Fix native Host metadata and delegated Catalog metadata bootstrap

.github/workflows/security-release-gate.yml

@@ -267,6 +267,9 @@ jobs:
                   'nativeSqlExcludesEveryForeignRemovedAndNonContainerRelationshipWithoutWrites',
               },
               'io.cattle.platform.iaas.api.auth.change.AiHostMetadataChangeTest': {
+                  'nativeDockerHostFullKeyUsesModelForVisiblePutAndReceipt',
+                  'nativeDockerHostReadKeyCanReadButRealWriteAuthorizationStillDenies',
+                  'hostSchemaRejectsWrongNativeModelEvenWhenItsKindClaimsHost',
                   'onlyMetadataIntentAndFieldsAreAccepted',
                   'nativePutUsesRealRevisionGuardAndRestoresContext',
                   'nativeMethodFieldAndCrossProjectCeilingsRejectBeforeMutation',
@@ -304,6 +307,12 @@ jobs:
                   'emptyHandlersAndLegacyListOverrideRemainValidWithoutEagerDependencyCycles',
                   'nativeCreateBindsExactlyOnceAndNestedFailureRestoresThreadLocalEnvelope',
               },
+              'io.cattle.platform.iaas.api.auth.ai.catalog.AiCatalogLaunchDelegationTest': {
+                  'nativeVersionRootSchemaHandshakeIsRepeatableOwnerMetadataWithoutChildWrites',
+                  'versionRootAuditsVerifiedDenialsWithoutAttributingForgedProofToPlanOrKey',
+                  'versionRootRechecksEventProofOriginalOwnerSourceAndFrozenStackBeforeMetadata',
+                  'versionRootRejectsUnknownPathsMethodsQueriesAndContradictoryRouteShapesWithSafe403',
+              },
           }
           suites = []
           observed = {}

COMPATIBILITY.md

@@ -1,5 +1,30 @@
 # Compatibility Contract
 
+## Engine 0.183.371 source candidate
+
+The typed Host change owner uses the native Host model for visibility and
+receipt checks. A Host can have driver kind `docker` while its API type remains
+`host`; another native model cannot gain Host access by claiming that kind.
+Service and Container kind checks, native read/write schema and Key ceilings,
+approval, locking, durable claim and audit remain unchanged. No lifecycle or
+permission grant is added.
+
+Three new focused Host cases cover Full-Key visibility/PUT/receipt, read-only
+Key read versus write403, and a rejected wrong model. Four Catalog cases cover
+the real API root/schema handshake, closed route shapes, fresh owner/source
+checks and safe denial audit. Valid root/schema reads are repeatable metadata;
+original delegated writes retain their event and replay boundaries.
+
+Both builders install the same already-pinned OpenSSL security packages before
+the base upgrade. The temporary security source is removed and normal indexes
+are reloaded before that base plan; its original source phase and final exact
+OpenSSL readback are restored afterwards. The twelve already-pinned final
+Python/Curl/CA/Brotli/PCRE packages enter through the normal local-deb APT solver
+before the base plan. Only the three old bootstrap Python/Curl/CA version pins
+are aligned with those existing final versions. Final package versions, security
+lock, source URLs, SHA pins and snapshot dates remain unchanged. Official CI,
+artifact publication and designated runtime acceptance remain pending.
+
 ## Engine 0.183.370 published
 
