NATS v2.15.3-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/nats:v2.15.3-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/nats:v2.15.3-CE-ubuntu24.04-r2
  • Index digestsha256:b8603961daf529a3fee7bf8659727e4d861a1a5ded216ed54c331f9cbca67e69
  • linux/amd64 digestsha256:8f0823326363ad4b43d6d3a76d9d87a3bcff63fd730d9eafc639ebfa80e56c6a
  • ArchiveReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 nowe175743cac6c121ea1ebc9b9920833dfec6b58424d7cde3859c63a46d9991e20
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-12T13:47:01Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.trail.json
ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.trail.jsonReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.trail.mdNATS product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductNATS (nats) [MANIFEST.json]
  • Release tagv2.15.3-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/nats:v2.15.3-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:b8603961daf529a3fee7bf8659727e4d861a1a5ded216ed54c331f9cbca67e69 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:8f0823326363ad4b43d6d3a76d9d87a3bcff63fd730d9eafc639ebfa80e56c6a [ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.tar.gz (bytes 462089009) [MANIFEST.json]
  • Archive sha256 at publishe175743cac6c121ea1ebc9b9920833dfec6b58424d7cde3859c63a46d9991e20 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/nats-io/nats-server [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv2.15.3 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit2a9066eb57ff4aa50d8e6a979bdfbd6a8b9db251 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash5b9cc2ec65654263c7b6900c150bd7fcbc5496b880f245a3d82459e96b491718 (files 598) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:470ab66d76f155f5332985cd1b4d821160ebdd367eadb48e0e15017e9f994430 [ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794473311 (utc 2026-11-12T08:48:31Z) [ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.4-bookworm@sha256:4fa7c968ba93f1635670522dbb01a2c78150443e1385746924566079f36570ea · platform digest sha256:fb7cceb528b47141eccd9b60bf3cbd27d5ef5f8cf5b7d338bec866da495b50dc
    • ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
    [ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit 90a06a5887bb1d16e24cf824619264064842b72d · dirty yes · first drive 4382
    • commit 27badbefbe8aac72eb90e98ea8f843a03c177b52 · dirty yes · first drive 4426
    • commit d439f5fb4e2900022d4c2b52cfcb9e9af8fcc20a · dirty yes · first drive 4430
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain1012 (created 2026-11-12T09:02:14Z · trigger customer_request · upstream version v2.15.3) [chains, chains #1012]
  • Requestbuild request #733 (rebuild) (requested at 2026-11-12T08:48:33Z · requested by kitforge-agent · version v2.15.3) [build_requests, build_requests #733]
  • Reasonrevision v2.15.3-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #733 request_reason]
  • Supersedesreadystack/nats:v2.15.3-CE-ubuntu24.04-r1 (chain 988) [chains, chains #988]

The path through the harness

Fully recorded

1 chain · 3 drives · 18 stages · 2 rewinds

Chain 1012 release · ready_to_ship

Created 2026-11-12T09:02:14Z, upstream v2.15.3, build request 733 [chains, chains #1012]

