PastureStack Server v1.6.553

Server v1.6.553

Published image: ghcr.io/pasturestack/server:v1.6.553@sha256:daf2562134dcd735a265f531f2e7fdf0a3aca762062566e4406c35ba7ce81101.

Source commit: b0c121abf9a812f83204ee93bb28ee7046815021.

The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.

Verified component inputs

CVE-2026-111497 affects the Brotli decoder. The accepted Google fix is applied
to the pinned Ubuntu source without replacing Ubuntu packaging or adding
packages to the runtime. The qualified shared bundle binds the official patch,
native owning tests, ordinary compression/streaming tests, three-library ABI,
package bytes, consumer installation receipts and exact-package OpenVEX.

Web Console 1.6.195, Engine v0.183.354, Host API 0.38.8, Temurin
25.0.5+8 and their application behavior are retained. Node Agent v1.2.34
uses published compatibility base v0.3.8. Catalog v0.3.18, source
00eec89e5fdeb9728c1c41babccad8b7dfc8b297, references the separately published
qualified component images. Node.js
build SDK checks are separate from the static web runtime artifacts.

Upgrade and rollback

Back up the database and all three named volumes. Preserve the existing Compose
environment, HTTPS origin, ports, AppArmor, mounts and restart policy. After
publication use the numeric ghcr.io/pasturestack/server:v1.6.553 tag, then
upgrade existing infrastructure Stacks and Host Agents normally. A new Server
default does not override an explicit database setting.

Keep the preceding immutable images and matching data checkpoint. Do not run
docker compose down -v or retain an old runtime web-bundle override. A rollback
may require restoring the matching database and volumes; never restore over
the only copy of current data.

Acceptance boundary

Only affected package installation, linkage, startup/restart and system-service
functions require new evidence. Unchanged UI, language, RBAC and session tests
retain their earlier results. Runtime adoption must identify the actual
container digest on each eligible Host; registry publication alone is not
deployment acceptance. Production, HAProxy and host firewall configuration are
outside this QA deployment.

PastureStack Server v1.6.552

Server v1.6.552

Published image: ghcr.io/pasturestack/server:v1.6.552@sha256:f19a0fdd7340fde910c8eb66311bbe11d682301f5fe2df7768638b866e5ef1f4.

Source commit: 6be16e0c62473e65e4222e144fba513d61717f34.

The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.

Verified component inputs

This release consumes the qualified Ubuntu security backports in Server and its
component images. It updates only already-installed packages, preserves the
coreutils provider and configuration, and keeps compilers outside the final
runtime. The root Server image does not add jq, Rust coreutils or development
packages to obtain a clean scan.

The bundle binds the original upstream fixes, native package tests, actual GNU
and uutils installation fixtures, package archives and exact-package OpenVEX.
The published image has its own SBOM and installation verification. These are
separate from the bundle's data SBOM. Raw findings remain available alongside
the interpreted report. Unfixed findings and code-absence determinations are
reported separately from fixed vulnerabilities.

Web Console 1.6.195, Engine v0.183.354, Host API 0.38.8 and Temurin
25.0.5+8 retain their component inputs. Node Agent v1.2.33 uses base
v0.3.7; Catalog v0.3.17 records the corresponding component releases.

Upgrade and rollback

Back up the database and all three named volumes before upgrading. Keep the
existing Compose environment variables, ports, restart policy, AppArmor,
public HTTPS origin and mounts. Use ghcr.io/pasturestack/server:v1.6.552;
do not keep old runtime bundle overrides mounted into the new image.

Upgrade existing infrastructure stacks through the normal Catalog workflow and
complete their upgrades after checking health. Preserve the previous image and
matching data backup for rollback. Do not run docker compose down -v.

The official release includes the producer commit, immutable image digest,
checksums, SBOMs, vulnerability reports and qualification receipts. Consult
the compatibility contract
for the retained runtime boundaries.

PastureStack Server v1.6.551

Server v1.6.551

Published image:
ghcr.io/pasturestack/server:v1.6.551@sha256:150c3eaa2d84df6236e7634843e506a79df71d9e434ad2038427108c14ac358e.
Producer: 9abef4712901981e5917c41356bb261974fdba47.

Verified component inputs

All component inputs retain the 550 pins, including Web Console 1.6.195,
Engine v0.183.354, Host API 0.38.8 and the eight PCRE2 CVE backports. No
application behavior or database migration is introduced.

