Skip to content

docs: align API key guide with published 1.6.521 #272

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chen21019 merged 1 commit into from
Oct 11, 2026
+10 −7
Merged

docs: align API key guide with published 1.6.521 #272

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 10 additions & 7 deletions docs/api-keys.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
# API Keys

This guide describes the Server `v1.6.519` source candidate, with Engine
`0.183.335` and Web Console `1.6.181`. It is not a publication or a claim that
every role/resource combination has passed acceptance. Use the published numeric
image tag in the installation guide until the candidate is separately released.
This guide describes published Server `v1.6.521`, with Engine `0.183.337`
and Web Console `1.6.181`. Publication does not mean that every role/resource
combination has passed acceptance. Use the published numeric image tag in the
[installation guide](../README.md#quick-start).

## Access and expiry

Expand Down Expand Up @@ -53,10 +53,13 @@ query rejects the result instead of returning partially authorized records.
All-time has no hidden 24-hour
restriction; explicit UTC ranges and filters apply before bounded totals and
pagination. Failed queries or loss of access must not leave old records visible.
Key governance events use the public Key ID, including rejected edits. After
the same ownership and environment checks, per-Key queries also include valid
historical numeric-ID aliases; existing audit records are not rewritten.

Read decision, outcome and phase separately. ALLOW does not imply success; an
HTTP 200/202 response is not later job or stream completion. A response error
such as 405 is not automatically a Key permission denial. Only the actual
HTTP 200/202 response or successful HTTP 101 handshake is not later job or stream
completion. An error such as 405 is not automatically a Key permission denial. Only the actual
terminal event establishes completion. Container targets use their persisted
instance ID (`1i` prefix) consistently across decision, response and terminal
records, even when an agent schema has no `container` alias. Errors retain the
Expand All @@ -77,7 +80,7 @@ handshake returns `ApiKeyExpired` (401) and records `DENY`/`FAILED`, phase
is unavailable, it returns `AuditUnavailable` (503), without starting execution
or claiming that the denial was durably recorded.

See the [candidate contract and component boundary](releases/server-1.6.519.md).
See the [published release and component boundary](releases/server-1.6.521.md).
Deploy the complete compatible Server image and preserve existing volumes and
backups. Do not downgrade restricted or expired Keys to a policy-unaware Engine,
or convert them to unrestricted legacy Keys as a workaround. Follow the
Expand Down