1.6.200

Web Console 1.6.200

Web Console 1.6.200 and bridge 0.2.2 passed required component CI/CodeQL and
original artifact verification. Server assembly and designated live browser/role
acceptance remain separate pending gates; no previous tag or artifact is replaced.
The npm dependency graphs are unchanged; only the root package versions advance.

Bounded workflows

Catalog discovery binds the named catalog/template/version and source revision.
The new Compose Stack flow accepts supported typed questions and resolves
references by names and returned scoped references. Private answers are completed
by the human in the ordinary console. Launch needs original live read/create/update
permissions at the destination, not Project PUT, and uses normal Stack/Compose
owners. No caller-supplied IDs, arbitrary URLs/YAML or extra grant is introduced.
External volumes, unsupported graph types and other Catalog administration remain
explicitly pending; unavailable fields are not claimed as accepted coverage.

Stopped Stack/Service Archive and restore use the existing native owner. Running
resources cannot be archived; mounted-directory data needs review. Restore changes
metadata only and never starts workloads. Infra/system and parent/child checks,
current roles, Key ceilings, cross-ID denials and normal audit behavior remain.

The normal human review keeps exact source/target bindings and current ownership.
Missing/ambiguous reference choices require explicit selection. Accepted work is
not described as unexecuted; uncertain apply responses preserve the original
operation and cannot be automatically retried. A fixed background authorization
denial stays failed with verifiedResult=false, warns about possible partial
changes through the existing 13-language alert and retains the original reference.
Late replies cannot clear a newer plan or reopen confirmation.

Source evidence and pending acceptance

Independent frozen Catalog and Archive sources were retargeted to actual Web199
main, then their eight shared files were merged while preserving Global-service
scale guidance, session generation/mutex/logout and all original locale values.
Seven shared-seam cases and six direct failure-display cases passed. The static
inventory remains exactly 615 actions (199 baseline 613 + two Catalog form
submits); the package source allowlist is the exact 25-file union. Partial local
ESLint was unavailable in the existing dependency tree; no dependency was installed
or gate lowered. Required release CI must still qualify this candidate.

The mapping associates seven partial-source business groups and 26 source IDs
with this batch; it is not whole-inventory acceptance. Archive, Catalog, roles,
locales/layouts, real lifecycle outcomes and weak-model use require their own
runtime evidence. Earlier unrelated PASS and original failures are retained.
Do not deploy this candidate to production based only on these source checks.

Qualified immutable artifacts

Original CI run 40956022401 and required CodeQL passed.
Producer 03e0d7b25b8dfcbc45baecf6d448834016aac649 and merged/tag source af08a99885012eb8c770a3266a341e8ffd2a17f5 share tree 3ebb0def9e9f1c0c9e412d6c812f79f10df30489.
The original static archive has 124 exact verified files, provenance and CycloneDX
attestations; SHA256 97fe46c426cb83263fcfc7f5884c15ca90f7ec3ebec71d9ca023d8b7ad2665c0. The actual Chromium/Ember
suite passed 1,121 tests with zero failures. The new Catalog/Archive and shared
resource cases, collaboration UI and review-label checks are included in full CI.

Bridge 0.2.2 uses 25 exact producer Git-byte sources, SBOM and manifest (27 entries).
ZIP SHA256 f6c2e4496aaa629925cbfc3217b7bdbfb96d710e9c51899bb8b15d8704c8da7c; SBOM SHA256 dde9f55749b3d5d1d680fe0b334d7b4fb9b3fed10aa59abd4cd4a4cbeba6a723.
Its clean extracted installation passed 47 Catalog/Archive tests and one actual SDK
handshake. This is source/archive qualification, not live 8080 acceptance.
The source and lock dependency graphs retain their previous dependency versions.
Server publication, new live Catalog/Archive/lifecycle outcomes, roles/cross-ID,
localized layouts and weak-model flows remain separate gates. Earlier unrelated
PASS and original failures are preserved; the full frontend task remains open.