NATS v2.15.3-CE-ubuntu24.04-r3 build trail

How ReadyStack built readystack/nats:v2.15.3-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/nats:v2.15.3-CE-ubuntu24.04-r3
  • Index digestsha256:aad60e7b70981e88c50b88748f8d6bf390a58db8a9e67139aaffc7dea949aa73
  • linux/amd64 digestsha256:e1a9a636c99716445dd569874036da53604da1aebfdb408d8c51b86575dd31d8
  • ArchiveReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.tar.gz
  • Archive SHA-256 now9e5fd7e75f44faf27723b777cbcb3325e68cf24cdc0bf65171c3a78880d1340a
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-13T14:57:39Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.trail.json
ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.trail.jsonReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.trail.json.sigstoreReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.trail.mdNATS product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductNATS (nats) [MANIFEST.json]
  • Release tagv2.15.3-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Imagereadystack/nats:v2.15.3-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Image index digestsha256:aad60e7b70981e88c50b88748f8d6bf390a58db8a9e67139aaffc7dea949aa73 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:e1a9a636c99716445dd569874036da53604da1aebfdb408d8c51b86575dd31d8 [ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.tar.gz (bytes 462087826) [MANIFEST.json]
  • Archive sha256 at publish9e5fd7e75f44faf27723b777cbcb3325e68cf24cdc0bf65171c3a78880d1340a [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/nats-io/nats-server [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv2.15.3 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit2a9066eb57ff4aa50d8e6a979bdfbd6a8b9db251 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash5b9cc2ec65654263c7b6900c150bd7fcbc5496b880f245a3d82459e96b491718 (files 598) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:3ddaf87786716a6e745ba90254260d2050dd2719c7bc3f5c2af7e4db04a3ce54 [ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794569008 (utc 2026-11-13T11:23:28Z) [ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.4-bookworm@sha256:4fa7c968ba93f1635670522dbb01a2c78150443e1385746924566079f36570ea · platform digest sha256:fb7cceb528b47141eccd9b60bf3cbd27d5ef5f8cf5b7d338bec866da495b50dc
    • ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
    [ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.rebuild.json, engine]
  • Engine commit(s)
    • commit 22ec3083b99f4ba8ca78ae96dc5e10cca45d4f16 · dirty yes · first drive 4565
    • commit 1762e17ee8e9761d80444e254bf92fa18d39ea4a · dirty yes · first drive 4581
    • commit 22bd7fe105ce4abd921b562e7fdb46640eaaf501 · dirty yes · first drive 4588
    • commit 3472fe43f1bbcee2e45028c90861e5bdd10a4fdd · dirty yes · first drive 4601
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain1071 (created 2026-11-13T11:42:31Z · trigger customer_request · upstream version v2.15.3) [chains, chains #1071]
  • Requestbuild request #748 (rebuild) (requested at 2026-11-13T11:23:29Z · requested by kitforge-agent · version v2.15.3) [build_requests, build_requests #748]
  • Reasonrerelease agenda REVISION -> v2.15.3-CE-ubuntu24.04-r3 (decay loop, IMP-08) [build_requests, build_requests #748 request_reason]
  • Supersedesreadystack/nats:v2.15.3-CE-ubuntu24.04-r2 (chain 1012) [chains, chains #1012]

The path through the harness

Fully recorded

1 chain · 4 drives · 18 stages · 3 rewinds

Chain 1071 release · ready_to_ship

Created 2026-11-13T11:42:31Z, upstream v2.15.3, build request 748 [chains, chains #1071]

