NATS v2.15.2-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/nats:v2.15.2-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON

Imagereadystack/nats:v2.15.2-CE-ubuntu24.04-r2
Index digestsha256:0a61e2a26234eae4a88d20c01e6024bb45d599346ebc53d856ed4229a8d17db5
linux/amd64 digestsha256:ed77bffbe5e2c9ab2740c0a09f618e1f6b62371a91523126bd975fa118dfbf02
ArchiveReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.tar.gz
Archive SHA-256 now8b072e2ad6c143b63bbde72c295965970014a8cd9e2db79df761a69f5bd3f1b4
Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
Sections9 sections, 4 fully recorded; 10 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.trail.json

ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.trail.json ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.trail.md NATS product page

Identity Why this release exists The path through the harness Model work per stage Review Defects Verification Publication Packages and CPU level

Identity

1 item not recorded

ProductNATS (nats) [MANIFEST.json]
Release tagv2.15.2-CE-ubuntu24.04-r2 [MANIFEST.json]
Imagereadystack/nats:v2.15.2-CE-ubuntu24.04-r2 [MANIFEST.json]
Image index digestsha256:0a61e2a26234eae4a88d20c01e6024bb45d599346ebc53d856ed4229a8d17db5 [docs/provenance/LOCKED_DIGEST.txt]
linux/amd64 image digestsha256:ed77bffbe5e2c9ab2740c0a09f618e1f6b62371a91523126bd975fa118dfbf02 [ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
ArchiveReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.tar.gz (bytes 461610778) [MANIFEST.json]
Archive sha256 at publishafe21ed2b0b60861468c67eb0a007fb4284ce2f86bd277a9f1a25a06c4163a59 [MANIFEST.json, repack_history[0].previous_tarball_sha256]
Archive sha256 now8b072e2ad6c143b63bbde72c295965970014a8cd9e2db79df761a69f5bd3f1b4 [MANIFEST.json, tarball_sha256]
Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
Repack history
- at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 afe21ed2b0b60861468c67eb0a007fb4284ce2f86bd277a9f1a25a06c4163a59 · sha256 8b072e2ad6c143b63bbde72c295965970014a8cd9e2db79df761a69f5bd3f1b4 · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
[MANIFEST.json, repack_history]
Upstream repositoryhttps://github.com/nats-io/nats-server [docs/provenance/SOURCE_TREE_HASH.json]
Upstream refv2.15.2 [docs/provenance/SOURCE_TREE_HASH.json]
Upstream commit5a815f11a911efa2c88fd1dbfb18ed89a449bfc1 [docs/provenance/SOURCE_TREE_HASH.json]
Source tree hash5b9cc2ec65654263c7b6900c150bd7fcbc5496b880f245a3d82459e96b491718 (files 598) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
Kit tree hashsha256:9d4a20a861be96a7618f8aaac6cd1c9d53a4819a80f961d50e1cfff1602a9959 [ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
SOURCE_DATE_EPOCH1793028235 (utc 2026-10-26T15:23:55Z) [ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
Base images
- ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
- ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
[ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.rebuild.json, bases]
BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.rebuild.json, engine]

Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded

Chain743 (created 2026-10-28T02:00:36Z · trigger customer_request · upstream version v2.15.2) [chains, chains #743]
Requestbuild request #440 (rebuild) (requested at 2026-10-28T01:53:11Z · requested by kitforge-agent · version v2.15.2) [build_requests, build_requests #440]
Reasonrevision v2.15.2-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #440 request_reason]
Supersedesreadystack/nats:v2.15.2-CE-ubuntu24.04-r1 (chain 699) [chains, chains #699]

The path through the harness

2 items not recorded

1 chain · 3 drives · 18 stages · 2 rewinds

Chain 743 release · shipped

Created 2026-10-28T02:00:36Z, upstream v2.15.2, build request 440 [chains, chains #743]

