From 22d0e53b0264e358588c5ce23d33bab8181d2bed Mon Sep 17 00:00:00 2001 From: chen21019 Date: Thu, 29 Oct 2026 19:58:30 +0800 Subject: [PATCH] Document published Server 1.6.555 identities --- COMPATIBILITY.md | 31 +++++++++++++++++++++++-------- README.md | 17 ++++++----------- docs/performance/README.md | 4 ++-- docs/releases/server-1.6.555.md | 29 ++++++++++++++++++++++++----- 4 files changed, 55 insertions(+), 26 deletions(-) diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index efa4300fd1..b5daedee3f 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -2,14 +2,29 @@ -## Server v1.6.555 prepared, not published - -This candidate packages Web Console `1.6.197` to restore the authenticated actor -after a fresh-cookie browser session resumes. The human upgrade-plan inbox can -then use the current account identity; the separate authenticated confirmation -requirement is unchanged. Engine `v0.183.355`, role/Key policies, component inputs -and the existing security baseline remain unchanged. No Server555 image or -runtime acceptance is claimed yet. See the [candidate note](docs/releases/server-1.6.555.md). +## Server v1.6.555 published + +The published linux/amd64 image is +`ghcr.io/pasturestack/server:v1.6.555@sha256:59b2335d31c705184a155d21d89ee3be99b71b841d2b674b5d6c4ba656c730cc`, +produced from `db04a4710c4d7019913610afbdd912245dc488d1` in successful +[publisher 40868492262](https://github.com/PastureStack/server/actions/runs/40868492262). +Its distinct OCI config is +`sha256:2ee478ba85bd70d89ed2457bfbc3181e732454d5fcc6ac35df0f3aac2b27e5af`. +All 35 public assets passed anonymous byte/checksum readback. Native provenance +and CycloneDX attestations bind this image, source and publication workflow. +Documentation commits do not change the runtime producer. + +Web Console `1.6.197` restores the authenticated actor after a fresh-cookie +browser session resumes, allowing the human upgrade-plan inbox to load. +Separate human confirmation, Engine `v0.183.355`, role/Key permissions and other +component inputs remain unchanged. See the [release note](docs/releases/server-1.6.555.md). + +The raw runtime scan retains 52 findings; ten Medium package occurrences across +nine officially unfixed CVEs remain tracked for review by November 5, 2026. +Untracked, High/Critical, available-fix and secret counts are zero under the +existing policy. The browser runtime SBOM retains its incomplete coverage. +Scoped 8080 deployment, the complete seven-tool flow and random-marker +persistence across upgrade and restart remain pending. diff --git a/README.md b/README.md index 7e97294dbe..f266f61037 100644 --- a/README.md +++ b/README.md @@ -11,18 +11,14 @@ upstream history, authorship, licenses, and notices. -## Current source candidate +## Current release -Server `v1.6.555` is a prepared source candidate, not a published image. +[Server `v1.6.555`](https://github.com/PastureStack/server/releases/tag/v1.6.555) is published. It packages Web Console `1.6.197`, which restores the authenticated actor when a fresh browser session resumes, so human upgrade-plan review can load. -Engine `v0.183.355`, the dedicated-Key boundary and all other components are -unchanged. See the [candidate note](docs/releases/server-1.6.555.md). - -The current published release is -[Server v1.6.554](https://github.com/PastureStack/server/releases/tag/v1.6.554), -with its [release note](docs/releases/server-1.6.554.md) and -[publication identities and the known UI limitation](COMPATIBILITY.md#server-v16554-webmcp). +Engine `v0.183.355`, dedicated-Key permissions and other components are unchanged. +See the [release note](docs/releases/server-1.6.555.md) and +[verified publication identities](COMPATIBILITY.md#server-v16555-webmcp-actor). Scoped deployment and random-marker data-retention acceptance remain pending. Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host. @@ -58,8 +54,7 @@ operations, audit records and rollback. ## Quick start -These examples target the candidate; run them only after its official release. -This candidate is not yet available from GHCR. Public downloads do not require +These examples use the published numeric version. Public downloads do not require a registry login. Keep all three named volumes. ```sh diff --git a/docs/performance/README.md b/docs/performance/README.md index 87ac6fd6f6..b1dc1df31e 100644 --- a/docs/performance/README.md +++ b/docs/performance/README.md @@ -8,8 +8,8 @@ The following example is appropriate as a starting point for a dedicated 16-vCPU host with about 32 GiB of RAM. It is not a universal performance profile; measure the real workload before increasing it further. -The example targets the Server `v1.6.555` candidate; run it only after its official release and image have been published and read back. -The candidate is not yet available from GHCR. +The example uses the published Server `v1.6.555` numeric tag. +The image and its release assets have passed public identity and checksum readback. See the [release note](../releases/server-1.6.555.md) and the [current release](../../README.md#current-release) for component versions and release details. Preserve the existing runtime overrides and all three named diff --git a/docs/releases/server-1.6.555.md b/docs/releases/server-1.6.555.md index fd66651992..3b86408b17 100644 --- a/docs/releases/server-1.6.555.md +++ b/docs/releases/server-1.6.555.md @@ -1,8 +1,10 @@ -# Server v1.6.555 candidate +# Server v1.6.555 -Prepared source only; no Server image or release has been published. -The release workflow records the final image digest and source -revision only after its required checks pass. +Published image: `ghcr.io/pasturestack/server:v1.6.555@sha256:59b2335d31c705184a155d21d89ee3be99b71b841d2b674b5d6c4ba656c730cc`. + +Source commit: `db04a4710c4d7019913610afbdd912245dc488d1`. + +The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results. ## Verified component inputs @@ -31,7 +33,7 @@ Server555 receives its own image and release; Server554 artifacts are not replac ## Acceptance boundary The Web producer completed its focused session-restoration tests and required -release checks. Server555 must still pass its source, image, startup/restart and +release checks. Server555 has passed its source, image, startup/restart and runtime security gates. The final seven-tool UI flow and a random marker read back across upgrade and restart remain separate 8080 acceptance work. The earlier Server554 publication passed, but its blocked human-inbox flow @@ -39,6 +41,23 @@ does not establish complete runtime acceptance or mounted-data preservation. The 78 panel layout cases and other unaffected producer evidence are retained; this correction does not claim completion of the full permission matrix. +## Publication validation and remaining limits + +[Publisher 40868492262](https://github.com/PastureStack/server/actions/runs/40868492262) +passed the original source, final-image, startup/restart and security checks. +All 35 public assets passed anonymous byte/checksum readback. Native provenance +and CycloneDX attestations bind the exact source and digest above. + +The raw runtime report retains 52 findings; the effective report retains ten +Medium package occurrences across nine officially unfixed CVEs, with review due +November 5, 2026. Untracked, High/Critical, available-fix and secret counts are +zero under the existing policy. Browser runtime coverage remains incomplete; +this is not a claim that every browser component has been fully scanned. + +Scoped 8080 deployment and the complete seven-tool flow, including random-marker +persistence across upgrade and restart, remain pending. Publication does not +establish those deployment-specific results. + ## Activation, upgrade and rollback Follow the [AI collaboration guide](../ai-collaboration.md). Preserve existing