chen21019 · Oct 14, 2026 · Oct 14, 2026
@@ -1,15 +1,23 @@
 # Compatibility Contract
 
-## Server v1.6.530 source candidate, not published
-
-This candidate packages immutable Web Console `1.6.185` with unchanged Engine
-`v0.183.347`. Authenticated users without an environment can open their own
-API Keys at `/account/keys`; the page shares the existing Key editor and audit
-viewer, loads both personal Key subtypes and does not request environment Keys.
-Existing environment navigation, owner RBAC, MFA and Key policy are unchanged.
-Ten focused Web tests passed. Server publication, packaged native acceptance
-and deployment are pending; the current installation remains published
-`v1.6.529`. See the [candidate note](docs/releases/server-1.6.530.md).
+## Server v1.6.531 source candidate, not published
+
+This candidate packages immutable Engine `v0.183.348` and Web Console `1.6.186`.
+The shared Default uses the configured public Native project template; catalog
+reload also repairs its empty binding when the template is already installed.
+Existing bindings, custom settings and other projects are preserved. Definitions
+may exist with zero hosts; service activation waits for an active host.
+Native machine-driver cards display their distinct API names without changing
+driver records, IDs, initialization or action targets. Catalog localization and
+intentional empty display names are preserved. The personal API Key page,
+owner RBAC, role schemas, HTTPS, MFA and provider/backend behavior are unchanged.
+
+Fourteen focused Engine and four rendered Web cases passed. Both component
+releases passed immutable anonymous readback; this does not establish Server
+publication, fresh-install/first-host readiness or driver initialization/restart
+acceptance. Server packaging, publication and native acceptance are pending.
+Installation examples retain an existing released tag until those gates pass.
+See the [candidate note](docs/releases/server-1.6.531.md).
 
