Fix typed plan input, upgrade strategy and lock ordering

.github/workflows/security-release-gate.yml

@@ -59,6 +59,48 @@ jobs:
           import xml.etree.ElementTree as ET
 
           required = {
+              'io.cattle.platform.iaas.api.auth.ai.catalog.AiCatalogLaunchLockOrderTest': {
+                  'nativeActionPrefetchAndConcurrentNativeGetCompleteWithApplicationBeforeRowLock',
+                  'onlyExactInternalActionOperandUsesSnapshotAndOrdinaryGetStillChecksSource',
+                  'snapshotRetainsOwnerProjectRoleKeyBindingAndDoesNotAuthorizeUnconfirmedApply',
+              },
+              'io.cattle.platform.iaas.api.auth.ai.catalog.AiCatalogLaunchAccessTest': {
+                  'operandSnapshotRechecksOriginalKeyWithoutRetainingCredentialRowLock',
+              },
+              'io.cattle.platform.iaas.api.auth.change.AiResourceChangeLockOrderTest': {
+                  'nativeActionReceiptPrefetchAndConcurrentGetDoNotInvertObservationWriteLocks',
+                  'exactSnapshotRetainsOwnerProjectKeyAndReceiptPermissionsWhileGetStillObservesAndApplyRequiresConfirmation',
+              },
+              'io.cattle.platform.iaas.api.auth.upgrade.AiServiceUpgradePlanLockOrderTest': {
+                  'acceptedUpgradeNativeActionPrefetchAndConcurrentGetKeepApplicationBeforeRowLock',
+                  'runningUpgradeNativeActionPrefetchAndConcurrentGetKeepApplicationBeforeRowLock',
+                  'onlyExactNativeUpgradeActionMarkerUsesReadSnapshotAndOrdinaryGetStillObserves',
+                  'upgradeActionSnapshotRetainsOwnerProjectRoleVisibilityAndBoundKeyChecks',
+                  'upgradeActionReloadsSnapshotRoleAndKeyAuthorityAfterOperandLookupAndClaimsOnlyOnce',
+                  'concurrentNativeUpgradeAppliesShareOneDurableClaimAndDispatch',
+              },
+              'io.cattle.platform.iaas.api.auth.ai.audit.AiAuditQueryServiceTest': {
+                  'realParserAndSchemaCannotEraseOriginalUnknownFieldsBeforeCanonicalError',
+                  'originalQueryParametersAreClosedButValidTypedQueriesKeepTheirCanonicalSuccess',
+                  'originalFieldCaptureIsOnlyTheAuditCollectionOwnerAndPrecedesTheRealSchemaValidator',
+              },
+              'io.cattle.platform.iaas.api.auth.upgrade.AiServiceUpgradePlanServiceTest': {
+                  'realPreviewPipelineRejectsUnknownAndCoercedStrategyWithoutPlanOrDispatch',
+                  'originalPreviewGuardLeavesOrdinaryUpgradeAndPlanActionsUntouchedAndRunsBeforeNativeValidation',
+                  'omittedAndLegacyStrategiesKeepTheOriginalEffectiveDispatchDefaults',
+                  'newCustomAndDefaultPlansFenceLegacySnapshotBeforeClaim',
+                  'legacySnapshotWithoutStrategyOrFenceStillConfirmsAndAppliesDefaults',
+                  'strategyAndSnapshotFenceDriftCannotClaimOrDispatch',
+                  'reloadedFencedStrategyRemainsImmutableAndDispatchesOnlyOnce',
+                  'approvedStrategyIsDetachedReviewedAndDispatchedOnceWithoutActionOverrides',
+                  'strategyUsesNativeMinimaAndExactJsonIntegerBoundaryWithoutClamping',
+                  'invalidOptionalStrategyRejectsBeforePlanOrDispatchAndNativePreflightIsRequired',
+              },
+              'io.cattle.platform.iaas.api.auth.upgrade.AiServiceUpgradeStrategyPreflightTest': {
+                  'nativeRetainIpStartFirstInvariantRejectsBeforeAnyPlanOrResourceMutation',
+                  'realStartFirstPortCapacityRejectsAtPreviewConfirmationAndBeforeClaim',
+                  'nativeVolumePreflightReceivesApprovedStartFirstAndNativeBatchNormalization',
+              },
               'io.cattle.platform.iaas.api.auth.ai.catalog.AiCatalogLaunchPrivateWireTest': {
                   'nativeCryptoHttpRoundTripOpensExactlyOneGoBase64JsonLayer',
                   'nativeCryptoEnvelopeRejectsEveryPlanActorProjectAndOriginalKeyRebinding',

