@serve.zone/appstore 33.4.0 → 33.6.0

package/dist_catalog/catalog.envelope.json

@@ -5,9 +5,9 @@
       "major": 1,
       "minor": 0
     },
-    "revision": 33000004000000,
-    "publishedAt": "2026-10-13T08:37:24.000Z",
-    "sourceRevision": "e605f88182adedde3f83255f242132f32098746b",
+    "revision": 33000006000000,
+    "publishedAt": "2026-10-13T23:08:46.000Z",
+    "sourceRevision": "cf8998112ff9bff2587d6ec1fa5b379abc9d3021",
     "apps": [
       {
         "info": {
@@ -60,7 +60,7 @@
             "Docs": "https://serve.zone"
           }
         },
-        "latestVersion": "1.28.3",
+        "latestVersion": "1.28.6",
         "versions": [
           {
             "version": "1.0.0",
@@ -7365,6 +7365,561 @@
               }
             },
             "configDigest": "sha256:e97d715e2f6486b27fe4c0200ad784cdfcccc4e63d7489e57ac42847f6293364"
+          },
+          {
+            "version": "1.28.4",
+            "config": {
+              "image": "code.foss.global/serve.zone/cloudly@sha256:0dd5399877c894b86f55d7a56df2da597bfcb7d1c8ec8adec547bfebb5d091d9",
+              "targetPorts": [
+                {
+                  "name": "web",
+                  "port": 3000,
+                  "protocol": "http",
+                  "default": true
+                }
+              ],
+              "envVars": [
+                {
+                  "key": "SERVEZONE_ENVIRONMENT",
+                  "value": "production",
+                  "description": "Cloudly runtime environment.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_PUBLIC_ORIGIN",
+                  "value": "https://${SERVICE_DOMAIN}",
+                  "description": "Canonical public Cloudly origin including protocol and optional public port.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_LISTENPORT",
+                  "value": "3000",
+                  "description": "Internal Cloudly HTTP port inside the container.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_SSLMODE",
+                  "value": "external",
+                  "description": "Use external TLS termination through Onebox or dcrouter.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_SECRET_KEYRING_PATH",
+                  "value": "/run/secrets/cloudly-secrets-v2-keyring.json",
+                  "description": "Path to the Cloudly Secrets v2 keyring mounted by Onebox; the keyring value is never placed in the public environment.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_SECRET_KEYRING_FILE",
+                  "description": "Existing Cloudly Secrets v2 keyring. Onebox stores it encrypted and mounts it only as a root-readable file; retain the existing keyring when upgrading.",
+                  "required": true,
+                  "secret": true,
+                  "delivery": {
+                    "type": "file",
+                    "targetPath": "/run/secrets/cloudly-secrets-v2-keyring.json",
+                    "uid": 0,
+                    "gid": 0,
+                    "mode": 256
+                  }
+                },
+                {
+                  "key": "SERVEZONE_WORKLOADINIT_APPROVAL_PATH",
+                  "value": "/run/secrets/cloudly-workloadinit-approval.json",
+                  "description": "Private WorkloadInit release-approval artifact mounted by Onebox for Coreflow secret-runtime registration.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_WORKLOADINIT_APPROVAL_FILE",
+                  "description": "Operator-approved WorkloadInit release authority. Onebox stores it encrypted and mounts it only as a root-readable file.",
+                  "required": true,
+                  "secret": true,
+                  "delivery": {
+                    "type": "file",
+                    "targetPath": "/run/secrets/cloudly-workloadinit-approval.json",
+                    "uid": 0,
+                    "gid": 0,
+                    "mode": 256
+                  }
+                },
+                {
+                  "key": "MONGODB_URL",
+                  "value": "${MONGODB_URI}",
+                  "description": "Authenticated MongoDB wire-protocol URL provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "MONGODB_NAME",
+                  "value": "${MONGODB_DATABASE}",
+                  "description": "MongoDB wire-protocol database name provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "MONGODB_USER",
+                  "value": "${MONGODB_USERNAME}",
+                  "description": "MongoDB wire-protocol username provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "MONGODB_PASS",
+                  "value": "${MONGODB_PASSWORD}",
+                  "description": "MongoDB wire-protocol password provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "S3_ENDPOINT",
+                  "value": "onebox-corestore",
+                  "description": "S3 endpoint host provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "S3_PORT",
+                  "value": "9000",
+                  "description": "S3 endpoint port provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "S3_USESSL",
+                  "value": "false",
+                  "description": "Use plain HTTP for internal Corestore S3 traffic on the Onebox network.",
+                  "required": true
+                },
+                {
+                  "key": "S3_BUCKET",
+                  "value": "${S3_BUCKET}",
+                  "description": "Cloudly's own S3 bucket, provisioned by Onebox Corestore: registry storage and kept workload logs.",
+                  "required": true
+                },
+                {
+                  "key": "S3_ACCESSKEY",
+                  "value": "${S3_ACCESS_KEY}",
+                  "description": "S3 access key provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "S3_SECRETKEY",
+                  "value": "${S3_SECRET_KEY}",
+                  "description": "S3 secret key provisioned by Onebox Corestore.",
+                  "required": true
+                }
+              ],
+              "platformRequirements": {
+                "mongodb": true,
+                "s3": true
+              },
+              "platformOidc": {
+                "redirectPath": "/auth/oidc/callback",
+                "roles": [
+                  {
+                    "id": "admin",
+                    "label": "Administrator",
+                    "description": "Full Cloudly administration for this hosted instance."
+                  },
+                  {
+                    "id": "user",
+                    "label": "User",
+                    "description": "Standard authenticated Cloudly access for this hosted instance."