The manual completion of 550 accidentally converted its standalone Host API
attachment into an empty gzip while converting an empty browser findings table.
The 550 image itself contains the correct package. That incorrect immutable
attachment remains as evidence; do not use it. The original Host API producer
release remains valid.

The normal publisher rechecks the pinned producer archive SHA-256 after report
conversion and before upload. Its executed negative fixture rejects an empty
gzip substitution even though the stream itself is syntactically valid. No
released image or asset was overwritten.

Verification and remaining risk

Run 40120970328
passed the source, image, security, startup/restart and publication checks. All
33 immutable assets passed anonymous byte/checksum readback, and the Host API
archive additionally matches producer SHA-256
6903ffb6a618f5a9bc8c7c8997a1e0419c93a8bbdeaee6d288957366dccef444.
Its archive contents and internal checksums are intact. Both OCI attestations
bind the exact producer and image digest; the final image retains one layer.

The scoped 8080 cutover and one controlled restart passed. Package integrity and
linkage, grep/Git and two read-only MariaDB regex controls, ping and three active
Host/Agent states passed. Existing HostConfig, operator environment, all three
named data volumes, socket bind and AppArmor were preserved. A consistent
104-table InnoDB backup and the 550 rollback container/image remain.

The exact rootfs scan retains 51 raw occurrences, 38 VEX dispositions and 13
pending LOW/MEDIUM occurrences across 10 CVEs. Other product candidates and
Ruby/Onigmo build-host coverage remain separately tracked. Unchanged UI, role,
OIDC and MFA evidence is carried forward; no full feature-matrix rerun or
all-project zero-risk claim is made. The production site, HAProxy, firewall and
production database were not modified.

Upgrade and rollback

Use the numeric v1.6.551 tag after verifying backups and the published image
identity. Preserve existing Compose settings, named volumes, restart policy and
security options. Keep the prior image and matching backup until acceptance.
Do not patch running containers or overwrite release tags.

PastureStack Server v1.6.550

Server v1.6.550

Standalone attachment correction: The manual completion script mistakenly
replaced host-api-0.38.8.tar.gz with an empty gzip stream. Do not use that
attachment. The Server image contains the correct archive, and the
original Host API producer release
is unchanged. Matching upload checksums did not detect the substitution. The
original immutable bytes remain available as failure evidence; 551 adds a
producer-identity recheck after report conversion and publishes a fresh release.

Published image:
ghcr.io/pasturestack/server:v1.6.550@sha256:03542028c3ce4be11d7ff87f96beddf5179c67caf9f0d28ad57043acf3cf52c5.
Producer: 54deb98ee33ffab78437070d61179b602844182e.

Verified component inputs

Rebuild only libpcre2-8-0 and libpcre2-posix3 from Ubuntu 10.46-1build1
with the twelve official release/pcre2-10.46 backports through
947809f11e9c9744aa0974b4b630a1ae461733dd. Sources and patches are SHA-256 pinned.
The first-party version 10.46-1build1+pasturestack.1 is not a Canonical release.
Original packaging, ABI, JIT, POSIX interfaces and hardening remain unchanged.

Fixed: CVE-2026-103111, CVE-2026-86145, CVE-2026-89156, CVE-2026-89157,
CVE-2026-89158, CVE-2026-89160, CVE-2026-89161 and CVE-2026-89162.
See the official backport list.
Ubuntu lacking an updated package does not mean upstream has no accepted fix.
Web Console 1.6.195, its original runtime SBOM, Engine v0.183.354 and all
other component inputs remain unchanged. No database migration is introduced.

Verification and remaining risk

Original native pcre2_jit_test, RunTest and RunGrepTest passed. Fourteen
builder contracts, five verifier guards, owning assembly checks, exact package
integrity, both library hashes and five actual consumers passed. C / C.utf8
regex controls cover ASCII, UTF-8, CRLF and the non-JIT path. The package-owned
README is retained during installation; integrity differences are not ignored.

The formal producer passed source, rootfs equivalence, startup/restart and fresh
security checks before pushing and signing the same one-layer image. The scan
retains 51 raw occurrences, 38 exact VEX dispositions and 13 pending LOW/MEDIUM
occurrences across 10 CVEs; HIGH/CRITICAL, available distro fixes, unregistered
findings and secrets are zero. Raw evidence remains available. Other artifacts,
build-host SDKs and the browser's six unsupported snapshots remain separately
tracked; this is not a zero-risk or complete-coverage claim.