DriveStartedMinutesBuild hostHow it stopped
43822026-11-12T09:02:33Z28.8build host 1 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4382]
44262026-11-12T13:19:52Z2.5build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4426]
44302026-11-12T13:43:07Z—build host 1 publish-held not recorded [drive_runs, drive_runs #4430]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-12T09:02:43Z2026-11-12T09:02:44Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 4f2a01e58c52…
acquire 2026-11-12T09:02:48Z2026-11-12T09:02:49Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 89e90c09ae3b…
license_file c71d239df917…
custody_inputs 98a3020fe500…
source_tree_hash 1f9404f5720d…
source_file_manifest 864b3398b61c…
plan 2026-11-12T09:03:13Z2026-11-12T09:03:13Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 7c72972b222e…
input_pin_plan 1131c02680ac…
toolchain_lock 6d530861a27f…
assemble_kit 2026-11-12T09:04:55Z2026-11-12T09:04:56Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile de4676f9d49d…
build_recipe eb8e49abc078…
system_pinning aa8db05a9a8a…
build_offline_sh 6ab4f08a6ec7…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health a997f9b17459…
verify_offline_sh 3e8184ea230c…
base_image_digests 9e1e8267e2c7…
dockerfile_offline de4676f9d49d…
first_build_digest 4ca6af7716aa…
remediate 2026-11-12T09:05:24Z2026-11-12T09:05:25Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 534085aa4b89…
security_report 9992671ef076…
build_kit 2026-11-12T09:08:05Z2026-11-12T09:08:06Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp ae069e99eac7…
locked_digest ab9fc01015f2…
freeze_manifest fef736e7e461…
offline_rebuild_transcript 5a352dabb3dd…
verdict 2026-11-12T09:08:33Z2026-11-12T09:08:34Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict fab23017ee32…
publish_image 2026-11-12T09:09:03Z2026-11-12T09:09:04Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 6df659278f20…
promotion_record 3179a017ad3e…
boot_instance 2026-11-12T09:09:09Z2026-11-12T09:09:14Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 430cab4886fe…
sbom 2026-11-12T09:09:21Z2026-11-12T09:09:22Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md d94bb186ced5…
sbom_json 658d13f116d8…
schema_discovery 2026-11-12T09:09:24Z2026-11-12T09:09:25Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash c6c0641213c6…
dependency_tree 574f5689a696…
table_classification 9861cf2bd975…
admin_handbook 2026-11-12T09:13:32Z2026-11-12T09:13:33Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map b372f477314d…
admin_handbook e30f1f6991f4…
db_handbook 2026-11-12T09:18:09Z2026-11-12T09:18:10Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 1c2594e6b34e…
seed_isolation 2cc15ca13cc7…
seed_data 2026-11-12T09:18:26Z2026-11-12T09:18:27Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 588a37a91869…
seed_cases_json 91c8f80d11b3…
seed_validate 2026-11-12T09:18:30Z2026-11-12T09:18:30Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract b7e65d430d29…
usecase_validate 2026-11-12T09:18:56Z2026-11-12T09:18:57Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 6b1727295ae8…
test_results 0a59a706ee19…
usecase_contract a8d053d7f361…
finalize_docs 2026-11-12T09:26:17Z2026-11-12T09:26:18Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json cac07bf65cf7…
release_notes 8a55c7ac5b77…
api_integration_guide 295c109dced6…
package_archive invalidated 2026-11-12T13:42:42Z 2026-11-12T09:31:20Z2026-11-12T13:22:23Z2
37 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 unpack_files
  • G8 scout_grade_a
  • G8 script_copies
  • G8 upgrade_check
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar aff9ffd1e7c5…
checksums a5f6ab6c3454…
verify_md 8f69ba64a035…
rebuild_md 602563d6390e…
manifest_txt 84809b21b267…
actions_jsonl d918c49d6a30…
provenance_md 79e23dc5d1d7…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 681fbddeea2a…

[stage_runs]

Rewinds

  • 2026-11-12T09:57:37Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33454]
  • 2026-11-12T13:42:42Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33876]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-12T13:22:23Z.

81 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 05778 L-A183, L-A15
remediate2001 05812 L-A183, L-A15
admin_handbook22403 1120889 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook22303 0122122 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate1001 02015 L-A59
finalize_docs32903 2175524 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $2.57 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-12T09:31:48Z 0521 findings to repackage [held_rounds, held_rounds #1803] $1.25 3 rounds, $40.00 df0f971a12e1…
22026-11-12T13:22:40Z 007 clean to publish [held_rounds, held_rounds #1817] $1.31 3 rounds, $40.00 aff9ffd1e7c5…

Defects

Fully recorded
  • Ledger entries33 [defects, defects where product_slug=nats and this tag or chain]
  • Disclosed in the archive33 [docs/defects/defects.json, entries]

33 ledger entries: by severity medium 1, high 5, low 27; by status open 1, fixed-before-release 32.