+                  }
+                ],
+                "environmentVariables": {
+                  "issuerUrl": "SERVEZONE_PLATFORM_OIDC_ISSUER",
+                  "clientId": "SERVEZONE_PLATFORM_OIDC_CLIENT_ID",
+                  "clientSecret": "SERVEZONE_PLATFORM_OIDC_CLIENT_SECRET",
+                  "redirectUri": "SERVEZONE_PLATFORM_OIDC_REDIRECT_URI",
+                  "audience": "SERVEZONE_PLATFORM_OIDC_AUDIENCE"
+                },
+                "clientAuthenticationMethod": "client_secret_basic"
+              },
+              "minOneboxVersion": "33.8.0",
+              "changelog": "Move Cloudly to 33.19.2, a fixes-only patch over 33.19.1. A greenfield deployment, a legacy import's successor included, proves its namespace blank on the nodes of the Pallet clusters (phase switching or pallet) and nowhere else: a reservation whose service had no rollout plan yet asked every registered node, so a fleet that still keeps a Coreflow-owned Swarm cluster without a relay could never reserve one, and a legacy import's reserve preflight answered NO-GO with CORESTORE_INVENTORY_UNAVAILABLE and NAMESPACE_NOT_PROVEN_BLANK. The deployment preflight and reserveServiceDeployment read the same nodes; a Pallet node whose inventory cannot be read still blocks, a fleet with no Pallet cluster node refuses the reservation CORESTORE_INVENTORY_UNAVAILABLE, and an existing service's preflight still reads its plan's clusters. A greenfield rollout without a Pallet runtime spec is refused GREENFIELD_PALLET_RUNTIME_SPEC_REQUIRED, which is not retryable, instead of falling back to Coreflow placement onto Swarm nodes the namespace proof never covered: state the spec with setServiceRuntimeSpec, then promote again. A rollout with a Pallet spec plans onto the spec's nodes as before. A node's network compilation proves each workload lease once and each protected authority revision and allocation eligibility proof once per transaction (before, every lease was read up to three times per compilation and each read re-proved the same revision and proof, about 24 proof reads per endpoint), so a compilation with 100 endpoints reads 539 records instead of 2,839 (7.8 s instead of 19.8 s on Cloudly's test fixture), and every compilation signs and refuses exactly as before. Cloudly 33.19.2 adds no data step and no collection and keeps the data version 0.30.0, so an upgrade from 1.28.3 runs no data step; it changes neither the Dockerfile nor the qenv.yml requirements, and the runtime contract is unchanged from 1.28.3 and requires Onebox 33.8.0. From 1.28.2 or earlier, the changes of Cloudly 33.18.3, 33.18.4, 33.18.5, 33.19.0 and 33.19.1 apply too: Runtime log intake no longer holds a node's request while its payload uploads: an admitted reportRuntimeAssignmentLogs costs one append transaction that queues the batch with its payload in the new collection cloudly_runtime_log_queue, and the node is answered once it commits. A background drain writes the payloads, up to 32 at once, and commits the ledger rows and removes the queue rows in coalesced transactions that fence no controller record; every other node request under a request budget counts as critical work, and the drain waits for it at most 1 s per step. A resend of a batch the ledger or the queue already holds is answered replay with nothing written, and while the queue is at its bounds (1024 batches, 64 MiB, 8 concurrent intakes) a report is refused at once with the retryable log-intake-saturated. Object writes list nothing (@lossless.org/client 1.23.3), workload logs are kept for at least 30 days whatever shorter logs.retentionMs a spec states, and one runtime log intake line, logged on its own timer at most once a minute, reports intake latency, queue depth, the drain and refusals. A node that applied its network head is no longer handed a successor that only drops the head's withdrawals, and a successor of the projection a node's receipt names lists only the tombstones its own step retires, so a node with more than 256 retired leases or handoffs stays within the contract's bound. Route verification reads the certificate a route presents on a connection of its own, without pooling or TLS session resumption, so it records the route's subject alternative names; a connection that exposes no certificate fails with TLS_PEER_CERTIFICATE_UNAVAILABLE and a certificate without names with TLS_SUBJECT_ALT_NAMES_MISSING. readServiceDeploymentStatus (@serve.zone/interfaces 32.54.0) reads a deployment operation's status without changing it, and a failed service deletion answers SERVICE_DELETION_FAILED and logs its cause. The first start after 1.28.2 or earlier creates the collection cloudly_runtime_log_queue. On the platform Corestore 32.2.4 (NoSQLDB 10.6.1) a collection creation waits at most 5 s for the open transactions on the Cloudly database, and a transaction an earlier Cloudly left open by exiting before its stop completed (it logs that its shutdown deadline passed) holds that database until its session expires 30 minutes later, so that first start fails with EFENCE_BUSY until then: after an unclean stop of the previous Cloudly, start this version no earlier than 30 minutes after that exit. Cloudly 33.19.1 adds no data step and keeps the data version 0.30.0, so an upgrade from 1.28.2, 1.28.1 or 1.28.0 runs no data step; it changes neither the Dockerfile nor the qenv.yml requirements, and the runtime contract is unchanged from 1.28.2 and requires Onebox 33.8.0. From 1.28.1 or earlier, Cloudly 33.18.2 advances a node's network configuration only once the node's authenticated application receipt names its head. Upgrade every node to Pallet 36.3.0 or later, speaking @serve.zone/interfaces 32.50.0 or later, before this Cloudly update: a node that sends no application receipt, Pallet 36.2.1 or earlier, or whose session speaks @serve.zone/interfaces below 32.50.0, keeps the projection it holds and receives no successor. The receipt wire contract is unchanged. The changes of Cloudly 33.18.2 and the releases before it that an upgrade from 1.28.1 or earlier also takes are described in the changelog of cloudly@1.28.2, which repeats those of every earlier template; this changelog keeps their upgrade path only, because a catalog changelog is bounded at 65536 characters. From 1.2.1 or earlier, startup