Argo CD v3.6.1-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/argocd:v3.6.1-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/argocd:v3.6.1-CE-ubuntu24.04-r1
  • Index digestsha256:8a924e34d30e2253c79c338b7a75ce033e7f7d1d9f399d7e5da55e301f9b327f
  • linux/amd64 digestsha256:348d8c959447e38f5f1c1245892ca4440261f8e6434a0cdf73a82d1b0aeb9045
  • ArchiveReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 now95cfafd97121d5f36db763b57a8002043d44132cae32ea86e2f7e9d44637d5b5
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T04:49:06Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.trail.json
ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.trail.jsonReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.trail.mdArgo CD product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductArgo CD (argocd) [MANIFEST.json]
  • Release tagv3.6.1-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/argocd:v3.6.1-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:8a924e34d30e2253c79c338b7a75ce033e7f7d1d9f399d7e5da55e301f9b327f [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:348d8c959447e38f5f1c1245892ca4440261f8e6434a0cdf73a82d1b0aeb9045 [ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.tar.gz (bytes 703898082) [MANIFEST.json]
  • Archive sha256 at publish95cfafd97121d5f36db763b57a8002043d44132cae32ea86e2f7e9d44637d5b5 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/argoproj/argo-cd.git [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.6.1 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit94037c4d4e1af4bd0651d37a179fbd9e347e668c [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash8baca6bcb6e31bdd7ec8d5004c09527b228242e82c05958277ebd89e465f7381 (files 6092) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:cfcca8cb933624c1da0ae5561bf8f17abaf58b7b94f0a069a370c2f0dcfa12e5 [ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793798466 (utc 2026-11-04T13:21:06Z) [ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit 18261d862c425c2423a19eba7edc819a59a582a4 · dirty yes · first drive 3726
    • commit 14ac19f4178268c2dbfa7e7cae4be76d466ea445 · dirty yes · first drive 3795
    • commit b29f462ba272213173a4375440fb6180b85d1510 · dirty yes · first drive 3914
    • commit 9f41ab74d9d3a9eb9a02d518e82effca6659bf55 · dirty yes · first drive 3928
    • commit cff175c7916b19e138784c06e8e05392550947fe · dirty yes · first drive 3940
    • commit bd24e9651b38719b0b2529486810572f75b6178d · dirty yes · first drive 3952
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain872 (created 2026-11-08T07:40:27Z · trigger customer_request · upstream version v3.6.1) [chains, chains #872]
  • Requestbuild request #562 (rebuild) (requested at 2026-11-08T06:41:57Z · requested by kitforge-agent · version v3.6.1) [build_requests, build_requests #562]
  • Reasonretarget to v3.6.1: a newer upstream release (rule 1) [build_requests, build_requests #562 request_reason]
  • Supersedesreadystack/argocd:v3.5.6-CE-ubuntu24.04-r1 (chain 771) [chains, chains #771]

The path through the harness

Fully recorded

1 chain · 6 drives · 18 stages · 3 rewinds

Chain 872 release · ready_to_ship

Created 2026-11-08T07:40:27Z, upstream v3.6.1, build request 562 [chains, chains #872]

