Consul v1.16.4-CE-ubuntu24.04-r6 build trail

How ReadyStack built readystack/consul:v1.16.4-CE-ubuntu24.04-r6 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/consul:v1.16.4-CE-ubuntu24.04-r6
  • Index digestsha256:56b4ebe8de1417fd03c72806d3795dd1b9b4b9007fc9dae0be0d7a7015b6cb5f
  • linux/amd64 digestsha256:1a323b0d110c675265895040105c9e22351d429df88204b466fbc5a1602d0d61
  • ArchiveReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.tar.gz
  • Archive SHA-256 nowb0822b1200a4b99cd42df105b5f95db80266804f7361d38cf63401841664e1a2
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-08T10:05:50Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.trail.json.sigstore ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.trail.json
ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.trail.jsonReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.trail.json.sigstoreReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.trail.mdConsul product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductConsul (consul) [MANIFEST.json]
  • Release tagv1.16.4-CE-ubuntu24.04-r6 [MANIFEST.json]
  • Imagereadystack/consul:v1.16.4-CE-ubuntu24.04-r6 [MANIFEST.json]
  • Image index digestsha256:56b4ebe8de1417fd03c72806d3795dd1b9b4b9007fc9dae0be0d7a7015b6cb5f [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:1a323b0d110c675265895040105c9e22351d429df88204b466fbc5a1602d0d61 [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.tar.gz (bytes 528065505) [MANIFEST.json]
  • Archive sha256 at publishb0822b1200a4b99cd42df105b5f95db80266804f7361d38cf63401841664e1a2 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/hashicorp/consul [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv1.16.4 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit2b5841d3f6243fc9b24a5f223daeef69761e0317 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashfed15f67fb0cd2b93301c46ea33c61b4dbab2c7c070eff1fab00b3b4f1f79ec3 (files 10293) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:e94a5188cb94ee7cf6ae1858390c665fd031aca97e59086239c6e1ec9a88cbfc [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1702410563 (utc 2023-12-12T19:49:23Z) [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.rebuild.json, engine]
  • Engine commit(s)
    • commit 89d863ac88b135c8b01feee55143a4eb91c606e1 · dirty yes · first drive 3650
    • commit f17fd5fee6d0843adaa7c678e7adcaedebd44dfb · dirty yes · first drive 3666
    • commit 569d60f7ee33751d5c871e37c52e92041b6acb60 · dirty yes · first drive 3667
    • commit be599c7987430f609ff7886169ea4c69401572ae · dirty yes · first drive 3668
    • commit 652df6e0e6aa50b44c0f12948b3d5baab047fc1f · dirty yes · first drive 3745
    • commit 1b6b66826eaa0cb5f2f833b5a6a84e7c72e9e068 · dirty yes · first drive 3751
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain858 (created 2026-11-07T11:10:18Z · trigger customer_request · upstream version 1.16.4) [chains, chains #858]
  • Requestbuild request #536 (rebuild) (requested at 2026-11-07T07:07:10Z · requested by kitforge-agent · version 1.16.4) [build_requests, build_requests #536]
  • Reasonrerelease agenda REVISION -> v1.16.4-CE-ubuntu24.04-r6 (decay loop, IMP-08) [build_requests, build_requests #536 request_reason]
  • Supersedesreadystack/consul:v1.16.4-CE-ubuntu24.04-r5 (chain 735) [chains, chains #735]

The path through the harness

Fully recorded

1 chain · 6 drives · 18 stages · 5 rewinds

Chain 858 release · ready_to_ship

Created 2026-11-07T11:10:18Z, upstream 1.16.4, build request 536 [chains, chains #858]

