Coder v2.38.3-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/coder:v2.38.3-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/coder:v2.38.3-CE-ubuntu24.04-r2
  • Index digestsha256:6618c3662ee33f07e0fdf5ea4f0388f3a8c64c285ec7cbd4c0ad7aeccc82e87d
  • linux/amd64 digestsha256:b8cc242203b258c2433715452e8cc7237baf30d5076a679611ee057f92848679
  • ArchiveReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 nowfcfd882b846118cafc70b90e410ee6b72fc03865614407f5c3661f7f8b37182d
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since 2026-11-03T00:47:14Z)
  • Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
  • Sections9 sections, 4 fully recorded; 10 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.trail.json
ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.trail.jsonReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.trail.mdCoder product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

1 item not recorded
  • ProductCoder (coder) [MANIFEST.json]
  • Release tagv2.38.3-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/coder:v2.38.3-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:6618c3662ee33f07e0fdf5ea4f0388f3a8c64c285ec7cbd4c0ad7aeccc82e87d [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:b8cc242203b258c2433715452e8cc7237baf30d5076a679611ee057f92848679 [ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.tar.gz (bytes 997806049) [MANIFEST.json]
  • Archive sha256 at publisha86759070f939bde1faac61ce267c74587a1a65de650d4c2c39f5c9f404d4af1 [MANIFEST.json, repack_history[0].previous_tarball_sha256]
  • Archive sha256 nowe1ec8be412a02def15dad4713edd534039c17d41ba800fc08d380e20608d799f [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack history
    • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 a86759070f939bde1faac61ce267c74587a1a65de650d4c2c39f5c9f404d4af1 · sha256 e1ec8be412a02def15dad4713edd534039c17d41ba800fc08d380e20608d799f · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
    [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/coder/coder [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv2.38.3 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit5bb296e4d5e55e7de39e0d1ab89493e205d6c4ac [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash5115fe51d3636ef099aa978f31de343cd3dbafdeb77ecf9d471005836b38954d (files 12340) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:0e812c70903c90cc449ce0a284fa76f55982078e7002d011972649eacf025d68 [ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793058723 (utc 2026-10-26T23:52:03Z) [ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded
  • Chain720 (created 2026-10-27T19:59:48Z · trigger customer_request · upstream version v2.38.3) [chains, chains #720]
  • Requestbuild request #403 (rebuild) (requested at 2026-10-27T19:38:59Z · requested by kitforge-agent · version v2.38.3) [build_requests, build_requests #403]
  • Reasonrevision v2.38.3-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #403 request_reason]
  • Supersedesreadystack/coder:v2.38.3-CE-ubuntu24.04-r1 (chain 702) [chains, chains #702]

The path through the harness

2 items not recorded

1 chain · 3 drives · 18 stages · 2 rewinds

Chain 720 release · shipped

Created 2026-10-27T19:59:48Z, upstream v2.38.3, build request 403 [chains, chains #720]

DriveStartedMinutesBuild hostHow it stopped
9842026-10-27T20:00:52Z39.7build host 5 withhold-publish stage_failed at verdict [drive_runs, drive_runs #984] rebuilt from a build line's log
10052026-10-28T08:33:46Z59.9build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #1005] rebuilt from a build line's log
10072026-10-28T09:59:08Z18.1build host 5 publish-held shipped [drive_runs, drive_runs #1007] rebuilt from a build line's log

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-27T20:00:58Z2026-10-27T20:01:00Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-27T20:01:17Z2026-10-27T20:01:18Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-27T20:02:11Z2026-10-27T20:02:12Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-27T20:22:00Z2026-10-28T08:53:48Z2
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 —
remediate 2026-10-27T20:23:01Z2026-10-28T08:53:51Z2
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 —
build_kit 2026-10-27T20:37:48Z2026-10-28T09:08:39Z2
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 —
verdict 2026-10-27T20:40:33Z2026-10-28T09:10:37Z2
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 —
publish_image 2026-10-28T09:11:37Z2026-10-28T09:11:37Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 —
boot_instance 2026-10-28T09:12:05Z2026-10-28T09:12:06Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 —
sbom 2026-10-28T09:12:39Z2026-10-28T09:12:40Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 —
schema_discovery 2026-10-28T09:12:41Z2026-10-28T09:12:42Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 —
admin_handbook 2026-10-28T09:12:49Z2026-10-28T09:12:50Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 —
db_handbook 2026-10-28T09:13:00Z2026-10-28T09:13:01Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 —
seed_data 2026-10-28T09:13:06Z2026-10-28T09:13:07Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 —
seed_validate 2026-10-28T09:13:09Z2026-10-28T09:13:10Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 —
usecase_validate 2026-10-28T09:13:32Z2026-10-28T09:13:33Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 —
finalize_docs 2026-10-28T09:13:38Z2026-10-28T09:13:39Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 —
package_archive 2026-10-28T09:33:34Z2026-10-28T10:17:12Z2
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 scout_grade_a
  • G8 script_copies
  • G8 three_way_sha
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 —

[stage_runs]

Rewinds

  • 2026-10-28T08:33:56Z: verdict to assemble_kit on strategy_changed (chain 720: strategy changed — rewound from 'verdict' to assemble_kit and dropped the vendored tree so the change actually reaches the build.) [stage_events, stage_events #2331]
  • 2026-10-28T09:58:35Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #1194]
  • Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
  • Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-10-28T10:17:12Z.

