Frappe CRM v1.90.0-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/frappecrm:v1.90.0-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/frappecrm:v1.90.0-CE-ubuntu24.04-r2
  • Index digestsha256:0bdd3342b6b44f6fd9543a259eed3c3fa4befb422fe8c95acb9313c3ab902002
  • linux/amd64 digestsha256:725978e709c6a6a9de138434a8008486ea26a7ef43b6735db2ebf5a3336df85b
  • ArchiveReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now4053919434379d6fe916db34f63f5e38294e8878f5fd372a6c125194e6d2afa2
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since 2026-11-03T01:44:24Z)
  • Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
  • Sections9 sections, 4 fully recorded; 10 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.trail.json
ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.trail.jsonReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.trail.mdFrappe CRM product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

1 item not recorded
  • ProductFrappe CRM (frappecrm) [MANIFEST.json]
  • Release tagv1.90.0-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/frappecrm:v1.90.0-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:0bdd3342b6b44f6fd9543a259eed3c3fa4befb422fe8c95acb9313c3ab902002 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:725978e709c6a6a9de138434a8008486ea26a7ef43b6735db2ebf5a3336df85b [ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.tar.gz (bytes 743263361) [MANIFEST.json]
  • Archive sha256 at publish57f799ad761a27526d845b7e906a2ce6d7edd4b794c4fa8fee03d6294fedec3e [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/frappe/crm [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv1.90.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit36bd8859f2a6345a620477bc708d0546e8c3f08a [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashbf0aa1f01cdb2aad41ae55d77ead24f1399f77b93c61cdc99c0baf7c48d8ceca (files 1111) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:c71e916e5bc198a01d20431379162f9dff1fc4fdc0e31a7801fec7255d097e28 [ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793289492 (utc 2026-10-29T15:58:12Z) [ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded
  • Chain808 (created 2026-11-01T02:45:58Z · trigger customer_request · upstream version v1.90.0) [chains, chains #808]
  • Requestbuild request #397 (rebuild) (requested at 2026-10-27T04:50:44Z · requested by kitforge-agent · version v1.90.0) [build_requests, build_requests #397]
  • Reasonretarget to v1.89.1: a newer upstream release (rule 1) [build_requests, build_requests #397 request_reason]
  • Supersedesreadystack/frappecrm:v1.90.0-CE-ubuntu24.04-r1 (chain 798) [chains, chains #798]

The path through the harness

2 items not recorded

2 chains · 6 drives · 18 stages · 3 rewinds

Chain 738 behind it · abandoned

Created 2026-10-28T00:23:03Z, upstream v1.89.1, build request 397 [chains, chains #738]

Abandoned: chain 738 abandoned: stale (it targets 'v1.89.1', the strategy 'v1.90.0') [watch_queue, watch_queue #9190 resolution]

DriveStartedMinutesBuild hostHow it stopped
9892026-10-28T00:23:28Z72.8build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #989] rebuilt from a build line's log
9922026-10-28T02:02:47Z0.3build host 5 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #992] rebuilt from a build line's log

Chain 808 release · shipped

Created 2026-11-01T02:45:58Z, upstream v1.90.0, build request 397 [chains, chains #808]

DriveStartedMinutesBuild hostHow it stopped
22026-11-01T02:46:22Z54.6build host 3 withhold-publish ready_to_ship [drive_runs, drive_runs #2] rebuilt from a build line's log
42026-11-01T04:16:50Z9.3build host 3 withhold-publish ready_to_ship [drive_runs, drive_runs #4] rebuilt from a build line's log
62026-11-01T05:37:42Z8.8build host 3 withhold-publish ready_to_ship [drive_runs, drive_runs #6] rebuilt from a build line's log
82026-11-01T07:57:08Z14.7build host 3 publish-held shipped [drive_runs, drive_runs #8] rebuilt from a build line's log