 Host metadata is limited to name/description through the existing native PUT

Dockerfile

@@ -20,6 +20,7 @@ COPY ubuntu-security-packages.lock /licenses/ubuntu-security-packages.lock
 COPY scripts/install-ubuntu-security-updates.sh /usr/local/bin/install-ubuntu-security-updates
 COPY scripts/install-python-security-tools.sh /usr/local/bin/install-python-security-tools
 COPY tools/pip-security-overlay /usr/local/lib/pip-security-overlay
+COPY --chmod=0755 scripts/install-snapshot-packages /usr/local/bin/install-snapshot-packages
 ADD --checksum=sha256:fac6f0728cf9490a7a698e6b343e4140283e92355b060193c04f5770a666df8a https://security.ubuntu.com/ubuntu/pool/main/p/python3.14/libpython3.14-minimal_3.14.4-1ubuntu0.2_amd64.deb /tmp/libpython3.14-minimal.deb
 ADD --checksum=sha256:3c267ef0f902f763c3615cbf28dd6fe91d2e4f603075d7f03db99f8d4eb66f46 https://security.ubuntu.com/ubuntu/pool/main/p/python3.14/libpython3.14-stdlib_3.14.4-1ubuntu0.2_amd64.deb /tmp/libpython3.14-stdlib.deb
 ADD --checksum=sha256:0a7ea8a52834f9b3de0f11758924f80f7a6ebcbb4b02a55ba4f457503569f55f https://security.ubuntu.com/ubuntu/pool/main/p/python3.14/python3.14-minimal_3.14.4-1ubuntu0.2_amd64.deb /tmp/python3.14-minimal.deb
@@ -79,9 +80,49 @@ RUN set -eux; \
     printf 'Types: deb\nURIs: https://snapshot.ubuntu.com/ubuntu/%s\nSuites: resolute resolute-updates resolute-backports resolute-security\nComponents: main universe restricted multiverse\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\nSnapshot: no\n' \
         "${UBUNTU_APT_SNAPSHOT}" > /etc/apt/sources.list.d/pasturestack-snapshot.sources; \
     printf 'Acquire::Retries "5";\nAcquire::http::Timeout "30";\nAcquire::https::Timeout "30";\nAcquire::http::Pipeline-Depth "0";\nAcquire::https::CaInfo "/etc/ssl/certs/ca-certificates.crt";\nAcquire::https::Verify-Peer "true";\nAcquire::https::Verify-Host "true";\nAcquire::AllowInsecureRepositories "false";\nAPT::Get::AllowUnauthenticated "false";\n' > /etc/apt/apt.conf.d/80pasturestack-retries; \
+    printf 'Types: deb\nURIs: https://snapshot.ubuntu.com/ubuntu/%s\nSuites: resolute-security\nComponents: main\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\nSnapshot: no\n' \
+        "${UBUNTU_APT_SECURITY_SNAPSHOT}" > /etc/apt/sources.list.d/pasturestack-security.sources; \
+    apt-get update; \
+    set --; \
+    for package in libexpat1 libsqlite3-0 libssh2-1t64; do \
+        test "$(grep -c "^${package}=" /licenses/ubuntu-security-packages.lock)" -eq 1; \
+        entry=$(grep "^${package}=" /licenses/ubuntu-security-packages.lock); \
+        set -- "$@" "$entry"; \
+    done; \
+    install-snapshot-packages install -y --no-install-recommends \
+        libssl3t64="${UBUNTU_APT_OPENSSL_VERSION}" \
+        openssl="${UBUNTU_APT_OPENSSL_VERSION}" \
+        openssl-provider-legacy="${UBUNTU_APT_OPENSSL_VERSION}" "$@"; \
+    for entry in "$@"; do \
+        test "$(dpkg-query -W -f='${Version}' "${entry%%=*}")" = "${entry#*=}"; \
