Skip to content

Document published Server 1.6.554 identities #383

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chen21019 merged 2 commits into from
Oct 29, 2026
Merged

Document published Server 1.6.554 identities #383

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bba236b
Document verified Server 1.6.554 publication
chen21019 Oct 29, 2026
20bddd3
Align published installation document references
chen21019 Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 21 additions & 4 deletions COMPATIBILITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,33 @@

<a id="server-v16554-webmcp"></a>

## Server v1.6.554 prepared, not published
## Server v1.6.554 published

The candidate integrates Web Console `1.6.196` and Engine `v0.183.355`.
The published linux/amd64 image is
`ghcr.io/pasturestack/server:v1.6.554@sha256:8fa087166970ca3670ad4a19b5b90a313041adb503f1a4be9d459e65bc8248a1`,
produced from `25f5f40f852d7c0cb97b8776bd832d6fce3a89e5` in successful
[publisher 40862854807](https://github.com/PastureStack/server/actions/runs/40862854807).
Its distinct OCI config is
`sha256:249e90384126e9dea1f4d150eb4aeb5be66696f73339c655c7931891b8a0a6ad`.
All 35 public assets passed anonymous byte/checksum readback; image provenance
and CycloneDX attestations match this exact digest, source and publication workflow.
Documentation commits do not change the runtime producer.

The release integrates Web Console `1.6.196` and Engine `v0.183.355`.
The build verifies the browser's enabled capability ceiling and off initial
mode against the exact archive. Backend activation remains explicit.
Seven typed tools share current RBAC and per-Key policy checks; service-upgrade
plans require separate authenticated human approval. No general action proxy
or approval tool is exposed. See the [candidate note](docs/releases/server-1.6.554.md)
or approval tool is exposed. See the [release note](docs/releases/server-1.6.554.md)
and [AI collaboration guide](docs/ai-collaboration.md).
Final publication identities and 8080 acceptance will be recorded after release.

The raw runtime report retains 52 findings. The qualified effective report
retains ten Medium package occurrences across nine officially unfixed CVEs,
reviewed again by November 5, 2026. Untracked, High/Critical, available-fix and
secret counts are zero under the existing release policy. The browser runtime
SBOM retains its explicitly incomplete coverage.
Scoped 8080 deployment, the full seven-tool flow and random-marker persistence
across upgrade and restart remain pending; publication does not establish those results.

<a id="server-v16553-brotli"></a>

Expand Down
16 changes: 6 additions & 10 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,19 +11,16 @@ upstream history, authorship, licenses, and notices.

<a id="current-release"></a>

## Current source candidate
## Current release

Server `v1.6.554` is a prepared source candidate, not a published image.
[Server `v1.6.554`](https://github.com/PastureStack/server/releases/tag/v1.6.554) is published.
It integrates Web Console `1.6.196` and Engine `v0.183.355` for optional,
scoped AI collaboration. New pages start with tools off. Upgrade execution
requires an authenticated owner's separate confirmation; ordinary API Keys
retain their existing permissions. It also includes qualified security updates
for secret delivery and host provisioning. See the [candidate note](docs/releases/server-1.6.554.md).

The previous published release is
[Server v1.6.553](https://github.com/PastureStack/server/releases/tag/v1.6.553),
with its [release note](docs/releases/server-1.6.553.md) and
[immutable identities](COMPATIBILITY.md#server-v16553-brotli).
for secret delivery and host provisioning. See the [release note](docs/releases/server-1.6.554.md)
and [verified publication identities](COMPATIBILITY.md#server-v16554-webmcp).
Scoped deployment and data-retention acceptance on port 8080 remain pending.

Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.

Expand Down Expand Up @@ -58,8 +55,7 @@ operations, audit records and rollback.

## Quick start

These examples target the candidate; run them only after its official release.
This candidate is not yet available from GHCR. Public downloads do not require
These examples use the published numeric version. Public downloads do not require
a registry login. Keep all three named volumes.

```sh
Expand Down
4 changes: 2 additions & 2 deletions docs/performance/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ The following example is appropriate as a starting point for a dedicated
16-vCPU host with about 32 GiB of RAM. It is not a universal performance
profile; measure the real workload before increasing it further.

The example targets the Server `v1.6.554` candidate; run it only after its official release and image have been published and read back.
The candidate is not yet available from GHCR.
The example uses the published Server `v1.6.554` numeric tag.
The image and its release assets have passed public identity and checksum readback.
See the [release note](../releases/server-1.6.554.md) and the
[current release](../../README.md#current-release) for component versions and
release details. Preserve the existing runtime overrides and all three named
Expand Down
27 changes: 23 additions & 4 deletions docs/releases/server-1.6.554.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
# Server v1.6.554 candidate
# Server v1.6.554

Prepared source only; no Server image or release has been published.
The release workflow records the final image digest and source
revision only after its required checks pass.
Published image: `ghcr.io/pasturestack/server:v1.6.554@sha256:8fa087166970ca3670ad4a19b5b90a313041adb503f1a4be9d459e65bc8248a1`.

Source commit: `25f5f40f852d7c0cb97b8776bd832d6fce3a89e5`.

The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.

## Verified component inputs

Expand Down Expand Up @@ -54,6 +56,23 @@ new tools and affected UI, not completion of every existing frontend feature or
the entire planned permission matrix. Rejected pre-confirmation requests are
expected negative tests, not successful upgrades.

## Publication validation and remaining limits

[Publisher 40862854807](https://github.com/PastureStack/server/actions/runs/40862854807)
passed source, final-image, startup/restart and security checks. All 35 public
assets passed anonymous byte/checksum readback. Native image provenance and
CycloneDX attestations bind the exact source and digest above.

The raw runtime report retains 52 findings; the effective report retains ten
Medium package occurrences across nine officially unfixed CVEs, with review due
November 5, 2026. Untracked, High/Critical, available-fix and secret counts are
zero under the existing policy. The independent browser runtime SBOM retains
its incomplete coverage; supported npm components have no reported finding.

Scoped 8080 deployment and the full seven-tool flow, including random-marker
persistence across upgrade and restart, remain pending. These publication
checks do not establish deployment-specific data retention.

## Activation, upgrade and rollback

Follow the [AI collaboration guide](../ai-collaboration.md) for the opt-in backend
Expand Down