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-01T02:46:28Z2026-11-01T02:46:29Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-11-01T02:46:33Z2026-11-01T02:46:34Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-11-01T02:47:17Z2026-11-01T02:47:18Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-11-01T03:04:15Z2026-11-01T03:04:16Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 —
remediate 2026-11-01T03:05:16Z2026-11-01T03:05:17Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 —
build_kit 2026-11-01T03:18:00Z2026-11-01T03:18:01Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 —
verdict 2026-11-01T03:21:20Z2026-11-01T03:21:21Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 —
publish_image 2026-11-01T03:22:48Z2026-11-01T03:22:49Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 —
boot_instance 2026-11-01T03:24:26Z2026-11-01T03:24:27Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 —
sbom 2026-11-01T03:25:18Z2026-11-01T03:25:19Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 —
schema_discovery 2026-11-01T03:25:21Z2026-11-01T03:25:22Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 —
admin_handbook 2026-11-01T03:25:28Z2026-11-01T03:25:29Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 —
db_handbook 2026-11-01T03:25:38Z2026-11-01T03:25:39Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 —
seed_data 2026-11-01T03:25:44Z2026-11-01T03:25:44Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 —
seed_validate 2026-11-01T03:25:46Z2026-11-01T03:25:47Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 —
usecase_validate 2026-11-01T03:26:02Z2026-11-01T03:26:03Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 —
finalize_docs 2026-11-01T03:26:09Z2026-11-01T03:26:10Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 —
package_archive 2026-11-01T03:40:57Z2026-11-01T08:11:45Z4
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 scout_grade_a
  • G8 script_copies
  • G8 three_way_sha
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 —

[stage_runs]

Rewinds

  • 2026-11-01T04:02:24Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2054]
  • 2026-11-01T04:48:13Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2055]
  • 2026-11-01T07:56:21Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #9]
  • Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
  • Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-11-01T08:11:45Z.

5 calls over 3 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
usecase_validate1001 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

2 items not recorded

Role: review model.

3 rounds, 3 counted, $1.75 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-01T03:41:47Z 010 findings to repackage [held_rounds, held_rounds #43] rebuilt from a held-review state file $0.75 not recorded not recorded
22026-11-01T04:26:31Z 010 findings to repackage [held_rounds, held_rounds #44] rebuilt from a held-review state file $0.71 not recorded not recorded
32026-11-01T05:46:55Z 000 clean to publish [held_rounds, held_rounds #45] rebuilt from a held-review state file $0.29 not recorded not recorded
  • Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
  • Not recorded: the round cap in force at each round (the state files did not keep it)

Defects

Fully recorded
  • Ledger entries29 [defects, defects where product_slug=frappecrm and this tag or chain]
  • Disclosed in the archive5 [docs/defects/defects.json, entries]

29 ledger entries: by severity medium 1, low 19, high 9; by status open 3, fixed-before-release 2, fixed-in-release 24.

