chen21019 · Oct 29, 2026 · Oct 29, 2026
@@ -1,5 +1,15 @@
 # Compatibility Contract
 
+## Server v1.6.558 source candidate
+
+The candidate retains Web Console 1.6.199 and bridge 0.2.1, using the qualified
+Engine 0.183.358 artifact to fix scoped managed retirement and native name-query
+pagination. Ordinary Full access, live actor ceilings and explicit child DENY
+remain authoritative. See the [candidate note](docs/releases/server-1.6.558.md)
+for component inputs, required runtime acceptance and rollback. It is not yet
+a published deployment; install examples remain on the published 557 image.
+
+
 <a id="server-v16557-typed-read-fixes"></a>
 
 ## Server v1.6.557 published

@@ -0,0 +1,59 @@
+# Server v1.6.558 candidate
+
+Not yet published. Install examples remain on the verified published 557 image
+until immutable 558 publication is verified. New runtime acceptance is pending.
+
+## Verified component inputs
+
+- Engine `v0.183.358`, original CI producer `1da1f4c37fe43b8c387045c263d286f7db01c574`,
+  merged/tag source `50569f39f241216d38661f49828dec0d925bb605`, JAR SHA256 `46ad548c6e284a7758eb7f65c85fb5878e2ebdc861ef5c396a00a6510709b733`.
+  Required CodeQL and [Security run 40939424603](https://github.com/PastureStack/orchestration-engine/actions/runs/40939424603) passed.
+  374 suites, 3631 tests,
+  0 failures and 0 errors;
+  conditional skips: 1.
+- Web Console `1.6.199`, producer `80a47df65f6406087b80aa81cfa99fe1f438ecff`,
+  archive SHA256 `ab60d4baa10685021b74db09b805dee1f866e9bd0fbccea4d54610df907c7570`.
+- Optional bridge `0.2.1`, ZIP SHA256
+  `f1477b74da0caefd7fcef77609b55b7d172683bda4afe3ffb884dfdf5a63dfae`.
+  Other component pins are unchanged. Catalog launch and Archive work are not included.
+
+## Corrected behavior
+
+Service reconciliation may retire a managed service/instance mapping before an
+asynchronous stop/remove checks its scoped Key. Preserve only the exact
+engine-captured scheduling ancestry, while rechecking current owner, role, Key,
+expiry, policy revision and explicit child DENY. Named/file volume deactivation
+keeps its existing safe path; only the exact private instance OS volume can
+inherit destructive cleanup. No historical row or caller body grants authority.
+Previously cancelled jobs are not automatically replayed or retrospectively authorized.
+
+Typed name search now filters through the normal authorized native owner before
+pagination. In-memory owners filter their authorized projections before taking
+a page. Late-row resources and literal wildcard characters no longer cause
+repeated empty pages. Ordinary Full/legacy API contracts remain unchanged.
+
+## Acceptance and rollback boundary
+
+The original 557 full workflow failed during scale-down after six verified
+operations and seven normal human approvals. Its raw failure and exact fixture
+ledger remain recorded. The real weak-model search failure is also retained;
+the model did not invent a successful result. Fourteen focused lifecycle and
+three actual H2/native-query regression cases passed for this patch.
+
+The designated 8080 installation must complete a fresh full affected lifecycle
+journey and the five real weak-model cases. The six original weak fixtures may
+be reused only by their exact UUID/name/project/readback ledger; no duplicate
+test data or replay of an uncertain apply is needed. Unaffected role/read and
+Web199 layout evidence carries forward with its original scope, not as a new
+whole-matrix PASS. Other frontend workflows, advanced forms and KVM HOLD remain
+separately tracked. No production origin, firewall or authentication policy changes.
+
+Back up the database, preserve all named volumes and genuine operator overrides,
+and retain the previous image. Keep existing AI opt-in properties, HTTPS origin,
+security and performance settings. No database migration is added. Before rollback,
+stop new clients, settle accepted work, cancel unused plans and revoke temporary
+Keys. Preserve durable receipts and never replay uncertain operations. See the
+[Key-policy rollback guide](../upgrades/api-key-policy-rollback.md).
+Officially unfixed Medium findings retain exact package tracking; applicable
+fixed, High/Critical, secret or untracked findings still block publication.
+Browser SBOM coverage remains explicitly incomplete.
@@ -571,7 +571,7 @@ python3 scripts/test-web-console-sbom.py
 python3 server/security/test_web_console_sbom_scan.py
 
