diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index d7e93103a6..160bcc1134 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -1,19 +1,41 @@ # Compatibility Contract -## Engine 0.183.366 candidate - -This candidate adds bounded `ports` and `healthCheck` parameters only to typed -Service creation. Compatible clients must keep read-only -`executionResult.assignedPorts` separate from the approved change summary. -Services are still created inactive, and private human entry of environment -values remains pending. Current role/Key checks, Full/legacy behavior, runtime -dependency coordinates and database schemas are unchanged. - -Native IPv6 port formatting now retains brackets for roundtrip parsing; -existing database values are not rewritten. Formatter coverage does not prove -host IPv6 binding or routing. Required CI/CodeQL, artifact qualification and -matching Server/native acceptance remain pending; see the -[candidate release note](docs/releases/orchestration-engine-0.183.366.md). +## Engine 0.183.366 release + +The [published release](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.366) +adds bounded `ports` and `healthCheck` parameters +only to typed Service creation. Compatible clients keep read-only +`executionResult.assignedPorts` separate from the approved summary. Services +are created inactive; private human entry of environment values in these +parameters remains unimplemented. Catalog's native dynamic-field projection +now preserves business values under the same role schema, formatter and +non-create-response rules. Full/legacy Key behavior, current role/Key checks, +runtime dependency coordinates and database schemas remain unchanged. + +Original CI/CodeQL and artifact qualification passed: 420 suites / 3,912 tests / +zero failures/errors / one existing skip. Relative to published Engine 0.183.365, +the 62-case focus contains 21 new methods (19 Service creation and two Materializer) and 41 +inherited methods. Full affected classes contain 63 methods, including one +additional existing Materializer method. All 97 required methods passed, retaining +the prior 95 requirements. All 1,396 operation tuples plus the source/unknown-action +row passed; the 441-input fingerprint and tuple/admission classifications were +verified. Three new role entries expose only the server-produced result as read; +there are no new mutation grants. + +All 12 original assets passed anonymous checksum readback. The +[release note](docs/releases/orchestration-engine-0.183.366.md) records the signed +producer, normal merge/tag, tested tree and original JAR SHA256. All 16 packaged +frozen `.ser` files match Engine 0.183.365 source bytes; five published role-schema +hashes match that baseline. Four packaged native JSON schemas bind the bounded +result projection. +The 89 POMs and four build scripts are version-only updates. No publication +rebuild or native SLSA attestation is claimed. + +Native IPv6 formatting preserves brackets for roundtrip parsing without rewriting +existing data. Host IPv6 binding/routing and matching Server/native business, +role/Key/cross-ID workflows remain pending. Component qualification and publication +are separate from runtime QA. Older sections below retain release-time evidence, +not current whole-platform acceptance. ## Engine 0.183.364 release diff --git a/README.md b/README.md index 50180d8413..f0fa819c5b 100644 --- a/README.md +++ b/README.md @@ -8,36 +8,35 @@ Rancher 1.6 ecosystem. It is not affiliated with Rancher Labs or SUSE. This fork of [`rancher/cattle`](https://github.com/rancher/cattle) preserves upstream history, authorship, licenses, and dependency notices. -## Engine 0.183.366 candidate +## Current release: Engine 0.183.366 -This source tree prepares Engine 0.183.366; the candidate is not published. -The published baseline is -[Engine 0.183.365](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.365). -Use the +[Engine 0.183.366](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.366) is published with 12 original assets verified by +anonymous SHA256 readback. Use the [Server installation guide](https://github.com/PastureStack/server#quick-start) for deployment; an Engine JAR alone is not a Server installation. -The candidate extends human-reviewed Service creation with bounded native -`ports` and `healthCheck` fields. Preview, confirmation and apply recheck the -existing native port preflight. Created Services remain inactive; starting -one requires a separate approved plan. A successful receipt exposes the actual -assigned ports through read-only `executionResult.assignedPorts`, while the -approved change summary remains unchanged. Native IPv6 port formatting now -preserves the brackets needed to read a mapping back through `PortSpec`. -Private human input for environment-variable values is not implemented in this -candidate; `environment` remains outside resource-change parameters. +Service