runs the forward-only data migration from 0.20.0 to 0.21.0 through the step retire-cluster-relay-acme and then the steps runtime-session-protocol-offer to 0.22.0, deployment-machine-user-grants to 0.23.0, corestore-control-token-state to 0.24.0, runtime-log-attempts to 0.25.0, cluster-node-hostname-intent to 0.26.0, deployment-operation-route-evidence to 0.27.0, service-secret-target-predecessor to 0.28.0, route-claim-absent-owners to 0.29.0 and bounded-runtime-history to 0.30.0; retire-cluster-relay-acme drops the relay certificate and DNS collections of Cloudly's retired Cloudflare and Let's Encrypt integration and logs every relay name whose A record Cloudly had written at Cloudflare: remove each such record at the provider. A cluster relay then requires a dcrouter that advertises dns.clientRecords and certificates.exactIssuance, SERVEZONE_SSLMODE=letsencrypt is refused (this template keeps external), and the typed API changes as the Breaking Changes of the Cloudly 33.0.0 changelog list; review them, stop Cloudly and take a verified backup before upgrading, because the 32.9 image refuses the migrated data and rollback requires a full restore. The upgrade is marked migration-required and backup-before-upgrade because hosts read these flags from the target version alone and every upgrade from 1.26.0 or earlier runs the 0.28.0 to 0.30.0 steps, one from 1.24.0 or earlier, and from 1.25.0 whose first start failed, the 0.25.0 to 0.28.0 steps before them, one from 1.19.0 or earlier the 0.24.0 to 0.25.0 step before that, one from 1.15.0 or earlier the 0.23.0 to 0.24.0 step before that, one from 1.8.0 or earlier the 0.22.0 to 0.23.0 step before that, one from 1.6.0 or earlier the 0.21.0 to 0.22.0 step before that and one from 1.2.1 or earlier the migration from 0.20.0 as well, and breaking and manual-review because every Cloudly before 33.17.3 refuses the 0.30.0 data, the 0.30.0 step deletes every archived deployment record, the 0.23.0 step removes stored grants forward-only, Cloudly 33.18.0 ignores APPSTORE_URL and loads the App Store catalog from its catalog registries and, from 1.7.0 or earlier, a username and password deployer, an administrator's deployment reservation and a machine identity or registry bearer issued earlier are refused. An installation on 1.1.10 or earlier also runs the 1.2.0 steps first, from 0.10.0, and requires completed Secrets v2 cutover retirement. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files.",
+              "breaking": true,
+              "requiresManualReview": true,
+              "migrationRequired": true,
+              "backupBeforeUpgrade": true,
+              "healthCheck": {
+                "path": "/status",
+                "port": 3000,
+                "expectedStatus": 200
+              }
+            },
+            "configDigest": "sha256:b069bdf3d8e9c9077a9fbe818abfb227b1677d576e2f51efbcc6829fdfc9e595"
+          },
+          {
+            "version": "1.28.5",
+            "config": {
+              "image": "code.foss.global/serve.zone/cloudly@sha256:ff692cf950da26d1d50e717c06eff1c58201b699e6bb94d65a541cd861abbedc",
+              "targetPorts": [
+                {
+                  "name": "web",
+                  "port": 3000,
+                  "protocol": "http",
+                  "default": true
+                }
+              ],
+              "envVars": [
+                {
+                  "key": "SERVEZONE_ENVIRONMENT",
+                  "value": "production",
+                  "description": "Cloudly runtime environment.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_PUBLIC_ORIGIN",
+                  "value": "https://${SERVICE_DOMAIN}",
+                  "description": "Canonical public Cloudly origin including protocol and optional public port.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_LISTENPORT",
+                  "value": "3000",
+                  "description": "Internal Cloudly HTTP port inside the container.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_SSLMODE",
+                  "value": "external",
+                  "description": "Use external TLS termination through Onebox or dcrouter.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_SECRET_KEYRING_PATH",
+                  "value": "/run/secrets/cloudly-secrets-v2-keyring.json",
+                  "description": "Path to the Cloudly Secrets v2 keyring mounted by Onebox; the keyring value is never placed in the public environment.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_SECRET_KEYRING_FILE",
+                  "description": "Existing Cloudly Secrets v2 keyring. Onebox stores it encrypted and mounts it only as a root-readable file; retain the existing keyring when upgrading.",
+                  "required": true,
+                  "secret": true,
+                  "delivery": {
+                    "type": "file",
+                    "targetPath": "/run/secrets/cloudly-secrets-v2-keyring.json",
+                    "uid": 0,
+                    "gid": 0,
+                    "mode": 256
+                  }
+                },
+                {
+                  "key": "SERVEZONE_WORKLOADINIT_APPROVAL_PATH",
+                  "value": "/run/secrets/cloudly-workloadinit-approval.json",
+                  "description": "Private WorkloadInit release-approval artifact mounted by Onebox for Coreflow secret-runtime registration.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_WORKLOADINIT_APPROVAL_FILE",
+                  "description": "Operator-approved WorkloadInit release authority. Onebox stores it encrypted and mounts it only as a root-readable file.",
+                  "required": true,
+                  "secret": true,
+                  "delivery": {
+                    "type": "file",
+                    "targetPath": "/run/secrets/cloudly-workloadinit-approval.json",
+                    "uid": 0,
+                    "gid": 0,
+                    "mode": 256
+                  }
+                },
+                {
+                  "key": "MONGODB_URL",
+                  "value": "${MONGODB_URI}",
+                  "description": "Authenticated MongoDB wire-protocol URL provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "MONGODB_NAME",
+                  "value": "${MONGODB_DATABASE}",