The scoped 8080 deployment passed first start, one restart, exact package/hash/
linkage checks, grep/Git controls, two read-only MariaDB regex controls and three
active Host/Agent states. HostConfig, operator environment, all three data
volumes, socket bind and AppArmor were preserved. The verified consistent DB
backup and 549 rollback container/image remain. Unchanged UI, role and
identity-flow PASS evidence was carried forward; no full feature matrix or
cross-host network rerun is claimed. The production site, HAProxy and firewall
were not changed.

Publication completion

Run 40116218929
remains failed because the final renderer required a missing candidate-note
heading. Its tested, signed image was not rebuilt or overwritten. Original CI
bytes completed image publication and both attestations were verified. The
34 assets passed upload-to-download checksum readback, which did not establish
that the Host API attachment still matched its producer; see the correction above. The
completion receipt
records the original archive and note-only correction. A permanent pre-build
test now validates the actual current note as well as fixtures.

Upgrade and rollback

Use the numeric v1.6.550 tag after verifying backups and image identity. Preserve
all existing Compose settings, named volumes, restart policy and security options.
Retain 549 until scoped acceptance succeeds. Do not patch a running container or
overwrite a release tag. Restore matching backups when an upgrade requires it;
this PCRE2-only update does not migrate the database.

PastureStack Server v1.6.549

Server v1.6.549

Published image: ghcr.io/pasturestack/server:v1.6.549@sha256:dae1c8e490e012a030855d73d7af0bfcd85f4c9d9bf94148664d492c35e5684c.

Source commit: ed3f334f2c371a3038ca5fe3e63c6581c8c1aabf.

The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.

Verified component inputs

• Web Console 1.6.195 is consumed as an exact static archive and a separate
  web-console-1.6.195-runtime.cdx.json release asset. The build verifies both
  checksums and binds the SBOM to the archive name, archive SHA-256, source
  commit, version and package-lock SHA-256.
  Producer f905bc12daae18d98a6ac65942625562fff2a424 passed
  run 40086505425.
  Archive SHA-256: 26cbe1f3c057722c6682c43316021687508b7d9dd58c28c32713512d75238bb3.
  Runtime SBOM SHA-256: ca31669f58aa342cd346e1d33ec7061d65f9b84d6a3afcbd132e09361425a88a.
  Lock SHA-256: ae862be4519751895f74e552f036906d64be8371fdbbc6379c16e52518f9ee22.
  The formal 216-component runtime SBOM passed the Server consumer's archive,
  source, version, lock and phase identity checks with coverage=incomplete retained.
• Orchestration Engine v0.183.354 retains source
  dc5a8d7bc44131f609f72a6504483b692d47ce16 and JAR SHA-256
  f4889bfb8759a7664f07524bb129d0cda19f35604a06c877b6ca7033246df6fa.
• Catalog v0.3.16 retains source 070e08d8f85ffc2779a0f97eb4e356c857812d34,
  Network Plugin Manager v0.8.25 and Metadata Service v0.10.6.
  The other Server v1.6.548 runtime component coordinates are unchanged.

Browser SBOM delivery

The original browser runtime SBOM is stored at
/usr/share/licenses/pasturestack/web-console/runtime.cdx.json. The publisher
reads that same file from the actual candidate rootfs, verifies its pinned
identity, and retains web-console-runtime.cdx.json, its SHA-256 sidecar and
web-console-sbom-identity.txt as separate Server release assets.
No normalization or merge into the OS SBOM changes the producer's bytes.

The publisher performs independent component vulnerability lookup on this runtime
SBOM using the same pinned Trivy image and freshly downloaded vulnerability DB.
Raw and effective reports retain identical bytes because no browser exception or
OS VEX is applied. Browser findings retain a distinct target in the existing
exact-set release gate: HIGH/CRITICAL, available fixes and every unregistered
finding block publication. The existing Ubuntu no-fix ledger is not expanded.
The raw/effective scan reports, coverage report and browser findings table are
included in the release checksum manifest.

The coverage report binds recognized npm PURLs to scanner package inventory,
records the scanner and exact DB identity, and lists unsupported snapshots with
their names, versions, references and provenance hashes. Missing npm lookup
coverage blocks publication. An unsupported snapshot does not receive a
not-affected/VEX disposition and a zero scanner result does not establish zero
risk or complete browser coverage.

