diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index 0820181028..c332eff210 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -1,17 +1,41 @@ # Compatibility Contract -## Server v1.6.560 source candidate - -Not yet published. Install examples remain on verified published 559. -The candidate consumes published Web Console 1.6.201 / optional bridge 0.2.3 -and Engine 0.183.360 original CI artifacts. It adds External Service, DNS Alias -and metadata-only audit flows, corrects the Catalog-validator collection -admission and retains audit events across a rejected typed-write transaction. -Native SQL/Key/role checks and unknown-filter denials are preserved. -Catalog 0.20.17 / Compose 0.14.40 and official Brotli package proof are unchanged. -Combined runtime, role, cross-ID, layout, weak-model and durable-DENY acceptance -remain pending. This does not complete the 243-group frontend inventory. -See the [candidate note](docs/releases/server-1.6.560.md) for identities and scope. + + +## Server v1.6.560 published + +Image: `ghcr.io/pasturestack/server:v1.6.560@sha256:2f1533325f8314684b71062a37c9deae891e236b543a5ed7d958d698c21ff332`. +Runtime producer: `48c1a180e19846eb61d8a7ad60f38368e74abae1`. +OCI config: `sha256:45a9d6c22d5660f2a32992f2d43f2c3578b25846456cca4b7087f518f6aacab6`. +[Publisher 40990392489](https://github.com/PastureStack/server/actions/runs/40990392489) +passed its original source/build, security, startup/restart and protocol gates. +All 35 public assets and the OCI digest passed anonymous verification; native +provenance and SBOM attestations passed. Documentation commits do not replace +this producer or rebuild the immutable image. + +The image consumes published Web Console 1.6.201 / optional bridge 0.2.3 and +Engine 0.183.360 original CI artifacts. It adds External Service, DNS Alias and +metadata-only audit flows, corrects the Catalog-validator collection admission +and retains audit decisions across rejected typed transactions. Native SQL/Key/ +role checks and unknown-filter denials remain. Catalog 0.20.17 / Compose 0.14.40 +and official Brotli package proof are unchanged. Engine provenance is its +original CI artifact/source/tree binding, without a native SLSA claim; that is +separate from the Server image's verified native attestations. + +The exact existing package policy retains ten Medium occurrences across nine +officially unfixed CVEs. High/Critical, available-fix, untracked and secret gates +passed. Raw/effective scan results and exact VEX/vendor evidence remain distinct; +passing the gate is not zero reported vulnerabilities. Browser SBOM coverage +remains incomplete. + +Designated QA now runs the published Server560 / Web201 image above. Its 8080 +cutover and one actual restart passed, preserving configuration, mounts, +AppArmor and rollback, with three active Hosts and three active Agents. This is +runtime-baseline evidence; combined Core/Catalog/Archive/new-domain, +role/cross-ID/layout/weak-model and durable-DENY business acceptance remain +pending. Prior failures are retained. This does not complete +the 243-group frontend inventory. See the [release note](docs/releases/server-1.6.560.md) +for verified component inputs and rollback boundaries. diff --git a/README.md b/README.md index 6b3dd8b568..d43f34147e 100644 --- a/README.md +++ b/README.md @@ -13,18 +13,24 @@ upstream history, authorship, licenses, and notices. ## Current release -[Server `v1.6.559`](https://github.com/PastureStack/server/releases/tag/v1.6.559) -packages Web Console `1.6.200`, Engine `v0.183.359`, Catalog `0.20.17` and -Compose `0.14.40`. It adds opt-in Catalog launch and Archive/restore workflows, -scoped lifecycle repairs, and the official Ubuntu Brotli safety package. -See the [release note](docs/releases/server-1.6.559.md) and -[publication identities](COMPATIBILITY.md#server-v16559-publication). - -Publication and designated QA startup/restart checks passed. Three Hosts/Agents -remain active. The full typed resource workflow is not accepted: creating a Stack -succeeds, but its subsequent scoped discovery returns 403. Catalog/Archive -browser and role acceptance remain pending. This is not complete frontend -coverage; unchanged PASS evidence retains only its original scope. +[Server `v1.6.560`](https://github.com/PastureStack/server/releases/tag/v1.6.560) +packages Web Console `1.6.201` / optional bridge `0.2.3`, Engine `v0.183.360`, +Catalog `0.20.17` and Compose `0.14.40`. It adds bounded External Service, DNS +Alias and audit metadata workflows, repairs scoped collection admission and +retains