chen21019 · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026
@@ -1,5 +1,24 @@
 # Compatibility Contract
 
+<a id="server-v16556-typed-resource-flows"></a>
+
+## Server v1.6.556 prepared, not published
+
+Server v1.6.556 source candidate consumes Web Console 1.6.199 (producer
+`80a47df65f6406087b80aa81cfa99fe1f438ecff`) and Engine 0.183.356 (producer
+`24cfa1db113f54de3148cd4ac3191e66a1702806`), retaining the other pinned components.
+The matching optional stdio bridge is 0.2.1. Source and release assets record
+immutable hashes and the same-tree merged identities. Assembly and 8080 runtime
+acceptance remain separate evidence; previous PASS is carried only where unaffected.
+
+The bridge and upgrade properties remain independent of the new opt-in
+`api.ai.resource.change.enabled` property. Basic Stack, Service and Container
+plans use live owner/Key permissions and human review. Global Services reject
+manual scale counts; Stack start/stop preflights its affected children. Advanced
+form fields, Catalog launching and other workflows remain pending adapters.
+Keep ordinary UI/API paths and use the [AI guide](docs/ai-collaboration.md) for
+activation, known boundaries and safe downgrade preparation.
+
 <a id="server-v16555-webmcp-actor"></a>
 
 ## Server v1.6.555 published

@@ -13,13 +13,13 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-[Server `v1.6.555`](https://github.com/PastureStack/server/releases/tag/v1.6.555) is published.
-It packages Web Console `1.6.197`, which restores the authenticated actor when
-a fresh browser session resumes, so human upgrade-plan review can load.
-Engine `v0.183.355`, dedicated-Key permissions and other components are unchanged.
-See the [release note](docs/releases/server-1.6.555.md) and
-[verified publication identities](COMPATIBILITY.md#server-v16555-webmcp-actor).
-Scoped deployment and random-marker data-retention acceptance remain pending.
+[Server `v1.6.555`](https://github.com/PastureStack/server/releases/tag/v1.6.555)
+packages Web Console `1.6.197` and Engine `v0.183.355`. Fresh browser sessions
+restore the authenticated actor for human upgrade-plan review. See the
+[release note](docs/releases/server-1.6.555.md) and
+[publication identities](COMPATIBILITY.md#server-v16555-webmcp-actor).
+Its scoped upgrade, random-marker data-retention, restart and WebSocket
+acceptance is retained separately from subsequent frontend workflow expansion.
 
 Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
@@ -45,12 +45,15 @@ Maintained CLI `0.6.20` propagates rejected requests as nonzero errors. Legacy `
 
 ## Optional AI collaboration
 
-The Web Console provides seven bounded service tools, an explicit per-page
-on/off control and human review of upgrade plans. An optional stdio bridge lets
-compatible clients use a dedicated scoped API Key. Both reuse current account
-permissions; a Key cannot approve its own upgrade. See the
-[AI collaboration guide](docs/ai-collaboration.md) for activation, supported
-operations, audit records and rollback.
+The next Server 1.6.556 source candidate (not yet published) expands to
+Web Console 1.6.199 and Engine 0.183.356. Its Web Console supports scoped resource
+discovery and basic Stack, Service and
+Container changes through twelve tools. Plans require normal human review and
+reuse live account and Key permissions. Global Services do not accept a manual
+instance count. Advanced forms and other resource workflows remain pending.
+See the [candidate note](docs/releases/server-1.6.556.md) and
+[AI collaboration guide](docs/ai-collaboration.md) for activation,
+supported operations, audit records and rollback.
 
 ## Quick start
 

@@ -1,10 +1,13 @@
 # Optional AI collaboration
 
-Server v1.6.554 combines Web Console 1.6.196 and Engine 0.183.355. The supported
-tools are `find_stacks`, `find_services`, `get_service`,
-`update_service_description`, `preview_service_upgrade`,
-`apply_service_upgrade` and `get_operation`. Other platform operations remain
-available through the normal UI/API, not through a generic AI proxy.
+Server v1.6.556 combines Web Console 1.6.199 and Engine 0.183.356. The twelve
+supported tools are `list_capabilities`, `find_resources`, `get_resource`,
+`preview_resource_change`, `apply_resource_change`, `find_stacks`,
+`find_services`, `get_service`, `update_service_description`,
+`preview_service_upgrade`, `apply_service_upgrade` and `get_operation`.
+The capability response distinguishes safe metadata, partial coverage and
+pending adapters. This is not complete WebMCP coverage of the console.
+Other platform operations retain their ordinary UI/API paths.
 
