chen21019 · Oct 30, 2026 · Oct 30, 2026
@@ -1,18 +1,33 @@
 # Compatibility Contract
 
-## Server v1.6.561 source candidate
-
-Consumes published Web Console 1.6.202 / bridge 0.2.4 and the original qualified
-Engine 0.183.361 JAR. Repairs verified native Container network cleanup,
-registered typed audit targets and fixed audit-owner topology. The new fixed
-child accepts normalized local HTTP(S) service origins only; ordinary broker
-operator settings and native role/Key boundaries remain. Certificate plans
-change name/description only; material remains in the human UI.
-
-Required image publication and designated business/role/layout acceptance are
-separate pending gates. Published installation examples remain on 560 until the
-new image passes. See [candidate details](docs/releases/server-1.6.561.md).
-
+<a id="server-v16561-publication"></a>
+
+## Server v1.6.561 published
+
+Image: `ghcr.io/pasturestack/server:v1.6.561@sha256:c9dbda3065b3cd860a01745d0af289d38cd4b48cb74c8e1277de67d0c0497449`.
+Producer: `6d83ff4cef4cd6d105e07f69af5a09c61441c634`.
+[Publisher41010568255](https://github.com/PastureStack/server/actions/runs/41010568255)
+passed source/build, security, startup/restart and protocol gates. All 35 public
+assets and the OCI digest passed anonymous readback; native image provenance and
+SBOM attestations passed. Original component artifacts are Web202 / bridge024
+and Engine361; Catalog0.20.17 / Compose0.14.40 and other package inputs remain.
+Documentation commits do not replace the immutable producer or rebuild the image.
+
+The fixed private audit child accepts normalized local HTTP(S) origins while the
+ordinary broker keeps its operator interface. Credentials stay in private stdin.
+Certificate plans change names/descriptions only. Current role/Key authority,
+explicit denial, precise native ownership and four default-off AI opt-ins remain.
+Ten Medium occurrences across nine officially unfixed CVEs remain registered;
+High/Critical, available-fix, untracked and secret gates passed. Raw/effective
+scan and VEX/vendor evidence remain distinct; browser SBOM is still incomplete.
+
+Designated Server561 cutover and one restart passed with three active Hosts and
+Agents, unchanged operator settings/mounts/AppArmor and retained560 rollback.
+Core business acceptance remains FAIL at native ServiceIndex removal during
+scale-down. The audit query's actual201/SUCCEEDED completion is recorded; its
+status oracle needs correction before the remaining cases can pass. Other new
+domain, role/layout/weak-model workflows remain pending. No complete243-group
+acceptance is claimed. See [release boundaries](docs/releases/server-1.6.561.md).
 
 <a id="server-v16560-publication"></a>
 

@@ -13,21 +13,22 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-[Server `v1.6.560`](https://github.com/PastureStack/server/releases/tag/v1.6.560)
-packages Web Console `1.6.201` / optional bridge `0.2.3`, Engine `v0.183.360`,
-Catalog `0.20.17` and Compose `0.14.40`. It adds bounded External Service, DNS
-Alias and audit metadata workflows, repairs scoped collection admission and
-retains authorization audit decisions across rejected typed transactions.
-Existing Catalog launch, Archive/restore and official Brotli package contracts
-remain. See the [release note](docs/releases/server-1.6.560.md) and
-[publication identities](COMPATIBILITY.md#server-v16560-publication).
+[Server `v1.6.561`](https://github.com/PastureStack/server/releases/tag/v1.6.561)
+packages Web Console `1.6.202` / optional bridge `0.2.4`, Engine `v0.183.361`,
+Catalog `0.20.17` and Compose `0.14.40`. It includes bounded Certificate
+name/description plans, native Container network-cleanup corrections, registered
+typed audit targets and a corrected fixed audit-owner topology. Existing Full
+and legacy permissions, operator settings, Catalog/Archive/session protections
+and official package contracts remain. See the
+[release note](docs/releases/server-1.6.561.md) and
+[publication identities](COMPATIBILITY.md#server-v16561-publication).
 
 | Qualification | Current evidence |
 |---|---|
 | Published image | Original publisher source/build, security, startup/restart and protocol gates passed. |
-| Public bytes and provenance | All 35 release assets and the OCI digest passed anonymous verification; native provenance and SBOM attestations passed. |
-| Designated runtime baseline | Server560 / Web201 cutover and one actual restart passed; configuration, mounts and rollback were preserved, with three active Hosts/Agents. |
-| Business workflow acceptance | Complete typed lifecycle and new Catalog/Archive/External/Alias/audit, role/cross-ID/layout/weak-model and durable-DENY acceptance remain pending. |
+| Public bytes and provenance | All 35 assets and the OCI digest passed anonymous verification; native provenance and SBOM attestations passed. |
+| Designated baseline | One actual Server561 restart passed, preserving config, mounts, AppArmor and rollback, with three active Hosts/Agents. |
+| Business workflows | Complete scoped lifecycle remains unaccepted: real scale-down found a ServiceIndex cleanup authorization gap. New domain, Certificate, layout and weak-model workflows remain pending. The audit-query oracle's HTTP201 handling is being corrected separately from the successful query/completion. |
 
 This is not complete frontend coverage. Original failures are retained and
 unchanged PASS evidence keeps its original scope.
@@ -63,7 +64,7 @@ instance count. Advanced forms and other resource workflows remain pending.
 The complete scoped lifecycle workflow remains unaccepted; review
 the [current limitation](docs/ai-collaboration.md#workload-retirement-limitation)
 before enabling these optional changes.
-See the [release note](docs/releases/server-1.6.560.md) and
+See the [release note](docs/releases/server-1.6.561.md) and
 [AI collaboration guide](docs/ai-collaboration.md) for activation,
 supported operations, audit records and rollback.
 
