MySQL 9.7.4-CE-ubuntu24.04-r4 build trail

How ReadyStack built readystack/mysql:9.7.4-CE-ubuntu24.04-r4 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/mysql:9.7.4-CE-ubuntu24.04-r4
  • Index digestsha256:88d405398740090db849f2526e2af059daa4971b069c6bd33aac7dd081c4251c
  • linux/amd64 digestsha256:9a2c5adf1c8995e997e4ed346254358c940ea3e8b79d14a746a81a5deb4edeba
  • ArchiveReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.tar.gz
  • Archive SHA-256 now60f91e303d5e1294990ff6254b7f40581f4ee09c66421293b301fb5a3c8d4e4b
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-10T00:44:02Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.trail.json.sigstore ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.trail.json
ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.trail.jsonReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.trail.json.sigstoreReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.trail.mdMySQL product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductMySQL (mysql) [MANIFEST.json]
  • Release tag9.7.4-CE-ubuntu24.04-r4 [MANIFEST.json]
  • Imagereadystack/mysql:9.7.4-CE-ubuntu24.04-r4 [MANIFEST.json]
  • Image index digestsha256:88d405398740090db849f2526e2af059daa4971b069c6bd33aac7dd081c4251c [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:9a2c5adf1c8995e997e4ed346254358c940ea3e8b79d14a746a81a5deb4edeba [ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.tar.gz (bytes 1477246113) [MANIFEST.json]
  • Archive sha256 at publish60f91e303d5e1294990ff6254b7f40581f4ee09c66421293b301fb5a3c8d4e4b [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/mysql/mysql-server [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refmysql-9.7.4 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit780b506e8296a61f2a7067bf2087d32c78e0bb76 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash02f5225b63b5b77b31042a137b38d1f4c7f72df8625acf796f051157bdfdc557 (files 59201) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:c5fc0cfd5d3eeb3a306cb6943541e17dbb39008c5f932f3ef6f1a864703c768d [ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792523961 (utc 2026-10-20T19:19:21Z) [ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.rebuild.json, engine]
  • Engine commit(s)
    • commit 9e1e08daa6fd77ad7901229048721017ec2e4d84 · dirty yes · first drive 3984
    • commit d5e78446f06025d790702ad43076afd5663bfdf4 · dirty yes · first drive 4001
    • commit 01f9fd638561d21081d4cacf3e60cf6477b01b00 · dirty yes · first drive 4020
    • commit d205348796ed23de3b97fd9443d97cae93ec451e · dirty yes · first drive 4030
    • commit 9b46fb2966cf7f115ec4c331ca41468be77aac3c · dirty yes · first drive 4042
    • commit d28155d8ca5cbee1adc82a2bd6715600f48c577b · dirty yes · first drive 4064
    • commit af2b965a4592cf93f865060c2ed1124a061bab44 · dirty yes · first drive 4120
    • commit 74325e6b7be1da29339978fad8f76790b4961751 · dirty yes · first drive 4129
    • commit 46b5af2067e0dce3119516953acc221a4a6124d6 · dirty yes · first drive 4142
    • commit 7af80cbe7cac0e3a62e3472ca4872acfe1fb009d · dirty yes · first drive 4143
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain919 (created 2026-11-09T08:45:06Z · trigger customer_request · upstream version 9.7.4) [chains, chains #919]
  • Requestbuild request #555 (rebuild) (requested at 2026-11-08T05:00:39Z · requested by kitforge-agent · version 9.7.4) [build_requests, build_requests #555]
  • Reasonrevision 9.7.4-CE-ubuntu24.04-r4: same upstream version rebuilt on the chiselled runtime (slim base, #206) [build_requests, build_requests #555 request_reason]
  • Supersedesreadystack/mysql:9.7.4-CE-ubuntu24.04-r3 (chain 816) [chains, chains #816]

The path through the harness

Fully recorded

1 chain · 10 drives · 18 stages · 4 rewinds

Chain 919 release · ready_to_ship

Created 2026-11-09T08:45:06Z, upstream 9.7.4, build request 555 [chains, chains #919]