DriveStartedMinutesBuild hostHow it stopped
37262026-11-08T07:41:03Z4.9build host 3 withhold-publish stage_failed at assemble_kit; first failed check exists:first_build_digest; 4 ticks [drive_runs, drive_runs #3726]
37952026-11-08T12:23:16Z3.4build host 3 withhold-publish stage_failed at assemble_kit; first failed check exists:first_build_digest; 1 tick [drive_runs, drive_runs #3795]
39142026-11-09T01:12:16Z59.2build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 15 ticks [drive_runs, drive_runs #3914]
39282026-11-09T02:31:01Z18.5build host 3 withhold-publish ready_to_ship at package_archive; 3 ticks [drive_runs, drive_runs #3928]
39402026-11-09T03:43:31Z9.3build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3940]
39522026-11-09T04:39:50Z—build host 3 publish-held not recorded [drive_runs, drive_runs #3952]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-08T07:41:13Z2026-11-08T07:41:14Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 50b7a265da8a…
acquire 2026-11-08T07:41:23Z2026-11-08T07:41:24Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 4f8b31f1f82c…
license_file c996fc213c94…
custody_inputs 242d1ab4bbcc…
source_tree_hash 07f5ee070cd1…
source_file_manifest 4159850b15ea…
plan 2026-11-08T07:42:00Z2026-11-08T07:42:01Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report e36acac82f56…
input_pin_plan 3be1f5f2a8fc…
toolchain_lock f806e60f393a…
assemble_kit 2026-11-08T07:45:54Z2026-11-09T01:26:24Z3
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile ad3a8ce627b5…
build_recipe e7e1997a4e01…
system_pinning 1d93608cf24a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 2a148576e32d…
verify_offline_sh 3e8184ea230c…
base_image_digests a677a5d6fcd7…
dockerfile_offline ad3a8ce627b5…
first_build_digest bdce74d0f114…
remediate 2026-11-09T01:27:15Z2026-11-09T01:27:15Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log e5421afab05b…
security_report b89a1473d003…
build_kit 2026-11-09T01:47:09Z2026-11-09T01:47:10Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp c50111748170…
locked_digest b47c39409328…
freeze_manifest 127c2e0fbf88…
offline_rebuild_transcript 40d7ddf2137b…
verdict 2026-11-09T01:49:14Z2026-11-09T01:49:16Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict fb1ffd233877…
publish_image 2026-11-09T01:50:17Z2026-11-09T01:50:18Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 0a723983ad13…
promotion_record 0be8f9322e85…
boot_instance 2026-11-09T01:50:43Z2026-11-09T02:31:46Z3 — instance_handle aedf99c93b06…
sbom 2026-11-09T01:51:15Z2026-11-09T01:51:16Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 74a9171d24fb…
sbom_json 8a9162d238e8…
schema_discovery 2026-11-09T01:51:20Z2026-11-09T01:51:21Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 469951e7f1b2…
dependency_tree feda475e200a…
table_classification bb614f92ba5c…
admin_handbook 2026-11-09T01:59:13Z2026-11-09T01:59:13Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map e74328258c1c…
admin_handbook 575e9e085f00…
db_handbook 2026-11-09T02:05:12Z2026-11-09T02:05:13Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook a79be6c393aa…
seed_isolation e32717c426bc…
seed_data 2026-11-09T02:05:25Z2026-11-09T02:05:25Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 6a13050709c8…
seed_cases_json 6d5b93d6005a…
seed_validate 2026-11-09T02:05:28Z2026-11-09T02:05:29Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 700a4cfde5e0…
usecase_validate 2026-11-09T02:06:26Z2026-11-09T02:06:27Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests 9dd8ded7c434…
passed_tests 307e6b23d3b8…
test_results 175bc92d2dac…
usecase_contract ded4bda0074e…
finalize_docs 2026-11-09T02:06:32Z2026-11-09T02:31:52Z2
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 6b73ce4e3ac0…
release_notes 0c3e17025a94…
api_integration_guide 5e2d90f4138c…
package_archive invalidated 2026-11-09T04:39:25Z 2026-11-09T02:11:29Z2026-11-09T03:52:49Z3
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar bac345bc3921…
checksums 6d7db8689294…
verify_md 62504b410b78…
rebuild_md 6f75e6b103fc…
manifest_txt a7a8187cce27…
actions_jsonl e008ee8ccce1…
provenance_md 780c10983488…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 37f1308ef33b…

[stage_runs]

Rewinds

  • 2026-11-09T02:22:04Z: package_archive to finalize_docs on docs_redo (scripts/redo-docs.py --stage finalize_docs --delete deliverables/api-guide/API_INTEGRATION_GUIDE.md) [stage_events, stage_events #27860]
  • 2026-11-09T03:23:58Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27917]
  • 2026-11-09T04:39:25Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27987]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T03:52:49Z.

93 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 08019 L-A183, L-A15
remediate2001 012080 L-A183, L-A15
admin_handbook532603 9281541 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook321203 3214719 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate4001 014306 L-A59

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $2.50 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T02:51:51Z 10111 findings to repackage [held_rounds, held_rounds #1569] $1.57 3 rounds, $40.00 3483ea8f1a74…
22026-11-09T03:54:16Z 004 clean to publish [held_rounds, held_rounds #1575] $0.93 3 rounds, $40.00 bac345bc3921…

Defects

Fully recorded
  • Ledger entries24 [defects, defects where product_slug=argocd and this tag or chain]
  • Disclosed in the archive24 [docs/defects/defects.json, entries]

24 ledger entries: by severity critical 8, high 11, low 5; by status fixed-before-release 24.