creation accepts bounded native `ports` and `healthCheck` fields in +human-reviewed plans. Preview, confirmation and apply repeat native port +preflight. Created Services remain inactive; starting one requires a separate +approved plan. A verified successful receipt reports actual assigned ports in +read-only `executionResult.assignedPorts`, without changing the approved summary. +Native IPv6 mappings retain their roundtrip brackets. Private human input for +environment values remains unimplemented in Service creation parameters. + +Catalog transformation now retains native dynamic image, environment, port and +log-configuration values through the existing role-schema projection. Hidden, +read-on-create-only and unlisted fields retain their output restrictions. | Qualification | Current evidence | |---|---| -| Focused source checks | 60 unique unit cases passed on JDK 25 and Maven 3.9.16. Three test-fixture setup corrections were rerun alone; unaffected PASS evidence was retained. | -| Candidate qualification and publication | Required original component CI/CodeQL, complete package qualification and publication remain pending. No candidate artifact digest or release asset is claimed. | -| Assembled Server and live workflows | Matching Web Console/Server integration and native role/Key workflows remain pending. IPv6 formatter tests do not establish host IPv6 binding or routing acceptance. | +| Original component CI and artifact | Required CI/CodeQL and artifact qualification passed: 420 suites / 3,912 tests / zero failures/errors / one existing skip. The 62-case focus contains 21 new and 41 inherited methods; full affected classes contain 63 methods. All 97 required identities passed. | +| Public bytes | All 12 original assets passed anonymous checksum readback; no publication rebuild was performed. | +| Assembled Server and live workflows | Matching Server/native business, role/Key and designated workflow acceptance remain pending. Component publication and IPv6 formatting tests do not prove runtime or host IPv6 acceptance. | -Use the compatible Web Console typed contract and matching Server broker. Four independent AI opt-ins remain default-off. The -[candidate release note](docs/releases/orchestration-engine-0.183.366.md) records -the exact supported fields and remaining boundaries. This does not complete all 243 frontend -business groups. +[release note](docs/releases/orchestration-engine-0.183.366.md) records exact +published identities, supported fields and compatibility limits. These component +results do not complete all 243 frontend business groups. ## Optional AI resource workflows @@ -51,9 +50,9 @@ private keys, raw process logs or full launch configurations. Queries and opaque pagination remain subject to the underlying domain manager's authorization. `aiResourceChangePlan` supports Stack, Service and Container creation, metadata -editing and the explicitly registered lifecycle operations. In this candidate, -Service creation additionally accepts native port-specification strings and a -closed health-check object. Fixed host ports must match the actual result; +editing and the explicitly registered lifecycle operations. Service creation +accepts native port-specification strings and a closed health-check object. Fixed +host ports must match the actual result; omitted host ports use native allocation and are reported only after verified readback. It does not cover every advanced UI field or private environment-value entry. A short-lived plan captures the target state and @@ -163,7 +162,7 @@ evidence are maintained in the Acceptance is limited to the documented affected paths, not every resource and role combination. Versioned evidence and upgrade boundaries are in the -[361 release note](docs/releases/orchestration-engine-0.183.361.md); +[366 release note](docs/releases/orchestration-engine-0.183.366.md); older changes remain in [release notes](docs/releases). ## Build and validation diff --git a/docs/releases/orchestration-engine-0.183.366.md b/docs/releases/orchestration-engine-0.183.366.md index 643c07a978..9a62d2782a 100644 --- a/docs/releases/orchestration-engine-0.183.366.md +++ b/docs/releases/orchestration-engine-0.183.366.md @@ -1,8 +1,9 @@ -# Engine 0.183.366 candidate +# Engine 0.183.366 -This candidate is not published. Required original component CI/CodeQL, -complete artifact qualification and matching Web Console/Server native -acceptance remain pending. The published baseline is Engine 0.183.365. +[Engine 0.183.366](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.366) +is published. Required original component CI/CodeQL, +artifact qualification and anonymous readback of all 12 original assets passed. +Matching assembled Server/native business acceptance remains pending. ## Service creation @@ -61,7 +62,8 @@ mapping, log driver/configuration and bean-backed name. Narrowed schemas, read-on-create-only fields and unlisted