Consul v1.16.4-CE-ubuntu24.04-r8 build trail

How ReadyStack built readystack/consul:v1.16.4-CE-ubuntu24.04-r8 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/consul:v1.16.4-CE-ubuntu24.04-r8
  • Index digestsha256:1327ebcf89555be142dddef0fe46a478bedaa52776ba92a9a6b4c81a43ac16f7
  • linux/amd64 digestsha256:b5a36d67594e42cf4df7e28453ba858f14552fefdcee59b001b99273f82d8d70
  • ArchiveReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.tar.gz
  • Archive SHA-256 now03a10b70ffc2539ed8a9ab368f2459fd85057d5da2c029ca8ea046d0cf1fb91f
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-13T04:18:39Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.trail.json.sigstore ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.trail.json
ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.trail.jsonReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.trail.json.sigstoreReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.trail.mdConsul product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductConsul (consul) [MANIFEST.json]
  • Release tagv1.16.4-CE-ubuntu24.04-r8 [MANIFEST.json]
  • Imagereadystack/consul:v1.16.4-CE-ubuntu24.04-r8 [MANIFEST.json]
  • Image index digestsha256:1327ebcf89555be142dddef0fe46a478bedaa52776ba92a9a6b4c81a43ac16f7 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:b5a36d67594e42cf4df7e28453ba858f14552fefdcee59b001b99273f82d8d70 [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.tar.gz (bytes 528455443) [MANIFEST.json]
  • Archive sha256 at publish03a10b70ffc2539ed8a9ab368f2459fd85057d5da2c029ca8ea046d0cf1fb91f [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/hashicorp/consul [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv1.16.4 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit2b5841d3f6243fc9b24a5f223daeef69761e0317 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashfed15f67fb0cd2b93301c46ea33c61b4dbab2c7c070eff1fab00b3b4f1f79ec3 (files 10293) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:133394eff0f20fe97c2a3dd72c35db45eb07da2f3945fe7e3f47637d85625268 [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794448154 (utc 2026-11-12T01:49:14Z) [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.11-bookworm@sha256:dc40a13b61304647ed7e5d581d246b86413dfc29d63c6d018310feb93cd98fc0 · platform digest sha256:79ecd0a7157c7a4cf3b281ced8465350591bf54fedab540e75374a003e1fde7e
    • ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
    [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.rebuild.json, engine]
  • Engine commit(s)
    • commit 7c94125a6f5fc584666dcc47caabc650fd3931aa · dirty yes · first drive 4521
    • commit 8e2ccd89012b505323ed4fe7a92c08c20259debd · dirty yes · first drive 4531
    • commit 96f3323140891ba62fe76c4b7c36875344807578 · dirty yes · first drive 4539
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain1053 (created 2026-11-13T01:33:27Z · trigger customer_request · upstream version 1.16.4) [chains, chains #1053]
  • Requestbuild request #687 (rebuild) (requested at 2026-11-12T01:49:16Z · requested by kitforge-agent · version 1.16.4) [build_requests, build_requests #687]
  • Reasonrevision v1.16.4-CE-ubuntu24.04-r8: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #687 request_reason]
  • Supersedesreadystack/consul:v1.16.4-CE-ubuntu24.04-r7 (chain 945) [chains, chains #945]

The path through the harness

Fully recorded

1 chain · 3 drives · 18 stages · 2 rewinds

Chain 1053 release · ready_to_ship

Created 2026-11-13T01:33:27Z, upstream 1.16.4, build request 687 [chains, chains #1053]