DriveStartedMinutesBuild hostHow it stopped
39842026-11-09T08:45:56Z122.8build host 1 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3984]
40012026-11-09T11:05:17Z36.8build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4001]
40202026-11-09T13:15:00Z12.2build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4020]
40302026-11-09T14:01:22Z3.5build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4030]
40422026-11-09T14:52:58Z1.9build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4042]
40642026-11-09T16:02:46Z1build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4064]
41202026-11-09T22:22:13Z2.4build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4120]
41292026-11-09T23:05:43Z9.2build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4129]
41422026-11-09T23:51:52Z8.7build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4142]
41432026-11-10T00:33:20Z—build host 1 publish-held not recorded [drive_runs, drive_runs #4143]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-09T08:46:07Z2026-11-09T08:46:08Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 6ef93adb6bb9…
acquire 2026-11-09T08:46:44Z2026-11-09T08:46:50Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 774a68939d0d…
license_file 89bc1cf378aa…
custody_inputs 717ab3fe3f2f…
source_tree_hash 02a717d4fa6d…
source_file_manifest b7e630ea7edd…
plan 2026-11-09T08:47:23Z2026-11-09T08:47:24Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 84b4608fcabb…
input_pin_plan 09f8a42e29c0…
toolchain_lock bdf2cfa124dc…
assemble_kit 2026-11-09T09:17:31Z2026-11-09T09:17:32Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 03d08d4f4480…
build_recipe 24fc25f917f0…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health ea2d57849735…
verify_offline_sh 3e8184ea230c…
base_image_digests 478219ad01e9…
dockerfile_offline 03d08d4f4480…
first_build_digest cdb3aaf784f0…
remediate 2026-11-09T09:18:15Z2026-11-09T09:18:16Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 0c36630a9bbe…
security_report 37436c934620…
build_kit 2026-11-09T10:10:49Z2026-11-09T10:10:50Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 16b67d0e7b84…
locked_digest d9ad65a6485a…
freeze_manifest c9fe312047a2…
offline_rebuild_transcript ecb52c59be73…
verdict 2026-11-09T10:11:42Z2026-11-09T10:11:43Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict e0d951cd4d1b…
publish_image 2026-11-09T10:12:20Z2026-11-09T10:12:21Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme b357eede2697…
promotion_record f625e32b75c7…
boot_instance 2026-11-09T10:12:38Z2026-11-09T10:12:42Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 8af63b00e0eb…
sbom 2026-11-09T10:12:59Z2026-11-09T10:13:00Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 6c32dbdf80af…
sbom_json fd756d324084…
schema_discovery 2026-11-09T10:13:02Z2026-11-09T10:13:03Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash ace2d359e979…
dependency_tree ebc40a637843…
table_classification d6a40cfce23a…
admin_handbook 2026-11-09T10:23:25Z2026-11-09T10:23:26Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map aef45610634e…
admin_handbook c9d9e1b7533c…
db_handbook 2026-11-09T10:26:46Z2026-11-09T10:26:47Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 8a41ac9a902a…
seed_isolation c131b893948e…
seed_data 2026-11-09T10:26:54Z2026-11-09T10:26:54Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql b033ce872dcf…
seed_cases_json 112b45bc40f9…
seed_validate 2026-11-09T10:26:57Z2026-11-09T10:26:58Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 50dec167cd3e…
usecase_validate 2026-11-09T10:27:21Z2026-11-09T10:27:22Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 34154cfd1c7d…
test_results 57e9440835a9…
usecase_contract c9d644f8c12c…
finalize_docs 2026-11-09T10:40:47Z2026-11-09T10:40:48Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json a0bd004bb089…
release_notes b58934e6f51e…
api_integration_guide b682bbb700f6…
package_archive invalidated 2026-11-10T00:32:57Z 2026-11-09T10:48:43Z2026-11-10T00:00:31Z9
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 310409711151…
checksums 0701e5e145d0…
verify_md a59465781b31…
rebuild_md 0c5bc501f315…
manifest_txt 06890d701101…
actions_jsonl 0161c32b3041…
provenance_md 63e64d6a99de…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json fb827ea59466…

[stage_runs]

Rewinds

  • 2026-11-09T13:13:37Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28926]
  • 2026-11-09T13:51:19Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29016]
  • 2026-11-09T23:51:19Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29992]
  • 2026-11-10T00:32:57Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29997]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-10T00:00:31Z.

