases/server-1.6.562.md) and
 [AI collaboration guide](docs/ai-collaboration.md) for activation,
 supported operations, audit records and rollback.
 
@@ -78,15 +75,15 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.561
+  ghcr.io/pasturestack/server:v1.6.562
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.561
+    image: ghcr.io/pasturestack/server:v1.6.562
     restart: unless-stopped
     ports:
       - "8080:8080"

@@ -8,7 +8,7 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the published Server `v1.6.561` numeric tag.
+The example uses the published Server `v1.6.562` numeric tag.
 The image and its release assets have passed public identity and checksum readback.
 See the [release note](../releases/server-1.6.561.md) and the
 [current release](../../README.md#current-release) for component versions and
@@ -21,7 +21,7 @@ evidence is not a performance benchmark; measure the actual workload.
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.561
+    image: ghcr.io/pasturestack/server:v1.6.562
     restart: unless-stopped
     ports:
       - "8080:8080"

@@ -1,15 +1,32 @@
-# Server v1.6.562 candidate
+# Server v1.6.562
 
-Source candidate; not a published image. Published component bytes below are
-qualified independently. Server image publication and designated runtime QA
-remain pending; installation instructions remain on published Server561.
+Published image: `ghcr.io/pasturestack/server:v1.6.562@sha256:0528940e29aabf142d852df14fb954be3cbf240db3be6b43822fbe48ea62af0d`.
 
-Engine363 repairs native External Service before-value previews, retains the
-exact ServiceIndex cleanup owner and updates official MariaDB Connector/J to
-3.5.11 on the same 3.5 line. Web203 / optional bridge0.2.5 retain the closed
-typed contract, explicit restricted-Key discovery and sanitized human guidance.
-Current role/Key/revision checks, human confirmation and four independent
-default-off AI opt-ins remain unchanged.
+Source commit: `d6bec333a5852ced8f33733f614ee5a21aa7b38d`.
+
+The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.
+
+## Corrected workflows
+
+- External Service review now shows the actual current hostname/IP before
+  values through native dynamic fields, retaining safe display, owner and CAS
+  checks. The exact ServiceIndex cleanup fix for Service scale-down and
+  Service/Stack removal is retained without a generic cleanup grant.
+- Key discovery explicitly distinguishes legacy `apiKey` from restricted or
+  expiring `apiKeyRestricted`, including same-name candidates. Existing current
+  actor/role, Key scope and policy revision checks still decide access.
+- Human confirmation maps sanitized permission codes to clear account/Key
+  guidance and stale/session codes to re-query/preview guidance. Raw error
+  messages are not forwarded and hidden foreign targets are not disclosed.
+- Pending-review and authorization notices remain in content flow so footer
+  controls stay actionable, including the reviewed narrow/RTL profiles. Original
+  CI includes the compiled theme rules and 96 parameter combinations; those
+  combinations are not 96 unique tests or a completed browser/locale matrix.
+- Official MariaDB Connector/J `3.5.11` replaces `3.5.10` on the existing 3.5
+  line. The four reported JDBC CVEs are absent from qualified original component
+  scans; the assembled image passed its own security gate. SQL, connection
+  configuration and privilege contracts remain; real JDBC business compatibility
+  acceptance is separate.
 
 ## Verified component inputs
 
@@ -23,10 +40,38 @@ default-off AI opt-ins remain unchanged.
 - Optional bridge ZIP SHA256 `cafe59ca00122dfaf9534f65f2cbd96500e6c014f4819dd8c49fd3cd4fa23b93`. All 12 Engine and 13 Web public assets passed anonymous SHA256 readback against fresh metadata bytes.
 - Engine provenance is original GitHub artifact/source/tree evidence; no native Engine SLSA attestation is inferred.
 
-Catalog0.20.17 / Compose0.14.40 and other qualified component/package pins,
-base image, VEX statements and vendor entries are retained. This source change
-does not rebuild components. The original Server publisher must pass its own
-source, build, restart, merged-image/browser scan and native attestation gates.
-Matching JDBC/External Service workflows, role/cross-ID/layout and designated
-weak-model acceptance remain separate pending gates; component PASS is not
-whole frontend or runtime acceptance.
+Catalog `0.20.17`, Compose `0.14.40` and the other qualified component/package
+pins, base image, VEX statements and vendor entries are retained. Component
+publication reused original qualified bytes; Engine artifact/source provenance
+remains separate from the Server image's native attestations.
+
+## Publication verification
+
+The original [publisher 41279691957](https://github.com/PastureStack/server/actions/runs/41279691957)
+passed source/build, security, startup/restart and protocol gates. All 35 public
+assets and the OCI digest above passed anonymous SHA256 verification; native
+image provenance and SBOM attestations passed. Documentation changes do not
+replace the source commit, rebuild the immutable image or rewrite release assets.
+
+The merged-rootfs, active nested payload and independent browser runtime scans
+passed the existing exact VEX/vendor policy. Critical/High, available-fix,
+untracked and secret counts were zero. Ten registered Medium occurrences remain;
+passing the gate does not mean zero vulnerabilities. Raw/effective evidence is
+retained, and browser runtime SBOM coverage remains incomplete.
+
+## Designated deployment and pending acceptance
+
+Sealed 8080 cutover, one actual restart and smoke passed for this exact digest
+and producer, with three active Hosts and three active Agents. Host configuration,
+mounts and AppArmor were preserved, the explicit operator plan was verified,
+and the rollback container was retained. This designated baseline did not
+change production or replace the original publisher.
+
+Core, External, Certificate, Audit and B3 business workflows remain pending.
+Native ownership, role/Key/revision and cross-ID behavior, actual JDBC read/write
+and transaction compatibility, browser/footer/locale layouts and designated
+weak-model workflows require their own results on this image. Published source,
+component CI and baseline health are not business completion or full 243-group
+acceptance. Original failed and unaffected evidence keeps its original scope.
+Human confirmation, Full/legacy behavior and the four independent default-off
+AI properties remain unchanged.