Loki v3.7.9-CE-ubuntu24.04-r4 build trail

How ReadyStack built readystack/loki:v3.7.9-CE-ubuntu24.04-r4 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/loki:v3.7.9-CE-ubuntu24.04-r4
  • Index digestsha256:8e00f3451abc58234241cac821a0be9312a1ce9e5ef783101b67364b39de283f
  • linux/amd64 digestsha256:9a0ac3757ef1ec94eff5d330c00249941187691bfb5f76ee6b2e06e82c70c769
  • ArchiveReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.tar.gz
  • Archive SHA-256 nowe94f32c01a1908598f0ae1a94646dc1a13f1e47fbe90f15a5b74f24573842280
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-07T08:16:24Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.trail.json.sigstore ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.trail.json
ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.trail.jsonReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.trail.json.sigstoreReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.trail.mdLoki product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductLoki (loki) [MANIFEST.json]
  • Release tagv3.7.9-CE-ubuntu24.04-r4 [MANIFEST.json]
  • Imagereadystack/loki:v3.7.9-CE-ubuntu24.04-r4 [MANIFEST.json]
  • Image index digestsha256:8e00f3451abc58234241cac821a0be9312a1ce9e5ef783101b67364b39de283f [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:9a0ac3757ef1ec94eff5d330c00249941187691bfb5f76ee6b2e06e82c70c769 [ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.tar.gz (bytes 671859645) [MANIFEST.json]
  • Archive sha256 at publishe94f32c01a1908598f0ae1a94646dc1a13f1e47fbe90f15a5b74f24573842280 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/grafana/loki [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.7.9 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitd3b4a2f76bfc5625abee7ceb00b8896fa3c31549 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash7ea06a80ecfdb282b58518c1afb525b50b11736d48680cdda893e9bd49efbf9d (files 22500) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:43b7191a83576bee66f25780034b7a39e2212980594b503c1cd25599f34d6977 [ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792531295 (utc 2026-10-20T21:21:35Z) [ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.rebuild.json, engine]
  • Engine commit(s)
    • commit d7ccff446f52731f23cbe85c44adc1730f1c2bef · dirty yes · first drive 3476
    • commit 21a662bdd6974e1e462fe91e1415f9f9d120bf2d · dirty yes · first drive 3534
    • commit e16541e62dbdea62eff6330ceb63cd6047a53c06 · dirty yes · first drive 3545
    • commit 010aa541a25a24b2cef6b4553320a093daeed530 · dirty yes · first drive 3565
    • commit a40e4d9d4d44a5f8647c6bf01ffdee4ed8801afd · dirty yes · first drive 3578
    • commit dd96302b9a90f1c60df2b90f5c0b896669121550 · dirty yes · first drive 3597
    • commit 0b84905088b3228fdf50e0647d1f5a7d7d60df02 · dirty yes · first drive 3608
    • commit bd381ae76aa7f67e8731266b0aeeeea5815cd5cc · dirty yes · first drive 3617
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain740 (created 2026-10-28T01:22:55Z · trigger customer_request · upstream version v3.7.9) [chains, chains #740]
  • Requestbuild request #439 (rebuild) (requested at 2026-10-28T01:19:48Z · requested by kitforge-agent · version v3.7.9) [build_requests, build_requests #439]
  • Reasonrevision v3.7.9-CE-ubuntu24.04-r4: same upstream version rebuilt on the chiselled Ubuntu runtime (runtime_base; retarget.py --rev-bump reused #425, which r3 then fulfilled) [build_requests, build_requests #439 request_reason]
  • Supersedesreadystack/loki:v3.7.9-CE-ubuntu24.04-r3 (chain 728) [chains, chains #728]

The path through the harness

Fully recorded

1 chain · 10 drives · 18 stages · 8 rewinds

Chain 740 release · ready_to_ship

Created 2026-10-28T01:22:55Z, upstream v3.7.9, build request 439 [chains, chains #740]