The runtime inventory preserves coverage=incomplete, including its documented
opaque vendor, sentinel and Sass tracing limitations. Build dependencies,
package-lock-only entries and host SDK inventories are not promoted into the
browser runtime inventory. The source-to-artifact evidence and disclosed
unknowns determine scope; SBOM presence does not prove complete detection.

Build-host Ruby tracking

The earlier Web194, Engine354 and Server548 jobs used a GitHub-hosted image
whose official SBOM includes Ubuntu Ruby and older cached/portable Ruby SDKs.
Their explicit use was not observed in those producer logs. Available Ruby
Onigmo fixes and these host-only inventories remain tracked separately from
product runtime findings; Ubuntu backport status is unverified. This evidence
does not establish a Ruby regexp-from-attacker path in the Node/Java/Go flows.
An absent scanner CVE is not a remediation result.

The Web Console producer captures actual build-host inventory without installing an
otherwise unused Ruby toolchain. Server intermediate-stage package coverage
gaps are retained; no unrelated base image rebuild is claimed as verification.
The Web195 build runs in its pinned Node container. Its before/after inventory
and absence gates found no Ruby interpreter, libruby, RubyGems or Onigmo in that
container. This result does not describe the enclosing GitHub runner or every
Server intermediate stage.

Security, publication and acceptance boundaries

The existing Server runtime CVE/VEX dispositions and scanner thresholds are
retained with the v1.6.549 release binding. Fresh source, image, security,
startup/restart, rootfs equivalence and release readback checks remain required;
the earlier v1.6.548 results are not a v1.6.549 release or deployment PASS.
The six-stage build and final one-layer publication process are preserved.

This change does not alter authentication, authorization, Catalog behavior,
database schema, host registration, named volumes or operator configuration.
No production deployment or new VM acceptance is claimed. Preserve the
verified v1.6.548 image and matching database/volume backup for rollback, and
follow the upgrade guidance for any later deployment.

PastureStack Server v1.6.548

Server v1.6.548

Published image: ghcr.io/pasturestack/server:v1.6.548@sha256:a20b7f32d53152a7be11b28ff0c081679e42161e3142718424a3bcabfab115be.

Source commit: 62dddd5269e2f4b9b8925e424f55359146c786ae.

The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.

Verified component inputs

• Catalog v0.3.16 source 070e08d8f85ffc2779a0f97eb4e356c857812d34
  adds Network Services revision 13 while retaining previous revisions.
• Network Plugin Manager v0.8.25 source
  461182e1fcd09527509359f5c551704303689c04, published manifest
  sha256:9a66894138dc6dded756c5e4b80e6d235698d911031641f6c45763ad9b32d94e.
• Metadata Service v0.10.6 source
  3db2e1cd53530a04282f5c2448426334ea4d92a8, published manifest
  sha256:88267d800365d354f06519014a3e4f7ce967d05d4805e5a705944980e30449ff.

The unchanged Engine v0.183.354, Web Console 1.6.194, Host API 0.38.8,
Node Agent 0.13.33 and other v1.6.547 components retain their exact inputs.
Component publication is separate from the environment acceptance below.

Scope

This patch carries the Catalog update for Network Plugin Manager v0.8.25 and
Metadata Service v0.10.6.
It fixes CNI provider handoff during a managed infrastructure upgrade: a stopped
driver must not remain selected after a replacement driver starts. Driver
selection still uses authorized local infrastructure metadata and preserves
the host's existing firewall backend.

Metadata Service preserves the engine's opaque data-version token instead of
parsing it as an integer. Revision-and-hash tokens must not collapse to 0:
otherwise version watchers cannot discover changed network endpoints. The
explicit version used for merged external metadata retains its existing
behavior. This patch does not change authentication, application data,
resource permissions, or the other component versions.

The previous v1.6.547 Network Services upgrade passed, but its subsequent IPsec
upgrade exposed the separate provider-event/retry defect. That failed attempt
and its normal Stack rollback are retained as QA evidence, not counted as a
successful upgrade.

