chen21019 · Oct 12, 2026 · Oct 12, 2026
@@ -2,14 +2,15 @@
 
 ## Server v1.6.522 prepared, not published
 
-The minimal onboarding candidate uses released Engine `v0.183.339` and Web Console
+The minimal onboarding candidate uses released Engine `v0.183.340` and Web Console
 `1.6.183`. It restores dedicated registration-token Basic authentication.
 Custom add-host requires RegistrationToken POST; built-in and Other drivers
 require Host POST, using the current project's loaded native schemas.
 Cancel / Go Back preserves the external return target across driver changes and
 API-host settings refresh; missing or self-referencing targets return to Hosts.
-Backend roles, resource authorization, other Server components and the console
-broker are unchanged.
+Native project creation with legacy/full API Keys now binds initial work to the
+actual manager-created project and rechecks ownership after that phase. Existing
+roles and non-creation authorization, other components and the broker are unchanged.
 
 Clean merged component source and official asset checksums have been read back;
 the original component packagers produced those assets. Focused component and

@@ -14,12 +14,14 @@ upstream history, authorship, licenses, and notices.
 ## Current source candidate
 
 Server `v1.6.522` is a prepared source candidate, not a published image. It targets
-released Web Console `1.6.183` and Orchestration Engine `v0.183.339`. Registration
+released Web Console `1.6.183` and Orchestration Engine `v0.183.340`. Registration
 tokens use their dedicated Basic authentication route. Add-host access follows
 the form's actual operation: Custom requires RegistrationToken POST; built-in
 and Other drivers require Host POST. Cancel / Go Back retains the return route
 across driver changes and API-host settings refresh, with Hosts as the fallback
 for a missing or self-referencing target.
+Native project creation with a legacy or full API Key also retains the creator's
+initial membership and default networks, without granting unrelated resources.
 Component validation and official asset readback have passed; final Server image
 publication, its native registration gate and active-node acceptance remain pending.
 The published Server remains

@@ -8,8 +8,8 @@ runtime gates have passed.
 ## Release notes
 
 - [Server v1.6.522 candidate](releases/server-1.6.522.md) — prepared source using
-  released Engine `0.183.339` and Web Console `1.6.183`; dedicated registration
-  authentication and schema-bound add-host access/navigation. Component checks
+  released Engine `0.183.340` and Web Console `1.6.183`; dedicated registration
+  authentication, native Key project creation and schema-bound add-host access/navigation. Component checks
   passed; the final Server image, native registration gate and active-node
   acceptance remain pending. It is not a published image.
 

@@ -1,7 +1,7 @@
 # Server v1.6.522 candidate
 
 Prepared source only; no Server image or release has been published.
-The candidate uses released Engine `v0.183.339` and Web Console `1.6.183`.
+The candidate uses released Engine `v0.183.340` and Web Console `1.6.183`.
 The published Server remains `v1.6.521`.
 
 ## Minimal onboarding changes
@@ -11,6 +11,14 @@ registration lookup before ordinary API Key authentication. A rejected native
 token does not fall through to an API Key or browser session. This does not
 broaden the register schema, API Key permissions or account RBAC.
 
+The formal publication gate also exposed a project-create lifecycle regression:
+the new project inherited the user kind, and ordinary Key authorization ran
+before its initial owner membership existed. Engine340 sets project kind before
+INSERT and binds the initial account/member/default-network work to the actual
+manager-created project. Legacy/full Keys retain native creation; custom policies
+do not gain this exception. After the manager scope closes, live owner membership
+is mandatory. Existing volume/instance process rules remain unchanged.
+
 Web Console gates each add-host form by its actual submission path: Custom
 creates a RegistrationToken and requires RegistrationToken POST; built-in and
 Other driver forms create a Host and require Host POST. Machine POST alone does
@@ -26,9 +34,9 @@ unchanged; this is not the broader API Key integration candidate.
 