DriveStartedMinutesBuild hostHow it stopped
6282026-10-28T01:23:26Z36.9build host 3 withhold-publish not recorded [drive_runs, drive_runs #628] rebuilt from a build line's log
6302026-10-28T02:33:25Z94.6build host 3 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #630] rebuilt from a build line's log
34762026-11-03T04:50:43Z58build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 15 ticks [drive_runs, drive_runs #3476]
35342026-11-07T01:41:05Z7.5build host 3 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3534]
35452026-11-07T02:44:51Z30.3build host 3 withhold-publish ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #3545]
35652026-11-07T04:26:20Z5.9build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3565]
35782026-11-07T05:17:42Z6.5build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3578]
35972026-11-07T06:36:54Z7.7build host 3 publish-held infra_hub_rate_limit at package_archive; 1 tick [drive_runs, drive_runs #3597]
36082026-11-07T07:25:30Z2.6build host 3 publish-held infra_hub_rate_limit at package_archive; 1 tick [drive_runs, drive_runs #3608]
36172026-11-07T08:08:43Z—build host 3 publish-held not recorded [drive_runs, drive_runs #3617]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-28T01:23:32Z2026-10-28T01:23:32Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-28T01:24:04Z2026-10-28T01:24:05Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-28T01:24:40Z2026-10-28T01:24:41Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-28T01:32:01Z2026-11-07T02:52:36Z4
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 1f4f4b7bb11b…
build_recipe 2278b3ccdaaa…
system_pinning fa091140511e…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health aa27df198189…
verify_offline_sh 3e8184ea230c…
base_image_digests 1d7477733bd2…
dockerfile_offline 1f4f4b7bb11b…
first_build_digest 95c760a7240c…
remediate 2026-10-28T01:32:47Z2026-11-07T02:52:40Z4
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 4d53a30c223b…
security_report f116339ab34a…
build_kit 2026-10-28T01:40:20Z2026-11-07T03:01:12Z4
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp a8734022d02b…
locked_digest 82409b88b661…
freeze_manifest 85642e5e569e…
offline_rebuild_transcript 8c20d1bdadaf…
verdict 2026-10-28T01:40:56Z2026-11-07T03:01:54Z4
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict e7ad77aa8069…
publish_image 2026-10-28T01:41:42Z2026-11-07T03:02:28Z4
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 40a7044e8f22…
promotion_record 5ab8e3081c9e…
boot_instance 2026-10-28T01:42:04Z2026-11-07T03:02:56Z8
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle c27728ae5442…
sbom 2026-10-28T01:42:16Z2026-11-07T03:03:08Z4
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 616eaa41b215…
sbom_json c4296e28622d…
schema_discovery 2026-10-28T01:42:19Z2026-11-07T03:03:11Z4
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 4ef43d41b9c2…
dependency_tree 4b7d13fc5e9e…
table_classification 0cad5c32db3c…
admin_handbook 2026-10-28T03:17:34Z2026-11-07T03:03:20Z3
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map e2c63eda268e…
admin_handbook 4c924af4df4a…
db_handbook 2026-10-28T03:38:36Z2026-11-07T03:03:31Z3
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook ea82ac351825…
seed_isolation 44b7b90b89d9…
seed_data 2026-10-28T03:38:47Z2026-11-07T03:03:42Z3
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql aa188c5a5836…
seed_cases_json d5fc947b2432…
seed_validate 2026-10-28T03:38:49Z2026-11-07T03:03:45Z3
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 126355023da0…
usecase_validate 2026-10-28T03:39:16Z2026-11-07T03:03:59Z3
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 0292d7a846a2…
test_results 7ace69fd35ee…
usecase_contract 48ea024692b2…
finalize_docs 2026-10-28T04:03:46Z2026-11-07T03:04:05Z3
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json e390251102a5…
release_notes ed2b91070b30…
api_integration_guide ef6b3ba4972e…
package_archive invalidated 2026-11-07T06:36:28Z 2026-10-28T04:08:00Z2026-11-07T05:24:12Z6
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar a8313e741877…
checksums b653968385fc…
verify_md 6d8a166c3214…
rebuild_md cdc08445d3f5…
manifest_txt a6f242ec08bc…
actions_jsonl dc5b7f995b3b…
provenance_md d8e8bcdcc996…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json c630a91161e7…

[stage_runs]

Rewinds

  • 2026-10-28T02:33:32Z: admin_handbook to assemble_kit on strategy_changed (chain 740: strategy changed — rewound from 'admin_handbook' to assemble_kit and dropped the vendored tree so the change actually reaches the build.) [stage_events, stage_events #2326]
  • 2026-11-03T04:50:47Z: package_archive to assemble_kit on strategy_changed (strategy changed (2cdbb38e38de -> 493b358d30d1)) [stage_events, stage_events #22122]
  • 2026-11-07T02:44:55Z: package_archive to assemble_kit on strategy_changed (strategy changed (493b358d30d1 -> d32465fd8220)) [stage_events, stage_events #23306]
  • 2026-11-07T03:40:56Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #23573]
  • 2026-11-07T05:00:51Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #23902]
  • 2026-11-07T06:36:28Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24130]
  • 2026-11-07T07:25:01Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24256]
  • 2026-11-07T08:08:17Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24273]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-07T05:24:12Z.

