Server v1.6.469

Server v1.6.468

This patch assembles Web Console 1.6.131 with Orchestration Engine v0.183.322
on the preserved digest-pinned v1.6.460 runtime base.
The administrative account collection includes project accounts, such as
the shared Default project. The account page only displays user/admin
accounts, but Web Console 1.6.130 requested user-only identity links for
every account in the collection. A project account's expected 404 blocked
the whole page. The route and controller now share the displayed-kind
predicate; authorization and backend errors for visible accounts remain
visible rather than being discarded.

No API authorization, authentication policy, database schema, HAProxy, or
production deployment changes are included.

Verification boundary

Source and browser-unit gates, the immutable image build and scan, QA 8080
startup/restart, the real account-page browser check, and the scoped
v1/v2-beta permission matrix must pass before claiming this patch is
accepted. The matrix lists its tested paths and gaps; it is not proof of
every API endpoint. Production stack.ascdc.tw is not changed here.

Upgrade and rollback

After publishing the immutable image digest, update only the Server image
reference from v1.6.467. Preserve existing Compose environment variables,
named volumes, restart policy, AppArmor, HTTPS origin, OIDC, performance
settings, and firewall backend. Rollback selects the preserved
v1.6.467 image with the same configuration and volumes.

Server v1.6.467

This patch assembles Orchestration Engine v0.183.322 and Web Console
1.6.130 on the preserved digest-pinned v1.6.460 runtime base. The Engine
retries account-owned networks left in removing after an interrupted purge;
completed removals are not repeated. Its release gate also rejects packaged
cattle-dev archives and dev-defaults.properties. The console clarifies
denied or missing stack/account pages and keeps identity-link authorization
failures visible instead of presenting a false empty identity. No database
migration or authentication-policy change is included.

Verification boundary

Production adoption is blocked until the official component artifacts, clean
Server build, image scan, and isolated 10.0.0.125:8080 permission matrix pass.
The matrix must distinguish live v1/v2-beta API results from simulated UI
error responses and list untested resource families explicitly. A passing
subset must not be described as proof that every API endpoint is authorized.
No deployment to stack.ascdc.tw is part of this release procedure.

Upgrade and rollback

After an immutable digest is published, update only the Server image reference
from v1.6.466. Retain the existing Compose environment variables, named
volumes, restart policy, AppArmor, public HTTPS origin, OIDC, performance
settings, and host firewall backend. Rollback selects the preserved
v1.6.466 image with the same configuration and volumes. Account-network
purge retries should be assessed before rollback because the prior Engine can
leave a partially removed network behind.

Server v1.6.466

This patch updates Web Console to 1.6.129 for capability-bound environment
editing. On a direct ?editing=true URL, member add/change/remove controls
now require the project's setmembers action, project metadata uses its own
update action, and network-policy controls use the network's update action.
The detail page exposes an Edit entry for network-only capability. The save
path follows the same boundaries. A page without writable controls
retains Cancel without offering a misleading Save. No backend authorization,
database schema, or deployment configuration changes are introduced.

Component and release coordinates

• Web Console: 1.6.129, source commit
  71fe325071e8a93a09c3eba122509e58caf4272a; official artifact SHA-256
  3cea709fc2b09f0088371b6ba3e4b5cff0e1b1ca54dbc76295668b2d8696580e.
• Orchestration Engine remains v0.183.321; Authentication Service remains
  v0.4.42. All other components and the digest-pinned v1.6.460 runtime
  base remain as in Server v1.6.465.
• The immutable Server image digest is recorded only after the release build
  and registry readback, not inferred from this source candidate.

Verification before publication

Run the focused Web Console unit and rendered-template permission tests and
its official clean-source build. In isolated QA, exercise owner, member,
restricted, readonly, and no-access accounts against direct environment view
and ?editing=true routes. Owner must retain member controls and real save;
roles without setmembers must see the member list without add/role/remove
controls. Verify no-write Save is absent, Cancel works, and v1/v2-beta project
member authorization remains unchanged. Check browser errors and live API
responses separately. Network update authorization requires a disposable
editable network and is not implied by a hidden UI control or by a 405.

