catalog: release 0.3.16 with lifecycle-safe network services

README.md

@@ -8,7 +8,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 
 ## Project status
 
-This source tree provides Catalog `v0.3.15`; its GitHub tag and Release determine
+This source tree provides Catalog `v0.3.16`; its GitHub tag and Release determine
 when it is published. It exposes one Native project template and twenty-one
 reviewed infrastructure entries. See [SUPPORTED.md](SUPPORTED.md) for the
 current versions and [catalog-provenance.json](catalog-provenance.json) for
@@ -25,6 +25,12 @@ Officially unfixed Low/Medium findings remain tracked, not resolved; narrowly
 scoped VEX decisions require product-specific evidence and retain the raw scan.
 A clean gate is not a claim that every dependency has zero reported CVEs.
 
+Network Services revision 13 uses NPM `v0.8.25` and Metadata `v0.10.6`.
+Both runtime GitHub Releases report `immutable: false`; the recorded OCI
+manifest digests identify verified content, not a GitHub release lock.
+Metadata106 retains 44 reviewed unfixed raw findings (38 Medium, 6 Low),
+tracked separately from publication and environment acceptance.
+
 Catalog validation covers template structure, retained versions, Traditional
 Chinese labels, exact image references and Catalog Service API lookups. CI uses
 Python `3.14.9`, hash-locked dependencies, the explicitly downstream

SUPPORTED.md

@@ -13,7 +13,7 @@ or out-of-scope templates from being presented as deployable software.
 | PastureStack System Image Preloader | Infrastructure image-cache service | v0.3.2 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
 | PastureStack Amazon ECR Credential Sync | Infrastructure registry service | v3.1.6 | Public PastureStack GHCR image with an explicit version tag | Published component; full runtime raw scan has zero findings; Catalog integration and environment acceptance remain distinct |
 | Metadata Healthcheck | Infrastructure stack | v0.3.17 | Public PastureStack GHCR image with a non-overwritten version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
-| PastureStack Network Services | Infrastructure system stack | v0.3.10 | Network Plugin Manager v0.8.24; Metadata Service v0.10.5 and Internal DNS v0.17.13 unchanged from revision 11 | Exact publication evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack Network Services | Infrastructure system stack | v0.3.11 | Network Plugin Manager v0.8.25; Metadata Service v0.10.6; Internal DNS v0.17.13 unchanged from revision 12 | OCI digest/SBOM evidence is in catalog-images.json; both runtime GitHub Releases report immutable=false, not locked; Metadata106 retains 44 reviewed unfixed Low/Medium raw findings; environment upgrade/rollback remains separate |
 | PastureStack Network Diagnostics | Infrastructure diagnostics service | v0.2.2 | Two public PastureStack GHCR images with explicit version tags | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
 | PastureStack Network Policy Manager | Infrastructure network-policy agent | v0.3.4 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
 | PastureStack IPsec Overlay | Infrastructure network driver | v0.3.11 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
@@ -418,6 +418,12 @@ release blockers.
 
 ## PastureStack Network Services evidence
 
+The current directory is `13` (`v0.3.11`), using NPM `v0.8.25`, Metadata
+`v0.10.6`, and the retained DNS `v0.17.13`. Exact new identities and raw scan
+counts are recorded above and in `catalog-images.json`; GitHub release
+`immutable=false` is distinct from the recorded OCI digest. The directory
+`9`/`10` evidence below is historical and is not acceptance of directory `13`.
+
 Directory `10` is the Network Services `v0.3.8` candidate and changes only
 Network Plugin Manager to published `v0.8.22` for legacy/current CNI configuration
 convergence. Metadata Service `v0.9.11`, Internal DNS `v0.17.11`, every Catalog