6 calls over 3 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
usecase_validate2001 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

2 items not recorded

Role: review model.

1 round, 1 counted, $0.40 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-10-28T09:34:53Z 000 clean to publish [held_rounds, held_rounds #19] rebuilt from a held-review state file $0.40 not recorded not recorded
  • Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
  • Not recorded: the round cap in force at each round (the state files did not keep it)

Defects

Fully recorded
  • Ledger entries44 [defects, defects where product_slug=coder and this tag or chain]
  • Disclosed in the archive3 [docs/defects/defects.json, entries]

44 ledger entries: by severity low 43, high 1; by status wont-fix-by-design 1, open 2, fixed-in-release 41.

DefectSeverityStatusFound byFixed in
RSD-coder-9680184733
Enterprise / non-open-source components are removed from the source before the build: enterprise, LICENSE.enterprise [defects, defects #131097]		lowwont-fix-by-designbuild strategy record—
RSD-coder-9198ff2110
First visitor can claim the administrator account until setup is completed [defects, defects #131098]		highopenbuild strategy record—
RSD-coder-3c5484c986
Admin handbook: The revision added an empty level-2 heading and a third consecutive 'Product Overview' heading, so the page shows blank and repeated headings. [defects, defects #131766]		lowopenheld review (review model)—
RSD-coder-a0f84a5660
Database handbook: The 'available once only' qualifier belongs to POST; read with GET,POST it suggests GET stops working after setup. [defects, defects #131767]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-da8745ac0d
Admin handbook: The handbooks give two run-command forms; the admin and API handbooks keep the database password on the command line (visible in docker inspect and shell history) where the documented run command… [defects, defects #131768]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-e675899872
API guide: The audit log (GET /api/v2/audit) stays empty after token revocation; what is retained is the expired database row. [defects, defects #131769]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-fd117c2fa0
API guide: The endpoint returns only a status message, it does not retrieve the user. [defects, defects #131770]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-68b7eb7c27
Admin handbook: The qualifier 'until the first user is created' applies only to POST /api/v2/users/first; every other listed endpoint (login, buildinfo, updatecheck, authmethods, GET first) is unauthenticated at… [defects, defects #131771]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-cd480e8dd8
Admin handbook: Puts the Terraform checkpoint files and the CLI URL file under .cache (they are under .terraform.d and .config/coderv2) and says the files are re-created at restart, contradicting the Operating… [defects, defects #131772]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-d5505064d5
Admin handbook: /healthz is not answered before the database connection succeeds; it only stays 200 afterwards. [defects, defects #131773]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-4679d128f4
Admin handbook: 'All other API endpoints' is false: GET /api/v2 and the OAuth/OIDC callback routes answer without a token. [defects, defects #131774]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-b4b9b088f2
Admin handbook: A fresh container started with an unreachable database does not report healthy at all: it does not listen until the database connection succeeds. [defects, defects #131775]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-92bb015c37
Admin handbook: 'the external URL' reads as the instance's address; external_url is the upstream source URL and dashboard_url is the configured one. [defects, defects #131776]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-b0b66ceea5
Admin handbook: The sentence follows the REST DELETE, which deletes the key; its next use gets 'API key is invalid.', not 'API key expired at ...' (that is the CLI tokens rm case). [defects, defects #131777]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-620ae5dcdc
Database handbook: Still false as stated: GET /api/v2 answers 200 without a token. [defects, defects #131778]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-97b2c79ca9
Database handbook: Omits the create-admin-user exception stated elsewhere in this handbook (lines 287, 629). [defects, defects #131779]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-dfd4203dd2
Database handbook: external_url is the upstream source URL, not the instance URL; dashboard_url is the configured one. [defects, defects #131780]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-3afca152d2
Database handbook: Neither endpoint can be reached 'as soon as the container starts': the server does not listen until the database connection succeeds. [defects, defects #131781]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-966f616216
API guide: 'All other endpoints under /api/v2' is false (GET /api/v2 answers 200 without a token). [defects, defects #131782]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-2926600c7b
API guide: The sentence follows 'or via REST with DELETE ...', which deletes the key; its next use gets 'API key is invalid.'. [defects, defects #131783]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-1e2f46d48e