 ## Released component inputs
 
-Engine `v0.183.339` uses source
-`436a37215bc5702e516ecf1feb6753b4be5bf602`; official `cattle.jar` SHA-256 is
-`bce020a298ebb89ef3d14ba0666f040e4a732288d1b100da9859dcf957a7981d`.
+Engine `v0.183.340` uses source
+`ff0a41e7676211043eb4f755a306a9e2a19abee1`; official `cattle.jar` SHA-256 is
+`5e5a1b908b43bf3824fc3bb2108bd661cd5199ce9bcfd187e0b18b5608a38cea`.
 Web Console `1.6.183` uses normally merged source
 `e056a0111d20816742eff17a65dfabb5d003dae2`; official
 `web-console-1.6.183.tar.gz` SHA-256 is
@@ -58,6 +66,9 @@ the new version is not permission to widen or reset them.
 Eleven focused native-schema and return-history component cases and the native
 add-host UI checks passed on the component source/tree used for the released
 Web bundle. They validate the component changes only, not a final Server image.
+The 34 focused Engine340 creation/authority tests passed, and their compiled
+classes match the packaged clean-main artifact. The unchanged registration
+tests are carried by identical source and compiled classes, not rerun.
 
 The final Server's seven-check native registration gate remains pending. It must
 verify native token creation and readiness, generated script retrieval,