+    done; \
+    for package in libssl3t64 openssl openssl-provider-legacy; do \
+        test "$(dpkg-query -W -f='${Version}' "${package}")" = "${UBUNTU_APT_OPENSSL_VERSION}"; \
+    done; \
+    rm -f /etc/apt/sources.list.d/pasturestack-security.sources; \
     apt-get update; \
-    apt-get upgrade -y; \
-    apt-get install -y --no-install-recommends \
+    set --; \
+    for package in libpython3.14-minimal libpython3.14-stdlib python3.14-minimal python3.14 python3.14-venv curl libcurl3t64-gnutls libcurl4t64 ca-certificates libbrotli1 libpcre2-8-0 libpcre2-posix3; do \
+        architecture=amd64; \
+        case "$package" in \
+            libpython3.14-minimal|libpython3.14-stdlib|python3.14-minimal|python3.14|python3.14-venv) version="${UBUNTU_APT_PYTHON3_14_VERSION}";; \
+            curl|libcurl3t64-gnutls|libcurl4t64) version="${UBUNTU_APT_CURL_VERSION}";; \
+            ca-certificates) version="${UBUNTU_APT_CA_CERTIFICATES_VERSION}"; architecture=all;; \
+            libbrotli1) version=1.2.0-3ubuntu0.1;; \
+            libpcre2-8-0|libpcre2-posix3) version=10.46-1ubuntu0.1;; \
+            *) exit 1;; \
+        esac; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Package)" = "$package"; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Version)" = "$version"; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Architecture)" = "$architecture"; \
+        set -- "$@" "/tmp/${package}.deb"; \
+    done; \
+    install-snapshot-packages install -y --no-install-recommends "$@"; \
+    for package in libpython3.14-minimal libpython3.14-stdlib python3.14-minimal python3.14 python3.14-venv curl libcurl3t64-gnutls libcurl4t64 ca-certificates libbrotli1 libpcre2-8-0 libpcre2-posix3; do \
+        test "$(dpkg-query -W -f='${Version}' "$package")" = "$(dpkg-deb -f "/tmp/${package}.deb" Version)"; \
+    done; \
+    install-snapshot-packages upgrade -y; \
+    install-snapshot-packages install -y --no-install-recommends \
         bash="${UBUNTU_APT_BASH_VERSION}" \
         ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_VERSION}" \
         curl="${UBUNTU_APT_CURL_BOOTSTRAP_VERSION}" \
@@ -104,10 +145,6 @@ RUN set -eux; \
     printf 'Types: deb\nURIs: https://snapshot.ubuntu.com/ubuntu/%s\nSuites: resolute-security\nComponents: main\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\nSnapshot: no\n' \
         "${UBUNTU_APT_SECURITY_SNAPSHOT}" > /etc/apt/sources.list.d/pasturestack-security.sources; \
     apt-get update; \
-    apt-get install -y --no-install-recommends \
-        libssl3t64="${UBUNTU_APT_OPENSSL_VERSION}" \
-        openssl="${UBUNTU_APT_OPENSSL_VERSION}" \
-        openssl-provider-legacy="${UBUNTU_APT_OPENSSL_VERSION}"; \
     for package in libssl3t64 openssl openssl-provider-legacy; do \
         test "$(dpkg-query -W -f='${Version}' "${package}")" = "${UBUNTU_APT_OPENSSL_VERSION}"; \
     done; \

