docs: record verified Server 1.6.537 publication

COMPATIBILITY.md

@@ -1,12 +1,18 @@
 # Compatibility Contract
 
-## Server v1.6.537 prepared, not published
-
-This candidate targets Web Console `1.6.190` and Engine `v0.183.350`.
-Component producer commits and artifact SHA-256 values are pinned in the recipe.
-Server producer, final image identity and official release checks remain pending. See the
-[candidate note](docs/releases/server-1.6.537.md). No Server537 publication or
-deployment is claimed; the Server536 identities below remain historical facts.
+## Server v1.6.537 published
+
+Immutable Server producer `f1df33f2a8b9e9265a9b8eeb9ad464786eb7f62e` packages
+official Web Console `1.6.190` and Engine `v0.183.350`. Official workflow
+[38742185175](https://github.com/PastureStack/server/actions/runs/38742185175)
+and anonymous exact-set readback of all 24 assets passed without bypassing checks.
+Manifest: `sha256:81aafa0347910449ef528526f02e75a12acfce2f3987b803b92cb3b96fd0ac2d`.
+Distinct OCI config: `sha256:f49f36d2d6d2bd397c62330a0ff616aa8a3bbd5fce9cba10da45efabf9144363`.
+Artifact identity (not an installation command):
+`ghcr.io/pasturestack/server:v1.6.537@sha256:81aafa0347910449ef528526f02e75a12acfce2f3987b803b92cb3b96fd0ac2d`.
+The linux/amd64 image has one runtime layer; documentation commits do not replace
+the producer. Numeric installation tags remain required. See the
+[release note](docs/releases/server-1.6.537.md).
 
 Stack and Service `archived` is a persisted boolean with missing values treated
 as false. Archive requires stopped services and instances, rejects system/driver
@@ -27,11 +33,16 @@ warns that mounts and volumes are retained and require operator backups.
 Reviewed pre-release isolated evidence covers focused tests, native role/Key
 archive/restore, thirteen-locale layouts, owner-read Key audit, and separate
 physical workload/mount preservation and first-host checks. It does not establish
-the final537 image or future published190/350 artifact identities. Existing API
+an exhaustive preserved-database upgrade or distributed race matrix. Separate
+official final-image startup/restart passed with HTTP200/pong after 12/8 polling
+attempts, with 34 MFA-policy API checks and seven registration-entry checks; this
+is not a Docker Healthcheck or a company-production deployment claim. Existing API
 Key policy, authentication/OIDC/MFA, three-volume persistence, CLI defaults,
 performance overrides and firewall contracts are not changed by this feature.
-Security document release IDs advance only; VEX statements, vendor findings and
-their review deadlines are preserved pending the new final-image security gate.
+The new final-image scan records 66 raw findings and the existing exact 22 unfixed
+package findings across 11 CVEs after VEX policy, review 2026-10-20. Its gate passed
+with zero untracked, critical/high, fixed-available or secret findings. VEX and
+vendor tracking are not remediation, a HIGH waiver or a zero-risk claim.
 
 ## Server v1.6.536 published
 

README.md

@@ -11,15 +11,19 @@ upstream history, authorship, licenses, and notices.
 
 <a id="current-release"></a>
 
-## Current source candidate
+## Current release
 
-Server `v1.6.537` is a prepared source candidate, not a published image.
-It targets Web Console `1.6.190` and Engine `v0.183.350` for persistent
-Stack/Service archive and restore. See the [candidate note](docs/releases/server-1.6.537.md)
-for the behavior, isolated acceptance scope, pinned component identities and
-remaining Server publication gates.
-The latest published release remains [Server `v1.6.536`](https://github.com/PastureStack/server/releases/tag/v1.6.536);
-its [release note](docs/releases/server-1.6.536.md) retains the official artifact evidence.
+[Server `v1.6.537`](https://github.com/PastureStack/server/releases/tag/v1.6.537)
+packages Web Console `1.6.190` and Engine `v0.183.350` for persistent
+Stack/Service archive and restore. The official source/build, fresh startup/restart,
+security/SBOM and anonymous artifact readback gates passed. See the
+[release note](docs/releases/server-1.6.537.md) for the immutable producer and
+image identities, archive behavior and bounded acceptance evidence.
+
+Producer: `f1df33f2a8b9e9265a9b8eeb9ad464786eb7f62e`.
+Manifest: `sha256:81aafa0347910449ef528526f02e75a12acfce2f3987b803b92cb3b96fd0ac2d`;
+distinct OCI config: `sha256:f49f36d2d6d2bd397c62330a0ff616aa8a3bbd5fce9cba10da45efabf9144363`.
+Documentation updates do not replace the producer or its immutable artifacts.
 