182 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 08181 —
remediate2001 011515 L-A08, L-038, L-036, L-034, L-032
admin_handbook491203 3340142 —
db_handbook19001 096189 —
finalize_docs1104903 18921435 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $9.45 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T11:43:18Z 61615 findings to tests_broken [held_rounds, held_rounds #1615] $2.91 3 rounds, $40.00 594f6e04a53b…
22026-11-09T13:27:40Z 1214 findings to repackage [held_rounds, held_rounds #1621] $2.12 3 rounds, $40.00 76aa844ed8e8…
32026-11-09T23:15:23Z 0114 findings to repackage [held_rounds, held_rounds #1684] $2.42 3 rounds, $40.00 98cc0604b071…
42026-11-10T00:00:59Z 0018 clean to publish [held_rounds, held_rounds #1685] $2.00 3 rounds, $40.00 310409711151…

Defects

Fully recorded
  • Ledger entries86 [defects, defects where product_slug=mysql and this tag or chain]
  • Disclosed in the archive86 [docs/defects/defects.json, entries]

86 ledger entries: by severity medium 1, critical 7, high 19, low 59; by status open 2, fixed-before-release 84.

DefectSeverityStatusFound byFixed in
RSD-mysql-c8ee10c240
The seed-data record says the product has no SQL database ('config/CRD-native product') [defects, defects #204804]		mediumopenengine review—
RSD-mysql-f6549480d7
Admin handbook: The Volume Snapshots procedure runs a statement that does not exist in MySQL 9.7.4 (FLUSH LOCAL DATA INTO OUTFILE); the following text claims it "creates a marker file that indicates a safe point",… [defects, defects #206967]		criticalfixed-before-releaseheld review (review model)—
RSD-mysql-b31b27f422
Admin handbook: Lost-password reset: the sentence tells the customer to write each backslash as FOUR backslashes (`\\\\`), which stores a different password (two backslashes) than the one intended; contradicts the… [defects, defects #206968]		criticalfixed-before-releaseheld review (review model)—
RSD-mysql-572538bec7
Admin handbook: Forgotten root password steps print the password example with four backslashes per separator; the stored password is not C:\new\pass. [defects, defects #206969]		criticalfixed-before-releaseheld review (review model)—
RSD-mysql-1dc67116bc
API guide: ALTER USER example (lines 1016-1017) uses four backslashes per separator and does not store the stated password C:\new\pass. [defects, defects #206970]		criticalfixed-before-releaseheld review (review model)—
RSD-mysql-84ff465160
API guide: Says the correct two-backslash literal "becomes a different password" and that four backslashes "store it correctly": inverted. [defects, defects #206971]		criticalfixed-before-releaseheld review (review model)—
RSD-mysql-fa83ebda7e
API guide: Account Recovery example stores a different password than the one stated. [defects, defects #206972]		criticalfixed-before-releaseheld review (review model)—
RSD-mysql-5e544f011b
Admin handbook: Replay command pipes mysqlbinlog output into a mysql client on the HOST (no docker exec) instead of into the container; it fails or replays into the wrong server. [defects, defects #206973]		highfixed-before-releaseheld review (review model)—
RSD-mysql-757a20a1cf
Admin handbook: Second replay command also pipes into a host `mysql -uroot`; the grep filter is unnecessary (see next finding). [defects, defects #206974]		highfixed-before-releaseheld review (review model)—
RSD-mysql-f2b4db3b14
Admin handbook: Unsupported claim that the replay output contains GTID_PURGED statements and fails without filtering. [defects, defects #206975]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-7ae90a4fcf
Admin handbook: First instruction ("do not use --skip-gtids") contradicts the command and rest of the section. [defects, defects #206976]		highfixed-before-releaseheld review (review model)—
RSD-mysql-128a53e19d
Admin handbook: False statement that the entrypoint runs as root; the image starts as uid 999 and contradicts the same handbook elsewhere. [defects, defects #206977]		highfixed-before-releaseheld review (review model)—
RSD-mysql-33fcae7caa
Admin handbook: The stop position is described as the Gtid event "immediately before the transaction you want to undo", which a customer reads as the previous transaction's Gtid event; using it drops a good… [defects, defects #206978]		highfixed-before-releaseheld review (review model)—
RSD-mysql-e6888007fb
Admin handbook: Ambiguous "Gtid event just before it" in the Operating facts (also in the DB handbook line 123). [defects, defects #206979]		highfixed-before-releaseheld review (review model)—
RSD-mysql-245a8c6f92
Admin handbook: Placeholder names the Gtid event "before the unwanted change". [defects, defects #206980]		highfixed-before-releaseheld review (review model)—
RSD-mysql-2108ff9de1
API guide: Same stop-position ambiguity in the API guide (also line 1785 "Note the Pos of the Gtid event just before the unwanted change"). [defects, defects #206981]		highfixed-before-releaseheld review (review model)—
RSD-mysql-fff892f3d8