Dockerfile.dapper

@@ -97,7 +97,47 @@ RUN set -eux; \
     printf 'Types: deb\nURIs: https://snapshot.ubuntu.com/ubuntu/%s\nSuites: resolute resolute-updates resolute-backports resolute-security\nComponents: main universe\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\nSnapshot: no\n' \
         "${UBUNTU_APT_SNAPSHOT}" > /etc/apt/sources.list.d/pasturestack-snapshot.sources; \
     printf 'Acquire::Retries "5";\nAcquire::http::Timeout "30";\nAcquire::https::Timeout "30";\nAcquire::http::Pipeline-Depth "0";\nAcquire::https::CaInfo "/etc/ssl/certs/ca-certificates.crt";\nAcquire::https::Verify-Peer "true";\nAcquire::https::Verify-Host "true";\nAcquire::AllowInsecureRepositories "false";\nAPT::Get::AllowUnauthenticated "false";\n' > /etc/apt/apt.conf.d/80pasturestack-retries; \
+    printf 'Types: deb\nURIs: https://snapshot.ubuntu.com/ubuntu/%s\nSuites: resolute-security\nComponents: main\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\nSnapshot: no\n' \
+        "${UBUNTU_APT_SECURITY_SNAPSHOT}" > /etc/apt/sources.list.d/pasturestack-security.sources; \
+    apt-get update; \
+    set --; \
+    for package in libexpat1 libsqlite3-0 libssh2-1t64; do \
+        test "$(grep -c "^${package}=" /licenses/ubuntu-security-packages.lock)" -eq 1; \
+        entry=$(grep "^${package}=" /licenses/ubuntu-security-packages.lock); \
+        set -- "$@" "$entry"; \
+    done; \
+    install-snapshot-packages install -y --no-install-recommends \
+        libssl3t64="${UBUNTU_APT_OPENSSL_VERSION}" \
+        openssl="${UBUNTU_APT_OPENSSL_VERSION}" \
+        openssl-provider-legacy="${UBUNTU_APT_OPENSSL_VERSION}" "$@"; \
+    for entry in "$@"; do \
+        test "$(dpkg-query -W -f='${Version}' "${entry%%=*}")" = "${entry#*=}"; \
+    done; \
+    for package in libssl3t64 openssl openssl-provider-legacy; do \
+        test "$(dpkg-query -W -f='${Version}' "${package}")" = "${UBUNTU_APT_OPENSSL_VERSION}"; \
+    done; \
+    rm -f /etc/apt/sources.list.d/pasturestack-security.sources; \
     apt-get update; \
+    set --; \
+    for package in libpython3.14-minimal libpython3.14-stdlib python3.14-minimal python3.14 python3.14-venv curl libcurl3t64-gnutls libcurl4t64 ca-certificates libbrotli1 libpcre2-8-0 libpcre2-posix3; do \
+        architecture=amd64; \
+        case "$package" in \
+            libpython3.14-minimal|libpython3.14-stdlib|python3.14-minimal|python3.14|python3.14-venv) version="${UBUNTU_APT_PYTHON3_14_VERSION}";; \
+            curl|libcurl3t64-gnutls|libcurl4t64) version="${UBUNTU_APT_CURL_VERSION}";; \
+            ca-certificates) version="${UBUNTU_APT_CA_CERTIFICATES_VERSION}"; architecture=all;; \
+            libbrotli1) version=1.2.0-3ubuntu0.1;; \
+            libpcre2-8-0|libpcre2-posix3) version=10.46-1ubuntu0.1;; \
+            *) exit 1;; \
+        esac; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Package)" = "$package"; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Version)" = "$version"; \
+        test "$(dpkg-deb -f "/tmp/${package}.deb" Architecture)" = "$architecture"; \
+        set -- "$@" "/tmp/${package}.deb"; \
+    done; \
+    install-snapshot-packages install -y --no-install-recommends "$@"; \
+    for package in libpython3.14-minimal libpython3.14-stdlib python3.14-minimal python3.14 python3.14-venv curl libcurl3t64-gnutls libcurl4t64 ca-certificates libbrotli1 libpcre2-8-0 libpcre2-posix3; do \
+        test "$(dpkg-query -W -f='${Version}' "$package")" = "$(dpkg-deb -f "/tmp/${package}.deb" Version)"; \
+    done; \
     install-snapshot-packages upgrade -y; \
     install-snapshot-packages install -y --no-install-recommends \
         bash="${UBUNTU_APT_BASH_VERSION}" \
@@ -122,10 +162,6 @@ RUN set -eux; \
     printf 'Types: deb\nURIs: https://snapshot.ubuntu.com/ubuntu/%s\nSuites: resolute-security\nComponents: main\nSigned-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg\nSnapshot: no\n' \
         "${UBUNTU_APT_SECURITY_SNAPSHOT}" > /etc/apt/sources.list.d/pasturestack-security.sources; \
     apt-get update; \
-    install-snapshot-packages install -y --no-install-recommends \
-        libssl3t64="${UBUNTU_APT_OPENSSL_VERSION}" \
-        openssl="${UBUNTU_APT_OPENSSL_VERSION}" \
-        openssl-provider-legacy="${UBUNTU_APT_OPENSSL_VERSION}"; \
     for package in libssl3t64 openssl openssl-provider-legacy; do \
         test "$(dpkg-query -W -f='${Version}' "${package}")" = "${UBUNTU_APT_OPENSSL_VERSION}"; \
     done; \

README.md

@@ -8,6 +8,19 @@ Rancher 1.6 ecosystem. It is not affiliated with Rancher Labs or SUSE.
 This fork of [`rancher/cattle`](https://github.com/rancher/cattle) preserves
 upstream history, authorship, licenses, and dependency notices.
 
