pgsty · Vonng · Sep 13, 2026 · Sep 13, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+As of 2026-09-13, the latest published version remains
+[v2.4.0](https://github.com/pgsty/silo-console/releases/tag/v2.4.0).
+The changes below are on main and selected by Server main; they are not in
+that release or the embedded Console of Server 20260903. The
+[component matrix](https://silo.pgsty.com/compatibility/versions/) records exact pins.
+
 - **Breaking authorization change:** uses `admin:ChangeMyPassword` for the Change Password button and session capability; user creation remains governed by `admin:CreateUser`. With the matching Server, a saved CreateUser deny no longer locks the caller's password, and a ChangeMyPassword deny now locks it. Preserve the old combined restriction by denying both actions before upgrading. The updated built-in `readonly` also permits self-service password changes and no longer overrides a separate CreateUser Allow; saved policy overrides retain their old statements. Deploy Server, silo-pkg and Console together. See the [migration guide](https://github.com/pgsty/silo/blob/420340bc142b7dec00c26c28dd78102e3ed9d0f3/docs/iam/password-permissions.md) for affected policies, mixed-version behavior and rollback limits. This change is independent of the SDK update.
 - Pins upstream minio-go to `60bd07042d49`, including streaming Content-Type signing, RDMA TLS trust, listing checksum and restore-status fixes. Uses released silo-pkg v3.14.0 and the September 13 mcli release, and refreshes the Go official x/* dependencies. The upstream region-whitespace fix (#2274) remains pending.
 - Updates knip's indirect smol-toml dependency to 1.8.0, retaining the fix for CVE-2026-85730.

diff --git a/README.md b/README.md
@@ -34,6 +34,15 @@
 > sponsored by MinIO, Inc. The MinIO name is used only to identify the upstream
 > project and compatibility lineage.
 
+## Current release and development source
+
+The latest published Console is [v2.4.0](https://github.com/pgsty/silo-console/releases/tag/v2.4.0)
+(2026-09-08). It uses silo-pkg v3.13.3 and MC source `c8aa5d25a63a`.
+The main branch now uses pkg v3.14.0, mcli 20260913 and upstream minio-go
+`60bd07042d49`; the password-permission split, streaming ZIP downloads and new
+release-promotion contract are **unreleased** as of 2026-09-13. See
+[CHANGELOG.md](CHANGELOG.md) and the [component matrix](https://silo.pgsty.com/compatibility/versions/).
+
 ## Overview
 
 SILO Console is the browser-based administration interface for

diff --git a/docs/Embedding.md b/docs/Embedding.md
@@ -1,5 +1,11 @@
 # Embedding Console in a SILO server
 
+This page describes the main-branch source as of 2026-09-13, including pkg
+v3.14.0 and the released mcli 20260913 source. For the published Console v2.4.0
+use [its embedding documentation](https://github.com/pgsty/silo-console/blob/v2.4.0/docs/Embedding.md)
+and its own README replacement block. The Server 20260903 binary embeds Console
+source `464a59d73ada` with the v2.3.0 version identity, not this newer source.
+
 SILO embeds this module (`github.com/minio/console`) as a Go dependency.
 Console directly requires `github.com/pgsty/silo-pkg/v3`; that requirement is
 inherited normally and needs no downstream replacement. Console has one
@@ -35,8 +41,13 @@ compile. `minio-go` is the explicit exception and resolves upstream by policy.
 
 This Console line has completed the migration described by silo-pkg v3.13.0:
 its source imports `github.com/pgsty/silo-pkg/v3`, and `go.mod` requires the
-current v3.14.0 release directly. A SILO server adopting this Console release must make the same source
+current v3.14.0 release directly. A SILO server adopting this Console revision must make the same source
 import migration. Keeping old `github.com/minio/pkg/v3`
 imports while replacing that path with silo-pkg v3.13.0 or later produces
 `used for two different module paths`. Update the embedding server's imports
-and module graph when it adopts this Console release.
+and module graph when it adopts this Console revision.
+
+The single maintained-component replacement is separate from compatibility
+pins: go-systemd remains v22.6.0 for NetBSD, and Console retains tablewriter
+v0.0.5 for the MC API it imports. Inspect the root module's full effective graph;
+Go does not inherit these other replacements either.
diff --git a/docs/README.md b/docs/README.md
@@ -1,5 +1,10 @@
 # Docs
 