548 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook1969803 10557134 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook1637613 14617596 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate2001 not recordednot recorded —
finalize_docs1839103 231193792 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $8.37 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-07T03:16:06Z 043 findings to repackage [held_rounds, held_rounds #1423] $1.09 3 rounds, $40.00 caf70d313362…
22026-11-07T04:32:50Z 0329 findings to repackage [held_rounds, held_rounds #1432] $3.91 3 rounds, $40.00 17346a0e5803…
32026-11-07T05:24:41Z 0022 clean to publish [held_rounds, held_rounds #1438] $3.38 3 rounds, $40.00 a8313e741877…

Defects

Fully recorded
  • Ledger entries63 [defects, defects where product_slug=loki and this tag or chain]
  • Disclosed in the archive61 [docs/defects/defects.json, entries]

63 ledger entries: by severity low 55, critical 1, high 7; by status fixed-in-release 2, fixed-before-release 61.

DefectSeverityStatusFound byFixed in
RSD-loki-c38d129cfb
Admin handbook: The upstream-comparison table gives only 3100/tcp for this image, but the image exposes 3100 and 9095 (round-1 minor, not corrected). [defects, defects #157829]		lowfixed-in-releaseheld review (review model)v3.7.9-CE-ubuntu24.04-r4
RSD-loki-4a4078c9b3
CVE-2026-111497 in github.com/andybalholm/brotli v1.2.6 is on CISA's Known Exploited Vulnerabilities list [defects, defects #158361]		criticalfixed-in-releaseimage scanv3.7.9-CE-ubuntu24.04-r4
RSD-loki-94259bddcd
Admin handbook: Quick Start (continued) push example is missing the closing brace of the JSON body, so a copy-pasted first push fails with 400. [defects, defects #159076]		highfixed-before-releaseheld review (review model)—
RSD-loki-5e148e497c
Database handbook: The Unix-seconds query_range example has start and end swapped (start=now, end=one hour ago); Loki rejects it with 400. [defects, defects #159077]		highfixed-before-releaseheld review (review model)—
RSD-loki-1713cd38be
Admin handbook: States that the `id` command inside the container prints the uid/gid line; the image has no `id` binary, so a customer running it gets an exec error. [defects, defects #159078]		highfixed-before-releaseheld review (review model)—
RSD-loki-fcaf1b07b2
Database handbook: Says the `id` command inside the container shows the uid/gid line; the image has no `id` binary. [defects, defects #159079]		highfixed-before-releaseheld review (review model)—
RSD-loki-096d673580
Admin handbook: Prose says to use `docker exec` to run tar inside a running container, contradicting the stop-then-`docker run --entrypoint tar` command below it. [defects, defects #159080]		lowfixed-before-releaseheld review (review model)—
RSD-loki-aec7a75043
API guide: Prose says the backup uses `docker exec` to invoke tar on the running container, but the procedure stops the container and uses `docker run --entrypoint`. [defects, defects #159081]		lowfixed-before-releaseheld review (review model)—
RSD-loki-72257e4eac
Database handbook: Calls r2 'the previous release'; this release supersedes r3 (which already ran as uid 10001). [defects, defects #159082]		lowfixed-before-releaseheld review (review model)—
RSD-loki-e203689c9d
API guide: The Unix-seconds example uses the same instant for start and end, so a copy-pasted query silently returns no logs (round-1 fix incomplete). [defects, defects #160852]		highfixed-before-releaseheld review (review model)—
RSD-loki-cd16486d4b
Admin handbook: Says the cat-from-image command extracts the current configuration from the old container; it extracts the shipped default and overwrites an edited config.yaml, so retention silently turns off after… [defects, defects #160853]		highfixed-before-releaseheld review (review model)—
RSD-loki-cc411b829d
Database handbook: Tells the customer to save their edited configuration with the cat-from-image command (which yields the shipped default) and says a mounted file is not preserved by docker restart (it is). [defects, defects #160854]		highfixed-before-releaseheld review (review model)—
RSD-loki-048471869b
Database handbook: Copy-out command for a modified configuration reads the shipped file from the image, not the old container. [defects, defects #160855]		lowfixed-before-releaseheld review (review model)—
RSD-loki-b1ff4d4387
API guide: Copy-out step for a changed configuration reads the shipped file from the image. [defects, defects #160856]		lowfixed-before-releaseheld review (review model)—
