Package Engine 0.183.364 lifecycle fixes

COMPATIBILITY.md

@@ -1,5 +1,20 @@
 # Compatibility Contract
 
+## Server v1.6.563 source candidate
+
+Not yet published. Installation examples remain on published Server562.
+The candidate consumes published original Engine364 while Web203 / optional
+bridge0.2.5, Catalog0.20.17 / Compose0.14.40 and all other pins remain unchanged.
+Engine364 corrects derived private-image cleanup for an authorized standalone
+container DELETE and stale hostname-map reconciliation during External target
+replacement. Current actor/role/Key/revision/expiry, explicit DENY, ownership,
+verified native graph and human-confirmation boundaries remain required.
+Existing VEX statements and vendor decisions are retained. Matching assembled
+Server/native business acceptance remains pending; component qualification is
+not runtime or full frontend PASS.
+See [candidate coordinates](docs/releases/server-1.6.563.md).
+
+
 <a id="server-v16562-publication"></a>
 
 ## Server v1.6.562 published

docs/releases/server-1.6.563.md

@@ -0,0 +1,38 @@
+# Server v1.6.563 candidate
+
+Source candidate; not a published image. The published component bytes below
+are qualified independently. Server image publication and matching runtime QA
+remain pending; installation instructions stay on published Server562.
+
+## Corrected workflows
+
+Engine364 repairs native CUSTOM-Key standalone container DELETE cleanup through
+its exact private OS-image/cache graph, retaining current owner/role/Key checks,
+explicit DENY and verified native execution frames. It also classifies a removed
+or different exact External hostname target as stale so normal map cleanup can
+finish hostname-to-IP and hostname replacement. These are substantive native
+behavior fixes; unchanged HTTP classification is not zero authorization change.
+The previously corrected External before-value previews, ServiceIndex cleanup,
+JDBC3.5.11, Web203 restricted-Key selector, sanitized human 403 guidance and
+confirmation-footer layout remain inherited. Bridge0.2.5 stays unchanged.
+
+## Verified component inputs
+
+- Engine v0.183.364: producer `e780d1613ab2a14112ba9e14fa55754b4e16ed0b`; tag source `04f5db394efd1ad9bc39b0193be94ac8b7746fd6`; tested tree `5c73690c54218d3537a06a641a0e38bb944a4689`.
+- Original cattle.jar SHA256 `279ae58c5ec0189df09e57fb9a9014b633a5323c884d49e63036046c6f8b15bb` (88235150 bytes); runtime SBOM `0eeae6ab2ccbc87672473005b987b63431447a4a2c9283e685a00e9c398e27eb`.
+- Original Security run 41283488278 attempt 1; CodeQL 41283488281 / 41283492244; 3872 tests in 416 suites, zero failure/error, 1 existing skip(s).
+- Actual new methods: 14, including six private cleanup and eight External lifecycle methods; seven preview and eight Index cleanup methods are inherited, not new tests.
+- Operation contract: 432 inputs / 1396 HTTP tuples / 1397 projection rows; source fingerprint `169fe350bed9358c2d9cbdac24f75c8636258325f2a92305507ad06e79c993e1`. HTTP tuples/classification and historical producer355/review chains are preserved; derived cleanup authorization changes substantively.
+- Packaged official JDBC3.5.11 SHA256 `42604178b9e57ec08ee0035079961516f086e455d0141f0b22c6eff29fb2fff4`; all four reported JDBC CVEs remain absent from original product and raw/effective scanner reports, including ignored entries. No new exception is added.
+- Unchanged Web 1.6.203 / bridge 0.2.5: producer `d97a8990801a281b519573a48b0db7dd12c9a616`; tag source `ae409b8404e946512297f00a71bdb4c141a3d5eb`; tested tree `6fff4d815fa34edc0287626e2ab83990fbc3a061`.
+- Web archive SHA256 `81e2e81becb2a006f0a753d781d7ec0383a908081c10864f451e8372b246b59d`; lock SHA256 `a0dfad456f43949e8c7c707197a0d73c2bb54b1a2a6d0ce763db1e3be7038452`; runtime SBOM `a34c07e7c6289a72174ddf5be4e83d1ccc8db0ad5fea07264f0b623eb77f013e`.
+- Optional bridge ZIP SHA256 `cafe59ca00122dfaf9534f65f2cbd96500e6c014f4819dd8c49fd3cd4fa23b93`. All 12 Engine and 13 Web assets passed anonymous SHA readback against fresh metadata bytes.
+- Engine provenance is original GitHub artifact/source/tree evidence; no native Engine SLSA attestation is inferred.
+
+Catalog0.20.17 / Compose0.14.40, other component/package pins, base image,
+VEX statements and vendor entries are retained. This source change does not
+rebuild components. The original Server publisher must pass source, build,
+restart, merged-image/browser scan and native attestation gates. Matching Core,
+External/Alias, role/Key/cross-ID, cleanup and designated business workflows
+remain separate pending gates. The four AI opt-ins remain independently
+default-off. These component results are not complete frontend acceptance.

