Caddy v2.11.9-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/caddy:v2.11.9-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/caddy:v2.11.9-CE-ubuntu24.04-r2
  • Index digestsha256:2f14dde620324719bb141babbefd60af160da6c506217ba69dc8c8602cb6fd8b
  • linux/amd64 digestsha256:6c9edd7c0968fb48499e41294a267876b7f8c165da8c123f00b046cc985654f9
  • ArchiveReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now126187f4391b1d0a2aad1da0bfcdc534d16a503c19d4c7dc79acc408f14437f7
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T16:42:00Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.trail.json
ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.trail.jsonReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.trail.mdCaddy product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductCaddy (caddy) [MANIFEST.json]
  • Release tagv2.11.9-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/caddy:v2.11.9-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:2f14dde620324719bb141babbefd60af160da6c506217ba69dc8c8602cb6fd8b [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:6c9edd7c0968fb48499e41294a267876b7f8c165da8c123f00b046cc985654f9 [ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.tar.gz (bytes 461481322) [MANIFEST.json]
  • Archive sha256 at publish126187f4391b1d0a2aad1da0bfcdc534d16a503c19d4c7dc79acc408f14437f7 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/caddyserver/caddy [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv2.11.9 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit0d98caea58f794f88e709b1bef2880996a471bca [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash5d2facdc29aac86a8324199b17b926492644473e77c2f6684159598b839ed808 (files 740) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:dbf55e0a303800c07ba7cd64927a951060b3662d218c5d381f5a791aecaddb2c [ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793833511 (utc 2026-11-04T23:05:11Z) [ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit 60d7a04b778e5437820c2145a8cdf69830b66625 · dirty yes · first drive 3979
    • commit 9e1e08daa6fd77ad7901229048721017ec2e4d84 · dirty yes · first drive 3985
    • commit 2e925c4ba6397efc51c0a48c281a06ea1514ae75 · dirty yes · first drive 4024
    • commit 33f90e4df8880eb3af828fc61ea626b22c124785 · dirty yes · first drive 4047
    • commit 97d8bfad381efca645cdc6860d2c1ee4243b979f · dirty yes · first drive 4059
    • commit 762b14205276731d25047ecbc7e53d9425b5b471 · dirty yes · first drive 4069
    • commit 5163af4d4c1993a6202ab252a3207b9300f6e3e6 · dirty yes · first drive 4072
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain915 (created 2026-11-09T07:51:48Z · trigger customer_request · upstream version v2.11.9) [chains, chains #915]
  • Requestbuild request #551 (rebuild) (requested at 2026-11-08T04:05:50Z · requested by kitforge-agent · version v2.11.9) [build_requests, build_requests #551]
  • Reasonrevision v2.11.9-CE-ubuntu24.04-r2: same upstream version rebuilt on the chiselled runtime (slim base; retarget.py --rev-bump) [build_requests, build_requests #551 request_reason]
  • Supersedesreadystack/caddy:v2.11.9-CE-ubuntu24.04-r1 (chain 833) [chains, chains #833]

The path through the harness

Fully recorded

1 chain · 7 drives · 18 stages · 4 rewinds

Chain 915 release · ready_to_ship

Created 2026-11-09T07:51:48Z, upstream v2.11.9, build request 551 [chains, chains #915]

