fix(server): publish native host onboarding repair in v1.6.522

.github/workflows/publish-current-server.yml

@@ -336,8 +336,10 @@ jobs:
           # Exercise the published API and real auth overlay on this fresh,
           # disposable database before the image is allowed to be released.
           python3 source/scripts/test-mfa-policy-api.py \
-            --port 18082 --disposable |
+            --port 18082 --disposable --registration-basic |
             tee "$evidence/mfa-policy-api-smoke.txt"
+          grep -E '^REGISTRATION_BASIC_API_OK checks=7 ordinary_user=true entry_only=true node_active_verified=false script_sha256=[0-9a-f]{64}$' \
+            "$evidence/mfa-policy-api-smoke.txt" >"$evidence/registration-basic-api-smoke.txt"
 
           docker stop "$CANDIDATE_NAME" >/dev/null
           mkdir -p "$rootfs"
@@ -585,6 +587,7 @@ jobs:
               host-api-package-check.txt \
               image-inspect.txt \
               mfa-policy-api-smoke.txt \
+              registration-basic-api-smoke.txt \
               published.txt \
               push.log \
               release-notes.md \
@@ -615,6 +618,7 @@ jobs:
             "$evidence/host-api-package-check.txt" \
             "$evidence/image-inspect.txt" \
             "$evidence/mfa-policy-api-smoke.txt" \
+            "$evidence/registration-basic-api-smoke.txt" \
             "$evidence/published.txt" \
             "$evidence/push.log" \
             "$evidence/release-notes.md" \

COMPATIBILITY.md

@@ -1,5 +1,23 @@
 # Compatibility Contract
 
+## Server v1.6.522 prepared, not published
+
+The minimal onboarding candidate uses released Engine `v0.183.339` and Web Console
+`1.6.183`. It restores dedicated registration-token Basic authentication.
+Custom add-host requires RegistrationToken POST; built-in and Other drivers
+require Host POST, using the current project's loaded native schemas.
+Cancel / Go Back preserves the external return target across driver changes and
+API-host settings refresh; missing or self-referencing targets return to Hosts.
+Backend roles, resource authorization, other Server components and the console
+broker are unchanged.
+
+Clean merged component source and official asset checksums have been read back;
+the original component packagers produced those assets. Focused component and
+native UI validation passed, but the final Server image, its seven-check native
+registration gate and active-node lifecycle acceptance remain pending.
+Integration candidates are not this published release. See the
+[candidate note](docs/releases/server-1.6.522.md) for exact component identities.
+
 ## Server v1.6.521 published
 
 The [official release](https://github.com/PastureStack/server/releases/tag/v1.6.521)

README.md

@@ -9,80 +9,76 @@ Rancher 1.6 ecosystem. It is not affiliated with Rancher Labs or SUSE.
 This fork of [`rancher/rancher`](https://github.com/rancher/rancher) preserves
 upstream history, authorship, licenses, and notices.
 
-## Current release
-
-Server `v1.6.521` packages Web Console `1.6.181`
-and Orchestration Engine `v0.183.337`. API Keys support full, custom and closed
-policies, optional expiry, and key-scoped durable audit records. Their permissions
-remain bounded by the owner's current role and environment access. Delegated
-terminal/log access requires the verified Host API audit capability and the
-compatible Linux Node Agent lifecycle.
-Custom Key Project targets share the normal API's live membership checks;
-membership never bypasses Key rules or unrelated resource authorization.
+<a id="current-release"></a>
+
+## Current source candidate
+
+Server `v1.6.522` is a prepared source candidate, not a published image. It targets
+released Web Console `1.6.183` and Orchestration Engine `v0.183.339`. Registration
+tokens use their dedicated Basic authentication route. Add-host access follows
+the form's actual operation: Custom requires RegistrationToken POST; built-in
+and Other drivers require Host POST. Cancel / Go Back retains the return route
+across driver changes and API-host settings refresh, with Hosts as the fallback
+for a missing or self-referencing target.
+Component validation and official asset readback have passed; final Server image
+publication, its native registration gate and active-node acceptance remain pending.
+The published Server remains
+[`v1.6.521`](https://github.com/PastureStack/server/releases/tag/v1.6.521); its
+registration-token Basic route has a known authentication regression. Its
+[release note](docs/releases/server-1.6.521.md) retains the published identity. See the
+[candidate release note](docs/releases/server-1.6.522.md) for the release boundary.
 
