Package Web197 session actor fix in Server 1.6.555

COMPATIBILITY.md

@@ -1,5 +1,16 @@
 # Compatibility Contract
 
+<a id="server-v16555-webmcp-actor"></a>
+
+## Server v1.6.555 prepared, not published
+
+This candidate packages Web Console `1.6.197` to restore the authenticated actor
+after a fresh-cookie browser session resumes. The human upgrade-plan inbox can
+then use the current account identity; the separate authenticated confirmation
+requirement is unchanged. Engine `v0.183.355`, role/Key policies, component inputs
+and the existing security baseline remain unchanged. No Server555 image or
+runtime acceptance is claimed yet. See the [candidate note](docs/releases/server-1.6.555.md).
+
 <a id="server-v16554-webmcp"></a>
 
 ## Server v1.6.554 published
@@ -29,6 +40,9 @@ secret counts are zero under the existing release policy. The browser runtime
 SBOM retains its explicitly incomplete coverage.
 Scoped 8080 deployment, the full seven-tool flow and random-marker persistence
 across upgrade and restart remain pending; publication does not establish those results.
+The fresh-cookie UI restore can leave the authenticated account identity unset
+and block the human inbox. This product issue motivates the separate Server555
+candidate; it does not invalidate the recorded Server554 publication evidence.
 
 <a id="server-v16553-brotli"></a>
 

README.md

@@ -11,16 +11,19 @@ upstream history, authorship, licenses, and notices.
 
 <a id="current-release"></a>
 
-## Current release
+## Current source candidate
 
-[Server `v1.6.554`](https://github.com/PastureStack/server/releases/tag/v1.6.554) is published.
-It integrates Web Console `1.6.196` and Engine `v0.183.355` for optional,
-scoped AI collaboration. New pages start with tools off. Upgrade execution
-requires an authenticated owner's separate confirmation; ordinary API Keys
-retain their existing permissions. It also includes qualified security updates
-for secret delivery and host provisioning. See the [release note](docs/releases/server-1.6.554.md)
-and [verified publication identities](COMPATIBILITY.md#server-v16554-webmcp).
-Scoped deployment and data-retention acceptance on port 8080 remain pending.
+Server `v1.6.555` is a prepared source candidate, not a published image.
+It packages Web Console `1.6.197`, which restores the authenticated actor when
+a fresh browser session resumes, so human upgrade-plan review can load.
+Engine `v0.183.355`, the dedicated-Key boundary and all other components are
+unchanged. See the [candidate note](docs/releases/server-1.6.555.md).
+
+The current published release is
+[Server v1.6.554](https://github.com/PastureStack/server/releases/tag/v1.6.554),
+with its [release note](docs/releases/server-1.6.554.md) and
+[publication identities and the known UI limitation](COMPATIBILITY.md#server-v16554-webmcp).
+Scoped deployment and random-marker data-retention acceptance remain pending.
 
 Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
@@ -55,23 +58,24 @@ operations, audit records and rollback.
 