Upgrade and rollback

After v1.6.466 is published with an immutable digest, update only the Server
image reference from v1.6.465. Preserve Compose environment variables,
named volumes, restart policy, Docker socket, AppArmor, HTTPS origin, OIDC,
performance parameters, and nftables architecture. No migration is needed;
rollback selects the preserved v1.6.465 image with the same configuration and
volumes. This release procedure does not deploy to a production host.

Server v1.6.465

This patch release updates Orchestration Engine to v0.183.321 for the
project-member detail authorization fix. A direct request for an
inactive or removed project-member row must return 404 even when the row remains in the
database. Active rows retain the established project access check. The same
contract applies to /v1/projectMembers/{id} and
/v2-beta/projectMembers/{id}.

Component and release coordinates

• Orchestration Engine: v0.183.321, source commit
  2adfd0f0338cf6ae637ceb36532e965ccf8ddb4e, with cattle.jar
  SHA-256 1be55ad6395989e4b73de102ef0db730ac6d5c378daef7a2f521ad74c85121ed
  from the successful pinned-source CI artifact.
• Web Console remains 1.6.127; Authentication Service remains v0.4.42.
  Other components, the digest-pinned v1.6.460 runtime base, persistent
  volume layout, and deployment settings remain as in
  Server v1.6.464.
• The immutable Server image digest and source commit are recorded only after
  the release build and registry readback. Neither is inferred from this
  source candidate.

Verification before publication

In an isolated environment, create an active project membership and confirm
that authorized direct reads succeed in both API versions. Remove that
membership while retaining its database row, then confirm that direct reads
return 404 in both versions and active collections omit it. Also test an
unrelated project ID, unauthorized update attempts, and the five-role
owner/member/restricted/readonly/noaccess UI and API matrix. The current
published UI should display permission and missing-resource errors through its
existing localized messages. Record the exact tested image digest, QA cleanup
result, Server startup and restart, SBOM and security scan before publishing.

Upgrade and rollback

After v1.6.465 is built and its immutable digest is verified, update only
the Server image tag from v1.6.464. Preserve the existing Compose
environment, named volumes, restart policy, Docker socket, AppArmor, HTTPS
origin, OIDC configuration, performance parameters, and nftables setup. No
database migration is introduced. Rollback uses the preserved v1.6.464
image and the same configuration and volumes. This release procedure does not
deploy to a production host.

Server v1.6.464

PastureStack Server v1.6.464 retains Orchestration Engine 0.183.320 and updates
Web Console 1.6.127. The console shows a localized, actionable error when an
environment or its environment member list cannot be loaded because the
resource is missing or the caller lacks permission. A 5xx environment-load
failure displays a localized retry message without exposing the raw server
response. A 403 or 404 during save identifies the failed project, membership,
or network-policy step. If an
earlier step may already have been stored, the message asks the operator to
refresh and verify before retrying. Identity search now distinguishes an empty
result, an expired session, forbidden access, and server or network failure.

The API permission decision remains on the Engine. The console follows the
project's projectMembers link and does not infer permission from a role name
or hide an API failure as an empty result.

Immutable component coordinates

• Web Console 1.6.127, artifact source commit
  0f21118a871a1b72558a2fa11b4f33675fd6ae15, signed release tag commit
  580cb3bc472b9e8105787d76ca20b0189ace84bf. Release archive
  web-console-1.6.127.tar.gz SHA-256:
  dcaaad16bbdf38c82af1cecb9cfc0867dcceab76503f632e151da6a17952f852.
• Both Web Console commits have source tree
  cdfafb8c77963f61587298f593a90baa7b57e49f. CI run 35892291179
  produced the published archive using SOURCE_DATE_EPOCH=1790182621 from the
  artifact source commit. CI run 35893346372 rebuilt the release tag with
  SOURCE_DATE_EPOCH=1790182948. The archive hashes differ only because the
  tar member modification times differ: all 140 member headers excluding
  modification time and all 123 file sizes, modes, and SHA-256 hashes match.
  Image metadata records the actual published archive's source commit.
• Orchestration Engine v0.183.320, commit
  268469153c299987bd42e288dd68bb62af91002e, cattle.jar SHA-256
  8483db0b4f2fe71ce527ba97bfb3caea14096ec356124ecef9aa1e7853c8553e.
• Authentication Service remains v0.4.42; the remaining component pins and
  digest-pinned v1.6.460 runtime base remain as documented for
  Server v1.6.463.

