chen21019 · Oct 15, 2026 · Oct 15, 2026
@@ -1,5 +1,58 @@
 # Compatibility Contract
 
+## Server v1.6.535 published
+
+This patch packages immutable Engine `v0.183.349` with unchanged Web Console
+`1.6.189`. Engine producer: `0733430fac11892a17ba53749fe02d99d26b1f52`;
+`cattle.jar` SHA-256:
+`6e61f05598c12941c3b07ebfcf81f40e7fb1bd5439ec4c7d9c34484306378f04`.
+
+Server producer: `6b7dca3a4d9154e37f9475e7b47d73bce26e1938`.
+Official workflow [38672753267](https://github.com/PastureStack/server/actions/runs/38672753267)
+and immutable readback of 24 assets passed without bypassing required checks.
+The linux/amd64 image has one runtime layer. Manifest:
+`sha256:634613baf631d54e4cf576aeaa2f9f003b035fdfec4a28e28aa3c8f0aa38283d`.
+Distinct OCI config:
+`sha256:599313735f18cc95330e0bbb76bd76bd74251c8bc4f56cba019afed4a0a3fc31`.
+Documentation commits are separate from the immutable producer.
+
+Fifteen resource-typed action pairs extend scoped-Key admission and queued
+reclassification without adding restrictions to Full/legacy Keys or widening
+owner authority. The focused Engine suite passed 150 cases and affected Server
+packaging contracts passed 38 cases; unaffected suites are carried forward.
+No schema migration, runtime patch, authentication or firewall change is needed.
+
+The official 535 image passed QA startup/restart and ten bounded native Stack
+output cases across both API roots, with eight audit pairs and normal fixture
+cleanup. Actual 535 -> retained 534 -> 535 code rollback retained Closed/expired
+Key policy, revision and expiry in twelve denial cases without restoring the
+database. The final container was ready 535 and the two test Keys were removed.
+Prior six-role OIDC A comparisons retain their original 534 provenance; neither
+this release nor those results claim completion of every role/action combination.
+
+The final-image gate reports zero untracked, critical/high, fixed-available or
+secret findings under its existing vendor/VEX policy. It retains 22 unfixed
+MEDIUM package findings across 11 CVEs for review on 2026-10-20. Newly reported
+CVE-2026-107161 remains Ubuntu 26.04 Needs evaluation; its upstream CVSS 7.5 High
+score is retained, not represented as fixed or not affected. See the
+[release note](docs/releases/server-1.6.535.md) for acceptance and rollback limits.
+
+### Legacy CLI error reporting
+
+The configured official CLI `0.6.14` download is an external client, not an
+executable installed inside Server. Native Full and stored-null legacy Key
+`inspect` commands produced identical data with no extra authentication headers.
+Legacy policy readback is canonical Full with revision zero, not JSON null.
+
+The same client returned exit code zero and no output when a Closed Key was
+correctly rejected with HTTP 403 `KeyPolicyDenied`; the server's matching audit
+pair confirms denial, not successful access. This client error-reporting defect
+remains open. The maintained `0.6.17` source propagates the error, but it is not a
+published product and its original release gates have not passed. Do not treat
+empty CLI output or exit zero as proof of a successful API operation. Use an
+HTTP client that checks response status for constrained-Key automation until a
+verified maintained CLI is released. The server does not waive the Key policy.
+
 ## Server v1.6.534 published
 
 This release packages immutable Web Console `1.6.189` and unchanged Engine `v0.183.348`.

@@ -13,17 +13,14 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-Server [`v1.6.534`](https://github.com/PastureStack/server/releases/tag/v1.6.534)
-packages Web Console `1.6.189` and Orchestration Engine `v0.183.348`.
-Native clipboard behavior from 188 is retained and RTL step-circle alignment is repaired;
-the image also includes Ubuntu's official curl `8.18.0-1ubuntu2.8` security backport.
-
-Official publication, immutable readback and QA startup/restart passed with
-preserved volumes and runtime overrides. The final 52 browser cases comprise 44
-unaffected 188 results and 8 new 189 fa-ir/en-us views; HTTP fallback was newly run on 189.
-Broader role/backend/lifecycle acceptance and historical pending cases remain
-incomplete. See the [release note](docs/releases/server-1.6.534.md) for
-exact component identities, curl/VEX evidence and acceptance limits.
+Server [`v1.6.535`](https://github.com/PastureStack/server/releases/tag/v1.6.535)
+packages Web Console `1.6.189` and Orchestration Engine `v0.183.349`.
+Scoped API Keys recognize additional existing Stack, Service, Container and Volume
+actions through a resource-typed central registry. Full and legacy Keys retain
+the normal authorization path; a Key cannot exceed its owner's live permissions.
+See the [release note](docs/releases/server-1.6.535.md) for artifact identities,
+focused acceptance and upgrade/rollback boundaries. This is not a claim that
+every platform action or historical matrix item has been verified.
 
 Personal API Keys remain available without an accessible environment. Existing
 API authorization, registration, OIDC/MFA and performance settings retain their
@@ -47,6 +44,8 @@ Engine-verified project contexts; a caller-supplied project header is not a gran
 Delegated terminal/log access requires the verified Host API audit capability
 and a compatible Linux Node Agent lifecycle. Open a Key's audit from its action
 menu. See the [API Key guide](docs/api-keys.md) for policy and audit contracts.
+For automation, check HTTP status explicitly: legacy CLI `0.6.14` can silently
+exit successfully after a rejected request. See [client compatibility](COMPATIBILITY.md#legacy-cli-error-reporting).
 