RSD-loki-2cf4b411b6
Admin handbook: Says the earlier release ran as uid 10001 and must be chowned to 10001, contradicting every other section (r2 ran as uid 999). [defects, defects #160857]		lowfixed-before-releaseheld review (review model)—
RSD-loki-17f1111ae8
Admin handbook: Earlier release described as running as uid 10001 while telling the customer to chown to 10001. [defects, defects #160858]		lowfixed-before-releaseheld review (review model)—
RSD-loki-d52c7b04d3
Database handbook: Same uid-10001-to-10001 contradiction in the DB handbook. [defects, defects #160859]		lowfixed-before-releaseheld review (review model)—
RSD-loki-f78e48be16
Admin handbook: Self-contradictory: r3 volumes are said to be owned by uid 999. [defects, defects #160860]		lowfixed-before-releaseheld review (review model)—
RSD-loki-3114248f30
Database handbook: This release is said to replace r2; it supersedes r3 (round-1 fix incomplete). [defects, defects #160861]		lowfixed-before-releaseheld review (review model)—
RSD-loki-48a6591d27
Database handbook: r2 called "the prior release". [defects, defects #160862]		lowfixed-before-releaseheld review (review model)—
RSD-loki-82ab9be5b9
API guide: Says the release replaces r2. [defects, defects #160863]		lowfixed-before-releaseheld review (review model)—
RSD-loki-454a75195e
API guide: Says the release replaces r2. [defects, defects #160864]		lowfixed-before-releaseheld review (review model)—
RSD-loki-f38b472a22
API guide: Says the release replaces r2. [defects, defects #160865]		lowfixed-before-releaseheld review (review model)—
RSD-loki-ee0570bd84
API guide: Says every release before r4 ran as uid 999; r3 ran as uid 10001. [defects, defects #160866]		lowfixed-before-releaseheld review (review model)—
RSD-loki-2a632749ec
Admin handbook: States the opposite of the rest of the handbook about where the "Ingester not ready" text appears. [defects, defects #160867]		lowfixed-before-releaseheld review (review model)—
RSD-loki-94d01624d9
Database handbook: Claims query_range returns no data key for an empty window; it returns data.result as an empty array, and data is an object, not an array. [defects, defects #160868]		lowfixed-before-releaseheld review (review model)—
RSD-loki-d0d9ac06a4
Admin handbook: Example labelled "last 24 hours" uses fixed past dates. [defects, defects #160869]		lowfixed-before-releaseheld review (review model)—
RSD-loki-5116abab62
Database handbook: Same mislabelled example. [defects, defects #160870]		lowfixed-before-releaseheld review (review model)—
RSD-loki-d64ddc2ff2
API guide: Labels default window is stated as the last hour (API:1118, 1145, 1209) while API:1168 says all stored logs; measured: not time-filtered. [defects, defects #160871]		lowfixed-before-releaseheld review (review model)—
RSD-loki-535a11114d
API guide: Lists push under "HTTP 200"; it returns 204. [defects, defects #160872]		lowfixed-before-releaseheld review (review model)—
RSD-loki-cfdf8cfaf5
Database handbook: Says omitting any of the three retention settings makes Loki exit; omitting retention_period does not. [defects, defects #160873]		lowfixed-before-releaseheld review (review model)—
RSD-loki-b38e2f08c5
API guide: Same false "all three required or exit" claim in the API guide. [defects, defects #160874]		lowfixed-before-releaseheld review (review model)—
RSD-loki-e118c43915
Database handbook: Says the container is healthy throughout startup; it is "starting". [defects, defects #160875]		lowfixed-before-releaseheld review (review model)—
RSD-loki-142f815dc2
Admin handbook: Says no health check runs for 25 s; checks run every 5 s and only their failures are ignored during the start period. [defects, defects #160876]		lowfixed-before-releaseheld review (review model)—
RSD-loki-4562a1137d
Database handbook: States logs are removed after about 15 minutes; the effective delay is 2 h or more. [defects, defects #160877]		lowfixed-before-releaseheld review (review model)—
RSD-loki-c0fb4303ce
API guide: Absolute claim that no configuration change reclaims space contradicts the retention section. [defects, defects #160878]		lowfixed-before-releaseheld review (review model)—
RSD-loki-4ee368c2ea
Admin handbook: The same guidance gives three different version thresholds (3.7.9, 3.7.8, 3.7.0). [defects, defects #160879]		lowfixed-before-releaseheld review (review model)—
RSD-loki-3519726a44
