diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index 1e1b2862e4..d9b7907313 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -1,16 +1,34 @@ # Compatibility Contract -## Server v1.6.564 source candidate + -Not yet published. Installation examples remain on published Server563. -The candidate consumes original published Engine365 / Web204. Optional bridge +## Server v1.6.564 published + +[Server v1.6.564](https://github.com/PastureStack/server/releases/tag/v1.6.564) +was published by the original +[publisher 41317439519](https://github.com/PastureStack/server/actions/runs/41317439519). +All 35 public assets and the OCI digest passed anonymous verification; native +image provenance and SBOM attestations passed. + +| Evidence | Verified value | +|---|---| +| Immutable publication identity | `ghcr.io/pasturestack/server:v1.6.564@sha256:884c94832cc507b25585437002dc49c7312d122ee527bb6ff941744c86705213` | +| Runtime producer | `0ce4a6fdfc00ceba8fc71bcd78af9148454f3bad` | +| Designated 8080 runtime | Exact published identity, cutover, one real restart and smoke passed; three active Hosts and three active Agents. Production site unchanged. | + +The image consumes original published Engine365 / Web204. Optional bridge 0.2.6 shares the Web producer and is not a second Server runtime. Exact private volume/pool cleanup, safe native validation status/code and Catalog wire compatibility are corrected. Web admission guidance retains submitted-apply UNKNOWN/context/ACK protection. Current actor/role/Key/revision, explicit DENY, human confirmation and CAS remain required. Other pins, VEX statements and -vendor decisions are retained. Matching Server/native acceptance is pending. -See [candidate coordinates](docs/releases/server-1.6.564.md). +vendor decisions are retained. Ten registered Medium occurrences remain; +browser runtime SBOM coverage remains incomplete. + +The designated runtime result covers release identity, restart and health. +Native business workflows and full 243-group WebMCP acceptance remain pending; +component CI and runtime health do not complete that matrix. Four AI opt-ins +remain independently default-off. See the [release note](docs/releases/server-1.6.564.md). diff --git a/README.md b/README.md index 47dd3b8958..59c02a5161 100644 --- a/README.md +++ b/README.md @@ -13,25 +13,27 @@ upstream history, authorship, licenses, and notices. ## Current release -[Server `v1.6.563`](https://github.com/PastureStack/server/releases/tag/v1.6.563) -packages Engine `v0.183.364`, Web Console `1.6.203` / optional bridge `0.2.5`, -Catalog `0.20.17` and Compose `0.14.40`. Engine364 corrects authorized native -private-image cleanup during standalone container DELETE and stale hostname-map -cleanup during External target replacement. The exact private graph, current -actor/role/Key revision/expiry and every explicit DENY remain required. +[Server `v1.6.564`](https://github.com/PastureStack/server/releases/tag/v1.6.564) +packages Engine `v0.183.365`, Web Console `1.6.204` / optional bridge `0.2.6`, +Catalog `0.20.17` and Compose `0.14.40`. Engine365 corrects verified private +OS-volume/pool cleanup, safe native validation status/code propagation and +Catalog private-wire compatibility. Web204 improves safe admission guidance +while preserving context, ACK and submitted-apply UNKNOWN protections. Current +owner/role/Key revision/expiry and every explicit DENY remain required. External before-value previews, ServiceIndex cleanup ownership, restricted-Key discovery, clear sanitized permission guidance and review/footer layout fixes are retained. Official MariaDB JDBC `3.5.11`, Full/legacy behavior, operator contracts and four independent default-off AI opt-ins remain. See the -[release note](docs/releases/server-1.6.563.md) and -[publication record](COMPATIBILITY.md#server-v16563-publication). +[release note](docs/releases/server-1.6.564.md) and +[publication record](COMPATIBILITY.md#server-v16564-publication). | Qualification | Current evidence | |---|---| | Publication | Original publisher gates passed; all 35 public assets and the OCI digest passed anonymous verification, with native provenance and SBOM attestations. | -| Engine component | Original CI passed 3,872 tests in 416 suites: zero failures/errors and one existing skip. Fourteen new cleanup/lifecycle methods and the inherited preview/Index methods are recorded separately. | -| Designated runtime and business acceptance | Server563 cutover/restart, Core, External, Certificate, Audit and B3 workflows, including role/Key/cross-ID/layout and JDBC compatibility, remain separate pending results. Publication and publisher smoke do not establish full 243-group acceptance. | +| Engine component | Original CI passed 3,891 tests in 418 suites: zero failures/errors and one existing skip. Nineteen new methods and inherited coverage are recorded separately. | +| Designated 8080 runtime | Published identity, cutover, one real restart and smoke passed; three Hosts and three Agents are active. The production site was unchanged. | +| Business acceptance | Native workflows, role/Key/cross-ID, cleanup, layout and weak-model acceptance remain separately tracked. Runtime health does not establish full 243-group