Required acceptance

• Confirm the published Network Plugin Manager source, image digest and required
  checks, and the corresponding Metadata Service identity, before pinning the
  new Catalog commit.
• Complete Network Services and IPsec upgrades on the QA hosts through normal
  platform actions. Verify provider selection, final service health, DNS,
  container egress, cross-host traffic, version-watch updates and unchanged
  workload data. Verify replacement endpoint discovery and health reporting
  on both hosts, not only steady-state traffic to old containers.
• Verify OIDC/TOTP, API access and a newly opened WebSocket before and after one
  controlled restart of the QA Server.
• Retain existing Compose settings, volumes, AppArmor and the previous Server
  rollback container. Company production is outside this change.

Do not infer deployment acceptance from component or Server publication.
Upgrade through the normal platform actions and retain a verified rollback
point until the affected services and workload data have been checked.

PastureStack Server v1.6.547

Server v1.6.547

Published image: ghcr.io/pasturestack/server:v1.6.547@sha256:09b14e3ad99d75223dca5251f6a27fa9dfec0cc55a3670b683ad406125f24de7.

Source commit: eb018efeb3ff5740e63adf054ef19265868b3538.

The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.

Verified component inputs

• Catalog v0.3.15 source 1d375422e25f83f72840067df97d90b4a5c4f16e
  adds network-services revision 12 while retaining every older revision.
• Network Plugin Manager v0.8.24 source
  f34bbca219ddd84b94f4b3f833e04d67b9c8ce03; verified image manifest
  sha256:c588d1ad06b1d756a16fd7f16230803c6dee69809ab4367034706325d0080738.
  Its published source, binary and runtime-image security checks passed.

The unchanged Engine v0.183.354, Web Console 1.6.194, Host API 0.38.8,
Node Agent 0.13.33, authentication service 0.4.46 and other v1.6.546 inputs
retain their exact published bytes and security dispositions. This patch does
not change OIDC, MFA, API Key authorization or the host's firewall backend.

Network Plugin Manager v0.8.24 removes a destructive lifecycle path that
mistook legitimate overlapping Metadata/DNS containers for duplicates. Those
containers belong to the Server orchestration lifecycle, not the network
plugin. The manager now waits for Metadata recovery with bounded requests and
backoff, supports cancellation, and stays unready until both networking
reconcilers succeed. Other local orphan handling is preserved.

The isolated v1.6.546 Catalog upgrade exposed this issue and was rolled back
through the official Stack action. Agent updates and workload data were kept.
That recovery is not acceptance of the new plugin; it must pass a new real
Catalog upgrade, data-preservation, refresh and Server-restart check.

Upgrade and rollback

Preserve the existing three named volumes, all operator environment variables,
restart policy, AppArmor profile, HTTPS origin and authentication configuration.
Retain the previously accepted Server image and database backup; never use
docker compose down -v. Keep existing custom Catalog and agent overrides.

Older Network Plugin Manager releases still contain their original destructive
reaper. Do not assume that a successful Stack API response proves Metadata,
DNS or host-port health. Verify all replacement instances and the actual
network path before completing the upgrade. Existing installations require
the validated migration sequence in the final deployment evidence.

Officially unfixed LOW/MEDIUM CVEs remain tracked with their exact packages and
review dates. HIGH/CRITICAL, available fixes, unregistered findings and secrets
still block publication. This patch does not claim zero vulnerabilities or
Windows-host acceptance.

PastureStack Server v1.6.546

Server v1.6.546

Published image: ghcr.io/pasturestack/server:v1.6.546@sha256:7b29b87ab40f427c2a6a5909330dd859745e9f0780166658ffd0556b6f0873d2.

Source commit: c1b4b335f77f8faaae8239af9e8d5a8189ce07b8.

The release workflow passed its source, security, startup and restart checks before publishing this image. Deployment-specific acceptance is separate and is not claimed by these build results.