authorization audit decisions across rejected typed transactions. +Existing Catalog launch, Archive/restore and official Brotli package contracts +remain. See the [release note](docs/releases/server-1.6.560.md) and +[publication identities](COMPATIBILITY.md#server-v16560-publication). + +| Qualification | Current evidence | +|---|---| +| Published image | Original publisher source/build, security, startup/restart and protocol gates passed. | +| Public bytes and provenance | All 35 release assets and the OCI digest passed anonymous verification; native provenance and SBOM attestations passed. | +| Designated runtime baseline | Server560 / Web201 cutover and one actual restart passed; configuration, mounts and rollback were preserved, with three active Hosts/Agents. | +| Business workflow acceptance | Complete typed lifecycle and new Catalog/Archive/External/Alias/audit, role/cross-ID/layout/weak-model and durable-DENY acceptance remain pending. | + +This is not complete frontend coverage. Original failures are retained and +unchanged PASS evidence keeps its original scope. Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host. @@ -57,7 +63,7 @@ instance count. Advanced forms and other resource workflows remain pending. The complete scoped lifecycle workflow remains unaccepted; review the [current limitation](docs/ai-collaboration.md#workload-retirement-limitation) before enabling these optional changes. -See the [release note](docs/releases/server-1.6.559.md) and +See the [release note](docs/releases/server-1.6.560.md) and [AI collaboration guide](docs/ai-collaboration.md) for activation, supported operations, audit records and rollback. @@ -71,7 +77,7 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \ -v pasturestack-cattle:/var/lib/cattle \ -v pasturestack-mysql:/var/lib/mysql \ -v pasturestack-mysqllog:/var/log/mysql \ - ghcr.io/pasturestack/server:v1.6.559 + ghcr.io/pasturestack/server:v1.6.560 ``` For HTTPS termination at a reverse proxy, set the exact public origin: @@ -79,7 +85,7 @@ For HTTPS termination at a reverse proxy, set the exact public origin: ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.559 + image: ghcr.io/pasturestack/server:v1.6.560 restart: unless-stopped ports: - "8080:8080" diff --git a/docs/ai-collaboration.md b/docs/ai-collaboration.md index 9aab8f088d..912980dc5d 100644 --- a/docs/ai-collaboration.md +++ b/docs/ai-collaboration.md @@ -1,6 +1,7 @@ # Optional AI collaboration -Server v1.6.559 combines Web Console 1.6.200 and Engine 0.183.359. The twelve +Published Server v1.6.560 combines Web Console 1.6.201 / optional bridge 0.2.3 +and Engine 0.183.360. The twelve supported tools are `list_capabilities`, `find_resources`, `get_resource`, `preview_resource_change`, `apply_resource_change`, `find_stacks`, `find_services`, `get_service`, `update_service_description`, @@ -11,12 +12,15 @@ Other platform operations retain their ordinary UI/API paths. ## Workload retirement limitation -The prior 558 individual Service-stop failure remains recorded. Engine 359 -contains scoped lifecycle corrections, but the designated 559 complete workflow -has not passed: Stack creation succeeds, then scoped Stack discovery returns -403. Do not broaden a Key or replay an uncertain write to overcome this failure. -Catalog launch and Archive/restore are included as opt-ins; their designated -browser/role acceptance is still pending. Ordinary UI/API paths remain available. +The prior 558 individual Service-stop and 559 post-create collection failures +and their original reports remain recorded. Engine 360 contains the scoped +lifecycle, collection and durable-audit corrections; publication and component +tests do not establish a complete live workflow. Designated Server560 / Web201 +QA cutover and one actual restart passed, retaining configuration, mounts and +rollback with three active Hosts/Agents. Complete Core, Catalog/Archive, +External/Alias/audit, role/cross-ID/layout/weak-model and durable-DENY business +acceptance remain pending. Do not broaden a Key or replay an uncertain write to overcome a +rejection. Ordinary UI/API paths remain available. ## Activation @@ -50,6 +54,19 @@ cover name, description, image, scale where applicable, command and entry point. They create stopped workloads. Advanced environment, port, mount, hardware, security and other UI form fields require subsequent adapters. +External Services add stopped creation and bounded hostname or IP targets; +the two target modes cannot be mixed. DNS Aliases are created stopped and empty, +then bind authorized local Service targets through