Orchestration Engine 0.183.298

Orchestration Engine 0.183.298

• Fix PUT /v2-beta/mfaSettings/global returning 405 because the live admin
  authorization overlay advertised create instead of update.
• Preserve all 37 declared settings fields, including advanced policy,
  security confirmation, and read-only local-administrator recovery status.
• Restore missing account-holder MFA confirmation inputs and results;
  replace the administrator operation-field wildcard with explicit rights.
• Retain administrator-only policy updates, single-use expiring confirmation,
  and non-echoed SMTP/password confirmation inputs. No authentication bypass
  or broader collection-create/delete permission is introduced.
• Add actual overlay-order regression tests and packaged-overlay checks;
  retain the frozen v1 hardware and MFA contracts.

Orchestration Engine v0.183.297

Orchestration Engine v0.183.297

• Complete the frozen v1 hardware contract for service launchConfig
  payloads as well as direct containers.
• Expose runtime, shmSize, and typed deviceRequests with the same
  create/update permissions on both schema surfaces across all 12 applicable
  role snapshots.
• Extend the packaging regression test to reject a snapshot where either
  container or launchConfig loses these fields.
• Keep the existing /v2-beta contract and Docker create/upgrade conversion
  behavior unchanged.

Orchestration Engine v0.183.296

Orchestration Engine v0.183.296

• Expose the existing container runtime and typed deviceRequests fields to
  clients which consume the frozen v1 API schemas.
• Preserve each role snapshot's existing create and update permissions by
  matching the established shmSize hardware field.
• Add a packaging regression test which loads every shipped v1 snapshot and
  verifies the container fields and nested GPU request schema.
• Keep the existing /v2-beta contract and Docker create/upgrade conversion
  behavior unchanged.

Orchestration Engine v0.183.295

Orchestration Engine v0.183.295

• Preserve the reviewed PROXY_PLATFORM_PUBLIC_ORIGIN value when launching the WebSocket proxy so TLS-terminating deployments retain their public HTTPS origin through the Engine-managed child process.
• Continue clearing unreviewed proxy environment variables and dynamic launcher addresses.
• Full Maven reactor tests, source secret scan, product JAR SBOM and vulnerability scan, and Dapper image scan passed for source revision 6c7922b in workflow run 34469322453.

Orchestration Engine v0.183.294

Orchestration Engine v0.183.294

• Replace the branded cache-runtime coordinate with the independently released pure numeric v5.7.4 artifact.
• Bind the build to cache-runtime source revision 21fe15f85f0eff12d3ba1f68af3e1753e90ca3bd and JAR SHA-256 6b768e6cff9e5281e77ad14e609b69bac6856ecd4469af827f566be95553644c.
• Keep the engine's own release coordinate pure numeric and preserve prior published tags as immutable history.
• Full Maven reactor tests, source secret scan, product JAR SBOM and vulnerability scan, and Dapper image scan passed for source revision b59ddee9d79dcffa8b95a00dd9182fe5304b619b.

Orchestration Engine v0.183.293

Orchestration Engine v0.183.293

• Accept Docker's six documented bind-propagation modes during volume preflight.
• Keep propagation modes restricted to bind mounts and reject conflicting propagation declarations.
• Restore NFS storage-driver upgrades that use the existing shared bind propagation contract.

Orchestration Engine v0.183.292

Orchestration Engine v0.183.292

Restore launchConfig.restartPolicy at the project API authorization boundary.
Service creation and in-service upgrades can now retain the restart policy
selected in the Web Console instead of silently dropping it before deployment.

Regression coverage now checks both authorization-schema visibility and the
downstream container launch configuration. The historical service integration
scenario also verifies the policy on the service and resulting container.

Orchestration Engine v0.183.291

Orchestration Engine v0.183.291

Preserve the service restartPolicy all the way to the container launch
configuration. Service creation and upgrade no longer silently discard the
policy selected in the API or Web Console.

The focused regression test proves that both the policy map and generated
instance name survive launch-data preparation. The complete dependent Maven
reactor remains green.

Orchestration Engine v0.183.290

Orchestration Engine v0.183.290

Keep named-volume preflight aligned with the actual container creation path.
Docker-local named volumes can legitimately have one API inventory record per
host; those records remain host-local until placement and are not an ambiguous
environment-wide shared-volume lookup.

Preflight now checks the same shared-or-unmapped candidate set used by
InstanceVolumeLookupPreCreate. Multiple resolvable shared volumes still fail
closed, as do a storage-driver mismatch or an unusable resolved volume. No
volume is deleted, renamed or implicitly migrated by this change.

The regression suite covers the per-host local-volume case and retains the
existing rejection cases. The source gate binds the runtime lookup used by the
preflight implementation.

Orchestration Engine v0.183.289

Orchestration Engine v0.183.289

Preserve typed runtime and GPU DeviceRequests through container, primary service,
sidekick and upgrade APIs and Docker/Compose conversion. Export GPU reservations
without silently flattening capability alternatives.

Validate GPU count versus device IDs, shared-memory versus IPC, CPU/PID limits,
device paths, temporary filesystems, sysctls and ulimits before scheduling.
The existing project/user schema permission boundaries remain in force.
Hardware settings never implicitly enable privileged mode or host IPC.

Use the Node Agent v0.13.24 and Compose Executor v0.14.35 release packages for
the corresponding new hardware contracts. Release those packages before
deploying this engine. Existing installation-level overrides must be checked
before rollout; do not treat the new default as proof every host is upgraded.

The frontend can suggest only capabilities reported by the selected host.
Inventory is not an exclusive GPU scheduler and does not establish CUDA,
ROCm or media-driver compatibility. Such workloads require real hardware tests.