Verified component inputs

• Engine v0.183.354: original JAR from producer
  dc5a8d7bc44131f609f72a6504483b692d47ce16, SHA256
  f4889bfb8759a7664f07524bb129d0cda19f35604a06c877b6ca7033246df6fa.
  JDK 25 tests: 3,372 cases, no failures or errors, one platform-specific skip.
• Web Console 1.6.194 and API Explorer v1.1.20 retain their UI/API behavior
  while refreshing fixed tooling and dependencies. Original published bytes
  are used, not locally rebuilt substitutes.
• Host API 0.38.8, WebSocket Proxy 0.23.18, authentication service 0.4.46,
  host provisioner 0.39.10, telemetry 0.4.4, catalog service 0.20.15 and
  compose executor 0.14.39 use exact published archives and binary checksums.
• Node Agent 0.13.33 includes the matching Host API 0.38.8 supervisor
  contract. Linux and Windows packages retain their independently verified
  checksums; cross-compiling the Windows package is not Windows-host QA.
• CLI 0.6.20 preserves its existing command and authorization behavior and
  provides the original CI-tested platform archives through numeric URLs.
• Machine-driver bundle 0.16.5 replaces the inherited 0.14.0 runtime binary.
  The original archive, both Go executables and legal metadata are verified;
  Packet stays retired for new hosts and explicit operator URLs are retained.
• Catalog v0.3.14 source 28756cdf13f50380e907d37da501e33383a7c217
  selects the independently verified plugin releases; operator catalog overrides
  are not replaced. Catalog publication and Server runtime verification remain
  separate checks.
• Temurin 25.0.5+8 and fixed Ubuntu 26.04 packages retain the existing ABI
  and installed-package set. The build stage verifies the signed Ubuntu
  snapshot and each package's SHA256. The minimal runtime installs only
  already-present, older packages from that verified offline bundle; it does
  not need network access or an APT signature executable. The package manifest
  is retained under /usr/share/pasturestack/security/ for inspection.
• Ubuntu's zlib security backport 1:1.3.dfsg+really1.3.1-1ubuntu3.2
  replaces the formerly preferred upstream 1.3.2 library. This fixes
  CVE-2026-85091 while retaining
  the earlier CVE-2026-27171 fix. Assembly removes the superseded library;
  post-build checks verify the active linker target and package-owned bytes,
  not just the version recorded in the package database.

Compatibility and evidence

Existing OIDC, MFA, API Key, service-upgrade and permission contracts are not
changed. The publisher must pass the normal source, CodeQL, artifact,
security, startup and restart checks before publication. QA then verifies the
exact image on the isolated QA deployment, including login, authenticated APIs, WebSocket,
host/agent connectivity and retained workload data. Unrelated previously
accepted features are not represented as newly retested.

Raw scans and SBOMs remain separate from vulnerability dispositions. An
officially unfixed LOW/MEDIUM finding is tracked against its exact artifact,
package and version; that is not remediation. Available fixes, unregistered
findings, HIGH/CRITICAL issues and secrets still block publication.
The OpenPGP module advisory retains the independently reviewed component
dispositions. Before applying them, the publisher verifies each affected
executable path, module version and exact binary SHA256; a new or changed
consumer cannot inherit the exception just by using the same module version.

Upgrade and rollback

Preserve the three existing named volumes, all operator environment
variables, restart policy, AppArmor profile, HTTPS origin, OIDC settings and
the host's selected firewall backend. Back up the database before cutover and
keep the previously accepted v1.6.545 image/container. Do not run
docker compose down -v. Restore matching data if a rollback requires it.
No production configuration or data is changed by this QA.

An explicitly stored agent.image or bootstrap.required.image value takes
precedence over the new image defaults. Review those settings when upgrading
an existing installation; selecting the maintained Agent version is separate
from changing the Server image. Custom image choices must not be silently
overwritten. The embedded Host API and Go Agent package URLs are verified
independently through their effective values.

PastureStack Server v1.6.545

Server v1.6.545

Service upgrade and endpoint identity correction.

Server v1.6.545 is published from official source
858ec54df70b8089ef900a16bed1287d94e7f692.
Publisher 39893305304
completed successfully, and all 26 immutable release assets passed checksum
verification. The manifest is
sha256:f79279d9d00d0301353663e000dc41b1ed49efe45e4ed878e03d1207cfea2a44;
the distinct OCI config is
sha256:6fc2e01d80288d65991b3886cea5390395a754f3d22e3a9acd1576007f62ec6a.
The linux/amd64 image has one runtime layer, 516,540,955 compressed bytes.
Artifact identity, not an installation command:
ghcr.io/pasturestack/server:v1.6.545@sha256:f79279d9d00d0301353663e000dc41b1ed49efe45e4ed878e03d1207cfea2a44.

The QA installation now runs this exact image. Its first health check and an
actual Server restart passed with the same three persistent volumes, operator
overrides, restart policy and AppArmor profile. The previous container/image
and a verified consistent pre-upgrade database dump remain available.

