Release backend-aware network catalog 0.3.12

COMPATIBILITY.md

@@ -31,6 +31,26 @@ The `PastureStack IPsec Overlay` release candidate keeps the literal `rancher-co
 
 The `PastureStack Network Services` release candidate keeps the same catalog filename and version gate, required `io.rancher.*` orchestration labels, `CATTLE_*` credential fallbacks, `/var/lib/rancher` CA path, and `rancher-cni-driver` shared volume. These values are produced or consumed by the compatible control plane and existing host-network contract. Public service names, image coordinates, executables, primary environment variables, and user-facing metadata use PastureStack-neutral identifiers.
 
+Fixed-subnet IPsec and VXLAN CNI revisions explicitly set
+`allowSharedSubnetIngress: true`. Network Plugin Manager alone consumes that
+metadata and owns the bounded host-forwarding rule: both addresses must be
+inside the configured shared subnet and the output interface must be the exact
+managed bridge. Host-label-based per-host subnets cannot enable this path and
+continue to trust only validated active peer ranges. IPsec owns XFRM and
+routes; VXLAN owns its data-plane namespace; neither may patch the manager's
+host firewall chains merely to make an integration test pass.
+
+Host firewall selection follows the installed system instead of rewriting it.
+In `auto` mode, Network Plugin Manager distinguishes Docker's native nftables
+backend from the iptables compatibility backend, then resolves the host's
+active iptables implementation as iptables-nft or iptables-legacy. It does not
+change `update-alternatives`, load a legacy kernel module, create rules in an
+inactive backend, or silently fall back after an error. An explicit backend
+answer is accepted only when it matches the detected host and Docker rule
+owner; a mismatch fails closed before existing hooks are replaced. This is the
+same contract on Ubuntu 26.04 and later: a newer operating system is not enough
+reason to override an operator's existing firewall choice.
+
 The `PastureStack Network Diagnostics` release candidate keeps only the
 catalog filename, version gate, and global scheduling label required by the
 compatible control plane. Its images, services, variables, persisted volume,

README.md

@@ -10,7 +10,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 
 Earlier prerelease coordinates are retired from current release references;
 their reviewed source commits remain in Git history. This source tree targets
-the pure numeric coordinate `v0.3.11`; the GitHub tag and Release, rather than
+the pure numeric coordinate `v0.3.12`; the GitHub tag and Release, rather than
 this README, determine when it is published. Product identity is carried by
 the repository, catalog metadata, and provenance rather than the version tag.
 
@@ -68,15 +68,24 @@ health-reporting, and encrypted-workload gates. The scheduler passed source,
 build, security, public distribution, live Metadata, idempotent reservation,
 managed allocation, and restart gates. Version `v0.8.15` additionally remained
 healthy through repeated Metadata long-poll windows in production without a
-second container start. Network Services version `7` moves to `v0.8.19`,
+second container start. Network Services version `9` moves to `v0.8.21`,
+keeps the host's actual Docker firewall path, and adds deterministic CNI
+provider selection, exact immutable-container wrapper binding, symlink-safe
+atomic wrapper repair, and a managed-subnet fallback for the short interval
+before Metadata reports a new container address. The fallback accepts exactly
+one address from the selected running container and revalidates its PID before
+installing host-port rules; ambiguity preserves the last known-good rules.
+Version `8` introduced the `v0.8.20` forwarding contract that
 rejects malformed per-host subnet labels before applying host firewall rules,
 and preserves routed container source IPs between validated active peers. It
-also fixes bidirectional VXLAN traffic when published host ports coexist with
-the overlay, binds forwarding rules to the exact managed bridge, and protects
-bridge traffic from `route_localnet` loopback routing while preserving and
-restoring the operator's original per-bridge setting. Layer 2 Flat Network
-version `4` moves to `v0.14.36` so the CNI
-preserves an operator-configured bridge address.
+also restores bounded inbound forwarding for fixed shared overlay subnets,
+binds every forwarding rule to the exact configured subnet and managed bridge,
+and protects bridge traffic from `route_localnet` loopback routing while
+preserving and restoring the operator's original per-bridge setting. Layer 2
+Flat Network version `6` moves to `v0.14.37`. Its Flat IPAM keeps an explicitly
+configured host bridge address, but when `bridgeSubnet` is a network prefix it
+deterministically selects the first usable address only if that address is
+actually present. Ambiguous multi-address bridges still fail closed.
 Restored-data provisioning, complete multi-host
 scheduler lifecycle, and complete project-template upgrade and rollback remain
 release-candidate gates. The two alternative network drivers passed packaged
@@ -88,7 +97,7 @@ isolated Ubuntu 26.04.1 / Docker 29.8 hosts, the source-equivalent candidate
 passed bidirectional workload ping and TCP, service DNS, egress, a published
 host port, Docker restart, and both host reboots. The peer was explicitly
 tested with native nftables, iptables-nft, and iptables-legacy, then restored
-to its original iptables-legacy configuration. This does not qualify every
+to its pre-test firewall frontend. This does not qualify every
 existing deployment's upgrade or rollback path. The
 alternative drivers are not installed automatically by the project template.
 