DriveStartedMinutesBuild hostHow it stopped
45212026-11-13T01:33:55Z43.2build host 4 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4521]
45312026-11-13T03:24:08Z3.2build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4531]
45392026-11-13T04:13:10Z—build host 4 publish-held not recorded [drive_runs, drive_runs #4539]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-13T01:34:05Z2026-11-13T01:34:06Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 5eee8668300a…
acquire 2026-11-13T01:34:13Z2026-11-13T01:34:15Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 717109e7026b…
license_file 24e598eb434d…
custody_inputs ad43eef85a7a…
source_tree_hash f13be32d07ed…
source_file_manifest 9b94d767e5d4…
plan 2026-11-13T01:35:07Z2026-11-13T01:35:08Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 7b6c68ee752d…
input_pin_plan e010ebdb2256…
toolchain_lock 57679a2a1c2a…
assemble_kit 2026-11-13T01:40:14Z2026-11-13T01:40:14Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile c79b72e5e2aa…
build_recipe 0a66343d0cb8…
system_pinning aa8db05a9a8a…
build_offline_sh 6ab4f08a6ec7…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health be0af5236530…
verify_offline_sh 3e8184ea230c…
base_image_digests c5f731d49215…
dockerfile_offline c79b72e5e2aa…
first_build_digest 714a2a90b3b5…
remediate 2026-11-13T01:41:24Z2026-11-13T01:41:25Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log b297843865dc…
security_report 301e88755b67…
build_kit 2026-11-13T01:47:09Z2026-11-13T01:47:09Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp b62e54e323f5…
locked_digest 0fad73ce7e33…
freeze_manifest 345d439da52b…
offline_rebuild_transcript 54fd34fd0e26…
verdict 2026-11-13T01:47:47Z2026-11-13T01:47:47Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 1abf415e3ef3…
publish_image 2026-11-13T01:48:20Z2026-11-13T01:48:21Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme b48ae907bc0d…
promotion_record add8fdda9d2e…
boot_instance 2026-11-13T01:48:26Z2026-11-13T01:48:31Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle f7c6833d6455…
sbom 2026-11-13T01:48:41Z2026-11-13T01:48:42Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 2f920a2cc9e2…
sbom_json a02a73192d9c…
schema_discovery 2026-11-13T01:48:45Z2026-11-13T01:48:45Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 529982209cdb…
dependency_tree f84ddfe65db2…
table_classification c73681a53618…
admin_handbook 2026-11-13T01:54:58Z2026-11-13T01:54:59Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 1bb72b7d7663…
admin_handbook df780a54a9ad…
db_handbook 2026-11-13T02:00:59Z2026-11-13T02:01:00Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 3af74619b071…
seed_isolation 2e6d352aa326…
seed_data 2026-11-13T02:01:09Z2026-11-13T02:01:10Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 9325a09c0c2e…
seed_cases_json 7e77147c2d74…
seed_validate 2026-11-13T02:01:12Z2026-11-13T02:01:13Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract b69e37b3a503…
usecase_validate 2026-11-13T02:01:39Z2026-11-13T02:01:40Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests f50d3fbd66f3…
test_results f5e470b9f4ba…
usecase_contract 616f430c95cc…
finalize_docs 2026-11-13T02:07:50Z2026-11-13T02:07:51Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 493cec5a3f84…
release_notes 68e2af2eef70…
api_integration_guide 0391e628e127…
package_archive invalidated 2026-11-13T04:12:45Z 2026-11-13T02:17:02Z2026-11-13T03:27:17Z2
37 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 unpack_files
  • G8 scout_grade_a
  • G8 script_copies
  • G8 upgrade_check
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar d6a48c5d59cd…
checksums 876a7d4bc95d…
verify_md bfa36252aa5d…
rebuild_md 21b2e19292cf…
manifest_txt 4bae0032cbbf…
actions_jsonl a1d918c883a4…
provenance_md 25e2fff5fa50…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 61f021a7a348…

[stage_runs]

Rewinds

  • 2026-11-13T02:41:35Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #35205]
  • 2026-11-13T04:12:45Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #35401]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-13T03:27:17Z.