API guide: Same stop-position ambiguity. [defects, defects #206982]		highfixed-before-releaseheld review (review model)—
RSD-mysql-52bb5b6f3a
Admin handbook: Build-time and host sizing for THIS release contradict REBUILD.md; a customer on the stated 7.8 GB host is steered to a size REBUILD.md says may fail. [defects, defects #206983]		highfixed-before-releaseheld review (review model)—
RSD-mysql-3bbf2ed985
Admin handbook: After docker load the documented run command pulls/uses the published tag, not the rebuilt image; no tagging step is given. [defects, defects #206984]		highfixed-before-releaseheld review (review model)—
RSD-mysql-c8abf289a0
Database handbook: Non-interactive example as written fails with Access denied. [defects, defects #206985]		highfixed-before-releaseheld review (review model)—
RSD-mysql-3dceab6361
Database handbook: The "already running" example has no -i/-t, so the client cannot read a password and exits with Access denied. [defects, defects #206986]		highfixed-before-releaseheld review (review model)—
RSD-mysql-305724b7a9
API guide: The example command fails as written (no terminal for the -p prompt). [defects, defects #206987]		highfixed-before-releaseheld review (review model)—
RSD-mysql-34021fa8b8
API guide: The quoted command is not valid (no program after the container name) and the explanation of when it works is wrong because the variable is expanded on the host. [defects, defects #206988]		highfixed-before-releaseheld review (review model)—
RSD-mysql-2b1fab95b9
API guide: No warning that init files must be readable by the mysql user; a file with the common mode 600 leaves the new volume unbootable. [defects, defects #206989]		highfixed-before-releaseheld review (review model)—
RSD-mysql-a2c1ff689c
Admin handbook: Ownership alone does not make a readable file unreadable (also Admin line 640 "owned by any user" vs this line; API 1520 and Admin 1777 repeat the wrong "owned by another user"). [defects, defects #206990]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-228bf25d5d
API guide: Wrong about ownership and about "silently". [defects, defects #206991]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-8545f71707
Database handbook: Contradicts the Operating facts of the same handbook. [defects, defects #206992]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-78df7bf2e6
Admin handbook: Tells the customer not to use localhost although the documented host connection is 127.0.0.1 through the published port. [defects, defects #206993]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-201ca5de07
Admin handbook: Sentence says the password can be passed to avoid a prompt, the command shown prompts. [defects, defects #206994]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-733e82e4f0
Admin handbook: Quotes another release's host figures instead of this release's measured ones (DB_HANDBOOK.md:725 has the same sentence). [defects, defects #206995]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-c510db3059
Database handbook: Describes a full Ubuntu base image; this release is FROM scratch. [defects, defects #206996]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-27e8d49c6a
Database handbook: Bootstrap server does not disable grant checks. [defects, defects #206997]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-11f3bc354b
API guide: Points to the release notes for a list they do not contain. [defects, defects #206998]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-01babdd397
API guide: Says TLS is not enabled by default; TLS is on with a generated self-signed certificate. [defects, defects #206999]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-9c40ccb637
API guide: Unsupported claim that TLS is required. [defects, defects #207000]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-d32f79815e
API guide: Lists all SQL files before all shell scripts; the entrypoint runs them interleaved by file name. [defects, defects #207001]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-eab8b2593e
API guide: Directs the customer to docker logs for probe activity, which it never contains. [defects, defects #207002]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-bfb7aee51f
Documentation: The manifest prices the kit at 10 USD while the Docker Hub README says the same kit is free for any registered account. [defects, defects #207003]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-97dca6595b
Admin handbook: The second Volume Snapshots procedure copies the data directory of the running container with docker cp and calls the result a full copy; the copy is inconsistent and the restored server crashed… [defects, defects #209127]		criticalfixed-before-releaseheld review (review model)—
RSD-mysql-0fa0dfb3a5
Admin handbook: The Binary logs and GTIDs replay command pipes into a mysql client that has no password, so it fails with Access denied; the sentence after it (exits successfully but applies nothing) describes a… [defects, defects #209128]		highfixed-before-releaseheld review (review model)—
RSD-mysql-1d4cce5715