DefectSeverityStatusFound byFixed in
RSD-argocd-558418dea6
Admin handbook: The documented restore command lacks `docker run -i`, so the backup is never read: the restore fails with a gzip/tar error and leaves an empty volume (an `-i` placed after `tar` is passed to tar,… [defects, defects #191625]		criticalfixed-before-releaseheld review (review model)—
RSD-argocd-b5583ee367
Admin handbook: The documented restore command lacks `docker run -i`, so the backup is never read: the restore fails with a gzip/tar error and leaves an empty volume (an `-i` placed after `tar` is passed to tar,… [defects, defects #191626]		criticalfixed-before-releaseheld review (review model)—
RSD-argocd-48354dc0c9
Admin handbook: The documented restore command lacks `docker run -i`, so the backup is never read: the restore fails with a gzip/tar error and leaves an empty volume (an `-i` placed after `tar` is passed to tar,… [defects, defects #191627]		criticalfixed-before-releaseheld review (review model)—
RSD-argocd-37c667c6f4
Database handbook: The documented restore command lacks `docker run -i`, so the backup is never read: the restore fails with a gzip/tar error and leaves an empty volume (an `-i` placed after `tar` is passed to tar,… [defects, defects #191628]		criticalfixed-before-releaseheld review (review model)—
RSD-argocd-508602be44
Database handbook: The documented restore command lacks `docker run -i`, so the backup is never read: the restore fails with a gzip/tar error and leaves an empty volume (an `-i` placed after `tar` is passed to tar,… [defects, defects #191629]		criticalfixed-before-releaseheld review (review model)—
RSD-argocd-a02d528615
Database handbook: The documented restore command lacks `docker run -i`, so the backup is never read: the restore fails with a gzip/tar error and leaves an empty volume (an `-i` placed after `tar` is passed to tar,… [defects, defects #191630]		criticalfixed-before-releaseheld review (review model)—
RSD-argocd-4d08a7eab8
Database handbook: The documented restore command lacks `docker run -i`, so the backup is never read: the restore fails with a gzip/tar error and leaves an empty volume (an `-i` placed after `tar` is passed to tar,… [defects, defects #191631]		criticalfixed-before-releaseheld review (review model)—
RSD-argocd-58200805f1
Database handbook: The documented restore command lacks `docker run -i`, so the backup is never read: the restore fails with a gzip/tar error and leaves an empty volume (an `-i` placed after `tar` is passed to tar,… [defects, defects #191632]		criticalfixed-before-releaseheld review (review model)—
RSD-argocd-e002ee0da3
Database handbook: The documented password-change body uses a `password` field the API does not read; the request is refused, so the documented credential change fails. [defects, defects #191633]		highfixed-before-releaseheld review (review model)—
RSD-argocd-f39c867e8c
Database handbook: The argocd CLI --server value must be host:port; with an http:// prefix every command fails. [defects, defects #191634]		highfixed-before-releaseheld review (review model)—
RSD-argocd-a09be99f4a
Database handbook: The argocd CLI --server value must be host:port; with an http:// prefix every command fails. [defects, defects #191635]		highfixed-before-releaseheld review (review model)—
RSD-argocd-19d8479026
Admin handbook: The UI has no 'User Settings > Account > Change Password' path; the password form is under User Info (Update Password). [defects, defects #191636]		highfixed-before-releaseheld review (review model)—
RSD-argocd-c4357c519e
Admin handbook: The argocd-manager ServiceAccount is created in kube-system by default, not in `argocd`. [defects, defects #191637]		highfixed-before-releaseheld review (review model)—
RSD-argocd-a2c59eb971
Admin handbook: No PUT /api/v1/account/{name} route exists. [defects, defects #191638]		highfixed-before-releaseheld review (review model)—
RSD-argocd-bc9865d214
Admin handbook: No POST /api/v1/applications/{application.metadata.name} route exists (create is POST /api/v1/applications). [defects, defects #191639]		highfixed-before-releaseheld review (review model)—
RSD-argocd-9b89c5a53c
Admin handbook: No POST /api/v1/applicationsets/{name} route exists (the spec has GET and DELETE only). [defects, defects #191640]		highfixed-before-releaseheld review (review model)—
RSD-argocd-963241753d
Admin handbook: `docker run --user` with another UID does not work: the container exits 2. [defects, defects #191641]		highfixed-before-releaseheld review (review model)—
RSD-argocd-e832da9afd
Admin handbook: Advice to bind-mount a UID-999 directory or use --user contradicts the 'do not bind-mount' warning and fails when run. [defects, defects #191642]		highfixed-before-releaseheld review (review model)—
RSD-argocd-af0845ae3b