DefectSeverityStatusFound byFixed in
RSD-frappecrm-3d3b447c30
Secret written in plain text or to the log by default [defects, defects #146391]		mediumopenbuild strategy record—
RSD-frappecrm-ee1a03d61d
Admin handbook: Contradicts the Site name bullet two lines above: a volume the upstream image wrote is used as it is only when its site is named frontend; otherwise it is not served. [defects, defects #146392]		lowopenheld review (review model)—
RSD-frappecrm-bbb4b9d0da
Release notes: The release notes present four CVEs as the change made by the python 3.14.9 to 3.14.10 move, but CVE-2025-15367 and CVE-2026-12345 are fixed only in 3.15 pre-releases; 3.14.10 does not fix them, and… [defects, defects #146630]		highfixed-before-releaseheld review (review model)—
RSD-frappecrm-cda77525f7
Release notes: The release notes still say CVE-2026-12345 is fixed only in Python 3.15 pre-releases and still applies to the python 3.14.10 binary. [defects, defects #147148]		highfixed-before-releaseheld review (review model)—
RSD-frappecrm-47e7e10e15
Admin handbook: The /crm page does not define a frappe object; the token is window.csrf_token there. [defects, defects #148387]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-1beea0d9da
Database handbook: States the /crm page exposes frappe.csrf_token; it exposes window.csrf_token. [defects, defects #148388]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-55426e3ef0
Admin handbook: Without -it the console starts and exits immediately, so the command as listed does not give a console; it contradicts line 1447 and line 445. [defects, defects #148389]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-3492320554
Database handbook: Console needs -it; without it the REPL exits immediately. [defects, defects #148390]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-23f2eea975
Database handbook: The list is presented as the image's environment but omits PATH, contradicting the other sections. [defects, defects #148391]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-69661200ec
Admin handbook: The worked example is false: the variable name swallows 'word1', so the password becomes 'Pass', not 'Password1'; it also contradicts the handbook's other examples. [defects, defects #148392]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-4c92e42af3
Admin handbook: 'Never returns HTTP 403' is false for the endpoint as a whole: PATCH answers 403. [defects, defects #148393]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-6f83eadaf2
Admin handbook: The example reuses the container name redis-queue with a different volume name than every other section, so following it either fails with a name conflict or silently points the queue at a new,… [defects, defects #148394]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-b32ba6e603
Admin handbook: Points to a document that does not exist. [defects, defects #148395]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-d5561912fe
Admin handbook: Operating fact (root: doc_facts.service_manager). [defects, defects #148396]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-39913002a6
Database handbook: Presented under Verification as a way to block until the service is ready, but wait-for-it checks only the TCP port; it returns, exit 0, inside the documented 502 window, so a readiness gate built… [defects, defects #148397]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-68e343ceec
Admin handbook: Paraphrase of the ADMIN 279 Operating fact in Logging and Diagnostics: frappe.log does not hold request tracebacks. [defects, defects #148398]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-7150bdb2af
Admin handbook: Operating fact (root: doc_facts.password_reset). [defects, defects #148399]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-058e1b4c16
Database handbook: The documented rollback is offered 'if issues arise', and in the documented order issues can only be seen after step 4 (migrate). [defects, defects #148400]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-416a719bbf
Database handbook: Tells the customer to look for identifiers that the log lines do not carry; no line except supervisord's own start-up lines names backend, socketio, worker, scheduler or frontend. [defects, defects #148401]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-42e9cf0612
Database handbook: The shipped image has no `nc`/netcat binary. [defects, defects #148402]		highfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-ac09c56dfc
Admin handbook: This is the near-duplicate the first review's /var/log/supervisor fix missed: it restates, in different words, that logs live in 'the container's log files' as an alternative to `docker logs`. [defects, defects #148403]		highfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-00124f1b2d
Database handbook: The shipped image has no `redis-cli` binary. [defects, defects #148404]		highfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-92d889891d
Admin handbook: False: the entrypoint does not wait indefinitely. [defects, defects #148405]		highfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-df63136d87
Admin handbook: Blanket claim contradicted by the very list under it: of the 7 variables listed (DB_ROOT_PASSWORD, DB_HOST, DB_PORT, REDIS_CACHE, REDIS_QUEUE, SITE_NAME, ADMIN_PASSWORD), only DB_ROOT_PASSWORD has… [defects, defects #148406]		highfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-5cabdc5473
Admin handbook: This is listed as the '4th' of 'four authentication methods' the API supports, but it isn't an authentication method at all — it's a description of the default account's credentials. [defects, defects #148407]		highfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-68eb6c584c
Database handbook: This '4th' item duplicates item 3 verbatim in substance ('OAuth Bearer Token: Include the header Authorization: Bearer <token>' two lines above already says the token is issued by the site's OAuth… [defects, defects #148408]		highfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-1818399472
Admin handbook: Says 'four' but only three numbered items follow (Session Cookie, API Key/Secret, Bearer Token) — recurs at DB_HANDBOOK.md:129 and DB_HANDBOOK.md:286 with the identical mismatch. [defects, defects #148409]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-e969c26009
Admin handbook: Redundant, not incorrect: item 2 in the same list already states 'Authorization: Basic <base64(key:secret)>' as an alternative to the token format. [defects, defects #148410]		lowfixed-in-releaseheld review (review model)v1.90.0-CE-ubuntu24.04-r2
RSD-frappecrm-43fb435cf0
Admin handbook: The section frames itself as the single canonical statement of this release's operating facts, but omits the 'cli' fact that strategies/frappecrm.json's doc_facts/operating_facts designates for… [defects, defects #148411]		lowopenheld review (review model)—

Verification

2 items not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:725978e709c6a6a9de138434a8008486ea26a7ef43b6735db2ebf5a3336df85b · published digest sha256:725978e709c6a6a9de138434a8008486ea26a7ef43b6735db2ebf5a3336df85b · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 322) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 808 package_archive gate_result.g8.result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-01T07:58:04Z · failing Docker Scout counts 160 packages with copyleft licences (GPL, LGPL, MPL), 155 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • First own scan of the releaseA (at 2026-11-01T08:13:47Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-11-01T06:20:12Z) [image_scans, image_scans #1869]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-01T07:57:14Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3624140734 · transparency-log entry · integrated 2026-11-01T08:07:58Z) [ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:0bdd3342b6b44f6fd9543a259eed3c3fa4befb422fe8c95acb9313c3ab902002 · state attached · log index 3624144085 · transparency-log entry
    • kind sbom · digest sha256:0bdd3342b6b44f6fd9543a259eed3c3fa4befb422fe8c95acb9313c3ab902002 · state attached · log index 3624146845 · transparency-log entry
    • kind vsa · digest sha256:0bdd3342b6b44f6fd9543a259eed3c3fa4befb422fe8c95acb9313c3ab902002 · state attached · log index 3624151003 · transparency-log entry
    • kind provenance · digest sha256:725978e709c6a6a9de138434a8008486ea26a7ef43b6735db2ebf5a3336df85b · state attached · log index 3624154402 · transparency-log entry
    • kind sbom · digest sha256:725978e709c6a6a9de138434a8008486ea26a7ef43b6735db2ebf5a3336df85b · state attached · log index 3624157192 · transparency-log entry
    • kind vsa · digest sha256:725978e709c6a6a9de138434a8008486ea26a7ef43b6735db2ebf5a3336df85b · state attached · log index 3624161066 · transparency-log entry
    (at 2026-11-01T08:07:59Z) [attestations.json, results]