+                  "description": "MongoDB wire-protocol database name provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "MONGODB_USER",
+                  "value": "${MONGODB_USERNAME}",
+                  "description": "MongoDB wire-protocol username provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "MONGODB_PASS",
+                  "value": "${MONGODB_PASSWORD}",
+                  "description": "MongoDB wire-protocol password provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "S3_ENDPOINT",
+                  "value": "onebox-corestore",
+                  "description": "S3 endpoint host provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "S3_PORT",
+                  "value": "9000",
+                  "description": "S3 endpoint port provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "S3_USESSL",
+                  "value": "false",
+                  "description": "Use plain HTTP for internal Corestore S3 traffic on the Onebox network.",
+                  "required": true
+                },
+                {
+                  "key": "S3_BUCKET",
+                  "value": "${S3_BUCKET}",
+                  "description": "Cloudly's own S3 bucket, provisioned by Onebox Corestore: registry storage and kept workload logs.",
+                  "required": true
+                },
+                {
+                  "key": "S3_ACCESSKEY",
+                  "value": "${S3_ACCESS_KEY}",
+                  "description": "S3 access key provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "S3_SECRETKEY",
+                  "value": "${S3_SECRET_KEY}",
+                  "description": "S3 secret key provisioned by Onebox Corestore.",
+                  "required": true
+                }
+              ],
+              "platformRequirements": {
+                "mongodb": true,
+                "s3": true
+              },
+              "backupExclusions": [
+                {
+                  "storageRequest": "legacy-s3",
+                  "keyPrefixes": [
+                    "runtime-logs/"
+                  ],
+                  "reason": "Workload logs; a restore brings back state, not past logs."
+                }
+              ],
+              "platformOidc": {
+                "redirectPath": "/auth/oidc/callback",
+                "roles": [
+                  {
+                    "id": "admin",
+                    "label": "Administrator",
+                    "description": "Full Cloudly administration for this hosted instance."
+                  },
+                  {
+                    "id": "user",
+                    "label": "User",
+                    "description": "Standard authenticated Cloudly access for this hosted instance."
+                  }
+                ],
+                "environmentVariables": {
+                  "issuerUrl": "SERVEZONE_PLATFORM_OIDC_ISSUER",
+                  "clientId": "SERVEZONE_PLATFORM_OIDC_CLIENT_ID",
+                  "clientSecret": "SERVEZONE_PLATFORM_OIDC_CLIENT_SECRET",
+                  "redirectUri": "SERVEZONE_PLATFORM_OIDC_REDIRECT_URI",
+                  "audience": "SERVEZONE_PLATFORM_OIDC_AUDIENCE"
+                },
+                "clientAuthenticationMethod": "client_secret_basic"
+              },
+              "minOneboxVersion": "33.8.0",
+              "changelog": "Declare Cloudly's workload logs non-backup data without moving the image: this template runs the Cloudly 33.19.1 image of 1.28.3 and differs from 1.28.3 only in its changelog and two members. backupExclusions names the key prefix runtime-logs/ of Cloudly's own bucket, the object storage platformRequirements.s3 provisions (storage request legacy-s3), under which Cloudly keeps the payloads of workload logs, and requiresFeatures names storage.object-storage.backup-exclusions. A host that fulfils that feature leaves the objects under runtime-logs/ out of Cloudly's backups, and a restore brings back Cloudly's state, not its past workload logs: it neither restores nor removes objects under that prefix, and Cloudly reports a log batch whose payload it no longer has as a gap. A host that does not fulfil the feature keeps listing this version and refuses it as an install or upgrade target. From 1.28.3 the upgrade moves the template only: Cloudly runs the same image on the same data and no data step runs. 1.28.5 sorts above 1.28.4 but runs the older image, Cloudly 33.19.1 instead of 33.19.2: it exists for a host on 1.28.3 that moves its template without moving Cloudly. From 1.28.4, upgrade to 1.28.6, which carries the same declaration on the Cloudly 33.19.2 image of 1.28.4; 1.28.5 would run Cloudly 33.19.1 on that data, which it reads because Cloudly 33.19.2 added no data step and no collection, but without the fixes of 33.19.2. The rest of this changelog is that of 1.28.3 and holds for this template: Move Cloudly to 33.19.1, which carries Cloudly 33.18.3, 33.18.4, 33.18.5, 33.19.0 and 33.19.1 over 33.18.2. Runtime log intake no longer holds a node's request while its payload uploads: an admitted reportRuntimeAssignmentLogs costs one append transaction that queues the batch with its payload in the new collection cloudly_runtime_log_queue, and the node is answered once it commits. A background drain writes the payloads, up to 32 at once, and commits the ledger rows and removes the queue rows in coalesced transactions that fence no controller record; every other node request under a request budget counts as critical work, and the drain waits for it at most 1 s per step. A resend of a batch the ledger or the queue already holds is answered replay with nothing written, and while the queue is at its bounds (1024 batches, 64 MiB, 8 concurrent intakes) a report is refused at once with the retryable log-intake-saturated. Object writes list nothing (@lossless.org/client 1.23.3), workload logs are kept for at least 30 days whatever shorter logs.retentionMs a spec states, and one runtime log intake line, logged on its own timer at most once a minute, reports intake latency, queue depth, the drain and refusals. A node that applied its network head is no longer handed a successor that only drops the head's withdrawals, and a successor of the projection a node's receipt names lists only the tombstones its own