Mastodon v4.7.4-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/mastodon:v4.7.4-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON

Imagereadystack/mastodon:v4.7.4-CE-ubuntu24.04-r1
Index digestsha256:2240012a3ee894b955e67b0fa9621183b9974cb1451f68ffbba4b3c062a7a63f
linux/amd64 digestsha256:426e1abb01de6f2652e23d2d2bdde2df9c24eae4ad2517520c395ba07830a02b
ArchiveReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.tar.gz
Archive SHA-256 now9eb346eb2e2638ba5547a343527ff534536552a78694fb2ebc5ce1025005c19a
Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
Sections9 sections, 4 fully recorded; 11 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.trail.json

ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.trail.json ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.trail.md Mastodon product page

Identity Why this release exists The path through the harness Model work per stage Review Defects Verification Publication Packages and CPU level

Identity

1 item not recorded

ProductMastodon (mastodon) [MANIFEST.json]
Release tagv4.7.4-CE-ubuntu24.04-r1 [MANIFEST.json]
Imagereadystack/mastodon:v4.7.4-CE-ubuntu24.04-r1 [MANIFEST.json]
Image index digestsha256:2240012a3ee894b955e67b0fa9621183b9974cb1451f68ffbba4b3c062a7a63f [docs/provenance/LOCKED_DIGEST.txt]
linux/amd64 image digestsha256:426e1abb01de6f2652e23d2d2bdde2df9c24eae4ad2517520c395ba07830a02b [ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
ArchiveReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.tar.gz (bytes 661373571) [MANIFEST.json]
Archive sha256 at publish9eb346eb2e2638ba5547a343527ff534536552a78694fb2ebc5ce1025005c19a [MANIFEST.json, tarball_sha256]
Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
Upstream repositoryhttps://github.com/mastodon/mastodon [docs/provenance/SOURCE_TREE_HASH.json]
Upstream refv4.7.4 [docs/provenance/SOURCE_TREE_HASH.json]
Upstream commitd04059fc80be5cbba6b4dd5a8b94d63ffff09f2c [docs/provenance/SOURCE_TREE_HASH.json]
Source tree hash66fa0a9ee21b341cf1bde47e22d905c3296233c69d950ee483bbcb7209929066 (files 9932) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
Kit tree hashsha256:54eeff31c3f8c0fdc0aba69ff819735e47762cb715cd604841fc8361d1231d18 [ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
SOURCE_DATE_EPOCH1793282182 (utc 2026-10-29T13:56:22Z) [ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
Base images
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
[ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.rebuild.json, bases]
BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.rebuild.json, engine]

Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded

Chain806 (created 2026-10-31T16:57:24Z · trigger customer_request · upstream version v4.7.4) [chains, chains #806]
Requestbuild request #446 (new_product) (requested at 2026-10-28T03:12:41Z · requested by agent · version v4.7.4) [build_requests, build_requests #446]
Reasonce.rodeo trending tier 1 (no free A/B image), owner 2026-10-27 'all apps queued' (docs/CATALOGUE_EXPANSION.md) [build_requests, build_requests #446 request_reason]

The path through the harness

2 items not recorded

2 chains · 14 drives · 18 stages · 8 rewinds

Chain 763 behind it · abandoned

Created 2026-10-28T09:44:10Z, completed 2026-10-31T16:53:06Z, upstream v4.7.3, build request 446 [chains, chains #763]

Abandoned: chain 763 abandoned [watch_queue, watch_queue #9399 resolution]

Drive	Started	Minutes	Build host	How it stopped
834	2026-10-28T09:44:23Z	1117.9	build host 4 withhold-publish	stage_failed at assemble_kit [drive_runs, drive_runs #834] rebuilt from a build line's log
836	2026-10-29T17:39:35Z	61.2	build host 4 withhold-publish	not recorded [drive_runs, drive_runs #836] rebuilt from a build line's log
847	2026-10-29T22:19:24Z	—	build host 4 withhold-publish	lost [drive_runs, drive_runs #847] rebuilt from a build line's log

Chain 806 release · shipped

Created 2026-10-31T16:57:24Z, upstream v4.7.4, build request 446 [chains, chains #806]