+## Source candidate: Engine 0.183.371
+
+Typed Host metadata plans identify the native Host model independently of its
+driver kind, including `docker`. This corrects Host preview and receipt reads
+that could return 404 in 0.183.370. Native role/Key checks, human approval,
+locking and exact-once dispatch remain unchanged. Qualification, publication
+and native acceptance of this candidate are pending. The internal Catalog
+launcher also gains its authenticated API root/schema metadata handshake;
+resource grants and one-time writes remain bounded by the original delegation.
+The builders install the existing pinned final security packages before the
+frozen base plan, retaining the same final versions and source phases. See the
+[candidate note](docs/releases/orchestration-engine-0.183.371.md).
+
 ## Latest published release: Engine 0.183.370
 
 [Engine 0.183.370](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.370)

code/framework/api-pub-sub-jetty/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.370</version>
+        <version>0.183.371</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/api-pub-sub/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.370</version>
+        <version>0.183.371</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/api/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.370</version>
+        <version>0.183.371</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/archaius/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-meta-parent</artifactId>
-        <version>0.183.370</version>
+        <version>0.183.371</version>
         <relativePath>../../meta-parent/pom.xml</relativePath>
     </parent>
 </project>

code/framework/async/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.370</version>
+        <version>0.183.371</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/auditing/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.370</version>
+        <version>0.183.371</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
 

code/framework/auditing/src/test/java/io/cattle/platform/iaas/api/auditing/ApiKeyAuditTest.java

@@ -145,6 +145,7 @@ public void governanceErrorsUseTheSamePublicKeyIdentityBeforeAndAfterValidation(
                     service.idFormatter = typedFormatter();
                     ApiRequest request = new ApiRequest(null, null);
                     request.setType(type); request.setId(id); request.setMethod("PUT"); request.setResponseCode(status);
+                    request.setAttribute("apiKey.audit.requestId", "00001c99-0000-4000-8000-000000000000");
                     request.setRequestObject(Map.of("id", "1c99", "accountId", "1a99", "secretValue", "private-secret"));
                     ApiContext.newContext().setPolicy(policy());
                     ApiContext.getContext().setIdFormatter(service.idFormatter);
@@ -157,7 +158,10 @@ public void governanceErrorsUseTheSamePublicKeyIdentityBeforeAndAfterValidation(
                     assertEquals("1a2", event.get("actor")); assertEquals("apiKey", event.get("targetType"));
                     assertEquals("update", event.get("operation")); assertEquals(status, event.get("httpStatus"));
                     assertEquals(status == 401 || status == 403 ? "DENIED" : "FAILED", event.get("outcome"));
-                    assertFalse(delivered.toString().contains("private")); assertFalse(delivered.toString().contains("1c99"));
+                    assertEquals("00001c99-0000-4000-8000-000000000000", event.get("requestId"));
+                    assertFalse(event.containsValue("1c99"));
+                    assertFalse(event.containsKey("requestObject")); assertFalse(event.containsKey("responseObject"));
+                    assertFalse(event.containsKey("secretValue")); assertFalse(event.toString().contains("private-secret"));
                 }
             }
         }

code/framework/db-loader/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.370</version>
+        <version>0.183.371</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/deferred/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.370</version>
+        <version>0.183.371</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/encryption/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.370</version>
+        <version>0.183.371</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/engine/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.370</version>
+        <version>0.183.371</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/eventing/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.370</version>
+        <version>0.183.371</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/events/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.370</version>
+        <version>0.183.371</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/extension-spring/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.370</version>
+        <version>0.183.371</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/extension/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.370</version>
+        <version>0.183.371</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>