cloudflared 2026.10.7-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/cloudflared:2026.10.7-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/cloudflared:2026.10.7-CE-ubuntu24.04-r1
  • Index digestsha256:60e91f70e8764ca3def7b943104ffb79c6abf3d89ee71bf34cda8a6362950723
  • linux/amd64 digestsha256:06d776682d2b4f8ffe4a2c5d0babb2d93565459eca8af2ff0fa822b57dd01ab1
  • ArchiveReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 now71f56cffc660f265a79f51b13be72550efeb00e159166ee9323a9c5779c9f13c
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-07T10:51:55Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.trail.json
ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.trail.jsonReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.trail.mdcloudflared product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • Productcloudflared (cloudflared) [MANIFEST.json]
  • Release tag2026.10.7-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/cloudflared:2026.10.7-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:60e91f70e8764ca3def7b943104ffb79c6abf3d89ee71bf34cda8a6362950723 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:06d776682d2b4f8ffe4a2c5d0babb2d93565459eca8af2ff0fa822b57dd01ab1 [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.tar.gz (bytes 452065764) [MANIFEST.json]
  • Archive sha256 at publish71f56cffc660f265a79f51b13be72550efeb00e159166ee9323a9c5779c9f13c [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/cloudflare/cloudflared [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref2026.10.7 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit872b241f94871665c1c157adefcf90c11f0ead96 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashead232ece2af8a12a4909624ac0dae58773921a5bffd4614f61004e56a6c66e3 (files 487) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:6cc054282400c93223f7ddd803346729ed7f607467583c6ef563c8a24f59a9a6 [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793378609 (utc 2026-10-30T16:43:29Z) [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit 41f5e1f99ee0c35eecf46505cb0cc6b032dda355 · dirty yes · first drive 3571
    • commit 0b84905088b3228fdf50e0647d1f5a7d7d60df02 · dirty yes · first drive 3605
    • commit bd381ae76aa7f67e8731266b0aeeeea5815cd5cc · dirty yes · first drive 3610
    • commit 1965bb7c468fd301b7164e27ef82448632bd34f4 · dirty yes · first drive 3643
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain844 (created 2026-11-07T04:52:07Z · trigger customer_request · upstream version 2026.10.7) [chains, chains #844]
  • Requestbuild request #529 (rebuild) (requested at 2026-11-07T02:02:39Z · requested by kitforge-agent · version 2026.10.7) [build_requests, build_requests #529]
  • Reasonretarget to 2026.10.7: a newer upstream release (rule 1) [build_requests, build_requests #529 request_reason]
  • Supersedesreadystack/cloudflared:2026.10.5-CE-ubuntu24.04-r1 (chain 746) [chains, chains #746]

The path through the harness

Fully recorded

1 chain · 5 drives · 18 stages · 2 rewinds

Chain 844 release · ready_to_ship

Created 2026-11-07T04:52:07Z, upstream 2026.10.7, build request 529 [chains, chains #844]

DriveStartedMinutesBuild hostHow it stopped
35712026-11-07T04:52:29Z6.7build host 1 withhold-publish stage_failed at verdict; first failed check scout_verdict:release_check_passed; 7 ticks [drive_runs, drive_runs #3571]
36052026-11-07T07:15:41Z12build host 1 withhold-publish infra_hub_rate_limit at package_archive; 15 ticks [drive_runs, drive_runs #3605]
36102026-11-07T07:44:30Z3.3build host 1 withhold-publish infra_hub_rate_limit at package_archive; 1 tick [drive_runs, drive_runs #3610]
36152026-11-07T08:05:21Z2.4build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3615]
36432026-11-07T10:48:05Z—build host 1 publish-held not recorded [drive_runs, drive_runs #3643]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-07T04:52:39Z2026-11-07T04:52:40Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json a3b0278aa5d2…
acquire 2026-11-07T04:52:44Z2026-11-07T04:52:44Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 6fb32f90eb40…
license_file 58d1e17ffe51…
custody_inputs 6ad976ab0a20…
source_tree_hash ac50f8ad4e88…
source_file_manifest 7968487fb727…
plan 2026-11-07T04:53:12Z2026-11-07T04:53:13Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 4e902b5f130c…
input_pin_plan 6251ea88f1cd…
toolchain_lock 9c856c2ee87c…
assemble_kit 2026-11-07T04:55:06Z2026-11-07T07:17:43Z2
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 12d97a2095a4…
build_recipe 45bedf6343d6…
system_pinning fa091140511e…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health d50a41b6caf1…
verify_offline_sh 3e8184ea230c…
base_image_digests 38951f88945d…
dockerfile_offline 12d97a2095a4…
first_build_digest 985be00ea353…
remediate 2026-11-07T04:55:33Z2026-11-07T07:17:47Z2
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 8cbdc099f566…
security_report 4a7245b3221c…
build_kit 2026-11-07T04:58:21Z2026-11-07T07:20:22Z2
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 3d43e7e8b008…
locked_digest ede15c93de51…
freeze_manifest 8786e9ea49bb…
offline_rebuild_transcript 54b1c1031d58…
verdict 2026-11-07T04:59:11Z2026-11-07T07:21:03Z2
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 859dae6a018f…
publish_image 2026-11-07T07:21:39Z2026-11-07T07:21:39Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 5b7fd4ab4ef4…
promotion_record d5f64aff9eb1…
boot_instance 2026-11-07T07:21:50Z2026-11-07T07:21:53Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 31365b03f08d…
sbom 2026-11-07T07:22:03Z2026-11-07T07:22:04Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md d88952c8722a…
sbom_json 5ee7f1ecf817…
schema_discovery 2026-11-07T07:22:07Z2026-11-07T07:22:08Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 3e14821deba7…
dependency_tree 519ec69aae9f…
table_classification 52a8b59c22a1…
admin_handbook 2026-11-07T07:22:15Z2026-11-07T07:22:16Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 78587680e440…
admin_handbook c02571f33cf0…
db_handbook 2026-11-07T07:22:25Z2026-11-07T07:22:26Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 60c50610177b…
seed_isolation 9d9634c8d2ba…
seed_data 2026-11-07T07:22:33Z2026-11-07T07:22:33Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 81b58bb65ad3…
seed_cases_json d9f368b6156e…
seed_validate 2026-11-07T07:22:36Z2026-11-07T07:22:37Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract a285db1d566c…
usecase_validate 2026-11-07T07:22:58Z2026-11-07T07:22:59Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 80c67d34191b…
test_results 658752384295…
usecase_contract 6d7e2f05a3d4…
finalize_docs 2026-11-07T07:23:04Z2026-11-07T07:23:04Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 9c897aa65489…
release_notes 72997bb0151d…
api_integration_guide 83537378d57f…
package_archive invalidated 2026-11-07T10:47:41Z 2026-11-07T08:07:42Z2026-11-07T08:07:44Z1
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 3a29eeff7502…
checksums 102cb4f871c7…
verify_md ac78b0b9e0b9…
rebuild_md 84adf65f6d3f…
manifest_txt 67c7214c88a6…
actions_jsonl d252e99536f6…
provenance_md 54a52afdc929…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json de0c568dd19b…