+These pages describe the checked-out source. The latest published version is
+v2.4.0; main-branch features marked Unreleased require a source build until the
+next Console release. See [CHANGELOG.md](../CHANGELOG.md) and the
+[component matrix](https://silo.pgsty.com/compatibility/versions/).
+
 More documentation to read
 
 - [OIDC](OIDC.md)

diff --git a/docs/Release.md b/docs/Release.md
@@ -2,8 +2,14 @@
 
 This is the checklist for publishing a SILO Console release. Pushing an
 annotated `v*` tag starts `.github/workflows/release.yaml`; the workflow creates
-a draft GitHub release and publishes the versioned and `latest` container tags.
-The maintainer reviews and publishes the draft manually.
+a draft GitHub release and a versioned candidate image. It does not advance
+`latest`. The maintainer publishes the verified draft; `promote-image.yaml`
+then verifies the current stable release, signatures, SBOM, provenance and
+anonymous image access before promoting that digest to `latest`.
+
+This is the main-branch procedure as of 2026-09-13. Console v2.4.0 was built
+with the earlier workflow. Older assets do not acquire the new verification
+contract retroactively; see [release-contract.md](release-contract.md).
 
 ## 1. Prepare one candidate commit
 
@@ -61,19 +67,23 @@ Before GoReleaser runs, the tag workflow checks:
 - that rebuilding `web-app/build` and `src/version.tsx` produces no diff.
 
 GoReleaser then uploads binaries, archives, packages, checksums, legal files,
-and a **draft** GitHub release. It publishes the multi-platform image directly
-to `ghcr.io/pgsty/silo-console` under the release tag and `latest`.
+and a **draft** GitHub release. It publishes the multi-platform candidate image
+to `ghcr.io/pgsty/silo-console` under the release tag. The workflow verifies
+checksum/image signatures, SBOM attestations and provenance before declaring
+the draft ready. Only the separate post-publication workflow advances `latest`.
 
 ## 4. Review and publish the draft
 
 Review the generated notes and asset list, then publish the draft in GitHub.
-The draft is the manual approval boundary; no separate environment or staging
-package is required.
+After publication, require `promote-image.yaml` to succeed and verify anonymous
+pulls of both the release tag and `latest`. A published GitHub release alone
+is not proof that image promotion completed.
 
 If GoReleaser fails while uploading assets, the release remains an unpublished
 draft. Delete that partial draft and rerun the tag workflow. The container tags
-may already point at the correctly labelled release image; rerunning with the
-same tag replaces them with the completed build.
+for the candidate version may already exist. Retry only while the GitHub
+release is still a draft; the workflow refuses to overwrite a published release.
+`latest` stays at the previous verified release until promotion succeeds.
 
 ## 5. Version metadata
 

diff --git a/docs/release-contract.md b/docs/release-contract.md
@@ -1,5 +1,10 @@
 # Release and verification contract
 
+> Release boundary (2026-09-13): this describes unreleased main-branch behavior.
+> Console v2.4.0 does not contain these changes. See
+> [the changelog](../CHANGELOG.md#unreleased) and [component matrix](https://silo.pgsty.com/compatibility/versions/).
+
+
 This contract applies to releases built from this source revision onward. Older
 releases do not retroactively acquire signatures or provenance.
 

diff --git a/docs/ui-downloads-and-recovery.md b/docs/ui-downloads-and-recovery.md
@@ -1,5 +1,10 @@
 # Browser downloads, recovery and UI text
 
+> Release boundary (2026-09-13): this describes unreleased main-branch behavior.
+> Console v2.4.0 does not contain these changes. See
+> [the changelog](../CHANGELOG.md#unreleased) and [component matrix](https://silo.pgsty.com/compatibility/versions/).
+
+
 Multi-selection ZIPs use a file writer when the browser offers the File System
 Access API. The response is streamed with backpressure, and cancelling a queued
 or active transfer aborts the request and file writer. A failed or incomplete

diff --git a/systemd/README.md b/systemd/README.md
@@ -1,5 +1,10 @@
 # Packaged Linux service
 
+> Release boundary (2026-09-13): this is the main-branch unit and package contract.
+> The certificate-directory transition and service hardening below are unreleased;
+> Console v2.4.0 retains its earlier unit. See [the changelog](../CHANGELOG.md#unreleased).
+
+
 DEB and RPM retain `/etc/systemd/system/minio-console.service` and
 `/etc/default/console`. Existing service names and configuration files continue
 to work. APK installs the same files for compatibility, but stock Alpine uses