Skip to content

docs: synchronize published Engine 0.183.366 evidence #153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chen21019 merged 1 commit into from
Nov 1, 2026
Merged

docs: synchronize published Engine 0.183.366 evidence #153

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 36 additions & 14 deletions COMPATIBILITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,41 @@
# Compatibility Contract

## Engine 0.183.366 candidate

This candidate adds bounded `ports` and `healthCheck` parameters only to typed
Service creation. Compatible clients must keep read-only
`executionResult.assignedPorts` separate from the approved change summary.
Services are still created inactive, and private human entry of environment
values remains pending. Current role/Key checks, Full/legacy behavior, runtime
dependency coordinates and database schemas are unchanged.

Native IPv6 port formatting now retains brackets for roundtrip parsing;
existing database values are not rewritten. Formatter coverage does not prove
host IPv6 binding or routing. Required CI/CodeQL, artifact qualification and
matching Server/native acceptance remain pending; see the
[candidate release note](docs/releases/orchestration-engine-0.183.366.md).
## Engine 0.183.366 release

The [published release](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.366)
adds bounded `ports` and `healthCheck` parameters
only to typed Service creation. Compatible clients keep read-only
`executionResult.assignedPorts` separate from the approved summary. Services
are created inactive; private human entry of environment values in these
parameters remains unimplemented. Catalog's native dynamic-field projection
now preserves business values under the same role schema, formatter and
non-create-response rules. Full/legacy Key behavior, current role/Key checks,
runtime dependency coordinates and database schemas remain unchanged.

Original CI/CodeQL and artifact qualification passed: 420 suites / 3,912 tests /
zero failures/errors / one existing skip. Relative to published Engine 0.183.365,
the 62-case focus contains 21 new methods (19 Service creation and two Materializer) and 41
inherited methods. Full affected classes contain 63 methods, including one
additional existing Materializer method. All 97 required methods passed, retaining
the prior 95 requirements. All 1,396 operation tuples plus the source/unknown-action
row passed; the 441-input fingerprint and tuple/admission classifications were
verified. Three new role entries expose only the server-produced result as read;
there are no new mutation grants.

All 12 original assets passed anonymous checksum readback. The
[release note](docs/releases/orchestration-engine-0.183.366.md) records the signed
producer, normal merge/tag, tested tree and original JAR SHA256. All 16 packaged
frozen `.ser` files match Engine 0.183.365 source bytes; five published role-schema
hashes match that baseline. Four packaged native JSON schemas bind the bounded
result projection.
The 89 POMs and four build scripts are version-only updates. No publication
rebuild or native SLSA attestation is claimed.

Native IPv6 formatting preserves brackets for roundtrip parsing without rewriting
existing data. Host IPv6 binding/routing and matching Server/native business,
role/Key/cross-ID workflows remain pending. Component qualification and publication
are separate from runtime QA. Older sections below retain release-time evidence,
not current whole-platform acceptance.

## Engine 0.183.364 release

Expand Down
49 changes: 24 additions & 25 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,36 +8,35 @@ Rancher 1.6 ecosystem. It is not affiliated with Rancher Labs or SUSE.
This fork of [`rancher/cattle`](https://github.com/rancher/cattle) preserves
upstream history, authorship, licenses, and dependency notices.

## Engine 0.183.366 candidate
## Current release: Engine 0.183.366

This source tree prepares Engine 0.183.366; the candidate is not published.
The published baseline is
[Engine 0.183.365](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.365).
Use the
[Engine 0.183.366](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.366) is published with 12 original assets verified by
anonymous SHA256 readback. Use the
[Server installation guide](https://github.com/PastureStack/server#quick-start)
for deployment; an Engine JAR alone is not a Server installation.

The candidate extends human-reviewed Service creation with bounded native
`ports` and `healthCheck` fields. Preview, confirmation and apply recheck the
existing native port preflight. Created Services remain inactive; starting
one requires a separate approved plan. A successful receipt exposes the actual
assigned ports through read-only `executionResult.assignedPorts`, while the
approved change summary remains unchanged. Native IPv6 port formatting now
preserves the brackets needed to read a mapping back through `PortSpec`.
Private human input for environment-variable values is not implemented in this
candidate; `environment` remains outside resource-change parameters.
Service creation accepts bounded native `ports` and `healthCheck` fields in
human-reviewed plans. Preview, confirmation and apply repeat native port
preflight. Created Services remain inactive; starting one requires a separate
approved plan. A verified successful receipt reports actual assigned ports in
read-only `executionResult.assignedPorts`, without changing the approved summary.
Native IPv6 mappings retain their roundtrip brackets. Private human input for
environment values remains unimplemented in Service creation parameters.

