Portal v0.53.0 — Correct diagnostics and tighter pack boundaries

Infrastructure reads now report failed commands and provider errors instead of returning misleading empty results. This release also tightens pack boundaries and gives MCP clients fixed validation codes and terminal results for definite host exclusions.

Security

• Decimal 3.1.2 fixes the rounding-allocation denial of service in CVE-2026-97853. The exact patch archive and upstream changes were reviewed; its short cooldown exception expires on October 17.
• The native diagnostics build updates Compose's linked x/net to 0.60.0 and containerd to 2.3.6 for their security fixes. Original source files and the minimal derived module graph remain hash-bound in its build evidence.
• Consul 0.2.38 omits SecretID values from token metadata; Runner masking recognizes the observed spellings. Cloudflare 0.2.11 omits Pages environment values, preserves bounded API failures, and confirms an absent custom-ruleset entrypoint before reporting zero.
• Cassandra 0.6.10 confines storage reads to configured roots, rejects keyspace escapes, bounds compaction history, and adds client metadata. Grafana 0.1.20 bounds and projects alerting/build data.
• Certificate inspection emits only the presented certificate chain. Update Network/TLS to 0.3.2. Versions below 0.3.1 are retired; inspection alone does not verify trust or hostname.

Consul versions below 0.2.38, Cloudflare below 0.2.10, Cassandra below 0.6.10, and Grafana below 0.1.20 are retired and blocked by default unless explicitly overridden by an administrator. Update these packs to use the corrected actions.

MCP and clients

• Validation failures carry fixed codes separately from human-readable explanations. Definite host exclusions are terminal results, so clients do not wait for an impossible execution.
• Runner 0.31.1 preserves complete bare signed Cassandra ring tokens, pathless JSON backend URLs, and the two public OIDC algorithm/authentication-method metadata fields. Credential values, authored masking rules and other token-shaped fields remain protected.
• Runner 0.31.1 and MCP Bridge 0.17.1 are rebuilt with Go 1.27.2. Version minima and enforcement are unchanged.

Pack behavior

• PostgreSQL 0.2.21: native VACUUM dead-item counters across versions, labeled checkpoint statistics, and the strict sequential-scan filter, including indexless tables. All 117 native cases passed across PostgreSQL 16.15, 17.11, and 18.6.
• Network/TLS 0.3.2: bounded hostname:port:IP overrides for HTTP probes/headers preserve Host, SNI, and certificate verification; IPv6 inspection, legacy TLS probes, and bounded WHOIS-to-RDAP fallback. Redirects reuse an override only for its exact hostname and port.
• Nomad 0.4.16: seven job reads accept periodic, dispatched, and nested child IDs; HTTP failures remain failures. Mutation-target validation is unchanged. Redis 0.3.20 rejects CLI error replies and preserves setup/command diagnostics.
• Traefik 0.1.25: separate metrics entrypoint and complete bounded HTTP router/service inventories, including summary and readiness joins. Docker 0.2.31 reports a missing Compose plugin without hiding unrelated failures or changing literal downstream arguments.
• GCP Compute 0.2.6 / DNS 0.2.4: bounded inventory reads. Load Balancing 0.1.4 preserves true, false, and absent Cloud CDN evidence. Storage 0.1.3 distinguishes live and explicitly requested noncurrent versions. Monitoring 0.3.12 uses the actual Interconnect resource labels.
• Linux Core 0.5.3 / Debugging 0.3.4 / Firewall 0.1.19 / Systemd Deep 0.3.1: exclude pseudo-filesystems from inode diagnostics; repair kernel/TCP/port reads and add peer counts; group protocol states and resolve inline port-set membership; preserve escaped unit names and omit disabled watchdog intervals.
• Vector 0.1.16 / ClickHouse 0.2.18: bounded finite component/server metrics and absent-Keeper handling. ClickHouse adds a normalized structural read that omits literals and is not recreatable SQL, plus a full server-provided DDL read that requires approval under the default policy and warns about sensitive defaults, comments and engine arguments. Oversized definitions fail instead of returning partial DDL.
• Tailscale 0.1.9 / GitHub CLI 0.1.17 / JVM 0.1.20 / Stripe 0.2.2: relay replies and requested probe counts; literal search arguments and permission-limited PR visibility; unavailable-counter failures; omit zero credit-note allocations.

Delivery and access

• A separate native Linux amd64 diagnostics artifact carries its complete runtime closure. CI, publication, and saved plans bind the exact source, immutable image, purpose, SBOM, and file evidence. The host extracts it without starting its container.
• Bucket-policy reads are limited to the two required buckets. Log and bucket inventory permissions do not grant log payload, private-object, or unrelated bucket-policy access.
• Review checks resolve their baseline per invocation. Regression coverage retains current runner admission, pack trust, and fixed-view log authorization. Terraform checks use 1.16.5; MySQL behavior fixtures wait for the bridge TCP listener.

Corrected Interconnect execution remains unverified against a live provider; fixture coverage is not live-provider proof. The owner waived model evals, so this release makes no MCP certification claim. Production rollout still requires the owner's Terraform Confirm & Apply, followed by live verification.