Admin handbook: Claims the user can be overridden at run time; the container exits 2. [defects, defects #191643]		highfixed-before-releaseheld review (review model)—
RSD-argocd-02df2fe780
Admin handbook: States as certain that argocd-server exits and bootstrap must be started after a k3s restart; not reproduced. [defects, defects #191644]		lowfixed-before-releaseheld review (review model)—
RSD-argocd-fe7d8b5207
Database handbook: The Logging list names a file that does not exist (argocd-application-controller.log), contradicting the real names listed elsewhere. [defects, defects #193297]		lowfixed-before-releaseheld review (review model)—
RSD-argocd-2935541131
Database handbook: The Logging list gives a non-existent log file name; cat of it fails. [defects, defects #193298]		lowfixed-before-releaseheld review (review model)—
RSD-argocd-6911cebf63
Database handbook: Paraphrase of the round-1 UI password path finding; vague path. [defects, defects #193299]		lowfixed-before-releaseheld review (review model)—
RSD-argocd-4e4b04786b
Database handbook: States as certain that bootstrap must run again (and at 995 that argocd-server may exit) after a k3s restart; not reproduced (round-1 minor, only partly softened). [defects, defects #193300]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:348d8c959447e38f5f1c1245892ca4440261f8e6434a0cdf73a82d1b0aeb9045 · published digest sha256:348d8c959447e38f5f1c1245892ca4440261f8e6434a0cdf73a82d1b0aeb9045 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 546) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T04:40:23Z · failing Docker Scout counts 123 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T04:40:02Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3761223618 · transparency-log entry · integrated 2026-11-09T04:47:14Z) [ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:8a924e34d30e2253c79c338b7a75ce033e7f7d1d9f399d7e5da55e301f9b327f · state attached · log index 3761224475 · transparency-log entry
    • kind sbom · digest sha256:8a924e34d30e2253c79c338b7a75ce033e7f7d1d9f399d7e5da55e301f9b327f · state attached · log index 3761225374 · transparency-log entry
    • kind vsa · digest sha256:8a924e34d30e2253c79c338b7a75ce033e7f7d1d9f399d7e5da55e301f9b327f · state attached · log index 3761226809 · transparency-log entry
    • kind provenance · digest sha256:348d8c959447e38f5f1c1245892ca4440261f8e6434a0cdf73a82d1b0aeb9045 · state attached · log index 3761228062 · transparency-log entry
    • kind sbom · digest sha256:348d8c959447e38f5f1c1245892ca4440261f8e6434a0cdf73a82d1b0aeb9045 · state attached · log index 3761228925 · transparency-log entry
    • kind vsa · digest sha256:348d8c959447e38f5f1c1245892ca4440261f8e6434a0cdf73a82d1b0aeb9045 · state attached · log index 3761229927 · transparency-log entry
    (at 2026-11-09T04:47:15Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/argocd/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T02:51:56Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:348d8c959447e38f5f1c1245892ca4440261f8e6434a0cdf73a82d1b0aeb9045 [clean-room rebuild ledger, runs[681]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T01:50:18Z [stage_runs, stage_runs chain 872 stage publish_image]
  • Archive manifests written2026-11-09T04:43:35Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 905 · probed 2026-11-09T01:37:47Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T04:49:06Z generated: by KitForge release/build_trail.py · generator commit 33cc96c2cc3645c7bfbc3866df5a3c028834af3e
  • 2026-11-09T04:51:08Z publication: promoted at 2026-11-09T04:49:41Z · promoted digest sha256:8a924e34d30e2253c79c338b7a75ce033e7f7d1d9f399d7e5da55e301f9b327f · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 404 · checklist status complete · checklist at 2026-11-09T04:51:08Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/argocd/v3.6.1-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/argocd/v3.6.1-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/argocd/v3.6.1-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-argocd-v3.6.1-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/argocd/v3.6.1-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/argocd/v3.6.1-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)562
chainssadb, ReadyStack's engine database (not published)872
defectssadb, ReadyStack's engine database (not published)argocd v3.6.1-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 872
held_roundssadb, ReadyStack's engine database (not published)chain 872
lesson_recallssadb, ReadyStack's engine database (not published)chain 872
micro_step_runssadb, ReadyStack's engine database (not published)chain 872
release_imagessadb, ReadyStack's engine database (not published)argocd v3.6.1-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 872
stage_runssadb, ReadyStack's engine database (not published)chain 872
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—