Catalog transformation now retains native dynamic image, environment, port and
log-configuration values through the existing role-schema projection. Hidden,
read-on-create-only and unlisted fields retain their output restrictions.

| Qualification | Current evidence |
|---|---|
| Focused source checks | 60 unique unit cases passed on JDK 25 and Maven 3.9.16. Three test-fixture setup corrections were rerun alone; unaffected PASS evidence was retained. |
| Candidate qualification and publication | Required original component CI/CodeQL, complete package qualification and publication remain pending. No candidate artifact digest or release asset is claimed. |
| Assembled Server and live workflows | Matching Web Console/Server integration and native role/Key workflows remain pending. IPv6 formatter tests do not establish host IPv6 binding or routing acceptance. |
| Original component CI and artifact | Required CI/CodeQL and artifact qualification passed: 420 suites / 3,912 tests / zero failures/errors / one existing skip. The 62-case focus contains 21 new and 41 inherited methods; full affected classes contain 63 methods. All 97 required identities passed. |
| Public bytes | All 12 original assets passed anonymous checksum readback; no publication rebuild was performed. |
| Assembled Server and live workflows | Matching Server/native business, role/Key and designated workflow acceptance remain pending. Component publication and IPv6 formatting tests do not prove runtime or host IPv6 acceptance. |

Use the compatible Web Console typed contract and matching Server broker.
Four independent AI opt-ins remain default-off. The
[candidate release note](docs/releases/orchestration-engine-0.183.366.md) records
the exact supported fields and remaining boundaries. This does not complete all 243 frontend
business groups.
[release note](docs/releases/orchestration-engine-0.183.366.md) records exact
published identities, supported fields and compatibility limits. These component
results do not complete all 243 frontend business groups.

## Optional AI resource workflows

Expand All @@ -51,9 +50,9 @@ private keys, raw process logs or full launch configurations. Queries and opaque
pagination remain subject to the underlying domain manager's authorization.

`aiResourceChangePlan` supports Stack, Service and Container creation, metadata
editing and the explicitly registered lifecycle operations. In this candidate,
Service creation additionally accepts native port-specification strings and a
closed health-check object. Fixed host ports must match the actual result;
editing and the explicitly registered lifecycle operations. Service creation
accepts native port-specification strings and a closed health-check object. Fixed
host ports must match the actual result;
omitted host ports use native allocation and are reported only after verified
readback. It does not cover every advanced UI field or private environment-value
entry. A short-lived plan captures the target state and
Expand Down Expand Up @@ -163,7 +162,7 @@ evidence are maintained in the
Acceptance is limited to the documented affected paths, not every resource and
role combination.
Versioned evidence and upgrade boundaries are in the
[361 release note](docs/releases/orchestration-engine-0.183.361.md);
[366 release note](docs/releases/orchestration-engine-0.183.366.md);
older changes remain in [release notes](docs/releases).

## Build and validation
Expand Down
80 changes: 61 additions & 19 deletions docs/releases/orchestration-engine-0.183.366.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
# Engine 0.183.366 candidate
# Engine 0.183.366

This candidate is not published. Required original component CI/CodeQL,
complete artifact qualification and matching Web Console/Server native
acceptance remain pending. The published baseline is Engine 0.183.365.
[Engine 0.183.366](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.366)
is published. Required original component CI/CodeQL,
artifact qualification and anonymous readback of all 12 original assets passed.
Matching assembled Server/native business acceptance remains pending.

## Service creation

Expand Down Expand Up @@ -61,7 +62,8 @@ mapping, log driver/configuration and bean-backed name. Narrowed schemas,
read-on-create-only fields and unlisted dynamic fields still restrict output,
and the source dynamic map retains its business values. This corrects the
existing Catalog projection; it adds no permission or new environment-input
channel. Matching artifact and native workflow acceptance remain pending.
channel. Artifact qualification passed; matching native workflow acceptance
remains pending.

