stack-single 1.1.34

stack-single 1.1.34

The console moves to genaryx-console:v1.1.46, and TokenFuse to v1.14.0 on the gateway, the
OpenAI door, the MCP broker, focus-export and the control plane. This tag carries no other
change. It also corrects one comment in compose.yaml: the note above GENARYX_COPILOT_FUSE_KEY_REF
said the pinned console ignored that reference. It reads it, since genaryx invariant 24, so the
note now says so.

A default install starts nothing new. The OpenAI door is still off unless OPENAI_DOOR=1 is set,
the MCP broker stays out of a default install, and the firewall stays in enforce.

What moves

• genaryx-console v1.1.45 -> v1.1.46 (CONSOLE_IMAGE, the console service at
  compose.yaml:1202 and the verdryx-drift service at compose.yaml:1542, and
  components.json). Index digest
  sha256:54218cfb989f7499da3a92d52d917ef8bc67b938d1b54070ba63e88fdf164bdd (amd64 and arm64).
  The image is built by stack-k8s tag v1.1.46, from the run that finished with success
  (38656056258). The console repository publishes no GitHub release, so the commits it was built
  from are named in the image's source labels and not restated here.
• TokenFuse v1.13.2 -> v1.14.0: the gateway (tokenfuse-gateway, compose.yaml:901), the
  OpenAI door (tokenfuse-gateway-openai, compose.yaml:1089), the MCP broker
  (tokenfuse-mcp-broker, compose.yaml:635), focus-export (compose.yaml:1444) and the
  control plane (tokenfuse-cloud, TOKENFUSE_CLOUD_IMAGE, compose.yaml:868), with
  components.json. Index digests tokenfuse:v1.14.0
sha256:c659d9bb51ce48b1082343d9d19d64cf3ac79fde617ea59bc09720d2a4f87c65 and
  tokenfuse-control-plane:v1.14.0 sha256:673a487da6da8270cabd15d522c5608ba5008e02c0a3972a42e569a112969e77.
  Both list linux/amd64 and linux/arm64. The release is annotated tag 443f399 (PR #444) and
  a published GitHub release with 17 assets, not a draft or a prerelease. Its notes are
  docs/releases/v1.14.0.md at the tag. The points an operator meets:
  • A gateway restarted while its control plane is down answers budget-governed calls
    503 seed_pending until it has read the seed. The TokenFuse notes call this the intended
    refusal, not a fault.
  • A stream carrying a denied tool call ends with the refusal, not with the call.
  • Trace files and FOCUS exports carry new nullable columns (pii_findings, x_price_basis,
    x_pii_findings). Old files keep reading; a reader that selects columns by position must
    read by name.
  • The price book prices openai/ ids at OpenAI's list rate, so a cost charged at the fallback
    rate can change.
  • The TokenFuse upgrade is "replace the image tag with v1.14.0". This tag moves the compose
    image pins to match, and nothing else in the launcher's settings moves.
• The compose comment above GENARYX_COPILOT_FUSE_KEY_REF. The console pinned here reads that
  reference (genaryx invariant 24, crates/api/src/copilot/state.rs at the v1.1.45 source commit
  fd7a1ab). Notes only: nothing runs differently.

No other pin moves. wardryx v1.5.0, idryx v1.2.1, heraldyx v0.6.0, typryx v0.4.1 and
trailryx-node v1.2.1 are unchanged from v1.1.33.

Measured

Read on 2026-10-15 from the registry, the releases and the source checkouts, not copied from the
notes above:

• docker buildx imagetools inspect on genaryx-console:v1.1.46, tokenfuse:v1.14.0 and
  tokenfuse-control-plane:v1.14.0. Each index digest matches the value above, and each lists
  linux/amd64 and linux/arm64.
• gh release view v1.14.0 in TAIPANBOX/tokenfuse: published 2026-10-14T23:28:35Z, not a draft,
  not a prerelease, 17 assets. The tag resolves to 443f399.
• gh run view 38656056258 in TAIPANBOX/stack-k8s: the console image workflow for tag v1.1.46
  completed with success.
• .githooks/pre-push: all 32 checks passed on the release commit, on 2026-10-15.
• scripts/gates-have-teeth.sh on a clean tree of the release commit: OK: 394 cases, exit 0,
  on 2026-10-15.

Upgrading

• No new switch. The launcher writes no TokenFuse switch that was not already accepted. The
  firewall switch is still ${TOKENFUSE_FIREWALL:-enforce}.
• TokenFuse 1.14.0. Its upgrade is the image tag, v1.14.0. The operator-facing points are
  listed under "What moves" above. A gateway restarted while its control plane is down answers
  budget-governed calls 503 seed_pending until the seed is read.
• Console v1.1.46 against v1.1.45. The console changes are the commits in the image's source
  labels, not restated here. This launcher's settings do not move for them.

Not proven

• TokenFuse v1.14.0 in a running stack. No live provider call was made through the new images
  here. The seed gate's restart case was reproduced on one host only, per the TokenFuse notes.
• install.sh with these pins on a box. CI's install legs run it on Ubuntu; it was not run here.
• Console v1.1.46 in a running stack. The image exists and its pin is in place; a stack built
  from this tag has not been run here.
• The seed_pending window has not been measured on a stack built from this tag.