Admin handbook: Says a socket-only root account needs MYSQL_ROOT_PASSWORD followed by later ALTER USER/deletion, when MYSQL_ROOT_HOST=localhost creates no network root at first start; the paragraph contradicts… [defects, defects #209129]		highfixed-before-releaseheld review (review model)—
RSD-mysql-dd110912d8
Admin handbook: Explains the Access denied by a client reading the password from standard input, which it does not do without -p. [defects, defects #209130]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-b88184ea67
Admin handbook: States that a file owned by another user is skipped, which is wrong for a world-readable file and contradicts line 646. [defects, defects #209131]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-4bffcb39ef
Admin handbook: Says the temporary server exits immediately whenever the conf.d mounts are left out; it does so only for settings the data directory needs. [defects, defects #209132]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-63d47bfe96
API guide: Same overgeneral claim as the Admin handbook: the temporary server exits immediately without the original conf.d files. [defects, defects #209133]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-f2bc924eaf
Admin handbook: Presents the 16 to 33 second first-start range as measured on the current release; the record measured it on r2. [defects, defects #209134]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-72e6d59f7b
Database handbook: Tells the customer to omit -it for a non-interactive command and then shows a command with -it and -p. [defects, defects #209135]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-73bed87d73
API guide: The documented example of passing server arguments omits the password env file, so on the first start it is refused. [defects, defects #209136]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-395e3f6efe
API guide: The refused-password list omits changeme, which the entrypoint refuses. [defects, defects #209137]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-7b39b2c162
API guide: The refused-password list omits changeme. [defects, defects #209138]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-21bd6a8874
API guide: Lists all SQL files before all shell scripts; the entrypoint runs them interleaved by file name. [defects, defects #209139]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-df5d82c15e
Documentation: The manifest still prices the kit at 10 USD ('free_release': false, files.buildkit.price_cents 1000) while the Docker Hub README says it is a free download for any registered account. [defects, defects #209140]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-d5f977056a
API guide: Names a MySQL Shell `-m` option that no record supports; the documented options are --mysqlx and the mysqlx:// URI. [defects, defects #209141]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-41526cc178
Admin handbook: The appendix tells the customer to run commands that read $MYSQL_ROOT_PASSWORD without saying they fail after the documented removal of that variable. [defects, defects #209142]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-b09a75ad05
Admin handbook: The Volume Snapshots (stop + docker cp) procedure gives no working restore: the copy made by a non-root host user is owned by that user and the sentence only says ownership must be 'intact'. [defects, defects #227966]		highfixed-before-releaseheld review (review model)—
RSD-mysql-70157d4acf
Admin handbook: Unsupported claim: no record shows a failed or successful later-release start leaves the volume unmodified or openable by the earlier tag. [defects, defects #227967]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-714fc7ec6a
Admin handbook: The commands are shown in the wrong order: SHOW BINARY LOGS and docker cp come first and the flush last, although the text says to flush before copying; followed top to bottom the active log is… [defects, defects #227968]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-7c41da9309
Admin handbook: The shown command has no -i/-t, so bash exits immediately instead of giving the customer a shell. [defects, defects #227969]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-28cc723468
Admin handbook: The range is presented as measured on this release; the record measured it on r2 and no r4 timing is in validation/test-results.json. [defects, defects #227970]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-b8235afd9f
Admin handbook: Same as above: a r2 measurement stated as a fact about this release. [defects, defects #227971]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-364d95d498
API guide: The r2 range is unattributed here, and likewise at API_INTEGRATION_GUIDE.md:1993 and :2012. [defects, defects #227972]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-d5b849a45f
Admin handbook: The same sentence says MYSQL_ROOT_HOST replaces the % (and the Security note recommends MYSQL_ROOT_HOST=localhost), but the recovery and ALTER USER steps (also in the Troubleshooting, Authentication… [defects, defects #227973]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-4e1001428a
