chen21019 · Nov 1, 2026 · Nov 1, 2026
@@ -1,19 +1,44 @@
 # Compatibility Contract
 
-## Server v1.6.563 source candidate
-
-Not yet published. Installation examples remain on published Server562.
-The candidate consumes published original Engine364 while Web203 / optional
-bridge0.2.5, Catalog0.20.17 / Compose0.14.40 and all other pins remain unchanged.
-Engine364 corrects derived private-image cleanup for an authorized standalone
-container DELETE and stale hostname-map reconciliation during External target
-replacement. Current actor/role/Key/revision/expiry, explicit DENY, ownership,
-verified native graph and human-confirmation boundaries remain required.
-Existing VEX statements and vendor decisions are retained. Matching assembled
-Server/native business acceptance remains pending; component qualification is
-not runtime or full frontend PASS.
-See [candidate coordinates](docs/releases/server-1.6.563.md).
+<a id="server-v16563-publication"></a>
 
+## Server v1.6.563 published
+
+Image: `ghcr.io/pasturestack/server:v1.6.563@sha256:f4da77e0d49e5f53eec1cfbdd478fae628acb90a223edbdd2dda01d4edf2a572`.
+
+[Server v1.6.563](https://github.com/PastureStack/server/releases/tag/v1.6.563)
+was published by the original
+[publisher 41285405058](https://github.com/PastureStack/server/actions/runs/41285405058)
+from `fa1fbd1fe1b3a94e6b74aac80b78b2bbdee05036`. Source/build, merged-runtime security,
+startup/restart and protocol gates passed. All 35 assets and the OCI digest
+passed anonymous readback; native provenance and SBOM attestations passed.
+The [release note](docs/releases/server-1.6.563.md) records immutable image and
+original component identities. Documentation does not replace this producer,
+rebuild the image or alter release assets.
+
+Engine364 corrects CUSTOM-Key standalone container DELETE through its exact
+private OS-image/cache graph and External stale-hostname reconciliation. Current
+owner/role/Key revision/expiry, root grant, verified native frames and every
+explicit dependency DENY remain required. HTTP tuples/classifications are
+unchanged; derived cleanup authorization has a substantive behavior correction.
+Fourteen new methods passed original component CI; seven preview and eight
+Index cleanup methods are inherited, not new Engine364 cases.
+
+Web203 / optional bridge0.2.5, Catalog0.20.17 / Compose0.14.40 and other package
+pins are retained. Prior External before-value previews, restricted-Key discovery,
+clear public-code permission guidance, review/footer layout, ServiceIndex cleanup
+and JDBC3.5.11 fixes remain. Human confirmation, Full/legacy behavior, operator
+contracts and four independent default-off AI flags are preserved.
+
+Ten registered Medium occurrences remain. Critical/High, available-fix,
+untracked and secret gates passed; raw/effective scans and exact VEX/vendor
+evidence remain distinct. Browser runtime SBOM coverage remains incomplete.
+
+Server563 designated cutover/restart and Core, External, Certificate, Audit and
+B3 business workflows remain separate pending results, including role/Key/cross-ID,
+cleanup, JDBC, layout and weak-model acceptance. Publisher smoke and component
+CI are not native business completion or full 243-group acceptance. Historical
+release sections retain their original scope and evidence.
 
 <a id="server-v16562-publication"></a>
 

@@ -13,22 +13,25 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-[Server `v1.6.562`](https://github.com/PastureStack/server/releases/tag/v1.6.562)
-packages Engine `v0.183.363`, Web Console `1.6.203` / optional bridge `0.2.5`,
-Catalog `0.20.17` and Compose `0.14.40`. It corrects External Service preview
-before values, restricted-Key discovery, human-readable permission failures
-and pending-review/footer layout, while retaining exact ServiceIndex cleanup
-ownership. MariaDB Connector/J is updated to official `3.5.11` on the same
-3.5 line. Existing Full/legacy permissions, operator contracts and four
-independent default-off AI opt-ins remain. See the
-[release note](docs/releases/server-1.6.562.md) and
-[publication record](COMPATIBILITY.md#server-v16562-publication).
+[Server `v1.6.563`](https://github.com/PastureStack/server/releases/tag/v1.6.563)
+packages Engine `v0.183.364`, Web Console `1.6.203` / optional bridge `0.2.5`,
+Catalog `0.20.17` and Compose `0.14.40`. Engine364 corrects authorized native
+private-image cleanup during standalone container DELETE and stale hostname-map
+cleanup during External target replacement. The exact private graph, current
+actor/role/Key revision/expiry and every explicit DENY remain required.
+
+External before-value previews, ServiceIndex cleanup ownership, restricted-Key
+discovery, clear sanitized permission guidance and review/footer layout fixes
+are retained. Official MariaDB JDBC `3.5.11`, Full/legacy behavior, operator
+contracts and four independent default-off AI opt-ins remain. See the
+[release note](docs/releases/server-1.6.563.md) and
+[publication record](COMPATIBILITY.md#server-v16563-publication).
 