 The console supports OIDC, TOTP and passkeys, role-aware resource operations,
 container resource/hardware settings, and movable terminal/log windows.
 Hardware options require compatible node software and actual host capabilities;
-GPU device access is not exclusive GPU allocation. Audit queries and exports
-cover retained records with environment-aware access and bounded pagination.
-Explicit date bounds remain attached to every audit page, so an older interval
-does not scan newer records first. Oversized queries retain the console filters
-and offer explicit narrowing or retry. Export failures are translated on the
-page instead of downloaded as error files. An export failure keeps successful
-query results intact; scan and export limits are retained.
-The Key modal owns initial focus and yields to keyboard or pointer interaction.
-Audit export closes its own menu before locking the request, allowing consecutive
-JSON, CSV and XLSX downloads without leaving a disabled menu open.
-Key scope choices use the viewer's authorized environment list. Environment,
-stack and resource selectors close before dependent loading or verification.
-Failed Key edits use a consistent public Key ID in audit records. Per-Key audit
-also reads historical numeric-ID records within the same ownership and environment
-authorization checks; existing records are not rewritten.
-See the [published v1.6.521 release](https://github.com/PastureStack/server/releases/tag/v1.6.521)
-and [release note](docs/releases/server-1.6.521.md) for exact
-component identities and verification boundaries. A version or packaged feature
-does not establish that every resource/role/hardware combination has been tested.
+GPU device access is not exclusive GPU allocation. Audit queries and JSON, CSV
+and XLSX exports preserve environment authorization, explicit date bounds and
+bounded pagination. Query/export errors retain filters and successful query
+results. See the [Host compatibility guide](docs/hosts/README.md) before enrolling
+a host and the [API Key guide](docs/api-keys.md) for policy and audit behavior.
+A packaged feature does not establish that every resource, role or hardware
+combination has been tested.
 
 ## API Keys
 
 Choose allow-by-default with deny exceptions, or deny-by-default with allow
 exceptions, with optional expiry. Without exceptions these retain full or closed
 access. Search for resource names; the editor and reviewed changes include a
-resource-by-operation policy matrix, not an extra grant of authority. The maximum access
-is always the Key owner's current account/environment RBAC; a Key never grants
-an additional role. Existing legacy Keys are not automatically narrowed on upgrade.
+resource-by-operation policy matrix, not an extra grant of authority. The maximum
+access is the Key owner's current account/environment RBAC, including live
+membership checks; a Key never grants an additional role. Existing legacy Keys
+are not automatically narrowed on upgrade.
 New Key secrets are shown once at creation and are not returned by later lists or
 details. Per-Key audit separates authorization, the HTTP response and any later
 job/stream completion. A successful WebSocket upgrade is recorded as a successful
 HTTP `101` handshake, not as proof of the stream's later completion.
 Environment-Key audit rechecks live Engine access in
 Engine-verified project contexts; a caller-supplied project header is not a grant.
-Open a Key's audit from its action menu; the close control follows the audit
-filters, results and details, below the audit block.
-Scope options and unselected hints use readable light/dark theme text, including
-keyboard highlighting; narrow layouts keep the matrix in its own scroll region.
-Errors use the existing API status/code and console error
-handling. See the [API Key guide](docs/api-keys.md) for policy and audit contracts.
+Delegated terminal/log access requires the verified Host API audit capability
+and a compatible Linux Node Agent lifecycle. Open a Key's audit from its action
+menu. See the [API Key guide](docs/api-keys.md) for policy and audit contracts.
 
 ## Quick start
 
-Public GHCR downloads do not require a registry login. Use the published numeric
-version tag and keep all three named volumes:
+Public GHCR downloads do not require a registry login. The examples below target
+the prepared numeric `v1.6.522` tag: run them only after its official release and
+image have been published and read back. This candidate is not yet available
+from GHCR. Keep all three named volumes:
 
 ```sh
 docker run -d --name pasturestack-server --restart unless-stopped -p 8080:8080 \
   -v pasturestack-cattle:/var/lib/cattle \
   -v pasturestack-mysql:/var/lib/mysql \
   -v pasturestack-mysqllog:/var/log/mysql \
-  ghcr.io/pasturestack/server:v1.6.521
+  ghcr.io/pasturestack/server:v1.6.522
 ```
 
 For HTTPS termination at a reverse proxy, set the exact public origin:
 
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.521
+    image: ghcr.io/pasturestack/server:v1.6.522
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/README.md

@@ -7,6 +7,12 @@ runtime gates have passed.
 