@@ -131,6 +140,13 @@ firewall ownership or backend selection. The image digest is recorded in
 `catalog-images.json`; live Catalog activation and two-host lifecycle remain
 separate acceptance gates.
 
+IPsec Overlay version `11` and VXLAN Overlay Network version `5` explicitly
+declare the fixed shared-subnet ingress contract consumed by Network Plugin
+Manager `v0.8.20`. The rule is limited to traffic whose source and destination
+are both inside the configured `10.42.0.0/16` subnet and whose output interface
+is the exact managed bridge. Overlay routers retain their existing data-plane
+responsibilities and do not take ownership of host firewall chains.
+
 Deployable Compose files use semantic version tags only. A published version
 tag must never be replaced. Manifest digests remain release-verification
 evidence and are not inserted into Catalog, Compose, API, or user-interface
@@ -154,7 +170,7 @@ corresponding current definition. Historical definitions are restored exactly
 from reviewed immutable source snapshots; their original commits and contents
 remain available in Git history without making prerelease tag names part of the
 current operator workflow. Taiwan Traditional Chinese readmes are added without
-changing those workload definitions. The integration gate is configured to resolve all 26
+changing those workload definitions. The integration gate is configured to resolve all 27
 retained and current version IDs through Catalog Service
 so an existing stack cannot regress to a version-detail 404.
 

SUPPORTED.md

@@ -13,7 +13,7 @@ or out-of-scope templates from being presented as deployable software.
 | PastureStack System Image Preloader | Infrastructure image-cache service | v0.3.0 | Public PastureStack GHCR image with an explicit version tag | Mock compatibility API discovery, real Docker pull/cache lifecycle, anonymous distribution, and HIGH/CRITICAL scan passed |
 | PastureStack Amazon ECR Credential Sync | Infrastructure registry service | v3.1.0 | Public PastureStack GHCR image with an explicit version tag | Source tests, anonymous distribution, and credential lifecycle gates passed |
 | Metadata Healthcheck | Infrastructure stack | v0.3.16 | Public PastureStack GHCR image with a non-overwritten version tag | Link-local Metadata integration and stdout/stderr routing passed; production rolling upgrade pending |
-| PastureStack Network Services | Infrastructure system stack | v0.3.2 candidate | Network Plugin Manager v0.8.13 published; official manifest digest, source revision, and release scan recorded; Metadata Service and Internal DNS unchanged | Earlier isolated native-nft VM gates passed; the official image still requires formal multi-host lifecycle verification before catalog publication |
+| PastureStack Network Services | Infrastructure system stack | v0.3.7 candidate | Network Plugin Manager v0.8.21; Metadata Service and Internal DNS unchanged | Two-host Ubuntu 26.04 gates passed native nftables, iptables-nft, and iptables-legacy across all four supported Linux network drivers; the exact official image and both host reboots passed; Catalog activation and removal remain release gates |
 | PastureStack Network Diagnostics | Infrastructure diagnostics service | v0.2.1 | Two public PastureStack GHCR images with explicit version tags | Reproducible builds, anonymous distribution, full snapshot and bundle lifecycle, persistence, localization, and HIGH/CRITICAL scan passed |
 | PastureStack Network Policy Manager | Infrastructure network-policy agent | v0.3.2 | Public PastureStack GHCR image with an explicit version tag | Five consecutive two-host default-deny, directed TCP allow, rollback, cleanup, and zero-restart gates passed |
 | PastureStack IPsec Overlay | Infrastructure network driver | v0.3.2 candidate | v0.14.27 published and manifest digest locked | Isolated VM two-container XFRM and encrypted-packet check passed; formal two-host control-plane lifecycle pending |
@@ -405,35 +405,43 @@ release blockers.
 