@@ -1068,12 +1068,12 @@ require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
     SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING
 for release_engine_marker in \
-    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.339' \
+    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.340' \
     'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar' \
-    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=bce020a298ebb89ef3d14ba0666f040e4a732288d1b100da9859dcf957a7981d' \
-    'ARG ORCHESTRATION_ENGINE_COMMIT=436a37215bc5702e516ecf1feb6753b4be5bf602' \
+    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=5e5a1b908b43bf3824fc3bb2108bd661cd5199ce9bcfd187e0b18b5608a38cea' \
+    'ARG ORCHESTRATION_ENGINE_COMMIT=ff0a41e7676211043eb4f755a306a9e2a19abee1' \
     'COPY --from=release_artifacts /out/orchestration-engine.jar /tmp/orchestration-engine.jar' \
-    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.339' \
+    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.340' \
     'grep -Fx "Implementation-Version: ${ORCHESTRATION_ENGINE_VERSION}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar' \
@@ -1094,10 +1094,10 @@ for release_engine_marker in \
         SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING
 done
 for release_engine_build_marker in \
-    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.339}' \
+    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.340}' \
     'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}' \
-    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-bce020a298ebb89ef3d14ba0666f040e4a732288d1b100da9859dcf957a7981d}' \
-    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-436a37215bc5702e516ecf1feb6753b4be5bf602}' \
+    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-5e5a1b908b43bf3824fc3bb2108bd661cd5199ce9bcfd187e0b18b5608a38cea}' \
+    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-ff0a41e7676211043eb4f755a306a9e2a19abee1}' \
     'CATTLE_CATTLE_VERSION="${orchestration_engine_release_tag}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     'test "${hazelcast_entry}" = "WEB-INF/lib/hazelcast-5.7.5.jar"'; do
@@ -2259,4 +2259,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.522 base=v1.6.460 engine=0.183.339 web_console=1.6.183 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.7 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.522 base=v1.6.460 engine=0.183.340 web_console=1.6.183 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.7 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
@@ -20,16 +20,16 @@
 WEB_SHA = '8540758ad4521f901f53fc79473570cf98862add2addcb49271d8dbf125b4217'
 WEB_SOURCE = 'e056a0111d20816742eff17a65dfabb5d003dae2'
 CATALOG_COMMIT = 'b6b658888fce50d3ec217eb4eba0f26ab0113baf'
-ENGINE_SHA = 'bce020a298ebb89ef3d14ba0666f040e4a732288d1b100da9859dcf957a7981d'
-ENGINE_SOURCE = '436a37215bc5702e516ecf1feb6753b4be5bf602'
+ENGINE_SHA = '5e5a1b908b43bf3824fc3bb2108bd661cd5199ce9bcfd187e0b18b5608a38cea'
+ENGINE_SOURCE = 'ff0a41e7676211043eb4f755a306a9e2a19abee1'
 OLD_COORDINATES = {
     'v1.6.522': 'v1.6.521',
     '1.6.183': '1.6.181',
     WEB_SHA: '9199681f2c4311f3fbe8727fcf0f6fa136c9bafe9fbe9d13878c55df442a7a03',
     WEB_SOURCE: '7f2bdad0c90a3241693c2ddd4475202ababba550',
     CATALOG_COMMIT: '7670ffd81d5f0b5570197fb03c7e55b46da45bf3',
 }
-# Engine339 and Web183 use independently read-back official release identities.
+# Engine340 and Web183 use independently read-back official release identities.
 # Published521 component values remain mutation controls.
 # Component coordinates do not establish Server522 artifact/runtime PASS.
 CATALOG_FIELDS = (
@@ -41,7 +41,7 @@
     ('LICENSE_SHA256', 'license_sha256', '0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594'),
 )
 LEGACY_ENGINE_COORDINATES = {
-    '0.183.339': '0.183.337',
+    '0.183.340': '0.183.337',
     ENGINE_SHA: '7e45189f2b57097efc7929c04ddf7767aebbe027d1b9f90023aa6711522c5c80',
     ENGINE_SOURCE: 'ba041fe312dfe97fc1e5144af576ddcf1b573d8e',
 }
@@ -80,18 +80,18 @@
 CREATE_RESPONSE_CODES = ['SERVER_WEB_CREATE_IDENTITY_BUILD_GATE_MISSING','SERVER_WEB_CANONICAL_RECORD_BUILD_GATE_MISSING','SERVER_WEB_CREATE_IDENTITY_RUNTIME_GATE_MISSING','SERVER_WEB_CANONICAL_RECORD_RUNTIME_GATE_MISSING']
 ENGINE_EXPECTED = {
     'SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING': (DOCKER, 'release_engine_marker', (
-        'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.339',
+        'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.340',
         'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar',
         'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=' + ENGINE_SHA,
         'ARG ORCHESTRATION_ENGINE_COMMIT=' + ENGINE_SOURCE,
-        'ARG ORCHESTRATION_ENGINE_VERSION=0.183.339',
+        'ARG ORCHESTRATION_ENGINE_VERSION=0.183.340',
         'grep -Fx "Implementation-Version: ${ORCHESTRATION_ENGINE_VERSION}"',
         'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar',
         'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar',
         'ENV CATTLE_CATTLE_VERSION=${ORCHESTRATION_ENGINE_RELEASE_TAG}',
     )),
     'SERVER_INCREMENTAL_ENGINE_BUILD_COORDINATE_MISSING': (BUILD, 'release_engine_build_marker', (
-        'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.339}',
+        'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.340}',
         'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}',
         'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-' + ENGINE_SHA + '}',
         'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-' + ENGINE_SOURCE + '}',
@@ -478,7 +478,7 @@ def verify(files, gate=GATE):
         raise AssertionError('CURRENT_VEX_RELEASE_MISMATCH')
     if json.loads(files[VENDOR]).get('release') != 'v1.6.522':
         raise AssertionError('CURRENT_VENDOR_RELEASE_MISMATCH')
-    if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.522 base=v1.6.460 engine=0.183.339 web_console=1.6.183 catalog_service=0.20.13 ' not in gate:
+    if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.522 base=v1.6.460 engine=0.183.340 web_console=1.6.183 catalog_service=0.20.13 ' not in gate:
         raise AssertionError('CURRENT_SUMMARY_MISMATCH')
     verify_incremental_contract(files, gate)
 