DefectSeverityStatusFound byFixed in
RSD-nats-fb215d474f
Unauthenticated HTTP monitoring port 8222 by default [defects, defects #263986]		mediumopenbuild strategy record—
RSD-nats-0ce68e0f7c
Admin handbook: Ran `docker run -d --name jt-ha1012-m --env-file p.env <image> --max_connections 10000`: container 'Exited (0) 3 seconds ago', logs 'flag provided but not defined: -max_connections' followed by the… [defects, defects #265107]		highfixed-before-releaseheld review (review model)—
RSD-nats-7ee8205803
Admin handbook: Ran `docker run -d --name jt-ha1012-m --env-file p.env <image> --max_connections 10000`: container 'Exited (0) 3 seconds ago', logs 'flag provided but not defined: -max_connections' followed by the… [defects, defects #265108]		highfixed-before-releaseheld review (review model)—
RSD-nats-02c57b3a70
Admin handbook: Ran with the documented mapping: the server listens on 8222 only (/etc/nats/nats-server.conf `http: 0.0.0.0:8222`; the image exposes 4222 and 8222, IMAGE_CONFIG.json ExposedPorts), so nothing… [defects, defects #265109]		highfixed-before-releaseheld review (review model)—
RSD-nats-ab2ef77a3b
Admin handbook: Ran with the documented mapping: the server listens on 8222 only (/etc/nats/nats-server.conf `http: 0.0.0.0:8222`; the image exposes 4222 and 8222, IMAGE_CONFIG.json ExposedPorts), so nothing… [defects, defects #265110]		highfixed-before-releaseheld review (review model)—
RSD-nats-2e0004b064
API guide: The monitoring listener is 0.0.0.0:8222 inside the container (same sentence); `-p 8222:8888` maps host 8222 to container port 8888, where nothing listens. [defects, defects #265111]		highfixed-before-releaseheld review (review model)—
RSD-nats-11c0f6f1df
Admin handbook: The next sentence in the same paragraph says the opposite ('remains accessible from the Docker host and from containers on the same Docker network'). [defects, defects #265112]		lowfixed-before-releaseheld review (review model)—
RSD-nats-97217238fd
Admin handbook: Measured: container started WITHOUT -p; from the Docker host `curl http://172.17.0.3:8222/healthz` (container bridge IP) -> {"status":"ok"}. [defects, defects #265113]		lowfixed-before-releaseheld review (review model)—
RSD-nats-7c08f6211d
Database handbook: Measured: container started WITHOUT -p; from the Docker host `curl http://172.17.0.3:8222/healthz` (container bridge IP) -> {"status":"ok"}. [defects, defects #265114]		lowfixed-before-releaseheld review (review model)—
RSD-nats-35bd1242fe
Database handbook: Measured: container started WITHOUT -p; from the Docker host `curl http://172.17.0.3:8222/healthz` (container bridge IP) -> {"status":"ok"}. [defects, defects #265115]		lowfixed-before-releaseheld review (review model)—
RSD-nats-ef955a97d4
API guide: Measured: container started WITHOUT -p; from the Docker host `curl http://172.17.0.3:8222/healthz` (container bridge IP) -> {"status":"ok"}. [defects, defects #265116]		lowfixed-before-releaseheld review (review model)—
RSD-nats-161dcfeac6
API guide: Measured: container started WITHOUT -p; from the Docker host `curl http://172.17.0.3:8222/healthz` (container bridge IP) -> {"status":"ok"}. [defects, defects #265117]		lowfixed-before-releaseheld review (review model)—
RSD-nats-082c5220bf
Database handbook: Measured: `GET /accountz` returned only {"server_id","now","system_account":"$SYS","accounts":["$SYS","$G"]} - account names, no users, counts, usage or limits. [defects, defects #265118]		lowfixed-before-releaseheld review (review model)—
RSD-nats-5e157573e2
Database handbook: Measured: `GET /accountz` returned only {"server_id","now","system_account":"$SYS","accounts":["$SYS","$G"]} - account names, no users, counts, usage or limits. [defects, defects #265119]		lowfixed-before-releaseheld review (review model)—
RSD-nats-0527a61793
API guide: Measured: `GET /accountz` returned only {"server_id","now","system_account":"$SYS","accounts":["$SYS","$G"]} - account names, no users, counts, usage or limits. [defects, defects #265120]		lowfixed-before-releaseheld review (review model)—