a separate reviewed plan. +Advanced/remote links and incoming-consumer/cross-source Alias cleanup remain +unsupported. These source-supported paths do not imply live acceptance. + +Audit metadata queries reuse the existing broker owner for Key, environment, +time and decision filters. They work with native Cookie or the optional stdio +Key transport in the matching components, under the original caller's current +role, scope and revision. Narrow the query when the bounded scan limit is +reached. Tool output withholds private payloads and credentials; authorized +people retain the ordinary audit UI's existing payload controls. + The normal human review shows the exact typed changes and mounted-data rules. Stopping or removing a workload does not mean every external data directory is backed up or retained. Review the existing domain's removal behavior before @@ -104,6 +121,11 @@ Per-Key audit distinguishes the server's authorization decision, the HTTP result and the later operation result. Client-reported tool events are labelled separately; an ALLOW decision or accepted request is not proof of completion. Credentials, OTPs and description contents are not tool audit payloads. +The Engine records the broker's complete query outcome separately from source +page responses. Decisions written inside a Core transaction remain in the +forced durable spool for independent replay, including when a rejected typed +request rolls back. Durable spool acknowledgment is not database completion or +business success; it never changes the original decision into an ALLOW. To stop native tools, select off in the panel. Before disabling the backend or downgrading, let accepted operations reach a terminal state, cancel unused diff --git a/docs/performance/README.md b/docs/performance/README.md index 19bfd6e2d2..7ffb3ace54 100644 --- a/docs/performance/README.md +++ b/docs/performance/README.md @@ -8,9 +8,9 @@ The following example is appropriate as a starting point for a dedicated 16-vCPU host with about 32 GiB of RAM. It is not a universal performance profile; measure the real workload before increasing it further. -The example uses the published Server `v1.6.559` numeric tag. +The example uses the published Server `v1.6.560` numeric tag. The image and its release assets have passed public identity and checksum readback. -See the [release note](../releases/server-1.6.558.md) and the +See the [release note](../releases/server-1.6.560.md) and the [current release](../../README.md#current-release) for component versions and release details. Preserve the existing runtime overrides and all three named volumes during an upgrade or restart. @@ -21,7 +21,7 @@ evidence is not a performance benchmark; measure the actual workload. ```yaml services: pasturestack-server: - image: ghcr.io/pasturestack/server:v1.6.559 + image: ghcr.io/pasturestack/server:v1.6.560 restart: unless-stopped ports: - "8080:8080" diff --git a/docs/releases/server-1.6.560.md b/docs/releases/server-1.6.560.md index a288bd1d46..f2354eb0d7 100644 --- a/docs/releases/server-1.6.560.md +++ b/docs/releases/server-1.6.560.md @@ -1,9 +1,10 @@ -# Server v1.6.560 candidate +# Server v1.6.560 -Not published or runtime accepted. Install examples stay on published 559. -Both components passed required CI, same-tree merge and immutable publication. -All original public asset bytes were read back anonymously. Server assembly -and designated live acceptance remain separate pending gates. +Published image: `ghcr.io/pasturestack/server:v1.6.560@sha256:2f1533325f8314684b71062a37c9deae891e236b543a5ed7d958d698c21ff332`. + +Source commit: `48c1a180e19846eb61d8a7ad60f38368e74abae1`. + +The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results. ## Verified component inputs @@ -43,7 +44,14 @@ typed read must remain auditable after its outer write rolls back. The fix keeps current metadata, capacity and failure behavior without nested account locks. Source/transaction tests passed; designated live durability is pending. -## Required acceptance: pending +## Designated runtime baseline + +The published digest above passed the designated 8080 cutover and one actual +Server restart. The sealed checks retained operator/JVM configuration, mounts, +AppArmor and rollback, with three active Hosts and three active Agents. This is +baseline identity/health evidence, not acceptance of the complete business flows. + +## Required business acceptance: pending The previous 558 Service-stop failure, 559 post-create collection failure and their original reports remain recorded. No partial result is promoted to a