Verification before publication

The source gate requires the final Web Console commit and archive digest. The
archive must pass SHA-256 verification and retain its own
VERSION.txt, all supported locale assets, and the compiled project-access
messages. Verify authorized environment view/edit/save, unauthorized project
and member-link load, permission-denied member and network-policy saves,
identity search failures, 5xx environment-load errors, and refresh after a
partial save in an isolated QA environment. Record the actual browser result
alongside the v1 and v2-beta project-member API matrix. The release image,
SBOM, scanner result, startup, and restart are release gates.

Upgrade and rollback

After the immutable v1.6.464 image and digest are published and verified,
upgrade from v1.6.463 by changing the image tag. Preserve environment
overrides, named volumes, Docker socket, port 8080, restart policy, and
AppArmor configuration. No database migration is introduced by this console
change. Rollback uses the preserved v1.6.463 image and the same configuration
and volumes. Production deployment is separate from this release procedure.

Server v1.6.463

PastureStack Server v1.6.463 packages Orchestration Engine 0.183.320 and the
unchanged Web Console 1.6.126. The Engine checks the requested project before
loading a project-member collection. A token authorized for project A cannot
combine X-API-Project-Id: A with ?projectId=B to read B's members through
/v1/projectMembers or /v2-beta/projectMembers. Malformed or unauthorized
project IDs return 404 before a membership read. Direct member-ID access keeps
its existing project check.

Immutable component coordinates

• Orchestration Engine v0.183.320, release commit
  268469153c299987bd42e288dd68bb62af91002e, release asset cattle.jar
  SHA-256 8483db0b4f2fe71ce527ba97bfb3caea14096ec356124ecef9aa1e7853c8553e,
  and CycloneDX asset cattle-cyclonedx.json SHA-256
  9869f1d6bd9ca5a193a89bc5d68d5ccae79b26291c320766df7332c078c7ae7e.
• Web Console remains 1.6.126, commit
  5cba85d3ab954c416b86910f760f987ec2bfc526, release artifact SHA-256
  a278904a10ce757510ed516507bd3926b02bab42a52a27bd153ff5e94e2998aa.
• The remaining component coordinates and the digest-pinned v1.6.460 base
  remain those of Server v1.6.462.

Release and QA verification

The Engine commit and both artifact digests are pinned to the immutable
v0.183.320 GitHub Release. The Server source gate, image build, merged
runtime scan, SBOM identity check, and candidate startup/restart must pass for
the exact Server commit. On isolated QA, run v1 and v2-beta project-member
collection checks with an authorized header for A and query project B, plus
authorized collection and direct member-ID allow/deny cases. Preserve the
existing direct-user and OpenID Connect group role matrix.

Upgrade and rollback

Upgrade from v1.6.462 by changing only the image tag after the new image is
published and verified. Preserve environment overrides, named volumes, Docker
socket, port 8080, restart policy, and AppArmor configuration. This Engine
change does not add a database migration.

Rollback uses the preserved v1.6.462 image and the same configuration and
volumes. That image contains Engine 0.183.319 and lacks this collection-read
authorization fix, so restrict access while diagnosing a rollback. Production
deployment is outside this release procedure.

Server v1.6.462

PastureStack Server v1.6.462 packages Orchestration Engine 0.183.319 and Web
Console 1.6.126. It closes the shared-Default membership race, completes the
zero-environment browser state, and makes OpenID Connect account identities
both useful to administrators and safe to update.