@@ -496,8 +496,8 @@ def previous_gate(gate=GATE):
             'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.521"',
         '"$vendor_pending_fixture" v1.6.522 >/dev/null':
             '"$vendor_pending_fixture" v1.6.521 >/dev/null',
-        'SERVER_API_EXPLORER_PATCH_OK release=v1.6.522 base=v1.6.460 engine=0.183.339 web_console=1.6.183 catalog_service=0.20.13 ':
-            'SERVER_API_EXPLORER_PATCH_OK release=v1.6.521 base=v1.6.460 engine=0.183.339 web_console=1.6.181 catalog_service=0.20.12 ',
+        'SERVER_API_EXPLORER_PATCH_OK release=v1.6.522 base=v1.6.460 engine=0.183.340 web_console=1.6.183 catalog_service=0.20.13 ':
+            'SERVER_API_EXPLORER_PATCH_OK release=v1.6.521 base=v1.6.460 engine=0.183.340 web_console=1.6.181 catalog_service=0.20.12 ',
     })
     for marker, stale_marker in replacements.items():
         if gate.count(marker) != 1:
@@ -919,6 +919,26 @@ def test_each_old_engine_coordinate_rejected(self):
                         verify(files)
         self.assertGreater(checked, 0)
 
+    def test_immediately_previous_engine339_cannot_be_packaged(self):
+        old = {'0.183.340': '0.183.339',
+               ENGINE_SHA: 'bce020a298ebb89ef3d14ba0666f040e4a732288d1b100da9859dcf957a7981d',
+               ENGINE_SOURCE: '436a37215bc5702e516ecf1feb6753b4be5bf602'}
+        checked = 0
+        for code, (name, _, markers) in ENGINE_EXPECTED.items():
+            for marker in markers:
+                previous = marker
+                for current, stale_value in old.items():
+                    previous = previous.replace(current, stale_value)
+                if previous == marker:
+                    continue
+                checked += 1
+                with self.subTest(name=name, marker=marker):
+                    files = dict(FILES)
+                    files[name] = files[name].replace(marker, previous)
+                    with self.assertRaisesRegex(AssertionError, code):
+                        verify(files)
+        self.assertGreater(checked, 0)
+
     def test_previous_fixture_rejects_stale_web179_pins(self):
         gate = previous_gate()
         for code, (_, marker) in EXPECTED.items():

@@ -56,6 +56,14 @@ def test_native_post_is_once_even_if_first_response_fails(self):
                 client.post('/v2-beta/accounts', {'kind': 'user', 'name': 'fresh'}, 'Bearer RAM')
         self.assertEqual(client.request.call_count, 1)
 
+    def test_failed_http_status_is_diagnostic_without_response_or_credentials(self):
+        client = r.Client(r.PORT)
+        client.request = Mock(return_value=(500, b'{"secret":"never print"}', (None, None)))
+        with self.assertRaisesRegex(r.SmokeFailure, 'HTTP_STATUS_500_EXPECTED_201') as failure:
+            client.post('/v2-beta/projects', {'name': 'fresh'}, 'Basic RAM')
+        self.assertNotIn('never print', str(failure.exception))
+        self.assertNotIn('Basic RAM', str(failure.exception))
+
     def test_failure_cannot_echo_secret_and_workflow_reuses_existing_bootstrap(self):
         secret = 'RAM-secret-marker-1234567890'
         output = io.StringIO()

@@ -93,7 +93,7 @@ def request(self, method, path, data=None, auth=None, cookie=None):
 
     def json(self, method, path, data=None, auth=None, cookie=None, expected=200):
         status, raw, principal = self.request(method, path, data, auth, cookie)
-        require(status == expected, 'HTTP_STATUS')
+        require(status == expected, 'HTTP_STATUS_' + str(status) + '_EXPECTED_' + str(expected))
         value = json.loads(raw); require(isinstance(value, dict), 'JSON_OBJECT')
         return value, raw, principal
 