step retires, so a node with more than 256 retired leases or handoffs stays within the contract's bound. Route verification reads the certificate a route presents on a connection of its own, without pooling or TLS session resumption, so it records the route's subject alternative names; a connection that exposes no certificate fails with TLS_PEER_CERTIFICATE_UNAVAILABLE and a certificate without names with TLS_SUBJECT_ALT_NAMES_MISSING. readServiceDeploymentStatus (@serve.zone/interfaces 32.54.0) reads a deployment operation's status without changing it, and a failed service deletion answers SERVICE_DELETION_FAILED and logs its cause. The first start creates the collection cloudly_runtime_log_queue. On the platform Corestore 32.2.4 (NoSQLDB 10.6.1) a collection creation waits at most 5 s for the open transactions on the Cloudly database, and a transaction an earlier Cloudly left open by exiting before its stop completed (it logs that its shutdown deadline passed) holds that database until its session expires 30 minutes later, so that first start fails with EFENCE_BUSY until then: after an unclean stop of the previous Cloudly, start this version no earlier than 30 minutes after that exit. Cloudly 33.19.1 adds no data step and keeps the data version 0.30.0, so an upgrade from 1.28.2, 1.28.1 or 1.28.0 runs no data step; it changes neither the Dockerfile nor the qenv.yml requirements, and the runtime contract is unchanged from 1.28.2 and requires Onebox 33.8.0. From 1.28.1 or earlier, the fixes of Cloudly 33.18.2 apply too: A node's network configuration advances only as fast as the node applies it: Cloudly signed a node's successor projection once the node stored its head, so every new version invalidated the application in flight. Cloudly now composes the successor only once the node's authenticated application receipt names the exact head, under a session speaking @serve.zone/interfaces 32.50.0 or later; a storage acknowledgement, a failed or absent application or a reconnect is no such proof, while a receipt whose nativeJournal is null, proving every packet table released, lets the node advance after a failed application too. Changes staged meanwhile coalesce into one successor from the current durable state; the producer reports the node awaiting-application, naming the held head, and logs one warning per held head. A withdrawn cluster ingress flow wanted again no longer lets the rest of the projection go on: the whole projection waits for the receipt. A rotated signing key still re-signs the held head at its own generation. Upgrade every node to Pallet 36.3.0 or later, speaking @serve.zone/interfaces 32.50.0 or later, before this Cloudly update: a node that sends no application receipt, Pallet 36.2.1 or earlier, or whose session speaks @serve.zone/interfaces below 32.50.0, keeps the projection it holds and receives no successor. The receipt wire contract is unchanged. Cloudly 33.18.2 adds no data step and keeps the data version 0.30.0, so an upgrade from 1.28.1 or 1.28.0 runs no data step; it changes neither the Dockerfile nor the qenv.yml requirements, and the runtime contract is unchanged from 1.28.1 and requires Onebox 33.8.0. The changes of the Cloudly releases before 33.18.2 that an upgrade from 1.28.0 or earlier also takes are described in the changelog of cloudly@1.28.2, which repeats those of every earlier template; this changelog keeps their upgrade path only, because a catalog changelog is bounded at 65536 characters. From 1.2.1 or earlier, startup runs the forward-only data migration from 0.20.0 to 0.21.0 through the step retire-cluster-relay-acme and then the steps runtime-session-protocol-offer to 0.22.0, deployment-machine-user-grants to 0.23.0, corestore-control-token-state to 0.24.0, runtime-log-attempts to 0.25.0, cluster-node-hostname-intent to 0.26.0, deployment-operation-route-evidence to 0.27.0, service-secret-target-predecessor to 0.28.0, route-claim-absent-owners to 0.29.0 and bounded-runtime-history to 0.30.0; retire-cluster-relay-acme drops the relay certificate and DNS collections of Cloudly's retired Cloudflare and Let's Encrypt integration and logs every relay name whose A record Cloudly had written at Cloudflare: remove each such record at the provider. A cluster relay then requires a dcrouter that advertises dns.clientRecords and certificates.exactIssuance, SERVEZONE_SSLMODE=letsencrypt is refused (this template keeps external), and the typed API changes as the Breaking Changes of the Cloudly 33.0.0 changelog list; review them, stop Cloudly and take a verified backup before upgrading, because the 32.9 image refuses the migrated data and rollback requires a full restore. The upgrade is marked migration-required and backup-before-upgrade because hosts read these flags from the target version alone and every upgrade from 1.26.0 or earlier runs the 0.28.0 to 0.30.0 steps, one from 1.24.0 or earlier, and from 1.25.0 whose first start failed, the 0.25.0 to 0.28.0 steps before them, one from 1.19.0 or earlier the 0.24.0 to 0.25.0 step before that, one from 1.15.0 or earlier the 0.23.0 to 0.24.0 step before that, one from 1.8.0 or earlier the 0.22.0 to 0.23.0 step before that, one from 1.6.0 or earlier the 0.21.0 to 0.22.0 step before that and one from 1.2.1 or earlier the migration from 0.20.0 as well, and breaking and manual-review because every Cloudly before 33.17.3 refuses the 0.30.0 data, the 0.30.0 step deletes every archived deployment record, the 0.23.0 step removes stored grants forward-only, Cloudly 33.18.0 ignores APPSTORE_URL and loads the App Store catalog from its catalog registries and, from 1.7.0 or earlier, a username and password deployer, an administrator's deployment reservation and a machine identity or registry bearer issued earlier are refused. An installation on 1.1.10 or earlier also runs the 1.2.0 steps first, from 0.10.0, and requires completed Secrets v2 cutover retirement. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files.",
+              "breaking": true,
+              "requiresManualReview": true,
+              "migrationRequired": true,
+              "backupBeforeUpgrade": true,
+              "requiresFeatures": [
+                "storage.object-storage.backup-exclusions"
+              ],
+              "healthCheck": {