Drive	Started	Minutes	Build host	How it stopped
21	2026-10-31T16:57:38Z	55.5	build host 4 withhold-publish	stage_failed at verdict [drive_runs, drive_runs #21] rebuilt from a build line's log
22	2026-11-01T01:44:56Z	70.6	build host 4 withhold-publish	not recorded [drive_runs, drive_runs #22] rebuilt from a build line's log
23	2026-11-01T03:39:30Z	18.5	build host 4 withhold-publish	stage_failed at package_archive [drive_runs, drive_runs #23] rebuilt from a build line's log
24	2026-11-01T04:33:20Z	22.4	build host 4 withhold-publish	ready_to_ship [drive_runs, drive_runs #24] rebuilt from a build line's log
25	2026-11-01T05:39:29Z	8.6	build host 4 withhold-publish	ready_to_ship [drive_runs, drive_runs #25] rebuilt from a build line's log
26	2026-11-01T06:10:43Z	8.7	build host 4 withhold-publish	ready_to_ship [drive_runs, drive_runs #26] rebuilt from a build line's log
27	2026-11-01T06:51:02Z	2.4	build host 4 withhold-publish	stage_failed at package_archive [drive_runs, drive_runs #27] rebuilt from a build line's log
28	2026-11-01T07:01:49Z	8.4	build host 4 withhold-publish	ready_to_ship [drive_runs, drive_runs #28] rebuilt from a build line's log
29	2026-11-01T08:19:09Z	8.4	build host 4 withhold-publish	ready_to_ship [drive_runs, drive_runs #29] rebuilt from a build line's log
30	2026-11-01T08:55:39Z	8.6	build host 4 withhold-publish	ready_to_ship [drive_runs, drive_runs #30] rebuilt from a build line's log
31	2026-11-01T09:35:23Z	12.3	build host 4 publish-held	shipped [drive_runs, drive_runs #31] rebuilt from a build line's log