DriveStartedMinutesBuild hostHow it stopped
45652026-11-13T11:42:53Z25.3build host 2 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4565]
45812026-11-13T13:30:44Z2.7build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4581]
45882026-11-13T14:04:58Z2.8build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4588]
46012026-11-13T14:53:10Z—build host 2 publish-held not recorded [drive_runs, drive_runs #4601]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-13T11:43:04Z2026-11-13T11:43:05Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 8df814c203e0…
acquire 2026-11-13T11:43:09Z2026-11-13T11:43:10Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 89e90c09ae3b…
license_file c71d239df917…
custody_inputs 98a3020fe500…
source_tree_hash 1f9404f5720d…
source_file_manifest 864b3398b61c…
plan 2026-11-13T11:43:40Z2026-11-13T11:43:41Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report baf2c76fccbe…
input_pin_plan 1c0586220bc0…
toolchain_lock dbb8eb5a47d8…
assemble_kit 2026-11-13T11:45:15Z2026-11-13T11:45:16Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 4d8f48e84e7e…
build_recipe f5e292a500d5…
system_pinning aa8db05a9a8a…
build_offline_sh 6ab4f08a6ec7…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 99a446693e84…
verify_offline_sh 3e8184ea230c…
base_image_digests 9e1e8267e2c7…
dockerfile_offline 4d8f48e84e7e…
first_build_digest 3c6070284df2…
remediate 2026-11-13T11:45:57Z2026-11-13T11:45:58Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 6b3a31d98b52…
security_report 54f4396a86a8…
build_kit 2026-11-13T11:48:50Z2026-11-13T11:48:51Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 18737892890a…
locked_digest 62b1929d053a…
freeze_manifest 16653a7e3b5b…
offline_rebuild_transcript 244776f77bf9…
verdict 2026-11-13T11:49:18Z2026-11-13T11:49:18Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict c0f04b24f743…
publish_image 2026-11-13T11:49:47Z2026-11-13T11:49:48Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 1d000f97f3df…
promotion_record 7b2a329a1227…
boot_instance 2026-11-13T11:49:53Z2026-11-13T11:49:59Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 3d4bfd1062b4…
sbom 2026-11-13T11:50:06Z2026-11-13T11:50:07Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 97d7de944ca4…
sbom_json 5be7b37d50d0…
schema_discovery 2026-11-13T11:50:09Z2026-11-13T11:50:10Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash c6c0641213c6…
dependency_tree 574f5689a696…
table_classification 9861cf2bd975…
admin_handbook 2026-11-13T11:55:20Z2026-11-13T11:55:20Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map b372f477314d…
admin_handbook 138f38bf4738…
db_handbook 2026-11-13T11:59:11Z2026-11-13T11:59:12Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook d2b408ab3764…
seed_isolation 2cc15ca13cc7…
seed_data 2026-11-13T11:59:27Z2026-11-13T11:59:27Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 588a37a91869…
seed_cases_json a8e99c1c8437…
seed_validate 2026-11-13T11:59:30Z2026-11-13T11:59:31Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 49d0effc2210…
usecase_validate 2026-11-13T11:59:55Z2026-11-13T11:59:55Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests c3768de7ed7e…
test_results 66bffbd44110…
usecase_contract 5e11489a48b5…
finalize_docs 2026-11-13T12:04:20Z2026-11-13T12:04:20Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 8ba27d98bdf1…
release_notes 7f311e54f5ab…
api_integration_guide 92bc59fb19aa…
package_archive invalidated 2026-11-13T14:52:46Z 2026-11-13T12:08:09Z2026-11-13T14:07:46Z3
37 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 unpack_files
  • G8 scout_grade_a
  • G8 script_copies
  • G8 upgrade_check
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 8fd0b051ba62…
checksums a89c6c510ddd…
verify_md dbf2007eba82…
rebuild_md ae47cc049c24…
manifest_txt 8008b644b388…
actions_jsonl 86b620a69522…
provenance_md 095f5bec287b…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 170b452970c9…

[stage_runs]

Rewinds

  • 2026-11-13T12:30:53Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #35944]
  • 2026-11-13T13:54:05Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36197]
  • 2026-11-13T14:52:46Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36351]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-13T14:07:46Z.