131 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 017360 —
remediate2001 022815 L-A08, L-038, L-036, L-034, L-032
admin_handbook391703 3141540 —
db_handbook441703 7170367 —
usecase_validate2001 03623 —
finalize_docs421803 3155714 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $2.68 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-13T02:17:47Z 0221 findings to repackage [held_rounds, held_rounds #1852] $1.29 3 rounds, $40.00 b9364ece9eb4…
22026-11-13T03:27:42Z 0011 clean to publish [held_rounds, held_rounds #1855] $1.39 3 rounds, $40.00 d6a48c5d59cd…

Defects

Fully recorded
  • Ledger entries40 [defects, defects where product_slug=consul and this tag or chain]
  • Disclosed in the archive39 [docs/defects/defects.json, entries]

40 ledger entries: by severity low 38, high 2; by status open 5, fixed-in-release 1, fixed-before-release 34.

DefectSeverityStatusFound byFixed in
RSD-consul-ec64d270a4
VERIFY.md: Count omits the VEX qualification (carried). [defects, defects #277280]		lowopenheld review (review model)—
RSD-consul-ab689c7a6a
Docker Hub README: Count omits the VEX qualification (carried). [defects, defects #277281]		lowopenheld review (review model)—
RSD-consul-a4f343158f
Release notes: Line 9 names hashicorp/consul as the build source; line 26 says the fork (carried). [defects, defects #277282]		lowopenheld review (review model)—
RSD-consul-e25d394acb
Docker Hub README: The image is built from the fork, not official upstream source (carried). [defects, defects #277283]		lowopenheld review (review model)—
RSD-consul-e245ea421f
PROVENANCE.md: Provenance omits the fork the image is built from (carried). [defects, defects #277284]		lowopenheld review (review model)—
RSD-consul-2827f5b784
Documentation: Same class as carried RSD-consul-b8e267fca4/e088cf9546: IMAGE_CONFIG.json label readystack.source_patches and strategy source_patches show the build comes from… [defects, defects #277285]		lowfixed-in-releaseheld review (review model)v1.16.4-CE-ubuntu24.04-r8
RSD-consul-d6e1858453
API guide: Ran on the held digest: `docker run -v V:/consul/data IMG -server -data-dir /consul/data`, `consul kv put b/k keep`, rm -f, re-create on volume V with the same flags, `consul kv get b/k` -> `Error! [defects, defects #277530]		highfixed-before-releaseheld review (review model)—
RSD-consul-d241859288
API guide: Ran `consul agent -dev -client 0.0.0.0 -bind 127.0.0.1 -acl-datacenter dc1` on the held digest -> `flag provided but not defined: -acl-datacenter` plus usage, agent exits. [defects, defects #277531]		highfixed-before-releaseheld review (review model)—
RSD-consul-e7da9ccc58
API guide: Held digest, `agent -server -bootstrap-expect=3`: status/leader 200, status/peers 200, agent/self 200, but GET /v1/catalog/services 500, /v1/catalog/service/consul 500, GET /v1/kv/foo 500 (rs-probe… [defects, defects #277532]		lowfixed-before-releaseheld review (review model)—
RSD-consul-68e6fe8ec2
API guide: Held digest with -hcl acl{enabled=true default_policy="deny"} + acl bootstrap: GET /v1/catalog/services without token -> 200 body `{}`; catalog/service/consul -> `[]`. [defects, defects #277533]		lowfixed-before-releaseheld review (review model)—
RSD-consul-b1ef4ee5d2
API guide: Default container (-dev) measured: /v1/status/leader -> "127.0.0.1:8300", `consul kv put rs/x y` -> Success. [defects, defects #277534]		lowfixed-before-releaseheld review (review model)—
RSD-consul-3ee5aa4fb9
Admin handbook: Default container: status/leader returns "127.0.0.1:8300" and KV writes succeed; ADMIN_HANDBOOK.md:619 says the same. [defects, defects #277535]		lowfixed-before-releaseheld review (review model)—
RSD-consul-6c7df14fc2