COMPATIBILITY.md

@@ -1,5 +1,51 @@
 # Compatibility Contract
 
+## Engine 0.183.367 source candidate
+
+The existing image-upgrade plan accepts three optional strategy fields and
+returns a closed effective `upgradeStrategy`. Omitted fields and old persisted
+image-only plans keep `startFirst=false`, `batchSize=1`, `intervalMillis=2000`.
+Batch size retains the native minimum 1 and interval the native minimum 100ms.
+The JSON contract accepts exact integers through 9007199254740991; this is a
+client representation boundary, not a new native product maximum. The native
+preflight keeps its existing int-range batch normalization, while dispatch
+receives the approved Long values. Full/legacy keys, role/Key revision checks,
+port/volume rules and durable operation claims remain unchanged. No new mutation
+operation or global grant is introduced. Publication and runtime qualification
+remain pending; see the [candidate note](docs/releases/orchestration-engine-0.183.367.md).
+
+New plans bind the approved strategy into their private snapshot. An older
+Engine rejects these plans as stale before claiming an operation instead of
+applying its own defaults. Genuine legacy image-only plans remain compatible.
+After a downgrade, pending newer plans require a fresh preview and approval.
+
+Typed Audit queries now preserve a closed-field rejection through normal schema
+sanitization. The existing owner rejects unknown fields with422 and records its
+canonical ERROR outcome without starting the private query runner. Other API
+schema filtering and current actor/Key authorization remain unchanged.
+
+Catalog-launch, resource-change and upgrade action operands now use authorized,
+non-mutating read snapshots only for the framework's exact internal action marker.
+The native API write transaction previously retained a prefetch row lock after
+releasing its application lock, allowing a concurrent receipt GET to invert the
+next action's lock order. Ordinary GETs still refresh receipts; actions still
+reload under their application lock and repeat owner, role, Key, snapshot and
+durable-claim checks. No lock timeout, retry, database schema or grant changes.
+
+The lock-order tests declare managed Spring Context and AspectJ dependencies in
+test scope so they can load the shipped transaction advice and pointcut. Runtime
+dependency coordinates are unchanged.
+
+Frozen-package downloads retry transport failures only at the original signed
+snapshot URL, at most four attempts. Hash or size failures stop that origin
+immediately. Package selection, TLS verification and SHA256 checks are unchanged.
+
+Both Engine build recipes install Ubuntu's official PCRE2 security update
+`10.46-1ubuntu0.1` for the already installed `libpcre2-8-0` and `libpcre2-posix3`.
+The two archives are SHA256-pinned and their package, version, architecture and
+installed versions are checked. Other package locks and snapshot dates remain
+unchanged. See [USN-8974-1](https://ubuntu.com/security/notices/USN-8974-1).
+
 ## Engine 0.183.366 release
 
 The [published release](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.366)

Dockerfile

@@ -31,6 +31,8 @@ ADD --checksum=sha256:2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba
 ADD --checksum=sha256:8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3t64-gnutls_8.18.0-1ubuntu2.8_amd64.deb /tmp/libcurl3t64-gnutls.deb
 ADD --checksum=sha256:7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266 https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4t64_8.18.0-1ubuntu2.8_amd64.deb /tmp/libcurl4t64.deb
 ADD --checksum=sha256:bedeef1cf3268f90338c411cdb0a45b224d0660fd2240f310f380316c8244606 https://security.ubuntu.com/ubuntu/pool/main/b/brotli/libbrotli1_1.2.0-3ubuntu0.1_amd64.deb /tmp/libbrotli1.deb
+ADD --checksum=sha256:44ebbeb6493eacffbc460ca71446959ba86a00b2e23515e4cfb1a5cc317d6672 https://security.ubuntu.com/ubuntu/pool/main/p/pcre2/libpcre2-8-0_10.46-1ubuntu0.1_amd64.deb /tmp/libpcre2-8-0.deb
+ADD --checksum=sha256:44605ea665673a359927d014f4a027c50fe6472af8bc956bd1b1c43ddc07a1cd https://security.ubuntu.com/ubuntu/pool/main/p/pcre2/libpcre2-posix3_10.46-1ubuntu0.1_amd64.deb /tmp/libpcre2-posix3.deb
 