 Personal API Keys remain available without an accessible environment. See the [Host guide](docs/hosts/README.md) before enrolling a host.
 
@@ -46,9 +50,7 @@ Maintained CLI `0.6.18` propagates rejected requests as nonzero errors. Legacy `
 ## Quick start
 
 Public GHCR downloads do not require a registry login. Keep all three named volumes.
-The examples below target the prepared numeric `v1.6.537` tag; run them only after its official release.
-This candidate is not yet available from GHCR. Until publication, use the latest
-published release identified above.
+The examples below use the published numeric `v1.6.537` tag.
 
 ```sh
 docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \

docs/README.md

@@ -7,9 +7,11 @@ runtime gates have passed.
 
 ## Release notes
 
-- [Server v1.6.537 candidate](releases/server-1.6.537.md) — prepared for Web
-  Console `1.6.190` and Engine `v0.183.350` archive/restore. Component identities
-  are pinned; official Server image/publication gates remain pending.
+- [Server v1.6.537](releases/server-1.6.537.md) — published Web Console `1.6.190`
+  and Engine `v0.183.350` archive/restore; official source/build, fresh startup/restart,
+  final-image security/SBOM and anonymous 24-asset/image readback passed.
+  Immutable producer and manifest/config identities are recorded separately from
+  documentation. Pre-release feature acceptance retains its bounded original scope.
 
 - [Server v1.6.529](releases/server-1.6.529.md) — published with Engine
   `0.183.347` and Web Console `1.6.184` for subscription terminal audit and its

docs/performance/README.md

@@ -8,11 +8,15 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
-The example targets prepared Server `v1.6.537`, Web Console `1.6.190` and Engine
-`v0.183.350`; run it only after its official release and image have been published and read back.
-This candidate is not yet available from GHCR. See the
-[candidate note](../releases/server-1.6.537.md) for pinned component identities
-and the bounded pre-release acceptance evidence.
+The example uses published Server `v1.6.537`, Web Console `1.6.190` and Engine
+`v0.183.350`. Official workflow
+[38742185175](https://github.com/PastureStack/server/actions/runs/38742185175)
+and anonymous release/image readback passed. Immutable producer:
+`f1df33f2a8b9e9265a9b8eeb9ad464786eb7f62e`;
+manifest `sha256:81aafa0347910449ef528526f02e75a12acfce2f3987b803b92cb3b96fd0ac2d`;
+distinct OCI config `sha256:f49f36d2d6d2bd397c62330a0ff616aa8a3bbd5fce9cba10da45efabf9144363`.
+See the [release note](../releases/server-1.6.537.md) for component identities
+and the bounded acceptance evidence. Documentation changes do not replace the producer.
 
 This release retains the same performance-setting contract. Existing runtime
 overrides and volumes must be preserved on upgrade or code rollback. Archive and

docs/releases/server-1.6.537.md

@@ -1,12 +1,38 @@
-# Server v1.6.537 candidate
+# Server v1.6.537
 
-Prepared source only; no Server image or release has been published.
-
-This candidate targets Web Console `1.6.190` and Engine `v0.183.350` for
+Published Server `v1.6.537` packages Web Console `1.6.190` and Engine `v0.183.350` for
 Stack/Service archive and restore. It retains the pinned Server460 build base,
 the other component producers, maintained CLI `v0.6.18` defaults, authentication,
 performance settings and the three-volume persistence contract.
 
+## Immutable publication
+
+Producer: `f1df33f2a8b9e9265a9b8eeb9ad464786eb7f62e`.
+Official workflow
+[38742185175](https://github.com/PastureStack/server/actions/runs/38742185175)
+passed all source/build, fresh startup/restart, final-image security/SBOM and
+publication gates without bypassing required checks. Anonymous readback verified
+the exact 24-asset roster and SHA-256 values, registry identity, versions and source.
+
+Manifest: `sha256:81aafa0347910449ef528526f02e75a12acfce2f3987b803b92cb3b96fd0ac2d`.
+Distinct OCI config: `sha256:f49f36d2d6d2bd397c62330a0ff616aa8a3bbd5fce9cba10da45efabf9144363`.
+Artifact identity (not an installation command):
+`ghcr.io/pasturestack/server:v1.6.537@sha256:81aafa0347910449ef528526f02e75a12acfce2f3987b803b92cb3b96fd0ac2d`.
+The single linux/amd64 runtime layer was flattened from 22 build layers with
+identical runtime configuration. Documentation commits do not replace the producer.
+
+The official disposable database started/restarted to HTTP200/pong after 12/8