DriveStartedMinutesBuild hostHow it stopped
39792026-11-09T07:52:09Z39build host 4 withhold-publish stall at usecase_validate; first failed check test_results:usecase_thresholds:80,70; 19 ticks [drive_runs, drive_runs #3979]
39852026-11-09T08:48:11Z16.6build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 3 ticks [drive_runs, drive_runs #3985]
40242026-11-09T13:37:22Z4.7build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4024]
40472026-11-09T15:00:43Z3.9build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4047]
40592026-11-09T15:39:25Z3.2build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4059]
40692026-11-09T16:12:17Z2.8build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4069]
40722026-11-09T16:38:03Z—build host 4 publish-held not recorded [drive_runs, drive_runs #4072]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-09T07:52:20Z2026-11-09T07:52:20Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json c1774f95d54e…
acquire 2026-11-09T07:52:25Z2026-11-09T07:52:26Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 9bba97c799c9…
license_file cfc7749b96f6…
custody_inputs aa4580bd3507…
source_tree_hash 13bf6fd04d99…
source_file_manifest 011bd62b9298…
plan 2026-11-09T07:53:10Z2026-11-09T07:53:11Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report a3d335b79c15…
input_pin_plan e68bc7b1c301…
toolchain_lock ab726de66213…
assemble_kit 2026-11-09T07:55:46Z2026-11-09T07:55:47Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 1666b9738a0f…
build_recipe d5e0f9426f85…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health cda8ee28a484…
verify_offline_sh 3e8184ea230c…
base_image_digests 0dcbe2e588a4…
dockerfile_offline 1666b9738a0f…
first_build_digest 4b73909edcce…
remediate 2026-11-09T07:56:35Z2026-11-09T07:56:36Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 8e621d3bfb21…
security_report c8acd29c5d33…
build_kit 2026-11-09T08:00:21Z2026-11-09T08:00:22Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 9b9bbbb65d0b…
locked_digest b4dc352fd282…
freeze_manifest eb4516769ebb…
offline_rebuild_transcript 6c51a36fe1af…
verdict 2026-11-09T08:00:55Z2026-11-09T08:00:56Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict baf8a1042ebf…
publish_image 2026-11-09T08:01:30Z2026-11-09T08:01:31Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 7fa1e131c516…
promotion_record 21c15fa40862…
boot_instance 2026-11-09T08:01:37Z2026-11-09T08:48:27Z3 — instance_handle 7e783cf7ceb2…
sbom 2026-11-09T08:01:51Z2026-11-09T08:01:52Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 1aa96c8a1737…
sbom_json a12e662d534d…
schema_discovery 2026-11-09T08:01:54Z2026-11-09T08:01:55Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 9dfb26084a20…
dependency_tree 58ece5c4716f…
table_classification 0b214d9d7e26…
admin_handbook 2026-11-09T08:14:48Z2026-11-09T08:14:49Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 6efa5f8a4ac6…
admin_handbook 9477cf4b9d7a…
db_handbook 2026-11-09T08:29:42Z2026-11-09T08:29:42Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 6558e07ba838…
seed_isolation e8e4bfd9358f…
seed_data 2026-11-09T08:29:49Z2026-11-09T08:29:50Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 9367b17dfde9…
seed_cases_json d083de8acdaa…
seed_validate 2026-11-09T08:29:52Z2026-11-09T08:29:53Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 5ad1df8364af…
usecase_validate 2026-11-09T08:30:12Z2026-11-09T08:48:49Z5
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b13495fe639b…
passed_tests 237db959f6ab…
test_results ba44783d80a8…
usecase_contract 8947860a99f8…
finalize_docs 2026-11-09T08:56:18Z2026-11-09T08:56:19Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json e7a2111ef03f…
release_notes c7c91f35e83c…
api_integration_guide 91b812572e2a…
package_archive invalidated 2026-11-09T16:37:38Z 2026-11-09T09:04:43Z2026-11-09T16:15:01Z5
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar e14c63f7796c…
checksums 87c8d74181d2…
verify_md 861359d25b29…
rebuild_md 08f87c45538b…
manifest_txt 556b768a576c…
actions_jsonl 871ae1d99331…
provenance_md 8e3775e5eb2d…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 380938421a59…

[stage_runs]

Rewinds

  • 2026-11-09T14:17:37Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29098]
  • 2026-11-09T15:36:43Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29298]
  • 2026-11-09T16:03:12Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29328]
  • 2026-11-09T16:37:38Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29393]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T16:15:01Z.