Drive	Started	Minutes	Build host	How it stopped
243	2026-10-28T02:00:54Z	24.2	build host 1 withhold-publish	ready_to_ship [drive_runs, drive_runs #243] rebuilt from a build line's log
247	2026-10-28T02:53:43Z	3	build host 1 withhold-publish	ready_to_ship [drive_runs, drive_runs #247] rebuilt from a build line's log
249	2026-10-28T03:26:51Z	5.6	build host 1 publish-held	shipped [drive_runs, drive_runs #249] rebuilt from a build line's log

Stages, in order

Stage	First start	Passed	Attempts	Gate checks passed	Artifacts (SHA-256)
`intake`	2026-10-28T02:00:59Z	2026-10-28T02:01:00Z	1	4 `exists:order_json` `order_json:json_parses` `order_json:no_forbidden_placeholders` `produces_paths_exist`	—
`acquire`	2026-10-28T02:01:04Z	2026-10-28T02:01:04Z	1	12 `exists:source_tree` `exists:source_tree_hash` `exists:source_file_manifest` `exists:custody_inputs` `exists:license_file` `source_tree:dir_nonempty` `source_tree_hash:json_parses` `source_file_manifest:json_parses` `custody_inputs:json_parses` `license_file:file_nonempty` `produces_paths_exist` `custody_inputs:json_true:ce_audit.ce_only`	—
`plan`	2026-10-28T02:01:28Z	2026-10-28T02:01:29Z	1	10 `exists:recon_report` `exists:input_pin_plan` `exists:toolchain_lock` `recon_report:md_min_sections:3` `recon_report:no_forbidden_placeholders` `input_pin_plan:md_min_sections:2` `input_pin_plan:no_forbidden_placeholders` `toolchain_lock:file_nonempty` `toolchain_lock:no_forbidden_placeholders` `produces_paths_exist`	—
`assemble_kit`	2026-10-28T02:03:02Z	2026-10-28T02:03:02Z	1	27 `exists:dockerfile` `exists:base_image_digests` `exists:system_pinning` `exists:build_recipe` `exists:first_build_digest` `exists:first_boot_health` `exists:dockerfile_offline` `exists:verify_offline_sh` `exists:build_offline_sh` `exists:generate_sbom_sh` `dockerfile:file_nonempty` `dockerfile:no_forbidden_placeholders` `base_image_digests:file_nonempty` `system_pinning:file_nonempty` `build_recipe:json_parses` `first_build_digest:file_nonempty` `first_boot_health:file_nonempty` `dockerfile_offline:file_nonempty` `dockerfile_offline:no_forbidden_placeholders` `verify_offline_sh:file_nonempty` `verify_offline_sh:no_forbidden_placeholders` `build_offline_sh:file_nonempty` `build_offline_sh:no_forbidden_placeholders` `generate_sbom_sh:file_nonempty` `generate_sbom_sh:no_forbidden_placeholders` `produces_paths_exist` `first_boot_health:file_contains:healthy=True`	—
`remediate`	2026-10-28T02:03:39Z	2026-10-28T02:03:39Z	1	8 `exists:vendored_apt` `exists:remediation_log` `exists:security_report` `vendored_apt:dir_exists` `remediation_log:json_parses` `security_report:md_min_sections:2` `security_report:no_forbidden_placeholders` `produces_paths_exist`	—
`build_kit`	2026-10-28T02:06:03Z	2026-10-28T02:06:04Z	1	9 `exists:freeze_manifest` `exists:locked_digest` `exists:cosign_stamp` `exists:offline_rebuild_transcript` `freeze_manifest:json_parses` `locked_digest:file_nonempty` `cosign_stamp:file_nonempty` `offline_rebuild_transcript:json_parses` `produces_paths_exist`	—
`verdict`	2026-10-28T02:06:30Z	2026-10-28T02:06:31Z	1	8 `exists:scout_verdict` `scout_verdict:json_parses` `produces_paths_exist` `scout_verdict:release_check_passed` `scout_verdict:nonroot_green` `scout_verdict:zero_fixable_crit_high` `scout_verdict:osv_clean` `scout_verdict:no_baked_secrets`	—