catalog-images.json

@@ -1139,6 +1139,45 @@
         "workflowRun": "https://github.com/PastureStack/metadata-service/actions/runs/39959381046"
       }
     },
+    {
+      "sourceRepository": "https://github.com/PastureStack/metadata-service",
+      "sourcePath": "package/Dockerfile",
+      "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/metadata-service",
+      "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu and other packages retain their upstream licenses and notices",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "reference": "ghcr.io/pasturestack/metadata-service:v0.10.6",
+      "sourceCommit": "3db2e1cd53530a04282f5c2448426334ea4d92a8",
+      "manifestDigest": "sha256:88267d800365d354f06519014a3e4f7ce967d05d4805e5a705944980e30449ff",
+      "reviewedAt": "2026-10-24",
+      "vulnerabilityScan": {
+        "scope": "published runtime image; complete severity raw report",
+        "rawFindings": 44,
+        "high": 0,
+        "critical": 0,
+        "low": 6,
+        "medium": 38,
+        "unknown": 0,
+        "secrets": 0,
+        "fixedAvailable": 0,
+        "reviewedUnfixedOccurrences": 44,
+        "evidence": "https://github.com/PastureStack/metadata-service/actions/runs/40016315561"
+      },
+      "publicationVerification": {
+        "source": "component owner verified anonymous manifest/config readback and OCI SLSA provenance",
+        "workflowRun": "https://github.com/PastureStack/metadata-service/actions/runs/40016315561",
+        "sourceCommit": "3db2e1cd53530a04282f5c2448426334ea4d92a8",
+        "anonymousReadback": true,
+        "githubReleaseImmutable": false,
+        "provenancePredicateType": "https://slsa.dev/provenance/v1"
+      },
+      "sbom": {
+        "format": "CycloneDX",
+        "sha256": "35fd5be38787438350e0eeea87eaf2eab6e64575fef895103c44570523e5db4a",
+        "url": "https://github.com/PastureStack/metadata-service/releases/download/v0.10.6/image.cdx.json"
+      }
+    },
     {
       "sourceRepository": "https://github.com/PastureStack/internal-dns",
       "sourcePath": "package/linux/amd64/Dockerfile",
@@ -1494,6 +1533,44 @@
         "sha256": "64605ff6d32f9f6b7c3bf20185d2cefead78b0e79b8395e3bc4523594e9af88b",
         "url": "https://github.com/PastureStack/network-plugin-manager/releases/download/v0.8.24/network-plugin-manager-0.8.24-image.cdx.json"
       }
+    },
+    {
+      "sourceRepository": "https://github.com/PastureStack/network-plugin-manager",
+      "sourcePath": "package/Dockerfile",
+      "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/network-plugin-manager",
+      "licenseBoundary": "Apache-2.0 source and image; bundled Alpine, Docker CLI, and other packages retain their upstream licenses and notices",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "reference": "ghcr.io/pasturestack/network-plugin-manager:v0.8.25",
+      "sourceCommit": "461182e1fcd09527509359f5c551704303689c04",
+      "manifestDigest": "sha256:9a66894138dc6dded756c5e4b80e6d235698d911031641f6c45763ad9b32d94e",
+      "reviewedAt": "2026-10-24",
+      "vulnerabilityScan": {
+        "scope": "published runtime image; complete severity gate",
+        "high": 0,
+        "critical": 0,
+        "low": 0,
+        "medium": 0,
+        "unknown": 0,
+        "secrets": 0,
+        "fixedAvailable": 0,
+        "actionable": 0,
+        "evidence": "https://github.com/PastureStack/network-plugin-manager/actions/runs/40013313015"
+      },
+      "publicationVerification": {
+        "source": "component owner verified anonymous manifest/config readback and SLSA provenance for the OCI image and image-SBOM file",
+        "workflowRun": "https://github.com/PastureStack/network-plugin-manager/actions/runs/40013313015",
+        "sourceCommit": "461182e1fcd09527509359f5c551704303689c04",
+        "anonymousReadback": true,
+        "githubReleaseImmutable": false,
+        "provenancePredicateType": "https://slsa.dev/provenance/v1"
+      },
+      "sbom": {
+        "format": "CycloneDX",
+        "sha256": "91f7cce56e1755e9625e2c6bfd0c6f0c9f73d9158b887037520abca7930186b2",
+        "url": "https://github.com/PastureStack/network-plugin-manager/releases/download/v0.8.25/network-plugin-manager-0.8.25-image.cdx.json"
+      }
     }
   ]
 }