240 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 011228 —
remediate2001 014917 L-A08, L-038, L-036, L-034, L-032
admin_handbook814003 13641538 —
db_handbook1055203 18799748 —
usecase_validate5001 07867 —
finalize_docs451003 0303914 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $7.02 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T13:42:41Z 0623 findings to repackage [held_rounds, held_rounds #1626] $2.47 3 rounds, $40.00 5092423bacf4…
22026-11-09T15:05:19Z 0014 clean to repackage [held_rounds, held_rounds #1640] $2.29 3 rounds, $40.00 60af5f95fbec…
32026-11-09T15:43:14Z 0116 findings to repackage [held_rounds, held_rounds #1644] $1.94 3 rounds, $40.00 46001b172a50…
42026-11-09T16:15:38Z 001 clean to publish [held_rounds, held_rounds #1649] $0.32 3 rounds, $40.00 e14c63f7796c…

Defects

Fully recorded
  • Ledger entries61 [defects, defects where product_slug=caddy and this tag or chain]
  • Disclosed in the archive61 [docs/defects/defects.json, entries]

61 ledger entries: by severity high 7, low 54; by status fixed-before-release 61.

DefectSeverityStatusFound byFixed in
RSD-caddy-16b3ad9f5c
Admin handbook: The documented command has one `caddy` too few: docker treats `caddy` as the container name and `reload` as the program, so it fails. [defects, defects #210399]		highfixed-before-releaseheld review (review model)—
RSD-caddy-4bad18f522
Admin handbook: A restart cannot keep serving traffic; the sentence promises zero downtime for an operation that stops the container. [defects, defects #210400]		highfixed-before-releaseheld review (review model)—
RSD-caddy-adc9f0cfd3
Admin handbook: Contradicts the next bullet and the Operating facts, which say both named volumes persist. [defects, defects #210401]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-afb442914c
Admin handbook: 'Only Caddy, a POSIX shell and rs-probe' contradicts the appendix command (getcap) and lines 1511/1538 of the same handbook that list getcap/setcap. [defects, defects #210402]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-635664369b
Admin handbook: 'No shell' contradicts the rest of the handbook and the image. [defects, defects #210403]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-01c8ede5d3
Admin handbook: Restart does load the Caddyfile from disk; the sentence contradicts line 1721. [defects, defects #210404]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-ff5bbca3b9
Admin handbook: The quoted example error text is not what this release prints (it is presented as 'a missing certificate file appears as'). [defects, defects #210405]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-e8a4a190fb
Admin handbook: The exit happens only when the configuration needs to write (HTTPS site); with the shipped default the container stays up and healthy. [defects, defects #210406]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-9704be4f95
Admin handbook: The chown example names the read-only Caddyfile directory in a paragraph about writable /data and /config directories. [defects, defects #210407]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-b66e98f3db
Admin handbook: Lumps the certificate case under the Caddyfile-read errors, contradicting the sections above. [defects, defects #210408]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-8194aa1bda
Admin handbook: The success message is on stdout. [defects, defects #210409]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-fc33a1e67b
Database handbook: Without -body the probe prints nothing; the status code is printed by -code. [defects, defects #210410]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-b670e00542
Database handbook: Contradicts the other sections: a valid file prints Valid configuration. [defects, defects #210411]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-2bb13e0114
Database handbook: The success message is on stdout. [defects, defects #210412]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-1259ea3163
Database handbook: A false security claim: nothing is encrypted by the local CA, so a customer could treat backups of /data (which contain private keys) as protected. [defects, defects #210413]		highfixed-before-releaseheld review (review model)—
RSD-caddy-a75316c6d2
Database handbook: A restart on the same volumes does not regenerate certificates, so the stated reason is false. [defects, defects #210414]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-5aa577bd7e
Database handbook: A container being restarted does not serve anything during the restart. [defects, defects #210415]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-c622424d83
Database handbook: The section implies root-owned volumes and a required chown for /data and /config, contradicting lines 493/1175/2022 and the measured ownership. [defects, defects #210416]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-b342029924