dynamic fields still restrict output, and the source dynamic map retains its business values. This corrects the existing Catalog projection; it adds no permission or new environment-input -channel. Matching artifact and native workflow acceptance remain pending. +channel. Artifact qualification passed; matching native workflow acceptance +remains pending. ## Verified results and compatibility @@ -89,17 +91,57 @@ runtime dependency coordinates and database schemas are unchanged. Clients must understand these typed fields and the read-only execution result. Consume a qualified component through a matching published Server release. -## Focused evidence - -60 unique focused cases passed with JDK 25 and Maven 3.9.16. They cover the -native parser/preflight path, post-preview conflicts and revocation before -claim, bounded input, actual readback, UUID rebinding, uncertain operations, -execution-result separation and IPv6 formatting. Three test-fixture setup -corrections were rerun alone; unaffected PASS evidence was retained. These -source results do not establish full CI, published artifact or native workflow -acceptance, and no final CI total or artifact digest is claimed. - -The Catalog projection correction passed two new real-schema regression -methods and one directly affected existing Materializer method. Its C03 -source review independently re-extracts all 1396 operation tuples and their -semantic/admission dispositions; those classifications remain unchanged. +## Qualified component evidence + +Original [Security CI 41328904546](https://github.com/PastureStack/orchestration-engine/actions/runs/41328904546), +[custom CodeQL 41328904462](https://github.com/PastureStack/orchestration-engine/actions/runs/41328904462) and +[organization CodeQL 41328907700](https://github.com/PastureStack/orchestration-engine/actions/runs/41328907700) +passed, with zero CodeQL aggregator annotations and no new alerts. The original +structured Surefire report contains **420 suites / 3,912 tests / zero failures / +zero errors / one existing skip**. + +The reviewed 62-case focus comprises **21 new source methods relative to Engine 0.183.365** +(19 Service creation and two Materializer) and 41 inherited methods. Full affected +classes add one existing Materializer method, giving 63 observed methods. These +are not 62 new tests. All 97 required method identities passed; the prior 95 +requirements were retained and two Materializer regressions were added. The +Materializer cases use the real transformer and native role schemas. + +All 1,396 operation tuples plus the source/unknown-action row passed (1,397 rows). +Independent source re-extraction preserved every tuple, semantic and admission +disposition. The 441 production inputs have fingerprint +`7ce17c8b05ccfba961414808148d8638bf54a9ad3bbc7de00facfcba4b26ac39`. +Three explicit new role entries provide read-only access to the server-produced +execution result; no mutation grant is added. Historical producer355 and review +chains remain intact. + +Eight changed production classes have original-artifact class/module hashes and +reviewed disassembly. All 16 packaged frozen `.ser` files match Engine 0.183.365 +source bytes, and five frozen role-schema hashes match that published baseline. +Four packaged native JSON schemas bind the bounded result projection. The 89 POMs and four build scripts +are version-only changes. The packaged official MariaDB JDBC3.5.11, CycloneDX +SBOM and original product/raw/effective Dapper scan evidence passed the existing +security gates without an exception. No new scan is claimed during qualification. + +## Published identities + +| Identity | Published value | +|---|---| +| Signed producer | `3ce114486954403cead091379916c2d69c052336` | +| Normal merge and tag source | `bbba0e5a3e40ed58c98643610943586d0e521328` | +| Tested whole tree | `f9482dd3c8c0a1e24763c23009ea50ddccc2e66e` | +| Original cattle.jar SHA256 | `0fd51b38c22c495d5f245527213807fa486e3bba571756b410ef6292f424db81` | +| Original cattle.jar size | 88,245,511 bytes | + +The [release metadata](https://github.com/PastureStack/orchestration-engine/releases/download/v0.183.366/engine366-release-metadata.json) +records the complete original-CI and packaged evidence. All 12 original release +assets passed anonymous SHA256 readback. The JAR was streamed from the retained +original CI ZIP; no publication rebuild or second full JAR was produced. The +workflow provides original artifact/source/tree/lock provenance and does not +provide native SLSA attestation; none is inferred. + +Matching Server565 / Engine366 / Web205 / Bridge027 / Compose14.41 assembly and +designated native, Catalog private human input, role/Key/cross-ID, IPv6 and +weak-model workflows remain separate pending QA. Existing failures and unaffected +PASS evidence remain separate. Component CI and publication do not establish +complete frontend or all 243 business workflows.