Admin handbook: Default (-dev) container: KV put/get succeed (ADMIN:619); 500 measured only with -bootstrap-expect=3. [defects, defects #277536]		lowfixed-before-releaseheld review (review model)—
RSD-consul-6b374d92b0
Database handbook: Default container: GET /v1/status/leader -> "127.0.0.1:8300". [defects, defects #277537]		lowfixed-before-releaseheld review (review model)—
RSD-consul-5a5767ab00
Admin handbook: provenance/IMAGE_CONFIG.json ExposedPorts: only 8500/tcp, 8600/tcp; ADMIN_HANDBOOK.md:271, 351 and DB:221 say two. [defects, defects #277538]		lowfixed-before-releaseheld review (review model)—
RSD-consul-54d0dddc73
Admin handbook: Contradicts ADMIN_HANDBOOK.md:138, 389, 523 (200 with or without a leader). [defects, defects #277539]		lowfixed-before-releaseheld review (review model)—
RSD-consul-fbd548dc45
Admin handbook: DNS is on 8600; 8500 serves HTTP only (ADMIN_HANDBOOK.md:216-217). [defects, defects #277540]		lowfixed-before-releaseheld review (review model)—
RSD-consul-1d624eb55a
Admin handbook: No record rates any fixed CVE critical (VEX/SECURITY_REPORT: 10005 HIGH, 10006 MEDIUM; provenance/REMEDIATION_LOG.json: unpatched four MEDIUM). [defects, defects #277541]		lowfixed-before-releaseheld review (review model)—
RSD-consul-36a467b6e9
Database handbook: DB_HANDBOOK.md:789-797 rates the four unpatched CVEs medium, the same as CVE-2024-10006; no record ranks the line's vulnerabilities. [defects, defects #277542]		lowfixed-before-releaseheld review (review model)—
RSD-consul-2ba1b1d49c
Admin handbook: gh compare ReadyStackFree/consul v1.16.4...v1.16.4-cve-r1 (per prior round and ADMIN:708/DB:799): d9d2098100 is a dependency removal; only 4b4e6dfe33 and 0de473d2ce address CVEs. [defects, defects #277543]		lowfixed-before-releaseheld review (review model)—
RSD-consul-765bdf68c4
Database handbook: The list that follows (DB_HANDBOOK.md:188-189) names two CVEs; DB:794 says 'Two CVEs'; the third fork commit is a dependency removal. [defects, defects #277544]		lowfixed-before-releaseheld review (review model)—
RSD-consul-5e53a9afd3
Database handbook: Same class as the round-2 '-dev OR -ui' finding. [defects, defects #277545]		lowfixed-before-releaseheld review (review model)—
RSD-consul-8ea3d2fc16
Database handbook: Held digest, host bind mount owned by uid 1000 with `chmod 777`: `agent -server -data-dir /consul/data` ran (status running, node-id/raft/serf written); with 755 it exited with `failed to write… [defects, defects #277546]		lowfixed-before-releaseheld review (review model)—
RSD-consul-3498d18dc3
Database handbook: Same measurement as DB:109 (777 bind mount owned by another uid starts and writes). [defects, defects #277547]		lowfixed-before-releaseheld review (review model)—
RSD-consul-fe3539b5b5
Admin handbook: Held digest: `chmod 777` bind mount works, 755 fails (see DB:109). [defects, defects #277548]		lowfixed-before-releaseheld review (review model)—
RSD-consul-0e88ce55f9
Database handbook: docker run accepts options in any order before the image name (documented DB:462, 620 put -v and --entrypoint in different orders); no record supports an ordering requirement, and the claim is false. [defects, defects #277549]		lowfixed-before-releaseheld review (review model)—
RSD-consul-61d9ab3d70
Database handbook: Ran `dig +tcp @127.0.0.1 8600 consul.service.consul` -> `Connection to 127.0.0.1#53 for 8600 failed: connection refused` (port is given with -p; `8600` is parsed as a query name). [defects, defects #277550]		lowfixed-before-releaseheld review (review model)—
RSD-consul-e8492549a1