Database handbook: Names a tool that does not report volume usage. [defects, defects #160880]		lowfixed-before-releaseheld review (review model)—
RSD-loki-965b41d0ec
Database handbook: Places the new docker run between stop and rm, which fails with a name conflict. [defects, defects #160881]		lowfixed-before-releaseheld review (review model)—
RSD-loki-96c4b1229d
API guide: Copy-out step is placed after the container has already been removed. [defects, defects #160882]		lowfixed-before-releaseheld review (review model)—
RSD-loki-2c9412485b
API guide: Example log lines show invented caller file:line values. [defects, defects #160883]		lowfixed-before-releaseheld review (review model)—
RSD-loki-126d4e887c
API guide: False isolation claim: the host can reach the unpublished container ports on the bridge network. [defects, defects #163216]		lowfixed-before-releaseheld review (review model)—
RSD-loki-98416ec00b
API guide: Implies /services reflects readiness and shows Pending/Failed states during startup; measured: all Running long before /ready is 200. [defects, defects #163217]		lowfixed-before-releaseheld review (review model)—
RSD-loki-0127061d18
Admin handbook: A Running module is not necessarily ready; /services is Running while /ready is still 503. [defects, defects #163218]		lowfixed-before-releaseheld review (review model)—
RSD-loki-2239f2bf92
API guide: Contradicts the other Labels API sections and the measured behaviour (round-2 finding fixed in 1145/1209 but left here). [defects, defects #163219]		lowfixed-before-releaseheld review (review model)—
RSD-loki-5284e5fe4f
API guide: Absolute claim that retention cannot free space contradicts the retention-enabled paragraphs (round-2 finding, not fully removed). [defects, defects #163220]		lowfixed-before-releaseheld review (review model)—
RSD-loki-4f6224b9b9
Database handbook: 'Removing the container' deletes logs is wrong for a volume; the absolute 'neither can free space' contradicts the next paragraph. [defects, defects #163221]		lowfixed-before-releaseheld review (review model)—
RSD-loki-e126f7a6c7
Database handbook: Self-contradictory: 'only way is to enlarge the volume' vs 'free space elsewhere on that filesystem'. [defects, defects #163222]		lowfixed-before-releaseheld review (review model)—
RSD-loki-2bb4aa3d83
Database handbook: Unsupported absolute claim that contradicts the retention sections. [defects, defects #163223]		lowfixed-before-releaseheld review (review model)—
RSD-loki-8e99fccc4f
Admin handbook: Deleting files from a separate volume does not lower usage of the /loki filesystem. [defects, defects #163224]		lowfixed-before-releaseheld review (review model)—
RSD-loki-4018aa2e2d
Database handbook: Contradicts the same section's neighbour and implies a restart does not pick up edits (round-2 'restart' finding family). [defects, defects #163225]		lowfixed-before-releaseheld review (review model)—
RSD-loki-73a30b0731
API guide: Contradicts API:1825/1957/2079 and implies a restart is not enough. [defects, defects #163226]		lowfixed-before-releaseheld review (review model)—
RSD-loki-4dc74de2d7
Database handbook: The cat-from-image command shows the shipped file, not the effective configuration (same command family as the round-2 findings). [defects, defects #163227]		lowfixed-before-releaseheld review (review model)—
RSD-loki-951640e986
Database handbook: Says the time range is required; it is optional. [defects, defects #163228]		lowfixed-before-releaseheld review (review model)—
RSD-loki-c7e49b6882
API guide: False 'both required' claim. [defects, defects #163229]		lowfixed-before-releaseheld review (review model)—
RSD-loki-ec1f951125
API guide: Names the wrong condition for the 404 and contradicts API:1845. [defects, defects #163230]		lowfixed-before-releaseheld review (review model)—
RSD-loki-98291ab943
API guide: Contradicts the r2 special case that follows. [defects, defects #163231]		lowfixed-before-releaseheld review (review model)—
RSD-loki-d78b8c37e3
Database handbook: Reads as if r4 changed the user relative to r3, which it supersedes. [defects, defects #163232]		lowfixed-before-releaseheld review (review model)—
RSD-loki-e0dad4d514
API guide: Same ambiguity: 'earlier release' includes r3, which ran as 10001, so the chown instruction is wrong for an r3 volume. [defects, defects #163233]		lowfixed-before-releaseheld review (review model)—
RSD-loki-c2b7ba55b5
Database handbook: Names a document as a copy of the script. [defects, defects #163234]		lowfixed-before-releaseheld review (review model)—
