Host API preserves established /v1 and /v2-beta node endpoint paths, proxy-token requests, container event payloads, Docker labels, and generated client schemas.
Preferred settings use platform-* names. Historical cattle-* flags, legacy Docker labels, and established node data paths remain only as API or data contracts. They are not PastureStack branding. The archived generated control-platform client, archived event lock, archived Docker Engine API, and archived global configuration parser are no longer compiled or vendored.
Operator lifecycle messages support en-US and zh-TW. HTTP response bodies, log streams, statistics payloads, Docker output, identifiers, and protocol errors are not translated.
The source package version is 0.38.7, built with Go 1.27.3 on a digest-pinned Ubuntu 26.04 image, a frozen bootstrap package snapshot, and checksum-pinned official security fixes. The final builder inventory records installed versions separately from the bootstrap lock. A published package must retain its reviewed producer revision, byte-identical packaging evidence, and successful security checks of the unpacked binary. Server packaging consumes host-api-0.38.7.tar.gz; its filename, executable layout, architecture, legacy SHA-1 compatibility files, and SHA-256 integrity files are release contracts. Product versions must remain pure numeric MAJOR.MINOR.PATCH values without branding or maintenance suffixes.
The key-audit-v1,key-delegation-v1 backend protocol and endpoint contracts remain unchanged. All non-allowed introspection results still close scoped streams. Confirmed authorization-loss evidence requires either expiry of the previously verified signed grant, or a configured-Engine 401/403 response carrying an allowlisted stable authorization code. Network failures, redirects, outages, malformed or mismatched responses are unknown, never confirmed revocation. Only authorized scoped transport cancellations receive a final recheck, inside the existing seven-second total report budget and without holding the audit mutex. A confirmed denial outranks a later disconnect or cancellation-induced Docker error; a completed success or genuine backend failure and the frozen first terminal record cannot be overwritten. Ordinary JWTs, Full/legacy traces, handshake admission, durable retry and ticket-bound agent/target/Host identities retain their contracts. No publication or native PASS is implied by the source version.
Before release, validate token acquisition, event forwarding, logs, stats, exec, console, Docker socket proxy, container proxy, disabled-proxy behavior, key parsing, and restart behavior.
The control-platform server must begin issuing the dockersocket scope and resource-bound statistics claims before this candidate is deployed. Allow previously issued short-lived tokens to expire, then deploy Host API enforcement. Reversing that order makes existing Docker socket and legacy statistics requests fail closed by design.