Atomic shared Default membership

The Engine performs the shared-Default membership lookup and conditional
insert while holding the same project lock used by administrator membership
updates. Every active direct, group, and stable-account identity is considered
before a baseline member link is created. Existing owner, member,
restricted, readonly, and noaccess decisions therefore remain
authoritative even when first login and an administrator update overlap.

The explicit shared, personal, and none provisioning modes and the
legacy project.create.default=false switch remain compatible. Invalid modes
continue to fail closed, existing personal environments are not migrated, and
the stable adminProject UUID remains the only shared Default identity.

Zero-environment and account administration

An authenticated account with no active environment is a supported empty
state. The console clears stale project scope, skips project-scoped catalogs,
secrets, workloads, hosts, and storage reads, and directs obsolete environment
URLs to the environment selector without a loading loop.

Account administration prefers an authoritative authIdentityLink name,
login, then external ID. If an inactive historical row has no readable link,
its embedded identity is used locally instead of blanking the row or failing
the full inventory. Descriptions remain operator-owned account data. Loaded
identity links are display-only and are never serialized in an account update.

Permission-matrix boundary

The runtime acceptance uses independent direct-user and OpenID Connect group
accounts for owner, member, restricted, readonly, and no-access roles, plus
site-denied and fresh-denied identities. Both v1 and v2-beta project and stack
collections are compared as exact sets; direct resource identifiers and
write/delete operations are also checked. The browser matrix validates the
real environment dropdown, a true zero-environment stale-route and reload
flow, the administrator account edit modal, and one explicit session-bound
logout. Passive authentication events must not emit a token DELETE.

The browser harness records no password, JWT, TOTP seed, one-time code, or
client secret. Failure screenshots clear input values first, temporary
Authentik principals and root-only secret files are removed through independent
cleanup paths, and a cleanup failure marks both the run and latest pointer as
failed.

Immutable component coordinates

• Orchestration Engine v0.183.319, commit
  222552c4b1fad095a5b55756cdca8e02b088ba04, release JAR SHA-256
  74ac55939399873eeb9ab0813ca193e373ccf2bdde3e3d884d5491b4d0b7608e,
  and CycloneDX SBOM SHA-256
  082af08ce90d7cb9b043452c177c8f60a0c36d52f0797e24baaa37d7c1e087b4.
• Web Console 1.6.126, commit
  5cba85d3ab954c416b86910f760f987ec2bfc526, release artifact SHA-256
  a278904a10ce757510ed516507bd3926b02bab42a52a27bd153ff5e94e2998aa.
• Authentication Service remains v0.4.42, commit
  5589ef8fda68ae56e1afd64096965d452ee8a17e, release archive SHA-256
  f14d22036a0a88d6a8d669700506bba680fc7605bbca2b337e345c5cd71500fb,
  and extracted binary SHA-256
  feaabe4bba85cbe119c98a79a27abb4510401fc051f34d02aa7b48d69bdbe746.
• Catalog Templates remain pinned to commit
  e082033ba3c12b5f5cfcae93ff1d6f50d5440d07 (v0.3.12).

Verification and SBOM identity

The Engine focused authorization suite contains 17 passing tests, including a
100-iteration deterministic lock barrier. Its complete security release gate
builds every Maven module and reports zero applicable Critical or High finding
for the source, release JAR, and Dapper image. Web Console validation contains
536 passing browser tests, clean source/dependency gates, CodeQL, and two
byte-identical production builds.

The Server release workflow builds the layered candidate once, compares and
flattens it to one registry layer, starts and restarts the exact candidate, and
checks the Host API SHA-256 chain, public-origin proxy contract, MFA policy API,
VEX, secrets, and vulnerability policy. After the final registry digest is
known, the CycloneDX metadata component is rewritten to the canonical OCI purl
for ghcr.io/pasturestack/server, exact release version, and one exact
SHA-256 manifest digest. The same finalized SBOM is checksummed, uploaded, and
attested. Replacing the root bom-ref also rewrites the matching dependency
root and inbound references, and the release gate requires exactly one root
edge for the canonical image purl so the component graph cannot be orphaned.