78 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 06456 —
remediate2001 010381 L-A08, L-038, L-036, L-034, L-032
admin_handbook26803 1126069 —
db_handbook21302 097435 —
usecase_validate1001 01942 —
finalize_docs26503 0115962 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $3.30 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-13T12:09:08Z 037 findings to repackage [held_rounds, held_rounds #1872] $1.10 3 rounds, $40.00 59b2c7941a02…
22026-11-13T13:34:06Z 014 findings to repackage [held_rounds, held_rounds #1880] $1.20 3 rounds, $40.00 a72cea392242…
32026-11-13T14:08:23Z 003 clean to publish [held_rounds, held_rounds #1884] $1.00 3 rounds, $40.00 8fd0b051ba62…

Defects

Fully recorded
  • Ledger entries19 [defects, defects where product_slug=nats and this tag or chain]
  • Disclosed in the archive19 [docs/defects/defects.json, entries]

19 ledger entries: by severity medium 1, high 4, low 14; by status open 1, fixed-before-release 18.

DefectSeverityStatusFound byFixed in
RSD-nats-be6c6281b3
Unauthenticated HTTP monitoring port 8222 by default [defects, defects #280238]		mediumopenbuild strategy record—
RSD-nats-a4f3bd0f8a
Database handbook: Credential-change procedure as written does not change the password. [defects, defects #280419]		highfixed-before-releaseheld review (review model)—
RSD-nats-efb4211e3d
Database handbook: False statement about the runtime user/privileges: nothing in the container ever runs as root. [defects, defects #280420]		highfixed-before-releaseheld review (review model)—
RSD-nats-b863655890
Admin handbook: The documented verification command prints empty values; contradicts DB handbook. [defects, defects #280421]		highfixed-before-releaseheld review (review model)—
RSD-nats-f312ffda0c
Admin handbook: Wrong explanation of the default. [defects, defects #280422]		lowfixed-before-releaseheld review (review model)—
RSD-nats-0459a659d7
Admin handbook: Unsupported way of passing a configuration. [defects, defects #280423]		lowfixed-before-releaseheld review (review model)—
RSD-nats-e673865276
Database handbook: No 'secrets file' exists. [defects, defects #280424]		lowfixed-before-releaseheld review (review model)—
RSD-nats-305a95277a
Database handbook: Cross-section contradiction. [defects, defects #280425]		lowfixed-before-releaseheld review (review model)—
RSD-nats-5be834728b
API guide: HEALTHCHECK does not call /jsz. [defects, defects #280426]		lowfixed-before-releaseheld review (review model)—
RSD-nats-0bc60e3091
API guide: Cross-section contradiction. [defects, defects #280427]		lowfixed-before-releaseheld review (review model)—
RSD-nats-1d29894b93
API guide: Dangling cross-reference. [defects, defects #280428]		lowfixed-before-releaseheld review (review model)—
RSD-nats-a51df68fd0
Database handbook: False statement about exposure of the unauthenticated monitoring port; contradicts the Health Checking section of the same handbook (line 321) and the admin handbook (line 326). [defects, defects #281714]		highfixed-before-releaseheld review (review model)—
RSD-nats-792b7632af
Database handbook: The nats CLI speaks the NATS protocol on 4222 and does not query the HTTP monitoring endpoints; in the rewritten Health Checking section. [defects, defects #281715]		lowfixed-before-releaseheld review (review model)—
RSD-nats-206d9242d9
Database handbook: NATS_USER is not required; the entrypoint defaults it to nats (and the same handbook says so two lines earlier). [defects, defects #281716]		lowfixed-before-releaseheld review (review model)—
RSD-nats-0df2d98b7e
API guide: `nats server info` queries the system account's $SYS.REQ.SERVER.* subjects; this image's only client user is in the global account, so nothing answers. [defects, defects #281717]		lowfixed-before-releaseheld review (review model)—
RSD-nats-0b80bd74c5
Admin handbook: Implies an unpublished port is reachable only through docker exec; contradicts ADMIN_HANDBOOK.md:326. [defects, defects #281718]		lowfixed-before-releaseheld review (review model)—
RSD-nats-3da2a7b9c9
Admin handbook: Self-contradictory instruction: it first says the nats CLI speaks the NATS protocol on 4222, then tells the reader to connect to the 4222 NATS URL to query the HTTP monitoring endpoints on 8222. [defects, defects #283019]		lowfixed-before-releaseheld review (review model)—