Stages, in order

Stage	First start	Passed	Attempts	Gate checks passed	Artifacts (SHA-256)
`intake`	2026-10-31T16:57:44Z	2026-10-31T16:57:44Z	1	4 `exists:order_json` `order_json:json_parses` `order_json:no_forbidden_placeholders` `produces_paths_exist`	—
`acquire`	2026-10-31T16:57:51Z	2026-10-31T16:57:52Z	1	12 `exists:source_tree` `exists:source_tree_hash` `exists:source_file_manifest` `exists:custody_inputs` `exists:license_file` `source_tree:dir_nonempty` `source_tree_hash:json_parses` `source_file_manifest:json_parses` `custody_inputs:json_parses` `license_file:file_nonempty` `produces_paths_exist` `custody_inputs:json_true:ce_audit.ce_only`	—
`plan`	2026-10-31T16:58:29Z	2026-10-31T16:58:30Z	1	10 `exists:recon_report` `exists:input_pin_plan` `exists:toolchain_lock` `recon_report:md_min_sections:3` `recon_report:no_forbidden_placeholders` `input_pin_plan:md_min_sections:2` `input_pin_plan:no_forbidden_placeholders` `toolchain_lock:file_nonempty` `toolchain_lock:no_forbidden_placeholders` `produces_paths_exist`	—
`assemble_kit`	2026-10-31T17:22:33Z	2026-11-01T02:09:57Z	2	27 `exists:dockerfile` `exists:base_image_digests` `exists:system_pinning` `exists:build_recipe` `exists:first_build_digest` `exists:first_boot_health` `exists:dockerfile_offline` `exists:verify_offline_sh` `exists:build_offline_sh` `exists:generate_sbom_sh` `dockerfile:file_nonempty` `dockerfile:no_forbidden_placeholders` `base_image_digests:file_nonempty` `system_pinning:file_nonempty` `build_recipe:json_parses` `first_build_digest:file_nonempty` `first_boot_health:file_nonempty` `dockerfile_offline:file_nonempty` `dockerfile_offline:no_forbidden_placeholders` `verify_offline_sh:file_nonempty` `verify_offline_sh:no_forbidden_placeholders` `build_offline_sh:file_nonempty` `build_offline_sh:no_forbidden_placeholders` `generate_sbom_sh:file_nonempty` `generate_sbom_sh:no_forbidden_placeholders` `produces_paths_exist` `first_boot_health:file_contains:healthy=True`	—
`remediate`	2026-10-31T17:23:24Z	2026-11-01T02:10:00Z	2	8 `exists:vendored_apt` `exists:remediation_log` `exists:security_report` `vendored_apt:dir_exists` `remediation_log:json_parses` `security_report:md_min_sections:2` `security_report:no_forbidden_placeholders` `produces_paths_exist`	—
`build_kit`	2026-10-31T17:49:58Z	2026-11-01T02:37:05Z	2	9 `exists:freeze_manifest` `exists:locked_digest` `exists:cosign_stamp` `exists:offline_rebuild_transcript` `freeze_manifest:json_parses` `locked_digest:file_nonempty` `cosign_stamp:file_nonempty` `offline_rebuild_transcript:json_parses` `produces_paths_exist`	—
`verdict`	2026-10-31T17:53:06Z	2026-11-01T02:39:14Z	2	8 `exists:scout_verdict` `scout_verdict:json_parses` `produces_paths_exist` `scout_verdict:release_check_passed` `scout_verdict:nonroot_green` `scout_verdict:zero_fixable_crit_high` `scout_verdict:osv_clean` `scout_verdict:no_baked_secrets`	—
`publish_image`	2026-11-01T02:40:17Z	2026-11-01T02:40:18Z	1	7 `exists:promotion_record` `exists:hub_readme` `promotion_record:json_parses` `hub_readme:md_min_sections:2` `hub_readme:no_forbidden_placeholders` `produces_paths_exist` `promotion_record:json_true:signed`	—
`boot_instance`	2026-11-01T02:41:02Z	2026-11-01T03:40:47Z	3	—	—
`sbom`	2026-11-01T02:41:36Z	2026-11-01T02:41:37Z	1	5 `exists:sbom_json` `exists:sbom_md` `sbom_json:json_parses` `sbom_md:md_min_sections:1` `produces_paths_exist`	—
`schema_discovery`	2026-11-01T02:41:39Z	2026-11-01T02:41:39Z	1	7 `exists:dependency_tree` `exists:table_classification` `exists:schema_hash` `dependency_tree:json_parses` `table_classification:json_parses` `schema_hash:file_nonempty` `produces_paths_exist`	—
`admin_handbook`	2026-11-01T02:48:44Z	2026-11-01T02:48:45Z	1	7 `exists:admin_handbook` `exists:api_map` `admin_handbook:md_min_sections:10` `admin_handbook:no_forbidden_placeholders` `api_map:json_parses` `produces_paths_exist` `admin_handbook:command_transcripts_clean`	—
`db_handbook`	2026-11-01T02:54:18Z	2026-11-01T02:54:19Z	1	8 `exists:db_handbook` `exists:seed_isolation` `db_handbook:md_min_sections:5` `db_handbook:no_forbidden_placeholders` `seed_isolation:md_min_sections:1` `seed_isolation:no_forbidden_placeholders` `produces_paths_exist` `db_handbook:command_transcripts_clean`	—
`seed_data`	2026-11-01T02:54:51Z	2026-11-01T02:54:51Z	1	6 `exists:seed_data_sql` `exists:seed_cases_json` `seed_data_sql:sql_parses` `seed_data_sql:no_forbidden_placeholders` `seed_cases_json:json_parses` `produces_paths_exist`	—
`seed_validate`	2026-11-01T02:54:53Z	2026-11-01T02:54:54Z	1	3 `exists:seed_data_contract` `seed_data_contract:json_parses` `produces_paths_exist`	—
`usecase_validate`	2026-11-01T02:55:16Z	2026-11-01T02:55:17Z	1	10 `exists:usecase_contract` `exists:passed_tests` `exists:failed_tests` `exists:test_results` `usecase_contract:json_parses` `passed_tests:md_min_sections:1` `failed_tests:md_min_sections:1` `test_results:json_parses` `produces_paths_exist` `test_results:usecase_thresholds:80,70`	—
`finalize_docs`	2026-11-01T03:46:45Z	2026-11-01T03:46:46Z	1	9 `exists:api_integration_guide` `exists:release_notes` `exists:defects_json` `api_integration_guide:md_min_sections:3` `api_integration_guide:no_forbidden_placeholders` `release_notes:md_min_sections:3` `release_notes:no_forbidden_placeholders` `defects_json:json_parses` `produces_paths_exist`	—
`package_archive`	2026-11-01T03:58:01Z	2026-11-01T09:47:40Z	9	33 (final gate PASS) `exists:checksums` `exists:verify_md` `exists:rebuild_md` `exists:provenance_md` `exists:manifest_txt` `exists:assetchain_log_md` `exists:assetchain_log_json` `exists:actions_jsonl` `exists:sale_tar` `checksums:file_nonempty` `verify_md:md_min_sections:2` `verify_md:no_forbidden_placeholders` `rebuild_md:md_min_sections:2` `rebuild_md:no_forbidden_placeholders` `provenance_md:md_min_sections:2` `provenance_md:no_forbidden_placeholders` `manifest_txt:file_nonempty` `assetchain_log_md:md_min_sections:1` `assetchain_log_json:json_parses` `actions_jsonl:file_nonempty` `sale_tar:file_nonempty` `produces_paths_exist` `G8 cosign` `G8 scan_grade` `G8 tag_base_os` `G8 vex_shipped` `G8 scout_grade_a` `G8 script_copies` `G8 three_way_sha` `G8 offline_rebuild` `G8 rebuild_manifest` `G8 artifact_coverage` `G8 assetchain_coverage`	—