Upgrade and rollback

Upgrade from v1.6.461 by changing only the image tag to v1.6.462. Preserve
all environment variables, named volumes, restart policy, AppArmor policy,
HTTPS origin, OIDC settings, performance settings, and selected firewall
backend. This release does not add a database migration.

Roll back by stopping v1.6.462 and starting the preserved v1.6.461 image with
the same configuration and volumes. Production stack.ascdc.tw, its HAProxy,
OIDC provider configuration, and runtime-patched files are outside this release
procedure.

Server v1.6.461

PastureStack Server v1.6.461 packages Web Console 1.6.125 and keeps account
administration usable when the account inventory contains an inactive
historical row whose identity-link lookup returns AccountNotFound.

Account identity isolation

Account administration continues to query authIdentityLink with the exact
account ID for every readable row. A successful lookup remains authoritative
for local and OpenID Connect names, descriptions, and identities. HTTP 404 is
isolated to the affected historical row and uses that row's existing embedded
identity fields, so one stale account cannot redirect the entire inventory to
the failure page.

The exception is intentionally narrow. HTTP 401, 403, 5xx, transport, and
unexpected failures still reject the route and remain diagnosable. This release
does not broaden account visibility, change role evaluation, or infer one
account's identity from another account.

Preserved authorization boundary

Orchestration Engine 0.183.318 is unchanged. The previously verified owner,
member, restricted, readonly, noaccess, site-denied, and fresh-denied
decisions therefore remain the server-side source of truth for both v1 and
v2 APIs. Workload create and upgrade controls still use the effective project
schema, direct /env/:project_id routes still select only permitted
environments, and required OpenID Connect access remains explicit-allowlist
only.

Session generation, the cross-tab authentication mutex, session-bound logout,
OIDC, TOTP, Passkey, WebSocket, shared Default reconciliation, runtime
resource fields, firewall selection, and persistent data formats are unchanged.

Immutable component coordinates

• Orchestration Engine v0.183.318, commit
  a06427975095bc37afdccc70be307a76a3adf1d3, release JAR SHA-256
  ba919954cfb2a809493499f34d2ecadb69f2dff011d32407309826ed655db593,
  and CycloneDX SBOM SHA-256
  ad369a1b9c0c431b392331539052d81096d7a326f8758ed46e4ff44418e483d7.
• Web Console 1.6.125, commit
  c38e9843d663d9d6dbc5afcecd81c875cf79cd08, release artifact SHA-256
  3282cc3c09ea591ec9474e77c5fd721b61ad67ced6887acda3fa694954ecb9bf.
• Authentication Service remains v0.4.42, commit
  5589ef8fda68ae56e1afd64096965d452ee8a17e, release archive SHA-256
  f14d22036a0a88d6a8d669700506bba680fc7605bbca2b337e345c5cd71500fb,
  and extracted binary SHA-256
  feaabe4bba85cbe119c98a79a27abb4510401fc051f34d02aa7b48d69bdbe746.
• Catalog Templates remain pinned to commit
  e082033ba3c12b5f5cfcae93ff1d6f50d5440d07 (v0.3.12).

Verification boundary

Web Console validation runs all 529 browser tests, including authoritative
identity links, isolated HTTP 404 fallback, and propagation of non-404 errors.
The release workflow also performs a clean Node 24 install, dependency and
source gates, two byte-identical production builds, and retained artifact
checksum verification.

Server validation verifies the exact Web Console release hash and commit,
version marker, merged root filesystem, one-layer output, restart behavior,
SBOM, VEX, and Critical/High security policy. Runtime acceptance on the QA
server additionally checks the rendered account inventory, absence of passive
token deletion, one explicit session-bound logout, and unchanged permission
sentinels.