scripts/check-server-api-explorer-patch.sh

@@ -571,7 +571,7 @@ python3 scripts/test-web-console-sbom.py
 python3 server/security/test_web_console_sbom_scan.py
 
 require_marker "$release_dockerfile" \
-    'ARG SERVER_RELEASE_TAG=v1.6.562' \
+    'ARG SERVER_RELEASE_TAG=v1.6.563' \
     SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
 require_marker "$release_dockerfile" \
     'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -1139,21 +1139,21 @@ require_marker "$build_script" \
     '--file server/Dockerfile.web-compose-release' \
     SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
 require_marker "$build_script" \
-    'image=${IMAGE:-pasturestack-validation/server:v1.6.562}' \
+    'image=${IMAGE:-pasturestack-validation/server:v1.6.563}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.562}' \
+    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.563}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
 require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
     SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING
 for release_engine_marker in \
-    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.363' \
+    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.364' \
     'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar' \
-    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=b2c1beca47f0654c22633012359eb8171202cb8192f7590ceddb02289875deda' \
-    'ARG ORCHESTRATION_ENGINE_COMMIT=6b23ada41c0324d708739433b68f5ff00d2209c3' \
+    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=279ae58c5ec0189df09e57fb9a9014b633a5323c884d49e63036046c6f8b15bb' \
+    'ARG ORCHESTRATION_ENGINE_COMMIT=e780d1613ab2a14112ba9e14fa55754b4e16ed0b' \
     'COPY --from=release_artifacts /out/orchestration-engine.jar /tmp/orchestration-engine.jar' \
-    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.363' \
+    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.364' \
     'sh /usr/share/cattle/verify-engine-archive.sh "${archive}" "${ORCHESTRATION_ENGINE_VERSION}" "${ORCHESTRATION_ENGINE_ARTIFACT_SHA256}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar' \
@@ -1172,10 +1172,10 @@ for release_engine_marker in \
         SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING
 done
 for release_engine_build_marker in \
-    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.363}' \
+    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.364}' \
     'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}' \
-    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-b2c1beca47f0654c22633012359eb8171202cb8192f7590ceddb02289875deda}' \
-    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-6b23ada41c0324d708739433b68f5ff00d2209c3}' \
+    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-279ae58c5ec0189df09e57fb9a9014b633a5323c884d49e63036046c6f8b15bb}' \
+    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-e780d1613ab2a14112ba9e14fa55754b4e16ed0b}' \
     'CATTLE_CATTLE_VERSION="${orchestration_engine_release_tag}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     '< "${server_dir}/artifacts/verify-engine-archive.sh"'; do
@@ -1694,10 +1694,10 @@ fi
 if grep -Fxq '## Current source candidate' README.md; then
     for candidate_readme_marker in \
         '<a id="current-release"></a>' \
-        'Server `v1.6.562` is a prepared source candidate, not a published image.' \
+        'Server `v1.6.563` is a prepared source candidate, not a published image.' \
         'run them only after its official release' \
         'This candidate is not yet available' \
-        'ghcr.io/pasturestack/server:v1.6.562'; do
+        'ghcr.io/pasturestack/server:v1.6.563'; do
         require_marker README.md "$candidate_readme_marker" \
             SERVER_CURRENT_CANDIDATE_README_MISSING
     done
@@ -2303,7 +2303,7 @@ done
 jq -e '
   ["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves
   |   .["@context"] == "https://openvex.dev/ns/v0.2.0"
-  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.562"
+  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.563"
   and (.statements | length) == 56
   and ([.statements[].vulnerability.name] | length == (unique | length))
   and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2341,7 +2341,7 @@ jq -r '
   | @tsv
 ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
 bash "$vendor_pending_validator" "$runtime_vendor_pending" \
-    "$vendor_pending_fixture" v1.6.562 >/dev/null
+    "$vendor_pending_fixture" v1.6.563 >/dev/null
 bash scripts/test-vendor-pending-findings.sh >/dev/null
 rm -f "$vendor_pending_fixture"
 trap - EXIT
@@ -2430,4 +2430,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.562 base=v1.6.460 engine=0.183.363 web_console=1.6.203 catalog_service=0.20.17 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.563 base=v1.6.460 engine=0.183.364 web_console=1.6.203 catalog_service=0.20.17 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'