stack-single 1.4.4

stack-single 1.4.4

A patch that moves seven images to newer releases: TokenFuse 1.20.1 to 1.20.3, the console 1.7.0 to 1.7.3, the caddy and tunnel images to 1.7.3, the trailryx-node record seal from 1.4.0 to 1.5.0, and the chain verifier (agent-conform) from 2.0.1 to 2.0.2. The console and the tunnel are built on Go 1.27.3, which fixes GO-2026-6809 in crypto/x509. agent-conform is rebuilt for the same fix.

Upgrade first

1. Run ./install.sh again from this release. A box with its own operator files names them as before (CLIENT_KEYS_FILE=... IDENTITY_MAP_FILE=...). The installer checks each new image's signature, pulls it by digest and recreates the services whose image changed. Nothing else needs to be set.
2. TokenFuse 1.20.2, included in 1.20.3, prices gpt-6.1-terra at its own row. Until now the model had no row, so each call was estimated and recorded at the fallback price of 15 USD (input) and 75 USD (output) per million tokens. It is now priced at OpenAI's Standard list, about a fifteenth of that. Budgets for that model burn that much more slowly, and the x-fuse-price response header no longer says fallback for it. Nothing to configure. A row for the model in TOKENFUSE_PRICE_BOOK still wins over the built-in row; this launcher does not set that variable.
3. Agent tokens are on by default, so a default box writes a new high event. The default is TOKENFUSE_AGENT_TOKENS='require'. TokenFuse 1.20.3 now writes an identity_mismatch event (severity high) to the bus for a call with an unknown client key (reason unknown_key, with a sha256: fingerprint of 16 hex digits, never the key) and for a call with no key (reason missing_key), where it wrote nothing before. A known key that the static list does not name is still refused and still not reported. The client gets the same answer as before. An alert on high identity_mismatch events will see these on a box that had none. The volume is bounded at one event per source per minute, and sixty a minute for the gateway.
4. trailryx 1.5.0 changes nothing on a stock install. The seal signs only when TRAILRYX_SIGNER is set, and this launcher does not set it, so the record seal runs as before. A node with TRAILRYX_SIGNER=keyryx and no TRAILRYX_KEYRYX_KID now refuses to start. That variable is the RFC 7638 thumbprint, 43 base64url characters, of the Keyryx key the seal signs under. Each Keyryx signature is also checked before it is stored: one that does not verify leaves its root queued, and a pack built while the root is queued says it is unsigned. This applies only to a box whose operator has set the Keyryx signer by hand, since this launcher does not wire it.
5. The console, the tunnel and agent-conform have no operator-visible change recorded for this release. Their change is the Go 1.27.3 base.

What changed

Image	1.4.3	1.4.4
tokenfuse (MCP broker, gateway, OpenAI gateway, FOCUS export)	v1.20.1	v1.20.3
tokenfuse-control-plane	v1.20.1	v1.20.3
genaryx-console	v1.7.0	v1.7.3
stack-caddy	v1.1.48	v1.7.3
stack-wg (tunnel)	v1.1.48	v1.7.3
trailryx-node (record seal)	v1.4.0	v1.5.0
agent-conform (chain verifier)	v2.0.1	v2.0.2

Each is pinned by tag and digest in compose.yaml and components.json:

• tokenfuse sha256:2b82c87733a8165922f8f6c737a1d19bc0e0156335e88db6c190b17cc2a4a484
• tokenfuse-control-plane sha256:64b9476edeced2c4436d4a5f5bfcbb78b0217f1d85c75af4ec045e21475fe07e
• genaryx-console sha256:0db4758c9f3dd2231184063af4f80bce491480f6d7238c02bcbac83abb8d708a
• stack-caddy sha256:41d37fc74013bf5b0c64a41acc5bbc9fb0af3de7dfeb69787e54f028118b05b7
• stack-wg sha256:1c70d34197586768164fa8bc3a220a4978bef48351023db318a3053dc8eed7a2
• trailryx-node sha256:f15215cd9708724e83fbd8493f2bf7d2a11980b37edf3b887081d8e17da18bab
• agent-conform sha256:65c0c1ef78effe96f09c5684a203616fed396375e182bedb142a5beaa178b713

The installer reads these from compose.yaml (docker compose config --images), so install.sh names none of them and needs no change. The image-verify fixtures, the teeth cases that plant faults next to these pins, and the README and CLAUDE.md lines that name the console and TokenFuse versions follow them.

What the upstream releases changed:

• TokenFuse 1.20.2 (its pull requests #484 to #489): zstd-sys moves to 2.1.2 for RUSTSEC-2026-0410. RUSTSEC-2026-0391 and RUSTSEC-2026-0403 stay as a recorded, temporary exception in TokenFuse's own audit, and its audit script fails once the exit condition is met: DataFusion 56, or any release that takes parquet and arrow-ipc 60.
• TokenFuse 1.20.3 (its pull requests #491 and #492): with TOKENFUSE_AGENT_TOKENS=require, a call with an unknown client key, or with no key, is now written to the event bus as an identity_mismatch event (high), with a fingerprint and never the key. The client's answer is unchanged.
• trailryx-node 1.5.0 (its pull requests #112 and #113): the Keyryx signer signs under one pinned key and checks each signature. No record, journal, pack or wire format changes, and the frozen section of COMPATIBILITY.md is unchanged.

Checked locally

• Each new digest was read from the registry with docker buildx imagetools inspect on 2026-10-28. Each index digest equals the value pinned above.
• Each new image has its cosign signature tag (sha256-<digest>.sig) in the registry. The signature identity is checked by the installer's cosign run, which the CI install job exercises.
• The provenance of genaryx-console v1.7.3 and stack-wg v1.7.3 names golang:1.27.3-alpine.
• The tokenfuse and tokenfuse-control-plane v1.20.3 index digests were read the same way, and their signature tags are present.
• The agent-conform v2.0.2 index digest was read the same way and matches the pinned one, and its signature tag is present in the registry.
• git grep finds no old tag or digest outside docs/releases/.
• 49 of the 54 gates in .github/workflows/gates.yml (every one except gates-have-teeth, which is listed under Not measured) pass on this Mac, including the new no-key-in-a-message gate. Five need tools it does not have running: shellcheck (shell-lint) and a Docker daemon (broker-blocks-raw-secrets, identity-files-are-checked, metered-doors-require-keys, openai-door). CI runs them.

Not measured

• No box was installed or upgraded with these pins. The forge upgrade follows separately.
• cosign was not run on the new images here, since cosign is not installed on this machine.
• agent-conform v2.0.2: its provenance names the Go base by digest (sha256:f20d83a8...), which did not match the golang:1.27.3 or golang:1.27.3-alpine tags when checked on 2026-10-28. The Go 1.27.3 build is therefore not confirmed here, and the agent-stack-go v2.0.2 release notes were not read.
• The console 1.7.x and the caddy and tunnel 1.7.3 release notes were not read beyond the provenance check.
• TokenFuse 1.20.3's new bus event has not been run live. Upstream measured the refusal on a v1.20.1 gateway on 2026-10-28 and says the fix itself has not run live yet.
• TokenFuse 1.20.2 was not run against a live OpenAI response. Its gpt-6.1-terra price is proven by unit tests and the regenerated contract, not by a recorded call.
• trailryx 1.5.0 was not run against a live Keyryx. Its tests use a stub.
• The full gates-have-teeth.sh run on this Mac was not clean: a baseline cache directory went missing during the run, and the gates that need Docker or shellcheck are red here. CI is the run of record for it.
• No stack-single release is cut by this change. The tag goes on the merge commit when it is cut.