Repair typed audit topology and assemble Server 1.6.561

COMPATIBILITY.md

@@ -1,5 +1,19 @@
 # Compatibility Contract
 
+## Server v1.6.561 source candidate
+
+Consumes published Web Console 1.6.202 / bridge 0.2.4 and the original qualified
+Engine 0.183.361 JAR. Repairs verified native Container network cleanup,
+registered typed audit targets and fixed audit-owner topology. The new fixed
+child accepts normalized local HTTP(S) service origins only; ordinary broker
+operator settings and native role/Key boundaries remain. Certificate plans
+change name/description only; material remains in the human UI.
+
+Required image publication and designated business/role/layout acceptance are
+separate pending gates. Published installation examples remain on 560 until the
+new image passes. See [candidate details](docs/releases/server-1.6.561.md).
+
+
 <a id="server-v16560-publication"></a>
 
 ## Server v1.6.560 published

docs/releases/server-1.6.561.md

@@ -0,0 +1,65 @@
+# Server v1.6.561 candidate
+
+Not published. Matching component publication, required image checks and
+designated runtime acceptance remain pending.
+
+## Verified component inputs
+
+- Web Console 1.6.202 / bridge 0.2.4: published original producer
+  `3350a566b77c46ccf3686975bdcc8d9c14ee2985`, tag source
+  `1b426175a55fd63260466cacd02e962e1bd44f8f`; all 13 public assets verified.
+- Web archive SHA256:
+  `333bca5f68e128423bf398cd2b8e72ccf05f96e02bcde7260b84a09b09601ac6`.
+- Web runtime SBOM SHA256:
+  `54a17d3405535210d3f770a64b0708a6e3d8e908cbbe036fc737558eb0dfeaf8`;
+  original lock `81b8b3d579373456953ed27619de4b003cf13e122c94dce115254c3e3bba4dae`.
+- Engine 0.183.361 producer `592bd47ca9417f24d5acea07b567b9385852f381`;
+  original JAR SHA256 `9346cdc844c56e76779e95b015246c4aba3c224ee8b7e3bdb6ba31989a615136`.
+  Required CI, same-tree merge, original artifact checks and all 12 public assets
+  passed; tag source `4e86a5890798d64f1f3f656c6c78e4dedef7aa39`.
+  Official structured results: 412 suites / 3843 tests / zero failure or error / 1 existing skip.
+  Runtime SBOM SHA256 `7163aba0bc8e77f0901a1d07be9ce23e77c548a7d20813a24b1bae22254701f8`.
+- Catalog 0.20.17, Compose 0.14.40 and other package inputs remain unchanged.
+
+## Corrected workflows
+
+Standalone Container removal preserves its verified native remove frame and
+owned retired NIC/IP cleanup. Current role, original Key revision, explicit
+DENY and shared/foreign-resource ownership remain enforced. Genuine structured
+child authorization denial becomes terminal instead of retrying as UNKNOWN.
+
+Registered External Service, DNS Alias and Certificate metadata audit targets
+remain in the existing durable metadata-only audit owner. Audit failure stays
+fail-closed. This change does not grant access to those resource types.
+
+The fixed private audit query CLI shares the operator-configured broker
+upstream. Previously its 8082 literal and cleared child environment diverged
+from the image topology. Java passes only that exact nonsecret operator
+setting after clearing the other environment, reconstructed from fixed local
+HTTP(S) origins and a bounded numeric port; credentials remain private stdin.
+Callers cannot choose an upstream, executable, SQL or raw audit payload.
+
+Certificate name/description plans use normal human approval and the native
+metadata-only PUT. Certificate PEM, private key and chain are preserved and
+excluded from tool snapshots. Other material operations stay in the human UI.
+
+## Acceptance boundary
+
+Required component CI, original artifacts, image/startup/restart and designated
+business tests are separate gates. The original failing runtime reports remain.
+Core lifecycle, External/Alias, all twelve audit-query cases, affected role/Key
+and cross-ID boundaries, new layouts and actual weak-model workflows must pass
+before their own matrix entries are marked accepted. Preserve unaffected PASS
+at its original scope; do not promote a subcase to complete frontend coverage.
+The baseline remains 243 groups and 3,089 source rows. New source coverage is
+partial and does not establish whole-group or complete-product acceptance.
+
+## Upgrade and rollback
+
+Use only the newly published immutable numeric image tag. Preserve existing
+volumes, operator configuration, origins, MFA/session protection, restart policy
+and AppArmor. Retain the last healthy container/image and a compatible database
+backup. A later downgrade does not reverse completed writes. Do not replay
+uncertain operations, replace their captured Key identity or patch database state.
+After deployment, confirm old denied work is terminal before a separately
+authorized operator cleanup. Production, HAProxy and firewall are unchanged.