Database handbook: Caddyfile directory is read-only and needs read access only; the chown example targets /path/to/caddy-conf. [defects, defects #210417]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-467b565767
Database handbook: The container does not exit for the /config error nor for /data with the default Caddyfile. [defects, defects #210418]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-54c6415222
Database handbook: Overstated: the default configuration keeps running. [defects, defects #210419]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-5110dd82b4
API guide: A security-content claim (advisories included in this image) that no record of this release supports; it is stale text from another release and contradicts the release notes' list of changes. [defects, defects #210420]		highfixed-before-releaseheld review (review model)—
RSD-caddy-0f7d5a91f1
API guide: The text tells the customer to add exactly the one-line form that Caddy rejects, with no caveat. [defects, defects #210421]		highfixed-before-releaseheld review (review model)—
RSD-caddy-0dbd33b990
API guide: False capability statement: it is the probe that is GET-only, not the API; the sentence contradicts the next sentence of the paragraph and the admin handbook. [defects, defects #210422]		highfixed-before-releaseheld review (review model)—
RSD-caddy-6277beaf74
API guide: Unsupported mechanism that contradicts the records and line 560 of the same guide (Linux 4.11). [defects, defects #210423]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-9700ee2666
API guide: Two different unsupported reasons (kernel 4.11 here, a sysctl at line 571) for the same behaviour. [defects, defects #210424]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-ec49c26877
API guide: Contradicts the measured ownership and line 593. [defects, defects #210425]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-b0bd45d855
API guide: States that the Caddyfile is rewritten; the file that is rewritten is autosave.json. [defects, defects #210426]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-f767acfe7a
API guide: The config endpoint returns configuration, not the certificates. [defects, defects #210427]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-390d97a9e9
Database handbook: Ran the image with a root-owned 755 bind mount at /data and the default Caddyfile: status=running, only a warn `mkdir /data/caddy: permission denied`; with a root-owned /config: status=running,… [defects, defects #215591]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-757417eae3
Admin handbook: Same test as above: an unwritable /config (state file /config/caddy/autosave.json) leaves the container running (status=running, health starting->healthy); only the certificate store (HTTPS site,… [defects, defects #215592]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-f8c3a0cc9b
Admin handbook: Ran `:80 { respond "hello" }` : `rs-probe -body -code http://127.0.0.1:80/health` printed 200 (not 404). [defects, defects #215593]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-b9af7a980e
Database handbook: Measured: fresh named volumes mounted at /data and /config are owned 999:999 (`stat -c %u:%g` on both and on /config/caddy/autosave.json). [defects, defects #215594]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-b5a20bd9a2
Admin handbook: `docker exec <c> curl ...` and `docker exec <c> ls` both fail: `exec: "curl": executable file not found in $PATH`. [defects, defects #215595]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-2c8482d742
Database handbook: Edited the mounted Caddyfile with `sed -i` and waited 3 s: GET / still answered the old body (`v1`) until `caddy reload` ran, then `v2`. [defects, defects #215596]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-9989d9e44a
Database handbook: Ran a `:80` block with `respond /health "OK" 200` at column 0 and `respond "v1"` indented 8 spaces: started and ran, /health answered OK. [defects, defects #215597]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-a036e05033
Database handbook: Measured: `curl -I https://localhost` against an HTTPS site returns `alt-svc: h3=":443"; ma=2592000`; the records show no HTTP/3 negotiation inside the TLS handshake (HTTP/3 is discovered through… [defects, defects #215598]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-34ea8f6fff
Admin handbook: A container re-created with `docker rm` + `docker run` on the same volumes served the same certificate with no restart (fingerprint F0:AB:BB... [defects, defects #215599]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-17ef38ea26
API guide: The sentence says reloaded changes last only 'until the next restart' and gives as reason that the Caddyfile is read again at startup, which is the reason they survive; contradicts… [defects, defects #215600]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-87e885b270