@@ -77,15 +78,15 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.560
+  ghcr.io/pasturestack/server:v1.6.561
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.560
+    image: ghcr.io/pasturestack/server:v1.6.561
     restart: unless-stopped
     ports:
       - "8080:8080"

@@ -1,7 +1,7 @@
 # Optional AI collaboration
 
-Published Server v1.6.560 combines Web Console 1.6.201 / optional bridge 0.2.3
-and Engine 0.183.360. The twelve
+Published Server v1.6.561 combines Web Console 1.6.202 / optional bridge 0.2.4
+and Engine 0.183.361. The twelve
 supported tools are `list_capabilities`, `find_resources`, `get_resource`,
 `preview_resource_change`, `apply_resource_change`, `find_stacks`,
 `find_services`, `get_service`, `update_service_description`,
@@ -12,15 +12,18 @@ Other platform operations retain their ordinary UI/API paths.
 
 ## Workload retirement limitation
 
-The prior 558 individual Service-stop and 559 post-create collection failures
-and their original reports remain recorded. Engine 360 contains the scoped
-lifecycle, collection and durable-audit corrections; publication and component
-tests do not establish a complete live workflow. Designated Server560 / Web201
-QA cutover and one actual restart passed, retaining configuration, mounts and
-rollback with three active Hosts/Agents. Complete Core, Catalog/Archive,
-External/Alias/audit, role/cross-ID/layout/weak-model and durable-DENY business
-acceptance remain pending. Do not broaden a Key or replay an uncertain write to overcome a
-rejection. Ordinary UI/API paths remain available.
+The complete scoped lifecycle is not accepted. Designated Server561 / Web202
+passed baseline cutover and one restart, but a real 2-to-1 Service scale-down
+exposed a missing authorization adapter for native ServiceIndex cleanup. The
+same native cleanup is used during Service and Stack removal. Do not broaden
+a Key, replay an uncertain write or assume a subcase proves the full flow.
+Ordinary Full/legacy UI and API paths retain their permissions.
+
+The fixed audit-owner topology now returns a real successful query and canonical
+completion. Its acceptance oracle must also recognize the native typed POST's
+HTTP201; remaining query cases stay pending until verified. New Certificate and
+other domain, role/cross-ID, layout and weak-model workflows remain separate
+gates. Original failures and unaffected PASS evidence keep their original scope.
 
 ## Activation
 
@@ -60,6 +63,10 @@ then bind authorized local Service targets through a separate reviewed plan.
 Advanced/remote links and incoming-consumer/cross-source Alias cleanup remain
 unsupported. These source-supported paths do not imply live acceptance.
 
+Certificate plans accept name and description only, under the same native owner,
+Key ceiling, current-state check and normal human approval. Certificate PEM,
+private keys, chains, renewal and other material operations stay in the human UI.
+
 Audit metadata queries reuse the existing broker owner for Key, environment,
 time and decision filters. They work with native Cookie or the optional stdio
 Key transport in the matching components, under the original caller's current

@@ -8,9 +8,9 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses the published Server `v1.6.560` numeric tag.
+The example uses the published Server `v1.6.561` numeric tag.
 The image and its release assets have passed public identity and checksum readback.
-See the [release note](../releases/server-1.6.560.md) and the
+See the [release note](../releases/server-1.6.561.md) and the
 [current release](../../README.md#current-release) for component versions and
 release details. Preserve the existing runtime overrides and all three named
 volumes during an upgrade or restart.
@@ -21,7 +21,7 @@ evidence is not a performance benchmark; measure the actual workload.
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.560
+    image: ghcr.io/pasturestack/server:v1.6.561
     restart: unless-stopped
     ports:
       - "8080:8080"

@@ -1,7 +1,10 @@
-# Server v1.6.561 candidate
+# Server v1.6.561
 
-Not published. Matching component publication, required image checks and
-designated runtime acceptance remain pending.
+Published image: `ghcr.io/pasturestack/server:v1.6.561@sha256:c9dbda3065b3cd860a01745d0af289d38cd4b48cb74c8e1277de67d0c0497449`.
+
+Source commit: `6d83ff4cef4cd6d105e07f69af5a09c61441c634`.
+
+The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.
 
 ## Verified component inputs
 
@@ -63,3 +66,13 @@ backup. A later downgrade does not reverse completed writes. Do not replay
 uncertain operations, replace their captured Key identity or patch database state.
 After deployment, confirm old denied work is terminal before a separately
 authorized operator cleanup. Production, HAProxy and firewall are unchanged.
+
+## Designated acceptance after publication
+
+One actual restart and all three Host/Agent baseline checks passed while retaining
+operator configuration, mounts, AppArmor and rollback. The complete scoped Core
+workflow remains failed at ServiceIndex cleanup during Service scale-down. This
+same native owner is used by Service/Stack removal and is being corrected; do not
+replay an uncertain write. Audit query201/SUCCEEDED completion exists, with an
+acceptance-status oracle correction pending. Other designated domain, role,
+layout and weak-model cases remain separate gates. Prior evidence is retained.