Ferrum Foundry v0.5.1

Ferrum Foundry v0.5.1

Published 2026-10-05 at 17:57:15 UTC. Release run 37351255936 succeeded at source 1dc43bd1bbd4c2c89ca14e2a603aa478ab1a0d18: 13 successful jobs and two expected skips in the reusable pre-publication workflow. Both actual architecture publishers, the manifest publisher and GitHub release creation succeeded.

This release pairs Foundry v0.5.1 with published Ferrum Edge v0.9.12 and the unchanged canonical contract scope at contracts-edge-0.9.12. It changes no runtime profile or authority tier.

Qualified pairing

Component	Published identity
Foundry	v0.5.1; source 1dc43bd1bbd4c2c89ca14e2a603aa478ab1a0d18; multi-architecture index sha256:52c76c58958ed20df96c35bd943a500eb00f5a5eb540263dd7dd4e40717f30df
Foundry platform build indexes	linux/amd64 sha256:2d87deac8d2fe7ecfe13018b9a515aaed8fe9ea0a062f5aa7d1d78d28d06e582; linux/arm64 sha256:6ad1083ff6456bd65b909fe69f8ff8160d808da3e65a86a42660723a7db340bb
Ferrum Edge	v0.9.12; ferrumedge/ferrum-edge@sha256:80526b59cbbdc2bfcc8bae9241da4e5395414cf07bf0be4effd4c73c51684ee4; source 0d917701b63ef38210c49df830f48cf0457cbc7d
Edge platform manifests	linux/amd64 sha256:96fda718b2d078090b16ebe06d02bec0b942ca5b8632bb78f5076221db3b6cb6; linux/arm64 sha256:0d3bbf1fb471347711a188b50fdcfe0df444fc7be32256cb9ec6807f338742af
Edge publication	Release run 37298358313, all 20 jobs successful; release 403693646 published 2026-10-05 at 12:33:02 UTC
Foundry qualification	Existing SQLite writable/read-only mode, trusted-proxy starter, viewer/operator/admin, Chromium, Node 22/24 gates, critical journeys and both architecture Container Gates

The unchanged Edge contracts retain ferrum-edge#5661 resource ETag/If-Match
handling and ferrum-edge#5726 proxy-scoped plugin configuration filtering.
Published Edge distribution, binary hashes, OpenAPI identity and registry
verification limits are recorded in compatibility source.
Anonymous GHCR access and an Edge OCI revision label are not claimed.

Source changes

• The browser-facing BFF explicitly refuses the secret-complete
  /deployment-snapshot read for every method and role with
  403 FERRUM_BFF_CREDENTIAL_READ_DENIED, after authentication and before
  capacity admission, JWT signing or upstream fetch. Encoded route components,
  an optional trailing slash and queries cannot bypass the normalized pathname
  check. Ordinary masked reads and ephemeral backup downloads remain supported.
• Starter, development command and current record use the same published Edge
  digest. Package and lockfile root versions are 0.5.1; dependency graph and
  Node floors are unchanged.
• The same 18 contract files are downloaded byte-exact from canonical commit
  31f0a21d707795be293d15837c2f77c3d84219d8, published as release
  403772929 at 2026-10-05 13:58:38 UTC after main Validate contracts run
  37320780987 succeeded. Manifest schema and all 12 fixtures are unchanged.
  Complete canonical invalid expectations include the new deployment entries,
  without adopting their schemas or runtime profile. Shared status remains
  EXISTING/implemented at Alloy owner 81cbb; Alloy stays unpublished.
• Sensitivity provenance names the published Edge source after table review
  and byte equality with c764. Static review of all five guided components is
  complete from verified hosted run 37336969590, attempt 1, artifact
  11356821423, source 0dc21a387367059785c6fbea8c7ced5a55e2af70 and tested
  merge 632a24eb7c5220fd06a6e9fd85d5b5b11308b898. The reviewed schema ref
  adopts the published Edge source; all five hashes, descriptors, catalog,
  templates, secret handling and unmodelled-value preservation are unchanged.
  Schema provenance records
  verified archive/export hashes and review limits. The previous failed
  producer remains historical schema evidence only.

Limits and pending work

PR #548 passed complete root and fresh independent static review. Qualification run 37341678624, attempt 1, passed all eight applicable gates at source 157fa7f478ea8e987104f6adb3cc41baf1efb2e0 and tested merge b01dd9137635739cd453d1e3b507c24ec1aca3e3. Its hosted schema export is artifact 11358382729; all five guided components remain unchanged. Only the qualification record followed that qualified source. Final PR run 37348064470 passed all eight applicable gates; two publication jobs were expected skips.

The protected release merge preserved exact reviewed head 0e47b6b307bca8aa25fe37f54a2224f87d6e1118 as its second parent. Main push CI 37349447989 passed all 11 jobs before the immutable v0.5.1 tag was created. The actual tag release repeated all eight qualification gates successfully. Its two reusable publication jobs require a push to refs/heads/main, so the refs/tags/v0.5.1 release ref made their condition false; the separate actual publishers succeeded.

This pin adoption adds no conditional restore, native deployment workflow,
recovery journal, capability or browser retention guarantee. Existing initial
untagged-write fallback and post-412 refusal remain unchanged; Foundry #542/#544
owner approval and #547 account-level immutability decisions are pending.
The deployment-snapshot refusal does not authorize browser retention of its
original evidence.

No advisory closure or unrelated upstream approval is implied. Edge #6011 is
excluded from v0.9.12. Existing best-effort/unqualified modes, eBPF variants,
real-gateway scale limits and browser limits remain unchanged.

Publication and deployment

The version tag targets the published source above. Both registries contain the same multi-architecture index. The release has no standalone GitHub assets; the distribution is the published container image. Native hosted publisher checks verify the version, source and platform identity. Anonymous GHCR access, independent cryptographic attestation verification and account-level registry immutability are not claimed.

The starter's default :main remains the development channel. Published v0.5.0 and v0.4.0 records remain byte-for-byte immutable; their source, image and CI evidence are historical. Published version tags must never move.

Docker

docker pull ferrumedge/ferrum-foundry:v0.5.1
docker pull ghcr.io/ferrum-edge/ferrum-foundry:v0.5.1

Both tags name the multi-architecture index sha256:52c76c58958ed20df96c35bd943a500eb00f5a5eb540263dd7dd4e40717f30df, built from
commit 1dc43bd1bbd4c2c89ca14e2a603aa478ab1a0d18. Release version tags are never reassigned; pin
the digest for byte-identical deployments:

docker pull ferrumedge/ferrum-foundry@sha256:52c76c58958ed20df96c35bd943a500eb00f5a5eb540263dd7dd4e40717f30df

Production quick start

Run Foundry only behind an identity-aware reverse proxy that removes
client-supplied identity headers and injects the trusted proxy proof:

export FERRUM_JWT_SECRET=$(openssl rand -hex 32)
export FERRUM_TRUSTED_PROXY_SECRET=$(openssl rand -hex 32)

docker run \
  -e FERRUM_ADMIN_URL=https://your-gateway:9443 \
  -e FERRUM_JWT_SECRET \
  -e FERRUM_AUTH_MODE=trusted-proxy \
  -e FERRUM_TRUSTED_PROXY_SECRET \
  -p 127.0.0.1:8080:8080 \
  ferrumedge/ferrum-foundry:v0.5.1

Configure the proxy to send X-Ferrum-Auth-Secret,
X-Forwarded-User, X-Ferrum-Role, and exact
X-Ferrum-Namespaces grants. See
Production authentication.