WebMCP acceptance. | Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host. @@ -64,7 +66,7 @@ instance count. Advanced forms and other resource workflows remain pending. The complete scoped lifecycle workflow remains unaccepted; review the [current limitation](docs/ai-collaboration.md#workload-retirement-limitation) before enabling these optional changes. -See the [release note](docs/releases/server-1.6.563.md) and +See the [release note](docs/releases/server-1.6.564.md) and [AI collaboration guide](docs/ai-collaboration.md) for activation, supported operations, audit records and rollback. @@ -78,7 +80,7 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \ -v pasturestack-cattle:/var/lib/cattle \ -v pasturestack-mysql:/var/lib/mysql \ -v pasturestack-mysqllog:/var/log/mysql \ - ghcr.io/pasturestack/server:v1.6.563 + ghcr.io/pasturestack/server:v1.6.564 ``` For HTTPS termination at a reverse proxy, set the exact public origin: @@ -86,7 +88,7 @@ For HTTPS termination at a reverse proxy, set the exact public origin: ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.563 + image: ghcr.io/pasturestack/server:v1.6.564 restart: unless-stopped ports: - "8080:8080" diff --git a/docs/performance/README.md b/docs/performance/README.md index ae5871106f..785bad8bf5 100644 --- a/docs/performance/README.md +++ b/docs/performance/README.md @@ -8,9 +8,9 @@ The following example is appropriate as a starting point for a dedicated 16-vCPU host with about 32 GiB of RAM. It is not a universal performance profile; measure the real workload before increasing it further. -The example uses the published Server `v1.6.563` numeric tag. +The example uses the published Server `v1.6.564` numeric tag. The image and its release assets have passed public identity and checksum readback. -See the [release note](../releases/server-1.6.563.md) and the +See the [release note](../releases/server-1.6.564.md) and the [current release](../../README.md#current-release) for component versions and release details. Preserve the existing runtime overrides and all three named volumes during an upgrade or restart. @@ -21,7 +21,7 @@ evidence is not a performance benchmark; measure the actual workload. ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.563 + image: ghcr.io/pasturestack/server:v1.6.564 restart: unless-stopped ports: - "8080:8080" diff --git a/docs/releases/server-1.6.564.md b/docs/releases/server-1.6.564.md index 868803612b..49b8d06197 100644 --- a/docs/releases/server-1.6.564.md +++ b/docs/releases/server-1.6.564.md @@ -1,7 +1,17 @@ -# Server v1.6.564 candidate +# Server v1.6.564 -Source candidate; not a published image. Installation remains on published563. -Matching Server publication/restart/business acceptance is pending. +[Server v1.6.564](https://github.com/PastureStack/server/releases/tag/v1.6.564) +is published and deployed to the designated 8080 environment. Its exact release +identity, cutover, one real restart and smoke passed, with three active Hosts +and three active Agents. The production site was unchanged. Native business +acceptance remains separate. + +| Publication evidence | Verified value | +|---|---| +| Immutable publication identity | `ghcr.io/pasturestack/server:v1.6.564@sha256:884c94832cc507b25585437002dc49c7312d122ee527bb6ff941744c86705213` | +| Runtime producer | `0ce4a6fdfc00ceba8fc71bcd78af9148454f3bad` | +| Original publisher | [41317439519](https://github.com/PastureStack/server/actions/runs/41317439519) | +| Public verification | All 35 assets and the OCI digest passed anonymous verification; native provenance and SBOM attestations passed. | Engine365 corrects the verified standalone private OS-volume/pool cleanup graph, safe native validation status/code propagation and bounded single-Base64 Catalog @@ -28,9 +38,12 @@ Prior Web203 restricted-Key/human-review/footer layout behavior is inherited. - All12 Engine and13 Web assets passed actual anonymous SHA/length readback against exact public metadata. Web archive provenance and runtime-SBOM attestations passed. No native Engine SLSA attestation is inferred. Catalog0.20.17 / Compose0.14.40 and other pins/base image, VEX statements and -vendor decisions remain unchanged. Source preparation rebuilds no component. -The original Server publisher must pass its source/build/restart/merged-image -and browser scans/native attestation gates. Core, External/Alias, Member, -Catalog, roles/Keys/cross-ID, cleanup and weak-model runtime remain pending. -Four AI opt-ins remain independently default-off. Server563 results do not -become Server564 PASS. Full243 coverage is incomplete. +vendor decisions remain unchanged. The original Server publisher passed its +source/build/restart, merged-image and browser security gates. Ten registered +Medium occurrences remain, and browser runtime SBOM coverage remains incomplete. +Documentation does not change the runtime producer or published bytes. + +The designated deployment receipt covers release identity, restart and health +only. Core, External/Alias, Member, Catalog, role/Key/cross-ID, cleanup, layout +and weak-model business acceptance remain separately tracked. Four AI opt-ins +remain independently default-off. Full 243-group WebMCP coverage is incomplete.