scripts/check-server-api-explorer-patch.sh

@@ -533,7 +533,7 @@ require_marker "$release_dockerfile" \
     SERVER_INCREMENTAL_RELEASE_BASE_MISSING
 for web_sbom_release_marker in \
     'COPY --chmod=0755 artifacts/verify-web-console-sbom.py /usr/local/bin/verify-web-console-sbom' \
-    'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.201-runtime.cdx.json' \
+    'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.202-runtime.cdx.json' \
     '"${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT}" "${WEB_CONSOLE_RUNTIME_SBOM_SHA256}" "${web_sbom}";' \
     '--lock-sha256 "${WEB_CONSOLE_LOCK_SHA256}" --archive "${web_archive}"' \
     '--webmcp-ceiling enabled;' \
@@ -571,7 +571,7 @@ python3 scripts/test-web-console-sbom.py
 python3 server/security/test_web_console_sbom_scan.py
 
 require_marker "$release_dockerfile" \
-    'ARG SERVER_RELEASE_TAG=v1.6.560' \
+    'ARG SERVER_RELEASE_TAG=v1.6.561' \
     SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
 require_marker "$release_dockerfile" \
     'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -629,22 +629,22 @@ require_marker "$publish_workflow" \
     'bash source/server/artifacts/verify-host-api-package.sh' \
     SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.201' \
+    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.202' \
     SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.201.tar.gz' \
+    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.202.tar.gz' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT_SHA256=5bc8142d9322657c5cbae782756c3aa5a45b6537074de8749066492fa8947eb8' \
+    'ARG WEB_CONSOLE_ARTIFACT_SHA256=333bca5f68e128423bf398cd2b8e72ccf05f96e02bcde7260b84a09b09601ac6' \
     SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_COMMIT=24715414f143e2c58cf53084bd84cbea0922798f' \
+    'ARG WEB_CONSOLE_COMMIT=3350a566b77c46ccf3686975bdcc8d9c14ee2985' \
     SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_LOCK_SHA256=d255b74a835ab7c0224d12613baacdf021d8b30d46204a71c22d57f35725666f' \
+    'ARG WEB_CONSOLE_LOCK_SHA256=81b8b3d579373456953ed27619de4b003cf13e122c94dce115254c3e3bba4dae' \
     SERVER_INCREMENTAL_WEB_CONSOLE_LOCK_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=8b837eb330b9815df48b4256d3bf0c4e215864b996e2be40dd707ec532872503' \
+    'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=54a17d3405535210d3f770a64b0708a6e3d8e908cbbe036fc737558eb0dfeaf8' \
     SERVER_INCREMENTAL_WEB_CONSOLE_SBOM_HASH_MISSING
 require_marker "$release_dockerfile" \
     "grep -aF 'hostsPage.permissionDenied'" \
@@ -653,22 +653,22 @@ require_marker "$release_dockerfile" \
     '"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING
 require_marker "$build_script" \
-    'web_console_commit=${WEB_CONSOLE_COMMIT:-24715414f143e2c58cf53084bd84cbea0922798f}' \
+    'web_console_commit=${WEB_CONSOLE_COMMIT:-3350a566b77c46ccf3686975bdcc8d9c14ee2985}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING
 require_marker "$build_script" \
-    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.201}' \
+    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.202}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.201.tar.gz}' \
+    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.202.tar.gz}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING
 require_marker "$build_script" \
-    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-5bc8142d9322657c5cbae782756c3aa5a45b6537074de8749066492fa8947eb8}' \
+    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-333bca5f68e128423bf398cd2b8e72ccf05f96e02bcde7260b84a09b09601ac6}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING
 require_marker "$build_script" \
-    'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-d255b74a835ab7c0224d12613baacdf021d8b30d46204a71c22d57f35725666f}' \
+    'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-81b8b3d579373456953ed27619de4b003cf13e122c94dce115254c3e3bba4dae}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING
 require_marker "$build_script" \
-    'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-8b837eb330b9815df48b4256d3bf0c4e215864b996e2be40dd707ec532872503}' \
+    'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-54a17d3405535210d3f770a64b0708a6e3d8e908cbbe036fc737558eb0dfeaf8}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING
 require_marker "$release_dockerfile" \
     'ARG CATALOG_SERVICE_VERSION=0.20.17' \
@@ -1139,21 +1139,21 @@ require_marker "$build_script" \