infra-templates/network-services/13/README.md

@@ -0,0 +1,64 @@
+<!-- SPDX-License-Identifier: MIT -->
+
+# PastureStack Network Services
+
+Version 13 (visible version `v0.3.11`) uses the published Network Plugin Manager `v0.8.25`, Metadata Service `v0.10.6`, and Internal DNS `v0.17.13`. This dependency update retains version 12's firewall ownership, CNI convergence, Catalog questions, sidekicks and shared volumes. Earlier numeric revisions remain unchanged. Published source, image digests and runtime scan evidence are recorded in `catalog-images.json`.
+
+The NPM25 and Metadata106 GitHub Releases report `immutable: false`; recorded OCI manifest digests and SBOM SHA256 values identify the verified content, not a GitHub release lock. Metadata106's full raw report retains 44 reviewed unfixed findings (38 Medium and 6 Low), not zero findings. Metadata106 preserves the platform's opaque `revision-hash` change tokens so existing long-poll clients observe updates without a protocol change.
+
+## CNI configuration convergence
+
+The manager preflights all desired CNI configurations and writes each through an atomic replacement with mode `0600`. Only after every desired configuration has been written successfully may it retire an obsolete platform configuration. The historical `10-rancher.conf` must have the exact name/type/IPAM triplet `rancher-cni-network` / `rancher-bridge` / `rancher-cni-ipam`; the current `10-pasturestack.conf` must have `pasturestack-cni-network` / `pasture-bridge` / `metadata-cni-ipam`. The same ownership check applies when the selected provider requires the historical configuration again.
+
+Retirement renames the obsolete file with a `.pasturestack-retired` suffix, preserving its original bytes outside the CNI `.conf` / `.json` execution set. An existing retirement backup must be byte-identical; a conflicting backup causes an error. Unrelated administrator configurations are preserved. Malformed or partially matching platform configurations, symlinks, and unsafe metadata paths cause an explicit error. The manager never sweeps the configuration directory or removes CNI binary aliases as part of this migration.
+
+Each component is a published security rebuild. Full-severity evidence is recorded separately from deployment acceptance; publication does not establish that an existing infrastructure stack has completed its managed upgrade.
+
+## Provider and lifecycle convergence
+
+The manager selects one eligible CNI provider per binary from the infrastructure-service metadata on the local host. The highest numeric OCI image version wins; an unversioned or nonnumeric development label cannot replace a numeric release, and ties use a deterministic immutable container-ID ordering. The generated wrapper stays bound to that exact provider and does not relist containers by service label at invocation time. It executes the provider's private `/opt/cni/bin` copy with a bounded compatibility fallback for older images. Wrapper replacement uses an exclusive temporary inode and atomic rename; content, file type, and mode drift are repaired without following a replacement symlink.
+
+When platform metadata temporarily reports a host-port container before its primary address, the manager may read the exact running container's network namespace. It accepts only one IPv4 address inside that network's configured managed subnet and revalidates the same Docker container PID after the namespace read. Missing, ambiguous, out-of-subnet, or lifecycle-raced results fail closed and retain the last known-good host-port rules until metadata and CNI converge.
+
+## Firewall backend
+
+`FIREWALL_BACKEND` defaults to `auto`. It reads Docker's actual firewall driver: Docker's native `nftables` driver uses native nft rules, while Docker's `iptables` driver selects the frontend that owns Docker's active NAT chain. That may be `iptables-nft` or `iptables-legacy` on **any supported host**, including Ubuntu 26.04 and later. The OS release, installed executable, or unloaded kernel module alone never selects a backend. To pin one path, choose:
+
+- `nftables`: Docker's native nftables firewall backend. This is **not** the same as the iptables-nft compatibility CLI.
+- `iptables-nft`: xtables compatibility CLI backed by nf_tables, for Docker's iptables firewall driver.