 ## Server v1.6.529 published
 

@@ -0,0 +1,51 @@
+# Server v1.6.531
+
+本版目前為來源組裝候選，尚未發布 Server 映像。
+組裝已正式不可變發行的 Engine `v0.183.348` 與 Web Console `1.6.186`。
+
+Engine 的預設專案範本名稱對齊真正 Catalog `project.yml` 的
+`PastureStack Native`。乾淨安裝的共用 Default 能自動綁定範本；
+catalog reload 也可補上已安裝範本、但 `adminProject` 仍未綁定的狀況。
+補綁只接受有效設定名稱符合的 public 範本、目前版本且未移除的 Default，
+使用原範本 lock，先持久化綁定再觸發原 system-stack 流程。
+不覆蓋已有綁定、明確自訂設定或其他專案；不使用別名 fallback、
+直接資料庫修補、手動補 stack 或 provider/backend 替換。
+
+零主機時可先有 network-services、IPsec、scheduler 與 healthcheck 定義，
+服務啟動沿用首台 active host 的正常觸發。Network、Metadata、DNS 與 health
+實際就緒仍須完成首台主機原生驗收，不能以 API 啟動或空容器清單宣告成功。
+
+Web 的原共用 driver card 在模型沒有 `catalogDisplayName` 時顯示 native API
+名稱，讓共用通用圖示的 `hyperv`、`libvirt`、`vmwarefusion`、`virtualbox`
+仍有各自名稱與 ID。Catalog 的本地化、格式化及刻意空白 display name 保留。
+不刪除 driver、不合併記錄、不改初始化或操作目標；既有本人 API Key 頁保持。
+
+## 元件輸入與驗收邊界
+
+- Engine 正常合併來源：`f19cd64183c0fa93464e9a9f9c2477c9e902b56d`。
+  `cattle.jar` 為 87,888,240 bytes，SHA-256：
+  `72581f6eead8633b6bbafbe15512cd44561b9ff25df68d00dd7120ad507aa449`。
+  14 項定向案例通過；原封裝／成品 gates 與測試來源對應的
+  4 個 production class、預設 properties 精確 bytes 核對通過。
+- Web 正常合併來源：`236973cb28dd7600a697902e3e3445b1a210a87a`。
+  `web-console-1.6.186.tar.gz` 為 3,023,477 bytes，SHA-256：
+  `95b319150d75b927b5474400129eee43eeec181a86c5b6d5065d44815df3da76`。
+  4 項實際頁面 render 案例通過，涵蓋 en-us、zh-tw、native driver 名稱與 ID、
+  320px card 容器、Catalog 語系切換及刻意空白 display name。
+- 兩個元件的正式不可變發行與匿名成品讀回已完成，正常合併與必要 checks
+  未繞過。上述是元件證據，不是 Server native 或完整矩陣 PASS。
+
+其他元件及 pins、工具鏈、readonly/restricted schema SHA、後端、角色、
+HTTPS origin、MFA、nftables、Compose／HA 與資料庫結構均保留。
+安全清單僅更新 Server 數字識別；VEX 決策、vendor-pending exact-set、
+原必要 gates 與既有元件歷史負控制不弱化。
+
+Server 原來源／封裝、安全／SBOM、CodeQL、不可變發行及成品讀回仍須通過。
+乾淨安裝的零主機／首台主機 readiness、driver 初始化／重啟識別及部署待驗。
+README 安裝範例暫維持已存在發行 tag；531 實際發行及原生驗收後才更新。
+
+## 升級與回復
+
+使用完成正式發行與讀回的整套 Server 映像，不在運行容器中替換元件。
+保留既有環境變數、三個 named volumes、restart、安全設定、HTTPS origin、
+OIDC 與 nftables 架構；先備份資料庫與設定並保留已驗收版本的回復點。
@@ -526,7 +526,7 @@ require_marker "$release_dockerfile" \
     'ARG BASE_IMAGE=ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403' \
     SERVER_INCREMENTAL_RELEASE_BASE_MISSING
 require_marker "$release_dockerfile" \
-    'ARG SERVER_RELEASE_TAG=v1.6.530' \
+    'ARG SERVER_RELEASE_TAG=v1.6.531' \
     SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
 require_marker "$release_dockerfile" \
     'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -567,16 +567,16 @@ require_marker "$publish_workflow" \
     'bash source/server/artifacts/verify-host-api-package.sh' \
     SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.185' \
+    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.186' \
     SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.185.tar.gz' \
+    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.186.tar.gz' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT_SHA256=49ac7dff80143329e88ab036a50fdb9e3a043412f67ca68fabe3b485c87df05e' \
+    'ARG WEB_CONSOLE_ARTIFACT_SHA256=95b319150d75b927b5474400129eee43eeec181a86c5b6d5065d44815df3da76' \
     SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_COMMIT=ad5a68dd30a6e136745123e26c97c4925c2ed263' \
+    'ARG WEB_CONSOLE_COMMIT=236973cb28dd7600a697902e3e3445b1a210a87a' \
     SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING
 require_marker "$release_dockerfile" \
     "grep -aF 'hostsPage.permissionDenied'" \
@@ -585,16 +585,16 @@ require_marker "$release_dockerfile" \
     '"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING
 require_marker "$build_script" \
-    'web_console_commit=${WEB_CONSOLE_COMMIT:-ad5a68dd30a6e136745123e26c97c4925c2ed263}' \
+    'web_console_commit=${WEB_CONSOLE_COMMIT:-236973cb28dd7600a697902e3e3445b1a210a87a}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING
 require_marker "$build_script" \
-    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.185}' \
+    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.186}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.185.tar.gz}' \
+    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.186.tar.gz}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING
 require_marker "$build_script" \
-    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-49ac7dff80143329e88ab036a50fdb9e3a043412f67ca68fabe3b485c87df05e}' \
+    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-95b319150d75b927b5474400129eee43eeec181a86c5b6d5065d44815df3da76}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING
 require_marker "$release_dockerfile" \
     'ARG CATALOG_SERVICE_VERSION=0.20.13' \
@@ -1059,21 +1059,21 @@ require_marker "$build_script" \
     '--file server/Dockerfile.web-compose-release' \
     SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
 require_marker "$build_script" \
-    'image=${IMAGE:-pasturestack-validation/server:v1.6.530}' \
+    'image=${IMAGE:-pasturestack-validation/server:v1.6.531}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.530}' \
+    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.531}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
 require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
     SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING
 for release_engine_marker in \
-    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.347' \
+    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.348' \
     'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar' \
-    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=22751db8829767d1ab9caedbca4e29de5260f26cafa677abb6f3ee0ee3c7e6f6' \
-    'ARG ORCHESTRATION_ENGINE_COMMIT=09eb6950551b65c514786b4a1dee91fcfd8aa43b' \
+    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=72581f6eead8633b6bbafbe15512cd44561b9ff25df68d00dd7120ad507aa449' \
+    'ARG ORCHESTRATION_ENGINE_COMMIT=f19cd64183c0fa93464e9a9f9c2477c9e902b56d' \
     'COPY --from=release_artifacts /out/orchestration-engine.jar /tmp/orchestration-engine.jar' \
-    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.347' \
+    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.348' \
     'grep -Fx "Implementation-Version: ${ORCHESTRATION_ENGINE_VERSION}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar' \
@@ -1094,10 +1094,10 @@ for release_engine_marker in \
         SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING
 done
 for release_engine_build_marker in \
-    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.347}' \
+    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.348}' \
     'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}' \
-    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-22751db8829767d1ab9caedbca4e29de5260f26cafa677abb6f3ee0ee3c7e6f6}' \
-    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-09eb6950551b65c514786b4a1dee91fcfd8aa43b}' \
+    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-72581f6eead8633b6bbafbe15512cd44561b9ff25df68d00dd7120ad507aa449}' \
+    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-f19cd64183c0fa93464e9a9f9c2477c9e902b56d}' \
     'CATTLE_CATTLE_VERSION="${orchestration_engine_release_tag}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     'test "${hazelcast_entry}" = "WEB-INF/lib/hazelcast-5.7.5.jar"'; do
@@ -2146,7 +2146,7 @@ done
 
 jq -e '
   .["@context"] == "https://openvex.dev/ns/v0.2.0"
-  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.530"
+  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.531"
   and (.statements | length) == 51
   and ([.statements[].vulnerability.name] | length == (unique | length))
   and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2172,7 +2172,7 @@ jq -r '
   | @tsv
 ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
 bash "$vendor_pending_validator" "$runtime_vendor_pending" \
-    "$vendor_pending_fixture" v1.6.530 >/dev/null
+    "$vendor_pending_fixture" v1.6.531 >/dev/null
 bash scripts/test-vendor-pending-findings.sh >/dev/null
 rm -f "$vendor_pending_fixture"
 trap - EXIT
@@ -2261,4 +2261,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.530 base=v1.6.460 engine=0.183.347 web_console=1.6.185 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.7 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.531 base=v1.6.460 engine=0.183.348 web_console=1.6.186 catalog_service=0.20.13 webhook_automation_service=0.10.4 authentication_service=0.4.43 curl=8.18.0-1ubuntu2.7 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'