Admin handbook: Run immediately after `docker run -d --rm --name mysql-reset ...`, as the numbered steps read, the exec fails; the recovery procedure (all copies, in the Admin, DB and API documents) has no wait step. [defects, defects #227974]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-5a77f38765
Database handbook: The Admin handbook's appendix carries this caveat (ADMIN_HANDBOOK.md:1862) but the Database handbook's appendix, with the same commands, does not; the previous round's finding on this is only half… [defects, defects #227975]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-e3c51ace7d
API guide: The image does not contain the upstream source. [defects, defects #227976]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-07a530e38c
API guide: No record supports `mysql://root@localhost:3306` as a connection string; the bundled mysql client does not accept it. [defects, defects #227977]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-87e4755257
API guide: Misstates the mechanism: redirecting standard input does not put the prompt into the dump; the Operating facts attribute it to a terminal (-t). [defects, defects #227978]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-9507e5745c
API guide: mysqld does not read the password from /proc/1/environ; it is the process's environment that holds it. [defects, defects #227979]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-b20b21596b
Database handbook: Ran `docker run --rm --entrypoint mysql <held image> mysql://root@localhost:3306`: 'ERROR 2002 (HY000): Can't connect to local MySQL server through socket' - the client takes the string as a… [defects, defects #228801]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-dd3d3492b6
API guide: Ran `docker run --rm --entrypoint mysql <held image> mysql://root@localhost:3306`: 'ERROR 2002 (HY000): Can't connect to local MySQL server through socket' - the client takes the string as a… [defects, defects #228802]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-5b84b18352
API guide: Ran `docker run --rm --entrypoint mysql <held image> mysql://root@localhost:3306`: 'ERROR 2002 (HY000): Can't connect to local MySQL server through socket' - the client takes the string as a… [defects, defects #228803]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-88db56cff2
API guide: Ran `docker run --rm --entrypoint mysql <held image> mysql://root@localhost:3306`: 'ERROR 2002 (HY000): Can't connect to local MySQL server through socket' - the client takes the string as a… [defects, defects #228804]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-c9f88073dd
API guide: Ran `docker run --rm --entrypoint mysql <held image> mysql://root@localhost:3306`: 'ERROR 2002 (HY000): Can't connect to local MySQL server through socket' - the client takes the string as a… [defects, defects #228805]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-66a22a0e61
Admin handbook: Round 3 finding about order only half fixed: the section still shows SHOW BINARY LOGS (:1246) and docker cp (:1251) before the FLUSH BINARY LOGS command (:1257), so a reader following the code… [defects, defects #228806]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-5b70b47751
Admin handbook: Ran the documented `docker run -d --rm --name mysql-reset ... [defects, defects #228807]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-08f5ab0f4a
API guide: Ran the documented `docker run -d --rm --name mysql-reset ... [defects, defects #228808]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-90cb521b9d
Database handbook: Ran the documented `docker run -d --rm --name mysql-reset ... [defects, defects #228809]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-45ec51b0d6
Admin handbook: Both ALTER USER statements are shown unconditionally. [defects, defects #228810]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-5c07e317ec
API guide: Both ALTER USER statements are shown unconditionally. [defects, defects #228811]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-00fc0ce0aa
Admin handbook: The first-start range is now attributed to r2, but the restart figure '6 to 9 seconds' is stated as fact about this release in several places; no r4 timing is in validation/test-results.json (its 10… [defects, defects #228812]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-b40620ccec
API guide: The first-start range is now attributed to r2, but the restart figure '6 to 9 seconds' is stated as fact about this release in several places; no r4 timing is in validation/test-results.json (its 10… [defects, defects #228813]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-e793b02177
Admin handbook: No record shows an upgrade/re-create run: validation/test-results.json holds only exec-0..exec-11 (version, ping, write/read, login, id, plugins, security, tls) and provenance/RUN_COMMAND_SMOKE.json… [defects, defects #228814]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-80aff127ec
