From ca8ac08eeeea68d1df4dd3f17ca967520214e949 Mon Sep 17 00:00:00 2001 From: chen21019 Date: Fri, 30 Oct 2026 10:09:58 +0800 Subject: [PATCH] docs: restore Server560 publication renderer boundary --- docs/releases/server-1.6.560.md | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/docs/releases/server-1.6.560.md b/docs/releases/server-1.6.560.md index b2e862d104..a288bd1d46 100644 --- a/docs/releases/server-1.6.560.md +++ b/docs/releases/server-1.6.560.md @@ -5,6 +5,18 @@ Both components passed required CI, same-tree merge and immutable publication. All original public asset bytes were read back anonymously. Server assembly and designated live acceptance remain separate pending gates. +## Verified component inputs + +- Web 1.6.201 / bridge 0.2.3 producer: `24715414f143e2c58cf53084bd84cbea0922798f`; tag source `18acf40d85061533762e8d0d1b9c1f7be69afe9c`. +- Web archive SHA256: `5bc8142d9322657c5cbae782756c3aa5a45b6537074de8749066492fa8947eb8`. +- Runtime SBOM SHA256: `8b837eb330b9815df48b4256d3bf0c4e215864b996e2be40dd707ec532872503`; lock `d255b74a835ab7c0224d12613baacdf021d8b30d46204a71c22d57f35725666f`. +- Bridge archive SHA256: `aad5cadfd3806b0f2c7339a1585a6bd19f3e61585af91dd4da119514775e7e93`; 13 published assets verified. +- Engine v0.183.360 producer: `72230c8b471312377bae968c0c17d63e8ad97ffb`; tag source `d6845eedd1df5ae8e69cc075d80b166bc8d26731`. +- Engine JAR SHA256: `0ebbd517ee43e113f29cbc14fe542aa7c7900ae28d65d63a12c348b7f0ac9a21`; runtime SBOM `088ce2b94ea1c30a6d1e52e600d2ef45258aeb26cdded784407a91020a19f474`. +- Original Engine CI: 408 suites / 3822 tests / zero failure or error / one existing skip; 12 published assets verified. +- Engine provenance is original GitHub artifact/source/tree evidence; its workflow supplies no native SLSA attestation. +- Catalog 0.20.17 and Compose 0.14.40 retain the qualified original pins from Server559; other component/package inputs are unchanged. + ## Behavior and owner boundaries The matching Web Console 1.6.201 / bridge 0.2.3 and Engine 0.183.360 add bounded @@ -40,7 +52,7 @@ launch/Archive, new domains, affected Key/role/cross-ID, layouts and weak-model cases remain pending. Retain only unaffected immutable evidence. The baseline remains 243 business groups and 3,089 frontend inventory rows; -this candidate does not complete that inventory. Browser SBOM coverage retains +this release does not complete that inventory. Browser SBOM coverage retains its recorded limits. KVM HOLD and explicit human ceremonies are not API grants. ## Upgrade and rollback @@ -55,15 +67,3 @@ may be required for rollback. Do not delete volumes or plan receipts. Production, HAProxy, firewall and production data are outside this QA change. Official Brotli package proof and all other package gates remain exact. No VEX scope expansion or weakened security threshold is introduced. - -## Qualified component coordinates - -- Web 1.6.201 / bridge 0.2.3 producer: `24715414f143e2c58cf53084bd84cbea0922798f`; tag source `18acf40d85061533762e8d0d1b9c1f7be69afe9c`. -- Web archive SHA256: `5bc8142d9322657c5cbae782756c3aa5a45b6537074de8749066492fa8947eb8`. -- Runtime SBOM SHA256: `8b837eb330b9815df48b4256d3bf0c4e215864b996e2be40dd707ec532872503`; lock `d255b74a835ab7c0224d12613baacdf021d8b30d46204a71c22d57f35725666f`. -- Bridge archive SHA256: `aad5cadfd3806b0f2c7339a1585a6bd19f3e61585af91dd4da119514775e7e93`; 13 published assets verified. -- Engine v0.183.360 producer: `72230c8b471312377bae968c0c17d63e8ad97ffb`; tag source `d6845eedd1df5ae8e69cc075d80b166bc8d26731`. -- Engine JAR SHA256: `0ebbd517ee43e113f29cbc14fe542aa7c7900ae28d65d63a12c348b7f0ac9a21`; runtime SBOM `088ce2b94ea1c30a6d1e52e600d2ef45258aeb26cdded784407a91020a19f474`. -- Original Engine CI: 408 suites / 3822 tests / zero failure or error / one existing skip; 12 published assets verified. -- Engine provenance is original GitHub artifact/source/tree evidence; its workflow supplies no native SLSA attestation. -- Catalog 0.20.17 and Compose 0.14.40 retain the qualified original pins from Server559; other component/package inputs are unchanged.