The Engine component is now published as
v0.183.353.
Its tested producer is e094944cd81da614187dbeba1f06354682af1d45, with jar
SHA256 d0a353b40b8b9f739ddd30b9ccae6fbf3ca64d45547cd95e9194aad738538f40.
The original CI bytes passed anonymous release download verification. Both
frozen readonly/restricted schemas match the prior assembly.
Engine CI 39804958880
passed 3,372 tests with zero failures/errors and one intentional platform skip;
the endpoint suite passed all 26 cases without skips.

Corrected behavior

Web Console 1.6.193
completes 2,519 missing policy/matrix/audit translations
across 11 locales. Its original full CI passed 1,104 browser tests without
failures or skips and produced two identical static archives
(CI 39890788296).
The tested producer is
fa7fd399e3aef2a67282e8fbbe9f3fc83002710d, with archive SHA256
07dd68dddecec1d95c6932d4dd31084401ee67d517fb820ecbbe6afaa052a888.
The browser test image includes CJK and Arabic-script fonts; no product layout
assertion or localization fallback exception was relaxed.

The Web Console service-upgrade path previously performed a generic service
save before sending the upgrade action. That save could return HTTP 422 when
the clone contained a derived publicEndpoints entry for a removed instance.
Service upgrades now retain the normal validation/preflight and shared saving
lifecycle, but wait for the upgrade action and send its strategy directly.
Ordinary create/edit persistence is not changed.

The Engine previously compared public endpoints using only address and port.
Replacing an instance while retaining its address/port could therefore leave
the old instance reference in the service. The comparison now uses an
order-independent set of address, port, service, host and instance identities.
Reordering an identical set does not write it again. Reference validation is
not relaxed, and removed resources do not become valid references.

The CA bootstrap package download uses the official locked Ubuntu snapshot
after the moving archive removed the pinned version. Its package version and
SHA256 remain identical, verified against the signed snapshot package index.
The source gate requires that exact snapshot and checksum in all three Server
recipes; this is a source availability repair, not a dependency downgrade or
an exception to the artifact security gate.

Acceptance boundary

The fresh runtime scan also identifies CVE-2026-88648 on
libgnutls30t64 3.8.12-2ubuntu1.1. Canonical marks Ubuntu 26.04 as
vulnerable with a deferred fix, and its official OSV data has no fixed version.
This Medium finding is recorded for review on 2026-10-27, not suppressed or
claimed as fixed. The final merged-rootfs-and-active-payloads gate reports 74
raw findings; the exact-match pending register contains 30 unfixed LOW/MEDIUM
package occurrences across 19 CVEs. HIGH/CRITICAL, fixed-available, untracked
findings and secrets are all zero. These categories still block release;
tracking is not remediation or zero risk. See the
official status.

The stale-endpoint regressions and complete Web Console and JDK 25 Engine test
suites passed. A real primary service and sidekick upgraded from BusyBox 1.36.1
to 1.37.0. Browser evidence shows zero complete service PUTs, one upgrade 202
and the following service-link update 200. The shipped Finish Upgrade control
returned 202. API, database and actual Docker readback confirmed active/healthy
service state, running new instances, removed old instances, unchanged public
address/port, correct endpoint/expose/port ownership, retained volume marker,
environment, labels, scheduling and primary/secondary launch configuration.
The same new instances and settings survived an actual Server restart.

The first QA harness incorrectly attempted Finish Upgrade using raw fetch
without the application's CSRF header and was correctly rejected with 403.
That failed harness attempt is retained, not described as an uninterrupted
zero-error browser run. Finishing through the real UI produced no browser
errors. No CSRF, authentication or permission control was weakened.

The shipped key-editor preview passed in all 11 completed locales at a
1440-pixel desktop viewport. Both allow/deny states were compared against the
release's own translations, including the Persian RTL layout. The dialog and
document had no horizontal overflow; no Key was created or saved. After the
Server restart, the service detail page loaded again and displayed the new
image and running containers. This is not a mobile or audit-panel layout claim.

Upgrade and rollback

Keep the three existing persistent volumes, operator-provided environment,
restart policy, AppArmor configuration, HTTPS origin, authentication and
networking settings. Retain the previous official image and a pre-upgrade
database backup. This change does not require a schema migration.