API guide: The only command shown is `rs-probe -body http://127.0.0.1:2019/config/`, a GET; API_INTEGRATION_GUIDE.md:885 and ADMIN_HANDBOOK.md:253 say rs-probe sends GET requests only and 'can read the API but… [defects, defects #215601]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-bac4509aec
API guide: API_INTEGRATION_GUIDE.md:885 says the admin API accepts the standard Caddy admin methods (for example POST to /load); a list that presents GET /config/ as the API's endpoint (also… [defects, defects #215602]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-48bdbc5b7c
Admin handbook: Ran `caddy validate` on a broken file: the error was printed on stderr and shows on a terminal (stdout empty, rc=1). [defects, defects #215603]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-61457fbe08
Database handbook: `getcap /usr/bin/caddy` printed `/usr/bin/caddy cap_net_bind_service=ep`; API_INTEGRATION_GUIDE.md:560 and :571 and the Appendix command state the file capability, so 'no elevated privileges'… [defects, defects #215604]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-d9d2e35a62
Database handbook: Ran the documented commands at DB_HANDBOOK.md:1245-1246 (no -R) on a volume holding /x/caddy/certs/f owned 1234:1234: after `docker run --rm -v V:/x alpine chown 999:999 /x`, `stat` printed `/x… [defects, defects #217221]		highfixed-before-releaseheld review (review model)—
RSD-caddy-ece455eb21
Database handbook: Prior round 2 minor, not fixed in this wording: API_INTEGRATION_GUIDE.md:885 says the admin API accepts the standard Caddy admin methods (for example POST to /load); only GET /config/ is in… [defects, defects #217222]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-e4b2db052a
API guide: Prior round 2 minor, not fixed in this wording: API_INTEGRATION_GUIDE.md:885 says the admin API accepts the standard Caddy admin methods (for example POST to /load); only GET /config/ is in… [defects, defects #217223]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-f3d1dfbeb9
API guide: Prior round 2 minor, not fixed in this wording: API_INTEGRATION_GUIDE.md:885 says the admin API accepts the standard Caddy admin methods (for example POST to /load); only GET /config/ is in… [defects, defects #217224]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-aa5d7392fe
Database handbook: The only command shown is the GET `rs-probe -body http://127.0.0.1:2019/config/`; API_INTEGRATION_GUIDE.md:885 says rs-probe 'sends GET requests only, so it can read the API but not change it';… [defects, defects #217225]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-6ec7f07e7b
Database handbook: GET /config/ returns Caddy's JSON configuration, not 'the Caddyfile configuration'; DB_HANDBOOK.md:262 and :724 say /config/ includes changes made through the API, which the Caddyfile (and `caddy… [defects, defects #217226]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-e25240a451
Admin handbook: Round 2 finding (caddy validate on a broken file: error on stderr, shows on a terminal, stdout empty, rc=1) fixed at ADMIN_HANDBOOK.md:2012, DB_HANDBOOK.md:633 and :1856, but this sentence still… [defects, defects #217227]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-7c03231327
Admin handbook: Ran the image (default Caddyfile) and read docker inspect: StartedAt 15:46:27.79, first probe 15:46:32.98 (about 5 s, Docker's start interval), next 15:47:03 (30 s later), both exit 0;… [defects, defects #217228]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-662a2f6853
Admin handbook: Ran the image (default Caddyfile) and read docker inspect: StartedAt 15:46:27.79, first probe 15:46:32.98 (about 5 s, Docker's start interval), next 15:47:03 (30 s later), both exit 0;… [defects, defects #217229]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-ee0bc538d0
Admin handbook: Ran the image (default Caddyfile) and read docker inspect: StartedAt 15:46:27.79, first probe 15:46:32.98 (about 5 s, Docker's start interval), next 15:47:03 (30 s later), both exit 0;… [defects, defects #217230]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-ca5a9b9757
Admin handbook: Ran the image (default Caddyfile) and read docker inspect: StartedAt 15:46:27.79, first probe 15:46:32.98 (about 5 s, Docker's start interval), next 15:47:03 (30 s later), both exit 0;… [defects, defects #217231]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-ce122fbb7a
Database handbook: Ran the image (default Caddyfile) and read docker inspect: StartedAt 15:46:27.79, first probe 15:46:32.98 (about 5 s, Docker's start interval), next 15:47:03 (30 s later), both exit 0;… [defects, defects #217232]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-1c6f30de01
API guide: Ran the image (default Caddyfile) and read docker inspect: StartedAt 15:46:27.79, first probe 15:46:32.98 (about 5 s, Docker's start interval), next 15:47:03 (30 s later), both exit 0;… [defects, defects #217233]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-019fdda3e9
