chen21019 · Oct 15, 2026 · Oct 15, 2026
@@ -1,5 +1,24 @@
 # Compatibility Contract
 
+## Server v1.6.536 published
+
+Immutable Server producer `b8cefb51db7f5e88341fdf231f6ae43d773fb9c7` passed the original official workflow [38681298101](https://github.com/PastureStack/server/actions/runs/38681298101) and anonymous release readback. Manifest: `sha256:84b701244ccd83abc313cfad47c52edf9c58fa49cdd5c2da129cdac0c81d8094`. Distinct OCI config: `sha256:4b56a5f4f58edf2ff08414fde91cc70da440562d7b6264ec62aaca133c256237`. Artifact identity (not an installation command): `ghcr.io/pasturestack/server:v1.6.536@sha256:84b701244ccd83abc313cfad47c52edf9c58fa49cdd5c2da129cdac0c81d8094`. Documentation commits do not replace the producer. Numeric installation tags remain required.
+
+This packaging update retains Web Console `1.6.189`, Engine `v0.183.349`, API Key policy, authentication, volumes, performance settings and firewall behavior. QA startup/restart passed with the original runtime configuration. No database migration or runtime binary patch is used.
+
+### Maintained CLI error reporting
+
+Official immutable [CLI `v0.6.18`](https://github.com/PastureStack/cli/releases/tag/v0.6.18), producer `2fd1298ffdc25e17008cb089fccf7780ed8728d5`, passed its original release/security gates and anonymous archive/SHA256SUMS readback. The three external download defaults use the producer's platform-before-version names. `PASTURESTACK_CLI_RELEASE_BASE_URL` follows the effective `CATTLE_RANCHER_CLI_VERSION`; without it the historical RC16 layout remains available. Explicit DEFAULT/active URLs and saved database settings remain authoritative. Existing custom mirrors are not silently migrated. Changing a download setting does not install a binary inside Server.
+
+On the official Server535 QA runtime, the maintained native CLI performed the same ordinary inspect command with Full, absent-policy legacy and Closed Keys. Full/legacy DTOs matched exactly; Closed returned nonzero with HTTP403 `KeyPolicyDenied`, no DTO and matching authorization/response audit pairs. The single empty Stack, three Keys and temporary client directory were normally removed. This evidence retains its actual535 provenance; it is not a536 rerun or a whole-client/role matrix. The old0.6.14 silent exit-zero defect and original failure receipts remain historical evidence.
+
+E2E-02 acceptance is the bounded original F-G evidence plus root review of exact unchanged UI pointers, with original versions and original FAIL retained; no new browser run is claimed. Unchanged535 action/role/rollback evidence is carried only within its original scope. Remaining matrix gaps, historical HOLDs and deferred KVM work remain unverified.
+
+The Server final-image gate retains 22 unfixed package findings across 11 CVEs, review 2026-10-20. CLI retains 100 exact reviewed LOW/MEDIUM tracker rows under the approved no-fixed policy. Raw findings, vendor status and precise VEX decisions are preserved separately; tracking is not remediation, not_affected or a HIGH waiver. Source SBOM inventories do not prove runtime safety or zero risk.
+
+Preserve the existing named volumes and runtime overrides; retain the previous working container for code rollback without restoring old policy/revocation/expiry or database state.
+
+
 ## Server v1.6.535 published
 
 This patch packages immutable Engine `v0.183.349` with unchanged Web Console

@@ -13,18 +13,9 @@ upstream history, authorship, licenses, and notices.
 
 ## Current release
 
-Server [`v1.6.535`](https://github.com/PastureStack/server/releases/tag/v1.6.535)
-packages Web Console `1.6.189` and Orchestration Engine `v0.183.349`.
-Scoped API Keys recognize additional existing Stack, Service, Container and Volume
-actions through a resource-typed central registry. Full and legacy Keys retain
-the normal authorization path; a Key cannot exceed its owner's live permissions.
-See the [release note](docs/releases/server-1.6.535.md) for artifact identities,
-focused acceptance and upgrade/rollback boundaries. This is not a claim that
-every platform action or historical matrix item has been verified.
-
-Personal API Keys remain available without an accessible environment. Existing
-API authorization, registration, OIDC/MFA and performance settings retain their
-contracts. See the [Host guide](docs/hosts/README.md) before enrolling a host.
+Server [`v1.6.536`](https://github.com/PastureStack/server/releases/tag/v1.6.536) packages unchanged Web Console `1.6.189` and Engine `v0.183.349`, with maintained external CLI `v0.6.18` download defaults. Explicit saved URLs and operator overrides remain authoritative. See the [release note](docs/releases/server-1.6.536.md) for immutable identities, native command evidence and remaining acceptance boundaries. Existing API authorization, OIDC/MFA, registration and performance contracts remain unchanged.
+
+Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
 ## API Keys
 
@@ -44,8 +35,7 @@ Engine-verified project contexts; a caller-supplied project header is not a gran
 Delegated terminal/log access requires the verified Host API audit capability
 and a compatible Linux Node Agent lifecycle. Open a Key's audit from its action
 menu. See the [API Key guide](docs/api-keys.md) for policy and audit contracts.
-For automation, check HTTP status explicitly: legacy CLI `0.6.14` can silently
-exit successfully after a rejected request. See [client compatibility](COMPATIBILITY.md#legacy-cli-error-reporting).
+Maintained CLI `0.6.18` propagates rejected requests as nonzero errors. Legacy `0.6.14` can silently exit zero; see [client compatibility](COMPATIBILITY.md#maintained-cli-error-reporting) and check HTTP status explicitly for automation.
 