 ## PastureStack Network Services evidence
 
-- Network Plugin Manager: `ghcr.io/pasturestack/network-plugin-manager:v0.6.34`
-- Network Plugin Manager source: [`PastureStack/network-plugin-manager@b4b61856d38a9410319688144ff635868571e35f`](https://github.com/PastureStack/network-plugin-manager/tree/b4b61856d38a9410319688144ff635868571e35f)
+- Network Plugin Manager: `ghcr.io/pasturestack/network-plugin-manager:v0.8.21`
+- Network Plugin Manager manifest: `sha256:aab4c05b0801feeca40fa9cb82a52fbfbfe506c609d3df2024fbc07ef4b968e9`
+- Network Plugin Manager source: [`PastureStack/network-plugin-manager@2f2418423022264695f90960f4a80b9d20c5826f`](https://github.com/PastureStack/network-plugin-manager/tree/2f2418423022264695f90960f4a80b9d20c5826f)
 - Metadata Service: `ghcr.io/pasturestack/metadata-service:v0.9.11`
 - Metadata Service source: [`PastureStack/metadata-service@2096eb100a6c900ab70a952483306965c2278fe9`](https://github.com/PastureStack/metadata-service/tree/2096eb100a6c900ab70a952483306965c2278fe9)
 - Internal DNS: `ghcr.io/pasturestack/internal-dns:v0.17.11`
 - Internal DNS source: [`PastureStack/internal-dns@5459f857cb7ead00888e900d77e4dc713107fef1`](https://github.com/PastureStack/internal-dns/tree/5459f857cb7ead00888e900d77e4dc713107fef1)
 - License: Apache-2.0 for each project; Ubuntu, Docker CLI, and bundled packages retain their upstream licenses and notices
-- Reviewed: 2026-07-23
-- Vulnerability gate: all three releases report 0 HIGH and 0 CRITICAL findings with Trivy 0.70.0
-
-This is a privileged release candidate. On isolated hosts, credential delivery,
-per-host scheduling, CNI installation, Metadata and DNS access, control-plane
-return traffic, NAT reconciliation, restart, and health reporting passed
-together with Metadata Healthcheck and IPsec Overlay. Multi-host upgrade,
-rollback, and complete infrastructure-stack removal remain required before
-production approval.
-
-The new Network Services `v0.3.2` definition in directory `4` is not yet
-published as a deployable release. It selects one host firewall backend and
-references published Network Plugin Manager `v0.8.13`; its official manifest
-digest, merged source revision, and runtime-image release scan are recorded in
-`catalog-images.json`. Metadata
-Service and Internal DNS are unchanged from directory `3`. The 2026-07-23
-evidence above applies to the earlier released image and must not be presented
-as host lifecycle validation of `v0.8.13`.
-An isolated VM using Docker native nftables has since passed backend detection,
-both watcher readiness checks, host-NAT egress, DNS, HTTPS, and same-bridge and
-cross-bridge host-port checks before and after reboot. This does not replace a
-formal two-host control-plane create, upgrade, rollback, and coexistence gate.
+- Reviewed: 2026-09-14
+- Vulnerability gate: Network Plugin Manager source, binary, and image report 0 detected vulnerabilities and 0 image/source secrets with Trivy 0.74.0; govulncheck, CodeQL, race tests, reproducible build, SBOM, checksums, and provenance attestation passed
+
+Directory `9` is the Network Services `v0.3.7` candidate. It follows Docker's
+active native nftables, iptables-nft, or iptables-legacy path without switching
+the host, loading legacy modules, or writing both backends. Network Plugin
+Manager alone owns host NAT, forwarding marks, and host-port `CATTLE_*` chains;
+the IPsec, VXLAN, per-host-subnet, and Flat providers retain only their own
+data-plane responsibilities.
+
+On two isolated Ubuntu 26.04 / Docker 29.1.3 hosts, the exact official image
+passed bidirectional cross-host workload traffic, published host ports, DNS,
+Metadata, platform egress, and component health for all four Linux network
+drivers. One host used Docker native nftables; the other passed both
+iptables-nft and iptables-legacy with Docker's iptables backend and was restored
+to iptables-nft. Docker restart recovery passed. Both hosts were then rebooted
+one at a time; after each reboot and after both had rebooted, all four drivers
+again passed the complete bidirectional data-path gate. Wrapper content, mode, and
+symbolic-link drift were repaired to the selected provider's exact SHA-256 and
+regular `0700` file without modifying the link target.
+
+The manager binds each wrapper to one eligible immutable provider ID, prefers
+the highest numeric OCI image version, and prevents a nonnumeric development
+label from replacing a numeric release. During the short interval before
+Metadata publishes a container IP, host-port recovery accepts exactly one IPv4
+address in that network's managed subnet and revalidates the same Docker PID;
+missing, ambiguous, or raced state preserves the previous working rules.
+Official Catalog activation, rollback, and complete test-stack removal remain
+gates before this candidate is called production-approved.
 