`publish_image`	2026-10-28T02:07:01Z	2026-10-28T02:07:02Z	1	7 `exists:promotion_record` `exists:hub_readme` `promotion_record:json_parses` `hub_readme:md_min_sections:2` `hub_readme:no_forbidden_placeholders` `produces_paths_exist` `promotion_record:json_true:signed`	—
`boot_instance`	2026-10-28T02:07:07Z	2026-10-28T02:07:09Z	2	3 `exists:instance_handle` `instance_handle:json_parses` `produces_paths_exist`	—
`sbom`	2026-10-28T02:07:15Z	2026-10-28T02:07:16Z	1	5 `exists:sbom_json` `exists:sbom_md` `sbom_json:json_parses` `sbom_md:md_min_sections:1` `produces_paths_exist`	—
`schema_discovery`	2026-10-28T02:07:18Z	2026-10-28T02:07:18Z	1	7 `exists:dependency_tree` `exists:table_classification` `exists:schema_hash` `dependency_tree:json_parses` `table_classification:json_parses` `schema_hash:file_nonempty` `produces_paths_exist`	—
`admin_handbook`	2026-10-28T02:12:45Z	2026-10-28T02:12:45Z	1	7 `exists:admin_handbook` `exists:api_map` `admin_handbook:md_min_sections:10` `admin_handbook:no_forbidden_placeholders` `api_map:json_parses` `produces_paths_exist` `admin_handbook:command_transcripts_clean`	—
`db_handbook`	2026-10-28T02:16:21Z	2026-10-28T02:16:21Z	1	8 `exists:db_handbook` `exists:seed_isolation` `db_handbook:md_min_sections:5` `db_handbook:no_forbidden_placeholders` `seed_isolation:md_min_sections:1` `seed_isolation:no_forbidden_placeholders` `produces_paths_exist` `db_handbook:command_transcripts_clean`	—
`seed_data`	2026-10-28T02:16:35Z	2026-10-28T02:16:35Z	1	6 `exists:seed_data_sql` `exists:seed_cases_json` `seed_data_sql:sql_parses` `seed_data_sql:no_forbidden_placeholders` `seed_cases_json:json_parses` `produces_paths_exist`	—
`seed_validate`	2026-10-28T02:16:37Z	2026-10-28T02:16:38Z	1	3 `exists:seed_data_contract` `seed_data_contract:json_parses` `produces_paths_exist`	—
`usecase_validate`	2026-10-28T02:17:09Z	2026-10-28T02:17:10Z	1	10 `exists:usecase_contract` `exists:passed_tests` `exists:failed_tests` `exists:test_results` `usecase_contract:json_parses` `passed_tests:md_min_sections:1` `failed_tests:md_min_sections:1` `test_results:json_parses` `produces_paths_exist` `test_results:usecase_thresholds:80,70`	—
`finalize_docs`	2026-10-28T02:21:06Z	2026-10-28T02:21:06Z	1	9 `exists:api_integration_guide` `exists:release_notes` `exists:defects_json` `api_integration_guide:md_min_sections:3` `api_integration_guide:no_forbidden_placeholders` `release_notes:md_min_sections:3` `release_notes:no_forbidden_placeholders` `defects_json:json_parses` `produces_paths_exist`	—
`package_archive`	2026-10-28T02:25:02Z	2026-10-28T03:32:20Z	3	33 (final gate PASS) `exists:checksums` `exists:verify_md` `exists:rebuild_md` `exists:provenance_md` `exists:manifest_txt` `exists:assetchain_log_md` `exists:assetchain_log_json` `exists:actions_jsonl` `exists:sale_tar` `checksums:file_nonempty` `verify_md:md_min_sections:2` `verify_md:no_forbidden_placeholders` `rebuild_md:md_min_sections:2` `rebuild_md:no_forbidden_placeholders` `provenance_md:md_min_sections:2` `provenance_md:no_forbidden_placeholders` `manifest_txt:file_nonempty` `assetchain_log_md:md_min_sections:1` `assetchain_log_json:json_parses` `actions_jsonl:file_nonempty` `sale_tar:file_nonempty` `produces_paths_exist` `G8 cosign` `G8 scan_grade` `G8 tag_base_os` `G8 vex_shipped` `G8 scout_grade_a` `G8 script_copies` `G8 three_way_sha` `G8 offline_rebuild` `G8 rebuild_manifest` `G8 artifact_coverage` `G8 assetchain_coverage`	—