The component-only assembly uses the immutable one-layer v1.6.460 runtime as
its digest-pinned base. It therefore reuses the already verified Ubuntu
security packages instead of downloading and reinstalling identical packages
during this Web Console-only patch. Full security-refresh builds retain the
Ubuntu-published CA package SHA-256 gate and fail closed on archive or snapshot
errors.

Upgrade and rollback

Upgrade from v1.6.460 by changing only the image tag to v1.6.461. Preserve
all environment variables, named volumes, restart policy, AppArmor policy,
HTTPS origin, OIDC settings, performance settings, and selected firewall
backend. This release does not add a database migration.

Roll back by stopping v1.6.461 and starting the preserved v1.6.460 image with
the same configuration and volumes. Production stack.ascdc.tw, its HAProxy,
OIDC provider configuration, and runtime-patched files are outside this release
procedure.

Server v1.6.460

PastureStack Server v1.6.460 corrects the OpenID Connect admission boundary for
returning accounts in restricted site-access mode. It packages Orchestration
Engine 0.183.318 and retains Web Console 1.6.124, Authentication Service
0.4.42, the shared Default environment, existing volumes, HTTPS origin, OIDC,
TOTP, Passkey, session ownership, performance settings, and the selected
firewall backend.

Restricted and required site access

The Engine now resolves an existing active account from its verified external
identity link before evaluating restricted-site access. Restricted mode may
therefore use that account's existing direct or group project membership,
including shared Default membership. The decision remains fail-closed for an
unresolved or inactive account.

Required mode does not receive the stable account identity during admission and
remains allow-list-only for ordinary OIDC sessions. A project membership cannot
become a required-site allow-list bypass. Explicit project roles, including
noaccess, continue to govern project and workload operations after admission.

Verification boundary

The focused Engine tests cover a returning external identity whose stable
account membership authorizes restricted mode and prove that the same stable
membership does not bypass required mode. The complete dependent Maven reactor,
CodeQL verification, and the security release gate must pass for the exact
merged Engine commit before Server assembly.

The isolated runtime matrix uses six independent OIDC accounts and both v1 and
v2 APIs. It checks unrestricted, restricted, and required site admission;
owner, member, restricted, readonly, noaccess, and site-denied roles; project
and stack create/read/update/delete; direct routes; account identities;
WebSocket access; and exact cleanup of temporary identities and resources.

Immutable component coordinates

• Orchestration Engine v0.183.318, commit
  a06427975095bc37afdccc70be307a76a3adf1d3, release JAR SHA-256
  ba919954cfb2a809493499f34d2ecadb69f2dff011d32407309826ed655db593,
  and CycloneDX SBOM SHA-256
  ad369a1b9c0c431b392331539052d81096d7a326f8758ed46e4ff44418e483d7.
• Web Console 1.6.124, commit
  5892b7b11ae0fee5ac67baedca200dec8826d45b, release artifact SHA-256
  9894883cfb149986fae7b963941a3d00dec324353da1d7b51482670310788d8f.
• Authentication Service remains v0.4.42, commit
  5589ef8fda68ae56e1afd64096965d452ee8a17e, release archive SHA-256
  f14d22036a0a88d6a8d669700506bba680fc7605bbca2b337e345c5cd71500fb,
  and extracted binary SHA-256
  feaabe4bba85cbe119c98a79a27abb4510401fc051f34d02aa7b48d69bdbe746.
• Catalog Templates remain pinned to commit
  e082033ba3c12b5f5cfcae93ff1d6f50d5440d07 (v0.3.12).

Upgrade and rollback

Upgrade from v1.6.459 by changing only the image tag to v1.6.460. Preserve
all environment variables, named volumes, restart policy, AppArmor policy,
HTTPS origin, OIDC settings, performance settings, and selected firewall
backend. This release does not add a database migration.

Roll back by stopping v1.6.460 and starting the preserved v1.6.459 image with
the same configuration and volumes. Production stack.ascdc.tw, its HAProxy,
OIDC provider configuration, and runtime-patched files are outside this release
procedure.