Database handbook: No record shows an upgrade/re-create run: validation/test-results.json holds only exec-0..exec-11 (version, ping, write/read, login, id, plugins, security, tls) and provenance/RUN_COMMAND_SMOKE.json… [defects, defects #228815]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-1c2a84c670
Admin handbook: Stated as fact for upgrades within 9.7.x, but ADMIN_HANDBOOK.md:1350 says no later 9.7.x release has been run against this one; no record covers any upgrade. [defects, defects #228816]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-41c894a20b
API guide: No connector library appears in validation/test-results.json or any build record; only the mysql client was exercised. [defects, defects #228817]		lowfixed-before-releaseheld review (review model)—
RSD-mysql-8ea4fae70f
Documentation: Unfixed: manifest says free_release false, chain_price_cents 1000 (:20) and files.buildkit.price_cents 1000 (:28) while docker/DOCKERHUB_README.md:15 and :89 say the kit is free with an account. [defects, defects #228818]		lowopenheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:9a2c5adf1c8995e997e4ed346254358c940ea3e8b79d14a746a81a5deb4edeba · published digest sha256:9a2c5adf1c8995e997e4ed346254358c940ea3e8b79d14a746a81a5deb4edeba · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 1558) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-10T00:33:46Z · failing Docker Scout counts 21 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-10T00:33:31Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3773794163 · transparency-log entry · integrated 2026-11-10T00:41:50Z) [ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:88d405398740090db849f2526e2af059daa4971b069c6bd33aac7dd081c4251c · state attached · log index 3773804609 · transparency-log entry
    • kind sbom · digest sha256:88d405398740090db849f2526e2af059daa4971b069c6bd33aac7dd081c4251c · state attached · log index 3773806128 · transparency-log entry
    • kind vsa · digest sha256:88d405398740090db849f2526e2af059daa4971b069c6bd33aac7dd081c4251c · state attached · log index 3773807719 · transparency-log entry
    • kind provenance · digest sha256:9a2c5adf1c8995e997e4ed346254358c940ea3e8b79d14a746a81a5deb4edeba · state attached · log index 3773810025 · transparency-log entry
    • kind sbom · digest sha256:9a2c5adf1c8995e997e4ed346254358c940ea3e8b79d14a746a81a5deb4edeba · state attached · log index 3773812323 · transparency-log entry
    • kind vsa · digest sha256:9a2c5adf1c8995e997e4ed346254358c940ea3e8b79d14a746a81a5deb4edeba · state attached · log index 3773814414 · transparency-log entry
    (at 2026-11-10T00:41:54Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/mysql/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T11:43:27Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:9a2c5adf1c8995e997e4ed346254358c940ea3e8b79d14a746a81a5deb4edeba [clean-room rebuild ledger, runs[698]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T10:12:21Z [stage_runs, stage_runs chain 919 stage publish_image]
  • Archive manifests written2026-11-10T00:38:08Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 305 · probed 2026-11-09T09:44:34Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-10T00:44:02Z generated: by KitForge release/build_trail.py · generator commit 7af80cbe7cac0e3a62e3472ca4872acfe1fb009d
  • 2026-11-10T00:46:30Z publication: promoted at 2026-11-10T00:44:50Z · promoted digest sha256:88d405398740090db849f2526e2af059daa4971b069c6bd33aac7dd081c4251c · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 442 · checklist status complete · checklist at 2026-11-10T00:46:30Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/mysql/9.7.4-CE-ubuntu24.04-r4/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/mysql/9.7.4-CE-ubuntu24.04-r4/), as staged for publishing—
ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.rebuild.jsonbeside the archive (prodasset /data/production/mysql/9.7.4-CE-ubuntu24.04-r4/), as staged for publishing—
ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r4.rebuild.json.sigstorebeside the archive (prodasset /data/production/mysql/9.7.4-CE-ubuntu24.04-r4/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/mysql/9.7.4-CE-ubuntu24.04-r4/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)555
chainssadb, ReadyStack's engine database (not published)919
defectssadb, ReadyStack's engine database (not published)mysql 9.7.4-CE-ubuntu24.04-r4
drive_runssadb, ReadyStack's engine database (not published)chain 919
held_roundssadb, ReadyStack's engine database (not published)chain 919
lesson_recallssadb, ReadyStack's engine database (not published)chain 919
micro_step_runssadb, ReadyStack's engine database (not published)chain 919
release_imagessadb, ReadyStack's engine database (not published)mysql 9.7.4-CE-ubuntu24.04-r4
stage_eventssadb, ReadyStack's engine database (not published)chain 919
stage_runssadb, ReadyStack's engine database (not published)chain 919
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—