[stage_runs]

Rewinds

2026-10-28T02:46:19Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2157]
2026-10-28T03:26:04Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #286]

Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-10-28T03:32:20Z.

72 calls over 6 stages

Stage	Calls	Refused	Max attempt	Forced commits	Real tokens	Lesson rules shown
`plan`	2	0	1	not recorded	not recorded	—
`remediate`	2	0	1	not recorded	not recorded	—
`admin_handbook`	27	9	3	not recorded	not recorded	—
`db_handbook`	19	2	2	not recorded	not recorded	—
`usecase_validate`	2	0	1	not recorded	not recorded	—
`finalize_docs`	20	1	2	not recorded	not recorded	—

[micro_step_runs]

Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

2 items not recorded

Role: review model.

2 rounds, 2 counted, $2.81 recorded cost

Round	Started	Critical	Major	Minor	Verdict	Cost	Cap in force	Archive reviewed
1	2026-10-28T02:25:31Z	1	7	11	findings to repackage [held_rounds, held_rounds #123] rebuilt from a held-review state file	$1.39	not recorded	not recorded
2	2026-10-28T02:57:06Z	0	0	5	clean to publish [held_rounds, held_rounds #124] rebuilt from a held-review state file	$1.42	not recorded	not recorded

Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
Not recorded: the round cap in force at each round (the state files did not keep it)

Defects

Fully recorded

Ledger entries28 [defects, defects where product_slug=nats and this tag or chain]
Disclosed in the archive24 [docs/defects/defects.json, entries]

28 ledger entries: by severity medium 1, low 20, high 6, critical 1; by status open 1, fixed-in-release 4, fixed-before-release 23.