DriveStartedMinutesBuild hostHow it stopped
36502026-11-07T11:10:44Z42build host 4 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3650]
36662026-11-07T12:16:33Z3.2build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3666]
36672026-11-07T12:40:32Z2.9build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3667]
36682026-11-07T13:02:42Z2.9build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3668]
37452026-11-08T09:25:01Z3.5build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3745]
37512026-11-08T10:01:19Z—build host 4 publish-held not recorded [drive_runs, drive_runs #3751]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-07T11:10:54Z2026-11-07T11:10:55Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 731ac248f287…
acquire 2026-11-07T11:11:02Z2026-11-07T11:11:04Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 717109e7026b…
license_file 24e598eb434d…
custody_inputs ad43eef85a7a…
source_tree_hash f13be32d07ed…
source_file_manifest 9b94d767e5d4…
plan 2026-11-07T11:11:53Z2026-11-07T11:11:54Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 1e4c5e2514bf…
input_pin_plan 6036bb8c84de…
toolchain_lock e20764a5831c…
assemble_kit 2026-11-07T11:16:44Z2026-11-07T11:16:45Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 2a8d897d6369…
build_recipe ba63f95d14f3…
system_pinning fa091140511e…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 63b228bb4df5…
verify_offline_sh 3e8184ea230c…
base_image_digests 89de9e3ffd5b…
dockerfile_offline 2a8d897d6369…
first_build_digest 498f0802efce…
remediate 2026-11-07T11:17:39Z2026-11-07T11:17:40Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log faea0c99cf6e…
security_report 9c549a89f4ce…
build_kit 2026-11-07T11:23:23Z2026-11-07T11:23:23Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 59307c1cb742…
locked_digest 7ada67bee049…
freeze_manifest bd7c3050ab89…
offline_rebuild_transcript 78841c0496ce…
verdict 2026-11-07T11:24:02Z2026-11-07T11:24:03Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict cdbfbbd29e38…
publish_image 2026-11-07T11:24:34Z2026-11-07T11:24:35Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme b0d8a6fd5c6b…
promotion_record a8acb2a36f07…
boot_instance 2026-11-07T11:24:40Z2026-11-07T11:24:45Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle a49aa82a9b08…
sbom 2026-11-07T11:24:56Z2026-11-07T11:24:56Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 4ddcfd6acd20…
sbom_json 27eb2359b750…
schema_discovery 2026-11-07T11:24:59Z2026-11-07T11:25:00Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 529982209cdb…
dependency_tree f84ddfe65db2…
table_classification c73681a53618…
admin_handbook 2026-11-07T11:32:17Z2026-11-07T11:32:18Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 1bb72b7d7663…
admin_handbook ff6c809f0779…
db_handbook 2026-11-07T11:38:11Z2026-11-07T11:38:11Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 5c8ced811e86…
seed_isolation 2e6d352aa326…
seed_data 2026-11-07T11:38:20Z2026-11-07T11:38:21Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 9325a09c0c2e…
seed_cases_json a1906060fe8d…
seed_validate 2026-11-07T11:38:24Z2026-11-07T11:38:25Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract dd062191e73b…
usecase_validate 2026-11-07T11:38:47Z2026-11-07T11:38:47Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 2895b702d68d…
test_results 5c0e39eae708…
usecase_contract 21cb17250ac0…
finalize_docs 2026-11-07T11:44:25Z2026-11-07T11:44:26Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 6ab2e6609507…
release_notes 89bcd676ef18…
api_integration_guide 09873039306f…
package_archive invalidated 2026-11-08T10:00:56Z 2026-11-07T11:52:43Z2026-11-08T09:28:27Z5
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 6b9c1d637d3c…
checksums 8bbc2aebbf5b…
verify_md ecd92f012770…
rebuild_md 6b2dba363b4c…
manifest_txt 1e68f303c746…
actions_jsonl 1b3004347ca6…
provenance_md 744b13eef3a9…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json c1cc0788b723…

[stage_runs]

Rewinds

  • 2026-11-07T12:15:21Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24828]
  • 2026-11-07T12:39:00Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24899]
  • 2026-11-07T13:01:54Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24914]
  • 2026-11-08T07:33:41Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #25425]
  • 2026-11-08T10:00:56Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #25749]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-08T09:28:27Z.

129 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 016998 L-A183, L-A15
remediate2001 018428 L-A183, L-A15
admin_handbook411803 2179215 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook431903 5186963 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate1001 01986 L-A59
finalize_docs401503 3168063 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

6 rounds, 5 counted, $6.36 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-07T11:53:19Z 329 findings to repackage [held_rounds, held_rounds #1465] $1.34 3 rounds, $40.00 11167801c513…
22026-11-07T12:20:09Z 106 findings to repackage [held_rounds, held_rounds #1466] $1.23 3 rounds, $40.00 cb3211833bdc…
32026-11-07T12:43:53Z 007 findings to repackage [held_rounds, held_rounds #1467] $1.22 3 rounds, $40.00 b08fa4c859c3…
4 not counted2026-11-07T13:06:02Z ——— blocked to blocked [held_rounds, held_rounds #1468] — 3 rounds, $40.00 a467b3c074e3…
52026-11-08T07:01:17Z 010 findings to repackage [held_rounds, held_rounds #1482] $1.26 3 rounds, $40.00 a467b3c074e3…
62026-11-08T09:29:00Z 004 clean to publish [held_rounds, held_rounds #1495] $1.31 3 rounds, $40.00 6b9c1d637d3c…

Defects

Fully recorded
  • Ledger entries35 [defects, defects where product_slug=consul and this tag or chain]
  • Disclosed in the archive35 [docs/defects/defects.json, entries]

35 ledger entries: by severity low 30, critical 2, high 3; by status fixed-before-release 30, open 5.