Admin handbook: Held digest with `-p 18600:8600`: `dig @127.0.0.1 -p 18600 +time=2 +tries=1 consul.service.consul` -> only `;; no servers could be reached` (no 'connection refused'); `dig +tcp` answers 127.0.0.1. [defects, defects #277551]		lowfixed-before-releaseheld review (review model)—
RSD-consul-9c5da4299d
Database handbook: Same measurement as ADMIN:485. [defects, defects #277552]		lowfixed-before-releaseheld review (review model)—
RSD-consul-e76078cdc7
API guide: Held digest, `agent -server -bootstrap-expect=3 -data-dir /tmp/d`: curl -m40 catalog/services -> `No cluster leader [500 8.4s]`; kv/foo -> 500 11.5s; `catalog/services?stale` -> `No cluster leader… [defects, defects #278210]		lowfixed-before-releaseheld review (review model)—
RSD-consul-35f58e174a
Admin handbook: Held digest, `-bootstrap-expect=3`: GET /v1/kv/foo -> 500 `No cluster leader` (11.5 s), also with ?stale; GET /v1/catalog/services -> 500; /v1/status/leader, /v1/status/peers, /v1/agent/self -> 200. [defects, defects #278211]		lowfixed-before-releaseheld review (review model)—
RSD-consul-98e2b4b509
Admin handbook: Default container (docker run IMAGE): GET /v1/catalog/services -> 200 `{"consul": []}`, /v1/catalog/service/consul -> 200 with one server element, /v1/catalog/nodes -> one node. [defects, defects #278212]		lowfixed-before-releaseheld review (review model)—
RSD-consul-111ceee284
Admin handbook: Same measurement as ADMIN:570: default container returns `{"consul": []}` for catalog/services; `{}` only with ACLs enabled and default_policy deny. [defects, defects #278213]		lowfixed-before-releaseheld review (review model)—
RSD-consul-0bc2f3d404
Database handbook: `consul agent -dev -client 0.0.0.0 -bind 127.0.0.1 -hcl 'acl{enabled=true default_policy="deny"}'` on the held digest: GET /v1/kv/x -> 403 `Permission denied: anonymous token lacks permission… [defects, defects #278214]		lowfixed-before-releaseheld review (review model)—
RSD-consul-2b73967076
Database handbook: Same measurement as DB:168: with -dev plus an ACL configuration, anonymous requests get 403; -dev itself does not grant permissions, ACLs are simply off by default (`consul info`: acl = disabled). [defects, defects #278215]		lowfixed-before-releaseheld review (review model)—
RSD-consul-9f8eb26ecf
Database handbook: The fragment has no image name and no `agent` subcommand; consul would receive `-data-dir ...` as its first argument. [defects, defects #278216]		lowfixed-before-releaseheld review (review model)—
RSD-consul-804b58841d
Database handbook: provenance/IMAGE_CONFIG.json Env: PATH, CONSUL_BIND_INTERFACE, CONSUL_DISABLE_PERM_MGMT (three); DB_HANDBOOK.md:128-132 and :656 say three; the list below this line omits PATH. [defects, defects #278217]		lowfixed-before-releaseheld review (review model)—
RSD-consul-18d34a058b
Admin handbook: docs/RELEASE_NOTES.md Base image: none (`FROM scratch`), a chiselled Ubuntu 24.04 runtime; PROVENANCE.md Build; ADMIN_HANDBOOK.md:681 itself says 'built FROM scratch' (no chown, ls, id: `sh: 1: id:… [defects, defects #278218]		lowfixed-before-releaseheld review (review model)—
RSD-consul-753b1f1204
Admin handbook: Default container: status/leader -> "127.0.0.1:8300". [defects, defects #278219]		lowfixed-before-releaseheld review (review model)—
RSD-consul-ae4ab6e13c
Admin handbook: Held digest, -bootstrap-expect=3: `curl -s :8500/v1/status/leader` -> `""` [200] (two characters, not zero bytes). [defects, defects #278220]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:b5a36d67594e42cf4df7e28453ba858f14552fefdcee59b001b99273f82d8d70 · published digest sha256:b5a36d67594e42cf4df7e28453ba858f14552fefdcee59b001b99273f82d8d70 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 155) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