[stage_runs]

Rewinds

2026-11-01T01:45:01Z: verdict to assemble_kit on strategy_changed (chain 806: strategy changed — rewound from 'verdict' to assemble_kit and dropped the vendored tree so the change actually reaches the build.) [stage_events, stage_events #2358]
2026-11-01T05:34:06Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2117]
2026-11-01T06:05:15Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2118]
2026-11-01T06:43:53Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2119]
2026-11-01T08:13:36Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2120]
2026-11-01T08:49:26Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2121]
2026-11-01T09:27:44Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2122]
2026-11-01T09:34:49Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #35]

Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-11-01T09:47:40Z.

178 calls over 6 stages

Stage	Calls	Refused	Max attempt	Forced commits	Real tokens	Lesson rules shown
`plan`	2	0	1	not recorded	not recorded	—
`remediate`	2	0	1	not recorded	not recorded	—
`admin_handbook`	59	30	3	not recorded	not recorded	—
`db_handbook`	50	25	3	not recorded	not recorded	—
`usecase_validate`	1	0	1	not recorded	not recorded	—
`finalize_docs`	64	32	3	not recorded	not recorded	—

[micro_step_runs]

Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

3 items not recorded

Role: review model.

6 rounds, 6 counted, $10.73 recorded cost

Round	Started	Critical	Major	Minor	Verdict	Cost	Cap in force	Archive reviewed
1	2026-11-01T04:56:19Z	2	12	11	findings to repackage [held_rounds, held_rounds #97] rebuilt from a held-review state file	$2.15	not recorded	not recorded
2	2026-11-01T05:48:46Z	0	2	12	findings to repackage [held_rounds, held_rounds #98] rebuilt from a held-review state file	$1.66	not recorded	not recorded
3	2026-11-01T06:20:08Z	0	2	7	findings to repackage [held_rounds, held_rounds #99] rebuilt from a held-review state file	$1.52	not recorded	not recorded
4	2026-11-01T07:54:19Z	0	2	3	findings to repackage [held_rounds, held_rounds #100] rebuilt from a held-review state file	$1.89	not recorded	not recorded
5	2026-11-01T08:28:00Z	0	2	2	findings to repackage [held_rounds, held_rounds #101] rebuilt from a held-review state file	$2.10	not recorded	not recorded
6	2026-11-01T09:04:43Z	0	0	1	clean to repackage [held_rounds, held_rounds #102] rebuilt from a held-review state file	$1.42	not recorded	not recorded

Overrides

max_rounds: — to 6; by not recorded; why: not recorded predates override recording (2026-11-02): found in runstate/held-auto/mastodon.json, last written 2026-11-01T09:27Z; who set it, why, when and the value before are not known [review_overrides, review_overrides #12]

Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
Not recorded: the round cap in force at each round (the state files did not keep it)
Not recorded: who raised max_rounds to 6 and why (review_overrides #12 was backfilled from a state file; overrides are recorded with who and why from 2026-11-02)

Defects

Fully recorded

Ledger entries56 [defects, defects where product_slug=mastodon and this tag or chain]
Disclosed in the archive56 [docs/defects/defects.json, entries]

56 ledger entries: by severity critical 2, high 19, low 35; by status fixed-before-release 56.