+polling attempts, including public-origin/private-cache checks, 34 MFA-policy API
+checks and seven registration-entry checks. These are not a Docker Healthcheck,
+an active-node registration proof or a company-production deployment claim.
+
+The final merged-rootfs scan (Trivy0.74.0) records 66 raw findings. After the
+existing exact VEX/vendor policy, 22 unfixed package findings across 11 CVEs remain
+tracked for review on 2026-10-20. The gate passed with zero untracked,
+critical/high, fixed-available or secret findings. Tracking is not remediation,
+not_affected or a HIGH waiver, and neither a source SBOM nor this gate proves zero risk.
+Image provenance and SBOM attestations were published for the manifest above.
+
 ## Behavior
 
 `archived` is a server-persisted boolean; missing values mean false. Archive
@@ -27,10 +53,10 @@ older Engines without the field do not offer archive. Native v1/v2-beta writes
 retain the original role and API Key `update` authorization, including live
 owner RBAC and scope limits. Archive writes send only `archived`.
 
-## Reviewed isolated candidate evidence
+## Reviewed isolated pre-release evidence
 
 The following local acceptance receipts concern pre-release feature inputs,
-not the final537 image or the future published190/350 artifact identities:
+not a rerun of the final537 image or a whole-platform acceptance matrix:
 
 - `backend-tests.json`: 63 unique focused tests, zero failures/errors/skips.
 - `frontend-tests.json`: 37 unique focused tests; 36 unaffected results are
@@ -57,15 +83,15 @@ not the final537 image or the future published190/350 artifact identities:
 
 These checks do not claim a full preserved-database upgrade, distributed
 multi-node race test, unrelated OIDC/MFA rerun or final release-image validation.
-Formal image health/restart, security scan/SBOM, anonymous asset readback and
-publication remain separate gates. Do not turn these local receipt names into
-published asset claims without attaching their reviewed immutable evidence.
+The separate final-image publication gates are recorded above. Do not turn these
+local receipt names into published asset claims without attaching their reviewed
+immutable evidence.
 
-## Component identities and remaining release gates
+## Component identities
 
 The recipe pins the following reviewed packager outputs, not previous189/349
-identities. Official component publication/readback must complete before Server
-assembly; the pins alone do not establish a published Server image.
+identities. Official Web190 and Engine350 publication and anonymous artifact
+readback completed before Server assembly; the pins alone are not publication evidence.
 
 | Input | Pinned value | Locations |
 | --- | --- | --- |
@@ -84,19 +110,16 @@ Its `WEB-INF/lib/cattle-resources-0.183.350.jar` contains `schema/v1/readonly.se
 and `schema/v1/restricted.ser` (355,023 bytes, SHA-256
 `f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51`).
 These actual reads confirm the retained frozen-schema pins for this artifact.
-Server537 producer commit, manifest/config digests, workflow and publication
-readback are also pending and must be recorded from the actual final outputs.
 
 The existing coordinate predicates continue to reject placeholders. OpenVEX and
 vendor tracking advance their release IDs only: the 69 VEX statements, 11
 vendor-pending CVEs/22 package rows, severities, fix policy and 2026-10-20 review
-deadline are unchanged. This metadata update is not a new scan or remediation;
-the new final-image security gate must still verify the exact current findings.
+deadline are unchanged. The metadata update is not remediation; the separate
+final-image scan verified the exact current findings as recorded above.
 
 ## Install and rollback boundary
 
 Operational examples use only `ghcr.io/pasturestack/server:v1.6.537`, never a
-digest-qualified or SHA-only installation tag. Run them only after official
-publication and readback. Preserve all three existing named volumes, runtime
-overrides and a working rollback container; do not restore old policy/revocation
+digest-qualified or SHA-only installation tag. Preserve all three existing named
+volumes, runtime overrides and a working rollback container; do not restore old policy/revocation
 or database state merely to roll back code. See the [upgrade guide](../upgrades/README.md).