RSD-nats-b820cc925e
API guide: Listed twice in succession (API_INTEGRATION_GUIDE.md:213-214). [defects, defects #265121]		lowfixed-before-releaseheld review (review model)—
RSD-nats-71cfca89fc
Database handbook: Measured with stream s1 present (3 messages): `GET /jsz?streams=true&accounts=true` returned account_details[0].stream_detail:[{"name":"s1",...,"state":{"messages":3,...}}]. [defects, defects #265122]		lowfixed-before-releaseheld review (review model)—
RSD-nats-07d0944c7f
API guide: Measured with stream s1 present (3 messages): `GET /jsz?streams=true&accounts=true` returned account_details[0].stream_detail:[{"name":"s1",...,"state":{"messages":3,...}}]. [defects, defects #265123]		lowfixed-before-releaseheld review (review model)—
RSD-nats-230d1f2909
API guide: Measured with stream s1 present (3 messages): `GET /jsz?streams=true&accounts=true` returned account_details[0].stream_detail:[{"name":"s1",...,"state":{"messages":3,...}}]. [defects, defects #265124]		lowfixed-before-releaseheld review (review model)—
RSD-nats-939d6d794e
API guide: The image has no nats CLI (IMAGE_BINARIES.txt lists only nats-server, rs-probe and shell utilities; stated at API_INTEGRATION_GUIDE.md:132, 740 and the Operating facts), so `docker exec` cannot run… [defects, defects #265125]		lowfixed-before-releaseheld review (review model)—
RSD-nats-41ba604c21
Database handbook: `nats` is natscli, not a tool of nats-server; the same handbook says so at DB_HANDBOOK.md:167 and 604. [defects, defects #265126]		lowfixed-before-releaseheld review (review model)—
RSD-nats-e41079a0c4
Database handbook: Contradicts the same paragraph (it writes JetStream state to /data) and DB_HANDBOOK.md:71/545: JetStream state persists in /data/jetstream. [defects, defects #265127]		lowfixed-before-releaseheld review (review model)—
RSD-nats-c6842a5b26
Admin handbook: Measured: `docker run --rm --entrypoint nats-server <image> --help` works without -c, and nats-server starts without a configuration; -c is not required (it is needed only to use a file). [defects, defects #265128]		lowfixed-before-releaseheld review (review model)—
RSD-nats-f93942d12c
Admin handbook: Measured: `docker run --rm --entrypoint sh <image>` returned rc=0 immediately with no output (no stdin, no tty); an interactive shell needs -it. [defects, defects #265129]		lowfixed-before-releaseheld review (review model)—
RSD-nats-3e0b4f21df
Admin handbook: Measured: `docker run --rm --entrypoint sh <image>` returned rc=0 immediately with no output (no stdin, no tty); an interactive shell needs -it. [defects, defects #265130]		lowfixed-before-releaseheld review (review model)—
RSD-nats-cee04f61ed
Admin handbook: Measured: a my.conf of mode 600 (typical editor/umask 077 result) mounted `-v $PWD/my.conf:/etc/nats/my.conf:ro` -> container 'Exited (1)', 'nats-server: open /etc/nats/my.conf: permission denied'. [defects, defects #265131]		lowfixed-before-releaseheld review (review model)—
RSD-nats-67192396ca
Database handbook: BUILD_OFFLINE.sh:144-150: the digest in REBUILT_DIGEST.txt is read from the OCI export; rebuilt.docker.tar is 'the same build, emitted in the one format docker load accepts'. [defects, defects #265132]		lowfixed-before-releaseheld review (review model)—
RSD-nats-1cc06c6855
Admin handbook: Custom-configuration command omits that the file must be readable by uid 999 (round-1 finding only fixed in the API guide). [defects, defects #269156]		lowfixed-before-releaseheld review (review model)—
RSD-nats-613c5fe711
API guide: Self-contradictory key-permission rule. [defects, defects #269157]		lowfixed-before-releaseheld review (review model)—
RSD-nats-9275c3653a
API guide: Response body shown with backslash-escaped quotes. [defects, defects #269158]		lowfixed-before-releaseheld review (review model)—
RSD-nats-736ebca805
Database handbook: Unsupported minimum-version claim. [defects, defects #269159]		lowfixed-before-releaseheld review (review model)—