Defect	Severity	Status	Found by	Fixed in
`RSD-mastodon-1015e6ca8e` Admin handbook: The documented restore pipes a plain pg_dump (CREATE TABLE etc., no --clean) into the live, already-populated database. [defects, defects #147430]	critical	fixed-before-release	held review (review model)	—
`RSD-mastodon-5486b7584d` Admin handbook: The source-extraction command fails as written: Docker creates the missing bind-mount directory owned by root and the non-root mastodon user (uid 991) cannot write into it. [defects, defects #147431]	critical	fixed-before-release	held review (review model)	—
`RSD-mastodon-34b0cee5f3` Admin handbook: A lost Redis loses the jobs it holds; they cannot be 'retried'. [defects, defects #147432]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-da50b965ad` Admin handbook: Pulling a new tag and 'restarting' the container never runs the new image, so the documented upgrade does not upgrade anything; sidekiq and streaming are not mentioned. [defects, defects #147433]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-cc7e366906` Admin handbook: The sentence tells the customer to set the skip variable on upgrade, which skips the migrations the upgrade needs; it contradicts lines 512, 547 and 826. [defects, defects #147434]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-f10036cd2e` API guide: 'Subsequent deployments' includes upgrades; following it skips the migrations a new release needs. [defects, defects #147435]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-7eb68625f9` API guide: Ambiguous: 'subsequent web containers' versus 'omit only after an upgrade' reads as 'set it on a re-created web container unless upgrading'. [defects, defects #147436]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-774f57eba9` Admin handbook: The sentence claims a wait that the entrypoint does not perform. [defects, defects #147437]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-265577752c` Admin handbook: Following the sentence sends streaming requests to the web server, which does not serve them (self-redirect), so real-time updates break; it contradicts the handbook's own nginx example and the… [defects, defects #147438]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-cc73ef15b4` Database handbook: Routing all traffic to port 3000 is offered as an option, but the web server does not serve the streaming API. [defects, defects #147439]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-692ffa3b3d` API guide: The routing list sends all of /api/ (including /api/v1/streaming) to port 3000 and contradicts the other routing sections of the same guide. [defects, defects #147440]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-f59d5a0733` Admin handbook: On a first start sidekiq is started while the web container is still preparing the database, crashes and stays stopped (no restart policy), so no background jobs run until the customer notices. [defects, defects #147441]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-542e18bda6` Database handbook: The start sequence starts sidekiq before the database schema exists. [defects, defects #147442]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-a13769a14d` Admin handbook: Telling the customer to rely on `docker ps` hides that the image's web-only HEALTHCHECK makes two of the three documented containers permanently unhealthy, which an orchestrator or autoheal tool… [defects, defects #147443]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-3586d841ae` API guide: The example one-off command omits `--network mastodon-net`, so it cannot reach the database and fails; db:seed is also not an administrative step a customer needs (the web container prepares the… [defects, defects #147444]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-b35f6f2481` Admin handbook: Mastodon checks the domain only, not ownership, and --confirmed needs no outgoing mail. [defects, defects #147445]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-17f2f3e1b7` Database handbook: The address does not have to belong to the customer's domain. [defects, defects #147446]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-c257965037` API guide: 'Will not operate without that check' is unsupported. [defects, defects #147447]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-556e6be204` Admin handbook: A stop does not lose the files; a removal does. [defects, defects #147448]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-9466c1fe8c` API guide: The sentence places the Sidekiq queue in PostgreSQL. [defects, defects #147449]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-7f5b47f5cf` Database handbook: The image sets its own 10 s interval; 30 s is only Docker's default. [defects, defects #147450]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-4ef892c13c` Database handbook: Irrelevant and misleading reason; the same wording in API guide line 310 ('can bind to port 4000 because the container's network namespace allows unprivileged binding'). [defects, defects #147451]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-96cbbe5bce` API guide: Contradicts the guide's other sections. [defects, defects #147452]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-5af5536a63` Admin handbook: A first-start password must say when to remove it; also the user is `mastodon` (POSTGRES_USER), not a 'root' password. [defects, defects #147453]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-1cb412da07` Database handbook: 'Drop the database and start over' is unsupported and destructive advice. [defects, defects #147454]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-b2dd3c9ac9` Admin handbook: Following the sentence sends streaming requests to the web server, which does not serve them, so real-time updates break; it contradicts the handbook's own routing sections (the round-1 routing… [defects, defects #148237]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-39879f7fe1` Database handbook: The documented command to open a Rails console runs without -i/-t, so no interactive console opens. [defects, defects #148238]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-58aea350d3` Admin handbook: The placeholder invites `bin/rails console` without -it. [defects, defects #148239]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-6ea80bc257` Admin handbook: The sentence restarts only the web container after stopping all three, so background jobs and streaming stay down. [defects, defects #148240]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-9d27aea9ac` Admin handbook: Claims encryption key generation is automatic; contradicts the Startup Sequence, which has the customer generate and back up the keys. [defects, defects #148241]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-99ef7726f1` Admin handbook: 'Retried until they succeed' is unsupported and the sentence contradicts the Redis section. [defects, defects #148242]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-3396c150a9` Admin handbook: Says Redis data can be regenerated; jobs cannot. [defects, defects #148243]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-eb5626ce70` Database handbook: A re-created web container after an upgrade can be read as a 'subsequent' container, which would skip the migrations. [defects, defects #148244]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-d0210a4233` Database handbook: The proxy list in this section omits the streaming route, so following it alone sends streaming to the web server. [defects, defects #148245]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-4644a52386` API guide: Only the web route is given; streaming is left out. [defects, defects #148246]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-a84f41f80d` API guide: The first sentence routes by request type; the second routes by path. [defects, defects #148247]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-1bd5c74eb1` API guide: Unsupported advice that discourages running several web containers. [defects, defects #148248]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-5ec4eeb601` Database handbook: Unsupported condition. [defects, defects #148249]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-f3bc299d09` Admin handbook: The extraction now succeeds, but the customer's own account cannot read the extracted tree. [defects, defects #148250]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-9cf0f594a9` API guide: The pattern '/api/v1/streaming/*' omits the bare path /api/v1/streaming, which the streaming server serves and the web server redirects; a literal glob rule sends WebSocket connections to the web… [defects, defects #148329]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-f86d7cd910` Database handbook: Same glob problem as the API guide: the bare streaming path is left to the web server, breaking real-time updates for a literal glob rule. [defects, defects #148330]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-2e5b66a635` Admin handbook: The routing list gives only the web route and refers to an unstated 'streaming route'. [defects, defects #148331]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-77813c83f8` API guide: 'All paths' contradicts the next bullet that sends /api/v1/streaming to port 4000. [defects, defects #148332]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-a8b849d472` API guide: The health endpoint answers 200 without Redis; the sentence says it reports Redis connectivity. [defects, defects #148333]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-4832267382` API guide: Over-broad claim about remote lookup; contradicts the 'without the domain' description at :263. [defects, defects #148334]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-a892eb202e` Database handbook: Docker leaves the variable unset, not empty; contradicts the admin handbook. [defects, defects #148335]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-891c7debbe` Admin handbook: The Startup Sequence command is run verbatim by customers and fails; the domain caveat is only in a later section. [defects, defects #148336]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-36cbb49e24` API guide: Unsupported claim about Node memory management settings. [defects, defects #148337]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-5e2b17df71` Admin handbook: The handbook's Operating facts section does not match the current strategy: the strategy lists 9 operating_facts keys and the reverse_proxy fact (added after round 3, stating that the bare path… [defects, defects #148460]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-796671eb32` Admin handbook: tootctl accounts has no suspend or unsuspend subcommand or option; a customer who looks for it in `accounts --help` will not find it. [defects, defects #148461]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-caeaa14846` Database handbook: tootctl accounts has no suspend subcommand. [defects, defects #148462]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-b91d12f04a` Admin handbook: The 'before the first start' requirement is not true for ALTERNATE_DOMAINS: a web container re-created against the populated database with ALTERNATE_DOMAINS=alt.test answered for alt.test (200) and… [defects, defects #148463]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-32d485f85f` Admin handbook: The image has no bin/sidekiq: /opt/mastodon/bin holds only brakeman, bundler-audit, dev, flatware, haml-lint, heroku-web, i18n-tasks, prometheus_exporter, rails, rake, rspec, rubocop, setup, tootctl… [defects, defects #148805]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-cc243bfc75` API guide: The curl block tells the customer to replace only `<host>`. [defects, defects #148806]	high	fixed-before-release	held review (review model)	—
`RSD-mastodon-e9c00833c7` API guide: rsowner (and acct:rsowner@localhost in the line above) is the account of the build's test container; on a customer server the lookup answers 404 until such an account exists. [defects, defects #148807]	low	fixed-before-release	held review (review model)	—
`RSD-mastodon-f56da25c2c` Admin handbook: The section says it compares the upstream image 'at this product's version' but names v4.7.3 and a read date for that tag; this product is v4.7.4 and ghcr.io/mastodon/mastodon:v4.7.4 is published. [defects, defects #148808]	low	fixed-before-release	held review (review model)	—