 ## Activation
 
@@ -13,12 +16,33 @@ preserving its other arguments, and recreate only the Server container with
 the same volumes, network, restart policy and security settings:
 
 ```text
--Dapi.ai.service.upgrade.enabled=true -Dapi.ai.bridge.enabled=true
+-Dapi.ai.service.upgrade.enabled=true -Dapi.ai.bridge.enabled=true -Dapi.ai.resource.change.enabled=true
 ```
 
-The first property enables the upgrade-plan API. The second permits dedicated
-AI bridge Keys. Both default to false. Disabling the bridge does not remove
-ordinary account/API Key permissions or alter an ordinary service API.
+The first property enables upgrade plans, the second permits dedicated bridge
+Keys, and the third enables typed resource-change plans. Each defaults to false.
+Disabling a bridge feature does not remove ordinary account/API Key permissions
+or alter an ordinary resource API.
+
+## Supported resource flows
+
+Find visible resources by family and name, select an unambiguous parent when
+names repeat, and use the returned scoped reference for details or a preview.
+The user does not need to enter environment, Stack or Service IDs. Metadata
+projection excludes credential values, private keys, full configurations and
+raw process logs. Selected families remain partial and are labelled as such.
+
+Typed plans support basic creation and metadata editing for Stack, Service and
+Container resources; Stack/Service start and stop; Service/Container restart;
+manual scaling of eligible non-global Services; and removal of those three resource types. Creates currently
+cover name, description, image, scale where applicable, command and entry point.
+They create stopped workloads. Advanced environment, port, mount, hardware,
+security and other UI form fields require subsequent adapters.
+
+The normal human review shows the exact typed changes and mounted-data rules.
+Stopping or removing a workload does not mean every external data directory is
+backed up or retained. Review the existing domain's removal behavior before
+approval. These plans do not add an extra purge of external storage.
 
 The supplied Web Console supports the enabled build profile but starts each
 new page with native browser tools off. Use the header's AI collaboration panel
@@ -46,12 +70,18 @@ Keep the credential file local to that client. The bridge accepts HTTPS, with
 an HTTP exception only for loopback development connections. It does not take
 browser cookies, general-purpose Keys, arbitrary URLs or an approval command.
 
-The client finds a named service and previews the target image. The Key owner
-reviews the target and changes in the normal authenticated UI, then explicitly
+The client previews a typed resource change or image upgrade. The Key owner
+reviews its target and changes in the normal authenticated UI, then explicitly
 approves. The client applies that plan and reads the same operation until
 `verifiedResult=true`. Approval expires; changed targets, policy revisions,
 revocation or lost permissions require a new valid decision. An uncertain
-response is not permission to submit another upgrade.
+response is not permission to submit another operation.
+
+An accepted request is not verified completion. Resource plans check the actual
+managed instances, desired scale, sidekicks and eligible global hosts, including
+retired-instance cleanup. Stack start/stop checks its child services. The human
+inbox can cancel pending or approved-but-unsubmitted plans; closing the review
+dialog does not cancel a plan. Submitted operations cannot be cancelled there.
 
 Description updates use the captured expected description and preserve the
 other service settings. A conflict requires reading the current value again.