API guide: The only create-admin-user example in this section that leaves the password unquoted; a password containing a space, $ or ! [defects, defects #131784]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-5dd8a2fbfa
API guide: Contradicts the seven-endpoint unauthenticated list in this guide: 'Two endpoints ... [defects, defects #131785]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-86a92b4b70
API guide: Invents a composition rule; the Admin Handbook (line 1580) and this guide (line 2017) correctly call it an entropy test. [defects, defects #131786]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-35b37e45c4
API guide: Unquoted, `!x` triggers history expansion in an interactive bash shell ('event not found', or a silent substitution if an earlier command starts with x); a password with a space or $ is also split… [defects, defects #131787]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-a620e669b4
API guide: An unauthenticated endpoint sits in a list introduced as authenticated endpoints. [defects, defects #131788]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-c744f80982
API guide: Same invented composition rule as lines 712 and 771. [defects, defects #131789]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-7a81547b3d
API guide: 'ready to accept requests' reads as readiness; the endpoint is liveness only. [defects, defects #131790]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-49d2972981
API guide: The sentence sits under Session Tokens right after the login example and states one message for every endpoint: the first-user endpoint answers 'Password is invalid' and the strength rule does not… [defects, defects #131791]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-d8f56f7771
API guide: No audit-log entry exists for token creation/revocation/deletion on this release (audit log empty), and a deleted token's row is removed, so 'retained in audit logs' is unsupported. [defects, defects #131792]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-6d92b1bd8b
Admin handbook: Without -i/-t the shell exits at once with no output, so the documented way to 'run a different program' (a shell) gives the operator nothing. [defects, defects #131793]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-06f8ee5a6a
Admin handbook: 'Owner only' is false: a User Admin (a site role an owner can assign in this edition) set a member's password with only {"password":...} (204). [defects, defects #131794]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-289129df83
API guide: False for a User Admin: 204 on a member, 400 on an owner. [defects, defects #131795]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-3255a4c6d5
Admin handbook: The overview gives the bare command as the way to create the owner; run as written under docker exec it prompts for a username with no input and fails with 'error: EOF'. [defects, defects #131796]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-7152daefb1
Admin handbook: Only members get 404; a User Admin (also a non-owner) gets 400 with a different message, so error handling built from this sentence misreads it. [defects, defects #131797]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-2198ea8bf6
API guide: False: a User Admin changed a member's password (204). [defects, defects #131798]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-545f02695f
API guide: A User Admin's token also works for non-owner targets (204). [defects, defects #131799]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-37930e9d5d
API guide: 'Non-owner -> 404' is false for a User Admin: 204 on a member, 400 on an owner. [defects, defects #131800]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-354723a388
API guide: A User Admin (non-owner) gets 400 'Only owners can change the password of an owner.', not 404. [defects, defects #131801]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-bf1fd9f4a4
API guide: False for a User Admin, who is a non-owner: 204 on a member, 400 on an owner. [defects, defects #131802]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-4caaad18b4
API guide: False: a User Admin performed it on a member (204). [defects, defects #131803]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-deb409e1bc
API guide: A non-owner User Admin gets 204 (member target) or 400 (owner target), not 404. [defects, defects #131804]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-8f9bf4f4fc
API guide: 'owner only' is false: a User Admin set a member's password with this body (204). [defects, defects #131805]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-81354c36e9
Database handbook: Shown as a dockerfile instruction 'defined in the image', but it is not valid Dockerfile syntax (a derived image built with it fails to parse) and it omits the image's interval/timeout/start-period. [defects, defects #131806]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2
RSD-coder-a6bf3dafc7
Database handbook: The list ('limited to' /healthz and /api/v2/buildinfo) contradicts the paragraph above it, which documents POST /api/v2/users/first as unauthenticated, and omits the login endpoints. [defects, defects #131807]		lowfixed-in-releaseheld review (review model)v2.38.3-CE-ubuntu24.04-r2