RSD-nats-ca956331f7
Database handbook: Syntax-check command cannot read the host file without a mount. [defects, defects #269160]		lowfixed-before-releaseheld review (review model)—
RSD-nats-9a71b0db2b
API guide: Command does not check the process it says it checks. [defects, defects #269161]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:8f0823326363ad4b43d6d3a76d9d87a3bcff63fd730d9eafc639ebfa80e56c6a · published digest sha256:8f0823326363ad4b43d6d3a76d9d87a3bcff63fd730d9eafc639ebfa80e56c6a · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 73) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T13:43:29Z · failing Docker Scout counts 11 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T13:43:19Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3833542630 · transparency-log entry · integrated 2026-11-12T13:45:50Z) [ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:b8603961daf529a3fee7bf8659727e4d861a1a5ded216ed54c331f9cbca67e69 · state attached · log index 3833544043 · transparency-log entry
    • kind sbom · digest sha256:b8603961daf529a3fee7bf8659727e4d861a1a5ded216ed54c331f9cbca67e69 · state attached · log index 3833545193 · transparency-log entry
    • kind vsa · digest sha256:b8603961daf529a3fee7bf8659727e4d861a1a5ded216ed54c331f9cbca67e69 · state attached · log index 3833547636 · transparency-log entry
    • kind provenance · digest sha256:8f0823326363ad4b43d6d3a76d9d87a3bcff63fd730d9eafc639ebfa80e56c6a · state attached · log index 3833549648 · transparency-log entry
    • kind sbom · digest sha256:8f0823326363ad4b43d6d3a76d9d87a3bcff63fd730d9eafc639ebfa80e56c6a · state attached · log index 3833550548 · transparency-log entry
    • kind vsa · digest sha256:8f0823326363ad4b43d6d3a76d9d87a3bcff63fd730d9eafc639ebfa80e56c6a · state attached · log index 3833552317 · transparency-log entry
    (at 2026-11-12T13:45:51Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/nats/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-12T09:31:53Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:8f0823326363ad4b43d6d3a76d9d87a3bcff63fd730d9eafc639ebfa80e56c6a [clean-room rebuild ledger, runs[782]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-12T09:09:04Z [stage_runs, stage_runs chain 1012 stage publish_image]
  • Archive manifests written2026-11-12T13:44:46Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 62 · probed 2026-11-12T09:06:37Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-12T13:47:01Z generated: by KitForge release/build_trail.py · generator commit d439f5fb4e2900022d4c2b52cfcb9e9af8fcc20a
  • 2026-11-12T13:48:08Z publication: promoted at 2026-11-12T13:47:31Z · promoted digest sha256:b8603961daf529a3fee7bf8659727e4d861a1a5ded216ed54c331f9cbca67e69 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 509 · checklist status complete · checklist at 2026-11-12T13:48:08Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/nats/v2.15.3-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/nats/v2.15.3-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/nats/v2.15.3-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/nats/v2.15.3-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/nats/v2.15.3-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)733
chainssadb, ReadyStack's engine database (not published)1012
defectssadb, ReadyStack's engine database (not published)nats v2.15.3-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 1012
held_roundssadb, ReadyStack's engine database (not published)chain 1012
lesson_recallssadb, ReadyStack's engine database (not published)chain 1012
micro_step_runssadb, ReadyStack's engine database (not published)chain 1012
release_imagessadb, ReadyStack's engine database (not published)nats v2.15.3-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 1012
stage_runssadb, ReadyStack's engine database (not published)chain 1012
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—