Do not use a runtime JavaScript patch. A production installation with an older
read-only bundle override must not carry that old bundle into the new image;
its removal and deployment require separate authorization and acceptance.
This task does not operate on the company production site, proxy, firewall or
database. The QA Server rollout retains its previous container/image for
rollback and never removes persistent volumes.

PastureStack Server v1.6.544

Server v1.6.544

This document describes the 544 assembly. Source changes alone are not publication
proof; official release assets and published.txt identify the actual Server
source and distinct registry manifest and OCI config digests.

Official Server release

Server v1.6.544
was built from source d6e966329b588693a6b904989865e18f731ffbad by successful
publisher39726684553.
All 26 immutable release assets passed anonymous exact-set/checksum readback
without bypassing required checks. The linux/amd64 image has one runtime layer,
516,490,074 compressed bytes.

Image identity	Value
Registry manifest	sha256:e9015d5e6d6525a684feb0161918aa7d089ecaee136907119170a7b82cdda19d
Distinct OCI config	sha256:7ca8a7082b15e8d03ea3cfdc19d61fe77b35c012c1e63daf9f4a96a31fe46eb8

Use the published numeric v1.6.544 tag in the
installation examples.

The QA8080 upgrade and actual restart passed with matching source and image
identities. All three persistent volumes, runtime overrides and LB database
settings were preserved; a 543 rollback and backup were retained. This Server
switch does not establish upgraded Host/Node processes, active-stream remediation
or complete native-matrix acceptance.

Official component bytes

The assembly consumes the original tested Linux bytes from
Host API v0.38.7
and the original tested Linux and Windows packages from
Node Agent v0.13.31.
Their immutable assets passed anonymous exact-byte/checksum readback without a
required-check bypass. Server assembly does not rebuild these components.

Component	Actual CI/binary producer	Archive SHA256
Host API 0.38.7	cd2a8d2b5e37f1b79a4b487760db5f3f7b3f818b	f0e0033da7661d1444b73e2dc43f8b5c5dad6c9169ff2d19c1dcb6aa1c4435d9
Node Agent 0.13.31 Linux	68ae58d886621540208b98378ed517b3525244e0	d12da35517448fd26467ee71249976b224da8d07c9dd9feec7c3e49d2977df62
Node Agent 0.13.31 Windows	68ae58d886621540208b98378ed517b3525244e0	5b5e4610200139e89d962e2f10b6961d85ca2972a86cc4d4ddddbb8b600115ae

Host API preserves confirmed scoped authorization loss when a transport
disconnect races its authorization watcher. Before reporting an eligible
cancellation it can recheck the same signed grant within the existing total
report budget; this does not postpone closing the stream. Network or server
failure is not proof of revocation. Genuine completed EOF and backend failures,
ordinary JWT behavior and the single immutable terminal record remain preserved.
The final reason records authorization at finalization, not the first watcher.

Node Agent requires exactly Host API 0.38.7, with no version fallback. Both
platform binaries retain Go 1.27.3, CGO disabled, exact producer revision and
vcs.modified=false. Windows package qualification is not Windows-native
acceptance. The key-audit-v1 and key-delegation-v1 protocols are unchanged;
Proxy 0.23.17 needs no additional patch.

Preserved assembly and upgrade contracts

Engine 0.183.352, Web Console 1.6.192, CNI 0.2.5, CLI 0.6.19, LB
0.9.32 and all remaining component pins and frozen schemas are unchanged.
The 17 local inputs, 26 release assets, four actual nested Go qualifications,
independent nested scans/SBOM, separate JDK stage and one runtime layer remain
required. The final merged-rootfs-and-active-payloads security gate reports 73 raw
findings and 29 tracked unfixed LOW/MEDIUM package occurrences across 18 CVEs,
review 2026-10-27. Untracked, HIGH/CRITICAL, fixed-available and secrets are zero.
The four nested payloads retain their separate actual-binary qualifications,
raw scans and CycloneDX SBOM in server-nested-payloads.json. VEX and vendor
tracking change only their current release identity; policies, exclusions and
security thresholds are unchanged. Tracking is not remediation or zero risk.

Keep all three persistent volumes, runtime overrides, LB database settings,
custom audit directories and the previous official image and backups for rollback.
New bundled defaults do not upgrade existing running hosts by themselves. Source
and component CI evidence do not establish Server deployment, active-stream
remediation or complete native-matrix acceptance. Do not patch deployed binaries,
restore stale Key policies or weaken MFA to apply the update.