Align Server 550 install documentation with verified deployment

COMPATIBILITY.md

@@ -1,15 +1,34 @@
 # Compatibility Contract
 
-## Server v1.6.550 prepared, not published
-
-The source candidate preserves all component versions and operator settings from
-549 while rebuilding the two PCRE2 runtime packages with the upstream's official
-10.46 backports. Original Ubuntu packaging, SONAMEs, JIT and POSIX interfaces are
-retained. First-party package version `10.46-1build1+pasturestack.1` distinguishes
-this rebuild from Canonical binaries. Native upstream tests, exact package
-integrity, ELF hashes and actual consumers are mandatory gates. The published
-installation remains 549 until a new immutable image passes publication.
-See [the candidate note](docs/releases/server-1.6.550.md).
+<a id="server-v16550-pcre2-backports"></a>
+
+## Server v1.6.550 published
+
+The immutable one-layer linux/amd64 identity is
+`ghcr.io/pasturestack/server:v1.6.550@sha256:03542028c3ce4be11d7ff87f96beddf5179c67caf9f0d28ad57043acf3cf52c5`,
+produced from `54deb98ee33ffab78437070d61179b602844182e` in
+[run 40116218929](https://github.com/PastureStack/server/actions/runs/40116218929).
+All 34 assets passed anonymous checksum readback; both image provenance and SBOM
+attestations bind the same digest and producer. The original job remains failed
+at its final release-note heading check. The exact signed image and original CI
+bytes completed publication without a rebuild or tag overwrite; see the immutable
+[completion receipt](https://github.com/PastureStack/server/releases/download/v1.6.550/publication-recovery.json).
+The permanent note preflight now validates the actual candidate document.
+
+The two PCRE2 packages use first-party `10.46-1build1+pasturestack.1`, built from
+original Ubuntu source/packaging with the complete supported upstream backport
+series. They are not issued by Canonical. Original native tests, package-owned
+bytes, SONAMEs, hardening, both library hashes and five actual consumers passed.
+The deployed image also passed MariaDB regex controls and one controlled restart,
+with the existing HostConfig, environment, three data volumes, socket bind,
+AppArmor and the 549 rollback container retained. Three Host/Agent states remain
+active. No production site, proxy or firewall was changed.
+
+The fresh runtime scan retains 51 raw occurrences, 38 exact VEX dispositions and
+13 pending LOW/MEDIUM occurrences across 10 CVEs. Eight PCRE2 CVEs are fixed;
+other artifacts and build-host SDKs are tracked separately. Browser component
+pins and its incomplete coverage are unchanged. This is scoped acceptance, not
+an all-feature or all-project zero-risk claim. See [the release note](docs/releases/server-1.6.550.md).
 
 <a id="server-v16549-web-console-sbom"></a>
 

README.md

@@ -13,27 +13,20 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-Server [`v1.6.549`](https://github.com/PastureStack/server/releases/tag/v1.6.549) is published.
-It packages Web Console `1.6.195` with an independent browser runtime SBOM,
-exact artifact identity and component vulnerability lookup. All 34 immutable
-release assets, the image provenance and SBOM attestations were verified.
-The browser inventory retains incomplete coverage for six unsupported snapshots;
-zero reported browser findings is not a claim of zero risk.
-
-Engine `v0.183.354`, Catalog `v0.3.16`, Host API `0.38.8`, Node Agent `0.13.33`
-and Temurin `25.0.5+8` retain their reviewed inputs. Authentication, API Key
-authorization, host registration and operator settings remain unchanged.
-The scoped 8080 upgrade, packaged SBOM readback, browser authentication,
-seven JSON APIs, session refresh and WebSocket smoke passed with the existing
-configuration and volumes preserved. This is not a full feature-matrix claim.
-See the [549 release note](docs/releases/server-1.6.549.md) and
-[compatibility contract](COMPATIBILITY.md#server-v16549-web-console-sbom)
-for exact identities, attachment recovery and acceptance boundaries.
-
-Source candidate `v1.6.550` adds the official PCRE2 10.46 security backports with
-original Ubuntu packaging, ABI checks and native regression tests. It is not yet
-published; installation examples continue to use the verified release above.
-See the [candidate note](docs/releases/server-1.6.550.md).
+Server [`v1.6.550`](https://github.com/PastureStack/server/releases/tag/v1.6.550) is published.
+It fixes eight PCRE2 CVEs using the upstream-supported 10.46 backports and
+original Ubuntu packaging. The two rebuilt runtime packages retain ABI, JIT,
+POSIX interfaces and hardening; all other component versions are unchanged.
+
+Web Console `1.6.195` and its original runtime SBOM, Engine `v0.183.354`,
+Host API `0.38.8` and Temurin `25.0.5+8` retain their verified inputs.
+The scoped 8080 upgrade and restart passed package/hash/linkage checks,
+regex controls in grep, Git and MariaDB, and three active Host/Agent states.
+Existing configuration, volumes, AppArmor and the previous rollback image remain.
+
+See the [550 release note](docs/releases/server-1.6.550.md) and
+[compatibility contract](COMPATIBILITY.md#server-v16550-pcre2-backports)
+for the immutable identity, publication completion and remaining risks.
 
 Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
@@ -60,22 +53,22 @@ Maintained CLI `0.6.20` propagates rejected requests as nonzero errors. Legacy `
 ## Quick start
 
 Public GHCR downloads do not require a registry login. Keep all three named volumes.
-The examples below use the published numeric `v1.6.549` tag.
+The examples below use the published numeric `v1.6.550` tag.
 
 ```sh
 docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.549
+  ghcr.io/pasturestack/server:v1.6.550
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.549
+    image: ghcr.io/pasturestack/server:v1.6.550
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/performance/README.md

@@ -20,7 +20,7 @@ evidence is not a performance benchmark; measure the actual workload.
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.549
+    image: ghcr.io/pasturestack/server:v1.6.550
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/releases/server-1.6.550.md

@@ -1,48 +1,64 @@
-# Server v1.6.550 candidate
+# Server v1.6.550
 
-Prepared source only; no Server image or release has been published.
+Published image:
+`ghcr.io/pasturestack/server:v1.6.550@sha256:03542028c3ce4be11d7ff87f96beddf5179c67caf9f0d28ad57043acf3cf52c5`.
+Producer: `54deb98ee33ffab78437070d61179b602844182e`.
 
 ## Verified component inputs
 
-Backport the twelve official PCRE2 `release/pcre2-10.46` commits through
-`947809f11e9c9744aa0974b4b630a1ae461733dd` onto the original Ubuntu 26.04
-`10.46-1build1` source package. The source, original packaging and every patch
-are SHA-256 pinned. This is a first-party rebuild, not a Canonical release.
-It avoids unrelated regex, Unicode, JIT or packaging changes.
+Rebuild only `libpcre2-8-0` and `libpcre2-posix3` from Ubuntu `10.46-1build1`
+with the twelve official `release/pcre2-10.46` backports through
+`947809f11e9c9744aa0974b4b630a1ae461733dd`. Sources and patches are SHA-256 pinned.
+The first-party version `10.46-1build1+pasturestack.1` is not a Canonical release.
+Original packaging, ABI, JIT, POSIX interfaces and hardening remain unchanged.
 
-The two packages `libpcre2-8-0` and `libpcre2-posix3` use version
-`10.46-1build1+pasturestack.1`. The eight fixed vulnerabilities are
-CVE-2026-103111, CVE-2026-86145, CVE-2026-89156, CVE-2026-89157,
+Fixed: CVE-2026-103111, CVE-2026-86145, CVE-2026-89156, CVE-2026-89157,
 CVE-2026-89158, CVE-2026-89160, CVE-2026-89161 and CVE-2026-89162.
-The [official supported backport list](https://github.com/PCRE2Project/pcre2/blob/pcre2-10.49/SUPPORT-LIFECYCLE.md)
-identifies this exact series. Ubuntu having no updated binary package does not
-mean upstream has no accepted fix.
-
-## Verification and boundaries
-
-The build runs the unchanged Ubuntu packaging tests: `pcre2_jit_test`, `RunTest`
-and `RunGrepTest`, and requires all three PASS records. The output retains source
-locks, build logs, native test logs, compiler flags, package identity and ABI /
-hardening evidence. Runtime checks require exact package versions, zero dpkg
-integrity differences, both library hashes, resolved linkage from grep, Git,
-MariaDB, libselinux and the POSIX wrapper, and C / C.utf8 regex controls.
-
-The inherited image's documentation exclusion is overridden only while installing
-the package-owned `README.Debian`; no integrity exception is added. Raw scanner
-results remain intact. The fixed VEX entries apply only to the exact rebuilt
-package PURLs; the other ten pending Server CVEs remain tracked.
-
-Native library and layered-candidate checks have passed on the QA host. These do
-not establish publication or startup/restart acceptance of the final image.