     '--file server/Dockerfile.web-compose-release' \
     SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
 require_marker "$build_script" \
-    'image=${IMAGE:-pasturestack-validation/server:v1.6.560}' \
+    'image=${IMAGE:-pasturestack-validation/server:v1.6.561}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.560}' \
+    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.561}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
 require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
     SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING
 for release_engine_marker in \
-    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.360' \
+    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.361' \
     'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar' \
-    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=0ebbd517ee43e113f29cbc14fe542aa7c7900ae28d65d63a12c348b7f0ac9a21' \
-    'ARG ORCHESTRATION_ENGINE_COMMIT=72230c8b471312377bae968c0c17d63e8ad97ffb' \
+    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=9346cdc844c56e76779e95b015246c4aba3c224ee8b7e3bdb6ba31989a615136' \
+    'ARG ORCHESTRATION_ENGINE_COMMIT=592bd47ca9417f24d5acea07b567b9385852f381' \
     'COPY --from=release_artifacts /out/orchestration-engine.jar /tmp/orchestration-engine.jar' \
-    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.360' \
+    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.361' \
     'sh /usr/share/cattle/verify-engine-archive.sh "${archive}" "${ORCHESTRATION_ENGINE_VERSION}" "${ORCHESTRATION_ENGINE_ARTIFACT_SHA256}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar' \
@@ -1172,10 +1172,10 @@ for release_engine_marker in \
         SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING
 done
 for release_engine_build_marker in \
-    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.360}' \
+    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.361}' \
     'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}' \
-    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-0ebbd517ee43e113f29cbc14fe542aa7c7900ae28d65d63a12c348b7f0ac9a21}' \
-    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-72230c8b471312377bae968c0c17d63e8ad97ffb}' \
+    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-9346cdc844c56e76779e95b015246c4aba3c224ee8b7e3bdb6ba31989a615136}' \
+    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-592bd47ca9417f24d5acea07b567b9385852f381}' \
     'CATTLE_CATTLE_VERSION="${orchestration_engine_release_tag}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     '< "${server_dir}/artifacts/verify-engine-archive.sh"'; do
@@ -1694,10 +1694,10 @@ fi
 if grep -Fxq '## Current source candidate' README.md; then
     for candidate_readme_marker in \
         '<a id="current-release"></a>' \
-        'Server `v1.6.560` is a prepared source candidate, not a published image.' \
+        'Server `v1.6.561` is a prepared source candidate, not a published image.' \
         'run them only after its official release' \
         'This candidate is not yet available' \
-        'ghcr.io/pasturestack/server:v1.6.560'; do
+        'ghcr.io/pasturestack/server:v1.6.561'; do
         require_marker README.md "$candidate_readme_marker" \
             SERVER_CURRENT_CANDIDATE_README_MISSING
     done
@@ -2303,7 +2303,7 @@ done
 jq -e '
   ["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves
   |   .["@context"] == "https://openvex.dev/ns/v0.2.0"
-  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.560"
+  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.561"
   and (.statements | length) == 56
   and ([.statements[].vulnerability.name] | length == (unique | length))
   and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2341,7 +2341,7 @@ jq -r '
   | @tsv
 ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
 bash "$vendor_pending_validator" "$runtime_vendor_pending" \
-    "$vendor_pending_fixture" v1.6.560 >/dev/null
+    "$vendor_pending_fixture" v1.6.561 >/dev/null
 bash scripts/test-vendor-pending-findings.sh >/dev/null
 rm -f "$vendor_pending_fixture"
 trap - EXIT
@@ -2430,4 +2430,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.560 base=v1.6.460 engine=0.183.360 web_console=1.6.201 catalog_service=0.20.17 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.561 base=v1.6.460 engine=0.183.361 web_console=1.6.202 catalog_service=0.20.17 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'