DefectSeverityStatusFound byFixed in
RSD-consul-9b9602eaa1
Documentation: IMAGE_CONFIG.json label readystack.source_patches = ReadyStackFree/consul tree v1.16.4-cve-r1 (10aaa17c1f2f); same class as the carried RSD-consul-856bc7d00f / -91854f6fd8 / -6b091e1dbf and… [defects, defects #97981]		lowfixed-before-releaseheld review (review model)—
RSD-consul-1a22533350
VERIFY.md: Count omits the VEX qualification (carried). [defects, defects #168708]		lowopenheld review (review model)—
RSD-consul-a9b2a4221f
Docker Hub README: Count omits the VEX qualification (carried). [defects, defects #168709]		lowopenheld review (review model)—
RSD-consul-6b091e1dbf
Release notes: Line 9 names hashicorp/consul as the build source; line 26 says the fork (carried). [defects, defects #168710]		lowopenheld review (review model)—
RSD-consul-856bc7d00f
Docker Hub README: The image is built from the fork, not official upstream source (carried). [defects, defects #168711]		lowopenheld review (review model)—
RSD-consul-91854f6fd8
PROVENANCE.md: Provenance omits the fork the image is built from (carried). [defects, defects #168712]		lowopenheld review (review model)—
RSD-consul-13c4ed06ef
Admin handbook: The Key-Value Store > Persistence command omits --entrypoint, so the container exits at start and nothing persists; the Running the Container section (line 539) has it right. [defects, defects #168989]		criticalfixed-before-releaseheld review (review model)—
RSD-consul-9e9e718345
Admin handbook: The sentence says the nodes 'reach each other on ports 8300–8302', but the commands bind Raft/Serf to 127.0.0.1 (Admin handbook lines 241, 318 of the DB handbook say exactly that, and 'prevents… [defects, defects #168990]		highfixed-before-releaseheld review (review model)—
RSD-consul-91db0d6c8d
API guide: The persistence example the text introduces ('mount a volume at /consul/data') has no -v option, so a copy of it writes to the container layer and loses the data when the container is removed. [defects, defects #168991]		highfixed-before-releaseheld review (review model)—
RSD-consul-ec61007281
Admin handbook: Contradicts lines 289 (`chmod 777` grants write access) and 619; live, a host dir with mode 777 owned by uid 1000 started healthy. [defects, defects #168992]		lowfixed-before-releaseheld review (review model)—
RSD-consul-281540bb0a
Admin handbook: 'prepared only with chmod' is stated to fail always, but chmod 777 works (Admin line 289). [defects, defects #168993]		lowfixed-before-releaseheld review (review model)—
RSD-consul-20368ca30f
API guide: Says a directory prepared with chmod only always fails; a 777 directory works. [defects, defects #168994]		lowfixed-before-releaseheld review (review model)—
RSD-consul-3bb9c81bfe
API guide: The probe is rs-probe, not curl; curl is not in the image. [defects, defects #168995]		lowfixed-before-releaseheld review (review model)—
RSD-consul-884492ab36
API guide: The container's resolver is not Consul's; the claim that DNS is 'typically available as the system resolver' / used 'automatically' is false (and dig is not in the image). [defects, defects #168996]		lowfixed-before-releaseheld review (review model)—
RSD-consul-6edd58f4f6
Admin handbook: The command omits `@localhost -p 8600`, so dig queries port 53 where nothing listens (line 809 of this handbook says so); `web` is also not registered by default. [defects, defects #168997]		lowfixed-before-releaseheld review (review model)—
RSD-consul-8a8285ed34
Database handbook: The quoted agent banner line is not what the agent prints. [defects, defects #168998]		lowfixed-before-releaseheld review (review model)—
RSD-consul-33694ca81b
Database handbook: 'nothing persists to the volume' is wrong: with -dev -data-dir the agent writes /consul/data/node-id; line 860 also says nothing is written unless -server -data-dir is appended. [defects, defects #168999]		lowfixed-before-releaseheld review (review model)—
RSD-consul-a30f9d29d2
Admin handbook: -dev does not set the listening address; -client does (the handbook says so itself at lines 257 and 386). [defects, defects #169000]		lowfixed-before-releaseheld review (review model)—
RSD-consul-51a320731e