 ## Quick start
 
-These examples use the published numeric version. Public downloads do not require
+These examples target the candidate; run them only after its official release.
+This candidate is not yet available from GHCR. Public downloads do not require
 a registry login. Keep all three named volumes.
 
 ```sh
 docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.554
+  ghcr.io/pasturestack/server:v1.6.555
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.554
+    image: ghcr.io/pasturestack/server:v1.6.555
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/performance/README.md

@@ -8,9 +8,9 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the published Server `v1.6.554` numeric tag.
-The image and its release assets have passed public identity and checksum readback.
-See the [release note](../releases/server-1.6.554.md) and the
+The example targets the Server `v1.6.555` candidate; run it only after its official release and image have been published and read back.
+The candidate is not yet available from GHCR.
+See the [release note](../releases/server-1.6.555.md) and the
 [current release](../../README.md#current-release) for component versions and
 release details. Preserve the existing runtime overrides and all three named
 volumes during an upgrade or restart.
@@ -21,7 +21,7 @@ evidence is not a performance benchmark; measure the actual workload.
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.554
+    image: ghcr.io/pasturestack/server:v1.6.555
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/releases/server-1.6.555.md

@@ -0,0 +1,49 @@
+# Server v1.6.555 candidate
+
+Prepared source only; no Server image or release has been published.
+The release workflow records the final image digest and source
+revision only after its required checks pass.
+
+## Verified component inputs
+
+- Web Console `1.6.197`: producer `4c18b92c926bdadc66d9da5cb1e1cedb5d5677f3`,
+  archive SHA256 `f45b4c1357199bed491f5a708d6103996f7f03313b6045d3e81f6bb7464fd7ad`.
+- Engine `v0.183.355`: producer `9ea138d1db1718cf65157c9564c379e62bafe9a0`,
+  `cattle.jar` SHA256 `a7f651f84a9fe6deef2c9f66f50c13c70e450e25f9dfa6fb59129b2681f9f54f`.
+- Secret Delivery API `v0.3.4`: producer `705589989f542669b7e60e1fdab8ae2694ed5d5d`,
+  archive SHA256 `941bed664e04f21d84754cd9e06e1d69cec1583ed6dbdadda13567f778605010`.
+- Machine Driver Bundle `v0.16.6`: producer `d5bade2722a788f54fe7f3a25af6245336a1e841`,
+  archive SHA256 `82747659c1c9c866ea0d4b5c8909e36f72445f97f13cdc7324c40f403e28a83d`.
+
+## Fresh browser-session actor restoration
+
+Server554 could resume an authenticated fresh-cookie session while its Web
+Console account identity remained unset. The human upgrade-plan inbox was
+therefore blocked even though authentication was enabled. Web Console 1.6.197
+restores the authenticated actor used by that view. Existing roles, dedicated
+API Key policy/revision checks and separate human confirmation remain intact.
+
+The browser artifact retains the enabled capability ceiling with tools initially
+off. The standalone stdio bridge is unchanged. Engine, other component binaries,
+volume lifecycle behavior and all existing security decisions are unchanged.
+Server555 receives its own image and release; Server554 artifacts are not replaced.
+
+## Acceptance boundary
+
+The Web producer completed its focused session-restoration tests and required
+release checks. Server555 must still pass its source, image, startup/restart and
+runtime security gates. The final seven-tool UI flow and a random marker read
+back across upgrade and restart remain separate 8080 acceptance work.
+The earlier Server554 publication passed, but its blocked human-inbox flow
+does not establish complete runtime acceptance or mounted-data preservation.
+The 78 panel layout cases and other unaffected producer evidence are retained;
+this correction does not claim completion of the full permission matrix.
+
+## Activation, upgrade and rollback
+
+Follow the [AI collaboration guide](../ai-collaboration.md). Preserve existing
+environment values, HTTPS origin, ports, AppArmor, restart policy and all three
+named volumes. Do not use `docker compose down -v`. Upgrade plans still require
+separate authenticated human confirmation; a dedicated bridge Key cannot approve
+its own plan. Keep the previous image and a matching database/volume backup.
+The [API Key rollback requirements](../upgrades/api-key-policy-rollback.md) still apply.

scripts/check-server-api-explorer-patch.sh

@@ -533,7 +533,7 @@ require_marker "$release_dockerfile" \
     SERVER_INCREMENTAL_RELEASE_BASE_MISSING
 for web_sbom_release_marker in \
     'COPY --chmod=0755 artifacts/verify-web-console-sbom.py /usr/local/bin/verify-web-console-sbom' \
-    'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.196-runtime.cdx.json' \
+    'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.197-runtime.cdx.json' \
     '"${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT}" "${WEB_CONSOLE_RUNTIME_SBOM_SHA256}" "${web_sbom}";' \
     '--lock-sha256 "${WEB_CONSOLE_LOCK_SHA256}" --archive "${web_archive}"' \
     '--webmcp-ceiling enabled;' \
@@ -571,7 +571,7 @@ python3 scripts/test-web-console-sbom.py
 python3 server/security/test_web_console_sbom_scan.py
 
 require_marker "$release_dockerfile" \
-    'ARG SERVER_RELEASE_TAG=v1.6.554' \
+    'ARG SERVER_RELEASE_TAG=v1.6.555' \
     SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
 require_marker "$release_dockerfile" \
     'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -629,22 +629,22 @@ require_marker "$publish_workflow" \
     'bash source/server/artifacts/verify-host-api-package.sh' \
     SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.196' \
+    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.197' \
     SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.196.tar.gz' \
+    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.197.tar.gz' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT_SHA256=4f0a550c2754e244cbf77f380c5c138150687988791e063bbf39ce0150d880fa' \
+    'ARG WEB_CONSOLE_ARTIFACT_SHA256=f45b4c1357199bed491f5a708d6103996f7f03313b6045d3e81f6bb7464fd7ad' \
     SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_COMMIT=4e3e4d51db003ef7b456166084d425bfb06e1518' \
+    'ARG WEB_CONSOLE_COMMIT=4c18b92c926bdadc66d9da5cb1e1cedb5d5677f3' \
     SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_LOCK_SHA256=4b9fb2e87352ec76c242b06af3974556b4d7c9f430adb0baccea3f624d3605e6' \
+    'ARG WEB_CONSOLE_LOCK_SHA256=83f664af0919f9ac42c220064a63f6a6f78b5bf7b4ddaf76601d6d973994a464' \
     SERVER_INCREMENTAL_WEB_CONSOLE_LOCK_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=44b6c1940e4fd364e7a634ac2a6168bc2a0ac3d84b07b9adbc4f6fa2d7e743eb' \
+    'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=04476100b2c764963ed71c33dfb4917e8cb8cae70c5ca0d64d4b34a004b17421' \
     SERVER_INCREMENTAL_WEB_CONSOLE_SBOM_HASH_MISSING
 require_marker "$release_dockerfile" \
     "grep -aF 'hostsPage.permissionDenied'" \
@@ -653,22 +653,22 @@ require_marker "$release_dockerfile" \
     '"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING
 require_marker "$build_script" \
-    'web_console_commit=${WEB_CONSOLE_COMMIT:-4e3e4d51db003ef7b456166084d425bfb06e1518}' \
+    'web_console_commit=${WEB_CONSOLE_COMMIT:-4c18b92c926bdadc66d9da5cb1e1cedb5d5677f3}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING
 require_marker "$build_script" \
-    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.196}' \
+    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.197}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.196.tar.gz}' \
+    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.197.tar.gz}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING
 require_marker "$build_script" \
-    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-4f0a550c2754e244cbf77f380c5c138150687988791e063bbf39ce0150d880fa}' \
+    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-f45b4c1357199bed491f5a708d6103996f7f03313b6045d3e81f6bb7464fd7ad}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING
 require_marker "$build_script" \
-    'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-4b9fb2e87352ec76c242b06af3974556b4d7c9f430adb0baccea3f624d3605e6}' \
+    'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-83f664af0919f9ac42c220064a63f6a6f78b5bf7b4ddaf76601d6d973994a464}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING
 require_marker "$build_script" \
-    'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-44b6c1940e4fd364e7a634ac2a6168bc2a0ac3d84b07b9adbc4f6fa2d7e743eb}' \
+    'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-04476100b2c764963ed71c33dfb4917e8cb8cae70c5ca0d64d4b34a004b17421}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING
 require_marker "$release_dockerfile" \
     'ARG CATALOG_SERVICE_VERSION=0.20.15' \
@@ -1139,10 +1139,10 @@ require_marker "$build_script" \
     '--file server/Dockerfile.web-compose-release' \
     SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
 require_marker "$build_script" \
-    'image=${IMAGE:-pasturestack-validation/server:v1.6.554}' \
+    'image=${IMAGE:-pasturestack-validation/server:v1.6.555}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.554}' \
+    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.555}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
 require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
@@ -1694,10 +1694,10 @@ fi
 if grep -Fxq '## Current source candidate' README.md; then
     for candidate_readme_marker in \
         '<a id="current-release"></a>' \
-        'Server `v1.6.554` is a prepared source candidate, not a published image.' \
+        'Server `v1.6.555` is a prepared source candidate, not a published image.' \
         'run them only after its official release' \
         'This candidate is not yet available' \
-        'ghcr.io/pasturestack/server:v1.6.554'; do
+        'ghcr.io/pasturestack/server:v1.6.555'; do
         require_marker README.md "$candidate_readme_marker" \
             SERVER_CURRENT_CANDIDATE_README_MISSING
     done
@@ -2303,7 +2303,7 @@ done
 jq -e '
   ["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves
   |   .["@context"] == "https://openvex.dev/ns/v0.2.0"
-  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.554"
+  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.555"
   and (.statements | length) == 56
   and ([.statements[].vulnerability.name] | length == (unique | length))
   and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2341,7 +2341,7 @@ jq -r '
   | @tsv
 ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
 bash "$vendor_pending_validator" "$runtime_vendor_pending" \
-    "$vendor_pending_fixture" v1.6.554 >/dev/null
+    "$vendor_pending_fixture" v1.6.555 >/dev/null
 bash scripts/test-vendor-pending-findings.sh >/dev/null
 rm -f "$vendor_pending_fixture"
 trap - EXIT
@@ -2430,4 +2430,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.554 base=v1.6.460 engine=0.183.355 web_console=1.6.196 catalog_service=0.20.15 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.555 base=v1.6.460 engine=0.183.355 web_console=1.6.197 catalog_service=0.20.15 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'