 ## Release notes
 
+- [Server v1.6.522 candidate](releases/server-1.6.522.md) — prepared source using
+  released Engine `0.183.339` and Web Console `1.6.183`; dedicated registration
+  authentication and schema-bound add-host access/navigation. Component checks
+  passed; the final Server image, native registration gate and active-node
+  acceptance remain pending. It is not a published image.
+
 - [Server v1.6.521](releases/server-1.6.521.md) — officially published with
   Engine `0.183.337` and Web Console `1.6.181`; canonical API Key audit identifiers
   and historical numeric-ID reads retain ownership and environment checks.

docs/performance/README.md

@@ -8,10 +8,14 @@ The following example is appropriate as a starting point for a dedicated
 16-vCPU host with about 32 GiB of RAM. It is not a universal performance
 profile; measure the real workload before increasing it further.
 
+The example matches the prepared `v1.6.522` source candidate: run it only after
+its official release and image have been published and read back. This candidate
+is not yet available from GHCR; see the [candidate release note](../releases/server-1.6.522.md).
+
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.521
+    image: ghcr.io/pasturestack/server:v1.6.522
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/releases/server-1.6.522.md

@@ -0,0 +1,76 @@
+# Server v1.6.522 candidate
+
+Prepared source only; no Server image or release has been published.
+The candidate uses released Engine `v0.183.339` and Web Console `1.6.183`.
+The published Server remains `v1.6.521`.
+
+## Minimal onboarding changes
+
+Engine gives the reserved `registrationToken` Basic username to its dedicated
+registration lookup before ordinary API Key authentication. A rejected native
+token does not fall through to an API Key or browser session. This does not
+broaden the register schema, API Key permissions or account RBAC.
+
+Web Console gates each add-host form by its actual submission path: Custom
+creates a RegistrationToken and requires RegistrationToken POST; built-in and
+Other driver forms create a Host and require Host POST. Machine POST alone does
+not grant either path. These checks use the current project's loaded native
+schemas; absent, readonly or stale schemas grant no onboarding access.
+
+Cancel / Go Back explicitly dispatches to the active route. The external return
+target is saved before the initial driver redirect and preserved across driver
+changes and API-host settings refresh. Missing, loading or self-referencing
+add-host targets fall back to Hosts; valid external targets and the existing
+waiting destination remain. Other Server components and the console broker are
+unchanged; this is not the broader API Key integration candidate.
+
+## Released component inputs
+
+Engine `v0.183.339` uses source
+`436a37215bc5702e516ecf1feb6753b4be5bf602`; official `cattle.jar` SHA-256 is
+`bce020a298ebb89ef3d14ba0666f040e4a732288d1b100da9859dcf957a7981d`.
+Web Console `1.6.183` uses normally merged source
+`e056a0111d20816742eff17a65dfabb5d003dae2`; official
+`web-console-1.6.183.tar.gz` SHA-256 is
+`8540758ad4521f901f53fc79473570cf98862add2addcb49271d8dbf125b4217`.
+
+These components use clean merged source and the original component packagers;
+the official versioned release assets and checksums were independently read back.
+They are not CI-produced component artifacts. The Server image is a separate
+normal publication CI output and is still pending.
+
+## Publication prerequisites
+
+The formal recipe, builder defaults and coordinate assertions must use the
+released component identities above and the verified Engine schema hashes.
+An uncommitted local build checksum or integration image is not an official
+release identity.
+
+The normal Server publication workflow still requires a clean exact source,
+source gates, formal image build and flatten comparison, isolated startup and
+restart, proxy/cache contracts, native MFA/API smoke, final merged-rootfs
+security and SBOM gates, provenance, immutable numeric publication, and release
+asset readback. Existing vulnerability decisions and review deadlines remain;
+the new version is not permission to widen or reset them.
+
+## Native acceptance boundary
+
+Eleven focused native-schema and return-history component cases and the native
+add-host UI checks passed on the component source/tree used for the released
+Web bundle. They validate the component changes only, not a final Server image.
+
+The final Server's seven-check native registration gate remains pending. It must
+verify native token creation and readiness, generated script retrieval,
+`GET /v1/register`, the restricted registration schema, ordinary API Key Basic
+authentication and invalid-token rejection even with a valid cookie.
+Successful HTTP entry alone does not prove an agent connection or active node.
+The real agent lifecycle and active-node acceptance also remain pending.
+
+## Install, upgrade and rollback
+
+After publication and readback, use the numeric image tag
+`ghcr.io/pasturestack/server:v1.6.522` shown in the README. Keep all three existing
+volumes, environment variables, networking, restart policy and security options.
+The intended changes do not add a database migration or authentication setting.
+Rollback to `v1.6.521` restores the known registration-token authentication defect;
+keep a matching database backup and follow the existing API Key rollback guide.