Defect	Severity	Status	Found by	Fixed in
`RSD-nats-49e66a448d` Unauthenticated HTTP monitoring port 8222 by default [defects, defects #126971]	medium	open	build strategy record	—
`RSD-nats-d0bbcf6250` Admin handbook: The TLS procedure mounts the nats-data volume and publishes 8222 but the configuration it describes holds only a tls block. [defects, defects #126972]	low	fixed-in-release	held review (review model)	v2.15.2-CE-ubuntu24.04-r2
`RSD-nats-b3b04724e5` Admin handbook: The TLS procedure mounts the nats-data volume and publishes 8222 but the configuration it describes holds only a tls block. [defects, defects #126973]	low	fixed-in-release	held review (review model)	v2.15.2-CE-ubuntu24.04-r2
`RSD-nats-9ce41171a8` Database handbook: The TLS procedure mounts the nats-data volume and publishes 8222 but the configuration it describes holds only a tls block. [defects, defects #126974]	low	fixed-in-release	held review (review model)	v2.15.2-CE-ubuntu24.04-r2
`RSD-nats-a911bfed71` Database handbook: The TLS procedure mounts the nats-data volume and publishes 8222 but the configuration it describes holds only a tls block. [defects, defects #126975]	low	fixed-in-release	held review (review model)	v2.15.2-CE-ubuntu24.04-r2
`RSD-nats-0b47dd1ae7` Admin handbook: The documents say extracting over a volume that already holds streams does not roll them back; it does: the extracted files replace the stream's files, and the stream returns to the backup's state… [defects, defects #127289]	high	fixed-before-release	held review (review model)	—
`RSD-nats-04ac9fc47d` Admin handbook: The documents say extracting over a volume that already holds streams does not roll them back; it does: the extracted files replace the stream's files, and the stream returns to the backup's state… [defects, defects #127290]	high	fixed-before-release	held review (review model)	—
`RSD-nats-c6e53a4bf9` Database handbook: The documents say extracting over a volume that already holds streams does not roll them back; it does: the extracted files replace the stream's files, and the stream returns to the backup's state… [defects, defects #127291]	high	fixed-before-release	held review (review model)	—
`RSD-nats-fe26278146` API guide: The documents say extracting over a volume that already holds streams does not roll them back; it does: the extracted files replace the stream's files, and the stream returns to the backup's state… [defects, defects #127292]	high	fixed-before-release	held review (review model)	—
`RSD-nats-97e2fc9adc` API guide: The documents say extracting over a volume that already holds streams does not roll them back; it does: the extracted files replace the stream's files, and the stream returns to the backup's state… [defects, defects #127293]	high	fixed-before-release	held review (review model)	—
`RSD-nats-d3cc86e175` Admin handbook: `-e NATS_PASSWORD "$NATS_PASSWORD"` is not a valid form: docker reads the second word as the image name and fails with `invalid reference format`; the Operating facts say to export the variable and… [defects, defects #127294]	critical	fixed-before-release	held review (review model)	—
`RSD-nats-cc34e41b5b` Admin handbook: The sentence says an unpublished monitoring port can be queried from outside; it cannot. [defects, defects #127295]	high	fixed-before-release	held review (review model)	—
`RSD-nats-82ddca6af2` Admin handbook: The health check is rs-probe run by Docker inside the container; `docker inspect` only reports its status. [defects, defects #127296]	low	fixed-before-release	held review (review model)	—
`RSD-nats-21a330bba6` Admin handbook: Understates what the unauthenticated port shows and contradicts the release notes and the API guide (addresses). [defects, defects #127297]	low	fixed-before-release	held review (review model)	—
`RSD-nats-0030f20424` Admin handbook: The records do not show the TLS procedure being tested. [defects, defects #127298]	low	fixed-before-release	held review (review model)	—
`RSD-nats-6c7989a4ce` Admin handbook: Gives no usable way to reach the port from inside the container and a customer would try curl, which the image lacks. [defects, defects #127299]	low	fixed-before-release	held review (review model)	—
`RSD-nats-be2cd47522` API guide: The image's interval is 5 s, not Docker's 30 s default; the same guide elsewhere says 'every few seconds'. [defects, defects #127300]	low	fixed-before-release	held review (review model)	—
`RSD-nats-0771852e64` API guide: The entrypoint does not write /etc/nats/nats-server.conf; it writes the runtime copy. [defects, defects #127301]	low	fixed-before-release	held review (review model)	—
`RSD-nats-c52b963bc2` API guide: Unexplained host port that contradicts every other example and the health URLs given in the guide. [defects, defects #127302]	low	fixed-before-release	held review (review model)	—
`RSD-nats-e5fcfe34d7` API guide: This is a single server; there is no cluster. [defects, defects #127303]	low	fixed-before-release	held review (review model)	—
`RSD-nats-b55b630fc8` API guide: As written the cert_file would not exist in the container unless the config points elsewhere. [defects, defects #127304]	low	fixed-before-release	held review (review model)	—
`RSD-nats-4608c4518a` Database handbook: Self-contradictory: says running or stopped, then stop it first. [defects, defects #127305]	low	fixed-before-release	held review (review model)	—
`RSD-nats-c78843688b` Database handbook: It prints one line, no build information. [defects, defects #127306]	low	fixed-before-release	held review (review model)	—
`RSD-nats-172f354b13` Admin handbook: The sentence invites passwords with spaces and # and says they are handled correctly, but every connection example puts the password raw into a URL, where those characters end the userinfo or fail… [defects, defects #127611]	low	fixed-before-release	held review (review model)	—
`RSD-nats-e6413bfdd9` Database handbook: States the monitoring port can be queried from outside the container without saying it must be published, while the same handbook tells customers to leave it unpublished. [defects, defects #127612]	low	fixed-before-release	held review (review model)	—
`RSD-nats-c30132b119` API guide: Reads as a description of the deployment (the port is published only privately) when the documented command publishes it on every host interface; it should be an instruction. [defects, defects #127613]	low	fixed-before-release	held review (review model)	—
`RSD-nats-8af5cbd0bf` API guide: Cross-section contradiction: the TLS and Server Configuration sections list authorization, http and jetstream as what a custom configuration must add, and the client listener defaults to 4222;… [defects, defects #127614]	low	fixed-before-release	held review (review model)	—
`RSD-nats-48fcbbe6a9` Admin handbook: Says a listener block is required (not so: 4222 is the default) and omits the http and jetstream blocks that a custom configuration really lacks, contradicting the Tls section at line 131. [defects, defects #127615]	low	fixed-before-release	held review (review model)	—