+- `iptables-legacy`: legacy xtables, only when the running Docker daemon actually owns the active rules through that frontend.
+
+The manager refuses a mismatched or ambiguous selection and does not fall back, switch Docker's backend, or load legacy modules. An Ubuntu 26.04+ host already using `iptables-legacy` or `iptables-nft` must keep its live Docker path; do not turn on native nftables merely because the OS is new. A deliberate migration requires a separate host change, rollback point, and network lifecycle test.
+
+This manager alone owns the host NAT and host-port `CATTLE_*` chains. Its
+masquerade rules exclude destinations inside the managed overlay subnet in
+all three backends; the IPsec host-XFRM router must not patch these chains.
+For the per-host-subnet driver, the manager also excludes other active hosts'
+validated subnets from masquerade and adds a bounded forwarding exception.
+Inactive registrations are ignored; missing or overlapping labels on an active
+host fail closed. This is a routed, unencrypted network; protect the host
+transport separately.
+Upgrade Network Services first and verify manager health on every host before
+upgrading the matching IPsec Overlay version.
+
+Shared-subnet ingress is enabled only when CNI metadata explicitly sets
+`allowSharedSubnetIngress: true`, or for the legacy fixed-subnet contract that
+already declares both `bridgeSubnet` and `hostNat: true`. It is rejected for
+host-label-based subnets, where only validated active peer ranges are trusted.
+
+For Docker's native nftables driver, configure Docker itself with `"firewall-backend": "nftables"` and `"bridge-accept-fwmark": "0x1068/0x1068"` before upgrading this stack. Persist `net.ipv4.ip_forward=1` on the host and verify it remains enabled after a reboot: Docker's native nftables backend does not enable IPv4 forwarding for you. The mark allows Docker's bridge forwarding rules to accept the manager's published-host-port traffic; the template cannot configure the host daemon or kernel settings. Check and explicitly migrate any stale `iptables-nft` `FORWARD DROP` policy or previous platform hooks before switching Docker. The manager refuses that mixed state rather than changing the host's global firewall policy. Docker's native nftables backend remains an experimental Docker feature; qualify it against the installed Docker release before production use.
+
+## Other configuration
+
+- `DOCKER_BRIDGE`: host bridge for managed workload traffic.
+- `DNS_RECURSER_TIMEOUT`, `TTL`: upstream DNS timeout and service-discovery cache time.
+- `CPU_PERIOD`, `CPU_QUOTA`: Metadata Service CPU scheduling limits.
+- `RELOAD_INTERVAL_LIMIT`, `ARP_SYNC_INTERVAL`: metadata reload and host ARP reconciliation intervals.
+
+Network Plugin Manager still requires host networking, host PID visibility, the Docker socket, Docker state, kernel-module and runtime mounts, and the shared CNI volume. Metadata Service starts as root only to assign its link-local address, then drops to UID/GID 10001. Internal DNS shares its namespace. The `rancher-compose.yml` filename, `io.rancher.*` labels, `CATTLE_*` fallback variables, `/var/lib/rancher` CA path, and `rancher-cni-driver` volume are compatibility contracts, not a request to use legacy firewall rules.
+
+These template files are MIT-licensed. The manager, metadata service, and internal DNS retain their Apache-2.0 licenses and bundled dependency notices. Verify image source and the recorded manifest digest in `catalog-images.json` before deployment.
+
+Metadata and DNS are managed by the Server lifecycle. The manager no longer removes overlapping instances during upgrades and remains unready while waiting for Metadata recovery. Verify service health before completing an upgrade; image publication alone is not runtime acceptance.
+
+Driver stop/start events and periodic reconciliation refresh the selected provider. Only eligible running local providers with a live process ID can be selected. Temporary metadata or Docker inspection failures remain visible and are retried; an unrelated unavailable driver does not block a healthy provider for another binary. No host firewall mode or administrator configuration is changed by provider selection.