Portal 4.0.16

[4.0.16] - 2026-08-11

Fixed

• Servers running 4.0.15 can update again. The update path attests the
  scheduled Portal backup helper (backup-full.sh) against a list of helpers
  that shipped in a signed release, and refuses to continue when it finds one
  it cannot vouch for. 4.0.15 shipped a rewritten helper — the degraded-backup
  work — without adding it to that list, so 4.0.15's own guard rejected the
  helper 4.0.15 installs. Every server that reached 4.0.15 was blocked from
  updating with Unsafe Docker prune guard: scheduled Portal backup helper does not match a known shipped BridgesLLM release. The helper is now attested and
  the update proceeds normally. No action is required beyond updating; the
  guard itself was working correctly and is unchanged.

Changed

• A release can no longer ship a backup helper its own installer would
  reject. The guard reads the helper that is already installed, before the
  update replaces it, so changing the helper passes every gate on the release
  that introduces it and only fails on the next update. The release build now
  hashes the helper it is about to ship and fails closed unless the installer
  attests those exact bytes.

---

Update from any earlier 4.0.x

curl -fsSL https://bridgesllm.ai/install.sh | sudo bash -s -- --update

4.0.16 contains everything in 4.0.15 plus this fix, so updating straight to 4.0.16 is the recommended path — including from 4.0.15, whose update was blocked by this defect.

Release integrity. Artifacts at https://bridgesllm.ai/releases/4.0.16/ carry an ed25519-signed manifest; portal.tar.gz is sha256:972622196d14ae0f573bf20df93ac6719289c2560797c6e59482fb18b8b80a8a.

Tag history note. This repository is a squashed source export. Releases 4.0.4, 4.0.9 and 4.0.10 shipped without a matching export at the time, and the commits that later carried their code also carry subsequent versions, so those tags cannot be backfilled honestly and were deliberately not invented.