RSD-loki-edf4a4d62d
API guide: Suggests restart policies recover an unhealthy container. [defects, defects #163235]		lowfixed-before-releaseheld review (review model)—
RSD-loki-bc8b7ebfd3
API guide: Procedure omits docker stop, so its docker rm fails on a running container. [defects, defects #163236]		lowfixed-before-releaseheld review (review model)—
RSD-loki-5c3af18edc
Admin handbook: Two different thresholds (3.7.9 vs 3.7.0) for the same guidance remain (round-2 finding). [defects, defects #163237]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:9a0ac3757ef1ec94eff5d330c00249941187691bfb5f76ee6b2e06e82c70c769 · published digest sha256:9a0ac3757ef1ec94eff5d330c00249941187691bfb5f76ee6b2e06e82c70c769 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 233) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-07T08:09:07Z · failing Docker Scout counts 10 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-07T08:08:55Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3733271655 · transparency-log entry · integrated 2026-11-07T08:14:51Z) [ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:8e00f3451abc58234241cac821a0be9312a1ce9e5ef783101b67364b39de283f · state attached · log index 3733274628 · transparency-log entry
    • kind sbom · digest sha256:8e00f3451abc58234241cac821a0be9312a1ce9e5ef783101b67364b39de283f · state attached · log index 3733275863 · transparency-log entry
    • kind vsa · digest sha256:8e00f3451abc58234241cac821a0be9312a1ce9e5ef783101b67364b39de283f · state attached · log index 3733277083 · transparency-log entry
    • kind provenance · digest sha256:9a0ac3757ef1ec94eff5d330c00249941187691bfb5f76ee6b2e06e82c70c769 · state attached · log index 3733278890 · transparency-log entry
    • kind sbom · digest sha256:9a0ac3757ef1ec94eff5d330c00249941187691bfb5f76ee6b2e06e82c70c769 · state attached · log index 3733280234 · transparency-log entry
    • kind vsa · digest sha256:9a0ac3757ef1ec94eff5d330c00249941187691bfb5f76ee6b2e06e82c70c769 · state attached · log index 3733281586 · transparency-log entry
    (at 2026-11-07T08:14:52Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/loki/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-07T03:16:10Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:9a0ac3757ef1ec94eff5d330c00249941187691bfb5f76ee6b2e06e82c70c769 [clean-room rebuild ledger, runs[599]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-07T03:02:28Z [stage_runs, stage_runs chain 740 stage publish_image]
  • Archive manifests written2026-11-07T08:12:44Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 61 · probed 2026-11-07T02:57:01Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-07T08:16:24Z generated: by KitForge release/build_trail.py · generator commit 0185b65902e7de72275f275e796ced5f2061c824
  • 2026-11-07T08:17:52Z publication: promoted at 2026-11-07T08:16:56Z · promoted digest sha256:8e00f3451abc58234241cac821a0be9312a1ce9e5ef783101b67364b39de283f · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 339 · checklist status complete · checklist at 2026-11-07T08:17:52Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/loki/v3.7.9-CE-ubuntu24.04-r4/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/loki/v3.7.9-CE-ubuntu24.04-r4/), as staged for publishing—
ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.rebuild.jsonbeside the archive (prodasset /data/production/loki/v3.7.9-CE-ubuntu24.04-r4/), as staged for publishing—
ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r4.rebuild.json.sigstorebeside the archive (prodasset /data/production/loki/v3.7.9-CE-ubuntu24.04-r4/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/loki/v3.7.9-CE-ubuntu24.04-r4/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)439
chainssadb, ReadyStack's engine database (not published)740
defectssadb, ReadyStack's engine database (not published)loki v3.7.9-CE-ubuntu24.04-r4
drive_runssadb, ReadyStack's engine database (not published)chain 740
held_roundssadb, ReadyStack's engine database (not published)chain 740
lesson_recallssadb, ReadyStack's engine database (not published)chain 740
micro_step_runssadb, ReadyStack's engine database (not published)chain 740
release_imagessadb, ReadyStack's engine database (not published)loki v3.7.9-CE-ubuntu24.04-r4
stage_eventssadb, ReadyStack's engine database (not published)chain 740
stage_runssadb, ReadyStack's engine database (not published)chain 740
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—