[stage_runs]

Rewinds

  • 2026-11-07T07:15:45Z: verdict to assemble_kit on strategy_changed (strategy changed (6b3fde0b8f31 -> edc5e13598c0)) [stage_events, stage_events #24201]
  • 2026-11-07T10:47:41Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24580]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-07T08:07:44Z.

5 calls over 3 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 06917 L-A183, L-A15
remediate2001 07081 L-A183, L-A15
usecase_validate1001 01834 L-A59

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

1 round, 1 counted, $0.33 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-07T08:08:05Z 000 clean to publish [held_rounds, held_rounds #1450] $0.33 3 rounds, $40.00 3a29eeff7502…

Defects

Fully recorded
  • Ledger entries1 [defects, defects where product_slug=cloudflared and this tag or chain]
  • Disclosed in the archive1 [docs/defects/defects.json, entries]

1 ledger entry: by severity medium 1; by status open 1.

DefectSeverityStatusFound byFixed in
RSD-cloudflared-9be226d8d8
Unauthenticated metrics port 20241 by default [defects, defects #165824]		mediumopenbuild strategy record—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:06d776682d2b4f8ffe4a2c5d0babb2d93565459eca8af2ff0fa822b57dd01ab1 · published digest sha256:06d776682d2b4f8ffe4a2c5d0babb2d93565459eca8af2ff0fa822b57dd01ab1 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 73) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-07T10:48:24Z · failing Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-07T10:48:16Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3736093120 · transparency-log entry · integrated 2026-11-07T10:50:41Z) [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:60e91f70e8764ca3def7b943104ffb79c6abf3d89ee71bf34cda8a6362950723 · state attached · log index 3736095842 · transparency-log entry
    • kind sbom · digest sha256:60e91f70e8764ca3def7b943104ffb79c6abf3d89ee71bf34cda8a6362950723 · state attached · log index 3736098694 · transparency-log entry
    • kind vsa · digest sha256:60e91f70e8764ca3def7b943104ffb79c6abf3d89ee71bf34cda8a6362950723 · state attached · log index 3736102027 · transparency-log entry
    • kind provenance · digest sha256:06d776682d2b4f8ffe4a2c5d0babb2d93565459eca8af2ff0fa822b57dd01ab1 · state attached · log index 3736105334 · transparency-log entry
    • kind sbom · digest sha256:06d776682d2b4f8ffe4a2c5d0babb2d93565459eca8af2ff0fa822b57dd01ab1 · state attached · log index 3736108116 · transparency-log entry
    • kind vsa · digest sha256:06d776682d2b4f8ffe4a2c5d0babb2d93565459eca8af2ff0fa822b57dd01ab1 · state attached · log index 3736110309 · transparency-log entry
    (at 2026-11-07T10:50:42Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/cloudflared/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-07T08:08:09Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:06d776682d2b4f8ffe4a2c5d0babb2d93565459eca8af2ff0fa822b57dd01ab1 [clean-room rebuild ledger, runs[616]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-07T07:21:39Z [stage_runs, stage_runs chain 844 stage publish_image]
  • Archive manifests written2026-11-07T10:49:25Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 743 · probed 2026-11-07T04:56:53Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-07T10:51:55Z generated: by KitForge release/build_trail.py · generator commit 1965bb7c468fd301b7164e27ef82448632bd34f4
  • 2026-11-07T10:53:10Z publication: promoted at 2026-11-07T10:52:29Z · promoted digest sha256:60e91f70e8764ca3def7b943104ffb79c6abf3d89ee71bf34cda8a6362950723 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 345 · checklist status complete · checklist at 2026-11-07T10:53:10Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)529
chainssadb, ReadyStack's engine database (not published)844
defectssadb, ReadyStack's engine database (not published)cloudflared 2026.10.7-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 844
held_roundssadb, ReadyStack's engine database (not published)chain 844
lesson_recallssadb, ReadyStack's engine database (not published)chain 844
micro_step_runssadb, ReadyStack's engine database (not published)chain 844
release_imagessadb, ReadyStack's engine database (not published)cloudflared 2026.10.7-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 844
stage_runssadb, ReadyStack's engine database (not published)chain 844
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—