Database handbook: The Key-Value Store > Data Persistence command (DB_HANDBOOK.md:505-514) has --entrypoint and -v but no -bootstrap-expect=1 (the round-1 finding named it; only --entrypoint was fixed). [defects, defects #169414]		criticalfixed-before-releaseheld review (review model)—
RSD-consul-ef1431f39c
API guide: The following command `docker exec <c> dig +tcp @127.0.0.1 -p 8600 ...` cannot run: dig is not in the image. [defects, defects #169415]		lowfixed-before-releaseheld review (review model)—
RSD-consul-27f8012017
API guide: False and self-contradicting: the EXPOSE only limits what -p publishes; Consul serves UDP inside the container (same guide line 444 and 'Inside the container ... [defects, defects #169416]		lowfixed-before-releaseheld review (review model)—
RSD-consul-f0671eb69c
Admin handbook: The three-server example as printed does not form a cluster (the caveat admits it) and 'repeat' with the same -p 8500:8500 is refused by Docker; no working command is given. [defects, defects #169417]		lowfixed-before-releaseheld review (review model)—
RSD-consul-c3ecfbddb9
Admin handbook: `-p 8600:8600/udp` alone publishes UDP only and drops TCP; the sentence says it publishes both (Admin 237 and 421 give the two-flag form). [defects, defects #169418]		lowfixed-before-releaseheld review (review model)—
RSD-consul-a5efc97592
API guide: Self-contradictory: there is no Ubuntu base image in the shipped image (FROM scratch), so it neither includes nor hides setuid utilities. [defects, defects #169419]		lowfixed-before-releaseheld review (review model)—
RSD-consul-1f784f4408
API guide: Run on the held digest with -server -bootstrap-expect=3 (no leader): status/leader 200 ""; catalog/services -> 'No cluster leader' [500]; catalog/service/consul -> 'No cluster leader' [500]; kv PUT… [defects, defects #169840]		lowfixed-before-releaseheld review (review model)—
RSD-consul-29c63d77a6
Admin handbook: Contradicts ADMIN_HANDBOOK.md:458 ('DNS queries are HTTP-only for key-value store operations') and API_INTEGRATION_GUIDE.md:533 ('The KV store is not available through DNS'); Consul has no KV DNS… [defects, defects #169841]		lowfixed-before-releaseheld review (review model)—
RSD-consul-eb0fafff66
Database handbook: Contradicts DB_HANDBOOK.md:667 and 615. [defects, defects #169842]		lowfixed-before-releaseheld review (review model)—
RSD-consul-444b66c65d
Database handbook: DB_HANDBOOK.md:509, 649, 662, 720 publish only 8600/udp; docker publishes only the protocol named, so `dig +tcp` (lines 543, 553-554) cannot reach those containers. [defects, defects #169843]		lowfixed-before-releaseheld review (review model)—
RSD-consul-313d43c5e6
Admin handbook: `docker exec` runs a program inside the already-running dev agent and cannot start a server-mode agent with persistent data; only --entrypoint does (measured, ADMIN_HANDBOOK.md:99-105). [defects, defects #169844]		lowfixed-before-releaseheld review (review model)—
RSD-consul-4994bf89f3
Database handbook: DB_HANDBOOK.md:126, 202, 310 are bare '##' lines with no title; same in ADMIN_HANDBOOK.md:650 and API_INTEGRATION_GUIDE.md:367, 623. [defects, defects #169845]		lowfixed-before-releaseheld review (review model)—
RSD-consul-a1c6200e2f
Database handbook: Run on the held digest (sha256:1a323b0d...) with `consul agent -dev -client 0.0.0.0 -bind 127.0.0.1 -hcl 'acl { enabled = true }'`: banner 'ACL Enabled: true', 'ACL Default Policy: allow'; with no… [defects, defects #171914]		highfixed-before-releaseheld review (review model)—
RSD-consul-0dd46f2e4d
Admin handbook: The records never rate these two fixes 'critical'; the only related finding is 1 high (IMAGE_EVIDENCE.json scout.policies fixable-vulnerabilities: '1 fixable critical/high vulnerability (1 high)'). [defects, defects #173947]		lowfixed-before-releaseheld review (review model)—
RSD-consul-4d1cbb7f39
Admin handbook: Measured on the held digest with `-p H:8600` (TCP only): `dig +time=3 +tries=1 @localhost -p H consul.service.consul` printed ';; communications error to 127.0.0.1#H: connection refused' / ';; no… [defects, defects #173948]		lowfixed-before-releaseheld review (review model)—
RSD-consul-88219f5839
Database handbook: Overgeneralised: with default_policy deny and a bootstrapped token, no-token requests still returned 200 for /v1/status/leader, /ui/, /v1/catalog/services ({}) and /v1/catalog/service/consul… [defects, defects #173949]		lowfixed-before-releaseheld review (review model)—