Admin handbook: Same section tells the customer to mount their own Caddyfile directory over /etc/caddy (ADMIN_HANDBOOK.md:1993, 1753); with that mount the file read at start is the host's, not the image's (tested:… [defects, defects #217234]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-0c96e0229c
API guide: provenance/IMAGE_BINARIES.txt lists arch base32 base64 basename basenc cat cut date dirname echo env head nl od printf pwd readlink rm sleep sort tac tail test tr uname ... [defects, defects #217235]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-7b045027fe
Database handbook: provenance/IMAGE_BINARIES.txt lists arch base32 base64 basename basenc cat cut date dirname echo env head nl od printf pwd readlink rm sleep sort tac tail test tr uname ... [defects, defects #217236]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-c7a5262c98
API guide: provenance/IMAGE_BINARIES.txt lists arch base32 base64 basename basenc cat cut date dirname echo env head nl od printf pwd readlink rm sleep sort tac tail test tr uname ... [defects, defects #217237]		lowfixed-before-releaseheld review (review model)—
RSD-caddy-f0b6144b11
API guide: Admin API endpoint availability is attributed to the Caddyfile and is untested. [defects, defects #218920]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:6c9edd7c0968fb48499e41294a267876b7f8c165da8c123f00b046cc985654f9 · published digest sha256:6c9edd7c0968fb48499e41294a267876b7f8c165da8c123f00b046cc985654f9 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 109) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T16:38:24Z · failing Docker Scout counts 9 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T16:38:14Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3767104877 · transparency-log entry · integrated 2026-11-09T16:40:48Z) [ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:2f14dde620324719bb141babbefd60af160da6c506217ba69dc8c8602cb6fd8b · state attached · log index 3767105913 · transparency-log entry
    • kind sbom · digest sha256:2f14dde620324719bb141babbefd60af160da6c506217ba69dc8c8602cb6fd8b · state attached · log index 3767106619 · transparency-log entry
    • kind vsa · digest sha256:2f14dde620324719bb141babbefd60af160da6c506217ba69dc8c8602cb6fd8b · state attached · log index 3767107262 · transparency-log entry
    • kind provenance · digest sha256:6c9edd7c0968fb48499e41294a267876b7f8c165da8c123f00b046cc985654f9 · state attached · log index 3767107729 · transparency-log entry
    • kind sbom · digest sha256:6c9edd7c0968fb48499e41294a267876b7f8c165da8c123f00b046cc985654f9 · state attached · log index 3767108137 · transparency-log entry
    • kind vsa · digest sha256:6c9edd7c0968fb48499e41294a267876b7f8c165da8c123f00b046cc985654f9 · state attached · log index 3767108623 · transparency-log entry
    (at 2026-11-09T16:40:49Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/caddy/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T13:42:46Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:6c9edd7c0968fb48499e41294a267876b7f8c165da8c123f00b046cc985654f9 [clean-room rebuild ledger, runs[700]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T08:01:31Z [stage_runs, stage_runs chain 915 stage publish_image]
  • Archive manifests written2026-11-09T16:39:42Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 63 · probed 2026-11-09T13:39:46Z · source g8) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T16:42:00Z generated: by KitForge release/build_trail.py · generator commit 5163af4d4c1993a6202ab252a3207b9300f6e3e6
  • 2026-11-09T16:43:36Z publication: promoted at 2026-11-09T16:42:33Z · promoted digest sha256:2f14dde620324719bb141babbefd60af160da6c506217ba69dc8c8602cb6fd8b · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 423 · checklist status complete · checklist at 2026-11-09T16:43:36Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/caddy/v2.11.9-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/caddy/v2.11.9-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/caddy/v2.11.9-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-caddy-v2.11.9-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/caddy/v2.11.9-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/caddy/v2.11.9-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)551
chainssadb, ReadyStack's engine database (not published)915
defectssadb, ReadyStack's engine database (not published)caddy v2.11.9-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 915
held_roundssadb, ReadyStack's engine database (not published)chain 915
lesson_recallssadb, ReadyStack's engine database (not published)chain 915
micro_step_runssadb, ReadyStack's engine database (not published)chain 915
release_imagessadb, ReadyStack's engine database (not published)caddy v2.11.9-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 915
stage_runssadb, ReadyStack's engine database (not published)chain 915
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—