 | Qualification | Current evidence |
 |---|---|
 | Publication | Original publisher gates passed; all 35 public assets and the OCI digest passed anonymous verification, with native provenance and SBOM attestations. |
-| Designated baseline | Sealed 8080 cutover, restart and smoke passed with three active Hosts/Agents; mounts, AppArmor, the explicit operator plan and rollback were preserved. |
-| Business acceptance | Core, External, Certificate, Audit and B3 workflows, including role/cross-ID/layout and JDBC compatibility, remain pending. Baseline health is not business or full 243-group acceptance. |
+| Engine component | Original CI passed 3,872 tests in 416 suites: zero failures/errors and one existing skip. Fourteen new cleanup/lifecycle methods and the inherited preview/Index methods are recorded separately. |
+| Designated runtime and business acceptance | Server563 cutover/restart, Core, External, Certificate, Audit and B3 workflows, including role/Key/cross-ID/layout and JDBC compatibility, remain separate pending results. Publication and publisher smoke do not establish full 243-group acceptance. |
 
 Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
@@ -61,7 +64,7 @@ instance count. Advanced forms and other resource workflows remain pending.
 The complete scoped lifecycle workflow remains unaccepted; review
 the [current limitation](docs/ai-collaboration.md#workload-retirement-limitation)
 before enabling these optional changes.
-See the [release note](docs/releases/server-1.6.562.md) and
+See the [release note](docs/releases/server-1.6.563.md) and
 [AI collaboration guide](docs/ai-collaboration.md) for activation,
 supported operations, audit records and rollback.
 
@@ -75,15 +78,15 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.562
+  ghcr.io/pasturestack/server:v1.6.563
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.562
+    image: ghcr.io/pasturestack/server:v1.6.563
     restart: unless-stopped
     ports:
       - "8080:8080"

@@ -8,9 +8,9 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the published Server `v1.6.562` numeric tag.
+The example uses the published Server `v1.6.563` numeric tag.
 The image and its release assets have passed public identity and checksum readback.
-See the [release note](../releases/server-1.6.561.md) and the
+See the [release note](../releases/server-1.6.563.md) and the
 [current release](../../README.md#current-release) for component versions and
 release details. Preserve the existing runtime overrides and all three named
 volumes during an upgrade or restart.
@@ -21,7 +21,7 @@ evidence is not a performance benchmark; measure the actual workload.
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.562
+    image: ghcr.io/pasturestack/server:v1.6.563
     restart: unless-stopped
     ports:
       - "8080:8080"

@@ -1,8 +1,10 @@
-# Server v1.6.563 candidate
+# Server v1.6.563
 
-Source candidate; not a published image. The published component bytes below
-are qualified independently. Server image publication and matching runtime QA
-remain pending; installation instructions stay on published Server562.
+Published image: `ghcr.io/pasturestack/server:v1.6.563@sha256:f4da77e0d49e5f53eec1cfbdd478fae628acb90a223edbdd2dda01d4edf2a572`.
+
+Source commit: `fa1fbd1fe1b3a94e6b74aac80b78b2bbdee05036`.
+
+The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.
 
 ## Corrected workflows
 
@@ -29,10 +31,37 @@ confirmation-footer layout remain inherited. Bridge0.2.5 stays unchanged.
 - Optional bridge ZIP SHA256 `cafe59ca00122dfaf9534f65f2cbd96500e6c014f4819dd8c49fd3cd4fa23b93`. All 12 Engine and 13 Web assets passed anonymous SHA readback against fresh metadata bytes.
 - Engine provenance is original GitHub artifact/source/tree evidence; no native Engine SLSA attestation is inferred.
 
-Catalog0.20.17 / Compose0.14.40, other component/package pins, base image,
-VEX statements and vendor entries are retained. This source change does not
-rebuild components. The original Server publisher must pass source, build,
-restart, merged-image/browser scan and native attestation gates. Matching Core,
-External/Alias, role/Key/cross-ID, cleanup and designated business workflows
-remain separate pending gates. The four AI opt-ins remain independently
-default-off. These component results are not complete frontend acceptance.
+Catalog0.20.17 / Compose0.14.40, other qualified component/package pins, base
+image, VEX statements and vendor entries are retained. Engine and Web publication
+reused original qualified bytes. Engine artifact/source provenance remains
+separate from the Server image's native attestations.
+
+## Publication verification
+
+The original [publisher 41285405058](https://github.com/PastureStack/server/actions/runs/41285405058)
+passed source/build, security, startup/restart and protocol gates. All 35 public
+assets and the OCI digest above passed anonymous SHA256 verification; native
+image provenance and SBOM attestations passed. Documentation changes do not
+replace the source commit, rebuild the image or rewrite release assets.
+
+The merged-rootfs, active nested payload and independent browser runtime scans
+passed the exact VEX/vendor policy. Critical/High, available-fix, untracked and
+secret counts were zero. Ten registered Medium occurrences remain; passing the
+gate does not mean zero vulnerabilities. Raw/effective reports remain distinct,
+and browser runtime SBOM coverage remains incomplete.
+
+## Designated deployment and pending acceptance
+
+Matching Server563 cutover/restart and native business acceptance remain pending
+in the publication record. The publisher's image startup/restart and protocol
+checks do not establish designated deployment or business completion. Previous
+Server562 sealed receipts retain their exact original image and scope.
+
+Core, External, Certificate, Audit and B3 workflows, native cleanup, applicable
+role/Key/revision and cross-ID cases, JDBC read/write and transaction compatibility,
+browser/footer/locale layouts and designated weak-model workflows require their
+own results on this image. Published source and component CI are not full
+243-group acceptance. Original failed and unaffected evidence retains its scope.
+Human confirmation, Full/legacy behavior, operator settings and four independent
+default-off AI properties remain unchanged. Preserve volumes and compatible
+backups during upgrade; do not blindly replay an uncertain old operation.