RSD-consul-b6cb41b38b
Admin handbook: Offered as the way to add authentication but omits that `enabled = true` alone leaves ACL Default Policy: allow (banner on the held digest with `-dev -hcl 'acl { enabled = true }'` per the r5… [defects, defects #173950]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:1a323b0d110c675265895040105c9e22351d429df88204b466fbc5a1602d0d61 · published digest sha256:1a323b0d110c675265895040105c9e22351d429df88204b466fbc5a1602d0d61 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 159) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseB (percent 72 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T10:01:40Z · failing 1 fixable critical/high vulnerability (1 high) in 1 package, e.g. github.com/hashicorp/consul 1.18.0 (fixed in 1.20.1)., Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T10:01:30Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3753734922 · transparency-log entry · integrated 2026-11-08T10:04:36Z) [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:56b4ebe8de1417fd03c72806d3795dd1b9b4b9007fc9dae0be0d7a7015b6cb5f · state attached · log index 3753736496 · transparency-log entry
    • kind sbom · digest sha256:56b4ebe8de1417fd03c72806d3795dd1b9b4b9007fc9dae0be0d7a7015b6cb5f · state attached · log index 3753737280 · transparency-log entry
    • kind vsa · digest sha256:56b4ebe8de1417fd03c72806d3795dd1b9b4b9007fc9dae0be0d7a7015b6cb5f · state attached · log index 3753737982 · transparency-log entry
    • kind provenance · digest sha256:1a323b0d110c675265895040105c9e22351d429df88204b466fbc5a1602d0d61 · state attached · log index 3753738643 · transparency-log entry
    • kind sbom · digest sha256:1a323b0d110c675265895040105c9e22351d429df88204b466fbc5a1602d0d61 · state attached · log index 3753739159 · transparency-log entry
    • kind vsa · digest sha256:1a323b0d110c675265895040105c9e22351d429df88204b466fbc5a1602d0d61 · state attached · log index 3753739607 · transparency-log entry
    (at 2026-11-08T10:04:37Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/consul/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-07T11:53:24Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:1a323b0d110c675265895040105c9e22351d429df88204b466fbc5a1602d0d61 [clean-room rebuild ledger, runs[626]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-07T11:24:35Z [stage_runs, stage_runs chain 858 stage publish_image]
  • Archive manifests written2026-11-08T10:03:02Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 57 · probed 2026-11-07T11:20:28Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-08T10:05:50Z generated: by KitForge release/build_trail.py · generator commit 1b6b66826eaa0cb5f2f833b5a6a84e7c72e9e068
  • 2026-11-08T10:07:13Z publication: promoted at 2026-11-08T10:06:22Z · promoted digest sha256:56b4ebe8de1417fd03c72806d3795dd1b9b4b9007fc9dae0be0d7a7015b6cb5f · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 359 · checklist status complete · checklist at 2026-11-08T10:07:13Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r6/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r6/), as staged for publishing—
ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.rebuild.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r6/), as staged for publishing—
ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r6.rebuild.json.sigstorebeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r6/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r6/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)536
chainssadb, ReadyStack's engine database (not published)858
defectssadb, ReadyStack's engine database (not published)consul v1.16.4-CE-ubuntu24.04-r6
drive_runssadb, ReadyStack's engine database (not published)chain 858
held_roundssadb, ReadyStack's engine database (not published)chain 858
lesson_recallssadb, ReadyStack's engine database (not published)chain 858
micro_step_runssadb, ReadyStack's engine database (not published)chain 858
release_imagessadb, ReadyStack's engine database (not published)consul v1.16.4-CE-ubuntu24.04-r6
stage_eventssadb, ReadyStack's engine database (not published)chain 858
stage_runssadb, ReadyStack's engine database (not published)chain 858
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—