RSD-nats-81228a1c71
Admin handbook: Broken heading: the section title 'Offline Build and Verification' is body text under an empty '##'. [defects, defects #283020]		lowfixed-before-releaseheld review (review model)—
RSD-nats-948bd8ce1b
Database handbook: Broken heading: the JetStream section (data storage, backup and restore) has an empty '##' heading and no Table of Contents entry. [defects, defects #283021]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:e1a9a636c99716445dd569874036da53604da1aebfdb408d8c51b86575dd31d8 · published digest sha256:e1a9a636c99716445dd569874036da53604da1aebfdb408d8c51b86575dd31d8 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 75) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T14:53:31Z · failing Docker Scout counts 11 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T14:53:21Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3856337824 · transparency-log entry · integrated 2026-11-13T14:55:58Z) [ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:aad60e7b70981e88c50b88748f8d6bf390a58db8a9e67139aaffc7dea949aa73 · state attached · log index 3856339527 · transparency-log entry
    • kind sbom · digest sha256:aad60e7b70981e88c50b88748f8d6bf390a58db8a9e67139aaffc7dea949aa73 · state attached · log index 3856341662 · transparency-log entry
    • kind vsa · digest sha256:aad60e7b70981e88c50b88748f8d6bf390a58db8a9e67139aaffc7dea949aa73 · state attached · log index 3856344631 · transparency-log entry
    • kind provenance · digest sha256:e1a9a636c99716445dd569874036da53604da1aebfdb408d8c51b86575dd31d8 · state attached · log index 3856346910 · transparency-log entry
    • kind sbom · digest sha256:e1a9a636c99716445dd569874036da53604da1aebfdb408d8c51b86575dd31d8 · state attached · log index 3856349291 · transparency-log entry
    • kind vsa · digest sha256:e1a9a636c99716445dd569874036da53604da1aebfdb408d8c51b86575dd31d8 · state attached · log index 3856353091 · transparency-log entry
    (at 2026-11-13T14:55:59Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/nats/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-13T12:09:12Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:e1a9a636c99716445dd569874036da53604da1aebfdb408d8c51b86575dd31d8 [clean-room rebuild ledger, runs[829]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-13T11:49:48Z [stage_runs, stage_runs chain 1071 stage publish_image]
  • Archive manifests written2026-11-13T14:54:55Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 62 · probed 2026-11-13T11:47:16Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-13T14:57:39Z generated: by KitForge release/build_trail.py · generator commit 3472fe43f1bbcee2e45028c90861e5bdd10a4fdd
  • 2026-11-13T14:59:00Z publication: promoted at 2026-11-13T14:58:21Z · promoted digest sha256:aad60e7b70981e88c50b88748f8d6bf390a58db8a9e67139aaffc7dea949aa73 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 548 · checklist status complete · checklist at 2026-11-13T14:59:00Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/nats/v2.15.3-CE-ubuntu24.04-r3/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/nats/v2.15.3-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.rebuild.jsonbeside the archive (prodasset /data/production/nats/v2.15.3-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-nats-v2.15.3-CE-ubuntu24.04-r3.rebuild.json.sigstorebeside the archive (prodasset /data/production/nats/v2.15.3-CE-ubuntu24.04-r3/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/nats/v2.15.3-CE-ubuntu24.04-r3/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)748
chainssadb, ReadyStack's engine database (not published)1071
defectssadb, ReadyStack's engine database (not published)nats v2.15.3-CE-ubuntu24.04-r3
drive_runssadb, ReadyStack's engine database (not published)chain 1071
held_roundssadb, ReadyStack's engine database (not published)chain 1071
lesson_recallssadb, ReadyStack's engine database (not published)chain 1071
micro_step_runssadb, ReadyStack's engine database (not published)chain 1071
release_imagessadb, ReadyStack's engine database (not published)nats v2.15.3-CE-ubuntu24.04-r3
stage_eventssadb, ReadyStack's engine database (not published)chain 1071
stage_runssadb, ReadyStack's engine database (not published)chain 1071
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—