@@ -79,9 +79,9 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.4
 ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=49c4579829a04e758045fae02a5a9fca12bb0ba3af0d5e979cf9eb97f23a88a9
 ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=98c7faea665b7eb95206b8c73a6f47d644c5d2d0eae53f274f6a15faf5205744
 ARG ORCHESTRATION_ENGINE_RELEASE_BASE_URL=https://github.com/PastureStack/orchestration-engine/releases/download
-ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.339
+ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.340
 ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar
-ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=bce020a298ebb89ef3d14ba0666f040e4a732288d1b100da9859dcf957a7981d
+ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=5e5a1b908b43bf3824fc3bb2108bd661cd5199ce9bcfd187e0b18b5608a38cea
 ARG COMPOSE_EXECUTOR_RELEASE_BASE_URL=https://github.com/PastureStack/compose-cli/releases/download
 ARG COMPOSE_EXECUTOR_VERSION=0.14.37
 ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=5ff465601930218f531885a384f231d969033e4cef794ce33d16bfe24e5c1c81
@@ -566,8 +566,8 @@ FROM ${BASE_IMAGE}
 ARG SOURCE_DATE_EPOCH
 ARG PASTURESTACK_SERVER_REVISION
 ARG SERVER_RELEASE_TAG=v1.6.522
-ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.339
-ARG ORCHESTRATION_ENGINE_VERSION=0.183.339
+ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.340
+ARG ORCHESTRATION_ENGINE_VERSION=0.183.340
 ARG ENGINE_READONLY_SCHEMA_SHA256=7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233
 ARG ENGINE_RESTRICTED_SCHEMA_SHA256=f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51
 ARG HOST_API_VERSION=0.38.5
@@ -606,8 +606,8 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.4
 ARG WEBHOOK_AUTOMATION_SERVICE_COMMIT=400118b893843d2a7d7c65cc70c3449d76c4a8d8
 ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=49c4579829a04e758045fae02a5a9fca12bb0ba3af0d5e979cf9eb97f23a88a9
 ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=98c7faea665b7eb95206b8c73a6f47d644c5d2d0eae53f274f6a15faf5205744
-ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=bce020a298ebb89ef3d14ba0666f040e4a732288d1b100da9859dcf957a7981d
-ARG ORCHESTRATION_ENGINE_COMMIT=436a37215bc5702e516ecf1feb6753b4be5bf602
+ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=5e5a1b908b43bf3824fc3bb2108bd661cd5199ce9bcfd187e0b18b5608a38cea
+ARG ORCHESTRATION_ENGINE_COMMIT=ff0a41e7676211043eb4f755a306a9e2a19abee1
 ARG HOST_PROVISIONER_VERSION=0.39.8
 ARG HOST_PROVISIONER_COMMIT=385e5b536c108f17fdfcdec84c01750a5be5ab1c
 ARG HOST_PROVISIONER_ARCHIVE_SHA256=d775f36a613b1a486a5e60d6ad61fdbd1ebb4bd22422cbb6dcb70fdd7c4abf0c

@@ -18,10 +18,10 @@ server_release_tag=${SERVER_RELEASE_TAG:-v1.6.522}
 source_date_epoch=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)}
 base_image=${BASE_IMAGE:-ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403}
 orchestration_engine_release_base_url=${ORCHESTRATION_ENGINE_RELEASE_BASE_URL:-https://github.com/PastureStack/orchestration-engine/releases/download}
-orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.339}
+orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.340}
 orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}
-orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-bce020a298ebb89ef3d14ba0666f040e4a732288d1b100da9859dcf957a7981d}
-orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-436a37215bc5702e516ecf1feb6753b4be5bf602}
+orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-5e5a1b908b43bf3824fc3bb2108bd661cd5199ce9bcfd187e0b18b5608a38cea}
+orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-ff0a41e7676211043eb4f755a306a9e2a19abee1}
 orchestration_engine_version=${orchestration_engine_release_tag#v}
 engine_readonly_schema_sha256=${ENGINE_READONLY_SCHEMA_SHA256:-7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233}
 engine_restricted_schema_sha256=${ENGINE_RESTRICTED_SCHEMA_SHA256:-f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51}