+                "path": "/status",
+                "port": 3000,
+                "expectedStatus": 200
+              }
+            },
+            "configDigest": "sha256:15c6742639a1fbf402d0b3d080029600f6a828e53f3103f5c303d9be89c49c2f"
+          },
+          {
+            "version": "1.28.6",
+            "config": {
+              "image": "code.foss.global/serve.zone/cloudly@sha256:0dd5399877c894b86f55d7a56df2da597bfcb7d1c8ec8adec547bfebb5d091d9",
+              "targetPorts": [
+                {
+                  "name": "web",
+                  "port": 3000,
+                  "protocol": "http",
+                  "default": true
+                }
+              ],
+              "envVars": [
+                {
+                  "key": "SERVEZONE_ENVIRONMENT",
+                  "value": "production",
+                  "description": "Cloudly runtime environment.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_PUBLIC_ORIGIN",
+                  "value": "https://${SERVICE_DOMAIN}",
+                  "description": "Canonical public Cloudly origin including protocol and optional public port.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_LISTENPORT",
+                  "value": "3000",
+                  "description": "Internal Cloudly HTTP port inside the container.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_SSLMODE",
+                  "value": "external",
+                  "description": "Use external TLS termination through Onebox or dcrouter.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_SECRET_KEYRING_PATH",
+                  "value": "/run/secrets/cloudly-secrets-v2-keyring.json",
+                  "description": "Path to the Cloudly Secrets v2 keyring mounted by Onebox; the keyring value is never placed in the public environment.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_SECRET_KEYRING_FILE",
+                  "description": "Existing Cloudly Secrets v2 keyring. Onebox stores it encrypted and mounts it only as a root-readable file; retain the existing keyring when upgrading.",
+                  "required": true,
+                  "secret": true,
+                  "delivery": {
+                    "type": "file",
+                    "targetPath": "/run/secrets/cloudly-secrets-v2-keyring.json",
+                    "uid": 0,
+                    "gid": 0,
+                    "mode": 256
+                  }
+                },
+                {
+                  "key": "SERVEZONE_WORKLOADINIT_APPROVAL_PATH",
+                  "value": "/run/secrets/cloudly-workloadinit-approval.json",
+                  "description": "Private WorkloadInit release-approval artifact mounted by Onebox for Coreflow secret-runtime registration.",
+                  "required": true
+                },
+                {
+                  "key": "SERVEZONE_WORKLOADINIT_APPROVAL_FILE",
+                  "description": "Operator-approved WorkloadInit release authority. Onebox stores it encrypted and mounts it only as a root-readable file.",
+                  "required": true,
+                  "secret": true,
+                  "delivery": {
+                    "type": "file",
+                    "targetPath": "/run/secrets/cloudly-workloadinit-approval.json",
+                    "uid": 0,
+                    "gid": 0,
+                    "mode": 256
+                  }
+                },
+                {
+                  "key": "MONGODB_URL",
+                  "value": "${MONGODB_URI}",
+                  "description": "Authenticated MongoDB wire-protocol URL provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "MONGODB_NAME",
+                  "value": "${MONGODB_DATABASE}",
+                  "description": "MongoDB wire-protocol database name provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "MONGODB_USER",
+                  "value": "${MONGODB_USERNAME}",
+                  "description": "MongoDB wire-protocol username provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "MONGODB_PASS",
+                  "value": "${MONGODB_PASSWORD}",
+                  "description": "MongoDB wire-protocol password provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "S3_ENDPOINT",
+                  "value": "onebox-corestore",
+                  "description": "S3 endpoint host provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "S3_PORT",
+                  "value": "9000",
+                  "description": "S3 endpoint port provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "S3_USESSL",
+                  "value": "false",
+                  "description": "Use plain HTTP for internal Corestore S3 traffic on the Onebox network.",
+                  "required": true
+                },
+                {
+                  "key": "S3_BUCKET",
+                  "value": "${S3_BUCKET}",
+                  "description": "Cloudly's own S3 bucket, provisioned by Onebox Corestore: registry storage and kept workload logs.",
+                  "required": true
+                },
+                {
+                  "key": "S3_ACCESSKEY",
+                  "value": "${S3_ACCESS_KEY}",
+                  "description": "S3 access key provisioned by Onebox Corestore.",
+                  "required": true
+                },
+                {
+                  "key": "S3_SECRETKEY",
+                  "value": "${S3_SECRET_KEY}",
+                  "description": "S3 secret key provisioned by Onebox Corestore.",
+                  "required": true
+                }
+              ],
+              "platformRequirements": {
+                "mongodb": true,
+                "s3": true
+              },
+              "backupExclusions": [
+                {
+                  "storageRequest": "legacy-s3",
+                  "keyPrefixes": [
+                    "runtime-logs/"
+                  ],
+                  "reason": "Workload logs; a restore brings back state, not past logs."
+                }
+              ],
+              "platformOidc": {
+                "redirectPath": "/auth/oidc/callback",
+                "roles": [
+                  {
+                    "id": "admin",
+                    "label": "Administrator",
+                    "description": "Full Cloudly administration for this hosted instance."