@@ -0,0 +1,51 @@
+# Server v1.6.556
+
+This release packages Web Console 1.6.199 and Engine 0.183.356 for opt-in AI
+resource discovery and typed, human-reviewed workload changes. The matching
+stdio source bridge is 0.2.1. Other bundled components retain their existing
+pinned versions. It does not complete every frontend WebMCP workflow.
+
+## Behavior
+
+Five tools extend the existing seven: capability discovery, typed resource
+search, safe details, resource-change preview and approved application.
+Basic Stack/Service/Container creates are stopped. Metadata editing, lifecycle
+and scaling use the existing domain managers and live role/Key authorization.
+Advanced form fields and other resource workflows remain explicitly pending.
+
+Keys cannot approve or cancel their own plans. A human reviews exact changes,
+then the original bound Key can apply one durable operation. Uncertain dispatch
+does not replay. Completion observes child services, the deployment owner's
+desired/global/sidekick units and retired-instance cleanup. Global Services reject manual counts; Stack changes preflight all affected children before dispatch. Human inboxes allow
+unused approved plans to be cancelled before submission.
+
+New controls and errors use all 13 console locales. Dedicated bridge metadata
+reads project only allowlisted fields, retaining live permission and revision
+checks. Credential values, raw logs and full configuration payloads are excluded.
+Ordinary Full/legacy Keys and ordinary UI/API workflows keep their current paths.
+
+## Enabling and qualification
+
+The new `api.ai.resource.change.enabled` property defaults to false, separately
+from the existing bridge and upgrade-plan flags. Preserve existing JVM options,
+Compose environment, named volumes, restart policy, AppArmor and HTTPS origin.
+See [AI collaboration](../ai-collaboration.md) for the supported flow.
+
+Required component CI, CodeQL, artifact/SBOM verification, Server checks and
+8080 browser/lifecycle acceptance are separate results. Exact immutable image
+digest, producer identities and executed acceptance are recorded with release
+assets and the Excel evidence, not inferred from source-level tests. Existing
+unaffected PASS evidence is retained; pending workflows are not promoted.
+
+## Upgrade and rollback
+
+Back up the database and persistent volumes and retain the prior Server image.
+Liquibase adds the private resource-change plan table. Preserve it and existing
+Key-policy and upgrade-plan records on code rollback; do not delete a migration
+or replace named volumes. Stop new AI clients, let accepted work settle, cancel
+unused plans and revoke dedicated bridge Keys before a downgrade. Follow the
+[API Key rollback safety guide](../upgrades/api-key-policy-rollback.md).
+
+Use normal image/Compose deployment. Do not carry a previous image's
+version-owned environment defaults or a static-bundle runtime patch into the
+new image. Genuine operator overrides and persistent data must be preserved.
@@ -90,13 +90,13 @@ ARG PER_HOST_SUBNET_STARTUP_SHA256=f22b41f18d1733c037babed4d2e0474efeedc6017a968
 ARG PER_HOST_SUBNET_PROVENANCE_SHA256=afa2db0e0755c6bd3ee28e111937c521a6d84e6d71d563e99202cf4693000eaf
 