 ENV DEBIAN_FRONTEND=noninteractive
 ARG TEMURIN_JDK25_URL="https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.5%2B8/OpenJDK25U-jdk_x64_linux_hotspot_25.0.5_8.tar.gz"
@@ -109,7 +111,17 @@ RUN set -eux; \
     test "$(dpkg-deb -f /tmp/libbrotli1.deb Version)" = 1.2.0-3ubuntu0.1; \
     test "$(dpkg-deb -f /tmp/libbrotli1.deb Architecture)" = amd64; \
     dpkg -i /tmp/libbrotli1.deb; \
+    for package in libpcre2-8-0 libpcre2-posix3; do \
+        test "$(dpkg-query -W -f='${db:Status-Status}' "${package}")" = installed; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Package)" = "${package}"; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Version)" = 10.46-1ubuntu0.1; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Architecture)" = amd64; \
+    done; \
+    dpkg -i /tmp/libpcre2-8-0.deb /tmp/libpcre2-posix3.deb; \
     sh /usr/local/bin/install-ubuntu-security-updates /licenses/ubuntu-security-packages.lock /etc/ssl/certs/ca-certificates.crt; \
+    for package in libpcre2-8-0 libpcre2-posix3; do \
+        test "$(dpkg-query -W -f='${Version}' "${package}")" = 10.46-1ubuntu0.1; \
+    done; \
     for package in curl libcurl3t64-gnutls libcurl4t64; do \
         test "$(dpkg-query -W -f='${Version}' "${package}")" = "${UBUNTU_APT_CURL_VERSION}"; \
     done; \

Dockerfile.dapper

@@ -32,6 +32,8 @@ ADD --checksum=sha256:2c418a61d7165d0cde01d9cb05ae025cc41fc75ef6d3f095996bd045ba
 ADD --checksum=sha256:8db913e1fa5a694ca6ba7b828bd18c5204e6853ac07fe7ed9c6e1f94e3444d8e https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3t64-gnutls_8.18.0-1ubuntu2.8_amd64.deb /tmp/libcurl3t64-gnutls.deb
 ADD --checksum=sha256:7c0b37592f83a629cc22f0c98effa176da9edbd6d77b3f38184a9d0ddc5e0266 https://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4t64_8.18.0-1ubuntu2.8_amd64.deb /tmp/libcurl4t64.deb
 ADD --checksum=sha256:bedeef1cf3268f90338c411cdb0a45b224d0660fd2240f310f380316c8244606 https://security.ubuntu.com/ubuntu/pool/main/b/brotli/libbrotli1_1.2.0-3ubuntu0.1_amd64.deb /tmp/libbrotli1.deb
+ADD --checksum=sha256:44ebbeb6493eacffbc460ca71446959ba86a00b2e23515e4cfb1a5cc317d6672 https://security.ubuntu.com/ubuntu/pool/main/p/pcre2/libpcre2-8-0_10.46-1ubuntu0.1_amd64.deb /tmp/libpcre2-8-0.deb
+ADD --checksum=sha256:44605ea665673a359927d014f4a027c50fe6472af8bc956bd1b1c43ddc07a1cd https://security.ubuntu.com/ubuntu/pool/main/p/pcre2/libpcre2-posix3_10.46-1ubuntu0.1_amd64.deb /tmp/libpcre2-posix3.deb
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV LANG=C.UTF-8 LC_ALL=C.UTF-8
@@ -127,7 +129,17 @@ RUN set -eux; \
     test "$(dpkg-deb -f /tmp/libbrotli1.deb Version)" = 1.2.0-3ubuntu0.1; \
     test "$(dpkg-deb -f /tmp/libbrotli1.deb Architecture)" = amd64; \
     dpkg -i /tmp/libbrotli1.deb; \
+    for package in libpcre2-8-0 libpcre2-posix3; do \
+        test "$(dpkg-query -W -f='${db:Status-Status}' "${package}")" = installed; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Package)" = "${package}"; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Version)" = 10.46-1ubuntu0.1; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Architecture)" = amd64; \
+    done; \
+    dpkg -i /tmp/libpcre2-8-0.deb /tmp/libpcre2-posix3.deb; \
     sh /usr/local/bin/install-ubuntu-security-updates /licenses/ubuntu-security-packages.lock /etc/ssl/certs/ca-certificates.crt; \
+    for package in libpcre2-8-0 libpcre2-posix3; do \
+        test "$(dpkg-query -W -f='${Version}' "${package}")" = 10.46-1ubuntu0.1; \
+    done; \
     for package in curl libcurl3t64-gnutls libcurl4t64; do \
         test "$(dpkg-query -W -f='${Version}' "${package}")" = "${UBUNTU_APT_CURL_VERSION}"; \
     done; \