+                  },
+                  {
+                    "id": "user",
+                    "label": "User",
+                    "description": "Standard authenticated Cloudly access for this hosted instance."
+                  }
+                ],
+                "environmentVariables": {
+                  "issuerUrl": "SERVEZONE_PLATFORM_OIDC_ISSUER",
+                  "clientId": "SERVEZONE_PLATFORM_OIDC_CLIENT_ID",
+                  "clientSecret": "SERVEZONE_PLATFORM_OIDC_CLIENT_SECRET",
+                  "redirectUri": "SERVEZONE_PLATFORM_OIDC_REDIRECT_URI",
+                  "audience": "SERVEZONE_PLATFORM_OIDC_AUDIENCE"
+                },
+                "clientAuthenticationMethod": "client_secret_basic"
+              },
+              "minOneboxVersion": "33.8.0",
+              "changelog": "Declare Cloudly's workload logs non-backup data on the Cloudly 33.19.2 image of 1.28.4: this template differs from 1.28.4 only in its changelog and two members. backupExclusions names the key prefix runtime-logs/ of Cloudly's own bucket, the object storage platformRequirements.s3 provisions (storage request legacy-s3), under which Cloudly keeps the payloads of workload logs, and requiresFeatures names storage.object-storage.backup-exclusions. A host that fulfils that feature leaves the objects under runtime-logs/ out of Cloudly's backups, and a restore brings back Cloudly's state, not its past workload logs: it neither restores nor removes objects under that prefix, and Cloudly reports a log batch whose payload it no longer has as a gap. A host that does not fulfil the feature keeps listing this version and refuses it as an install or upgrade target. From 1.28.4 the upgrade moves the template only: Cloudly runs the same image on the same data and no data step runs. From 1.28.5, which carries the same declaration on the Cloudly 33.19.1 image of 1.28.3, it moves Cloudly to 33.19.2 as an upgrade from 1.28.3 does. The rest of this changelog is that of 1.28.4 and holds for this template: Move Cloudly to 33.19.2, a fixes-only patch over 33.19.1. A greenfield deployment, a legacy import's successor included, proves its namespace blank on the nodes of the Pallet clusters (phase switching or pallet) and nowhere else: a reservation whose service had no rollout plan yet asked every registered node, so a fleet that still keeps a Coreflow-owned Swarm cluster without a relay could never reserve one, and a legacy import's reserve preflight answered NO-GO with CORESTORE_INVENTORY_UNAVAILABLE and NAMESPACE_NOT_PROVEN_BLANK. The deployment preflight and reserveServiceDeployment read the same nodes; a Pallet node whose inventory cannot be read still blocks, a fleet with no Pallet cluster node refuses the reservation CORESTORE_INVENTORY_UNAVAILABLE, and an existing service's preflight still reads its plan's clusters. A greenfield rollout without a Pallet runtime spec is refused GREENFIELD_PALLET_RUNTIME_SPEC_REQUIRED, which is not retryable, instead of falling back to Coreflow placement onto Swarm nodes the namespace proof never covered: state the spec with setServiceRuntimeSpec, then promote again. A rollout with a Pallet spec plans onto the spec's nodes as before. A node's network compilation proves each workload lease once and each protected authority revision and allocation eligibility proof once per transaction (before, every lease was read up to three times per compilation and each read re-proved the same revision and proof, about 24 proof reads per endpoint), so a compilation with 100 endpoints reads 539 records instead of 2,839 (7.8 s instead of 19.8 s on Cloudly's test fixture), and every compilation signs and refuses exactly as before. Cloudly 33.19.2 adds no data step and no collection and keeps the data version 0.30.0, so an upgrade from 1.28.3 runs no data step; it changes neither the Dockerfile nor the qenv.yml requirements, and the runtime contract is unchanged from 1.28.3 and requires Onebox 33.8.0. From 1.28.2 or earlier, the changes of Cloudly 33.18.3, 33.18.4, 33.18.5, 33.19.0 and 33.19.1 apply too: Runtime log intake no longer holds a node's request while its payload uploads: an admitted reportRuntimeAssignmentLogs costs one append transaction that queues the batch with its payload in the new collection cloudly_runtime_log_queue, and the node is answered once it commits. A background drain writes the payloads, up to 32 at once, and commits the ledger rows and removes the queue rows in coalesced transactions that fence no controller record; every other node request under a request budget counts as critical work, and the drain waits for it at most 1 s per step. A resend of a batch the ledger or the queue already holds is answered replay with nothing written, and while the queue is at its bounds (1024 batches, 64 MiB, 8 concurrent intakes) a report is refused at once with the retryable log-intake-saturated. Object writes list nothing (@lossless.org/client 1.23.3), workload logs are kept for at least 30 days whatever shorter logs.retentionMs a spec states, and one runtime log intake line, logged on its own timer at most once a minute, reports intake latency, queue depth, the drain and refusals. A node that applied its network head is no longer handed a successor that only drops the head's withdrawals, and a successor of the projection a node's receipt names lists only the tombstones its own step retires, so a node with more than 256 retired leases or handoffs stays within the contract's bound. Route verification reads the certificate a route presents on a connection of its own, without pooling or TLS session resumption, so it records the route's subject alternative names; a connection that exposes no certificate fails with