Web Console 1.6.202 / bridge 0.2.4

Web Console 1.6.202 / bridge 0.2.4

Required component CI, CodeQL and original artifact qualification passed. Server
assembly and designated live browser, role, cross-ID and weak-model acceptance
remain separate pending gates. This release does not complete the full frontend
inventory, all 243 baseline business groups, or discovered operation overlays.

The twelve shared typed tools now support human-approved Certificate name and
description updates. PEM material, private keys, chains, issuance, renewal and
removal remain in the normal human Certificate UI. The selected opaque resource,
current role and original Key permissions, revision, human confirmation and CAS
still govern preview and apply. No direct raw mutation route is added. Normal
UI/session, Full Key and legacy API behavior are preserved; opt-ins default off.
Engine 0.183.361 and the matching audit broker are required for the matching
runtime workflows. Their publication and new Server assembly are separate gates.

Qualified original artifacts

CI run 41003203117 and
CodeQL run 41003203936 passed.
The CodeQL alert aggregator reports success, no new alerts and zero annotations.
Producer 3350a566b77c46ccf3686975bdcc8d9c14ee2985 and merged/tag source
1b426175a55fd63260466cacd02e962e1bd44f8f share tree 9a0b35f5e43014e61c7c2f1796818bbf31975a70.
The original archive contains 124 exact manifest-verified files with native
GitHub provenance and runtime-SBOM attestations. Archive SHA256:
333bca5f68e128423bf398cd2b8e72ccf05f96e02bcde7260b84a09b09601ac6.

This run's original logs record 1,121 Chromium/Ember tests with 0 failures,
and 4 new Certificate metadata cases, each matched by its exact source name.
The existing 21 External/Alias/Audit cases are verified from this same CI log;
they are not renamed as new Certificate cases. Separate shared, UI, contract and
builder invocations are not summed into a unique-case total. Runtime SBOM
coverage retains its explicit incomplete boundaries.

Bridge 0.2.4 contains 34 exact producer Git-byte sources plus standalone
SBOM and manifest (36 entries). The fresh ZIP's clean Node 24.22.1/npm 12.0.2
ignore-scripts install passed 4 Certificate cases and
1 real local SDK stdio handshake. Prior 21/47 unrelated local cases were not rerun.
ZIP SHA256 b42a06c29b5f81087c1293f9f1872068bdd27029690644d4372d0232138a876a;
SBOM SHA256 749e940476c02bde28388eaabe8fe8014ae3adb1a1c02b948e320f81bd0918f5.
Its 92 dependency components and dependency graph remain equal to 0.2.3 except
the root version. Identical source and SBOM bytes reproduce the identical ZIP.
The public bridge proof keeps the existing pasturestack-bridge-release-proof-v1
qualification-summary dialect; it is not a native SLSA provenance attestation.
No new CVE scan or live-platform acceptance is claimed. Earlier PASS evidence,
original failures and pending runtime limits remain preserved.