 ## PastureStack IPsec Overlay evidence
 

catalog-images.json

@@ -261,6 +261,25 @@
         "secrets": 0
       }
     },
+    {
+      "reference": "ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.37",
+      "manifestDigest": "sha256:1b3451edc5f338e13edb14a434bf68d51febdcfd25dc94de73b9a2421656014f",
+      "sourceRepository": "https://github.com/PastureStack/ipsec-vxlan-overlay-network",
+      "sourceCommit": "20eb898da1b24ed3b8ab2c0ad212d6523adeddeb",
+      "sourcePath": "package/Dockerfile",
+      "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/ipsec-vxlan-overlay-network",
+      "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu, strongSwan, CNI, Weave, and other packages retain their upstream licenses and notices",
+      "reviewedAt": "2026-09-14",
+      "platforms": ["linux/amd64"],
+      "vulnerabilityScan": {
+        "scanner": "Trivy 0.74.0",
+        "reportCreatedAt": "2026-09-14",
+        "scope": "published runtime image",
+        "high": 0,
+        "critical": 0,
+        "secrets": 0
+      }
+    },
     {
       "reference": "ghcr.io/pasturestack/network-plugin-manager:v0.6.34",
       "sourceRepository": "https://github.com/PastureStack/network-plugin-manager",
@@ -378,6 +397,46 @@
         "critical": 0
       }
     },
+    {
+      "reference": "ghcr.io/pasturestack/network-plugin-manager:v0.8.20",
+      "manifestDigest": "sha256:b66e4a7188c52d4ff970d450e2086c726e5895f3c5881599c24f5b020953d337",
+      "sourceRepository": "https://github.com/PastureStack/network-plugin-manager",
+      "sourceCommit": "75d7957d36a7f0079b2335c6a9060a592596b72a",
+      "sourcePath": "package/Dockerfile",
+      "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/network-plugin-manager",
+      "licenseBoundary": "Apache-2.0 source and image; bundled Alpine, Docker CLI, and other packages retain their upstream licenses and notices",
+      "reviewedAt": "2026-09-14",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "vulnerabilityScan": {
+        "scanner": "Trivy 0.74.0",
+        "reportCreatedAt": "2026-09-14",
+        "scope": "published runtime image",
+        "high": 0,
+        "critical": 0
+      }
+    },
+    {
+      "reference": "ghcr.io/pasturestack/network-plugin-manager:v0.8.21",
+      "manifestDigest": "sha256:aab4c05b0801feeca40fa9cb82a52fbfbfe506c609d3df2024fbc07ef4b968e9",
+      "sourceRepository": "https://github.com/PastureStack/network-plugin-manager",
+      "sourceCommit": "2f2418423022264695f90960f4a80b9d20c5826f",
+      "sourcePath": "package/Dockerfile",
+      "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/network-plugin-manager",
+      "licenseBoundary": "Apache-2.0 source and image; bundled Alpine, Docker CLI, and other packages retain their upstream licenses and notices",
+      "reviewedAt": "2026-09-14",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "vulnerabilityScan": {
+        "scanner": "Trivy 0.74.0",
+        "reportCreatedAt": "2026-09-14",
+        "scope": "published runtime image",
+        "high": 0,
+        "critical": 0
+      }
+    },
     {
       "reference": "ghcr.io/pasturestack/network-diagnostics-agent:v0.2.0",
       "sourceRepository": "https://github.com/PastureStack/network-diagnostics-agent",