TLS_PEER_CERTIFICATE_UNAVAILABLE and a certificate without names with TLS_SUBJECT_ALT_NAMES_MISSING. readServiceDeploymentStatus (@serve.zone/interfaces 32.54.0) reads a deployment operation's status without changing it, and a failed service deletion answers SERVICE_DELETION_FAILED and logs its cause. The first start after 1.28.2 or earlier creates the collection cloudly_runtime_log_queue. On the platform Corestore 32.2.4 (NoSQLDB 10.6.1) a collection creation waits at most 5 s for the open transactions on the Cloudly database, and a transaction an earlier Cloudly left open by exiting before its stop completed (it logs that its shutdown deadline passed) holds that database until its session expires 30 minutes later, so that first start fails with EFENCE_BUSY until then: after an unclean stop of the previous Cloudly, start this version no earlier than 30 minutes after that exit. Cloudly 33.19.1 adds no data step and keeps the data version 0.30.0, so an upgrade from 1.28.2, 1.28.1 or 1.28.0 runs no data step; it changes neither the Dockerfile nor the qenv.yml requirements, and the runtime contract is unchanged from 1.28.2 and requires Onebox 33.8.0. From 1.28.1 or earlier, Cloudly 33.18.2 advances a node's network configuration only once the node's authenticated application receipt names its head. Upgrade every node to Pallet 36.3.0 or later, speaking @serve.zone/interfaces 32.50.0 or later, before this Cloudly update: a node that sends no application receipt, Pallet 36.2.1 or earlier, or whose session speaks @serve.zone/interfaces below 32.50.0, keeps the projection it holds and receives no successor. The receipt wire contract is unchanged. The changes of Cloudly 33.18.2 and the releases before it that an upgrade from 1.28.1 or earlier also takes are described in the changelog of cloudly@1.28.2, which repeats those of every earlier template; this changelog keeps their upgrade path only, because a catalog changelog is bounded at 65536 characters. From 1.2.1 or earlier, startup runs the forward-only data migration from 0.20.0 to 0.21.0 through the step retire-cluster-relay-acme and then the steps runtime-session-protocol-offer to 0.22.0, deployment-machine-user-grants to 0.23.0, corestore-control-token-state to 0.24.0, runtime-log-attempts to 0.25.0, cluster-node-hostname-intent to 0.26.0, deployment-operation-route-evidence to 0.27.0, service-secret-target-predecessor to 0.28.0, route-claim-absent-owners to 0.29.0 and bounded-runtime-history to 0.30.0; retire-cluster-relay-acme drops the relay certificate and DNS collections of Cloudly's retired Cloudflare and Let's Encrypt integration and logs every relay name whose A record Cloudly had written at Cloudflare: remove each such record at the provider. A cluster relay then requires a dcrouter that advertises dns.clientRecords and certificates.exactIssuance, SERVEZONE_SSLMODE=letsencrypt is refused (this template keeps external), and the typed API changes as the Breaking Changes of the Cloudly 33.0.0 changelog list; review them, stop Cloudly and take a verified backup before upgrading, because the 32.9 image refuses the migrated data and rollback requires a full restore. The upgrade is marked migration-required and backup-before-upgrade because hosts read these flags from the target version alone and every upgrade from 1.26.0 or earlier runs the 0.28.0 to 0.30.0 steps, one from 1.24.0 or earlier, and from 1.25.0 whose first start failed, the 0.25.0 to 0.28.0 steps before them, one from 1.19.0 or earlier the 0.24.0 to 0.25.0 step before that, one from 1.15.0 or earlier the 0.23.0 to 0.24.0 step before that, one from 1.8.0 or earlier the 0.22.0 to 0.23.0 step before that, one from 1.6.0 or earlier the 0.21.0 to 0.22.0 step before that and one from 1.2.1 or earlier the migration from 0.20.0 as well, and breaking and manual-review because every Cloudly before 33.17.3 refuses the 0.30.0 data, the 0.30.0 step deletes every archived deployment record, the 0.23.0 step removes stored grants forward-only, Cloudly 33.18.0 ignores APPSTORE_URL and loads the App Store catalog from its catalog registries and, from 1.7.0 or earlier, a username and password deployer, an administrator's deployment reservation and a machine identity or registry bearer issued earlier are refused. An installation on 1.1.10 or earlier also runs the 1.2.0 steps first, from 0.10.0, and requires completed Secrets v2 cutover retirement. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files.",
+              "breaking": true,
+              "requiresManualReview": true,
+              "migrationRequired": true,
+              "backupBeforeUpgrade": true,
+              "requiresFeatures": [
+                "storage.object-storage.backup-exclusions"
+              ],
+              "healthCheck": {
+                "path": "/status",
+                "port": 3000,
+                "expectedStatus": 200
+              }
+            },
+            "configDigest": "sha256:110432c0d224cd8433e796c63092b603738ad89c98e9f8e2b4bff36d2056e90e"
           }
         ]
       },
@@ -8138,11 +8693,11 @@
       }
     ]
   },
-  "catalogDigest": "sha256:dc4d8856812fd16616dc5cb324b70cde0ed0218502adfd74a68f92d893c8bc84",
+  "catalogDigest": "sha256:e86081be018dd1c01c4153c13493f4de9d00ea28abd9b8dddf67cfa4afd63880",
   "signatures": [
     {
       "keyId": "sha256:58956c3537cdf542430d6685261824776d6128ebb9a93b3d77b53f2d031ba854",
-      "signature": "104589a9af51bf762dc36e6844bc0f1fcdf28e7d0102fa1f2324cb1d2dad5c6ee422dfca8770ae1d9a9bc075500f726c1402610a9ef275fca243ebcd32ce660d"
+      "signature": "e7c14935c07b1b3c47bd80aec573bf8f6dcf7bdc7bafc2f8155be75ab7412bbba57ffcdd4f97c924a0fe90fb2498b21f8ff1ebfcdd39652d1372fa3444bba006"
     }
   ]
 }