Verification

2 items not recorded

Reproduced before publishingyes (rebuilt digest sha256:ed77bffbe5e2c9ab2740c0a09f618e1f6b62371a91523126bd975fa118dfbf02 · published digest sha256:ed77bffbe5e2c9ab2740c0a09f618e1f6b62371a91523126bd975fa118dfbf02 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 73) [docs/provenance/REPRO_VERIFICATION.json, verified]
Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 743 package_archive gate_result.g8.result]
Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-28T03:27:09Z · failing Docker Scout counts 11 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
First own scan of the releaseA (at 2026-10-28T03:32:34Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-27T06:30:41Z) [image_scans, image_scans #1367]
Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-28T03:26:59Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
Image signature transparency-log entries
- log index 3531347993 · transparency-log entry
- log index 3531350398 · transparency-log entry
[deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3626377325 · transparency-log entry · integrated 2026-11-01T10:06:40Z) [ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
Signed attestations
- kind provenance · digest sha256:0a61e2a26234eae4a88d20c01e6024bb45d599346ebc53d856ed4229a8d17db5 · state attached · log index 3532935833 · transparency-log entry
- kind sbom · digest sha256:0a61e2a26234eae4a88d20c01e6024bb45d599346ebc53d856ed4229a8d17db5 · state attached · log index 3532935972 · transparency-log entry
- kind vsa · digest sha256:0a61e2a26234eae4a88d20c01e6024bb45d599346ebc53d856ed4229a8d17db5 · state attached · log index 3532936142 · transparency-log entry
- kind provenance · digest sha256:ed77bffbe5e2c9ab2740c0a09f618e1f6b62371a91523126bd975fa118dfbf02 · state attached · log index 3532936305 · transparency-log entry
- kind sbom · digest sha256:ed77bffbe5e2c9ab2740c0a09f618e1f6b62371a91523126bd975fa118dfbf02 · state attached · log index 3532936494 · transparency-log entry
- kind vsa · digest sha256:ed77bffbe5e2c9ab2740c0a09f618e1f6b62371a91523126bd975fa118dfbf02 · state attached · log index 3532936708 · transparency-log entry
(at 2026-10-28T03:30:04Z) [attestations.json, results]

Offline clean-room rebuilds

2026-10-28T02:25:34Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:ed77bffbe5e2c9ab2740c0a09f618e1f6b62371a91523126bd975fa118dfbf02 [clean-room rebuild ledger, runs[505]]

Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

Fully recorded

Image pushed (internal tag), publish_image passed2026-10-28T02:07:02Z [stage_runs, stage_runs chain 743 stage publish_image]
Release tag promoted2026-10-28T03:31:45Z (method imagetools_create_retag_by_digest_no_rebuild · digest sha256:0a61e2a26234eae4a88d20c01e6024bb45d599346ebc53d856ed4229a8d17db5 · tag readystack/nats:v2.15.2-CE-ubuntu24.04-r2) [deliverables/provenance/PROMOTION_RECORD.json, promoted_at]
Archive manifests written2026-10-28T03:28:45Z [PUBLISH_MANIFEST.json, published_at]
Archive cut over on prodasset, package_archive passed2026-10-28T03:32:20Z [stage_runs, stage_runs chain 743 stage package_archive]
Cut-over markerpresent (chain 743) [.cutover.json]
Release checklist and site event2026-10-28T03:32:18Z (status complete · site event 244 · steps grade a verified done · release tag promoted done · cosign signed done · release evidence recorded done · contract gate passed done · archive published done · hub readme live done · reproducibility recorded done · defects ledger published done · catalog available done · build request fulfilled done · seo regenerated skipped · site catalogue refreshed done · site grade recorded done · site queue synced done · customer requests charged done · owners notified done) [deliverables/provenance/RELEASE_CHECKLIST.json, run_at]

Packages and CPU level

Fully recorded

Packages in the image27 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 62 · probed 2026-11-02T17:14:29Z · source backfill) [release_images, isa_level_hard]

History

1 event

2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records

Records

25 records

Record	Where it is	Rows
`docs/defects/defects.json`	inside the archive (ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.tar.gz)	—
`docs/provenance/IMAGE_EVIDENCE.json`	inside the archive (ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.tar.gz)	—
`docs/provenance/LOCKED_DIGEST.txt`	inside the archive (ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.tar.gz)	—
`docs/provenance/REPRO_VERIFICATION.json`	inside the archive (ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.tar.gz)	—
`docs/provenance/SOURCE_TREE_HASH.json`	inside the archive (ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.tar.gz)	—
`.cutover.json`	beside the archive (prodasset /data/production/nats/v2.15.2-CE-ubuntu24.04-r2/)	—
`MANIFEST.json`	beside the archive (prodasset /data/production/nats/v2.15.2-CE-ubuntu24.04-r2/)	—
`PUBLISH_MANIFEST.json`	beside the archive (prodasset /data/production/nats/v2.15.2-CE-ubuntu24.04-r2/)	—
`ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.rebuild.json`	beside the archive (prodasset /data/production/nats/v2.15.2-CE-ubuntu24.04-r2/)	—
`ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.rebuild.json.sigstore`	beside the archive (prodasset /data/production/nats/v2.15.2-CE-ubuntu24.04-r2/)	—
`SCOUT_EVIDENCE.json`	beside the archive (prodasset /data/production/nats/v2.15.2-CE-ubuntu24.04-r2/)	—
`clean-room rebuild ledger`	the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)	—
`build_requests`	sadb, ReadyStack's engine database (not published)	440
`chains`	sadb, ReadyStack's engine database (not published)	743
`defects`	sadb, ReadyStack's engine database (not published)	nats v2.15.2-CE-ubuntu24.04-r2
`drive_runs`	sadb, ReadyStack's engine database (not published)	chain 743
`held_rounds`	sadb, ReadyStack's engine database (not published)	chain 743
`image_scans`	sadb, ReadyStack's engine database (not published)	1367
`micro_step_runs`	sadb, ReadyStack's engine database (not published)	chain 743
`release_images`	sadb, ReadyStack's engine database (not published)	nats v2.15.2-CE-ubuntu24.04-r2
`stage_events`	sadb, ReadyStack's engine database (not published)	chain 743
`stage_runs`	sadb, ReadyStack's engine database (not published)	chain 743
`attestations.json`	the chain's workspace on the controller (not published)	—
`deliverables/provenance/PROMOTION_RECORD.json`	the chain's workspace on the controller (not published)	—
`deliverables/provenance/RELEASE_CHECKLIST.json`	the chain's workspace on the controller (not published)	—