 ## Quick start
 
@@ -58,15 +57,15 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.534
+  ghcr.io/pasturestack/server:v1.6.535
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.534
+    image: ghcr.io/pasturestack/server:v1.6.535
     restart: unless-stopped
     ports:
       - "8080:8080"

@@ -8,20 +8,19 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses published Server `v1.6.534`, packaging Web Console `1.6.189`
-and Engine `v0.183.348`. See the [release note](../releases/server-1.6.534.md)
+The example uses published Server `v1.6.535`, packaging Web Console `1.6.189`
+and Engine `v0.183.349`. See the [release note](../releases/server-1.6.535.md)
 for immutable identities and acceptance limits.
 
-This release retains these performance settings. Official image readback and
-QA startup/restart passed with preserved runtime overrides and volumes. The
-final 52 browser cases use 44 carried 188 results plus 8 new 189 views; ordinary-HTTP
-copy was newly verified on 189. This does
-not establish a performance benchmark or complete broader acceptance.
+This release retains the same performance-setting contract. Existing runtime
+overrides and volumes must be preserved on upgrade or code rollback. The scoped
+API Key action repair does not establish a performance improvement or complete
+broader acceptance.
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.534
+    image: ghcr.io/pasturestack/server:v1.6.535
     restart: unless-stopped
     ports:
       - "8080:8080"

@@ -3,6 +3,19 @@
 This patch packages immutable Engine `v0.183.349` with unchanged Web Console
 `1.6.189` and the existing component set.
 
+## Published artifact
+
+Server producer: `6b7dca3a4d9154e37f9475e7b47d73bce26e1938`.
+The normal official workflow
+[38672753267](https://github.com/PastureStack/server/actions/runs/38672753267)
+and immutable readback of 24 assets passed. The linux/amd64 image has one runtime
+layer; its manifest is
+`sha256:634613baf631d54e4cf576aeaa2f9f003b035fdfec4a28e28aa3c8f0aa38283d`.
+The distinct OCI config is
+`sha256:599313735f18cc95330e0bbb76bd76bd74251c8bc4f56cba019afed4a0a3fc31`.
+Installation examples use the numeric `v1.6.535` tag, not a digest-pinned command.
+Later documentation commits do not replace this producer.
+
 ## Scoped API Key action repair
 
 Fifteen exact persisted-resource/action pairs are registered centrally, including
@@ -24,9 +37,36 @@ Engine suite passed 150 cases without replaying unrelated suites.
 
 The previous Server's normal-vs-Full/legacy read comparison and six-role OIDC
 normal-vs-Full checks are carried as their original evidence. They cover the
-tested accounts and operations, not every account, action or matrix row. Native
-packaged action acceptance, official final-image security checks, deployment and
-rollback are separate gates; component publication alone does not prove them.
+tested accounts and operations, not every account, action or matrix row. On 534,
+the administrator comparison covered 156 read cases; six OIDC roles used one
+existing identity each, with exact visible-set/schema comparisons and bounded
+owned writes or foreign-ID rejection according to live capabilities. This is
+not a two-identities-per-role or whole-platform permission matrix.
+
+On the official 535 image, ten native cases across v1 and v2-beta passed:
+normal/Full compatibility, exact custom update, other-ID rejection and read-only
+rejection for Stack outputs. Eight authorization/response audit pairs matched
+request IDs. The two empty Stacks and three Keys were normally removed. This
+does not claim native coverage of all fifteen new mappings or every API action.
+
+QA startup and restart passed with original volumes and runtime overrides.
+An actual 535 -> retained 534 -> 535 stop/start cycle used the same database and
+normal session: twelve cases retained exact policy/revision/expiry and rejected
+Closed and expired Keys on both API roots. It finished on ready 535 and removed
+both test Keys. The expiration barrier uses the server clock; deliberately
+expired authentication is rejected before successful principal headers are set.
+No old database was restored. Deactivated-Key rollback and a full role/client
+rollback matrix are not claimed.
+
+The configured official external CLI `0.6.14` was also exercised without new
+headers. Full and stored-null legacy Keys returned identical native `inspect`
+data; each issued six HTTP 200 requests with complete audit pairs. A Closed Key
+was correctly rejected by Server with 403 `KeyPolicyDenied` and a matching audit
+pair, but the old CLI swallowed that error and exited zero with no output. This
+is an unresolved client-reporting failure, not authorization bypass or a complete
+interoperability PASS. The maintained source already fixes propagation; its
+formal release remains a separate required gate. No CLI artifact or release
+check was replaced, waived or declared successful by this Server release.
 
 ## Upgrade and rollback
 
@@ -39,3 +79,13 @@ The existing Ubuntu curl backport and precise OpenVEX decisions are unchanged.
 Unfixed LOW/MEDIUM findings remain in the versioned vendor-pending tracker;
 none is hidden or promoted to a HIGH waiver. The normal source, CodeQL and
 final-image security gates remain required.
+
+The first unpublished attempt was correctly rejected when the vulnerability
+feed added CVE-2026-107161 for two Cyrus SASL package versions. Ubuntu lists
+26.04 as [Needs evaluation](https://ubuntu.com/security/CVE-2026-107161), with
+Medium vendor priority and no fixed package. Its upstream CVSS v3 score is 7.5
+High. The exact versions were registered without changing packages, VEX decisions
+or security thresholds. The successful final gate records 22 unfixed MEDIUM
+package findings across 11 CVEs, review date 2026-10-20; zero untracked,
+critical/high, fixed-available and secret findings under the existing policy.
+Raw findings and the failed attempt remain evidence, not a zero-risk claim.