README.md

@@ -8,7 +8,24 @@ Rancher 1.6 ecosystem. It is not affiliated with Rancher Labs or SUSE.
 This fork of [`rancher/cattle`](https://github.com/rancher/cattle) preserves
 upstream history, authorship, licenses, and dependency notices.
 
-## Current release: Engine 0.183.366
+## Development candidate: Engine 0.183.367
+
+Image-upgrade previews accept optional `startFirst`, `batchSize` and
+`intervalMillis`. The immutable plan exposes the three effective values in
+`upgradeStrategy`, with the existing defaults `false`, `1` and `2000`.
+Preview, human confirmation and apply repeat the existing native port/volume
+preflight using that approved strategy. Native role/Key checks, snapshot staleness
+and exactly-once dispatch remain in effect. See the
+[candidate contract](docs/releases/orchestration-engine-0.183.367.md).
+This source candidate has not been published or accepted in runtime QA.
+Catalog-launch, resource-change and upgrade action lookups use authorized read
+snapshots to preserve application/row lock order during concurrent receipt reads.
+
+Typed Audit queries retain their closed-input check before generic schema
+sanitization. Unknown caller fields are rejected with a canonical error outcome
+instead of being discarded into an accepted query.
+
+## Latest published release: Engine 0.183.366
 
 [Engine 0.183.366](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.366) is published with 12 original assets verified by
 anonymous SHA256 readback. Use the
@@ -177,7 +194,7 @@ Before publishing an Engine artifact, run the complete package gate:
 
 ```sh
 bash scripts/check-cattle-jdk25-full-package
-ENGINE_VERSION=0.183.366 bash scripts/build --release
+ENGINE_VERSION=0.183.367 bash scripts/build --release
 bash scripts/check-release-artifact dist/artifacts/cattle.jar
 ```
 
@@ -214,9 +231,11 @@ the credential identity and policy revision; that same Key must apply them.
 Using a browser's shared Cookie alone does not establish strict credential
 isolation. Ordinary UI/API authorization remains unchanged.
 
-* `POST /v2-beta/projects/{projectId}/aiServiceUpgradePlans` with `serviceId` and
-  `image` creates a five-minute actor/project-bound preview and, for Key callers,
-  a credential/revision binding. It does not upgrade a service.
+* `POST /v2-beta/projects/{projectId}/aiServiceUpgradePlans` with `serviceId`,
+  `image` and optional `startFirst` / `batchSize` / `intervalMillis` creates a
+  five-minute actor/project-bound preview and, for Key callers, a credential/revision
+  binding. The effective strategy is immutable and shown for human review.
+  It does not upgrade a service.
 * The confirmation UI separately calls `POST .../{planId}?action=confirm` with an
   empty body. The same owner's human session confirms through the console;
   API Keys cannot confirm, and a bound Key's current scope, expiry and revision

code/framework/api-pub-sub-jetty/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/api-pub-sub/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/api/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/archaius/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-meta-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../meta-parent/pom.xml</relativePath>
     </parent>
 </project>

code/framework/async/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/auditing/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
 

code/framework/db-loader/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/deferred/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/encryption/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/engine/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/eventing/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/events/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/extension-spring/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/extension/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/java-server/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/jmx/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/jooq/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/json/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/launcher/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<groupId>io.cattle</groupId>
 		<artifactId>cattle-parent</artifactId>
-		<version>0.183.366</version>
+		<version>0.183.367</version>
     <relativePath>../../parent/pom.xml</relativePath>
 	</parent>
 	<dependencies>

code/framework/lock/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.366</version>
+        <version>0.183.367</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>