-Those results and the immutable digest will be recorded after the release gates.
-Web Console 1.6.195, its runtime SBOM and all other component pins are unchanged.
-Unrelated role, UI, OIDC, MFA and feature-matrix PASS evidence is carried forward.
+See the [official backport list](https://github.com/PCRE2Project/pcre2/blob/pcre2-10.49/SUPPORT-LIFECYCLE.md).
+Ubuntu lacking an updated package does not mean upstream has no accepted fix.
+Web Console `1.6.195`, its original runtime SBOM, Engine `v0.183.354` and all
+other component inputs remain unchanged. No database migration is introduced.
+
+## Verification and remaining risk
+
+Original native `pcre2_jit_test`, `RunTest` and `RunGrepTest` passed. Fourteen
+builder contracts, five verifier guards, owning assembly checks, exact package
+integrity, both library hashes and five actual consumers passed. C / C.utf8
+regex controls cover ASCII, UTF-8, CRLF and the non-JIT path. The package-owned
+README is retained during installation; integrity differences are not ignored.
+
+The formal producer passed source, rootfs equivalence, startup/restart and fresh
+security checks before pushing and signing the same one-layer image. The scan
+retains 51 raw occurrences, 38 exact VEX dispositions and 13 pending LOW/MEDIUM
+occurrences across 10 CVEs; HIGH/CRITICAL, available distro fixes, unregistered
+findings and secrets are zero. Raw evidence remains available. Other artifacts,
+build-host SDKs and the browser's six unsupported snapshots remain separately
+tracked; this is not a zero-risk or complete-coverage claim.
+
+The scoped 8080 deployment passed first start, one restart, exact package/hash/
+linkage checks, grep/Git controls, two read-only MariaDB regex controls and three
+active Host/Agent states. HostConfig, operator environment, all three data
+volumes, socket bind and AppArmor were preserved. The verified consistent DB
+backup and 549 rollback container/image remain. Unchanged UI, role and
+identity-flow PASS evidence was carried forward; no full feature matrix or
+cross-host network rerun is claimed. The production site, HAProxy and firewall
+were not changed.
+
+## Publication completion
+
+[Run 40116218929](https://github.com/PastureStack/server/actions/runs/40116218929)
+remains failed because the final renderer required a missing candidate-note
+heading. Its tested, signed image was not rebuilt or overwritten. Original CI
+bytes completed publication, all 34 immutable assets passed anonymous SHA-256
+readback, and both attestations were verified. The
+[completion receipt](https://github.com/PastureStack/server/releases/download/v1.6.550/publication-recovery.json)
+records the original archive and note-only correction. A permanent pre-build
+test now validates the actual current note as well as fixtures.
 
 ## Upgrade and rollback
 
-Until publication, continue using the numeric `v1.6.549` installation examples.
-Do not overwrite an existing image tag or apply library patches to a running
-container. Upgrade with a new immutable image after verified backups, preserving
-all existing volumes, configuration and the previous container/image for rollback.
-No database migration or operator setting change is introduced by this patch.
-No production deployment is part of this release task.
+Use the numeric `v1.6.550` tag after verifying backups and image identity. Preserve
+all existing Compose settings, named volumes, restart policy and security options.
+Retain 549 until scoped acceptance succeeds. Do not patch a running container or
+overwrite a release tag. Restore matching backups when an upgrade requires it;
+this PCRE2-only update does not migrate the database.