Verification

2 items not recorded

Reproduced before publishingyes (rebuilt digest sha256:426e1abb01de6f2652e23d2d2bdde2df9c24eae4ad2517520c395ba07830a02b · published digest sha256:426e1abb01de6f2652e23d2d2bdde2df9c24eae4ad2517520c395ba07830a02b · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 776) [docs/provenance/REPRO_VERIFICATION.json, verified]
Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 806 package_archive gate_result.g8.result]
Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-01T09:36:06Z · failing Docker Scout counts 120 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 114 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: @mastodon/mastodon, @mastodon/streaming. · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
First own scan of the releaseA (at 2026-11-01T09:47:58Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-11-01T06:20:12Z) [image_scans, image_scans #1871]
Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-01T09:35:32Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
Image signature transparency-log entries
- log index 3618075404 · transparency-log entry
- log index 3618075600 · transparency-log entry
[deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3625837462 · transparency-log entry · integrated 2026-11-01T09:44:17Z) [ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
Signed attestations
- kind provenance · digest sha256:2240012a3ee894b955e67b0fa9621183b9974cb1451f68ffbba4b3c062a7a63f · state attached · log index 3625843741 · transparency-log entry
- kind sbom · digest sha256:2240012a3ee894b955e67b0fa9621183b9974cb1451f68ffbba4b3c062a7a63f · state attached · log index 3625849349 · transparency-log entry
- kind vsa · digest sha256:2240012a3ee894b955e67b0fa9621183b9974cb1451f68ffbba4b3c062a7a63f · state attached · log index 3625853054 · transparency-log entry
- kind provenance · digest sha256:426e1abb01de6f2652e23d2d2bdde2df9c24eae4ad2517520c395ba07830a02b · state attached · log index 3625856680 · transparency-log entry
- kind sbom · digest sha256:426e1abb01de6f2652e23d2d2bdde2df9c24eae4ad2517520c395ba07830a02b · state attached · log index 3625860056 · transparency-log entry
- kind vsa · digest sha256:426e1abb01de6f2652e23d2d2bdde2df9c24eae4ad2517520c395ba07830a02b · state attached · log index 3625863475 · transparency-log entry
(at 2026-11-01T09:44:23Z) [attestations.json, results]

Offline clean-room rebuilds

2026-11-01T04:56:22Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:426e1abb01de6f2652e23d2d2bdde2df9c24eae4ad2517520c395ba07830a02b [clean-room rebuild ledger, runs[572]]

Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

Fully recorded

Image pushed (internal tag), publish_image passed2026-11-01T02:40:18Z [stage_runs, stage_runs chain 806 stage publish_image]
Release tag promoted2026-11-01T09:46:19Z (method imagetools_create_retag_by_digest_no_rebuild · digest sha256:2240012a3ee894b955e67b0fa9621183b9974cb1451f68ffbba4b3c062a7a63f · tag readystack/mastodon:v4.7.4-CE-ubuntu24.04-r1) [deliverables/provenance/PROMOTION_RECORD.json, promoted_at]
Archive manifests written2026-11-01T09:40:58Z [PUBLISH_MANIFEST.json, published_at]
Archive cut over on prodasset, package_archive passed2026-11-01T09:47:40Z [stage_runs, stage_runs chain 806 stage package_archive]
Cut-over markerpresent (chain 806) [.cutover.json]
Release checklist and site event2026-11-01T09:47:38Z (status complete · site event 307 · steps grade a verified done · release tag promoted done · cosign signed done · release evidence recorded done · contract gate passed done · archive published done · hub readme live done · reproducibility recorded done · defects ledger published done · catalog available done · build request fulfilled done · seo regenerated skipped · site catalogue refreshed done · site grade recorded done · site queue synced done · customer requests charged done · owners notified done) [deliverables/provenance/RELEASE_CHECKLIST.json, run_at]

Packages and CPU level

Fully recorded

Packages in the image679 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 998 · probed 2026-11-02T17:06:14Z · source backfill) [release_images, isa_level_hard]

History

1 event

2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records

Records

27 records

Record	Where it is	Rows
`docs/defects/defects.json`	inside the archive (ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.tar.gz)	—
`docs/provenance/IMAGE_EVIDENCE.json`	inside the archive (ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.tar.gz)	—
`docs/provenance/LOCKED_DIGEST.txt`	inside the archive (ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.tar.gz)	—
`docs/provenance/REPRO_VERIFICATION.json`	inside the archive (ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.tar.gz)	—
`docs/provenance/SOURCE_TREE_HASH.json`	inside the archive (ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.tar.gz)	—
`.cutover.json`	beside the archive (prodasset /data/production/mastodon/v4.7.4-CE-ubuntu24.04-r1/)	—
`MANIFEST.json`	beside the archive (prodasset /data/production/mastodon/v4.7.4-CE-ubuntu24.04-r1/)	—
`PUBLISH_MANIFEST.json`	beside the archive (prodasset /data/production/mastodon/v4.7.4-CE-ubuntu24.04-r1/)	—
`ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.rebuild.json`	beside the archive (prodasset /data/production/mastodon/v4.7.4-CE-ubuntu24.04-r1/)	—
`ReadyStack-mastodon-v4.7.4-CE-ubuntu24.04-r1.rebuild.json.sigstore`	beside the archive (prodasset /data/production/mastodon/v4.7.4-CE-ubuntu24.04-r1/)	—
`SCOUT_EVIDENCE.json`	beside the archive (prodasset /data/production/mastodon/v4.7.4-CE-ubuntu24.04-r1/)	—
`clean-room rebuild ledger`	the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)	—
`build_requests`	sadb, ReadyStack's engine database (not published)	446
`chains`	sadb, ReadyStack's engine database (not published)	763, 806
`defects`	sadb, ReadyStack's engine database (not published)	mastodon v4.7.4-CE-ubuntu24.04-r1
`drive_runs`	sadb, ReadyStack's engine database (not published)	chain 763, chain 806
`held_rounds`	sadb, ReadyStack's engine database (not published)	chain 806
`image_scans`	sadb, ReadyStack's engine database (not published)	1871
`micro_step_runs`	sadb, ReadyStack's engine database (not published)	chain 806
`release_images`	sadb, ReadyStack's engine database (not published)	mastodon v4.7.4-CE-ubuntu24.04-r1
`review_overrides`	sadb, ReadyStack's engine database (not published)	12
`stage_events`	sadb, ReadyStack's engine database (not published)	chain 806
`stage_runs`	sadb, ReadyStack's engine database (not published)	chain 806
`watch_queue`	sadb, ReadyStack's engine database (not published)	9399
`attestations.json`	the chain's workspace on the controller (not published)	—
`deliverables/provenance/PROMOTION_RECORD.json`	the chain's workspace on the controller (not published)	—
`deliverables/provenance/RELEASE_CHECKLIST.json`	the chain's workspace on the controller (not published)	—