  • Grade at releaseB (percent 72 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T04:13:33Z · failing 1 fixable critical/high vulnerability (1 high) in 1 package, e.g. github.com/hashicorp/consul 1.18.0 (fixed in 1.20.1)., Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T04:13:21Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3845814866 · transparency-log entry · integrated 2026-11-13T04:16:43Z) [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:1327ebcf89555be142dddef0fe46a478bedaa52776ba92a9a6b4c81a43ac16f7 · state attached · log index 3845819952 · transparency-log entry
    • kind sbom · digest sha256:1327ebcf89555be142dddef0fe46a478bedaa52776ba92a9a6b4c81a43ac16f7 · state attached · log index 3845824201 · transparency-log entry
    • kind vsa · digest sha256:1327ebcf89555be142dddef0fe46a478bedaa52776ba92a9a6b4c81a43ac16f7 · state attached · log index 3845827808 · transparency-log entry
    • kind provenance · digest sha256:b5a36d67594e42cf4df7e28453ba858f14552fefdcee59b001b99273f82d8d70 · state attached · log index 3845830796 · transparency-log entry
    • kind sbom · digest sha256:b5a36d67594e42cf4df7e28453ba858f14552fefdcee59b001b99273f82d8d70 · state attached · log index 3845833754 · transparency-log entry
    • kind vsa · digest sha256:b5a36d67594e42cf4df7e28453ba858f14552fefdcee59b001b99273f82d8d70 · state attached · log index 3845836365 · transparency-log entry
    (at 2026-11-13T04:16:47Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/consul/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-13T02:17:51Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:b5a36d67594e42cf4df7e28453ba858f14552fefdcee59b001b99273f82d8d70 [clean-room rebuild ledger, runs[814]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-13T01:48:21Z [stage_runs, stage_runs chain 1053 stage publish_image]
  • Archive manifests written2026-11-13T04:15:05Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 57 · probed 2026-11-13T01:44:18Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-13T04:18:39Z generated: by KitForge release/build_trail.py · generator commit 96f3323140891ba62fe76c4b7c36875344807578
  • 2026-11-13T04:20:20Z publication: promoted at 2026-11-13T04:19:27Z · promoted digest sha256:1327ebcf89555be142dddef0fe46a478bedaa52776ba92a9a6b4c81a43ac16f7 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 533 · checklist status complete · checklist at 2026-11-13T04:20:20Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r8/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r8/), as staged for publishing—
ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.rebuild.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r8/), as staged for publishing—
ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r8.rebuild.json.sigstorebeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r8/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r8/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)687
chainssadb, ReadyStack's engine database (not published)1053
defectssadb, ReadyStack's engine database (not published)consul v1.16.4-CE-ubuntu24.04-r8
drive_runssadb, ReadyStack's engine database (not published)chain 1053
held_roundssadb, ReadyStack's engine database (not published)chain 1053
lesson_recallssadb, ReadyStack's engine database (not published)chain 1053
micro_step_runssadb, ReadyStack's engine database (not published)chain 1053
release_imagessadb, ReadyStack's engine database (not published)consul v1.16.4-CE-ubuntu24.04-r8
stage_eventssadb, ReadyStack's engine database (not published)chain 1053
stage_runssadb, ReadyStack's engine database (not published)chain 1053
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—