 ## Quick start
 
@@ -57,15 +47,15 @@ docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.535
+  ghcr.io/pasturestack/server:v1.6.536
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.535
+    image: ghcr.io/pasturestack/server:v1.6.536
     restart: unless-stopped
     ports:
       - "8080:8080"

@@ -8,19 +8,18 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example uses published Server `v1.6.535`, packaging Web Console `1.6.189`
-and Engine `v0.183.349`. See the [release note](../releases/server-1.6.535.md)
+The example uses published Server `v1.6.536`, packaging Web Console `1.6.189`
+and Engine `v0.183.349`. See the [release note](../releases/server-1.6.536.md)
 for immutable identities and acceptance limits.
 
 This release retains the same performance-setting contract. Existing runtime
-overrides and volumes must be preserved on upgrade or code rollback. The scoped
-API Key action repair does not establish a performance improvement or complete
-broader acceptance.
+overrides and volumes must be preserved on upgrade or code rollback. The CLI download-default update does not establish a performance improvement
+or complete broader acceptance.
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.535
+    image: ghcr.io/pasturestack/server:v1.6.536
     restart: unless-stopped
     ports:
       - "8080:8080"

@@ -1,23 +1,17 @@
-# Server v1.6.536 candidate
-
-This packaging update changes the three default external CLI download links and
-advertised CLI version to the maintained `v0.6.18` release. It does not replace
-the unchanged Web Console `1.6.189` or Engine `v0.183.349`, change API Key policy,
-authentication, firewall rules, volumes or operator runtime configuration.
-
-The old `0.6.14` client swallowed a rejected schema request and exited zero.
-The maintained CLI propagates the original failure. CLI publication/security
-checks, exact release checksums and native Full/legacy/Closed command acceptance
-remain required; this candidate is not a claim that they have passed.
-
-Explicit URL settings already saved in the database remain authoritative. An
-upgrade does not silently replace an operator's mirror or pinned client. If a
-saved URL still points to the historical Server `v1.6.278` CLI `0.6.14` asset,
-an administrator can update the three `rancher.cli.*.url` settings through the
-normal settings API/UI after verifying the new release checksums. Preserve any
-intentional custom URLs. No database script or runtime binary patch is required.
-
-The full Server release and final-image checks must pass before publication.
-Existing 535 acceptance is carried only where unchanged. Installation continues
-to use a numeric image tag; do not overwrite earlier releases. Keep the previous
-container and its configuration for rollback, without restoring an older database.
+# Server v1.6.536
+
+Immutable Server producer `b8cefb51db7f5e88341fdf231f6ae43d773fb9c7` passed the original official workflow [38681298101](https://github.com/PastureStack/server/actions/runs/38681298101) and anonymous release readback. Manifest: `sha256:84b701244ccd83abc313cfad47c52edf9c58fa49cdd5c2da129cdac0c81d8094`. Distinct OCI config: `sha256:4b56a5f4f58edf2ff08414fde91cc70da440562d7b6264ec62aaca133c256237`. Artifact identity (not an installation command): `ghcr.io/pasturestack/server:v1.6.536@sha256:84b701244ccd83abc313cfad47c52edf9c58fa49cdd5c2da129cdac0c81d8094`. Documentation commits do not replace the producer. Numeric installation tags remain required.
+
+This packaging update retains Web Console `1.6.189`, Engine `v0.183.349`, API Key policy, authentication, volumes, performance settings and firewall behavior. QA startup/restart passed with the original runtime configuration. No database migration or runtime binary patch is used.
+
+### Maintained CLI error reporting
+
+Official immutable [CLI `v0.6.18`](https://github.com/PastureStack/cli/releases/tag/v0.6.18), producer `2fd1298ffdc25e17008cb089fccf7780ed8728d5`, passed its original release/security gates and anonymous archive/SHA256SUMS readback. The three external download defaults use the producer's platform-before-version names. `PASTURESTACK_CLI_RELEASE_BASE_URL` follows the effective `CATTLE_RANCHER_CLI_VERSION`; without it the historical RC16 layout remains available. Explicit DEFAULT/active URLs and saved database settings remain authoritative. Existing custom mirrors are not silently migrated. Changing a download setting does not install a binary inside Server.
+
+On the official Server535 QA runtime, the maintained native CLI performed the same ordinary inspect command with Full, absent-policy legacy and Closed Keys. Full/legacy DTOs matched exactly; Closed returned nonzero with HTTP403 `KeyPolicyDenied`, no DTO and matching authorization/response audit pairs. The single empty Stack, three Keys and temporary client directory were normally removed. This evidence retains its actual535 provenance; it is not a536 rerun or a whole-client/role matrix. The old0.6.14 silent exit-zero defect and original failure receipts remain historical evidence.
+
+E2E-02 acceptance is the bounded original F-G evidence plus root review of exact unchanged UI pointers, with original versions and original FAIL retained; no new browser run is claimed. Unchanged535 action/role/rollback evidence is carried only within its original scope. Remaining matrix gaps, historical HOLDs and deferred KVM work remain unverified.
+
+The Server final-image gate retains 22 unfixed package findings across 11 CVEs, review 2026-10-20. CLI retains 100 exact reviewed LOW/MEDIUM tracker rows under the approved no-fixed policy. Raw findings, vendor status and precise VEX decisions are preserved separately; tracking is not remediation, not_affected or a HIGH waiver. Source SBOM inventories do not prove runtime safety or zero risk.
+
+Preserve the existing named volumes and runtime overrides; retain the previous working container for code rollback without restoring old policy/revocation/expiry or database state.