Verification

2 items not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:b8cc242203b258c2433715452e8cc7237baf30d5076a679611ee057f92848679 · published digest sha256:b8cc242203b258c2433715452e8cc7237baf30d5076a679611ee057f92848679 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 416) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 720 package_archive gate_result.g8.result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-28T09:59:39Z · failing Docker Scout counts 106 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • First own scan of the releaseA (at 2026-10-28T10:17:27Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-28T06:23:30Z) [image_scans, image_scans #1454]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-28T09:59:16Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3621492024 · transparency-log entry · integrated 2026-11-01T05:37:54Z) [ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:6618c3662ee33f07e0fdf5ea4f0388f3a8c64c285ec7cbd4c0ad7aeccc82e87d · state attached · log index 3536015305 · transparency-log entry
    • kind sbom · digest sha256:6618c3662ee33f07e0fdf5ea4f0388f3a8c64c285ec7cbd4c0ad7aeccc82e87d · state attached · log index 3536025709 · transparency-log entry
    • kind vsa · digest sha256:6618c3662ee33f07e0fdf5ea4f0388f3a8c64c285ec7cbd4c0ad7aeccc82e87d · state attached · log index 3536029101 · transparency-log entry
    • kind provenance · digest sha256:b8cc242203b258c2433715452e8cc7237baf30d5076a679611ee057f92848679 · state attached · log index 3536035170 · transparency-log entry
    • kind sbom · digest sha256:b8cc242203b258c2433715452e8cc7237baf30d5076a679611ee057f92848679 · state attached · log index 3536039519 · transparency-log entry
    • kind vsa · digest sha256:b8cc242203b258c2433715452e8cc7237baf30d5076a679611ee057f92848679 · state attached · log index 3536040943 · transparency-log entry
    (at 2026-10-28T10:12:24Z) [attestations.json, results]

Offline clean-room rebuilds

  • 2026-10-28T09:34:56Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:b8cc242203b258c2433715452e8cc7237baf30d5076a679611ee057f92848679 [clean-room rebuild ledger, runs[518]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
  • Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

Fully recorded
  • Image pushed (internal tag), publish_image passed2026-10-28T09:11:37Z [stage_runs, stage_runs chain 720 stage publish_image]
  • Release tag promoted2026-10-28T10:16:07Z (method imagetools_create_retag_by_digest_no_rebuild · digest sha256:6618c3662ee33f07e0fdf5ea4f0388f3a8c64c285ec7cbd4c0ad7aeccc82e87d · tag readystack/coder:v2.38.3-CE-ubuntu24.04-r2) [deliverables/provenance/PROMOTION_RECORD.json, promoted_at]
  • Archive manifests written2026-10-28T10:07:26Z [PUBLISH_MANIFEST.json, published_at]
  • Archive cut over on prodasset, package_archive passed2026-10-28T10:17:12Z [stage_runs, stage_runs chain 720 stage package_archive]
  • Cut-over markerpresent (chain 720) [.cutover.json]
  • Release checklist and site event2026-10-28T10:17:10Z (status complete · site event 255 · steps grade a verified done · release tag promoted done · cosign signed done · release evidence recorded done · contract gate passed done · archive published done · hub readme live done · reproducibility recorded done · defects ledger published done · catalog available done · build request fulfilled done · seo regenerated skipped · site catalogue refreshed done · site grade recorded done · site queue synced done · customer requests charged done · owners notified done) [deliverables/provenance/RELEASE_CHECKLIST.json, run_at]

Packages and CPU level

Fully recorded
  • Packages in the image572 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 830 · probed 2026-11-02T17:07:26Z · source backfill) [release_images, isa_level_hard]

History

2 events
  • 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records
  • 2026-11-03T00:47:14Z repack: previous sha256 e1ec8be412a02def15dad4713edd534039c17d41ba800fc08d380e20608d799f · sha256 fcfd882b846118cafc70b90e410ee6b72fc03865614407f5c3661f7f8b37182d · reason customer kit files brought up to the current engine: every pinned input's reason (docs/PINS.md, docs/provenance/PINS.json) and docs/PROVENANCE.md's section pointing at it, rendered by release/pin_reasons.py; docs/PROVENANCE.md's 'Build trail' section pointing at the signed build trail beside the archive (release/build_trail.py); not image inputs; image and every build input unchanged · label kitfix · replaced docs/PROVENANCE.md · added docs/PINS.md, docs/provenance/PINS.json · record MANIFEST.json repack_history

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.tar.gz)—
.cutover.jsonbeside the archive (prodasset /data/production/coder/v2.38.3-CE-ubuntu24.04-r2/)—
MANIFEST.jsonbeside the archive (prodasset /data/production/coder/v2.38.3-CE-ubuntu24.04-r2/)—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/coder/v2.38.3-CE-ubuntu24.04-r2/)—
ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/coder/v2.38.3-CE-ubuntu24.04-r2/)—
ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/coder/v2.38.3-CE-ubuntu24.04-r2/)—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/coder/v2.38.3-CE-ubuntu24.04-r2/)—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)403
chainssadb, ReadyStack's engine database (not published)720
defectssadb, ReadyStack's engine database (not published)coder v2.38.3-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 720
held_roundssadb, ReadyStack's engine database (not published)chain 720
image_scanssadb, ReadyStack's engine database (not published)1454
micro_step_runssadb, ReadyStack's engine database (not published)chain 720
release_imagessadb, ReadyStack's engine database (not published)coder v2.38.3-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 720
stage_runssadb, ReadyStack's engine database (not published)chain 720
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/RELEASE_CHECKLIST.jsonthe chain's workspace on the controller (not published)—