## Verified results and compatibility

Expand Down Expand Up @@ -89,17 +91,57 @@ runtime dependency coordinates and database schemas are unchanged. Clients
must understand these typed fields and the read-only execution result.
Consume a qualified component through a matching published Server release.

## Focused evidence

60 unique focused cases passed with JDK 25 and Maven 3.9.16. They cover the
native parser/preflight path, post-preview conflicts and revocation before
claim, bounded input, actual readback, UUID rebinding, uncertain operations,
execution-result separation and IPv6 formatting. Three test-fixture setup
corrections were rerun alone; unaffected PASS evidence was retained. These
source results do not establish full CI, published artifact or native workflow
acceptance, and no final CI total or artifact digest is claimed.

The Catalog projection correction passed two new real-schema regression
methods and one directly affected existing Materializer method. Its C03
source review independently re-extracts all 1396 operation tuples and their
semantic/admission dispositions; those classifications remain unchanged.
## Qualified component evidence

Original [Security CI 41328904546](https://github.com/PastureStack/orchestration-engine/actions/runs/41328904546),
[custom CodeQL 41328904462](https://github.com/PastureStack/orchestration-engine/actions/runs/41328904462) and
[organization CodeQL 41328907700](https://github.com/PastureStack/orchestration-engine/actions/runs/41328907700)
passed, with zero CodeQL aggregator annotations and no new alerts. The original
structured Surefire report contains **420 suites / 3,912 tests / zero failures /
zero errors / one existing skip**.

The reviewed 62-case focus comprises **21 new source methods relative to Engine 0.183.365**
(19 Service creation and two Materializer) and 41 inherited methods. Full affected
classes add one existing Materializer method, giving 63 observed methods. These
are not 62 new tests. All 97 required method identities passed; the prior 95
requirements were retained and two Materializer regressions were added. The
Materializer cases use the real transformer and native role schemas.

All 1,396 operation tuples plus the source/unknown-action row passed (1,397 rows).
Independent source re-extraction preserved every tuple, semantic and admission
disposition. The 441 production inputs have fingerprint
`7ce17c8b05ccfba961414808148d8638bf54a9ad3bbc7de00facfcba4b26ac39`.
Three explicit new role entries provide read-only access to the server-produced
execution result; no mutation grant is added. Historical producer355 and review
chains remain intact.

Eight changed production classes have original-artifact class/module hashes and
reviewed disassembly. All 16 packaged frozen `.ser` files match Engine 0.183.365
source bytes, and five frozen role-schema hashes match that published baseline.
Four packaged native JSON schemas bind the bounded result projection. The 89 POMs and four build scripts
are version-only changes. The packaged official MariaDB JDBC3.5.11, CycloneDX
SBOM and original product/raw/effective Dapper scan evidence passed the existing
security gates without an exception. No new scan is claimed during qualification.

## Published identities

| Identity | Published value |
|---|---|
| Signed producer | `3ce114486954403cead091379916c2d69c052336` |
| Normal merge and tag source | `bbba0e5a3e40ed58c98643610943586d0e521328` |
| Tested whole tree | `f9482dd3c8c0a1e24763c23009ea50ddccc2e66e` |
| Original cattle.jar SHA256 | `0fd51b38c22c495d5f245527213807fa486e3bba571756b410ef6292f424db81` |
| Original cattle.jar size | 88,245,511 bytes |

The [release metadata](https://github.com/PastureStack/orchestration-engine/releases/download/v0.183.366/engine366-release-metadata.json)
records the complete original-CI and packaged evidence. All 12 original release
assets passed anonymous SHA256 readback. The JAR was streamed from the retained
original CI ZIP; no publication rebuild or second full JAR was produced. The
workflow provides original artifact/source/tree/lock provenance and does not
provide native SLSA attestation; none is inferred.

Matching Server565 / Engine366 / Web205 / Bridge027 / Compose14.41 assembly and
designated native, Catalog private human input, role/Key/cross-ID, IPv6 and
weak-model workflows remain separate pending QA. Existing failures and unaffected
PASS evidence remain separate. Component CI and publication do not establish
complete frontend or all 243 business workflows.
Loading