 ARG WEB_CONSOLE_RELEASE_BASE_URL=https://github.com/PastureStack/web-console/releases/download
-ARG WEB_CONSOLE_RELEASE_TAG=1.6.197
-ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.197.tar.gz
-ARG WEB_CONSOLE_ARTIFACT_SHA256=f45b4c1357199bed491f5a708d6103996f7f03313b6045d3e81f6bb7464fd7ad
-ARG WEB_CONSOLE_COMMIT=4c18b92c926bdadc66d9da5cb1e1cedb5d5677f3
-ARG WEB_CONSOLE_LOCK_SHA256=83f664af0919f9ac42c220064a63f6a6f78b5bf7b4ddaf76601d6d973994a464
-ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.197-runtime.cdx.json
-ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=04476100b2c764963ed71c33dfb4917e8cb8cae70c5ca0d64d4b34a004b17421
+ARG WEB_CONSOLE_RELEASE_TAG=1.6.199
+ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.199.tar.gz
+ARG WEB_CONSOLE_ARTIFACT_SHA256=ab60d4baa10685021b74db09b805dee1f866e9bd0fbccea4d54610df907c7570
+ARG WEB_CONSOLE_COMMIT=80a47df65f6406087b80aa81cfa99fe1f438ecff
+ARG WEB_CONSOLE_LOCK_SHA256=e9f88f608cd4d516a69141464a6eb853ec1179bb86415979fad0569cdfa88173
+ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.199-runtime.cdx.json
+ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=324948a11348729a334864c04850a77b2e5c4643546168ee7b8c7289e983ac31
 ARG CATALOG_SERVICE_RELEASE_BASE_URL=https://github.com/PastureStack/catalog-service/releases/download
 ARG CATALOG_SERVICE_VERSION=0.20.15
 ARG CATALOG_SERVICE_COMMIT=6ea547594065f7f95d5877b82f0c1bc553e72640
@@ -118,9 +118,9 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.5
 ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=f2df8874d5a00a2d5713594609063256164ed624d29a733149d00cb271f0f66b
 ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=b98e55db2739ab45119eacc94c8f65cb44371480ebcebec95e5470fd67c72a4c
 ARG ORCHESTRATION_ENGINE_RELEASE_BASE_URL=https://github.com/PastureStack/orchestration-engine/releases/download
-ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.355
+ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.356
 ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar
-ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=a7f651f84a9fe6deef2c9f66f50c13c70e450e25f9dfa6fb59129b2681f9f54f
+ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=dfce4c6df625a905a837770780bd09d871752cf9d8493b590145f84a8c78dd09
 ARG COMPOSE_EXECUTOR_RELEASE_BASE_URL=https://github.com/PastureStack/compose-cli/releases/download
 ARG COMPOSE_EXECUTOR_VERSION=0.14.39
 ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=4ab4685af67a8b8b11f3dd4996de9e087c26391ec401cf02cdcafe4c93094bab
@@ -696,12 +696,12 @@ ARG PER_HOST_SUBNET_VERSION=0.2.5
 ARG PER_HOST_SUBNET_PRODUCER_COMMIT=e102e0bb38d84b0a9cbf87e5458cf1bc74d01904
 ARG PER_HOST_SUBNET_ARCHIVE_SHA256=7237e83e96a64e7f3de64eb86bff9721c4e879c35cda9e9de1e4cb1ba225f298
 ARG PER_HOST_SUBNET_PROVENANCE_SHA256=afa2db0e0755c6bd3ee28e111937c521a6d84e6d71d563e99202cf4693000eaf
-ARG SERVER_RELEASE_TAG=v1.6.555
+ARG SERVER_RELEASE_TAG=v1.6.556
 ARG API_EXPLORER_RELEASE_TAG=v1.1.20
 ARG API_EXPLORER_ARTIFACT_SHA256=c989ee12a518f6d9d2b23b1f17f48d781aacf6ec31fb65291dd7de9b1661badb
 ARG API_EXPLORER_COMMIT=a586f0dc0aa50df579049a8d4bf26f04400fdf75
-ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.355
-ARG ORCHESTRATION_ENGINE_VERSION=0.183.355
+ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.356
+ARG ORCHESTRATION_ENGINE_VERSION=0.183.356
 ARG ENGINE_READONLY_SCHEMA_SHA256=7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233
 ARG ENGINE_RESTRICTED_SCHEMA_SHA256=f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51
 ARG HOST_API_VERSION=0.38.8
@@ -722,11 +722,11 @@ ARG GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4
 ARG GLIBC_RUNTIME_PACKAGE_VERSION=2.43-2ubuntu2.4+pasturestack.1
 ARG PERL_PACKAGE_VERSION=5.40.1-7ubuntu0.3
 ARG PCRE2_PACKAGE_VERSION=10.46-1build1+pasturestack.1
-ARG WEB_CONSOLE_RELEASE_TAG=1.6.197
-ARG WEB_CONSOLE_ARTIFACT_SHA256=f45b4c1357199bed491f5a708d6103996f7f03313b6045d3e81f6bb7464fd7ad
-ARG WEB_CONSOLE_COMMIT=4c18b92c926bdadc66d9da5cb1e1cedb5d5677f3
-ARG WEB_CONSOLE_LOCK_SHA256=83f664af0919f9ac42c220064a63f6a6f78b5bf7b4ddaf76601d6d973994a464
-ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=04476100b2c764963ed71c33dfb4917e8cb8cae70c5ca0d64d4b34a004b17421
+ARG WEB_CONSOLE_RELEASE_TAG=1.6.199
+ARG WEB_CONSOLE_ARTIFACT_SHA256=ab60d4baa10685021b74db09b805dee1f866e9bd0fbccea4d54610df907c7570
+ARG WEB_CONSOLE_COMMIT=80a47df65f6406087b80aa81cfa99fe1f438ecff
+ARG WEB_CONSOLE_LOCK_SHA256=e9f88f608cd4d516a69141464a6eb853ec1179bb86415979fad0569cdfa88173
+ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=324948a11348729a334864c04850a77b2e5c4643546168ee7b8c7289e983ac31
 ARG CATALOG_SERVICE_VERSION=0.20.15
 ARG CATALOG_SERVICE_COMMIT=6ea547594065f7f95d5877b82f0c1bc553e72640
 ARG CATALOG_SERVICE_ARCHIVE_SHA256=7c059101265d897e4b176f503a9217b112946d37d91daa0c40f421fb16e4bb6b
@@ -745,8 +745,8 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.5
 ARG WEBHOOK_AUTOMATION_SERVICE_COMMIT=4da77ccac464bc7f7cd2020e0659a666a5d1ff7e
 ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=f2df8874d5a00a2d5713594609063256164ed624d29a733149d00cb271f0f66b
 ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=b98e55db2739ab45119eacc94c8f65cb44371480ebcebec95e5470fd67c72a4c
-ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=a7f651f84a9fe6deef2c9f66f50c13c70e450e25f9dfa6fb59129b2681f9f54f
-ARG ORCHESTRATION_ENGINE_COMMIT=9ea138d1db1718cf65157c9564c379e62bafe9a0
+ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=dfce4c6df625a905a837770780bd09d871752cf9d8493b590145f84a8c78dd09
+ARG ORCHESTRATION_ENGINE_COMMIT=24cfa1db113f54de3148cd4ac3191e66a1702806
 ARG HOST_PROVISIONER_VERSION=0.39.10
 ARG HOST_PROVISIONER_COMMIT=d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba
 ARG HOST_PROVISIONER_ARCHIVE_SHA256=fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661