 require_marker "$release_dockerfile" \
-    'ARG SERVER_RELEASE_TAG=v1.6.557' \
+    'ARG SERVER_RELEASE_TAG=v1.6.558' \
     SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
 require_marker "$release_dockerfile" \
     'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -1139,21 +1139,21 @@ require_marker "$build_script" \
     '--file server/Dockerfile.web-compose-release' \
     SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
 require_marker "$build_script" \
-    'image=${IMAGE:-pasturestack-validation/server:v1.6.557}' \
+    'image=${IMAGE:-pasturestack-validation/server:v1.6.558}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.557}' \
+    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.558}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
 require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
     SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING
 for release_engine_marker in \
-    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.357' \
+    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.358' \
     'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar' \
-    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=a46e832314b32292e3423133168020acf93052a7dd29e967bbaabc3df6dca8dc' \
-    'ARG ORCHESTRATION_ENGINE_COMMIT=2cd688b0c066658c41e7d3de5bed8c543687f275' \
+    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=46ad548c6e284a7758eb7f65c85fb5878e2ebdc861ef5c396a00a6510709b733' \
+    'ARG ORCHESTRATION_ENGINE_COMMIT=1da1f4c37fe43b8c387045c263d286f7db01c574' \
     'COPY --from=release_artifacts /out/orchestration-engine.jar /tmp/orchestration-engine.jar' \
-    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.357' \
+    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.358' \
     'sh /usr/share/cattle/verify-engine-archive.sh "${archive}" "${ORCHESTRATION_ENGINE_VERSION}" "${ORCHESTRATION_ENGINE_ARTIFACT_SHA256}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar' \
@@ -1172,10 +1172,10 @@ for release_engine_marker in \
         SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING
 done
 for release_engine_build_marker in \
-    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.357}' \
+    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.358}' \
     'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}' \
-    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-a46e832314b32292e3423133168020acf93052a7dd29e967bbaabc3df6dca8dc}' \
-    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-2cd688b0c066658c41e7d3de5bed8c543687f275}' \
+    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-46ad548c6e284a7758eb7f65c85fb5878e2ebdc861ef5c396a00a6510709b733}' \
+    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-1da1f4c37fe43b8c387045c263d286f7db01c574}' \
     'CATTLE_CATTLE_VERSION="${orchestration_engine_release_tag}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     '< "${server_dir}/artifacts/verify-engine-archive.sh"'; do
@@ -1694,10 +1694,10 @@ fi
 if grep -Fxq '## Current source candidate' README.md; then
     for candidate_readme_marker in \
         '<a id="current-release"></a>' \
-        'Server `v1.6.557` is a prepared source candidate, not a published image.' \
+        'Server `v1.6.558` is a prepared source candidate, not a published image.' \
         'run them only after its official release' \
         'This candidate is not yet available' \
-        'ghcr.io/pasturestack/server:v1.6.557'; do
+        'ghcr.io/pasturestack/server:v1.6.558'; do
         require_marker README.md "$candidate_readme_marker" \
             SERVER_CURRENT_CANDIDATE_README_MISSING
     done
@@ -2303,7 +2303,7 @@ done
 jq -e '
   ["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves
   |   .["@context"] == "https://openvex.dev/ns/v0.2.0"
-  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.557"
+  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.558"
   and (.statements | length) == 56
   and ([.statements[].vulnerability.name] | length == (unique | length))
   and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2341,7 +2341,7 @@ jq -r '
   | @tsv
 ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
 bash "$vendor_pending_validator" "$runtime_vendor_pending" \
-    "$vendor_pending_fixture" v1.6.557 >/dev/null
+    "$vendor_pending_fixture" v1.6.558 >/dev/null
 bash scripts/test-vendor-pending-findings.sh >/dev/null
 rm -f "$vendor_pending_fixture"
 trap - EXIT
@@ -2430,4 +2430,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.557 base=v1.6.460 engine=0.183.357 web_console=1.6.199 catalog_service=0.20.15 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.558 base=v1.6.460 engine=0.183.358 web_console=1.6.199 catalog_service=0.20.15 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'