Offline clean-room rebuilds

  • 2026-11-01T03:41:51Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:725978e709c6a6a9de138434a8008486ea26a7ef43b6735db2ebf5a3336df85b [clean-room rebuild ledger, runs[564]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
  • Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

Fully recorded
  • Image pushed (internal tag), publish_image passed2026-11-01T03:22:49Z [stage_runs, stage_runs chain 808 stage publish_image]
  • Release tag promoted2026-11-01T08:09:54Z (method imagetools_create_retag_by_digest_no_rebuild · digest sha256:0bdd3342b6b44f6fd9543a259eed3c3fa4befb422fe8c95acb9313c3ab902002 · tag readystack/frappecrm:v1.90.0-CE-ubuntu24.04-r2) [deliverables/provenance/PROMOTION_RECORD.json, promoted_at]
  • Archive manifests written2026-11-01T08:02:43Z [PUBLISH_MANIFEST.json, published_at]
  • Archive cut over on prodasset, package_archive passed2026-11-01T08:11:45Z [stage_runs, stage_runs chain 808 stage package_archive]
  • Cut-over markerpresent (chain 808) [.cutover.json]
  • Release checklist and site event2026-11-01T08:11:43Z (status complete · site event 305 · steps grade a verified done · release tag promoted done · cosign signed done · release evidence recorded done · contract gate passed done · archive published done · hub readme live done · reproducibility recorded done · defects ledger published done · catalog available done · build request fulfilled done · seo regenerated skipped · site catalogue refreshed done · site grade recorded done · site queue synced done · customer requests charged done · owners notified done) [deliverables/provenance/RELEASE_CHECKLIST.json, run_at]

Packages and CPU level

Fully recorded
  • Packages in the image450 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 1181 · probed 2026-11-02T17:03:35Z · source backfill) [release_images, isa_level_hard]

History

2 events
  • 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records
  • 2026-11-03T01:44:24Z repack: previous sha256 57f799ad761a27526d845b7e906a2ce6d7edd4b794c4fa8fee03d6294fedec3e · sha256 4053919434379d6fe916db34f63f5e38294e8878f5fd372a6c125194e6d2afa2 · reason customer kit files brought up to the current engine: every pinned input's reason (docs/PINS.md, docs/provenance/PINS.json) and docs/PROVENANCE.md's section pointing at it, rendered by release/pin_reasons.py; docs/PROVENANCE.md's 'Build trail' section pointing at the signed build trail beside the archive (release/build_trail.py); not image inputs; image and every build input unchanged · label kitfix · replaced docs/PROVENANCE.md · added docs/PINS.md, docs/provenance/PINS.json · record MANIFEST.json repack_history

Records

26 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.tar.gz)—
.cutover.jsonbeside the archive (prodasset /data/production/frappecrm/v1.90.0-CE-ubuntu24.04-r2/)—
MANIFEST.jsonbeside the archive (prodasset /data/production/frappecrm/v1.90.0-CE-ubuntu24.04-r2/)—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/frappecrm/v1.90.0-CE-ubuntu24.04-r2/)—
ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/frappecrm/v1.90.0-CE-ubuntu24.04-r2/)—
ReadyStack-frappecrm-v1.90.0-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/frappecrm/v1.90.0-CE-ubuntu24.04-r2/)—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/frappecrm/v1.90.0-CE-ubuntu24.04-r2/)—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)397
chainssadb, ReadyStack's engine database (not published)738, 808
defectssadb, ReadyStack's engine database (not published)frappecrm v1.90.0-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 738, chain 808
held_roundssadb, ReadyStack's engine database (not published)chain 808
image_scanssadb, ReadyStack's engine database (not published)1869
micro_step_runssadb, ReadyStack's engine database (not published)chain 808
release_imagessadb, ReadyStack's engine database (not published)frappecrm v1.90.0-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 808
stage_runssadb, ReadyStack's engine database (not published)chain 808
watch_queuesadb, ReadyStack's engine database (not published)9190
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/RELEASE_CHECKLIST.jsonthe chain's workspace on the controller (not published)—